nixamp 0.27.1 → 0.27.3

package/dist/translation-passes.js

@@ -2,6 +2,7 @@
  * each listening account reserves 5x base provider cost for paid access. */
 import { randomUUID } from "node:crypto";
 import { SpeechError } from "./speech.js";
+import { UpgradeAllowances } from "./upgrade-allowance.js";
 export const TRANSLATION_MULTIPLIER = 5;
 export const TRANSLATION_PLANS = [
     { id: "day", name: "Day", days: 1, priceCents: 500 },
@@ -40,13 +41,16 @@ export class TranslationPasses {
     merchantUntil = 0;
     fetcher;
     now;
+    free;
     constructor(options) {
         this.options = options;
         this.fetcher = options.fetcher ?? fetch;
         this.now = options.now ?? Date.now;
+        this.free = new UpgradeAllowances(options.db, this.now);
     }
     async ensure() {
         this.schema ??= (async () => {
+            await this.free.ensure();
             await this.options.db.query(`CREATE TABLE IF NOT EXISTS translation_wallets (
         by_account TEXT PRIMARY KEY, balance_micros BIGINT NOT NULL CHECK (balance_micros >= 0), expires_at TIMESTAMPTZ NOT NULL)`);
             await this.options.db.query(`CREATE TABLE IF NOT EXISTS translation_orders (
@@ -93,41 +97,48 @@ export class TranslationPasses {
         const row = by ? (await this.options.db.query("SELECT balance_micros, expires_at FROM translation_wallets WHERE by_account = $1 AND expires_at > $2", [by, new Date(this.now())])).rows[0] : null;
         const orders = by ? (await this.options.db.query("SELECT id, payment_id, plan FROM translation_orders WHERE by_account = $1 AND status = 'pending' AND payment_id IS NOT NULL ORDER BY created_at DESC LIMIT 5", [by])).rows.map(order => ({ id: String(order["id"]), plan: String(order["plan"]), url: `https://coinpayportal.com/pay/${order["payment_id"]}` })) : [];
         return { required: true, available: config.coins.length > 0, balanceMicros: Number(row?.["balance_micros"] ?? 0),
-            expires: row ? new Date(String(row["expires_at"])).toISOString() : null, plans: TRANSLATION_PLANS, coins: config.coins, orders,
+            expires: row ? new Date(String(row["expires_at"])).toISOString() : null, plans: TRANSLATION_PLANS, coins: config.coins, orders, free: await this.free.access(by),
             rates: { transcriptionHour: 0.22, voiceThousand: 0.05, multiplier: TRANSLATION_MULTIPLIER } };
     }
-    async require(by) {
+    async begin(by, resource) {
         await this.ensure();
+        if (await this.free.begin(by, "translation", resource))
+            return;
+        await this.require(by, resource);
+    }
+    async require(by, resource = "") {
+        await this.ensure();
+        if ((await this.free.active([by], "translation", resource, true)).length)
+            return;
         const found = await this.options.db.query("SELECT by_account FROM translation_wallets WHERE by_account = $1 AND expires_at > $2 AND balance_micros > 0", [by, new Date(this.now())]);
         if (!found.rows.length)
-            throw new SpeechError("Buy a translation pass to enable translated audio.", 402);
+            throw new SpeechError("Buy a pass or start a remaining free session: this session has no free time or audio credit.", 402);
     }
-    async eligible(accounts) {
+    async eligible(accounts, resource = "") {
         await this.ensure();
         const result = await this.options.db.query("SELECT by_account FROM translation_wallets WHERE by_account = ANY($1::text[]) AND expires_at > $2 AND balance_micros > 0", [accounts, new Date(this.now())]);
-        return result.rows.map(row => String(row["by_account"]));
+        return [...new Set([...result.rows.map(row => String(row["by_account"])), ...await this.free.active(accounts, "translation", resource, true)])];
     }
-    async reserve(by, kind, units) {
-        await this.ensure();
-        const { cost, charge } = translationCost(kind, units), id = randomUUID();
-        const result = await this.options.db.query(`WITH debit AS (
-      UPDATE translation_wallets SET balance_micros = balance_micros - $2
-      WHERE by_account = $1 AND expires_at > $3 AND balance_micros >= $2 RETURNING by_account)
-      INSERT INTO translation_usage (id, by_account, kind, units, cost_micros, charge_micros, created_at)
-      SELECT $4, by_account, $5, $6, $7, $2, $3 FROM debit RETURNING id`, [by, charge, new Date(this.now()), id, kind, units, cost]);
-        if (!result.rows.length)
-            throw new SpeechError("Your translation balance is used up or expired. Buy another pass to continue.", 402);
-        return id;
+    async reserve(by, kind, units, resource = "") {
+        const result = await this.reserveMany([by], kind, units, resource);
+        if (!result.length)
+            throw new SpeechError("This free session ended and audio credit is used up. Start a remaining free session or buy a pass.", 402);
+        return result[0].id;
     }
     /** Batch a shared stream's access charges in one database round trip. */
-    async reserveMany(accounts, kind, units) {
+    async reserveMany(accounts, kind, units, resource = "") {
         await this.ensure();
         const { cost, charge } = translationCost(kind, units);
-        const result = await this.options.db.query(`WITH debit AS (
+        const now = this.now(), key = resource ? this.free.key("translation", resource) : "";
+        const result = await this.options.db.query(`WITH free AS (
+      SELECT DISTINCT by_account FROM upgrade_daily_uses WHERE by_account = ANY($1::text[])
+        AND (sessions->>$7)::bigint > $8), debit AS (
       UPDATE translation_wallets SET balance_micros = balance_micros - $2
-      WHERE by_account = ANY($1::text[]) AND expires_at > $3 AND balance_micros >= $2 RETURNING by_account)
+      WHERE by_account = ANY($1::text[]) AND expires_at > $3 AND balance_micros >= $2
+        AND by_account NOT IN (SELECT by_account FROM free) RETURNING by_account), admitted AS (
+      SELECT by_account, 0::bigint AS charge FROM free UNION ALL SELECT by_account, $2::bigint FROM debit)
       INSERT INTO translation_usage (id, by_account, kind, units, cost_micros, charge_micros, created_at)
-      SELECT gen_random_uuid()::text, by_account, $4, $5, $6, $2, $3 FROM debit RETURNING id, by_account`, [[...new Set(accounts)], charge, new Date(this.now()), kind, units, cost]);
+      SELECT gen_random_uuid()::text, by_account, $4, $5, $6, charge, $3 FROM admitted RETURNING id, by_account`, [[...new Set(accounts)], charge, new Date(now), kind, units, cost, key, now]);
         return result.rows.map(row => ({ by: String(row["by_account"]), id: String(row["id"]) }));
     }
     async commit(id) {

package/dist/upgrade-allowance.d.ts

@@ -0,0 +1,23 @@
+import type { Queryable } from "./follows.ts";
+export declare const FREE_UPGRADE_SESSIONS = 5;
+export declare const FREE_UPGRADE_RECONNECT_SECONDS = 90;
+export interface UpgradeAllowance {
+    limit: number;
+    remaining: number;
+    reconnectSeconds: number;
+    resets: string;
+    activeUntil: string | null;
+}
+export declare class UpgradeAllowances {
+    private readonly db;
+    private readonly now;
+    private schema;
+    constructor(db: Queryable, now?: () => number);
+    ensure(): Promise<void>;
+    key(product: string, resource: string): string;
+    access(by?: string): Promise<UpgradeAllowance>;
+    /** One atomic row serializes concurrent starts across tabs, products and replicas.
+     * Active use renews a short lease. Reconnecting reuses it; idle leases expire. */
+    begin(by: string, product: string, resource: string): Promise<boolean>;
+    active(accounts: string[], product: string, resource: string, renew?: boolean): Promise<string[]>;
+}

package/dist/upgrade-allowance.js

@@ -0,0 +1,70 @@
+/** Daily free access shared by Nixamp's paid panels and upgrades.
+ * Claim only on explicit use, never from balance polling or provider chunks. */
+import { createHash } from "node:crypto";
+import { SpeechError } from "./speech.js";
+export const FREE_UPGRADE_SESSIONS = 5;
+export const FREE_UPGRADE_RECONNECT_SECONDS = 90;
+const DAY = 86_400_000;
+export class UpgradeAllowances {
+    db;
+    now;
+    schema = null;
+    constructor(db, now = Date.now) {
+        this.db = db;
+        this.now = now;
+    }
+    async ensure() {
+        this.schema ??= this.db.query(`CREATE TABLE IF NOT EXISTS upgrade_daily_uses (
+      by_account TEXT NOT NULL, day BIGINT NOT NULL,
+      uses INTEGER NOT NULL CHECK (uses BETWEEN 1 AND 5),
+      sessions JSONB NOT NULL, PRIMARY KEY (by_account, day))`).then(() => undefined)
+            .catch(error => { this.schema = null; throw error; });
+        await this.schema;
+    }
+    key(product, resource) {
+        if (!/^[a-z][a-z0-9-]{0,63}$/.test(product) || !/^[\w-]{1,80}$/.test(resource))
+            throw new SpeechError("Choose a panel session.", 400);
+        return createHash("sha256").update(`${product}|${resource}`).digest("hex");
+    }
+    async access(by) {
+        await this.ensure();
+        const now = this.now(), day = Math.floor(now / DAY);
+        const rows = by ? (await this.db.query("SELECT uses, day, sessions FROM upgrade_daily_uses WHERE by_account = $1", [by])).rows : [];
+        const today = rows.find(row => Number(row["day"]) === day);
+        const active = Math.max(0, ...rows.flatMap(row => Object.values(row["sessions"]).map(Number)));
+        return { limit: FREE_UPGRADE_SESSIONS, remaining: Math.max(0, FREE_UPGRADE_SESSIONS - Number(today?.["uses"] ?? 0)),
+            reconnectSeconds: FREE_UPGRADE_RECONNECT_SECONDS, resets: new Date((day + 1) * DAY).toISOString(), activeUntil: active > now ? new Date(active).toISOString() : null };
+    }
+    /** One atomic row serializes concurrent starts across tabs, products and replicas.
+     * Active use renews a short lease. Reconnecting reuses it; idle leases expire. */
+    async begin(by, product, resource) {
+        if (!by)
+            throw new SpeechError("Sign in to use your free sessions.", 401);
+        const key = this.key(product, resource);
+        if ((await this.active([by], product, resource, true)).length)
+            return true;
+        await this.ensure();
+        const now = this.now(), day = Math.floor(now / DAY), until = now + FREE_UPGRADE_RECONNECT_SECONDS * 1000;
+        const result = await this.db.query(`INSERT INTO upgrade_daily_uses AS daily (by_account, day, uses, sessions)
+      VALUES ($1, $2, 1, jsonb_build_object($3::text, $5::bigint))
+      ON CONFLICT (by_account, day) DO UPDATE SET
+        uses = CASE WHEN COALESCE((daily.sessions->>$3)::bigint, 0) > $4 THEN daily.uses ELSE daily.uses + 1 END,
+        sessions = daily.sessions || EXCLUDED.sessions
+      WHERE COALESCE((daily.sessions->>$3)::bigint, 0) > $4 OR daily.uses < $6
+      RETURNING uses`, [by, day, key, now, until, FREE_UPGRADE_SESSIONS]);
+        return result.rows.length > 0;
+    }
+    async active(accounts, product, resource, renew = false) {
+        if (!resource || !accounts.length)
+            return [];
+        const key = this.key(product, resource);
+        await this.ensure();
+        const now = this.now();
+        const result = renew
+            ? await this.db.query(`UPDATE upgrade_daily_uses SET sessions = sessions || jsonb_build_object($2::text, $4::bigint)
+          WHERE by_account = ANY($1::text[]) AND (sessions->>$2)::bigint > $3 RETURNING by_account`, [accounts, key, now, now + FREE_UPGRADE_RECONNECT_SECONDS * 1000])
+            : await this.db.query(`SELECT by_account FROM upgrade_daily_uses
+          WHERE by_account = ANY($1::text[]) AND (sessions->>$2)::bigint > $3`, [accounts, key, now]);
+        return result.rows.map(row => String(row["by_account"]));
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.27.1",
+  "version": "0.27.3",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",

package/src/accounts.ts

@@ -19,7 +19,8 @@
  * terminal better than either -- OAuth 2.0 reached through the device grant in
  * device.ts -- and what it ends with is a token from tokens.ts.
  */
-import { createAuthSystem, PostgresAdapter } from "@profullstack/auth-system";
+import { createAuthSystem, createPasswordUtils, PostgresAdapter } from "@profullstack/auth-system";
+import { PasswordResets } from "./password-reset.ts";
 import { Identities, type Identity, type Users } from "./oauth.ts";
 import type { Queryable } from "./follows.ts";
 import { type IssuedToken, looksLikeToken, type TokenKind, type TokenRecord, Tokens } from "./tokens.ts";
@@ -129,6 +130,7 @@ export class Accounts {
   private readonly system: AuthLike;
   /** Null only where a test injected an auth system and no storage. */
   readonly tokens: Tokens | null;
+  readonly passwordResets: PasswordResets | null;
   private readonly identities: Identities | null;
 
   constructor(options: AccountsOptions) {
@@ -151,6 +153,8 @@ export class Accounts {
         passwordOptions: { ...PASSWORD_RULES },
       }) as AuthLike);
     this.tokens = adapter ? new Tokens(adapter) : null;
+    this.passwordResets = adapter && this.tokens
+      ? new PasswordResets(adapter, this.tokens, createPasswordUtils({ ...PASSWORD_RULES })) : null;
     this.identities = adapter ? new Identities(adapter, adapter) : null;
   }
 
@@ -216,7 +220,9 @@ export class Accounts {
       }
     }
     try {
-      return readClaims(await this.system.validateToken(token));
+      const account = readClaims(await this.system.validateToken(token));
+      if (account && this.passwordResets && !(await this.passwordResets.acceptsLegacyToken(account.id, token))) return null;
+      return account;
     } catch {
       return null;
     }

package/src/classroom.ts

@@ -0,0 +1,52 @@
+/** Public classroom metadata, shared by the API and the small school client. */
+export interface ClassroomSettings {
+  broadcastUrl?: string;
+  hostName?: string;
+  homepageUrl?: string;
+  avatarUrl?: string;
+  recurrence?: "daily" | "weekly";
+}
+
+export function publicWebUrl(value: unknown): string | null {
+  if (typeof value !== "string" || value.length > 2048) return null;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:" || url.username || url.password) return null;
+    return url.href;
+  } catch { return null; }
+}
+
+export function classroomBroadcast(value: unknown): { provider: "pairux" | "nixamp"; url: string; embed: string; join: string } | null {
+  const safe = publicWebUrl(value);
+  if (!safe) return null;
+  const url = new URL(safe);
+  if (!url.port && (url.hostname === "pairux.com" || url.hostname === "www.pairux.com")) {
+    const code = /^\/(?:l|join|embed)\/([A-Za-z0-9_-]{1,64})\/?$/.exec(url.pathname)?.[1];
+    if (!code) return null;
+    return { provider: "pairux", url: `https://pairux.com/l/${code}`, embed: `https://pairux.com/embed/${code}`, join: `https://pairux.com/join/${code}` };
+  }
+  if (!url.port && (url.hostname === "nixamp.com" || url.hostname === "www.nixamp.com")) {
+    if (url.pathname !== "/") return null;
+    // Never publish an admin credential in a classroom share link.
+    const server = url.searchParams.get("url") || "";
+    // The server's Share panel supplies a viewer URL without a track selection.
+    const play = url.searchParams.get("play") || (server ? "live" : "");
+    if (/\/admin\//i.test(server) || /\/admin\//i.test(play) || url.searchParams.has("key")) return null;
+    if (server && !publicWebUrl(server)) return null;
+    if (!/^(?:live|channel:[^\s]+|track:\d+)$/.test(play) && !publicWebUrl(play)) return null;
+    const clean = new URL("https://nixamp.com/");
+    if (server) clean.searchParams.set("url", server);
+    clean.searchParams.set("play", play);
+    const original = clean.href;
+    clean.searchParams.set("embed", "1");
+    return { provider: "nixamp", url: original, embed: clean.href, join: original };
+  }
+  // A self-hosted Nixamp viewer link can be played through the shared client.
+  if (url.hostname.endsWith(".nixamp.com") && /^\/view\/[A-Za-z0-9_-]+\/?$/.test(url.pathname) && !url.search) {
+    const player = new URL("https://nixamp.com/");
+    player.searchParams.set("url", url.href);
+    player.searchParams.set("play", "live");
+    return classroomBroadcast(player.href);
+  }
+  return null;
+}

package/src/event-writer.ts

@@ -0,0 +1,126 @@
+import { Guard } from "./guard.ts";
+
+export interface EventDraft { title: string; description: string; topic: string }
+export interface WriterInput extends EventDraft {
+  hostName: string; startsAt: string; timezone: string; duration: string; recurrence: string;
+}
+export interface EventDraftResult { draft: EventDraft; provider: "openai" | "claude" }
+export class EventWriterError extends Error {
+  constructor(message: string, readonly status: number, readonly retryAfter?: number) { super(message); }
+}
+class Refused extends EventWriterError {
+  constructor() { super("The writer could not draft these notes. Try rephrasing the event details.", 422); }
+}
+
+const LIMITS = {title: 160, description: 5000, topic: 100, hostName: 100, startsAt: 40, timezone: 100, duration: 20, recurrence: 20} as const;
+export function writerInput(value: unknown): WriterInput {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new EventWriterError("Send event details as an object.", 400);
+  const source = value as Record<string, unknown>;
+  const result = {} as WriterInput;
+  for (const key of Object.keys(LIMITS) as Array<keyof WriterInput>) {
+    const field = source[key] ?? "";
+    if (typeof field !== "string" || field.length > LIMITS[key]) throw new EventWriterError(`The ${key} field is too long or is not text.`, 422);
+    result[key] = field.trim();
+  }
+  if (!result.title && !result.description && !result.topic) throw new EventWriterError("Add a title, description, or topic first, then click Write with AI.", 422);
+  return result;
+}
+
+const SCHEMA = {
+  type: "object", properties: { title: {type: "string"}, description: {type: "string"}, topic: {type: "string"} },
+  required: ["title", "description", "topic"], additionalProperties: false,
+};
+const INSTRUCTIONS = `You write useful, welcoming event details for BackToSchool.help, a live learning platform.
+Use the supplied form text as the writing prompt. Rough notes and requests in that text describe what the host wants to teach.
+Return a clear title (at most 160 characters), a description (at most 5000 characters, usually 100–250 words), and a short topic (at most 100 characters).
+Write in the language of the host's notes. Describe what students will learn and what will happen, using only information supported by the notes.
+Keep concrete names and facts. Do not invent dates, prices, qualifications, prerequisites, links, credentials, or promises. Omit unknown logistics. Do not expand into unrelated subjects.
+The schedule and host name are context only; never propose changing them. Return plain text in the required JSON fields, with no HTML. Short paragraphs or simple bullet lists are fine.`;
+
+function draftFrom(text: string): EventDraft {
+  const value: unknown = JSON.parse(text);
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid draft");
+  const row = value as Record<string, unknown>;
+  const draft = {} as EventDraft;
+  for (const key of ["title", "description", "topic"] as const) {
+    const field = row[key];
+    if (typeof field !== "string" || !field.trim() || field.length > LIMITS[key]) throw new Error("invalid draft");
+    draft[key] = field.trim();
+  }
+  return draft;
+}
+
+export interface EventWriterOptions {
+  openaiKey?: string; anthropicKey?: string;
+  openaiModel?: string; claudeModel?: string;
+  fetch?: typeof globalThis.fetch;
+  timeoutMs?: number;
+}
+
+/** Server-side only. Drafting has no access to the event store and cannot publish. */
+export class EventWriter {
+  private readonly guard = new Guard();
+  private readonly active = new Set<string>();
+  constructor(private readonly options: EventWriterOptions) {}
+
+  async draft(accountId: string, value: unknown, signal?: AbortSignal): Promise<EventDraftResult> {
+    if (!accountId) throw new EventWriterError("Sign in to use the AI writer.", 401);
+    const input = writerInput(value);
+    if (!this.options.openaiKey && !this.options.anthropicKey) throw new EventWriterError("The AI writer is temporarily unavailable. You can keep writing here.", 503);
+    if (this.active.has(accountId)) throw new EventWriterError("A draft is already being written. Wait for it or cancel it first.", 429, 5);
+    if (this.active.size >= 4) throw new EventWriterError("The AI writer is busy. Try again in a moment.", 503, 10);
+    const limit = this.guard.check(accountId, {allowed: 6, windowMs: 10 * 60_000});
+    if (!limit.ok) throw new EventWriterError("You have requested several drafts. Try again in a few minutes.", 429, limit.retryAfter);
+    this.active.add(accountId);
+    try {
+      for (const provider of ["openai", "claude"] as const) {
+        const key = provider === "openai" ? this.options.openaiKey : this.options.anthropicKey;
+        if (!key) continue;
+        if (signal?.aborted) throw new EventWriterError("Draft cancelled.", 499);
+        try {
+          const draft = await this.generate(provider, key, input, signal);
+          if (signal?.aborted) throw new EventWriterError("Draft cancelled.", 499);
+          return {draft, provider};
+        }
+        catch (error) {
+          if (signal?.aborted) throw new EventWriterError("Draft cancelled.", 499);
+          // Refusals are a response to the content, not a provider outage.
+          if (error instanceof Refused) throw error;
+          // Never log prompts, credentials, or a provider's raw response body.
+          console.warn(`nixamp: event writer ${provider} request failed`);
+        }
+      }
+      throw new EventWriterError("The AI writer could not finish this draft. Your text is unchanged; please try again.", 503);
+    } finally { this.active.delete(accountId); }
+  }
+
+  private async generate(provider: "openai" | "claude", key: string, input: WriterInput, signal?: AbortSignal): Promise<EventDraft> {
+    const timeout = AbortSignal.timeout(this.options.timeoutMs ?? 25_000);
+    const requestSignal = signal ? AbortSignal.any([signal, timeout]) : timeout;
+    const prompt = JSON.stringify(input);
+    const openai = provider === "openai";
+    const response = await (this.options.fetch ?? globalThis.fetch)(openai ? "https://api.openai.com/v1/responses" : "https://api.anthropic.com/v1/messages", {
+      method: "POST", signal: requestSignal,
+      headers: { "content-type": "application/json", ...(openai ? {authorization: `Bearer ${key}`} : {"x-api-key": key, "anthropic-version": "2023-06-01"}) },
+      body: JSON.stringify(openai ? {
+        model: this.options.openaiModel ?? "gpt-5-mini", store: false,
+        instructions: INSTRUCTIONS, input: [{role: "user", content: prompt}],
+        reasoning: {effort: "minimal"}, max_output_tokens: 2048,
+        text: {format: {type: "json_schema", name: "event_draft", strict: true, schema: SCHEMA}},
+      } : {
+        model: this.options.claudeModel ?? "claude-haiku-4-5", max_tokens: 2048,
+        system: INSTRUCTIONS, messages: [{role: "user", content: prompt}],
+        output_config: {format: {type: "json_schema", schema: SCHEMA}},
+      }),
+    });
+    if (!response.ok) { await response.body?.cancel(); throw new Error("provider unavailable"); }
+    const body = await response.json() as Record<string, unknown>;
+    const blocks = openai
+      ? (Array.isArray(body["output"]) ? body["output"].flatMap(item => item?.type === "message" && Array.isArray(item.content) ? item.content : []) : [])
+      : (Array.isArray(body["content"]) ? body["content"] : []);
+    if (body["stop_reason"] === "refusal" || blocks.some(block => block?.type === "refusal")) throw new Refused();
+    if (openai ? body["status"] !== "completed" : body["stop_reason"] !== "end_turn") throw new Error("incomplete draft");
+    const text = blocks.filter(block => block?.type === (openai ? "output_text" : "text")).map(block => typeof block.text === "string" ? block.text : "").join("");
+    return draftFrom(text);
+  }
+}

package/src/live-api.ts

@@ -1,3 +1,4 @@
+import { EventWriterError, type EventWriter } from "./event-writer.ts";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { tokenFrom, type Account, type Accounts } from "./accounts.ts";
 import {
@@ -26,6 +27,7 @@ import { HAND_RAISE_STATES, RoomError, type Rooms } from "./rooms.ts";
 
 export interface LiveApiOptions {
   events: LiveEvents;
+  eventWriter?: EventWriter;
   accounts?: Accounts;
   layouts?: Layouts;
   rooms?: Rooms;
@@ -52,13 +54,13 @@ function json(response: ServerResponse, code: number, body: unknown): void {
   response.end(value);
 }
 
-async function body(request: IncomingMessage): Promise<Record<string, unknown>> {
+async function body(request: IncomingMessage, limit = 64 * 1024): Promise<Record<string, unknown>> {
   const chunks: Buffer[] = [];
   let size = 0;
   for await (const chunk of request) {
     const buffer = chunk as Buffer;
     size += buffer.length;
-    if (size > 64 * 1024) throw new LiveEventError("body too large", 413);
+    if (size > limit) throw new LiveEventError("body too large", 413);
     chunks.push(buffer);
   }
   try {
@@ -256,6 +258,21 @@ export async function handleLiveApi(
       !path.startsWith("/api/v1/layout-presets")) return false;
 
   try {
+    if (path === "/api/v1/events/ai-draft") {
+      if (request.method !== "POST") { json(response, 405, {error: "POST only"}); return true; }
+      const account = await requiredAccount(request, response, options);
+      if (!account) return true;
+      if (!options.eventWriter) { json(response, 503, {error: "The AI writer is temporarily unavailable. You can keep writing here."}); return true; }
+      const input = await body(request, 12 * 1024);
+      const controller = new AbortController();
+      const closed = () => controller.abort();
+      response.once("close", closed);
+      try {
+        const result = await options.eventWriter.draft(account.id, input, controller.signal);
+        if (!response.destroyed) json(response, 200, result);
+      } finally { response.off("close", closed); }
+      return true;
+    }
     if (path === "/api/v1/events") {
       if (request.method === "GET") {
         const account = await signedIn(request, options.accounts);
@@ -624,6 +641,13 @@ export async function handleLiveApi(
     json(response, 404, { error: "no such endpoint" });
     return true;
   } catch (error) {
+    if (error instanceof EventWriterError) {
+      if (!response.destroyed) {
+        if (error.retryAfter) response.setHeader("retry-after", String(error.retryAfter));
+        json(response, error.status, {error: error.message});
+      }
+      return true;
+    }
     if (error instanceof LiveEventError || error instanceof LayoutError || error instanceof RoomError) {
       json(response, error.status, { error: error.message });
       return true;