nixamp 0.27.1 → 0.27.3

package/src/password-reset-page.ts

@@ -0,0 +1,108 @@
+function escape(value: string): string {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll('"', "&quot;");
+}
+
+/** A small recovery page shared by every branded client on this account server. */
+export function passwordResetPage(site: string, nonce: string): string {
+  const host = new URL(site).hostname;
+  const school = host === "backtoschool.help" || host === "www.backtoschool.help";
+  const name = school ? "BackToSchool.help" : host;
+  const home = school ? "/#live" : "/";
+  return `<!doctype html><html lang="en"><head>
+  <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="referrer" content="no-referrer"><meta name="robots" content="noindex, nofollow">
+  <title>Reset your password — ${escape(name)}</title>
+  <style>
+  :root{font-family:system-ui,sans-serif;color:#34246d;background:#f7f3e9;color-scheme:light}
+  *{box-sizing:border-box}body{margin:0}header{padding:1.25rem max(1rem,calc((100% - 960px)/2));border-bottom:1px solid #ddd5e6}
+  a{color:#34246d;text-underline-offset:3px}header a{font-weight:800;text-decoration:none}
+  main{max-width:480px;margin:clamp(2rem,8vh,5rem) auto;padding:0 1rem 3rem}
+  .card{background:#fffdf8;border:1px solid #ddd5e6;border-radius:20px;padding:clamp(1.25rem,5vw,2rem)}
+  h1{font-family:Georgia,serif;font-size:2.25rem;line-height:1.1;margin:0 0 1rem}p{line-height:1.55}
+  label{display:block;font-weight:650;margin:1.25rem 0 .5rem}input{width:100%;font:inherit;padding:.85rem;border:1px solid #8a829f;border-radius:10px;background:white;color:#211747}
+  button{width:100%;font:inherit;font-weight:700;border:0;border-radius:30px;background:#34246d;color:white;padding:.9rem 1.1rem;margin-top:1.25rem;cursor:pointer}
+  button[aria-disabled=true]{opacity:.65;cursor:wait}a:focus-visible,input:focus-visible,button:focus-visible{outline:3px solid #b14b29;outline-offset:3px}
+  .help{font-size:.9rem;color:#514961}.message:empty{display:none}.error{color:#9b202a}.success{color:#215d3d}
+  .back{display:inline-block;margin-top:1.5rem}[hidden]{display:none!important}
+  @media(forced-colors:active){.card,button{border:1px solid CanvasText}}
+  </style></head><body>
+  <header><a href="${home}">${escape(name)}</a></header>
+  <main><div class="card">
+    <h1 id="title">Forgot your password?</h1>
+    <p id="intro">Enter your account’s email address and we’ll send you a link to choose a new password.</p>
+    <form id="request-form">
+      <label for="email">Email</label><input id="email" name="email" type="email" autocomplete="email" maxlength="320" required>
+      <button type="submit">Send reset link</button>
+    </form>
+    <form id="reset-form" hidden>
+      <label for="password">New password</label><input id="password" name="password" type="password" autocomplete="new-password" minlength="8" maxlength="200" aria-describedby="password-help" required>
+      <p class="help" id="password-help">Use at least 8 characters, including a number.</p>
+      <label for="confirm">Confirm new password</label><input id="confirm" name="confirm" type="password" autocomplete="new-password" minlength="8" maxlength="200" required>
+      <button type="submit">Save new password</button>
+    </form>
+    <p id="status" class="message success" role="status" aria-live="polite"></p>
+    <p id="error" class="message error" role="alert"></p>
+    <p id="another" hidden><a href="/reset-password">Request a new reset link</a></p>
+    <a class="back" id="back" href="${home}">Back to sign in</a>
+    <noscript><p>Enable JavaScript to reset your password.</p></noscript>
+  </div></main>
+  <script nonce="${nonce}">${SCRIPT}</script></body></html>`;
+}
+
+const SCRIPT = String.raw`
+(() => {
+  const requestForm = document.querySelector('#request-form');
+  const resetForm = document.querySelector('#reset-form');
+  const status = document.querySelector('#status');
+  const error = document.querySelector('#error');
+  let token = ''; let pending = false; let done = false;
+  function readLink() {
+    const incoming = new URLSearchParams(location.hash.slice(1)).get('token');
+    if (location.hash) history.replaceState(null, '', location.pathname);
+    if (!incoming) return;
+    token = incoming; done = false;
+    status.textContent = ''; error.textContent = '';
+    document.querySelector('#another').hidden = true;
+    for (const field of resetForm.querySelectorAll('input')) {field.value = ''; field.readOnly = false;}
+    const button = resetForm.querySelector('button');
+    button.textContent = 'Save new password'; button.removeAttribute('aria-disabled');
+    requestForm.hidden = true; resetForm.hidden = false;
+    document.querySelector('#title').textContent = 'Choose a new password';
+    document.querySelector('#intro').textContent = 'Your new password works here and on NixAmp. Existing sessions will be signed out.';
+  }
+  readLink(); window.addEventListener('hashchange', readLink);
+  async function submit(form, path, input) {
+    if (pending || done) return;
+    pending = true; error.textContent = ''; status.textContent = '';
+    const button = form.querySelector('button');
+    button.setAttribute('aria-disabled', 'true'); form.setAttribute('aria-busy', 'true');
+    try {
+      const response = await fetch(path, {method:'POST', credentials:'same-origin', headers:{'content-type':'application/json'}, body:JSON.stringify(input)});
+      const result = await response.json();
+      if (!response.ok) {
+        if (form === resetForm && response.status === 400) document.querySelector('#another').hidden = false;
+        throw new Error(result.error || 'That did not work. Please try again.');
+      }
+      status.textContent = result.message;
+      if (form === resetForm) {
+        done = true; token = '';
+        for (const field of form.querySelectorAll('input')) {field.value = ''; field.readOnly = true;}
+        button.textContent = 'Password saved';
+        document.querySelector('#back').textContent = 'Sign in with your new password';
+      }
+    } catch (problem) {error.textContent = problem instanceof TypeError ? 'Could not connect. Please try again.' : problem.message;}
+    finally {pending = false; form.removeAttribute('aria-busy'); if (!done) button.removeAttribute('aria-disabled');}
+  }
+  requestForm.addEventListener('submit', event => {
+    event.preventDefault();
+    void submit(requestForm, '/api/v1/auth/password-reset/request', {email:requestForm.elements.email.value.trim()});
+  });
+  resetForm.addEventListener('submit', event => {
+    event.preventDefault();
+    if (pending || done) return;
+    const password = resetForm.elements.password.value;
+    if (password !== resetForm.elements.confirm.value) {error.textContent = 'The passwords do not match.'; return;}
+    if (!/[0-9]/.test(password)) {error.textContent = 'Include at least one number in your password.'; return;}
+    void submit(resetForm, '/api/v1/auth/password-reset/confirm', {token, password});
+  });
+})();`;

package/src/password-reset.ts

@@ -0,0 +1,134 @@
+import { createHash, randomBytes } from "node:crypto";
+import type { Queryable } from "./follows.ts";
+import type { Tokens } from "./tokens.ts";
+import { mailSender, type BrandedMailSender } from "./mail-sender.ts";
+
+export const RESET_MESSAGE = "If an account exists for that email, you’ll receive a password reset link shortly.";
+export const RESET_INVALID = "This reset link is invalid, expired, or already used. Request a new link.";
+const LIFETIME_MS = 30 * 60_000;
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS nixamp_password_resets (
+    user_id TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+    token_hash TEXT UNIQUE,
+    password_hash TEXT,
+    expires_at TIMESTAMPTZ,
+    reset_at TIMESTAMPTZ
+  );
+`;
+
+interface Passwords {
+  hashPassword(password: string): Promise<string>;
+  validatePassword(password: string): { valid: boolean; message: string };
+}
+
+export type ResetMail = (email: string, link: string) => Promise<boolean>;
+
+function digest(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+export class PasswordResets {
+  private ready: Promise<void> | null = null;
+
+  constructor(
+    private readonly db: Queryable & { initialize?(): Promise<void> },
+    private readonly tokens: Tokens,
+    private readonly passwords: Passwords,
+  ) {}
+
+  private async ensure(): Promise<void> {
+    this.ready ??= (async () => {
+      await this.db.initialize?.();
+      await this.tokens.initialize();
+      await this.db.query(SCHEMA);
+    })().catch((error) => { this.ready = null; throw error; });
+    await this.ready;
+  }
+
+  /** The public response is identical for registered and unknown addresses. */
+  async request(email: string, site: string, deliver: ResetMail): Promise<void> {
+    await this.ensure();
+    const token = randomBytes(32).toString("base64url");
+    const { rows } = await this.db.query(
+      `INSERT INTO nixamp_password_resets (user_id, token_hash, password_hash, expires_at)
+       SELECT id, $2, password, now() + interval '30 minutes' FROM users WHERE lower(email) = $1
+       ON CONFLICT (user_id) DO UPDATE SET token_hash = EXCLUDED.token_hash,
+         password_hash = EXCLUDED.password_hash, expires_at = EXCLUDED.expires_at
+       RETURNING user_id`,
+      [email.trim().toLowerCase(), digest(token)],
+    );
+    if (!rows.length) return;
+    // Fragments never reach HTTP logs or referrers. Email delivery also never
+    // changes the HTTP response (or its timing) according to account existence.
+    const link = `${site.replace(/\/+$/, "")}/reset-password#token=${token}`;
+    void Promise.resolve().then(() => deliver(email.trim().toLowerCase(), link)).then((sent) => {
+      if (!sent) console.error("nixamp: password reset email delivery failed");
+    }).catch(() => console.error("nixamp: password reset email delivery failed"));
+  }
+
+  /** Claim the link, change the password, and revoke sessions in one statement. */
+  async confirm(token: unknown, password: unknown): Promise<string | null> {
+    if (typeof token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(token)) return RESET_INVALID;
+    if (typeof password !== "string" || password.length > 200) return "Enter a password between 8 and 200 characters.";
+    const validation = this.passwords.validatePassword(password);
+    if (!validation.valid) return validation.message;
+    await this.ensure();
+    const tokenHash = digest(token);
+    // Reject bad tokens before doing the deliberately expensive password hash.
+    const candidate = await this.db.query(
+      `SELECT user_id FROM nixamp_password_resets WHERE token_hash = $1 AND expires_at > now()`, [tokenHash],
+    );
+    if (!candidate.rows.length) return RESET_INVALID;
+    const hashed = await this.passwords.hashPassword(password);
+    const { rows } = await this.db.query(
+      `WITH consumed AS (
+         UPDATE nixamp_password_resets r SET token_hash = NULL, expires_at = NULL,
+           password_hash = NULL, reset_at = clock_timestamp()
+         FROM users u WHERE r.token_hash = $1 AND r.expires_at > now()
+           AND u.id = r.user_id AND r.password_hash IS NOT DISTINCT FROM u.password
+         RETURNING r.user_id
+       ), changed AS (
+         UPDATE users u SET password = $2, updated_at = now()
+         FROM consumed c WHERE u.id = c.user_id RETURNING u.id
+       ), revoked AS (
+         DELETE FROM nixamp_tokens t USING changed c WHERE t.user_id = c.id RETURNING t.id
+       ) SELECT id FROM changed`,
+      [tokenHash, hashed],
+    );
+    return rows.length ? null : RESET_INVALID;
+  }
+
+  /** Older JWT sessions also stop working after recovery, across restarts. */
+  async acceptsLegacyToken(userId: string, token: string): Promise<boolean> {
+    await this.ensure();
+    const { rows } = await this.db.query("SELECT reset_at FROM nixamp_password_resets WHERE user_id = $1", [userId]);
+    if (!rows[0]?.["reset_at"]) return true;
+    try {
+      // Called only after the auth library has verified the JWT signature.
+      const claims = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+      const issued = claims.iat;
+      const reset = rows[0]["reset_at"];
+      const resetAt = reset instanceof Date ? reset.getTime() : new Date(String(reset)).getTime();
+      return typeof issued === "number" && Number.isFinite(issued)
+        && issued * 1000 >= resetAt;
+    } catch { return false; }
+  }
+}
+
+/** Transactional recovery mail has no follower footer and never logs a token. */
+export function resendPasswordReset(options: BrandedMailSender & { fetch?: typeof globalThis.fetch }): ResetMail {
+  return async (email, link) => {
+    const host = new URL(link).hostname;
+    const sender = mailSender(options, link);
+    const response = await (options.fetch ?? globalThis.fetch)("https://api.resend.com/emails", {
+      method: "POST",
+      headers: { authorization: `Bearer ${sender.apiKey}`, "content-type": "application/json" },
+      signal: AbortSignal.timeout(15_000),
+      body: JSON.stringify({
+        from: sender.from, to: [email], subject: `Reset your ${host} password`,
+        text: `Someone requested a password reset for your account on ${host}.\n\nChoose a new password using this link:\n${link}\n\nThis link expires in ${LIFETIME_MS / 60_000} minutes and works once. Resetting your password signs out existing sessions.\n\nIf you did not request this, you can ignore this email. Your password will stay the same.`,
+      }),
+    });
+    return response.ok;
+  };
+}

package/src/server.ts

@@ -37,6 +37,8 @@ import {
 } from "./channels.ts";
 import { RtmpListeners } from "./rtmp-in.ts";
 import { Accounts, clearedCookie, sessionCookie, tokenFrom } from "./accounts.ts";
+import { RESET_INVALID, RESET_MESSAGE, resendPasswordReset, type ResetMail } from "./password-reset.ts";
+import { passwordResetPage } from "./password-reset-page.ts";
 import { anonymousHandle, Handles } from "./handles.ts";
 import { OpenDirs } from "./opendirs.ts";
 import { Servers } from "./servers.ts";
@@ -85,6 +87,7 @@ import { createThrottle, presentedCredential, type Throttle } from "@profullstac
 import { Durable } from "./durable.ts";
 import { notifyAll, resendEmail, webPush, type Notification } from "./notify.ts";
 import { inviteSubject, inviteText, isEmail, isPhone, watchLink } from "./invite.ts";
+import { EventWriter } from "./event-writer.ts";
 import { handleLiveApi } from "./live-api.ts";
 import { LiveEvents, eventStructuredData, isTicketed, type LiveEvent } from "./live-events.ts";
 import { Tickets, needsTicket, ticketFrom, ticketsFromEnv } from "./tickets.ts";
@@ -1717,6 +1720,8 @@ export interface HandlerOptions {
   publishUrls?: () => { id: string; url: string }[];
   /** Accounts, on the instance that keeps them. Only nixamp.com passes this. */
   accounts?: Accounts;
+  /** Transactional password recovery mail, separate from follow notifications. */
+  resetMail?: ResetMail;
   /** Providers to sign in with, and the terminals waiting to be connected. */
   signIn?: SignIn;
   /** The servers each account runs, on the instance that keeps accounts. */
@@ -1755,6 +1760,7 @@ export interface HandlerOptions {
   settingsSync?: SettingsSync;
   /** Scheduled and live sessions, kept by NixAmp and shared by branded clients. */
   events?: LiveEvents;
+  eventWriter?: EventWriter;
   /** Versioned panel layouts, including event and user overrides. */
   layouts?: Layouts;
   /** Persistent participation state that must not be coupled to live audio. */
@@ -1852,6 +1858,7 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
     const webSite = options.webSites?.get((request.headers.host ?? "").toLowerCase());
     const web = webSite?.web ?? options.web;
     const eventSite = webSite?.site ?? options.invites?.site;
+    const accountSite = eventSite ?? options.site ?? "https://nixamp.com";
     const key = options.key ?? null;
     const behindProxy = options.behindProxy ?? false;
     const listenKey = options.listenKey ?? null;
@@ -1939,6 +1946,7 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
 
     if (options.events && await handleLiveApi(request, response, url, {
       events: options.events,
+      ...(options.eventWriter ? {eventWriter: options.eventWriter} : {}),
       ...(options.accounts ? { accounts: options.accounts } : {}),
       ...(options.layouts ? { layouts: options.layouts } : {}),
       ...(options.rooms ? { rooms: options.rooms } : {}),
@@ -2460,6 +2468,20 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       return;
     }
 
+    if (path === "/reset-password" && options.accounts?.passwordResets) {
+      if (request.method !== "GET" && request.method !== "HEAD") {
+        json(response, 405, { error: "GET only" }); return;
+      }
+      const nonce = randomBytes(18).toString("base64");
+      response.writeHead(200, {
+        "content-type": "text/html; charset=utf-8", "cache-control": "no-store",
+        "referrer-policy": "no-referrer", "x-robots-tag": "noindex, nofollow",
+        "content-security-policy": `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'unsafe-inline'; connect-src 'self'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'`,
+      });
+      response.end(request.method === "HEAD" ? undefined : passwordResetPage(accountSite, nonce));
+      return;
+    }
+
     // --- accounts ---------------------------------------------------------
     //
     // Before the share-key check, because signing in is how somebody without a
@@ -2469,6 +2491,46 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       const accounts = options.accounts;
       const secure = options.secureCookies ?? false;
 
+      if (path === "/api/v1/auth/password-reset/request" || path === "/api/v1/auth/password-reset/confirm") {
+        if (request.method !== "POST") { json(response, 405, { error: "POST only" }); return; }
+        const confirming = path.endsWith("/confirm");
+        if (!accounts.passwordResets || (!confirming && !options.resetMail)) {
+          json(response, 503, { error: "Password reset email is temporarily unavailable. Please try again later." }); return;
+        }
+        const who = callerOf(request.headers, request.socket.remoteAddress, behindProxy);
+        const limit = guard.check(`password-reset:${confirming ? "confirm" : "request"}:${who}`, { allowed: confirming ? 15 : 10, windowMs: 15 * 60_000 });
+        if (!limit.ok) {
+          response.setHeader("retry-after", String(limit.retryAfter));
+          json(response, 429, { error: "Too many attempts. Please try again in 15 minutes." }); return;
+        }
+        try {
+          const input: unknown = JSON.parse(await readBody(request, 4096));
+          if (!input || typeof input !== "object" || Array.isArray(input)) {
+            json(response, 400, { error: "Provide a JSON object." }); return;
+          }
+          const body = input as Record<string, unknown>;
+          if (confirming) {
+            const error = await accounts.passwordResets.confirm(body["token"], body["password"]);
+            if (error) { json(response, error === RESET_INVALID ? 400 : 422, { error }); return; }
+            response.setHeader("set-cookie", clearedCookie());
+            json(response, 200, { message: "Your password has been changed. Sign in with your new password." });
+          } else {
+            const email = typeof body["email"] === "string" ? body["email"].trim().toLowerCase() : "";
+            if (email.length > 320 || !/^[^@\s]+@[^@\s.]+\.[^@\s]+$/.test(email)) {
+              json(response, 422, { error: "Enter a valid email address." }); return;
+            }
+            // Count every address, including nonexistent ones, identically.
+            const address = guard.check(`password-reset:email:${email}`, { allowed: 3, windowMs: 15 * 60_000 });
+            if (address.ok) await accounts.passwordResets.request(email, accountSite, options.resetMail!);
+            json(response, 200, { message: RESET_MESSAGE });
+          }
+        } catch (error) {
+          const malformed = error instanceof SyntaxError || (error as Error).message === "body too large";
+          json(response, malformed ? 400 : 503, { error: malformed ? "Provide a valid JSON request." : "Password reset is temporarily unavailable. Please try again." });
+        }
+        return;
+      }
+
       if (path === "/api/v1/auth/me") {
         const who = await accounts.whoIs(tokenFrom(request.headers));
         if (who === null) {
@@ -2909,8 +2971,16 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         if (path === "/api/v1/translation-passes" && request.method === "GET") {
           json(response, 200, await service.access(who?.id)); return;
         }
-        if (!who) throw new SpeechError("Sign in to buy translated audio.", 401);
+        if (!who) throw new SpeechError("Sign in to use translated audio.", 401);
         if (!guard.check(`translation-pass-account:${who.id}`, { allowed: 30, windowMs: 60_000 }).ok) throw new SpeechError("Too many purchase requests.", 429);
+        if (path === "/api/v1/translation-passes/session" && request.method === "POST") {
+          if (!request.headers["content-type"]?.startsWith("application/json")) throw new SpeechError("Send a panel session as JSON.", 415);
+          let body: { resource?: unknown };
+          try { body = JSON.parse(await readBody(request, 1024)); } catch { throw new SpeechError("Choose a panel session.", 400); }
+          if (typeof body?.resource !== "string") throw new SpeechError("Choose a panel session.", 400);
+          await service.begin(who.id, body.resource);
+          json(response, 200, await service.access(who.id)); return;
+        }
         if (path === "/api/v1/translation-passes/checkout" && request.method === "POST") {
           if (!request.headers["content-type"]?.startsWith("application/json")) throw new SpeechError("Send a purchase as JSON.", 415);
           if (!guard.check(`translation-checkout-ip:${caller}`, { allowed: 10, windowMs: 3600_000 }).ok) throw new SpeechError("Too many new checkouts. Resume your pending purchase.", 429);
@@ -2959,7 +3029,9 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
           } else if (path.endsWith("/speakers") && request.method === "POST") {
             if (!request.headers["content-type"]?.startsWith("audio/wav")) { json(response, 415, { error: "send a mono 16 kHz WAV" }); return; }
             const bytes = await readBytes(request, 484_000);
-            json(response, 200, await service.hear(bytes, who.id, controller.signal));
+            const resource = request.headers["x-nixamp-translation-session"];
+            if (resource !== undefined && (typeof resource !== "string" || !/^[\w-]{1,80}$/.test(resource))) throw new SpeechError("Choose a panel session.", 400);
+            json(response, 200, await service.hear(bytes, who.id, controller.signal, undefined, resource));
           } else if (path.endsWith("/grant") && request.method === "POST") {
             if (!request.headers["content-type"]?.startsWith("application/json")) { json(response, 415, { error: "send JSON" }); return; }
             let body: { channel?: unknown };
@@ -6054,6 +6126,10 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
   const favorites = pool ? new Favorites(pool) : undefined;
   const settingsSync = pool ? new SettingsSync(pool) : undefined;
   const nixampSite = (process.env["NIXAMP_SITE"] ?? DEFAULT_DIRECTORY).replace(/\/+$/, "");
+  const schoolMailKey = process.env["BACKTOSCHOOL_RESEND_API_KEY"] ?? process.env["RESEND_API_KEY"];
+  const schoolMail = schoolMailKey && process.env["BACKTOSCHOOL_MAIL_FROM"] ? {
+    apiKey: schoolMailKey, from: process.env["BACKTOSCHOOL_MAIL_FROM"],
+  } : undefined;
   const events = pool ? new LiveEvents(pool) : undefined;
   const layouts = pool ? new Layouts(pool) : undefined;
   const rooms = pool ? new Rooms(pool) : undefined;
@@ -6582,7 +6658,10 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     ...(follows ? { follows, vapidPublicKey } : {}),
     ...(favorites ? { favorites } : {}),
     ...(settingsSync ? { settingsSync } : {}),
-    ...(events ? { events } : {}),
+    ...(events ? { events, eventWriter: new EventWriter({
+      openaiKey: process.env["OPENAI_API_KEY"], anthropicKey: process.env["ANTHROPIC_API_KEY"],
+      openaiModel: process.env["NIXAMP_WRITER_OPENAI_MODEL"], claudeModel: process.env["NIXAMP_WRITER_CLAUDE_MODEL"],
+    }) } : {}),
     ...(layouts ? { layouts } : {}),
     ...(rooms ? { rooms } : {}),
     ...(trollbox ? { trollbox } : {}),
@@ -6595,6 +6674,13 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     ...(translations ? { translations } : {}),
     ...(records ? { records } : {}),
     site: nixampSite,
+    ...(accounts && process.env["RESEND_API_KEY"] ? {
+      resetMail: resendPasswordReset({
+        apiKey: process.env["RESEND_API_KEY"],
+        from: process.env["NIXAMP_MAIL_FROM"] ?? "nixamp <notifications@nixamp.com>",
+        backtoschool: schoolMail,
+      }),
+    } : {}),
     // Other people's OpenProfiles, read for the voice a line is spoken in,
     // and the voices to speak in: ElevenLabs when the Telnyx account holds
     // the key for it (an integration secret named "elevenlabs"), Kokoro
@@ -6617,6 +6703,8 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
                   email: resendEmail({
                     apiKey: process.env["RESEND_API_KEY"],
                     from: process.env["NIXAMP_MAIL_FROM"] ?? "nixamp <notifications@nixamp.com>",
+                    backtoschool: schoolMail,
+                    reason: "You received this email because a host invited you to join a live session.",
                     onEvent: (message) => console.log(message),
                   }),
                 }

package/src/shared-translation.ts

@@ -1,5 +1,6 @@
 /** One live source/language pipeline, paid access for every listening account.
  * Browsers receive the same PCM, never upload a replacement for a public feed. */
+import { transientAudioError } from "./live-recovery.ts";
 import { createHash, randomUUID } from "node:crypto";
 import { lookup } from "node:dns/promises";
 import { BlockList, isIP } from "node:net";
@@ -58,9 +59,9 @@ export function liveInput(ffmpeg: string[] = ["ffmpeg"]): OpenLiveInput {
   };
 }
 
-export type SharedEvent = { type: "status"; listeners: number } | { type: "line"; id: string; line: Caption } | { type: "audio"; id: string; data: string } | { type: "end"; id: string } | { type: "error"; error: string };
+export type SharedEvent = { type: "status"; listeners: number } | { type: "line"; id: string; line: Caption } | { type: "audio"; id: string; data: string } | { type: "end"; id: string } | { type: "error"; error: string; retryable?: boolean };
 type Member = { by: string; send: (event: SharedEvent) => void; close: () => void };
-interface Feed { id: string; source: URL; language: string; members: Set<Member>; controller: AbortController; input?: LiveInput; interpreter: Interpreter; meter: TranslationMeter; reservations: Map<string, string[]>; queue: Caption[]; speaking: boolean; previous: Buffer; pending: Buffer; until: number; heartbeat?: ReturnType<typeof setInterval>; }
+interface Feed { id: string; source: URL; language: string; members: Set<Member>; controller: AbortController; input?: LiveInput; interpreter: Interpreter; meter: TranslationMeter; reservations: Map<string, string[]>; queue: Caption[]; speaking: boolean; voiceFailures: number; previous: Buffer; pending: Buffer; until: number; heartbeat?: ReturnType<typeof setInterval>; }
 
 export class SharedTranslations {
   private readonly feeds = new Map<string, Feed>();
@@ -71,18 +72,24 @@ export class SharedTranslations {
     if (!this.options.voice.available()) throw new SpeechError("Translated audio is unavailable.", 503);
     const source = sharedSource(raw);
     if (!LIVE_VOICE_LANGUAGES.has(language)) throw new SpeechError("Choose a supported audio language.", 400);
-    await this.options.billing?.require(by);
-    const connections = [...this.feeds.values()].reduce((total, feed) => total + [...feed.members].filter(member => member.by === by).length, 0);
-    if (connections >= 2) throw new SpeechError("Translated audio is already open in two players for this account.", 429);
     const id = `dub-${createHash("sha256").update(`${source}|${language}`).digest("hex").slice(0, 40)}`;
+    const capacity = (): void => {
+      const connections = [...this.feeds.values()].reduce((total, feed) => total + [...feed.members].filter(member => member.by === by).length, 0);
+      if (connections >= 2) throw new SpeechError("Translated audio is already open in two players for this account.", 429);
+      const feed = this.feeds.get(id);
+      if (!feed && this.feeds.size >= 4) throw new SpeechError("Live translation is busy. Try again shortly.", 429);
+      if (feed && feed.members.size >= 1000) throw new SpeechError("This translated stream is full. Try again shortly.", 429);
+    };
+    capacity();
+    if (this.options.billing?.begin) await this.options.billing.begin(by, id);
+    else await this.options.billing?.require(by, id);
+    capacity(); // Other joins can finish during the account/database check.
     let feed = this.feeds.get(id);
     if (!feed) {
-      if (this.feeds.size >= 4) throw new SpeechError("Live translation is busy. Try again shortly.", 429);
       feed = this.make(id, source, language); this.feeds.set(id, feed);
       const current = feed;
       current.heartbeat = setInterval(() => void this.checkMembers(current), 10_000); current.heartbeat.unref?.();
     }
-    if (feed.members.size >= 1000) throw new SpeechError("This translated stream is full. Try again shortly.", 429);
     const member = { by, send, close }; feed.members.add(member);
     this.broadcast(feed, { type: "status", listeners: feed.members.size });
     if (feed.members.size === 1 && !feed.input) void this.start(feed);
@@ -99,14 +106,14 @@ export class SharedTranslations {
   }
   private async checkMembers(feed: Feed): Promise<void> {
     const accounts = [...new Set([...feed.members].map(member => member.by))];
-    let funded = new Set(accounts), message = "Your translation balance is used up or expired. Buy another pass to continue.";
+    let funded = new Set(accounts), message = "This free session ended and audio credit is used up. Start a remaining free session or buy a pass.";
     try {
-      if (this.options.billing?.eligible) funded = new Set(await this.options.billing.eligible(accounts));
+      if (this.options.billing?.eligible) funded = new Set(await this.options.billing.eligible(accounts, feed.id));
       else if (this.options.billing) {
-        const results = await Promise.allSettled(accounts.map(by => this.options.billing!.require(by)));
+        const results = await Promise.allSettled(accounts.map(by => this.options.billing!.require(by, feed.id)));
         funded = new Set(accounts.filter((_by, index) => results[index]?.status === "fulfilled"));
       }
-    } catch { funded.clear(); message = "Your translation balance could not be checked. Try again shortly."; }
+    } catch { funded.clear(); message = "Your translation access could not be checked. Try again shortly."; }
     for (const member of [...feed.members]) if (accounts.includes(member.by) && !funded.has(member.by)) {
       try { member.send({ type: "error", error: message }); } catch { /* disconnected */ }
       finally { this.leave(feed, member); member.close(); }
@@ -117,14 +124,14 @@ export class SharedTranslations {
       try { member.send(event); } catch { this.leave(feed, member); member.close(); }
     }
   }
-  private stop(feed: Feed, error: string): void {
-    this.broadcast(feed, { type: "error", error });
+  private stop(feed: Feed, error: string, retryable = false): void {
+    this.broadcast(feed, { type: "error", error, retryable });
     for (const member of [...feed.members]) { this.leave(feed, member); member.close(); }
   }
   private make(id: string, source: URL, language: string): Feed {
-    const feed = { id, source, language, members: new Set<Member>(), controller: new AbortController(), reservations: new Map<string, string[]>(), queue: [], speaking: false, previous: Buffer.alloc(0), pending: Buffer.alloc(0), until: Date.now() } as unknown as Feed;
-    // Every active account pays the same published access rate. API work is
-    // done once; additional listeners do not trigger recognition or synthesis.
+    const feed = { id, source, language, members: new Set<Member>(), controller: new AbortController(), reservations: new Map<string, string[]>(), queue: [], speaking: false, voiceFailures: 0, previous: Buffer.alloc(0), pending: Buffer.alloc(0), until: Date.now() } as unknown as Feed;
+    // Each account uses free access first, then the same published credit rate.
+    // Additional listeners do not trigger recognition or synthesis.
     feed.meter = {
       require: async () => { if (!feed.members.size) throw new SpeechError("No listeners.", 410); },
       reserve: async (_by: string, kind: TranslationUsage, units: number) => {
@@ -133,9 +140,9 @@ export class SharedTranslations {
         const accepted = new Set<string>();
         const billing = this.options.billing;
         if (billing?.reserveMany) {
-          for (const charged of await billing.reserveMany(accounts, kind, units)) { ids.push(charged.id); accepted.add(charged.by); }
+          for (const charged of await billing.reserveMany(accounts, kind, units, feed.id)) { ids.push(charged.id); accepted.add(charged.by); }
         } else {
-          const results = await Promise.allSettled(accounts.map(async account => ({ by: account, id: await billing?.reserve(account, kind, units) })));
+          const results = await Promise.allSettled(accounts.map(async account => ({ by: account, id: await billing?.reserve(account, kind, units, feed.id) })));
           let failure: unknown;
           for (const result of results) {
             if (result.status === "fulfilled") { accepted.add(result.value.by); if (result.value.id) ids.push(result.value.id); }
@@ -144,7 +151,7 @@ export class SharedTranslations {
           if (failure) { await Promise.all(ids.map(id => billing!.refund(id))); throw failure; }
         }
         for (const member of [...feed.members]) if (accounts.includes(member.by) && !accepted.has(member.by)) {
-          try { member.send({ type: "error", error: "Your translation balance is used up or expired. Buy another pass to continue." }); }
+          try { member.send({ type: "error", error: "This free session ended and audio credit is used up. Start a remaining free session or buy a pass." }); }
           catch { /* disconnected */ } finally { this.leave(feed, member); member.close(); }
         }
         if (!feed.members.size) { await Promise.all(ids.map(id => this.options.billing!.refund(id))); throw new SpeechError("No funded listeners.", 402); }
@@ -157,10 +164,10 @@ export class SharedTranslations {
     feed.interpreter = new Interpreter({
       language: () => language, speakers: () => true, voices: () => voices, channel: () => id,
       status: text => { if (!feed.controller.signal.aborted && !feed.members.size) this.stop(feed, text); },
-      failed: () => this.stop(feed, "Live translation stopped. Enable it again to retry."),
+      failed: message => this.stop(feed, message),
       lines: lines => {
         feed.queue.push(...lines);
-        if (feed.queue.length > 24) { this.stop(feed, "Live translation fell behind. Enable it again to retry."); return; }
+        feed.queue = feed.queue.filter(line => Date.now() - line.until <= 12_000).slice(-24);
         if (!feed.speaking) void this.speak(feed);
       },
       fetcher: (async (url, init) => {
@@ -190,7 +197,7 @@ export class SharedTranslations {
           for (let index = 0; index < samples.length; index++) samples[index] = pcm.readInt16LE(index * 2) / 32768;
           feed.interpreter.push({ samples, at: feed.until - samples.length / 16, until: feed.until, freshAt: feed.until - 2000 });
         }
-      }, () => this.stop(feed, "The live source stopped. Enable translated audio again when playback resumes."), feed.controller.signal);
+      }, () => this.stop(feed, "The live source disconnected.", true), feed.controller.signal);
       if (feed.controller.signal.aborted) input.stop(); else feed.input = input;
     } catch (error) { this.stop(feed, error instanceof SpeechError ? error.message : "The live source could not be opened."); }
   }
@@ -199,18 +206,25 @@ export class SharedTranslations {
     try {
       while (feed.queue.length && !feed.controller.signal.aborted) {
         const line = feed.queue.shift()!;
-        if (Date.now() - line.until > 12_000) throw new SpeechError("Live translation fell behind. Enable it again to retry.", 503);
-        const response = await this.options.voice.stream({ text: line.text, language: feed.language, channel: feed.id, speaker: line.speaker, voice: feed.interpreter.tracker.speakers.get(line.speaker ?? "")?.voice }, feed.id, feed.controller.signal, feed.meter);
-        const id = randomUUID();
-        this.broadcast(feed, { type: "line", id, line });
-        const reader = response.body!.getReader();
+        if (Date.now() - line.until > 12_000) continue;
         try {
-          while (true) {
-            const { done, value } = await reader.read(); if (done) break;
-            for (let at = 0; at < value.length; at += 16_384) this.broadcast(feed, { type: "audio", id, data: Buffer.from(value.subarray(at, at + 16_384)).toString("base64") });
-          }
-        } finally { reader.releaseLock(); }
-        this.broadcast(feed, { type: "end", id });
+          const response = await this.options.voice.stream({ text: line.text, language: feed.language, channel: feed.id, speaker: line.speaker, voice: feed.interpreter.tracker.speakers.get(line.speaker ?? "")?.voice }, feed.id, feed.controller.signal, feed.meter);
+          const id = randomUUID();
+          this.broadcast(feed, { type: "line", id, line });
+          const reader = response.body!.getReader();
+          try {
+            while (true) {
+              const { done, value } = await reader.read(); if (done) break;
+              for (let at = 0; at < value.length; at += 16_384) this.broadcast(feed, { type: "audio", id, data: Buffer.from(value.subarray(at, at + 16_384)).toString("base64") });
+            }
+          } finally { reader.releaseLock(); this.broadcast(feed, { type: "end", id }); }
+          feed.voiceFailures = 0;
+        } catch (error) {
+          if (feed.controller.signal.aborted) return;
+          if (!transientAudioError(error) || ++feed.voiceFailures >= 3) throw error;
+          // A provider failure skips this phrase; the source and other listeners
+          // remain connected. Never replay partial speech or retry a charge.
+        }
       }
     } catch (error) { if (!feed.controller.signal.aborted) this.stop(feed, error instanceof SpeechError ? error.message : "Translated audio was interrupted."); }
     finally { feed.speaking = false; }

package/src/tokens.ts

@@ -152,6 +152,9 @@ export class Tokens {
     await this.ready;
   }
 
+  /** Recovery revokes this table in the same transaction as the password update. */
+  async initialize(): Promise<void> { await this.ensure(); }
+
   async issue(options: IssueOptions): Promise<IssuedToken> {
     await this.ensure();
     const { id, secret, token } = mintToken();