nixamp 0.28.37 → 0.28.41

package/dist/server.d.ts

@@ -11,6 +11,8 @@ import { type ResetMail } from "./password-reset.ts";
 import { Handles } from "./handles.ts";
 import { OpenDirs } from "./opendirs.ts";
 import { Servers } from "./servers.ts";
+import { AccountProfiles } from "./profiles.ts";
+import { NixampLinks } from "./nixamp-link.ts";
 import { SignIn } from "./oauth.ts";
 import { AuthorizationServer } from "./oauth-server.ts";
 import { WatchParties } from "./watch-party.ts";
@@ -29,6 +31,7 @@ import { Names } from "./names.ts";
 import { Certs } from "./certs.ts";
 import { type Throttle } from "@profullstack/throttle";
 import { type Notification } from "./notify.ts";
+import { type VapidKeys } from "@profullstack/notifications/server";
 import { EventWriter } from "./event-writer.ts";
 import { LiveEvents, type LiveEvent } from "./live-events.ts";
 import { Tickets } from "./tickets.ts";
@@ -669,6 +672,10 @@ export interface HandlerOptions {
     servers?: Servers;
     /** The name other people see, which is never the address they signed up with. */
     handles?: Handles;
+    /** The account's card: a name, a homepage, a photo, a line. One table, read by every site here. */
+    accountProfiles?: AccountProfiles;
+    /** nixamp accounts connected to accounts here, where this site is a client of nixamp.com. */
+    links?: NixampLinks;
     /** Open directories people have found, which anyone may read. */
     openDirs?: OpenDirs;
     /** True when this instance is reached over https, for the cookie's Secure. */
@@ -764,8 +771,11 @@ export interface HandlerOptions {
      * Response it is refused with.
      */
     throttle?: Throttle;
-    /** The VAPID public key a browser needs before it can subscribe. */
-    vapidPublicKey?: string;
+    /**
+     * The VAPID pair, read from the environment when the server starts. Only the
+     * public half leaves: it is what a browser needs before it can subscribe.
+     */
+    vapidKeys?: VapidKeys | null;
 }
 /**
  * The whole HTTP surface, as a plain function of a request — so a test can

package/dist/server.js

@@ -33,10 +33,13 @@ import { passwordResetPage } from "./password-reset-page.js";
 import { anonymousHandle, Handles } from "./handles.js";
 import { OpenDirs } from "./opendirs.js";
 import { Servers } from "./servers.js";
+import { AccountProfiles, hostCard, PHOTO_LIMIT } from "./profiles.js";
+import { NixampLinks, nixampExchange } from "./nixamp-link.js";
+import { handleNixampLinkApi, nixampLinkPath } from "./nixamp-link-api.js";
 import { DeviceGrants } from "./device.js";
 import { BAD_KEY_LIMIT, callerOf, Guard, SIGN_IN_LIMIT } from "./guard.js";
 import { deviceDonePage, devicePage, exchangeCode, providersFrom, signInFailedPage, SignIn, } from "./oauth.js";
-import { AuthorizationServer, SCOPE_NAMES, clientsFrom } from "./oauth-server.js";
+import { AuthorizationServer, BACKTOSCHOOL_CLIENT, SCOPE_NAMES, clientsFrom } from "./oauth-server.js";
 import { handleOAuthApi, oauthApiPath } from "./oauth-api.js";
 import { WatchParties } from "./watch-party.js";
 import { needsAdmin, needsMember, Owner } from "./owner.js";
@@ -66,6 +69,7 @@ import { forbiddenLibrary, readLibrary } from "./library.js";
 import { createThrottle, presentedCredential } from "@profullstack/throttle";
 import { Durable } from "./durable.js";
 import { notifyAll, resendEmail, webPush } from "./notify.js";
+import { vapidKeysFromEnv, vapidPublicKeyResponse } from "@profullstack/notifications/server";
 import { inviteSubject, inviteText, isEmail, isPhone, watchLink } from "./invite.js";
 import { EventWriter } from "./event-writer.js";
 import { handleLiveApi } from "./live-api.js";
@@ -1138,6 +1142,12 @@ export function isSignInPath(path) {
         path === "/api/v1/servers" ||
         path.startsWith("/api/v1/servers/") ||
         path === "/api/v1/me/handle" ||
+        path === "/api/v1/me/profile" ||
+        path.startsWith("/api/v1/me/profile/") ||
+        // A stored photo is public: it is on every class the host runs.
+        path.startsWith("/api/v1/profiles/") ||
+        // "Connect nixamp" on a site that is a client of nixamp.com.
+        nixampLinkPath(path) ||
         // Public to read, so it must not be behind a share key either.
         path === "/api/v1/opendirs" ||
         path.startsWith("/api/v1/opendirs/") ||
@@ -1447,6 +1457,18 @@ export function createHandler(engine, options) {
             secureCookies: options.secureCookies ?? false,
         }))
             return;
+        // A site here that is a client of nixamp.com: connect, callback, streams.
+        if (options.links && options.accounts && options.authServer && await handleNixampLinkApi(request, response, url, {
+            links: options.links,
+            accounts: options.accounts,
+            issuer: options.site ?? DEFAULT_DIRECTORY,
+            site: accountSite,
+            redirectUris: options.authServer.client(BACKTOSCHOOL_CLIENT.id)?.redirectUris ?? [],
+            home: "/#settings",
+            secureCookies: options.secureCookies ?? false,
+            fetcher: options.links.fetcher,
+        }))
+            return;
         if (options.events && await handleLiveApi(request, response, url, {
             events: options.events,
             ...(options.eventWriter ? { eventWriter: options.eventWriter } : {}),
@@ -1457,6 +1479,9 @@ export function createHandler(engine, options) {
             ...(eventSite ? { site: eventSite } : {}),
             ...(options.invites?.email ? { email: options.invites.email } : {}),
             ...(options.onEventUpdated ? { onEventUpdated: options.onEventUpdated } : {}),
+            ...(options.accountProfiles
+                ? { hostProfile: async (userId) => hostCard(await options.accountProfiles.of(userId), userId, accountSite) }
+                : {}),
         }))
             return;
         // The page explaining the reminder texts. Public for the same reason the
@@ -1781,9 +1806,12 @@ export function createHandler(engine, options) {
         // --- where to reach a follower ----------------------------------------
         if (path.startsWith("/api/v1/notify") && options.follows && options.accounts) {
             // The key is public by design: it is what a browser needs before it can
-            // ask permission, and it is useless without the private half.
+            // ask permission, and it is useless without the private half. Served at
+            // run time, never built into the page: a key baked in at build time is
+            // how push quietly becomes "not supported" in production. 503 when this
+            // instance has no keys, so the browser can say so.
             if (path === "/api/v1/notify/key" && request.method === "GET") {
-                json(response, 200, { publicKey: options.vapidPublicKey ?? "" });
+                await answerWith(response, vapidPublicKeyResponse(options.vapidKeys));
                 return;
             }
             const me = await options.accounts.whoIs(tokenFrom(request.headers));
@@ -1826,7 +1854,19 @@ export function createHandler(engine, options) {
             }
             if (path === "/api/v1/notify/subscribe") {
                 if (request.method === "DELETE") {
-                    const endpoint = url.searchParams.get("endpoint") ?? "";
+                    // The endpoint arrives in the query (older pages) or as the JSON
+                    // body @profullstack/notifications sends: { endpoint }.
+                    let endpoint = url.searchParams.get("endpoint") ?? "";
+                    if (!endpoint) {
+                        try {
+                            const body = JSON.parse(await readBody(request));
+                            if (typeof body.endpoint === "string")
+                                endpoint = body.endpoint;
+                        }
+                        catch {
+                            // No body: nothing to forget.
+                        }
+                    }
                     await follows.removePush(endpoint);
                     json(response, 200, { ok: true });
                     return;
@@ -3137,6 +3177,146 @@ export function createHandler(engine, options) {
             json(response, 405, { error: "GET or PUT" });
             return;
         }
+        // --- the account's card -------------------------------------------------
+        //
+        // A name, a homepage, a photo and a line, said once. A class is made from
+        // it, a settings page edits it, and an OpenProfile.md fills it in one move.
+        if ((path === "/api/v1/me/profile" || path.startsWith("/api/v1/me/profile/")) && options.accountProfiles && options.accounts) {
+            const profiles = options.accountProfiles;
+            const who = await options.accounts.whoIs(tokenFrom(request.headers));
+            if (who === null) {
+                json(response, 401, { error: "not signed in" });
+                return;
+            }
+            const persona = options.handles ? await options.handles.persona(who.id) : null;
+            const answer = async () => {
+                const profile = await profiles.of(who.id);
+                // Read again: an import may just have remembered the address.
+                const now = options.handles ? await options.handles.persona(who.id) : null;
+                json(response, 200, {
+                    ...profile,
+                    card: hostCard(profile, who.id, accountSite),
+                    openProfile: now?.profile ?? "",
+                    handle: now?.handle || fallbackHandle(who.id),
+                });
+            };
+            if (path === "/api/v1/me/profile") {
+                if (request.method === "GET") {
+                    await answer();
+                    return;
+                }
+                if (request.method === "PUT" || request.method === "POST") {
+                    let body;
+                    try {
+                        body = JSON.parse(await readBody(request));
+                    }
+                    catch {
+                        json(response, 400, { error: "bad JSON" });
+                        return;
+                    }
+                    const written = await profiles.set(who.id, body);
+                    if (written.error) {
+                        json(response, 422, { error: written.error });
+                        return;
+                    }
+                    await answer();
+                    return;
+                }
+                json(response, 405, { error: "GET or PUT" });
+                return;
+            }
+            if (path === "/api/v1/me/profile/import") {
+                if (request.method !== "POST") {
+                    json(response, 405, { error: "POST only" });
+                    return;
+                }
+                let body = {};
+                try {
+                    const raw = await readBody(request);
+                    body = raw.trim() === "" ? {} : JSON.parse(raw);
+                }
+                catch {
+                    json(response, 400, { error: "bad JSON" });
+                    return;
+                }
+                const given = typeof body.url === "string" ? body.url.trim() : "";
+                const from = given || persona?.profile || "";
+                if (from === "") {
+                    json(response, 422, { error: "give the URL of your OpenProfile.md, like https://you.example/.well-known/openprofile.md" });
+                    return;
+                }
+                const imported = await profiles.importFrom(who.id, from);
+                if (imported.error) {
+                    json(response, 422, { error: imported.error });
+                    return;
+                }
+                // The address is remembered, so the phone line reads the same file
+                // for the voice, and a later import needs no URL.
+                if (given && options.handles && given !== persona?.profile) {
+                    await options.handles.describe(who.id, fallbackHandle(who.id), { profile: given });
+                }
+                await answer();
+                return;
+            }
+            if (path === "/api/v1/me/profile/photo") {
+                if (request.method === "PUT" || request.method === "POST") {
+                    let bytes;
+                    try {
+                        bytes = await readBytes(request, PHOTO_LIMIT);
+                    }
+                    catch {
+                        json(response, 413, { error: "a photo may be up to 1 MB" });
+                        return;
+                    }
+                    const kept = await profiles.setPhoto(who.id, bytes);
+                    if (kept.error) {
+                        json(response, 422, { error: kept.error });
+                        return;
+                    }
+                    await answer();
+                    return;
+                }
+                if (request.method === "DELETE") {
+                    await profiles.removePhoto(who.id);
+                    await answer();
+                    return;
+                }
+                json(response, 405, { error: "PUT or DELETE" });
+                return;
+            }
+            json(response, 404, { error: "no such profile route" });
+            return;
+        }
+        // The stored photo, public: it is on every class the host runs, and a
+        // page shows it to strangers by design. Cached by its etag.
+        if (path.startsWith("/api/v1/profiles/") && path.endsWith("/photo") && options.accountProfiles) {
+            if (request.method !== "GET" && request.method !== "HEAD") {
+                json(response, 405, { error: "GET only" });
+                return;
+            }
+            const userId = decodeURIComponent(path.slice("/api/v1/profiles/".length, -"/photo".length));
+            const photo = userId === "" ? null : await options.accountProfiles.photo(userId);
+            if (photo === null) {
+                json(response, 404, { error: "no photo" });
+                return;
+            }
+            const etag = `"${photo.etag}"`;
+            if (request.headers["if-none-match"] === etag) {
+                response.writeHead(304, { etag, "cache-control": "public, max-age=86400" });
+                response.end();
+                return;
+            }
+            response.writeHead(200, {
+                "content-type": photo.type,
+                "content-length": photo.bytes.length,
+                etag,
+                "cache-control": "public, max-age=86400",
+                "x-content-type-options": "nosniff",
+                "access-control-allow-origin": "*",
+            });
+            response.end(request.method === "HEAD" ? undefined : Buffer.from(photo.bytes));
+            return;
+        }
         // --- the servers this account runs ----------------------------------
         //
         // Kept against the account rather than the machine, so the list reads the
@@ -5497,7 +5677,11 @@ function sendFile(request, response, file) {
 export function createServer(engine, options) {
     const handle = createHandler(engine, options);
     const onRequest = (request, response) => {
-        handle(request, response).catch(() => {
+        handle(request, response).catch((error) => {
+            // Silent by default: a stack trace per bad request is a log nobody
+            // reads. Said aloud when asked, which is how a 500 in a test is found.
+            if (process.env["NIXAMP_DEBUG"])
+                console.error(error);
             if (!response.headersSent)
                 json(response, 500, { error: "server error" });
             else
@@ -5849,8 +6033,8 @@ export async function serve(argv, version = "0.1.0") {
     // The two things that were promises kept only in memory: a caller who was
     // told they would be texted, and the ended stream a code still points at.
     const durable = pool ? new Durable(pool, (message) => console.log(message)) : undefined;
-    const vapidPublicKey = process.env["VAPID_PUBLIC_KEY"] ?? "";
-    const vapidPrivateKey = process.env["VAPID_PRIVATE_KEY"] ?? "";
+    // Read at run time, and null unless both halves are set.
+    const vapidKeys = vapidKeysFromEnv(process.env);
     /**
      * Tell a broadcaster's followers, on whatever they asked to be told on.
      *
@@ -5888,11 +6072,10 @@ export async function serve(argv, version = "0.1.0") {
                     }),
                 }
                 : {}),
-            ...(vapidPublicKey && vapidPrivateKey
+            ...(vapidKeys
                 ? {
                     push: webPush({
-                        publicKey: vapidPublicKey,
-                        privateKey: vapidPrivateKey,
+                        ...vapidKeys,
                         subject: process.env["NIXAMP_SITE"] ?? DEFAULT_DIRECTORY,
                         onEvent: (message) => console.log(message),
                     }),
@@ -5927,7 +6110,7 @@ export async function serve(argv, version = "0.1.0") {
         };
         void follows.audience(event.ownerId).then((audience) => notifyAll(audience, note, {
             ...(eventMail ? { email: resendEmail({ ...eventMail, onEvent: (message) => console.log(message) }) } : {}),
-            ...(vapidPublicKey && vapidPrivateKey ? { push: webPush({ publicKey: vapidPublicKey, privateKey: vapidPrivateKey, subject: nixampSite, onEvent: (message) => console.log(message) }) } : {}),
+            ...(vapidKeys ? { push: webPush({ ...vapidKeys, subject: nixampSite, onEvent: (message) => console.log(message) }) } : {}),
             onGone: (endpoint) => follows.removePush(endpoint),
             onEvent: (message) => console.log(message),
         })).catch(() => undefined);
@@ -6249,7 +6432,7 @@ export async function serve(argv, version = "0.1.0") {
         load: (next) => loadSource(tools, next, false),
         tag: (next) => loadTagged(tools, next),
         ...(directory ? { directory } : {}),
-        ...(follows ? { follows, vapidPublicKey } : {}),
+        ...(follows ? { follows, vapidKeys } : {}),
         ...(favorites ? { favorites } : {}),
         ...(settingsSync ? { settingsSync } : {}),
         ...(events ? { events, eventWriter: new EventWriter({
@@ -6341,7 +6524,16 @@ export async function serve(argv, version = "0.1.0") {
                 // The same pool the follows and reminders use: three small tables in
                 // one database do not want three sets of connections.
                 ...(pool
-                    ? { servers: new Servers(pool), handles: new Handles(pool), openDirs: new OpenDirs(pool) }
+                    ? {
+                        servers: new Servers(pool),
+                        handles: new Handles(pool),
+                        openDirs: new OpenDirs(pool),
+                        accountProfiles: new AccountProfiles(pool),
+                        // The school's side of "Connect nixamp": tokens from nixamp.com,
+                        // kept against the school account. The issuer is this same
+                        // program in production, reached over HTTP like any client.
+                        links: new NixampLinks(pool, nixampExchange(nixampSite, BACKTOSCHOOL_CLIENT.id), BACKTOSCHOOL_CLIENT.id),
+                    }
                     : {}),
                 signIn: new SignIn(providersFrom(process.env), new DeviceGrants(), process.env["NIXAMP_SITE"] ?? DEFAULT_DIRECTORY),
             }

package/dist/voice-provider.d.ts

@@ -0,0 +1,9 @@
+import { SpeechError } from "./speech.ts";
+/** Only fixed messages/codes leave this boundary: provider bodies can contain
+ * account information. Authorization and billing errors must not be retried
+ * as transient 502s by the live player. */
+export declare function voiceProviderFailure(response: Response): Promise<{
+    error: SpeechError;
+    code: string;
+    cooldownMs: number;
+}>;

package/dist/voice-provider.js

@@ -0,0 +1,27 @@
+import { SpeechError } from "./speech.js";
+/** Only fixed messages/codes leave this boundary: provider bodies can contain
+ * account information. Authorization and billing errors must not be retried
+ * as transient 502s by the live player. */
+export async function voiceProviderFailure(response) {
+    let code = "unknown";
+    try {
+        const body = await response.json();
+        const status = body?.detail?.status;
+        if (typeof status === "string" && ["quota_exceeded", "invalid_api_key", "missing_permissions", "subscription_required", "subscription_expired", "payment_required", "payment_issue", "too_many_concurrent_requests", "rate_limit_exceeded"].includes(status))
+            code = status;
+    }
+    catch { /* Non-JSON provider failures still have an HTTP status. */ }
+    if (code === "quota_exceeded")
+        return { code, cooldownMs: 300_000, error: new SpeechError("ElevenLabs credits are exhausted. The site owner needs to check the provider balance.", 402) };
+    if (code === "payment_issue")
+        return { code, cooldownMs: 300_000, error: new SpeechError("ElevenLabs blocked transcription because its subscription payment failed. The site owner needs to complete the outstanding ElevenLabs invoice.", 402) };
+    if (["subscription_required", "subscription_expired", "payment_required"].includes(code) || response.status === 402)
+        return { code, cooldownMs: 300_000, error: new SpeechError("ElevenLabs billing needs attention. The site owner needs to check the provider subscription.", 402) };
+    if (["invalid_api_key", "missing_permissions"].includes(code) || [401, 403].includes(response.status))
+        return { code, cooldownMs: 300_000, error: new SpeechError("ElevenLabs rejected transcription or voice access. The site owner needs to check the provider key, permissions, and billing.", 424) };
+    if (response.status === 429) {
+        const retry = Number(response.headers.get("retry-after"));
+        return { code, cooldownMs: Math.min(300_000, Math.max(30_000, Number.isFinite(retry) ? retry * 1000 : 0)), error: new SpeechError("ElevenLabs is rate limited. Wait before enabling translated audio again.", 429) };
+    }
+    return { code, cooldownMs: 10_000, error: new SpeechError("ElevenLabs is temporarily unavailable. Try translated audio again shortly.", 502) };
+}

package/dist/watch-party.d.ts

@@ -86,6 +86,14 @@ export declare class WatchParties {
      */
     bridge(ownerId: string, origin: PartyOrigin, input: BridgeInput): Promise<PartyView>;
     byCode(origin: PartyOrigin, partyCode: string): Promise<PartyView | null>;
+    /**
+     * A party by its code alone, for somebody who has only the code.
+     *
+     * A code is unique per origin, not across them; a person typing one into
+     * nixamp.com is not asked which site it came from. The one still live, or
+     * the most recently touched, is the one they mean.
+     */
+    byAnyCode(partyCode: string): Promise<PartyView | null>;
     /** The party behind a nixamp room or slug, for a client that has only that. */
     byEvent(reference: string): Promise<PartyView | null>;
     /**

package/dist/watch-party.js

@@ -200,6 +200,27 @@ export class WatchParties {
             return null;
         return { party: partyFrom(row, event), event };
     }
+    /**
+     * A party by its code alone, for somebody who has only the code.
+     *
+     * A code is unique per origin, not across them; a person typing one into
+     * nixamp.com is not asked which site it came from. The one still live, or
+     * the most recently touched, is the one they mean.
+     */
+    async byAnyCode(partyCode) {
+        await this.ensure();
+        const code = cleanPartyCode(partyCode);
+        const { rows } = await this.options.db.query(`SELECT p.* FROM ${TABLE} p JOIN live_events e ON e.id = p.event_id
+        WHERE p.party_code = $1
+        ORDER BY (e.status = 'live') DESC, p.updated_at DESC LIMIT 1`, [code]);
+        const row = rows[0];
+        if (!row)
+            return null;
+        const event = await this.options.events.get(String(row["event_id"] ?? ""));
+        if (!event)
+            return null;
+        return { party: partyFrom(row, event), event };
+    }
     /** The party behind a nixamp room or slug, for a client that has only that. */
     async byEvent(reference) {
         await this.ensure();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.28.37",
+  "version": "0.28.41",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",
@@ -47,12 +47,12 @@
   "dependencies": {
     "@profullstack/auth-system": "^0.6.0",
     "@profullstack/hqtui": "^0.5.0",
+    "@profullstack/notifications": "^0.1.0",
     "@profullstack/synconfig": "^0.1.2",
     "@profullstack/throttle": "0.2.2",
-    "@profullstack/x402-gateway": "0.6.0",
+    "@profullstack/x402-gateway": "^0.7.0",
     "acme-client": "5.4.0",
-    "pg": "^8.23.0",
-    "web-push": "^3.6.7"
+    "pg": "^8.23.0"
   },
   "optionalDependencies": {
     "@huggingface/transformers": "^4.2.0"
@@ -60,7 +60,6 @@
   "devDependencies": {
     "@types/node": "^26",
     "@types/pg": "^8.23.1",
-    "@types/web-push": "^3.6.4",
     "typescript": "^7.0.2"
   },
   "trustedDependencies": [
@@ -82,6 +81,7 @@
   },
   "overrides": {
     "https-proxy-agent": "7.0.6",
-    "tslib": "2.8.1"
+    "tslib": "2.8.1",
+    "@profullstack/x402-gateway": "^0.7.0"
   }
 }

package/src/classroom.ts

@@ -16,7 +16,7 @@ export function publicWebUrl(value: unknown): string | null {
   } catch { return null; }
 }
 
-export function classroomBroadcast(value: unknown): { provider: "pairux" | "nixamp"; url: string; embed: string; join: string } | null {
+export function classroomBroadcast(value: unknown): { provider: "pairux" | "nixamp" | "media"; url: string; embed: string; join: string } | null {
   const safe = publicWebUrl(value);
   if (!safe) return null;
   const url = new URL(safe);
@@ -48,5 +48,9 @@ export function classroomBroadcast(value: unknown): { provider: "pairux" | "nixa
     player.searchParams.set("play", "live");
     return classroomBroadcast(player.href);
   }
+  // Direct media is loaded by the browser, never fetched by this server.
+  if (/\.(?:m3u8|mp4|webm|mp3|m4a|ogg|wav|ts)$/i.test(url.pathname)) {
+    return { provider: "media", url: safe, embed: safe, join: safe };
+  }
   return null;
 }

package/src/live-api.ts

@@ -36,6 +36,12 @@ export interface LiveApiOptions {
   site?: string;
   email?: (to: string, note: { title: string; body: string; url: string }) => Promise<boolean>;
   onEventUpdated?: (event: LiveEvent, previous: LiveEvent) => void;
+  /**
+   * The account's own card -- name, homepage, photo -- so a class made
+   * without them carries the host's instead of nothing. What the class
+   * says explicitly still wins.
+   */
+  hostProfile?: (userId: string) => Promise<{ hostName: string; homepageUrl: string; avatarUrl: string }>;
 }
 
 const CORS = {
@@ -309,6 +315,13 @@ export async function handleLiveApi(
         const account = await requiredAccount(request, response, options);
         if (!account) return true;
         const input = await body(request);
+        if (options.hostProfile) {
+          const card = await options.hostProfile(account.id);
+          for (const key of ["hostName", "homepageUrl", "avatarUrl"] as const) {
+            const given = input[key];
+            if (card[key] && (given === undefined || given === null || given === "")) input[key] = card[key];
+          }
+        }
         const event = await options.events.create(account.id, { ...input, title: input["title"] });
         json(response, 201, view(event, account));
         return true;

package/src/live-events.ts

@@ -307,7 +307,7 @@ function classroomSettings(input: CreateLiveEventInput | UpdateLiveEventInput, c
     if (key === "hostName") settings[key] = value;
     else if (key === "broadcastUrl") {
       const broadcast = classroomBroadcast(value);
-      if (!broadcast) throw new LiveEventError("Use a Pairux live/join link or a Nixamp Share link with a stream selected. Admin links cannot be shared.", 422);
+      if (!broadcast) throw new LiveEventError("Use a Nixamp Share link, a direct HTTPS media link, or a Pairux live/join link. Admin links cannot be shared.", 422);
       settings[key] = broadcast.url;
     } else {
       const safe = publicWebUrl(value);

package/src/live-voice.ts

@@ -6,6 +6,7 @@ import type { VoiceProfile } from "./voice-profile.ts";
 import { Guard } from "./guard.ts";
 import type { TranslationMeter } from "./translation-passes.ts";
 import type { Queryable } from "./follows.ts";
+import { voiceProviderFailure } from "./voice-provider.ts";
 
 export const LIVE_VOICE_MODEL = "eleven_flash_v2_5";
 export const LIVE_VOICE_RATE = 16_000;
@@ -37,6 +38,20 @@ export class LiveVoice {
   private readonly dailyAudioSeconds: number;
   private readonly userDailyChars: number;
   private readonly userDailyAudioSeconds: number;
+  private providerPause: { until: number; error: SpeechError } | null = null;
+
+  private checkProvider(): void {
+    if (this.providerPause && this.providerPause.until > this.now()) throw this.providerPause.error;
+  }
+
+  private async providerFailed(response: Response, operation: string): Promise<never> {
+    const failure = await voiceProviderFailure(response);
+    const until = this.now() + failure.cooldownMs;
+    // Another in-flight response must not shorten an existing billing pause.
+    if (!this.providerPause || this.providerPause.until < until) this.providerPause = { until, error: failure.error };
+    console.error(JSON.stringify({ event: "voice_provider_failure", provider: "elevenlabs", operation, status: response.status, code: failure.code, cooldownMs: failure.cooldownMs }));
+    throw failure.error;
+  }
 
   constructor(options: { apiKey?: string; fetcher?: typeof fetch; now?: () => number; charsPerMinute?: number; dailyChars?: number; dailyAudioSeconds?: number; userDailyChars?: number; userDailyAudioSeconds?: number; db?: Queryable; billing?: TranslationMeter } = {}) {
     this.key = options.apiKey ?? process.env["ELEVENLABS_API_KEY"] ?? "";
@@ -60,6 +75,7 @@ export class LiveVoice {
   async hear(bytes: Uint8Array, by: string, signal?: AbortSignal, meter = this.billing, resource = ""): Promise<SpeakerTranscript> {
     if (!this.available()) throw new SpeechError("speaker voices are unavailable", 503);
     await meter?.require(by, resource);
+    this.checkProvider();
     const wav = decodeWav(bytes);
     const seconds = wav.samples.length / wav.rate;
     if (wav.rate !== 16000 || wav.channels !== 1 || seconds < 0.2 || seconds > 15.1) throw new SpeechError("send up to 15 seconds of mono 16 kHz WAV", 400);
@@ -77,6 +93,7 @@ export class LiveVoice {
       await this.reserve(`scribe:user:${by}`, billed, this.userDailyAudioSeconds, 86_400_000);
       await this.reserve("scribe:server", billed, this.dailyAudioSeconds, 86_400_000);
       signal?.throwIfAborted();
+      this.checkProvider();
       const form = new FormData();
       // Canonical PCM prevents a crafted container from billing more audio
       // than the duration we validated, and removes uploaded metadata.
@@ -91,8 +108,9 @@ export class LiveVoice {
         method: "POST", headers: { "xi-api-key": this.key }, body: form,
         signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000),
       });
-      if (!answer.ok) throw new SpeechError("speaker transcription could not run; check provider quota and permissions", answer.status === 429 ? 429 : 502);
+      if (!answer.ok) await this.providerFailed(answer, "transcription");
       accepted = true;
+      console.info(JSON.stringify({ event: "voice_provider_usage", provider: "elevenlabs", operation: "transcription", account: createHash("sha256").update(by).digest("hex").slice(0, 16), audioSeconds: seconds }));
       if (reservation) await meter!.commit(reservation);
       return speakerTurns(await answer.json() as ScribeResult, wav);
     } catch (error) {
@@ -103,12 +121,13 @@ export class LiveVoice {
 
   async voices(): Promise<LiveVoiceChoice[]> {
     if (!this.available()) throw new SpeechError("translated audio needs ELEVENLABS_API_KEY on the account server", 503);
+    this.checkProvider();
     if (!this.catalog || this.now() >= this.catalogUntil) {
       this.catalogUntil = this.now() + 3600_000;
       this.catalog = this.fetcher("https://api.elevenlabs.io/v2/voices?page_size=100&voice_type=default", {
         headers: { "xi-api-key": this.key }, signal: AbortSignal.timeout(8000),
       }).then(async response => {
-        if (!response.ok) throw new SpeechError("ElevenLabs could not list voices; check the server key and its voice permissions", 503);
+        if (!response.ok) await this.providerFailed(response, "voices");
         const body = await response.json() as { voices: { voice_id: string; name: string; labels?: Record<string, string> }[] };
         return body.voices.filter(voice => /^[a-zA-Z0-9_-]+$/.test(voice.voice_id)).map(voice => ({
           id: voice.voice_id, name: voice.name, gender: voice.labels?.["gender"] ?? "neutral", language: voice.labels?.["language"] ?? "",
@@ -238,6 +257,7 @@ export class LiveVoice {
     let accepted = false;
     try {
       await this.charge(by, ask.channel ?? "direct", text.length);
+      this.checkProvider();
       signal?.throwIfAborted();
       reservation = await meter?.reserve(by, "voice", text.length, ask.channel);
       const response = await this.fetcher(`https://api.elevenlabs.io/v1/text-to-speech/${voice.id}/stream?output_format=pcm_16000`, {
@@ -246,9 +266,11 @@ export class LiveVoice {
         body: JSON.stringify({ text, model_id: LIVE_VOICE_MODEL, language_code: ask.language }),
         signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000),
       });
-      if (!response.ok || !response.body) throw new SpeechError(response.status === 429 ? "ElevenLabs audio quota is temporarily exhausted" : "ElevenLabs could not generate audio; check the server key and quota", response.status === 429 ? 429 : 502);
+      if (!response.ok) await this.providerFailed(response, "synthesis");
+      if (!response.body) throw new SpeechError("ElevenLabs returned no audio", 502);
       // Once the provider accepts, aborting playback cannot refund heard audio.
       accepted = true;
+      console.info(JSON.stringify({ event: "voice_provider_usage", provider: "elevenlabs", operation: "synthesis", account: createHash("sha256").update(by).digest("hex").slice(0, 16), characters: text.length }));
       if (reservation) await meter!.commit(reservation);
       const [play, keep] = response.body.tee();
       void (async () => {