nixamp 0.28.38 → 0.28.41

package/dist/oauth-api.js

@@ -121,7 +121,7 @@ function partyBody(parties, view, caller) {
         party: { ...view.party, positionNow: parties.positionNow(view.party) },
         event: view.event,
         links: parties.links(view.party),
-        host: view.event.ownerId === caller.account.id,
+        host: caller !== null && view.event.ownerId === caller.account.id,
     };
 }
 // --- the handler ---------------------------------------------------------------
@@ -282,15 +282,28 @@ export async function handleOAuthApi(request, response, url, options) {
                 return true;
             }
             const caller = await callerFor(request, options, "parties");
-            if (caller === null) {
+            const rest = path.slice("/api/v1/watch-parties/".length).split("/");
+            const reference = decodeURIComponent(rest[0] ?? "");
+            const action = rest[1];
+            // Reading one party is open, the way its /live/<slug> page is: the code
+            // or the room link IS the invitation, and a person who was handed one
+            // on a television or in a terminal has no session on nixamp.com yet.
+            // Everything else -- the list, bridging, moving playback, ending --
+            // still needs a session or a token with the parties scope.
+            const openRead = path !== "/api/v1/watch-parties" && !action && request.method === "GET";
+            if (caller === null && !openRead) {
                 json(response, 401, { error: "a session, or a token granted the parties scope, is needed here" });
                 return true;
             }
             // A client bridges parties under its own origin, so two sites cannot
             // collide on a six-character code; a person acting directly is filed
             // under nixamp itself.
-            const origin = caller.clientId || "nixamp";
+            const origin = caller?.clientId || "nixamp";
             if (path === "/api/v1/watch-parties") {
+                if (caller === null) {
+                    json(response, 401, { error: "a session, or a token granted the parties scope, is needed here" });
+                    return true;
+                }
                 if (request.method === "GET") {
                     const wanted = url.searchParams.get("origin");
                     const found = await parties.list({
@@ -324,14 +337,15 @@ export async function handleOAuthApi(request, response, url, options) {
                 json(response, 405, { error: "GET or POST" });
                 return true;
             }
-            const rest = path.slice("/api/v1/watch-parties/".length).split("/");
-            const reference = decodeURIComponent(rest[0] ?? "");
-            const action = rest[1];
             // A party is findable by its code on the origin that bridged it, or by
             // the nixamp slug or room a client was handed, because a nixamp client
-            // arriving from a share link has only the latter.
-            const view = (await parties.byCode(origin, reference).catch(() => null)) ?? (await parties.byEvent(reference));
-            if (!view) {
+            // arriving from a share link has only the latter. A person on
+            // nixamp.com with only a code gets the party that code names on
+            // whichever site bridged it.
+            const view = (await parties.byCode(origin, reference).catch(() => null)) ??
+                (await parties.byEvent(reference)) ??
+                (caller === null || caller.clientId === "" ? await parties.byAnyCode(reference).catch(() => null) : null);
+            if (!view || (caller === null && view.event.visibility === "private")) {
                 json(response, 404, { error: "watch party not found" });
                 return true;
             }
@@ -339,6 +353,10 @@ export async function handleOAuthApi(request, response, url, options) {
                 json(response, 200, partyBody(parties, view, caller));
                 return true;
             }
+            if (caller === null) {
+                json(response, 401, { error: "a session, or a token granted the parties scope, is needed here" });
+                return true;
+            }
             if (action === "playback" && request.method === "POST") {
                 let input;
                 try {

package/dist/oauth-server.d.ts

@@ -18,6 +18,7 @@ export declare const SCOPES: {
     readonly profile: "who you are on nixamp (your handle)";
     readonly email: "the address on your account";
     readonly parties: "host and join watch parties as you";
+    readonly streams: "see the servers you run on nixamp, and what is live on them";
     readonly offline_access: "stay connected without asking again";
 };
 export type Scope = keyof typeof SCOPES;
@@ -35,7 +36,14 @@ export declare const REFRESH_TTL_MS: number;
  */
 export declare const BITTORRENTED_CLIENT: OAuthClient;
 /**
- * The registered clients: the built-in one, plus whatever NIXAMP_OAUTH_CLIENTS
+ * backtoschool.help runs on this codebase and used to tell its teachers that
+ * their school identity *was* a nixamp account. It is not, any more: a school
+ * account is a school account, and nixamp is the broadcast backend a host may
+ * connect -- through this client, like any other site. Public, PKCE only.
+ */
+export declare const BACKTOSCHOOL_CLIENT: OAuthClient;
+/**
+ * The registered clients: the built-in ones, plus whatever NIXAMP_OAUTH_CLIENTS
  * names. The variable is a JSON list of `{id, name, redirectUris, secret?,
  * homepage?}`; an entry with the built-in id replaces it, so a staging
  * bittorrented can point the callback somewhere else.

package/dist/oauth-server.js

@@ -34,6 +34,7 @@ export const SCOPES = {
     profile: "who you are on nixamp (your handle)",
     email: "the address on your account",
     parties: "host and join watch parties as you",
+    streams: "see the servers you run on nixamp, and what is live on them",
     offline_access: "stay connected without asking again",
 };
 export const SCOPE_NAMES = Object.keys(SCOPES);
@@ -59,13 +60,32 @@ export const BITTORRENTED_CLIENT = {
     ],
 };
 /**
- * The registered clients: the built-in one, plus whatever NIXAMP_OAUTH_CLIENTS
+ * backtoschool.help runs on this codebase and used to tell its teachers that
+ * their school identity *was* a nixamp account. It is not, any more: a school
+ * account is a school account, and nixamp is the broadcast backend a host may
+ * connect -- through this client, like any other site. Public, PKCE only.
+ */
+export const BACKTOSCHOOL_CLIENT = {
+    id: "backtoschool",
+    name: "BackToSchool.help",
+    homepage: "https://backtoschool.help",
+    redirectUris: [
+        "https://backtoschool.help/api/v1/nixamp/callback",
+        "https://www.backtoschool.help/api/v1/nixamp/callback",
+        "http://localhost:5174/api/v1/nixamp/callback",
+    ],
+};
+/**
+ * The registered clients: the built-in ones, plus whatever NIXAMP_OAUTH_CLIENTS
  * names. The variable is a JSON list of `{id, name, redirectUris, secret?,
  * homepage?}`; an entry with the built-in id replaces it, so a staging
  * bittorrented can point the callback somewhere else.
  */
 export function clientsFrom(env) {
-    const byId = new Map([[BITTORRENTED_CLIENT.id, BITTORRENTED_CLIENT]]);
+    const byId = new Map([
+        [BITTORRENTED_CLIENT.id, BITTORRENTED_CLIENT],
+        [BACKTOSCHOOL_CLIENT.id, BACKTOSCHOOL_CLIENT],
+    ]);
     const raw = env["NIXAMP_OAUTH_CLIENTS"];
     if (raw) {
         let parsed = [];
@@ -95,6 +115,8 @@ export function clientsFrom(env) {
     }
     if (env["NIXAMP_OAUTH_BITTORRENTED"] === "off")
         byId.delete(BITTORRENTED_CLIENT.id);
+    if (env["NIXAMP_OAUTH_BACKTOSCHOOL"] === "off")
+        byId.delete(BACKTOSCHOOL_CLIENT.id);
     return [...byId.values()];
 }
 /** Loopback is the address; the port is whatever the CLI got (RFC 8252 §7.3). */

package/dist/profiles.d.ts

@@ -0,0 +1,85 @@
+import type { Queryable } from "./follows.ts";
+/** The card as the account holder sees it. */
+export interface Profile {
+    name: string;
+    homepage: string;
+    /** A picture somewhere on the web, when they gave one instead of uploading. */
+    avatarUrl: string;
+    bio: string;
+    /** Set when a photo is stored here; the etag changes with the bytes. */
+    photo: string;
+}
+export interface ProfileInput {
+    name?: unknown;
+    homepage?: unknown;
+    avatarUrl?: unknown;
+    bio?: unknown;
+}
+/** What a classroom shows about its host. */
+export interface HostCard {
+    hostName: string;
+    homepageUrl: string;
+    avatarUrl: string;
+}
+export declare const EMPTY_PROFILE: Profile;
+/** A photo is a picture, not a document: a megabyte is plenty for a face. */
+export declare const PHOTO_LIMIT: number;
+export declare const NAME_LIMIT = 100;
+export declare const BIO_LIMIT = 1000;
+/**
+ * The type is read from the bytes, never from the header: a browser sends
+ * whatever it was told, and what is served back must be what the file is.
+ */
+export declare function sniffImage(bytes: Uint8Array): string;
+/**
+ * What may be written. Every field is optional and what is not sent is
+ * kept; an empty string clears. A link must be https without credentials,
+ * the same rule a classroom applies, so a card never fails at class time.
+ */
+export declare function cleanProfile(input: ProfileInput): {
+    fields: Partial<Profile>;
+    error: string;
+};
+/**
+ * The parts of an OpenProfile.md that say who somebody is: the `#` line is
+ * the name, the identity block gives `Avatar` and `Web`, the first prose
+ * line is the headline, and the first bullet under `## Photos` stands in
+ * for a missing Avatar. Everything else is somebody else's business.
+ */
+export declare function readOpenProfile(markdown: string): Partial<Profile>;
+/** The three things a classroom shows, from the card, with a stored photo served from here. */
+export declare function hostCard(profile: Profile, userId: string, site: string): HostCard;
+export declare class AccountProfiles {
+    private readonly db;
+    private readonly fetcher;
+    private ready;
+    constructor(db: Queryable, fetcher?: typeof fetch);
+    private ensure;
+    of(userId: string): Promise<Profile>;
+    /** Write what was sent, keep what was not. */
+    set(userId: string, input: ProfileInput): Promise<{
+        profile: Profile | null;
+        error: string;
+    }>;
+    /** Keep a photo. The type comes from the bytes; a file that is not a picture is refused. */
+    setPhoto(userId: string, bytes: Uint8Array): Promise<{
+        profile: Profile | null;
+        error: string;
+    }>;
+    removePhoto(userId: string): Promise<Profile>;
+    /** The stored photo, to serve. Null when there is none. */
+    photo(userId: string): Promise<{
+        bytes: Uint8Array;
+        type: string;
+        etag: string;
+    } | null>;
+    /**
+     * Fill the card from an OpenProfile.md. What the file says replaces what
+     * is here; what the file does not say is kept. A stored photo stays: an
+     * Avatar link is only used where no photo was uploaded.
+     */
+    importFrom(userId: string, url: string): Promise<{
+        profile: Profile | null;
+        error: string;
+    }>;
+}

package/dist/server.d.ts

@@ -11,6 +11,8 @@ import { type ResetMail } from "./password-reset.ts";
 import { Handles } from "./handles.ts";
 import { OpenDirs } from "./opendirs.ts";
 import { Servers } from "./servers.ts";
+import { AccountProfiles } from "./profiles.ts";
+import { NixampLinks } from "./nixamp-link.ts";
 import { SignIn } from "./oauth.ts";
 import { AuthorizationServer } from "./oauth-server.ts";
 import { WatchParties } from "./watch-party.ts";
@@ -29,6 +31,7 @@ import { Names } from "./names.ts";
 import { Certs } from "./certs.ts";
 import { type Throttle } from "@profullstack/throttle";
 import { type Notification } from "./notify.ts";
+import { type VapidKeys } from "@profullstack/notifications/server";
 import { EventWriter } from "./event-writer.ts";
 import { LiveEvents, type LiveEvent } from "./live-events.ts";
 import { Tickets } from "./tickets.ts";
@@ -669,6 +672,10 @@ export interface HandlerOptions {
     servers?: Servers;
     /** The name other people see, which is never the address they signed up with. */
     handles?: Handles;
+    /** The account's card: a name, a homepage, a photo, a line. One table, read by every site here. */
+    accountProfiles?: AccountProfiles;
+    /** nixamp accounts connected to accounts here, where this site is a client of nixamp.com. */
+    links?: NixampLinks;
     /** Open directories people have found, which anyone may read. */
     openDirs?: OpenDirs;
     /** True when this instance is reached over https, for the cookie's Secure. */
@@ -764,8 +771,11 @@ export interface HandlerOptions {
      * Response it is refused with.
      */
     throttle?: Throttle;
-    /** The VAPID public key a browser needs before it can subscribe. */
-    vapidPublicKey?: string;
+    /**
+     * The VAPID pair, read from the environment when the server starts. Only the
+     * public half leaves: it is what a browser needs before it can subscribe.
+     */
+    vapidKeys?: VapidKeys | null;
 }
 /**
  * The whole HTTP surface, as a plain function of a request — so a test can

package/dist/server.js

@@ -33,10 +33,13 @@ import { passwordResetPage } from "./password-reset-page.js";
 import { anonymousHandle, Handles } from "./handles.js";
 import { OpenDirs } from "./opendirs.js";
 import { Servers } from "./servers.js";
+import { AccountProfiles, hostCard, PHOTO_LIMIT } from "./profiles.js";
+import { NixampLinks, nixampExchange } from "./nixamp-link.js";
+import { handleNixampLinkApi, nixampLinkPath } from "./nixamp-link-api.js";
 import { DeviceGrants } from "./device.js";
 import { BAD_KEY_LIMIT, callerOf, Guard, SIGN_IN_LIMIT } from "./guard.js";
 import { deviceDonePage, devicePage, exchangeCode, providersFrom, signInFailedPage, SignIn, } from "./oauth.js";
-import { AuthorizationServer, SCOPE_NAMES, clientsFrom } from "./oauth-server.js";
+import { AuthorizationServer, BACKTOSCHOOL_CLIENT, SCOPE_NAMES, clientsFrom } from "./oauth-server.js";
 import { handleOAuthApi, oauthApiPath } from "./oauth-api.js";
 import { WatchParties } from "./watch-party.js";
 import { needsAdmin, needsMember, Owner } from "./owner.js";
@@ -66,6 +69,7 @@ import { forbiddenLibrary, readLibrary } from "./library.js";
 import { createThrottle, presentedCredential } from "@profullstack/throttle";
 import { Durable } from "./durable.js";
 import { notifyAll, resendEmail, webPush } from "./notify.js";
+import { vapidKeysFromEnv, vapidPublicKeyResponse } from "@profullstack/notifications/server";
 import { inviteSubject, inviteText, isEmail, isPhone, watchLink } from "./invite.js";
 import { EventWriter } from "./event-writer.js";
 import { handleLiveApi } from "./live-api.js";
@@ -1138,6 +1142,12 @@ export function isSignInPath(path) {
         path === "/api/v1/servers" ||
         path.startsWith("/api/v1/servers/") ||
         path === "/api/v1/me/handle" ||
+        path === "/api/v1/me/profile" ||
+        path.startsWith("/api/v1/me/profile/") ||
+        // A stored photo is public: it is on every class the host runs.
+        path.startsWith("/api/v1/profiles/") ||
+        // "Connect nixamp" on a site that is a client of nixamp.com.
+        nixampLinkPath(path) ||
         // Public to read, so it must not be behind a share key either.
         path === "/api/v1/opendirs" ||
         path.startsWith("/api/v1/opendirs/") ||
@@ -1447,6 +1457,18 @@ export function createHandler(engine, options) {
             secureCookies: options.secureCookies ?? false,
         }))
             return;
+        // A site here that is a client of nixamp.com: connect, callback, streams.
+        if (options.links && options.accounts && options.authServer && await handleNixampLinkApi(request, response, url, {
+            links: options.links,
+            accounts: options.accounts,
+            issuer: options.site ?? DEFAULT_DIRECTORY,
+            site: accountSite,
+            redirectUris: options.authServer.client(BACKTOSCHOOL_CLIENT.id)?.redirectUris ?? [],
+            home: "/#settings",
+            secureCookies: options.secureCookies ?? false,
+            fetcher: options.links.fetcher,
+        }))
+            return;
         if (options.events && await handleLiveApi(request, response, url, {
             events: options.events,
             ...(options.eventWriter ? { eventWriter: options.eventWriter } : {}),
@@ -1457,6 +1479,9 @@ export function createHandler(engine, options) {
             ...(eventSite ? { site: eventSite } : {}),
             ...(options.invites?.email ? { email: options.invites.email } : {}),
             ...(options.onEventUpdated ? { onEventUpdated: options.onEventUpdated } : {}),
+            ...(options.accountProfiles
+                ? { hostProfile: async (userId) => hostCard(await options.accountProfiles.of(userId), userId, accountSite) }
+                : {}),
         }))
             return;
         // The page explaining the reminder texts. Public for the same reason the
@@ -1781,9 +1806,12 @@ export function createHandler(engine, options) {
         // --- where to reach a follower ----------------------------------------
         if (path.startsWith("/api/v1/notify") && options.follows && options.accounts) {
             // The key is public by design: it is what a browser needs before it can
-            // ask permission, and it is useless without the private half.
+            // ask permission, and it is useless without the private half. Served at
+            // run time, never built into the page: a key baked in at build time is
+            // how push quietly becomes "not supported" in production. 503 when this
+            // instance has no keys, so the browser can say so.
             if (path === "/api/v1/notify/key" && request.method === "GET") {
-                json(response, 200, { publicKey: options.vapidPublicKey ?? "" });
+                await answerWith(response, vapidPublicKeyResponse(options.vapidKeys));
                 return;
             }
             const me = await options.accounts.whoIs(tokenFrom(request.headers));
@@ -1826,7 +1854,19 @@ export function createHandler(engine, options) {
             }
             if (path === "/api/v1/notify/subscribe") {
                 if (request.method === "DELETE") {
-                    const endpoint = url.searchParams.get("endpoint") ?? "";
+                    // The endpoint arrives in the query (older pages) or as the JSON
+                    // body @profullstack/notifications sends: { endpoint }.
+                    let endpoint = url.searchParams.get("endpoint") ?? "";
+                    if (!endpoint) {
+                        try {
+                            const body = JSON.parse(await readBody(request));
+                            if (typeof body.endpoint === "string")
+                                endpoint = body.endpoint;
+                        }
+                        catch {
+                            // No body: nothing to forget.
+                        }
+                    }
                     await follows.removePush(endpoint);
                     json(response, 200, { ok: true });
                     return;
@@ -3137,6 +3177,146 @@ export function createHandler(engine, options) {
             json(response, 405, { error: "GET or PUT" });
             return;
         }
+        // --- the account's card -------------------------------------------------
+        //
+        // A name, a homepage, a photo and a line, said once. A class is made from
+        // it, a settings page edits it, and an OpenProfile.md fills it in one move.
+        if ((path === "/api/v1/me/profile" || path.startsWith("/api/v1/me/profile/")) && options.accountProfiles && options.accounts) {
+            const profiles = options.accountProfiles;
+            const who = await options.accounts.whoIs(tokenFrom(request.headers));
+            if (who === null) {
+                json(response, 401, { error: "not signed in" });
+                return;
+            }
+            const persona = options.handles ? await options.handles.persona(who.id) : null;
+            const answer = async () => {
+                const profile = await profiles.of(who.id);
+                // Read again: an import may just have remembered the address.
+                const now = options.handles ? await options.handles.persona(who.id) : null;
+                json(response, 200, {
+                    ...profile,
+                    card: hostCard(profile, who.id, accountSite),
+                    openProfile: now?.profile ?? "",
+                    handle: now?.handle || fallbackHandle(who.id),
+                });
+            };
+            if (path === "/api/v1/me/profile") {
+                if (request.method === "GET") {
+                    await answer();
+                    return;
+                }
+                if (request.method === "PUT" || request.method === "POST") {
+                    let body;
+                    try {
+                        body = JSON.parse(await readBody(request));
+                    }
+                    catch {
+                        json(response, 400, { error: "bad JSON" });
+                        return;
+                    }
+                    const written = await profiles.set(who.id, body);
+                    if (written.error) {
+                        json(response, 422, { error: written.error });
+                        return;
+                    }
+                    await answer();
+                    return;
+                }
+                json(response, 405, { error: "GET or PUT" });
+                return;
+            }
+            if (path === "/api/v1/me/profile/import") {
+                if (request.method !== "POST") {
+                    json(response, 405, { error: "POST only" });
+                    return;
+                }
+                let body = {};
+                try {
+                    const raw = await readBody(request);
+                    body = raw.trim() === "" ? {} : JSON.parse(raw);
+                }
+                catch {
+                    json(response, 400, { error: "bad JSON" });
+                    return;
+                }
+                const given = typeof body.url === "string" ? body.url.trim() : "";
+                const from = given || persona?.profile || "";
+                if (from === "") {
+                    json(response, 422, { error: "give the URL of your OpenProfile.md, like https://you.example/.well-known/openprofile.md" });
+                    return;
+                }
+                const imported = await profiles.importFrom(who.id, from);
+                if (imported.error) {
+                    json(response, 422, { error: imported.error });
+                    return;
+                }
+                // The address is remembered, so the phone line reads the same file
+                // for the voice, and a later import needs no URL.
+                if (given && options.handles && given !== persona?.profile) {
+                    await options.handles.describe(who.id, fallbackHandle(who.id), { profile: given });
+                }
+                await answer();
+                return;
+            }
+            if (path === "/api/v1/me/profile/photo") {
+                if (request.method === "PUT" || request.method === "POST") {
+                    let bytes;
+                    try {
+                        bytes = await readBytes(request, PHOTO_LIMIT);
+                    }
+                    catch {
+                        json(response, 413, { error: "a photo may be up to 1 MB" });
+                        return;
+                    }
+                    const kept = await profiles.setPhoto(who.id, bytes);
+                    if (kept.error) {
+                        json(response, 422, { error: kept.error });
+                        return;
+                    }
+                    await answer();
+                    return;
+                }
+                if (request.method === "DELETE") {
+                    await profiles.removePhoto(who.id);
+                    await answer();
+                    return;
+                }
+                json(response, 405, { error: "PUT or DELETE" });
+                return;
+            }
+            json(response, 404, { error: "no such profile route" });
+            return;
+        }
+        // The stored photo, public: it is on every class the host runs, and a
+        // page shows it to strangers by design. Cached by its etag.
+        if (path.startsWith("/api/v1/profiles/") && path.endsWith("/photo") && options.accountProfiles) {
+            if (request.method !== "GET" && request.method !== "HEAD") {
+                json(response, 405, { error: "GET only" });
+                return;
+            }
+            const userId = decodeURIComponent(path.slice("/api/v1/profiles/".length, -"/photo".length));
+            const photo = userId === "" ? null : await options.accountProfiles.photo(userId);
+            if (photo === null) {
+                json(response, 404, { error: "no photo" });
+                return;
+            }
+            const etag = `"${photo.etag}"`;
+            if (request.headers["if-none-match"] === etag) {
+                response.writeHead(304, { etag, "cache-control": "public, max-age=86400" });
+                response.end();
+                return;
+            }
+            response.writeHead(200, {
+                "content-type": photo.type,
+                "content-length": photo.bytes.length,
+                etag,
+                "cache-control": "public, max-age=86400",
+                "x-content-type-options": "nosniff",
+                "access-control-allow-origin": "*",
+            });
+            response.end(request.method === "HEAD" ? undefined : Buffer.from(photo.bytes));
+            return;
+        }
         // --- the servers this account runs ----------------------------------
         //
         // Kept against the account rather than the machine, so the list reads the
@@ -5497,7 +5677,11 @@ function sendFile(request, response, file) {
 export function createServer(engine, options) {
     const handle = createHandler(engine, options);
     const onRequest = (request, response) => {
-        handle(request, response).catch(() => {
+        handle(request, response).catch((error) => {
+            // Silent by default: a stack trace per bad request is a log nobody
+            // reads. Said aloud when asked, which is how a 500 in a test is found.
+            if (process.env["NIXAMP_DEBUG"])
+                console.error(error);
             if (!response.headersSent)
                 json(response, 500, { error: "server error" });
             else
@@ -5849,8 +6033,8 @@ export async function serve(argv, version = "0.1.0") {
     // The two things that were promises kept only in memory: a caller who was
     // told they would be texted, and the ended stream a code still points at.
     const durable = pool ? new Durable(pool, (message) => console.log(message)) : undefined;
-    const vapidPublicKey = process.env["VAPID_PUBLIC_KEY"] ?? "";
-    const vapidPrivateKey = process.env["VAPID_PRIVATE_KEY"] ?? "";
+    // Read at run time, and null unless both halves are set.
+    const vapidKeys = vapidKeysFromEnv(process.env);
     /**
      * Tell a broadcaster's followers, on whatever they asked to be told on.
      *
@@ -5888,11 +6072,10 @@ export async function serve(argv, version = "0.1.0") {
                     }),
                 }
                 : {}),
-            ...(vapidPublicKey && vapidPrivateKey
+            ...(vapidKeys
                 ? {
                     push: webPush({
-                        publicKey: vapidPublicKey,
-                        privateKey: vapidPrivateKey,
+                        ...vapidKeys,
                         subject: process.env["NIXAMP_SITE"] ?? DEFAULT_DIRECTORY,
                         onEvent: (message) => console.log(message),
                     }),
@@ -5927,7 +6110,7 @@ export async function serve(argv, version = "0.1.0") {
         };
         void follows.audience(event.ownerId).then((audience) => notifyAll(audience, note, {
             ...(eventMail ? { email: resendEmail({ ...eventMail, onEvent: (message) => console.log(message) }) } : {}),
-            ...(vapidPublicKey && vapidPrivateKey ? { push: webPush({ publicKey: vapidPublicKey, privateKey: vapidPrivateKey, subject: nixampSite, onEvent: (message) => console.log(message) }) } : {}),
+            ...(vapidKeys ? { push: webPush({ ...vapidKeys, subject: nixampSite, onEvent: (message) => console.log(message) }) } : {}),
             onGone: (endpoint) => follows.removePush(endpoint),
             onEvent: (message) => console.log(message),
         })).catch(() => undefined);
@@ -6249,7 +6432,7 @@ export async function serve(argv, version = "0.1.0") {
         load: (next) => loadSource(tools, next, false),
         tag: (next) => loadTagged(tools, next),
         ...(directory ? { directory } : {}),
-        ...(follows ? { follows, vapidPublicKey } : {}),
+        ...(follows ? { follows, vapidKeys } : {}),
         ...(favorites ? { favorites } : {}),
         ...(settingsSync ? { settingsSync } : {}),
         ...(events ? { events, eventWriter: new EventWriter({
@@ -6341,7 +6524,16 @@ export async function serve(argv, version = "0.1.0") {
                 // The same pool the follows and reminders use: three small tables in
                 // one database do not want three sets of connections.
                 ...(pool
-                    ? { servers: new Servers(pool), handles: new Handles(pool), openDirs: new OpenDirs(pool) }
+                    ? {
+                        servers: new Servers(pool),
+                        handles: new Handles(pool),
+                        openDirs: new OpenDirs(pool),
+                        accountProfiles: new AccountProfiles(pool),
+                        // The school's side of "Connect nixamp": tokens from nixamp.com,
+                        // kept against the school account. The issuer is this same
+                        // program in production, reached over HTTP like any client.
+                        links: new NixampLinks(pool, nixampExchange(nixampSite, BACKTOSCHOOL_CLIENT.id), BACKTOSCHOOL_CLIENT.id),
+                    }
                     : {}),
                 signIn: new SignIn(providersFrom(process.env), new DeviceGrants(), process.env["NIXAMP_SITE"] ?? DEFAULT_DIRECTORY),
             }

package/dist/voice-provider.d.ts

@@ -0,0 +1,9 @@
+import { SpeechError } from "./speech.ts";
+/** Only fixed messages/codes leave this boundary: provider bodies can contain
+ * account information. Authorization and billing errors must not be retried
+ * as transient 502s by the live player. */
+export declare function voiceProviderFailure(response: Response): Promise<{
+    error: SpeechError;
+    code: string;
+    cooldownMs: number;
+}>;

package/dist/voice-provider.js

@@ -0,0 +1,27 @@
+import { SpeechError } from "./speech.js";
+/** Only fixed messages/codes leave this boundary: provider bodies can contain
+ * account information. Authorization and billing errors must not be retried
+ * as transient 502s by the live player. */
+export async function voiceProviderFailure(response) {
+    let code = "unknown";
+    try {
+        const body = await response.json();
+        const status = body?.detail?.status;
+        if (typeof status === "string" && ["quota_exceeded", "invalid_api_key", "missing_permissions", "subscription_required", "subscription_expired", "payment_required", "payment_issue", "too_many_concurrent_requests", "rate_limit_exceeded"].includes(status))
+            code = status;
+    }
+    catch { /* Non-JSON provider failures still have an HTTP status. */ }
+    if (code === "quota_exceeded")
+        return { code, cooldownMs: 300_000, error: new SpeechError("ElevenLabs credits are exhausted. The site owner needs to check the provider balance.", 402) };
+    if (code === "payment_issue")
+        return { code, cooldownMs: 300_000, error: new SpeechError("ElevenLabs blocked transcription because its subscription payment failed. The site owner needs to complete the outstanding ElevenLabs invoice.", 402) };
+    if (["subscription_required", "subscription_expired", "payment_required"].includes(code) || response.status === 402)
+        return { code, cooldownMs: 300_000, error: new SpeechError("ElevenLabs billing needs attention. The site owner needs to check the provider subscription.", 402) };
+    if (["invalid_api_key", "missing_permissions"].includes(code) || [401, 403].includes(response.status))
+        return { code, cooldownMs: 300_000, error: new SpeechError("ElevenLabs rejected transcription or voice access. The site owner needs to check the provider key, permissions, and billing.", 424) };
+    if (response.status === 429) {
+        const retry = Number(response.headers.get("retry-after"));
+        return { code, cooldownMs: Math.min(300_000, Math.max(30_000, Number.isFinite(retry) ? retry * 1000 : 0)), error: new SpeechError("ElevenLabs is rate limited. Wait before enabling translated audio again.", 429) };
+    }
+    return { code, cooldownMs: 10_000, error: new SpeechError("ElevenLabs is temporarily unavailable. Try translated audio again shortly.", 502) };
+}

package/dist/watch-party.d.ts

@@ -86,6 +86,14 @@ export declare class WatchParties {
      */
     bridge(ownerId: string, origin: PartyOrigin, input: BridgeInput): Promise<PartyView>;
     byCode(origin: PartyOrigin, partyCode: string): Promise<PartyView | null>;
+    /**
+     * A party by its code alone, for somebody who has only the code.
+     *
+     * A code is unique per origin, not across them; a person typing one into
+     * nixamp.com is not asked which site it came from. The one still live, or
+     * the most recently touched, is the one they mean.
+     */
+    byAnyCode(partyCode: string): Promise<PartyView | null>;
     /** The party behind a nixamp room or slug, for a client that has only that. */
     byEvent(reference: string): Promise<PartyView | null>;
     /**