nixamp 0.34.0 → 0.35.0

package/dist/server.d.ts

@@ -26,6 +26,7 @@ import { ListenerStore } from "./library-user.ts";
 import { Importer } from "./handoff.ts";
 import { StationRunner } from "./station-runner.ts";
 import { StationStore } from "./stations.ts";
+import { StationUsage, type Limits } from "./station-metering.ts";
 import { CompressionService } from "./compression/service.ts";
 import { Enricher } from "./enrich.ts";
 import { Follows } from "./follows.ts";
@@ -582,6 +583,8 @@ export interface HandlerOptions {
     stations?: {
         store: StationStore;
         runner: StationRunner;
+        usage?: StationUsage;
+        limits?: Limits;
     };
     web: string | null;
     /** Branded clients on this same backend, keyed by an explicitly configured host. */

package/dist/server.js

@@ -63,6 +63,7 @@ import { handleHandoffs } from "./handoff-routes.js";
 import { STATION_PAGE, STATION_PAGE_CSP, STATION_PAGE_HTML } from "./station-page.js";
 import { StationRunner } from "./station-runner.js";
 import { StationError, StationStore, stationOfChannel } from "./stations.js";
+import { STATION_CONTROL_LIMIT, StationUsage, limitsFromEnv } from "./station-metering.js";
 import { CompressionService } from "./compression/service.js";
 import { handleChannelCompression, handleCompressionApi, handleStaticRelay } from "./compression/routes.js";
 import { DEFAULT_SITE as NICHEDB, Enricher, FIXTURE_TTL_MS } from "./enrich.js";
@@ -2274,6 +2275,12 @@ export function createHandler(engine, options) {
                 json,
                 readBody,
                 headers: CORS,
+                ...(options.stations.usage ? { usage: options.stations.usage } : {}),
+                ...(options.stations.limits ? { limits: options.stations.limits } : {}),
+                throttle: () => {
+                    const verdict = guard.check(`stations:${control.account || callerOf(request.headers, request.socket.remoteAddress, behindProxy)}`, STATION_CONTROL_LIMIT);
+                    return verdict.ok ? null : { retryAfter: verdict.retryAfter };
+                },
             });
             return;
         }
@@ -6168,7 +6175,13 @@ export async function serve(argv, version = "0.1.0") {
     const listeners = new ListenerStore(ListenerStore.fileFor(stateDir(), options.port));
     const library = { index: libraryIndex, probe: probeFile, retag: retagPlayer, listeners };
     const stationStore = new StationStore(StationStore.fileFor(stateDir(), options.port));
+    // What stations deliver, per month, and the operator's limits on it.
+    const stationUsage = new StationUsage(StationUsage.fileFor(stateDir(), options.port));
+    const stationLimits = limitsFromEnv();
+    process.once("exit", () => stationUsage.flush());
     stationRunner = new StationRunner({
+        onRestart: (id) => stationUsage.restarted(id),
+        onFailure: (id) => stationUsage.failed(id),
         store: stationStore,
         channels,
         pull: async (channelId, name, files, known) => Boolean(await pullChannel(channels, tools.ffprobe, channelId, name, files[0], [], "", {
@@ -6181,7 +6194,7 @@ export async function serve(argv, version = "0.1.0") {
         roots: () => [...new Set([engine.snapshot(false).root || chosen, ...libraryIndex.roots()])].filter((one) => one !== ""),
         log: (line) => console.log(line),
     });
-    const stations = { store: stationStore, runner: stationRunner };
+    const stations = { store: stationStore, runner: stationRunner, usage: stationUsage, limits: stationLimits };
     // Music handed over from BitTorrented, copied into a folder of our own.
     const importer = new Importer(join(stateDir(), `handoffs-${options.port}.json`), {
         index: libraryIndex,

package/dist/station-metering.d.ts

@@ -0,0 +1,59 @@
+export interface Limits {
+    stationListeners: number;
+    totalListeners: number;
+    runningStations: number;
+    /** Bytes per station per month; 0 is no allowance. */
+    monthlyBytes: number;
+}
+export declare function limitsFromEnv(env?: Record<string, string | undefined>): Limits;
+/** Station control: start, stop, edit, publish. Thirty a minute is a person. */
+export declare const STATION_CONTROL_LIMIT: {
+    allowed: number;
+    windowMs: number;
+};
+export interface MonthUsage {
+    bytes: number;
+    listenerSeconds: number;
+    peakListeners: number;
+    restarts: number;
+    failures: number;
+}
+export declare function monthOf(at: number): string;
+export declare class StationUsage {
+    private readonly file;
+    private readonly now;
+    /** station -> month -> usage */
+    private usage;
+    private live;
+    private timer;
+    constructor(file: string, now?: () => number);
+    static fileFor(stateDir: string, port: number): string;
+    private month;
+    private touch;
+    flush(): void;
+    /** Somebody started listening; returns what to call when they stop. */
+    joined(station: string): () => void;
+    delivered(station: string, bytes: number): void;
+    restarted(station: string): void;
+    failed(station: string): void;
+    listeners(station: string): number;
+    totalListeners(): number;
+    thisMonth(station: string): MonthUsage;
+    history(station: string): Record<string, MonthUsage>;
+    forget(station: string): void;
+    /**
+     * Whether one more listener may join this station now: null to go
+     * ahead, or why not, with a code and how long to wait.
+     */
+    admit(station: string, limits: Limits): {
+        code: string;
+        error: string;
+        status: number;
+        retryAfter: number;
+    } | null;
+}
+/** Things an owner should know about a station, in words. */
+export declare function alertsFor(station: {
+    desired: string;
+    failures: Record<string, number>;
+}, state: string, offlineSince: number, usage: MonthUsage, limits: Limits, now?: number): string[];

package/dist/station-metering.js

@@ -0,0 +1,189 @@
+/**
+ * What stations cost to run, and the limits that keep one from costing
+ * everything.
+ *
+ * Counted where it is spent: every byte a station's link delivers and every
+ * second somebody is connected, per station, per calendar month, kept in
+ * `usage-<port>.json`. Restarts and files that would not play are counted
+ * too, because those are what an operator is asked about.
+ *
+ * Limits are the operator's (environment, below), and each is a refusal a
+ * person can act on, never a silent cut:
+ *
+ *   NIXAMP_STATION_MAX_LISTENERS   per station (default 200)
+ *   NIXAMP_MAX_LISTENERS           across every station (default 500)
+ *   NIXAMP_MAX_RUNNING_STATIONS    stations on the air at once (default 10)
+ *   NIXAMP_STATION_MONTHLY_GB      delivered per station per month (default 0: no allowance)
+ *
+ * When an allowance runs out the policy is "pause": nobody new is admitted
+ * until the month turns or the allowance is raised; nobody already
+ * listening is cut off mid-song. Control requests are limited separately
+ * (STATION_CONTROL_LIMIT) so that a flood of listeners never locks the owner
+ * out, and a flood of control requests never starves listeners.
+ */
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+export function limitsFromEnv(env = process.env) {
+    const whole = (name, fallback) => {
+        const value = Number(env[name]);
+        return Number.isFinite(value) && value >= 0 ? Math.floor(value) : fallback;
+    };
+    return {
+        stationListeners: whole("NIXAMP_STATION_MAX_LISTENERS", 200),
+        totalListeners: whole("NIXAMP_MAX_LISTENERS", 500),
+        runningStations: whole("NIXAMP_MAX_RUNNING_STATIONS", 10),
+        monthlyBytes: Math.round(Number(env["NIXAMP_STATION_MONTHLY_GB"] ?? 0) * 1024 ** 3) || 0,
+    };
+}
+/** Station control: start, stop, edit, publish. Thirty a minute is a person. */
+export const STATION_CONTROL_LIMIT = { allowed: 30, windowMs: 60_000 };
+const BLANK = { bytes: 0, listenerSeconds: 0, peakListeners: 0, restarts: 0, failures: 0 };
+export function monthOf(at) {
+    return new Date(at).toISOString().slice(0, 7);
+}
+export class StationUsage {
+    file;
+    now;
+    /** station -> month -> usage */
+    usage = {};
+    live = new Map();
+    timer = null;
+    constructor(file, now = Date.now) {
+        this.file = file;
+        this.now = now;
+        try {
+            this.usage = JSON.parse(readFileSync(file, "utf8"));
+        }
+        catch {
+            this.usage = {};
+        }
+    }
+    static fileFor(stateDir, port) {
+        return join(stateDir, `usage-${port}.json`);
+    }
+    month(station, at = this.now()) {
+        const byMonth = (this.usage[station] ??= {});
+        return (byMonth[monthOf(at)] ??= { ...BLANK });
+    }
+    touch() {
+        if (this.timer)
+            return;
+        this.timer = setTimeout(() => this.flush(), 5_000);
+        this.timer.unref?.();
+    }
+    flush() {
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = null;
+        // Listening still going on is counted up to now, then counted on from now.
+        const at = this.now();
+        for (const [station, listeners] of this.live) {
+            for (const [who, since] of listeners) {
+                this.month(station, at).listenerSeconds += Math.max(0, (at - since) / 1000);
+                listeners.set(who, at);
+            }
+        }
+        try {
+            mkdirSync(dirname(this.file), { recursive: true });
+            const temporary = `${this.file}.${process.pid}.tmp`;
+            writeFileSync(temporary, JSON.stringify(this.usage), { mode: 0o600 });
+            renameSync(temporary, this.file);
+        }
+        catch {
+            // Counting is not a reason to stop serving.
+        }
+    }
+    /** Somebody started listening; returns what to call when they stop. */
+    joined(station) {
+        const who = {};
+        let listeners = this.live.get(station);
+        if (!listeners) {
+            listeners = new Map();
+            this.live.set(station, listeners);
+        }
+        listeners.set(who, this.now());
+        const month = this.month(station);
+        month.peakListeners = Math.max(month.peakListeners, listeners.size);
+        this.touch();
+        return () => {
+            const since = listeners.get(who);
+            if (since === undefined)
+                return;
+            listeners.delete(who);
+            this.month(station).listenerSeconds += Math.max(0, (this.now() - since) / 1000);
+            this.touch();
+        };
+    }
+    delivered(station, bytes) {
+        this.month(station).bytes += bytes;
+        this.touch();
+    }
+    restarted(station) {
+        this.month(station).restarts += 1;
+        this.touch();
+    }
+    failed(station) {
+        this.month(station).failures += 1;
+        this.touch();
+    }
+    listeners(station) {
+        return this.live.get(station)?.size ?? 0;
+    }
+    totalListeners() {
+        let total = 0;
+        for (const listeners of this.live.values())
+            total += listeners.size;
+        return total;
+    }
+    thisMonth(station) {
+        return { ...this.month(station) };
+    }
+    history(station) {
+        return { ...(this.usage[station] ?? {}) };
+    }
+    forget(station) {
+        delete this.usage[station];
+        this.live.delete(station);
+        this.touch();
+    }
+    /**
+     * Whether one more listener may join this station now: null to go
+     * ahead, or why not, with a code and how long to wait.
+     */
+    admit(station, limits) {
+        if (limits.monthlyBytes > 0 && this.month(station).bytes >= limits.monthlyBytes) {
+            const now = new Date(this.now());
+            const next = Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1);
+            return { code: "allowance_exhausted", error: "this station has used its delivery allowance for the month", status: 429, retryAfter: Math.ceil((next - this.now()) / 1000) };
+        }
+        if (limits.stationListeners > 0 && this.listeners(station) >= limits.stationListeners) {
+            return { code: "station_full", error: "this station is full; try again in a little while", status: 503, retryAfter: 60 };
+        }
+        if (limits.totalListeners > 0 && this.totalListeners() >= limits.totalListeners) {
+            return { code: "server_full", error: "this server is carrying as many listeners as it can; try again in a little while", status: 503, retryAfter: 60 };
+        }
+        return null;
+    }
+}
+/** Things an owner should know about a station, in words. */
+export function alertsFor(station, state, offlineSince, usage, limits, now = Date.now()) {
+    const alerts = [];
+    if (station.desired === "running" && (state === "offline" || state === "recovering") && offlineSince > 0) {
+        const minutes = Math.floor((now - offlineSince) / 60_000);
+        if (minutes >= 2)
+            alerts.push(`Off the air for ${minutes} minutes while it should be running.`);
+    }
+    const left = Object.values(station.failures).filter((count) => count >= 3).length;
+    if (left > 0)
+        alerts.push(`${left} file${left === 1 ? " is" : "s are"} left out because ${left === 1 ? "it" : "they"} would not play.`);
+    if (usage.restarts >= 5)
+        alerts.push(`Restarted ${usage.restarts} times this month: something keeps stopping it.`);
+    if (limits.monthlyBytes > 0) {
+        const share = usage.bytes / limits.monthlyBytes;
+        if (share >= 1)
+            alerts.push("The delivery allowance for this month is used up: nobody new can join until it resets.");
+        else if (share >= 0.9)
+            alerts.push(`${Math.round(share * 100)}% of this month's delivery allowance is used.`);
+    }
+    return alerts;
+}

package/dist/station-routes.d.ts

@@ -15,6 +15,7 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { Channels } from "./channels.ts";
 import type { StationRunner } from "./station-runner.ts";
+import { type Limits, type StationUsage } from "./station-metering.ts";
 import { type OwnerStation, type PublicStation, type Station, type StationStore } from "./stations.ts";
 /** Whether this path is one a station's own link may open, without the server's key. */
 export declare function isStationListenPath(path: string): boolean;
@@ -43,6 +44,13 @@ export interface StationContext {
     readBody: (request: IncomingMessage) => Promise<string>;
     /** Headers every answer carries (CORS). */
     headers: Record<string, string>;
+    /** Metering and limits; absent in tests that do not care. */
+    usage?: StationUsage;
+    limits?: Limits;
+    /** Null to go ahead with a change, or how long to wait (control rate limit). */
+    throttle?: () => {
+        retryAfter: number;
+    } | null;
 }
 declare function links(ctx: StationContext, station: Station): {
     page: string;

package/dist/station-routes.js

@@ -1,3 +1,4 @@
+import { alertsFor } from "./station-metering.js";
 import { StationError, channelOf, tokensMatch, } from "./stations.js";
 /** The three things a station's link opens. */
 const LISTEN = /^\/api\/v1\/stations\/([a-z0-9]{10})\/(stream|state|listen\.m3u|events)$/;
@@ -56,6 +57,10 @@ export function ownerView(ctx, station) {
         error: ctx.runner.error(station.id),
         links: links(ctx, station),
         nowPlaying: nowPlayingFile(ctx, station),
+        ...(ctx.usage && ctx.limits ? {
+            metrics: { listeners: ctx.usage.listeners(station.id), month: ctx.usage.thisMonth(station.id), limits: ctx.limits },
+            alerts: alertsFor(station, ctx.runner.observed(station.id), ctx.runner.downSince(station.id), ctx.usage.thisMonth(station.id), ctx.limits),
+        } : {}),
     };
 }
 /** Answers anything under /api/v1/stations; false when the path is not one. */
@@ -153,20 +158,46 @@ export async function handleStations(request, response, path, url, ctx) {
             ctx.json(response, 503, { error: "the station is not on the air", code: "not_live", state: ctx.runner.observed(station.id) });
             return true;
         }
+        // Admitted only within the station's and the server's limits, and the
+        // month's allowance; refused with what to do about it.
+        const refused = method === "GET" && ctx.usage && ctx.limits ? ctx.usage.admit(station.id, ctx.limits) : null;
+        if (refused) {
+            response.writeHead(refused.status, { ...ctx.headers, "content-type": "application/json; charset=utf-8", "retry-after": String(refused.retryAfter) });
+            response.end(JSON.stringify({ error: refused.error, code: refused.code, retryAfter: refused.retryAfter }));
+            return true;
+        }
         response.writeHead(200, { ...ctx.headers, "content-type": ctx.channels.contentType(channelId), "cache-control": "no-store" });
         if (method === "HEAD") {
             response.end();
             return true;
         }
-        const detach = ctx.channels.listen(channelId, response);
+        // Every byte that goes out through the link is counted against the station.
+        const usage = ctx.usage;
+        const counted = usage
+            ? {
+                write: (chunk) => {
+                    usage.delivered(station.id, chunk.length);
+                    return response.write(chunk);
+                },
+                end: () => { response.end(); },
+                pending: () => response.writableLength,
+            }
+            : response;
+        const detach = ctx.channels.listen(channelId, counted);
         if (detach === null) {
             response.end();
             return true;
         }
+        const left = usage?.joined(station.id);
         const untrack = ctx.runner.track(station.id, { end: () => response.destroy() });
+        let gone = false;
         const leave = () => {
+            if (gone)
+                return;
+            gone = true;
             detach();
             untrack();
+            left?.();
         };
         request.on("close", leave);
         response.on("close", leave);
@@ -177,6 +208,15 @@ export async function handleStations(request, response, path, url, ctx) {
         ctx.json(response, 403, { error: "only this server's owner manages its stations", code: "forbidden" });
         return true;
     }
+    // Changes are limited apart from listening, so neither starves the other.
+    if (method !== "GET" && ctx.throttle) {
+        const wait = ctx.throttle();
+        if (wait) {
+            response.setHeader("retry-after", String(wait.retryAfter));
+            ctx.json(response, 429, { error: "too many changes at once; wait a moment", code: "rate_limited", retryAfter: wait.retryAfter });
+            return true;
+        }
+    }
     const body = async () => {
         if (method === "GET" || method === "DELETE")
             return {};
@@ -253,11 +293,30 @@ export async function handleStations(request, response, path, url, ctx) {
             ctx.json(response, 405, { error: "GET, PATCH or DELETE", code: "method_not_allowed" });
             return true;
         }
+        if (action === "metrics" && method === "GET") {
+            if (!ctx.usage || !ctx.limits) {
+                ctx.json(response, 404, { error: "metering is off on this server", code: "not_found" });
+                return true;
+            }
+            ctx.json(response, 200, {
+                listeners: ctx.usage.listeners(station.id),
+                month: ctx.usage.thisMonth(station.id),
+                history: ctx.usage.history(station.id),
+                limits: ctx.limits,
+                alerts: alertsFor(station, ctx.runner.observed(station.id), ctx.runner.downSince(station.id), ctx.usage.thisMonth(station.id), ctx.limits),
+            });
+            return true;
+        }
         if (method !== "POST") {
             ctx.json(response, 405, { error: "POST", code: "method_not_allowed" });
             return true;
         }
         if (action === "start") {
+            const running = ctx.store.list().filter((one) => one.desired === "running" && one.id !== id).length;
+            if (ctx.limits && ctx.limits.runningStations > 0 && running >= ctx.limits.runningStations) {
+                ctx.json(response, 409, { error: `this server runs at most ${ctx.limits.runningStations} stations at once; stop one first`, code: "too_many_running" });
+                return true;
+            }
             const started = await ctx.runner.start(id);
             ctx.json(response, 200, { station: ownerView(ctx, started) });
             return true;

package/dist/station-runner.d.ts

@@ -23,6 +23,9 @@ export interface RunnerDeps {
     roots: () => string[];
     log?: (line: string) => void;
     now?: () => number;
+    /** Told when a station is restarted after an unexpected end, and when a file will not play. */
+    onRestart?: (id: string) => void;
+    onFailure?: (id: string) => void;
 }
 /** Something a listener is connected through, that can be ended. */
 export interface Ending {
@@ -37,6 +40,8 @@ export declare class StationRunner {
     private starting;
     private errors;
     private listening;
+    /** When a station that should be on went off, for "off the air for N minutes". */
+    private down;
     constructor(deps: RunnerDeps);
     private now;
     private log;
@@ -58,6 +63,8 @@ export declare class StationRunner {
     private scheduleRecovery;
     private cancelRecovery;
     observed(id: string): Observed;
+    /** When it went off while wanted, or 0 when it is not off. */
+    downSince(id: string): number;
     error(id: string): string;
     /** A listener on a station's link, ended if the link is revoked. */
     track(id: string, listener: Ending): () => void;

package/dist/station-runner.js

@@ -10,6 +10,8 @@ export class StationRunner {
     starting = new Set();
     errors = new Map();
     listening = new Map();
+    /** When a station that should be on went off, for "off the air for N minutes". */
+    down = new Map();
     constructor(deps) {
         this.deps = deps;
     }
@@ -41,6 +43,7 @@ export class StationRunner {
     /** Wanted off, and taken off. Stays off across restarts. */
     stop(id) {
         const station = this.deps.store.setDesired(id, "stopped", this.now());
+        this.down.delete(id);
         this.cancelRecovery(id);
         this.attempts.delete(id);
         this.errors.delete(id);
@@ -106,6 +109,7 @@ export class StationRunner {
                     excluded: (file) => store.isExcluded(id, file),
                     onFailure: ({ file, reason }) => {
                         this.errors.set(id, reason);
+                        this.deps.onFailure?.(id);
                         if (store.recordFailure(id, file)) {
                             this.log(`  Station "${station.name}": left out a file that failed ${EXCLUDE_AFTER} times.`);
                         }
@@ -118,6 +122,7 @@ export class StationRunner {
                 return false;
             }
             this.startedAt.set(id, this.now());
+            this.down.delete(id);
             this.deps.channels.keep(channelId);
             return true;
         }
@@ -147,6 +152,9 @@ export class StationRunner {
             this.errors.delete(id);
             return;
         }
+        if (!this.down.has(id))
+            this.down.set(id, this.now());
+        this.deps.onRestart?.(id);
         const ran = this.now() - (this.startedAt.get(id) ?? 0);
         if (ran >= HEALTHY_RUN_MS)
             this.attempts.delete(id);
@@ -185,6 +193,10 @@ export class StationRunner {
             return info.redials ? "recovering" : "live";
         return (this.attempts.get(id) ?? 0) <= RECOVERY_DELAYS_MS.length && this.timers.has(id) ? "recovering" : "offline";
     }
+    /** When it went off while wanted, or 0 when it is not off. */
+    downSince(id) {
+        return this.down.get(id) ?? 0;
+    }
     error(id) {
         return this.errors.get(id) ?? "";
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",

package/src/server.ts

@@ -80,6 +80,7 @@ import { handleHandoffs } from "./handoff-routes.ts";
 import { STATION_PAGE, STATION_PAGE_CSP, STATION_PAGE_HTML } from "./station-page.ts";
 import { StationRunner } from "./station-runner.ts";
 import { StationError, StationStore, channelOf, stationOfChannel, type Station } from "./stations.ts";
+import { STATION_CONTROL_LIMIT, StationUsage, limitsFromEnv, type Limits } from "./station-metering.ts";
 import { CompressionService } from "./compression/service.ts";
 import { handleChannelCompression, handleCompressionApi, handleStaticRelay, type RouteContext } from "./compression/routes.ts";
 import { DEFAULT_SITE as NICHEDB, Enricher, type EnrichKind, FIXTURE_TTL_MS } from "./enrich.ts";
@@ -1716,7 +1717,7 @@ export interface HandlerOptions {
   /** Music handed over from BitTorrented. */
   importer?: Importer;
   /** This server's stations and what keeps them on the air. */
-  stations?: { store: StationStore; runner: StationRunner };
+  stations?: { store: StationStore; runner: StationRunner; usage?: StationUsage; limits?: Limits };
   web: string | null;
   /** Branded clients on this same backend, keyed by an explicitly configured host. */
   webSites?: ReadonlyMap<string, import("./web-sites.ts").WebSite>;
@@ -2785,6 +2786,12 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         json,
         readBody,
         headers: CORS,
+        ...(options.stations.usage ? { usage: options.stations.usage } : {}),
+        ...(options.stations.limits ? { limits: options.stations.limits } : {}),
+        throttle: () => {
+          const verdict = guard.check(`stations:${control.account || callerOf(request.headers, request.socket.remoteAddress, behindProxy)}`, STATION_CONTROL_LIMIT);
+          return verdict.ok ? null : { retryAfter: verdict.retryAfter };
+        },
       });
       return;
     }
@@ -6652,7 +6659,13 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
   const listeners = new ListenerStore(ListenerStore.fileFor(stateDir(), options.port));
   const library = { index: libraryIndex, probe: probeFile, retag: retagPlayer, listeners };
   const stationStore = new StationStore(StationStore.fileFor(stateDir(), options.port));
+  // What stations deliver, per month, and the operator's limits on it.
+  const stationUsage = new StationUsage(StationUsage.fileFor(stateDir(), options.port));
+  const stationLimits = limitsFromEnv();
+  process.once("exit", () => stationUsage.flush());
   stationRunner = new StationRunner({
+    onRestart: (id) => stationUsage.restarted(id),
+    onFailure: (id) => stationUsage.failed(id),
     store: stationStore,
     channels,
     pull: async (channelId, name, files, known) =>
@@ -6666,7 +6679,7 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     roots: () => [...new Set([engine.snapshot(false).root || chosen, ...libraryIndex.roots()])].filter((one) => one !== ""),
     log: (line) => console.log(line),
   });
-  const stations = { store: stationStore, runner: stationRunner };
+  const stations = { store: stationStore, runner: stationRunner, usage: stationUsage, limits: stationLimits };
   // Music handed over from BitTorrented, copied into a folder of our own.
   const importer = new Importer(join(stateDir(), `handoffs-${options.port}.json`), {
     index: libraryIndex,