nixamp 0.41.1 → 0.42.0

package/dist/server.d.ts

@@ -26,7 +26,7 @@ import { ListenerStore } from "./library-user.ts";
 import { Importer } from "./handoff.ts";
 import { AiRadio } from "./ai-radio.ts";
 import { ListenerShares } from "./listener-shares.ts";
-import { Support } from "./support.ts";
+import { Support, SupportSubscriptions } from "./support.ts";
 import { PeerGuides } from "./station-guide.ts";
 import { StationRunner } from "./station-runner.ts";
 import { StationStore, type Station } from "./stations.ts";
@@ -807,6 +807,8 @@ export interface HandlerOptions {
     translationPasses?: TranslationPasses;
     /** Payments to copyright holders nixamp.com collects for (support.ts). */
     support?: Support;
+    /** Monthly support, run by nixamp.com (support.ts). */
+    supportSubscriptions?: SupportSubscriptions;
     /** Signing secret of nixamp's CoinPay business, for /api/v1/webhooks/coinpay. */
     coinpayWebhookSecret?: string;
     sharedTranslations?: SharedTranslations;

package/dist/server.js

@@ -64,7 +64,7 @@ import { handleAiRoutes, isPublicSharePath } from "./ai-routes.js";
 import { AiRadio } from "./ai-radio.js";
 import { ListenerShares } from "./listener-shares.js";
 import { HolderStore, TagReader, factsFor } from "./track-facts.js";
-import { SUPPORT_CSP, SUPPORT_PAGE, Support, SupportError, supportHoldersFrom } from "./support.js";
+import { SUPPORT_CSP, SUPPORT_PAGE, Support, SupportError, SupportSubscriptions, supportHoldersFrom } from "./support.js";
 import { STATION_APP_CSP, STATION_PAGE, STATION_PAGE_CSP, STATION_PAGE_HTML } from "./station-page.js";
 import { GUIDE_CSP, guideHosts, guidePeers, peerBase, PeerGuides, renderGuide } from "./station-guide.js";
 import { StationRunner } from "./station-runner.js";
@@ -2164,7 +2164,7 @@ export function createHandler(engine, options) {
             // What is on, as MCP, for anybody.
             path !== "/mcp/public" &&
             // Supporting a copyright holder is for anybody listening.
-            !/^\/support\/[a-z0-9-]{1,40}$/.test(path) && !/^\/api\/v1\/support\/[a-z0-9-]{1,40}$/.test(path) &&
+            !/^\/support\/[a-z0-9-]{1,40}$/.test(path) && path !== "/support/cancel" && !/^\/api\/v1\/support\/[a-z0-9-]{1,40}$/.test(path) &&
             // A station's short link, which sends the browser to wherever it plays.
             !/^\/watch\/[a-z0-9]{10}$/.test(path) &&
             !STATION_PAGE.test(path) &&
@@ -2231,6 +2231,22 @@ export function createHandler(engine, options) {
          * in the directory). It sends the browser to the station's own page, on
          * the server that plays it. Nothing private or unlisted is ever found.
          */
+        /* A monthly support's cancel link, from any of its emails. */
+        if (path === "/support/cancel" && options.supportSubscriptions && (request.method === "GET" || request.method === "HEAD")) {
+            let words;
+            try {
+                const done = await options.supportSubscriptions.cancel(url.searchParams.get("s") ?? "", url.searchParams.get("t") ?? "");
+                const name = options.support?.holder(done.holder)?.name ?? done.holder;
+                words = `Your monthly support for ${name} is cancelled. No more payment links will be sent.`;
+            }
+            catch (error) {
+                words = error instanceof SupportError ? error.message : "That did not work; try the link again.";
+            }
+            const safe = words.replace(/[&<>"']/g, (one) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[one]);
+            response.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'", "referrer-policy": "no-referrer" });
+            response.end(request.method === "HEAD" ? undefined : `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Support · nixamp</title><body style="margin:0;background:#080c09;color:#e8efe9;font:16px/1.5 system-ui,sans-serif"><main style="max-width:520px;margin:0 auto;padding:48px 16px"><h1 style="font-size:1.4rem">Monthly support</h1><p>${safe}</p><p><a style="color:#3ddc84" href="https://nixamp.com/guide">Back to the stations</a></p></main></body>`);
+            return;
+        }
         /* Support a copyright holder: the page, the coins, and a CoinPay checkout. */
         const supportPage = /^\/support\/([a-z0-9-]{1,40})$/.exec(path);
         if (supportPage && options.support && (request.method === "GET" || request.method === "HEAD")) {
@@ -2269,7 +2285,14 @@ export function createHandler(engine, options) {
                     catch {
                         body = {};
                     }
-                    json(response, 200, await support.checkout({ ...body, holder: holder.id }));
+                    if (body["monthly"] === true) {
+                        if (!options.supportSubscriptions)
+                            throw new SupportError("Monthly support is not set up here.", 503, "unavailable");
+                        json(response, 200, await options.supportSubscriptions.start({ ...body, holder: holder.id }));
+                    }
+                    else {
+                        json(response, 200, await support.checkout({ ...body, holder: holder.id }));
+                    }
                     return;
                 }
                 json(response, 405, { error: "GET or POST", code: "method_not_allowed" });
@@ -6752,6 +6775,15 @@ export async function serve(argv, version = "0.1.0") {
         ? new TranslationPasses({ db: pool, key: coinpayKeyFrom(), site: nixampSite }) : undefined;
     // Payments to the copyright holders nixamp.com collects for, on its own CoinPay business.
     const supportPayments = accounts ? new Support({ key: coinpayKeyFrom(), site: nixampSite, holders: supportHoldersFrom() }) : undefined;
+    // Monthly support: each month a new CoinPay payment and its link by email.
+    const supportMonthly = supportPayments && supportPayments.enabled && pool ? new SupportSubscriptions({
+        db: pool,
+        support: supportPayments,
+        mail: process.env["RESEND_API_KEY"] ? { apiKey: process.env["RESEND_API_KEY"], from: process.env["NIXAMP_MAIL_FROM"] ?? "nixamp <notifications@nixamp.com>" } : null,
+        site: nixampSite,
+        log: (line) => console.log(line),
+    }) : undefined;
+    supportMonthly?.startSchedule();
     if (translationPasses)
         void translationPasses.access().catch(() => console.error("nixamp: translation checkout could not warm; it will retry on demand"));
     const liveVoice = accounts && process.env["NIXAMP_DUBBING"] !== "off" ? new LiveVoice({
@@ -7301,6 +7333,7 @@ export async function serve(argv, version = "0.1.0") {
         ...(liveVoice ? { liveVoice } : {}),
         ...(translationPasses ? { translationPasses } : {}),
         ...(supportPayments ? { support: supportPayments } : {}),
+        ...(supportMonthly ? { supportSubscriptions: supportMonthly } : {}),
         ...(process.env["COINPAY_WEBHOOK_SECRET"] ? { coinpayWebhookSecret: process.env["COINPAY_WEBHOOK_SECRET"] } : {}),
         ...(sharedTranslations ? { sharedTranslations } : {}),
         ...(translator ? { translator } : {}),

package/dist/station-guide.d.ts

@@ -1,3 +1,12 @@
+/**
+ * A card's now-playing line from tags as they come: links pasted into a title
+ * (archive.org films carry their item URL) go, and "A;B" artists read "A, B".
+ * The page's script carries this same function, so both renders agree.
+ */
+export declare function nowLine(now: {
+    title: string;
+    artist: string;
+} | null | undefined): string;
 export interface GuideEntry {
     id?: string;
     name: string;
@@ -19,7 +28,7 @@ export interface GuideEntry {
  * /n/<name>), and for a crawler. Everything from a station is escaped.
  */
 export declare function renderGuide(entries: GuideEntry[], apiBase?: string): string;
-export declare const GUIDE_HTML = "<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Live \u00B7 stations</title>\n<meta name=\"description\" content=\"Radio and TV stations, live now: AI-composed music, tracks shared by listeners, and more.\">\n<link rel=\"icon\" href=\"data:,\">\n<style>\n:root{--bg:#f6f5f2;--fg:#17171a;--muted:#5d5d66;--card:#fff;--line:#dedcd6;--accent:#1f6feb;--live:#0b7a3b;--warn:#a1460b}\n@media (prefers-color-scheme:dark){:root{--bg:#121214;--fg:#ececf1;--muted:#a4a4b0;--card:#1c1c20;--line:#2c2c33;--accent:#6aa7ff;--live:#3fbf7f;--warn:#f0a35e}}\n*{box-sizing:border-box}html,body{margin:0;background:var(--bg);color:var(--fg);font:16px/1.5 system-ui,-apple-system,\"Segoe UI\",sans-serif}\nmain{max-width:880px;margin:0 auto;padding:40px 16px}\nh1{margin:0 0 4px;font-size:1.8rem}p.lead{color:var(--muted);margin:0 0 24px}\nh2{font-size:1rem;letter-spacing:.06em;text-transform:uppercase;color:var(--muted);margin:28px 0 10px}\n.grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(240px,1fr));gap:12px}\n.card{background:var(--card);border:1px solid var(--line);border-radius:14px;padding:16px;position:relative}\n.card:hover,.card:focus-within{border-color:var(--accent)}\na.station{color:inherit;text-decoration:none;display:block}a.station:focus-visible{outline:2px solid var(--accent);outline-offset:4px;border-radius:6px}\n.name{font-weight:700;font-size:1.05rem}.now{color:var(--muted);font-size:.9rem;margin-top:6px;min-height:1.4em}\n.live{color:var(--live);font-size:.8rem;font-weight:700}.empty{color:var(--muted)}\nbutton.report{margin-top:10px;background:none;border:0;padding:0;color:var(--muted);font:inherit;font-size:.8rem;text-decoration:underline;cursor:pointer}\nbutton.report:hover{color:var(--warn)}\n#share{background:var(--card);border:1px solid var(--line);border-radius:14px;padding:16px;margin-top:12px}\n#share label{display:block;font-size:.9rem;margin:10px 0 4px;color:var(--muted)}\n#share input[type=url],#share input[type=text],#share select{width:100%;padding:9px 10px;border:1px solid var(--line);border-radius:8px;background:var(--bg);color:var(--fg);font:inherit}\n#share .agree{display:flex;gap:8px;align-items:flex-start;color:var(--fg);margin-top:12px}\n#share button[type=submit]{margin-top:14px;background:var(--accent);color:#fff;border:0;border-radius:8px;padding:10px 16px;font:inherit;font-weight:600;cursor:pointer}\n#share .or{color:var(--muted);font-size:.85rem;margin:8px 0 0}\n#status{margin-top:10px;font-size:.9rem;min-height:1.4em}\nfooter{margin-top:40px;color:var(--muted);font-size:.85rem}footer a{color:inherit}\n</style>\n</head>\n<body>\n<main>\n  <h1>Live</h1>\n  <p class=\"lead\">Radio and TV, on the air now. Pick one and press play.</p>\n  <h2 id=\"ai-title\" hidden>AI Radio</h2>\n  <div id=\"ai\" class=\"grid\" aria-live=\"polite\"></div>\n  <h2 id=\"shared-title\" hidden>Shared by listeners</h2>\n  <div id=\"shared\" class=\"grid\" aria-live=\"polite\"></div>\n  <h2 id=\"radio-title\" hidden>Radio</h2>\n  <div id=\"radio\" class=\"grid\" aria-live=\"polite\"></div>\n  <h2 id=\"tv-title\" hidden>TV</h2>\n  <div id=\"tv\" class=\"grid\" aria-live=\"polite\"></div>\n  <p id=\"empty\" class=\"empty\">Nothing is on the air here yet.</p>\n  <h2 id=\"share-title\" hidden>Share a track</h2>\n  <form id=\"share\" hidden>\n    <label for=\"url\">A link to an MP3</label>\n    <input id=\"url\" name=\"url\" type=\"url\" placeholder=\"https://example.com/my-song.mp3\" inputmode=\"url\">\n    <p class=\"or\">or upload one (up to <span id=\"max\">60 MB</span>)</p>\n    <input id=\"file\" name=\"file\" type=\"file\" accept=\"audio/*,.mp3,.ogg,.flac,.m4a,.wav\">\n    <label for=\"basis\">Why it may be broadcast</label>\n    <select id=\"basis\" name=\"basis\" required>\n      <option value=\"owned\">I made it</option>\n      <option value=\"permission\">I have the artist's permission</option>\n      <option value=\"licensed\">It is licensed for broadcast</option>\n      <option value=\"creative-commons\">It is Creative Commons (allows sharing)</option>\n      <option value=\"public-domain\">It is in the public domain</option>\n    </select>\n    <label for=\"note\">Anything we should know (licence, link to the artist)</label>\n    <input id=\"note\" name=\"note\" type=\"text\" maxlength=\"300\">\n    <label for=\"by\">Credit me as (optional)</label>\n    <input id=\"by\" name=\"by\" type=\"text\" maxlength=\"60\">\n    <label class=\"agree\"><input type=\"checkbox\" name=\"agree\" value=\"1\"> I have the right to share this for broadcast here. AI files it under a genre and checks it before it airs; anything can be reported off the air.</label>\n    <button type=\"submit\">Share it</button>\n    <div id=\"status\" role=\"status\" aria-live=\"polite\"></div>\n  </form>\n  <footer>Played by <a href=\"https://nixamp.com\">nixamp</a>, on the Moshpit.</footer>\n</main>\n<script>\n(async () => {\n  const el = (tag, cls, text) => { const n = document.createElement(tag); if (cls) n.className = cls; if (text) n.textContent = text; return n; };\n  const say = (text) => { document.querySelector(\"#status\").textContent = text; };\n  // This server's own address: through a gateway (pit.moshcode.sh/n/...) the\n  // page's origin is not the server's, and a relative fetch would ask the gateway.\n  const API = document.body.dataset.api || \"\";\n  const report = async (s, button) => {\n    // Click twice: a sandboxed page (the gateway's) cannot open confirm().\n    if (button.dataset.armed !== \"1\") { button.dataset.armed = \"1\"; button.textContent = \"Click again to take it off the air\"; return; }\n    button.disabled = true;\n    try {\n      const r = await fetch(new URL(s.page).origin + \"/api/v1/share/report\", { method: \"POST\", headers: { \"content-type\": \"application/json\" }, body: JSON.stringify({ station: s.id }) });\n      const body = await r.json();\n      button.textContent = body.reported ? \"Reported: off the air\" : \"Nothing shared is playing\";\n    } catch { button.textContent = \"Could not report; try again\"; button.disabled = false; }\n  };\n  const draw = (stations) => {\n    for (const group of [\"ai\", \"shared\", \"radio\", \"tv\"]) {\n      const grid = document.querySelector(\"#\" + group);\n      grid.replaceChildren();\n      const list = stations.filter((s) => (s.group || (s.kind === \"video\" ? \"tv\" : \"radio\")) === group);\n      document.querySelector(\"#\" + group + \"-title\").hidden = list.length === 0;\n      for (const s of list) {\n        const card = el(\"div\", \"card\");\n        const a = el(\"a\", \"station\");\n        a.href = s.page;\n        a.append(el(\"div\", \"live\", s.state === \"live\" ? \"\u25CF LIVE\" : \"off the air\"), el(\"div\", \"name\", s.name),\n          el(\"div\", \"now\", s.nowPlaying ? [s.nowPlaying.title, s.nowPlaying.artist].filter(Boolean).join(\" \u2014 \") : \"\"));\n        card.append(a);\n        if (group === \"shared\") {\n          const b = el(\"button\", \"report\", \"Report this track\");\n          b.type = \"button\";\n          b.addEventListener(\"click\", () => report(s, b));\n          card.append(b);\n        }\n        grid.append(card);\n      }\n    }\n    document.querySelector(\"#empty\").hidden = stations.length > 0;\n  };\n  const load = async () => {\n    try {\n      const r = await fetch(API + \"/api/v1/stations/guide\", { cache: \"no-store\" });\n      if (r.ok && (r.headers.get(\"content-type\") || \"\").includes(\"json\")) draw((await r.json()).stations);\n    } catch {}\n  };\n  const watch = async (status) => {\n    for (let i = 0; i < 120; i++) {\n      await new Promise((done) => setTimeout(done, 3000));\n      try {\n        const share = (await (await fetch(API + status, { cache: \"no-store\" })).json()).share;\n        if (!share) return;\n        const words = { fetching: \"Fetching it\u2026\", checking: \"Listening to it and checking it\u2026\", held: \"Waiting for the owner to look at it\", approved: \"On the air\", rejected: \"Not accepted\", failed: \"Could not use it\", withdrawn: \"Withdrawn\", reported: \"Reported\" };\n        say((words[share.state] || share.state) + (share.genre ? \" \u00B7 \" + share.genre : \"\") + (share.reason ? \" \u2014 \" + share.reason : \"\"));\n        if (![\"fetching\", \"checking\"].includes(share.state)) { load(); return; }\n      } catch {}\n    }\n  };\n  const form = document.querySelector(\"#share\");\n  try {\n    const info = await (await fetch(API + \"/api/v1/share\", { cache: \"no-store\" })).json();\n    if (info.open) {\n      document.querySelector(\"#share-title\").hidden = false;\n      form.hidden = false;\n      document.querySelector(\"#max\").textContent = info.maxMb + \" MB\";\n    }\n  } catch {}\n  form.addEventListener(\"submit\", async (event) => {\n    event.preventDefault();\n    const data = new FormData(form);\n    const file = data.get(\"file\");\n    const link = String(data.get(\"url\") || \"\").trim();\n    const fields = { basis: String(data.get(\"basis\") || \"\"), note: String(data.get(\"note\") || \"\"), by: String(data.get(\"by\") || \"\"), agree: data.get(\"agree\") ? \"1\" : \"\" };\n    if (!fields.agree) { say(\"Tick the box to confirm you have the right to share it.\"); return; }\n    if (!link && !(file && file.size)) { say(\"Paste a link to an MP3, or choose a file.\"); return; }\n    say(file && file.size && !link ? \"Uploading\u2026\" : \"Sending\u2026\");\n    try {\n      const r = file && file.size && !link\n        ? await fetch(API + \"/api/v1/share/upload?\" + new URLSearchParams({ ...fields, name: file.name }), { method: \"PUT\", headers: { \"content-type\": file.type || \"audio/mpeg\" }, body: file })\n        : await fetch(API + \"/api/v1/share\", { method: \"POST\", headers: { \"content-type\": \"application/json\" }, body: JSON.stringify({ ...fields, agree: true, url: link }) });\n      const body = await r.json();\n      if (!r.ok) { say(body.error || \"That did not work.\"); return; }\n      form.reset();\n      say(\"Got it. Checking it now\u2026\");\n      watch(body.status);\n    } catch { say(\"Could not reach the station; try again.\"); }\n  });\n  await load();\n  setInterval(load, 15000);\n})();\n</script>\n</body>\n</html>\n";
+export declare const GUIDE_HTML: string;
 export declare const GUIDE_CSP: string;
 /**
  * The hosts whose front page is the guide: `guideHosts` in config.json

package/dist/station-guide.js

@@ -19,7 +19,7 @@ h2{font-size:1rem;letter-spacing:.06em;text-transform:uppercase;color:var(--mute
 .card{background:var(--card);border:1px solid var(--line);border-radius:14px;padding:16px;position:relative}
 .card:hover,.card:focus-within{border-color:var(--accent)}
 a.station{color:inherit;text-decoration:none;display:block}a.station:focus-visible{outline:2px solid var(--accent);outline-offset:4px;border-radius:6px}
-.name{font-weight:700;font-size:1.05rem}.now{color:var(--muted);font-size:.9rem;margin-top:6px;min-height:1.4em}
+.name{font-weight:700;font-size:1.05rem;overflow-wrap:anywhere}.now{color:var(--muted);font-size:.9rem;margin-top:6px;min-height:1.4em;overflow-wrap:anywhere}
 .live{color:var(--live);font-size:.8rem;font-weight:700}.empty{color:var(--muted)}
 button.report{margin-top:10px;background:none;border:0;padding:0;color:var(--muted);font:inherit;font-size:.8rem;text-decoration:underline;cursor:pointer}
 button.report:hover{color:var(--warn)}
@@ -32,8 +32,21 @@ button.report:hover{color:var(--warn)}
 #status{margin-top:10px;font-size:.9rem;min-height:1.4em}
 footer{margin-top:40px;color:var(--muted);font-size:.85rem}footer a{color:inherit}
 `;
+/**
+ * A card's now-playing line from tags as they come: links pasted into a title
+ * (archive.org films carry their item URL) go, and "A;B" artists read "A, B".
+ * The page's script carries this same function, so both renders agree.
+ */
+export function nowLine(now) {
+    if (!now)
+        return "";
+    const title = String(now.title || "").replace(/\s*[-–—|]?\s*https?:\/\/\S+/g, "").trim();
+    const artist = String(now.artist || "").split(/\s*;\s*/).filter(Boolean).join(", ");
+    return [title, artist].filter(Boolean).join(" — ");
+}
 const SCRIPT = `
 (async () => {
+  const nowLine = ${nowLine.toString()};
   const el = (tag, cls, text) => { const n = document.createElement(tag); if (cls) n.className = cls; if (text) n.textContent = text; return n; };
   const say = (text) => { document.querySelector("#status").textContent = text; };
   // This server's own address: through a gateway (pit.moshcode.sh/n/...) the
@@ -60,7 +73,7 @@ const SCRIPT = `
         const a = el("a", "station");
         a.href = s.page;
         a.append(el("div", "live", s.state === "live" ? "● LIVE" : "off the air"), el("div", "name", s.name),
-          el("div", "now", s.nowPlaying ? [s.nowPlaying.title, s.nowPlaying.artist].filter(Boolean).join(" — ") : ""));
+          el("div", "now", nowLine(s.nowPlaying)));
         card.append(a);
         if (group === "shared") {
           const b = el("button", "report", "Report this track");
@@ -138,7 +151,7 @@ export function renderGuide(entries, apiBase = "") {
     const groupOf = (one) => one.group ?? (one.kind === "video" ? "tv" : "radio");
     const cards = (group) => entries
         .filter((one) => groupOf(one) === group && /^https?:\/\//.test(one.page))
-        .map((one) => `<div class="card"><a class="station" href="${escape(one.page)}"><div class="live">${one.state === "live" ? "● LIVE" : "off the air"}</div><div class="name">${escape(one.name)}</div><div class="now">${one.nowPlaying ? escape([one.nowPlaying.title, one.nowPlaying.artist].filter(Boolean).join(" — ")) : ""}</div></a></div>`)
+        .map((one) => `<div class="card"><a class="station" href="${escape(one.page)}"><div class="live">${one.state === "live" ? "● LIVE" : "off the air"}</div><div class="name">${escape(one.name)}</div><div class="now">${escape(nowLine(one.nowPlaying))}</div></a></div>`)
         .join("");
     let page = GUIDE_HTML;
     for (const group of GROUPS) {
@@ -202,7 +215,7 @@ export const GUIDE_HTML = `<!doctype html>
 </html>
 `;
 export const GUIDE_CSP = [
-    "default-src 'none'", `script-src ${hash(SCRIPT)}`, `style-src ${hash(STYLE)}`, "connect-src 'self' https:",
+    "default-src 'none'", `script-src ${hash(SCRIPT)}`, `style-src 'self' ${hash(STYLE)}`, "connect-src 'self' https:",
     "img-src 'self' data:", "base-uri 'none'", "form-action 'none'", "frame-ancestors 'none'",
 ].join("; ");
 /**

package/dist/support.d.ts

@@ -20,6 +20,8 @@ export declare class Support {
         fetcher?: typeof fetch;
         now?: () => number;
     });
+    /** For a subscription's renewals, which ask CoinPay about their payments. */
+    get key(): string;
     holder(id: string): SupportHolder | undefined;
     get enabled(): boolean;
     private provider;
@@ -35,9 +37,72 @@ export declare class Support {
         coin?: unknown;
         station?: unknown;
         track?: unknown;
+        metadata?: Record<string, unknown>;
     }): Promise<{
         url: string;
+        paymentId: string;
     }>;
 }
 export declare const SUPPORT_PAGE: string;
 export declare const SUPPORT_CSP: string;
+/** Postgres, as nixamp.com's pool offers it. */
+export interface Db {
+    query: (text: string, params?: unknown[]) => Promise<{
+        rows: Array<Record<string, unknown>>;
+    }>;
+}
+/** One month on from a time, on the same day where the month has it. */
+export declare function nextMonth(at: number): number;
+/**
+ * Monthly support, run here rather than by CoinPay: CoinPay's only merchant
+ * subscriptions are Stripe's, and its recurring invoices refuse a scoped key.
+ * A subscription is an email, an amount, a coin and a holder. Month one is
+ * paid at once on CoinPay's checkout; each month after, a new payment is made
+ * and its link emailed, with a one-click cancel. A month left unpaid ends it
+ * (lapsed) rather than emailing forever.
+ */
+export declare class SupportSubscriptions {
+    private readonly options;
+    private schema;
+    private timer;
+    constructor(options: {
+        db: Db;
+        support: Support;
+        /** Resend; null leaves renewals unsent (and says so in the log). */
+        mail: {
+            apiKey: string;
+            from: string;
+        } | null;
+        site: string;
+        fetcher?: typeof fetch;
+        now?: () => number;
+        log?: (line: string) => void;
+    });
+    private now;
+    private ready;
+    /** Month one: a subscription and its first checkout. */
+    start(input: {
+        holder?: unknown;
+        amountUsd?: unknown;
+        coin?: unknown;
+        email?: unknown;
+        station?: unknown;
+        track?: unknown;
+    }): Promise<{
+        url: string;
+        id: string;
+    }>;
+    cancelLink(id: string, token: string): string;
+    cancel(id: string, token: string): Promise<{
+        canceled: boolean;
+        holder: string;
+    }>;
+    private paid;
+    /** Every subscription now due: a new month's payment and its link, or lapsed when last month went unpaid. */
+    renew(): Promise<{
+        renewed: number;
+        lapsed: number;
+    }>;
+    startSchedule(everyMs?: number): void;
+    private mail;
+}

package/dist/support.js

@@ -40,6 +40,10 @@ export class Support {
     constructor(options) {
         this.options = options;
     }
+    /** For a subscription's renewals, which ask CoinPay about their payments. */
+    get key() {
+        return this.options.key;
+    }
     holder(id) {
         return this.options.holders.find((one) => one.id === id.toLowerCase());
     }
@@ -100,7 +104,7 @@ export class Support {
                 currency: coin.toLowerCase(),
                 payment_method: "crypto",
                 description: `Support ${holder.name} on nixamp`,
-                metadata: { app: "nixamp", product: "support", holder: holder.id, order, station: clean(input.station), track: clean(input.track) },
+                metadata: { app: "nixamp", product: "support", holder: holder.id, order, station: clean(input.station), track: clean(input.track), ...(input.metadata ?? {}) },
                 redirect_url: `${this.options.site}/support/${holder.id}?thanks=1`,
             }),
         });
@@ -108,7 +112,7 @@ export class Support {
         const id = typeof payment?.id === "string" ? payment.id : "";
         if (!/^[A-Za-z0-9_-]{6,80}$/.test(id))
             throw new SupportError("The checkout did not start; nothing was charged. Try again.", 502, "provider");
-        return { url: `https://coinpayportal.com/pay/${id}` };
+        return { url: `https://coinpayportal.com/pay/${id}`, paymentId: id };
     }
 }
 const STYLE = `
@@ -126,6 +130,8 @@ button.go{margin-top:18px;width:100%;padding:12px;border:0;border-radius:999px;b
 button:focus-visible,input:focus-visible,select:focus-visible{outline:3px solid var(--accent);outline-offset:2px}
 #status{min-height:1.4em;margin-top:12px;color:var(--muted)}
 .thanks{color:var(--accent);font-weight:700}
+.often{display:flex;gap:8px;margin:0 0 14px}.often label{flex:1;margin:0;display:flex;gap:8px;align-items:center;justify-content:center;padding:10px;border:1px solid var(--line);border-radius:10px;color:var(--fg);cursor:pointer}
+.often input{width:auto}
 small{display:block;margin-top:18px;color:var(--muted)}small a{color:inherit}
 `;
 const SCRIPT = `
@@ -141,6 +147,11 @@ const SCRIPT = `
       for (const o of document.querySelectorAll(".amounts button")) o.setAttribute("aria-pressed", String(o === b));
     });
   }
+  const monthly = () => document.querySelector("input[name=often]:checked").value === "monthly";
+  for (const r of document.querySelectorAll("input[name=often]")) r.addEventListener("change", () => {
+    $("#email-box").hidden = !monthly();
+    $("#go").textContent = monthly() ? "Pay the first month" : "Continue to payment";
+  });
   if (params.get("thanks")) { $("#status").className = "thanks"; $("#status").textContent = "Thank you. Your payment is on its way."; }
   try {
     const info = await (await fetch("/api/v1/support/" + encodeURIComponent(holder), { cache: "no-store" })).json();
@@ -157,7 +168,8 @@ const SCRIPT = `
     $("#status").textContent = "Starting the checkout…";
     try {
       const r = await fetch("/api/v1/support/" + encodeURIComponent(holder), { method: "POST", headers: { "content-type": "application/json" },
-        body: JSON.stringify({ amountUsd: usd, coin: $("#coin").value, station: params.get("station") || "", track: params.get("track") || "" }) });
+        body: JSON.stringify({ amountUsd: usd, coin: $("#coin").value, station: params.get("station") || "", track: params.get("track") || "",
+          ...(monthly() ? { monthly: true, email: $("#email").value } : {}) }) });
       const body = await r.json();
       if (r.ok && body.url) { location.href = body.url; return; }
       $("#status").textContent = body.error || "That did not work.";
@@ -180,17 +192,22 @@ export const SUPPORT_PAGE = `<!doctype html>
 <main>
   <div class="card">
     <h1>Support <span id="who">the artist</span></h1>
-    <p>Pay the copyright holder of the music you are listening to, directly. One payment, in crypto, through CoinPay.</p>
+    <p>Pay the copyright holder of the music you are listening to, directly, in crypto through CoinPay. Once, or every month.</p>
     <form id="form">
+      <div class="often"><label><input type="radio" name="often" value="once" checked> One time</label><label><input type="radio" name="often" value="monthly"> Monthly</label></div>
       <div class="amounts">${AMOUNTS.map((usd, at) => `<button type="button" data-usd="${usd}" aria-pressed="${at === 1}">$${usd}</button>`).join("")}</div>
       <label for="other">Or another amount (US$)</label>
       <input id="other" type="number" min="1" max="1000" step="1" inputmode="numeric">
+      <div id="email-box" hidden>
+        <label for="email">Email, for each month's payment link (and the cancel link)</label>
+        <input id="email" type="email" autocomplete="email" maxlength="254">
+      </div>
       <label for="coin">Pay with</label>
       <select id="coin"></select>
       <button id="go" class="go" type="submit">Continue to payment</button>
       <div id="status" role="status" aria-live="polite"></div>
     </form>
-    <small>Payments go through <a href="https://coinpayportal.com">CoinPay</a> to nixamp.com, which pays the holder. Nothing recurs.</small>
+    <small>Payments go through <a href="https://coinpayportal.com">CoinPay</a> to nixamp.com, which pays the holder. Monthly: each month we email a new payment link; nothing is taken until you pay it, and every email has a one-click cancel.</small>
   </div>
 </main>
 <script>${SCRIPT}</script>
@@ -201,3 +218,168 @@ export const SUPPORT_CSP = [
     "default-src 'none'", `script-src ${hash(SCRIPT)}`, `style-src ${hash(STYLE)}`, "connect-src 'self'",
     "img-src 'self' data:", "base-uri 'none'", "form-action 'none'", "frame-ancestors 'none'",
 ].join("; ");
+/** What CoinPay calls a payment that has been made. */
+const PAID = new Set(["confirmed", "forwarding", "forwarded", "forwarding_failed", "completed"]);
+const EMAIL = /^[^\s@<>"]{1,64}@[^\s@<>"]{1,190}\.[a-z]{2,24}$/i;
+/** One month on from a time, on the same day where the month has it. */
+export function nextMonth(at) {
+    const date = new Date(at);
+    const day = date.getUTCDate();
+    date.setUTCDate(1);
+    date.setUTCMonth(date.getUTCMonth() + 1);
+    const last = new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth() + 1, 0)).getUTCDate();
+    date.setUTCDate(Math.min(day, last));
+    return date.getTime();
+}
+/**
+ * Monthly support, run here rather than by CoinPay: CoinPay's only merchant
+ * subscriptions are Stripe's, and its recurring invoices refuse a scoped key.
+ * A subscription is an email, an amount, a coin and a holder. Month one is
+ * paid at once on CoinPay's checkout; each month after, a new payment is made
+ * and its link emailed, with a one-click cancel. A month left unpaid ends it
+ * (lapsed) rather than emailing forever.
+ */
+export class SupportSubscriptions {
+    options;
+    schema = null;
+    timer = null;
+    constructor(options) {
+        this.options = options;
+    }
+    now() {
+        return this.options.now?.() ?? Date.now();
+    }
+    ready() {
+        this.schema ??= (async () => {
+            await this.options.db.query(`CREATE TABLE IF NOT EXISTS support_subscriptions (
+        id TEXT PRIMARY KEY, token TEXT NOT NULL, holder TEXT NOT NULL, email TEXT NOT NULL,
+        amount_cents INTEGER NOT NULL, coin TEXT NOT NULL, status TEXT NOT NULL DEFAULT 'active',
+        cycles INTEGER NOT NULL DEFAULT 0, last_payment_id TEXT, next_due TIMESTAMPTZ NOT NULL,
+        station TEXT NOT NULL DEFAULT '', created_at TIMESTAMPTZ NOT NULL, canceled_at TIMESTAMPTZ)`);
+            await this.options.db.query("CREATE INDEX IF NOT EXISTS support_subscriptions_due ON support_subscriptions (status, next_due)");
+        })().catch((error) => { this.schema = null; throw error; });
+        return this.schema;
+    }
+    /** Month one: a subscription and its first checkout. */
+    async start(input) {
+        const email = typeof input.email === "string" ? input.email.trim().toLowerCase() : "";
+        if (!EMAIL.test(email))
+            throw new SupportError("Give an email for the monthly payment links.", 400, "invalid_email");
+        const holder = typeof input.holder === "string" ? this.options.support.holder(input.holder) : undefined;
+        if (!holder)
+            throw new SupportError("Nobody by that name is supported here.", 404, "not_found");
+        await this.ready();
+        const live = await this.options.db.query("SELECT count(*)::int AS n FROM support_subscriptions WHERE email = $1 AND status = 'active'", [email]);
+        if (Number(live.rows[0]?.["n"] ?? 0) >= 10)
+            throw new SupportError("That email already has ten monthly supports.", 409, "too_many");
+        const id = randomUUID();
+        const token = randomUUID().replace(/-/g, "");
+        const checkout = await this.options.support.checkout({ ...input, holder: holder.id, metadata: { subscription: id, cycle: 1 } });
+        const now = this.now();
+        await this.options.db.query(`INSERT INTO support_subscriptions (id, token, holder, email, amount_cents, coin, cycles, last_payment_id, next_due, station, created_at)
+      VALUES ($1,$2,$3,$4,$5,$6,1,$7,$8,$9,$10)`, [id, token, holder.id, email, Math.round(Number(input.amountUsd) * 100), String(input.coin).toUpperCase(), checkout.paymentId, new Date(nextMonth(now)), typeof input.station === "string" ? input.station.slice(0, 20) : "", new Date(now)]);
+        await this.mail(email, `Your monthly support for ${holder.name}`, [
+            `Thank you for supporting ${holder.name} on nixamp, $${Number(input.amountUsd).toFixed(2)} a month in ${String(input.coin).toUpperCase()}.`,
+            `This month: ${checkout.url}`,
+            `Each month we email you a new payment link like this one. Nothing is taken without you paying it.`,
+            `Stop at any time: ${this.cancelLink(id, token)}`,
+        ]);
+        return { url: checkout.url, id };
+    }
+    cancelLink(id, token) {
+        return `${this.options.site}/support/cancel?s=${encodeURIComponent(id)}&t=${encodeURIComponent(token)}`;
+    }
+    async cancel(id, token) {
+        await this.ready();
+        const found = await this.options.db.query("UPDATE support_subscriptions SET status = 'canceled', canceled_at = $3 WHERE id = $1 AND token = $2 AND status <> 'canceled' RETURNING holder", [id, token, new Date(this.now())]);
+        const row = found.rows[0];
+        if (!row) {
+            const known = await this.options.db.query("SELECT holder FROM support_subscriptions WHERE id = $1 AND token = $2", [id, token]);
+            if (!known.rows[0])
+                throw new SupportError("That cancel link is not one of ours.", 404, "not_found");
+            return { canceled: true, holder: String(known.rows[0]["holder"]) };
+        }
+        return { canceled: true, holder: String(row["holder"]) };
+    }
+    async paid(paymentId) {
+        try {
+            const response = await (this.options.fetcher ?? fetch)(`https://coinpayportal.com/api/payments/${encodeURIComponent(paymentId)}`, {
+                signal: AbortSignal.timeout(15_000),
+                headers: { authorization: `Bearer ${this.options.support.key}` },
+            });
+            if (!response.ok)
+                return null;
+            const body = (await response.json());
+            return PAID.has(String(body.payment?.status ?? ""));
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Every subscription now due: a new month's payment and its link, or lapsed when last month went unpaid. */
+    async renew() {
+        await this.ready();
+        const due = await this.options.db.query("SELECT * FROM support_subscriptions WHERE status = 'active' AND next_due <= $1 ORDER BY next_due LIMIT 200", [new Date(this.now())]);
+        let renewed = 0;
+        let lapsed = 0;
+        for (const row of due.rows) {
+            const id = String(row["id"]);
+            const last = String(row["last_payment_id"] ?? "");
+            const paid = last ? await this.paid(last) : false;
+            if (paid === null)
+                continue; // CoinPay did not answer: ask again next time.
+            const holder = this.options.support.holder(String(row["holder"]));
+            if (!paid || !holder) {
+                await this.options.db.query("UPDATE support_subscriptions SET status = 'lapsed' WHERE id = $1 AND status = 'active'", [id]);
+                lapsed += 1;
+                if (holder)
+                    await this.mail(String(row["email"]), `Your monthly support for ${holder.name} has stopped`, [
+                        `Last month's payment was not made, so we have stopped sending payment links. Nothing more will be asked.`,
+                        `Start again any time: ${this.options.site}/support/${holder.id}`,
+                    ]);
+                continue;
+            }
+            const amountUsd = Number(row["amount_cents"]) / 100;
+            const cycle = Number(row["cycles"]) + 1;
+            let checkout;
+            try {
+                checkout = await this.options.support.checkout({ holder: holder.id, amountUsd, coin: String(row["coin"]), station: String(row["station"] ?? ""), metadata: { subscription: id, cycle } });
+            }
+            catch (error) {
+                this.options.log?.(`  support: renewal ${id} could not start a payment: ${error.message}`);
+                continue;
+            }
+            await this.options.db.query("UPDATE support_subscriptions SET cycles = $2, last_payment_id = $3, next_due = $4 WHERE id = $1", [id, cycle, checkout.paymentId, new Date(nextMonth(new Date(String(row["next_due"])).getTime()))]);
+            await this.mail(String(row["email"]), `This month's support for ${holder.name}`, [
+                `Your monthly support for ${holder.name}: $${amountUsd.toFixed(2)} in ${String(row["coin"])}.`,
+                `Pay this month: ${checkout.url}`,
+                `Stop at any time: ${this.cancelLink(id, String(row["token"]))}`,
+            ]);
+            renewed += 1;
+        }
+        return { renewed, lapsed };
+    }
+    startSchedule(everyMs = 3600_000) {
+        if (this.timer)
+            return;
+        this.timer = setInterval(() => void this.renew().catch((error) => this.options.log?.(`  support: renewals failed: ${error.message}`)), everyMs);
+        this.timer.unref?.();
+    }
+    async mail(to, subject, lines) {
+        if (!this.options.mail) {
+            this.options.log?.(`  support: no RESEND_API_KEY, so "${subject}" to ${to} was not sent`);
+            return;
+        }
+        try {
+            await (this.options.fetcher ?? fetch)("https://api.resend.com/emails", {
+                method: "POST",
+                signal: AbortSignal.timeout(15_000),
+                headers: { authorization: `Bearer ${this.options.mail.apiKey}`, "content-type": "application/json" },
+                body: JSON.stringify({ from: this.options.mail.from, to: [to], subject, text: `${lines.join("\n\n")}\n\nnixamp.com` }),
+            });
+        }
+        catch (error) {
+            this.options.log?.(`  support: mail to ${to} failed: ${error.message}`);
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.41.1",
+  "version": "0.42.0",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",

package/src/server.ts

@@ -81,7 +81,7 @@ import { handleAiRoutes, isPublicSharePath } from "./ai-routes.ts";
 import { AiRadio } from "./ai-radio.ts";
 import { ListenerShares } from "./listener-shares.ts";
 import { HolderStore, TagReader, factsFor } from "./track-facts.ts";
-import { SUPPORT_CSP, SUPPORT_PAGE, Support, SupportError, supportHoldersFrom } from "./support.ts";
+import { SUPPORT_CSP, SUPPORT_PAGE, Support, SupportError, SupportSubscriptions, supportHoldersFrom } from "./support.ts";
 import { STATION_APP_CSP, STATION_PAGE, STATION_PAGE_CSP, STATION_PAGE_HTML } from "./station-page.ts";
 import { GUIDE_CSP, guideHosts, guidePeers, peerBase, PeerGuides, renderGuide, type GuideEntry } from "./station-guide.ts";
 import { StationRunner } from "./station-runner.ts";
@@ -1924,6 +1924,8 @@ export interface HandlerOptions {
   translationPasses?: TranslationPasses;
   /** Payments to copyright holders nixamp.com collects for (support.ts). */
   support?: Support;
+  /** Monthly support, run by nixamp.com (support.ts). */
+  supportSubscriptions?: SupportSubscriptions;
   /** Signing secret of nixamp's CoinPay business, for /api/v1/webhooks/coinpay. */
   coinpayWebhookSecret?: string;
   sharedTranslations?: SharedTranslations;
@@ -2698,7 +2700,7 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       // What is on, as MCP, for anybody.
       path !== "/mcp/public" &&
       // Supporting a copyright holder is for anybody listening.
-      !/^\/support\/[a-z0-9-]{1,40}$/.test(path) && !/^\/api\/v1\/support\/[a-z0-9-]{1,40}$/.test(path) &&
+      !/^\/support\/[a-z0-9-]{1,40}$/.test(path) && path !== "/support/cancel" && !/^\/api\/v1\/support\/[a-z0-9-]{1,40}$/.test(path) &&
       // A station's short link, which sends the browser to wherever it plays.
       !/^\/watch\/[a-z0-9]{10}$/.test(path) &&
       !STATION_PAGE.test(path) &&
@@ -2765,6 +2767,22 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
      * in the directory). It sends the browser to the station's own page, on
      * the server that plays it. Nothing private or unlisted is ever found.
      */
+    /* A monthly support's cancel link, from any of its emails. */
+    if (path === "/support/cancel" && options.supportSubscriptions && (request.method === "GET" || request.method === "HEAD")) {
+      let words: string;
+      try {
+        const done = await options.supportSubscriptions.cancel(url.searchParams.get("s") ?? "", url.searchParams.get("t") ?? "");
+        const name = options.support?.holder(done.holder)?.name ?? done.holder;
+        words = `Your monthly support for ${name} is cancelled. No more payment links will be sent.`;
+      } catch (error) {
+        words = error instanceof SupportError ? error.message : "That did not work; try the link again.";
+      }
+      const safe = words.replace(/[&<>"']/g, (one) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[one]!);
+      response.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'", "referrer-policy": "no-referrer" });
+      response.end(request.method === "HEAD" ? undefined : `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Support · nixamp</title><body style="margin:0;background:#080c09;color:#e8efe9;font:16px/1.5 system-ui,sans-serif"><main style="max-width:520px;margin:0 auto;padding:48px 16px"><h1 style="font-size:1.4rem">Monthly support</h1><p>${safe}</p><p><a style="color:#3ddc84" href="https://nixamp.com/guide">Back to the stations</a></p></main></body>`);
+      return;
+    }
+
     /* Support a copyright holder: the page, the coins, and a CoinPay checkout. */
     const supportPage = /^\/support\/([a-z0-9-]{1,40})$/.exec(path);
     if (supportPage && options.support && (request.method === "GET" || request.method === "HEAD")) {
@@ -2798,7 +2816,12 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
           }
           let body: Record<string, unknown> = {};
           try { body = JSON.parse(await readBody(request)) as Record<string, unknown>; } catch { body = {}; }
-          json(response, 200, await support.checkout({ ...body, holder: holder.id }));
+          if (body["monthly"] === true) {
+            if (!options.supportSubscriptions) throw new SupportError("Monthly support is not set up here.", 503, "unavailable");
+            json(response, 200, await options.supportSubscriptions.start({ ...body, holder: holder.id }));
+          } else {
+            json(response, 200, await support.checkout({ ...body, holder: holder.id }));
+          }
           return;
         }
         json(response, 405, { error: "GET or POST", code: "method_not_allowed" });
@@ -7234,6 +7257,15 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     ? new TranslationPasses({ db: pool, key: coinpayKeyFrom(), site: nixampSite }) : undefined;
   // Payments to the copyright holders nixamp.com collects for, on its own CoinPay business.
   const supportPayments = accounts ? new Support({ key: coinpayKeyFrom(), site: nixampSite, holders: supportHoldersFrom() }) : undefined;
+  // Monthly support: each month a new CoinPay payment and its link by email.
+  const supportMonthly = supportPayments && supportPayments.enabled && pool ? new SupportSubscriptions({
+    db: pool as unknown as import("./support.ts").Db,
+    support: supportPayments,
+    mail: process.env["RESEND_API_KEY"] ? { apiKey: process.env["RESEND_API_KEY"], from: process.env["NIXAMP_MAIL_FROM"] ?? "nixamp <notifications@nixamp.com>" } : null,
+    site: nixampSite,
+    log: (line) => console.log(line),
+  }) : undefined;
+  supportMonthly?.startSchedule();
   if (translationPasses) void translationPasses.access().catch(() => console.error("nixamp: translation checkout could not warm; it will retry on demand"));
   const liveVoice = accounts && process.env["NIXAMP_DUBBING"] !== "off" ? new LiveVoice({
     ...(pool ? { db: pool } : {}),
@@ -7787,6 +7819,7 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     ...(liveVoice ? { liveVoice } : {}),
     ...(translationPasses ? { translationPasses } : {}),
     ...(supportPayments ? { support: supportPayments } : {}),
+    ...(supportMonthly ? { supportSubscriptions: supportMonthly } : {}),
     ...(process.env["COINPAY_WEBHOOK_SECRET"] ? { coinpayWebhookSecret: process.env["COINPAY_WEBHOOK_SECRET"] } : {}),
     ...(sharedTranslations ? { sharedTranslations } : {}),
     ...(translator ? { translator } : {}),