nixamp 0.49.0 → 0.51.0

package/src/label-routes.ts

@@ -10,20 +10,34 @@ import { createHash } from "node:crypto";
 import { createReadStream, statSync } from "node:fs";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { ROSTER, type AiLabel, type PublicArtist } from "./ai-label.ts";
+import { covers, PRICES, type GrantVerifier } from "./music-store.ts";
+import { writeZip, zipSize } from "./zip-stream.ts";
 import { StationError } from "./stations.ts";
 
 // Listening is free on the live stations (with their breaks); the songs as
-// files are sold, so only the words and the cover are public here.
-const FILE = /^\/api\/v1\/label\/([a-f0-9]{10})\/([a-f0-9]{8})\/(\d{1,3}\.txt|cover\.jpg)$/;
+// files are sold, so only the words and the cover are public here, and an
+// MP3 or a zip needs a grant from nixamp.com's store (music-store.ts).
+const FILE = /^\/api\/v1\/label\/([a-f0-9]{10})\/([a-f0-9]{8})\/(\d{1,3}\.(?:txt|mp3)|cover\.jpg)$/;
 
-/** Whether this path is the label's public face. */
+/** Whether this path is the label's public face (an MP3 or the zip still asks for its grant). */
 export function isPublicLabelPath(path: string): boolean {
-  return path === "/label" || path === "/api/v1/label" || FILE.test(path);
+  return path === "/label" || path === "/api/v1/label" || path === "/api/v1/label/zip" || FILE.test(path);
+}
+
+/** nixamp.com's page that sells this: a song, an album or everything by the artist. */
+export function buyLink(site: string, server: string, kind: "song" | "album" | "artist", artist: string, album = "", n = 0): string {
+  const query = new URLSearchParams({ server, kind, artist, ...(kind !== "artist" ? { album } : {}), ...(kind === "song" ? { n: String(n) } : {}) });
+  return `${site}/buy?${query.toString()}`;
 }
 
 export interface LabelRoutesContext {
   label: AiLabel;
   canControl: boolean;
+  /** Checks a store grant with nixamp.com; without it nothing is sold or handed out. */
+  grants?: GrantVerifier;
+  /** nixamp.com, where the store is, and this server's public address (for Buy links). */
+  site?: string;
+  publicBase?: string;
   json: (response: ServerResponse, status: number, body: unknown) => void;
   readBody: (request: IncomingMessage) => Promise<string>;
 }
@@ -91,7 +105,8 @@ export async function handleLabelRoutes(
         return true;
       }
       if (path === "/label") {
-        const page = renderLabel(label.publicView());
+        const shop = ctx.grants && ctx.site && /^https:\/\//.test(ctx.publicBase ?? "") ? { site: ctx.site, server: ctx.publicBase! } : undefined;
+        const page = renderLabel(label.publicView(), shop);
         response.writeHead(200, { "content-type": "text/html; charset=utf-8", "content-security-policy": LABEL_CSP, "cache-control": "public, max-age=300" });
         response.end(method === "HEAD" ? undefined : page);
         return true;
@@ -100,7 +115,45 @@ export async function handleLabelRoutes(
         ctx.json(response, 200, label.publicView());
         return true;
       }
+      const url = new URL(request.url ?? "/", "http://x");
+      const grant = url.searchParams.get("grant") ?? "";
+      if (path === "/api/v1/label/zip") {
+        const scope = ctx.grants ? await ctx.grants.check(grant) : null;
+        if (!scope) {
+          ctx.json(response, 403, { error: "that download link has expired or is not one of ours: open your purchase again for a fresh one", code: "bad_grant" });
+          return true;
+        }
+        const zip = label.zipFor(scope);
+        if (!zip) {
+          ctx.json(response, 404, { error: "nothing to download yet", code: "not_found" });
+          return true;
+        }
+        response.writeHead(200, {
+          "content-type": "application/zip",
+          "content-length": String(zipSize(zip.entries)),
+          "content-disposition": `attachment; filename*=UTF-8''${encodeURIComponent(zip.name)}`,
+          "cache-control": "private, no-store",
+        });
+        if (method === "HEAD") {
+          response.end();
+          return true;
+        }
+        await writeZip(response, zip.entries).catch(() => response.destroy());
+        response.end();
+        return true;
+      }
       const [, artist, album, what] = FILE.exec(path)!;
+      if (what!.endsWith(".mp3")) {
+        const scope = ctx.grants && grant ? await ctx.grants.check(grant) : null;
+        const n = Number(what!.split(".")[0]);
+        const file = scope && covers(scope, artist!, album!, n) ? label.songFile(artist!, album!, n) : "";
+        if (!file) {
+          ctx.json(response, 403, { error: "songs as files are for the people who bought them; listening on the live stations is free", code: "not_bought" });
+          return true;
+        }
+        sendFile(request, response, file, "audio/mpeg", file.split("/").pop() ?? "");
+        return true;
+      }
       const found = label.publicFile(artist!, album!, what!);
       if (!found) {
         ctx.json(response, 404, { error: "no such file on the label", code: "not_found" });
@@ -213,6 +266,7 @@ audio{width:100%;max-width:360px;height:36px}
 details{margin-top:4px}summary{cursor:pointer;color:var(--muted);font-size:.9rem}
 pre.lyrics{white-space:pre-wrap;font:inherit;font-size:.95rem;margin:8px 0 0;padding:12px;border-radius:8px;background:var(--bg)}
 .dl{font-size:.85rem}.soon{color:var(--muted);font-size:.85rem}
+a.buy{display:inline-block;font-weight:700;text-decoration:none;border:1px solid var(--accent);border-radius:999px;padding:2px 10px}
 footer{margin-top:48px;color:var(--muted);font-size:.85rem}footer a{color:inherit}
 `;
 
@@ -225,25 +279,39 @@ export const LABEL_CSP = [
   "base-uri 'none'", "form-action 'none'", "frame-ancestors 'none'",
 ].join("; ");
 
-function renderAlbum(artist: PublicArtist, album: PublicArtist["albums"][number]): string {
+type Shop = { site: string; server: string } | undefined;
+
+function price(cents: number): string {
+  return cents < 100 ? `${cents}¢` : `$${(cents / 100).toFixed(cents % 100 ? 2 : 0)}`;
+}
+
+function buy(shop: Shop, kind: "song" | "album" | "artist", artist: string, album = "", n = 0, what = ""): string {
+  if (!shop) return "";
+  return `<a class="buy" href="${escape(buyLink(shop.site, shop.server, kind, artist, album, n))}">Download ${what || kind} · ${price(PRICES[kind])}</a>`;
+}
+
+function renderAlbum(artist: PublicArtist, album: PublicArtist["albums"][number], shop: Shop): string {
   const base = `/api/v1/label/${artist.key}/${album.key}`;
   const cover = album.cover ? `<img class="cover" src="${base}/cover.jpg" alt="Cover of ${escape(album.title)}" width="160" height="160" loading="lazy">` : `<div class="blank" aria-hidden="true"></div>`;
   const songs = album.songs.map((song) => `<li><div class="song"><span class="n">${song.n}.</span><span class="t">${escape(song.title)}</span><span class="d">${minutes(song.seconds)}</span></div>`
     + `<details><summary>Lyrics</summary><pre class="lyrics">${escape(song.lyrics)}</pre></details>`
-    + `<div class="dl"><a href="${base}/${song.n}.txt">lyrics.txt</a></div></li>`).join("");
+    + `<div class="dl"><a href="${base}/${song.n}.txt">lyrics.txt</a>${shop ? ` · ${buy(shop, "song", artist.key, album.key, song.n, "MP3")}` : ""}</div></li>`).join("");
   return `<div class="album">${cover}<div><h4>${escape(album.title)} <span class="d">(${album.year})</span></h4>`
     + `${album.concept ? `<p class="concept">${escape(album.concept)}</p>` : ""}`
     + `${album.complete ? "" : `<p class="soon">Still being recorded: new songs land here as they are finished.</p>`}`
+    + `${shop ? `<p>${buy(shop, "album", artist.key, album.key, 0, "the album, MP3s with art and lyrics")}</p>` : ""}`
     + `<ol class="songs">${songs}</ol></div></div>`;
 }
 
 /** The label's catalogue as a page: no script, plays in any browser. */
-export function renderLabel(view: ReturnType<AiLabel["publicView"]>): string {
+export function renderLabel(view: ReturnType<AiLabel["publicView"]>, shop?: Shop): string {
   const label = view.holder.replace(/,?\s+(inc|llc|ltd|gmbh|co)\.?$/i, "");
   const nav = view.genres.length > 1 ? `<nav class="genres" aria-label="Genres">${view.genres.map((one) => `<a href="#${escape(one.genre.toLowerCase().replace(/[^a-z0-9]+/g, "-"))}">${escape(one.genre)}</a>`).join("")}</nav>` : "";
   const sections = view.genres.map((genre) => `<section class="genre" id="${escape(genre.genre.toLowerCase().replace(/[^a-z0-9]+/g, "-"))}" aria-labelledby="g-${escape(genre.genre.toLowerCase().replace(/[^a-z0-9]+/g, "-"))}">`
     + `<h2 id="g-${escape(genre.genre.toLowerCase().replace(/[^a-z0-9]+/g, "-"))}">${escape(genre.genre)}${genre.station ? ` <a href="/watch/${escape(genre.station)}">Listen live, free →</a>` : ""}</h2>`
-    + genre.artists.map((artist) => `<article class="artist"><h3>${escape(artist.name)}</h3>${artist.bio ? `<p class="bio">${escape(artist.bio)}</p>` : ""}${artist.albums.map((album) => renderAlbum(artist, album)).join("")}</article>`).join("")
+    + genre.artists.map((artist) => `<article class="artist"><h3>${escape(artist.name)}</h3>${artist.bio ? `<p class="bio">${escape(artist.bio)}</p>` : ""}`
+      + `${shop ? `<p>${buy(shop, "artist", artist.key, "", 0, "everything by them")}</p>` : ""}`
+      + `${artist.albums.map((album) => renderAlbum(artist, album, shop)).join("")}</article>`).join("")
     + `</section>`).join("");
   return `<!doctype html>
 <html lang="en">

package/src/music-store.ts

@@ -0,0 +1,333 @@
+/**
+ * The music store on nixamp.com: the AI label's songs as files, bought with
+ * crypto through CoinPay.
+ *
+ * Listening is free on the live stations (with their breaks). What is sold is
+ * the files: a song for 10 cents, an album for $1, everything by an artist
+ * for $2, as a zip made on the fly by the server that holds them (MP3s with
+ * the cover and the words inside, each song's .lyrics.txt, cover.jpg and
+ * album.json). A buyer gives an email; once CoinPay says paid (its webhook,
+ * or asked when the buyer comes back), the email gets a link to the purchase,
+ * and the account with that email sees every purchase under My music on
+ * nixamp.com/radio, to play or download again.
+ *
+ * nixamp.com never holds the music. It signs a grant -- what was bought, from
+ * which server, until when -- and the server asks nixamp.com whether a grant
+ * is good before it plays or zips anything (/api/v1/store/grant).
+ */
+import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+import type { Db, Support } from "./support.ts";
+import { SupportError } from "./support.ts";
+
+export type Kind = "song" | "album" | "artist";
+
+/** In cents. */
+export const PRICES: Record<Kind, number> = { song: 10, album: 100, artist: 200 };
+
+const EMAIL = /^[^\s@<>"]{1,64}@[^\s@<>"]{1,190}\.[a-z]{2,24}$/i;
+const KEY = /^[a-f0-9]{10}$/;
+const ALBUM = /^[a-f0-9]{8}$/;
+/** A grant is good for a day; pages mint a fresh one each time. */
+const GRANT_MS = 24 * 3600_000;
+
+export interface Scope {
+  server: string;
+  kind: Kind;
+  artist: string;
+  album: string;
+  n: number;
+}
+
+export interface Purchase extends Scope {
+  id: string;
+  token: string;
+  email: string;
+  userId: string;
+  title: string;
+  artistName: string;
+  amountCents: number;
+  coin: string;
+  paymentId: string;
+  status: "pending" | "paid";
+  createdAt: number;
+  paidAt: number;
+}
+
+interface LabelSong { n: number; title: string }
+interface LabelAlbum { key: string; title: string; year: number; songs: LabelSong[] }
+interface LabelArtist { key: string; name: string; albums: LabelAlbum[] }
+interface LabelView { holder: string; genres: Array<{ genre: string; artists: LabelArtist[] }> }
+
+/** A server's public address as given: https, no path, no trailing slash. */
+export function serverBase(value: unknown): string {
+  if (typeof value !== "string") return "";
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:" || url.username || url.password) return "";
+    return url.origin;
+  } catch {
+    return "";
+  }
+}
+
+function sign(secret: string, text: string): string {
+  return createHmac("sha256", secret).update(text).digest("base64url");
+}
+
+/** `g1.<exp>.<kind>.<artist>.<album|->.<n>.<server, base64url>.<sig>` */
+export function makeGrant(secret: string, scope: Scope, exp: number): string {
+  const body = ["g1", String(exp), scope.kind, scope.artist, scope.album || "-", String(scope.n), Buffer.from(scope.server).toString("base64url")].join(".");
+  return `${body}.${sign(secret, body)}`;
+}
+
+export function readGrant(secret: string, grant: string, now = Date.now()): (Scope & { exp: number }) | null {
+  const parts = grant.split(".");
+  if (parts.length !== 8 || parts[0] !== "g1") return null;
+  const body = parts.slice(0, 7).join(".");
+  const expected = Buffer.from(sign(secret, body));
+  const given = Buffer.from(parts[7]!);
+  if (expected.length !== given.length || !timingSafeEqual(expected, given)) return null;
+  const exp = Number(parts[1]);
+  if (!Number.isFinite(exp) || exp < now) return null;
+  const kind = parts[2] as Kind;
+  if (!(kind in PRICES)) return null;
+  return { kind, artist: parts[3]!, album: parts[4] === "-" ? "" : parts[4]!, n: Number(parts[5]), server: Buffer.from(parts[6]!, "base64url").toString("utf8"), exp };
+}
+
+/** Whether a grant for `scope` covers this file of the catalogue. */
+export function covers(scope: Pick<Scope, "kind" | "artist" | "album" | "n">, artist: string, album: string, n?: number): boolean {
+  if (scope.artist !== artist) return false;
+  if (scope.kind === "artist") return true;
+  if (scope.album !== album) return false;
+  if (scope.kind === "album") return true;
+  return n === undefined ? false : scope.n === n;
+}
+
+/**
+ * On a server that holds the music: whether nixamp.com signed this grant,
+ * asked at /api/v1/store/grant and remembered (a good one until it expires,
+ * a refused one for 5 minutes). nixamp.com itself checks with its secret.
+ */
+export class GrantVerifier {
+  private known = new Map<string, { scope: (Scope & { exp: number }) | null; until: number }>();
+
+  constructor(private readonly options: { site: string; secret?: string; fetcher?: typeof fetch; now?: () => number }) {}
+
+  async check(grant: string): Promise<(Scope & { exp: number }) | null> {
+    const now = this.options.now?.() ?? Date.now();
+    if (!/^g1\.[A-Za-z0-9._-]{20,600}$/.test(grant)) return null;
+    if (this.options.secret) return readGrant(this.options.secret, grant, now);
+    const hit = this.known.get(grant);
+    if (hit && hit.until > now) return hit.scope;
+    try {
+      const response = await (this.options.fetcher ?? fetch)(`${this.options.site}/api/v1/store/grant?g=${encodeURIComponent(grant)}`, { signal: AbortSignal.timeout(5_000) });
+      if (response.status >= 500) return null;
+      const body = await response.json() as { ok?: boolean; scope?: Scope & { exp: number } };
+      const scope = body.ok && body.scope ? body.scope : null;
+      if (this.known.size > 5000) this.known.clear();
+      this.known.set(grant, { scope, until: scope ? scope.exp : now + 5 * 60_000 });
+      return scope;
+    } catch {
+      return null;
+    }
+  }
+}
+
+function row(one: Record<string, unknown>): Purchase {
+  return {
+    id: String(one["id"]), token: String(one["token"]), email: String(one["email"]), userId: String(one["user_id"] ?? ""),
+    server: String(one["server"]), kind: String(one["kind"]) as Kind, artist: String(one["artist"]), album: String(one["album"] ?? ""), n: Number(one["n"] ?? 0),
+    title: String(one["title"]), artistName: String(one["artist_name"]), amountCents: Number(one["amount_cents"]), coin: String(one["coin"]),
+    paymentId: String(one["payment_id"] ?? ""), status: one["status"] === "paid" ? "paid" : "pending",
+    createdAt: new Date(String(one["created_at"])).getTime(), paidAt: one["paid_at"] ? new Date(String(one["paid_at"])).getTime() : 0,
+  };
+}
+
+export interface MusicStoreOptions {
+  db: Db;
+  support: Support;
+  /** Resend; null leaves the receipt unsent (and says so in the log). */
+  mail: { apiKey: string; from: string } | null;
+  site: string;
+  /** Signs the grants; derived from NIXAMP_JWT_SECRET. */
+  secret: string;
+  /** The servers whose catalogues may be sold here (the directory and the guide's peers). */
+  servers: () => string[];
+  fetcher?: typeof fetch;
+  now?: () => number;
+  log?: (line: string) => void;
+}
+
+export class MusicStore {
+  private schema: Promise<void> | null = null;
+
+  constructor(private readonly options: MusicStoreOptions) {}
+
+  private now(): number {
+    return this.options.now?.() ?? Date.now();
+  }
+
+  private ready(): Promise<void> {
+    this.schema ??= (async () => {
+      await this.options.db.query(`CREATE TABLE IF NOT EXISTS music_purchases (
+        id TEXT PRIMARY KEY, token TEXT NOT NULL, email TEXT NOT NULL, user_id TEXT NOT NULL DEFAULT '',
+        server TEXT NOT NULL, kind TEXT NOT NULL, artist TEXT NOT NULL, album TEXT NOT NULL DEFAULT '', n INTEGER NOT NULL DEFAULT 0,
+        title TEXT NOT NULL, artist_name TEXT NOT NULL, amount_cents INTEGER NOT NULL, coin TEXT NOT NULL,
+        payment_id TEXT, status TEXT NOT NULL DEFAULT 'pending', created_at TIMESTAMPTZ NOT NULL, paid_at TIMESTAMPTZ)`);
+      await this.options.db.query("CREATE INDEX IF NOT EXISTS music_purchases_email ON music_purchases (lower(email))");
+      await this.options.db.query("CREATE INDEX IF NOT EXISTS music_purchases_user ON music_purchases (user_id)");
+      await this.options.db.query("CREATE INDEX IF NOT EXISTS music_purchases_payment ON music_purchases (payment_id)");
+    })().catch((error: unknown) => { this.schema = null; throw error; });
+    return this.schema;
+  }
+
+  /** A server's catalogue, as it publishes it at /api/v1/label. */
+  private async catalogue(server: string): Promise<LabelView> {
+    const response = await (this.options.fetcher ?? fetch)(`${server}/api/v1/label`, { signal: AbortSignal.timeout(10_000), headers: { accept: "application/json" } });
+    if (!response.ok) throw new SupportError("That server's catalogue could not be read. Try again.", 502, "catalogue");
+    return await response.json() as LabelView;
+  }
+
+  /** What is for sale at this address, with its name and price; refused when there is no such thing. */
+  async describe(input: Record<string, unknown>): Promise<Scope & { title: string; artistName: string; amountCents: number; songs: number }> {
+    const server = serverBase(input["server"]);
+    // A server in the directory or the guide's peers, or one named under nixamp.com (whose names
+    // and certificates nixamp.com issues): the directory empties on every restart of nixamp.com.
+    const named = server ? new URL(server).hostname.endsWith(".nixamp.com") : false;
+    if (!server || !(named || this.options.servers().includes(server))) throw new SupportError("That server does not sell music here.", 404, "not_found");
+    const kind = String(input["kind"] ?? "") as Kind;
+    if (!(kind in PRICES)) throw new SupportError("Buy a song, an album or an artist.", 400, "invalid_kind");
+    const artistKey = String(input["artist"] ?? "");
+    const albumKey = kind === "artist" ? "" : String(input["album"] ?? "");
+    const n = kind === "song" ? Number(input["n"]) : 0;
+    if (!KEY.test(artistKey) || (kind !== "artist" && !ALBUM.test(albumKey)) || (kind === "song" && !(Number.isInteger(n) && n > 0))) throw new SupportError("No such music.", 404, "not_found");
+    const view = await this.catalogue(server);
+    const artist = view.genres.flatMap((one) => one.artists).find((one) => one.key === artistKey);
+    const album = artist?.albums.find((one) => one.key === albumKey);
+    const song = album?.songs.find((one) => one.n === n);
+    if (!artist || (kind !== "artist" && !album) || (kind === "song" && !song)) throw new SupportError("No such music.", 404, "not_found");
+    const title = kind === "artist" ? `Everything by ${artist.name}` : kind === "album" ? `${album!.title} (${album!.year})` : `${song!.title}`;
+    const songs = kind === "artist" ? artist.albums.reduce((sum, one) => sum + one.songs.length, 0) : kind === "album" ? album!.songs.length : 1;
+    return { server, kind, artist: artistKey, album: albumKey, n, title, artistName: artist.name, amountCents: PRICES[kind], songs };
+  }
+
+  /** A purchase waiting for its payment, and where to pay. Signed in, it is the account's too. */
+  async checkout(input: Record<string, unknown>, account: { id: string; email: string } | null): Promise<{ url: string; id: string; token: string }> {
+    const email = (typeof input["email"] === "string" && input["email"].trim() ? input["email"] : account?.email ?? "").trim().toLowerCase();
+    if (!EMAIL.test(email)) throw new SupportError("Give the email your music should go to.", 400, "invalid_email");
+    const item = await this.describe(input);
+    await this.ready();
+    const id = randomUUID();
+    const token = randomUUID().replace(/-/g, "");
+    const checkout = await this.options.support.pay({
+      amountUsd: item.amountCents / 100,
+      coin: input["coin"],
+      order: `music-${id}`,
+      description: `${item.title} by ${item.artistName} (${item.kind === "song" ? "song" : item.kind === "album" ? "album" : "every album"}, MP3)`,
+      metadata: { product: "music", purchase: id, kind: item.kind },
+      redirect: this.link(id, token),
+    });
+    await this.options.db.query(`INSERT INTO music_purchases (id, token, email, user_id, server, kind, artist, album, n, title, artist_name, amount_cents, coin, payment_id, created_at)
+      VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)`,
+    [id, token, email, account?.id ?? "", item.server, item.kind, item.artist, item.album, item.n, item.title, item.artistName, item.amountCents, String(input["coin"]).toUpperCase(), checkout.paymentId, new Date(this.now())]);
+    return { url: checkout.url, id, token };
+  }
+
+  /** The purchase's own page, which is also the receipt link. */
+  link(id: string, token: string): string {
+    return `${this.options.site}/purchases/${id}?t=${token}`;
+  }
+
+  /** A purchase by its link; a pending one asks CoinPay whether it has been paid since. */
+  async get(id: string, token: string): Promise<Purchase | null> {
+    await this.ready();
+    const found = (await this.options.db.query("SELECT * FROM music_purchases WHERE id = $1 AND token = $2", [id, token])).rows[0];
+    if (!found) return null;
+    const purchase = row(found);
+    if (purchase.status === "pending" && purchase.paymentId && (await this.options.support.isPaid(purchase.paymentId)) === true) return (await this.paid(purchase.id)) ?? purchase;
+    return purchase;
+  }
+
+  /** CoinPay's webhook: a payment of ours that is now paid. False when it is not a music purchase. */
+  async settle(paymentId: string): Promise<{ settled: boolean; purchase?: string }> {
+    await this.ready();
+    const found = (await this.options.db.query("SELECT id, status FROM music_purchases WHERE payment_id = $1", [paymentId])).rows[0];
+    if (!found) return { settled: false };
+    if (found["status"] === "paid") return { settled: true, purchase: String(found["id"]) };
+    if ((await this.options.support.isPaid(paymentId)) !== true) return { settled: false, purchase: String(found["id"]) };
+    await this.paid(String(found["id"]));
+    return { settled: true, purchase: String(found["id"]) };
+  }
+
+  /** Whether CoinPay's webhook is about one of ours. */
+  async owns(paymentId: string): Promise<boolean> {
+    await this.ready();
+    return (await this.options.db.query("SELECT 1 FROM music_purchases WHERE payment_id = $1", [paymentId])).rows.length > 0;
+  }
+
+  /** Marks it paid once (the first to get there sends the receipt). */
+  private async paid(id: string): Promise<Purchase | null> {
+    const updated = (await this.options.db.query("UPDATE music_purchases SET status = 'paid', paid_at = $2 WHERE id = $1 AND status = 'pending' RETURNING *", [id, new Date(this.now())])).rows[0];
+    if (!updated) {
+      const again = (await this.options.db.query("SELECT * FROM music_purchases WHERE id = $1", [id])).rows[0];
+      return again ? row(again) : null;
+    }
+    const purchase = row(updated);
+    await this.mail(purchase.email, `Your music: ${purchase.title}`, [
+      `Thank you. "${purchase.title}" by ${purchase.artistName} is yours: MP3s with the cover art and the lyrics, in one zip.`,
+      `Download it, now or any time: ${this.link(purchase.id, purchase.token)}`,
+      `Sign in to nixamp.com with ${purchase.email} and everything you have bought is under My music on ${this.options.site}/radio#music, to play or download again.`,
+    ]);
+    return purchase;
+  }
+
+  /** Every paid purchase of this account: made signed in, or to its email. */
+  async forAccount(account: { id: string; email: string }): Promise<Purchase[]> {
+    await this.ready();
+    const rows = await this.options.db.query(
+      "SELECT * FROM music_purchases WHERE status = 'paid' AND (user_id = $1 OR lower(email) = lower($2)) ORDER BY paid_at DESC LIMIT 500",
+      [account.id, account.email],
+    );
+    return rows.rows.map(row);
+  }
+
+  grant(purchase: Scope): string {
+    return makeGrant(this.options.secret, purchase, this.now() + GRANT_MS);
+  }
+
+  check(grant: string): (Scope & { exp: number }) | null {
+    return readGrant(this.options.secret, grant, this.now());
+  }
+
+  /** Where the zip of a purchase is made: on the server that holds the music. */
+  zipUrl(purchase: Purchase): string {
+    return `${purchase.server}/api/v1/label/zip?grant=${encodeURIComponent(this.grant(purchase))}`;
+  }
+
+  /** What anybody with the purchase's link (or the account) is shown. */
+  view(purchase: Purchase): Record<string, unknown> {
+    return {
+      id: purchase.id, kind: purchase.kind, title: purchase.title, artistName: purchase.artistName, server: purchase.server,
+      artist: purchase.artist, album: purchase.album, n: purchase.n, amountUsd: purchase.amountCents / 100, coin: purchase.coin,
+      status: purchase.status, createdAt: purchase.createdAt, paidAt: purchase.paidAt,
+      ...(purchase.status === "paid" ? { grant: this.grant(purchase), zip: this.zipUrl(purchase), link: this.link(purchase.id, purchase.token) } : {}),
+    };
+  }
+
+  private async mail(to: string, subject: string, lines: string[]): Promise<void> {
+    if (!this.options.mail) {
+      this.options.log?.(`  store: no RESEND_API_KEY, so "${subject}" to ${to} was not sent`);
+      return;
+    }
+    try {
+      await (this.options.fetcher ?? fetch)("https://api.resend.com/emails", {
+        method: "POST",
+        signal: AbortSignal.timeout(15_000),
+        headers: { authorization: `Bearer ${this.options.mail.apiKey}`, "content-type": "application/json" },
+        body: JSON.stringify({ from: this.options.mail.from, to: [to], subject, text: `${lines.join("\n\n")}\n\nnixamp.com` }),
+      });
+    } catch (error) {
+      this.options.log?.(`  store: mail to ${to} failed: ${(error as Error).message}`);
+    }
+  }
+}

package/src/server.ts

@@ -79,7 +79,9 @@ import { Importer } from "./handoff.ts";
 import { handleHandoffs } from "./handoff-routes.ts";
 import { handleAiRoutes, isPublicSharePath } from "./ai-routes.ts";
 import { AiLabel } from "./ai-label.ts";
-import { handleLabelRoutes, isPublicLabelPath } from "./label-routes.ts";
+import { buyLink, handleLabelRoutes, isPublicLabelPath } from "./label-routes.ts";
+import { GrantVerifier, MusicStore } from "./music-store.ts";
+import { handleStoreRoutes, isStorePath } from "./store-routes.ts";
 import { AiRadio } from "./ai-radio.ts";
 import { ListenerShares } from "./listener-shares.ts";
 import { HolderStore, TagReader, factsFor } from "./track-facts.ts";
@@ -1950,6 +1952,8 @@ export interface HandlerOptions {
   supportSubscriptions?: SupportSubscriptions;
   /** Signing secret of nixamp's CoinPay business, for /api/v1/webhooks/coinpay. */
   coinpayWebhookSecret?: string;
+  /** The AI label's songs for sale, nixamp.com only (music-store.ts). */
+  musicStore?: MusicStore;
   sharedTranslations?: SharedTranslations;
   /** Translation: texts in another language, by a model here. The same optional library. */
   translator?: Translator;
@@ -2040,6 +2044,9 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
     site: process.env["NIXAMP_SITE"] || "https://nixamp.com",
     ...(listenPassKey ? { secret: listenPassKey } : {}),
   });
+  // The music store lives on nixamp.com; a server holding the label's music asks it about grants.
+  const storeSite = (process.env["NIXAMP_SITE"] || "https://nixamp.com").replace(/\/+$/, "");
+  const storeGrants = new GrantVerifier({ site: storeSite });
 
   return async function handle(request: IncomingMessage, response: ServerResponse): Promise<void> {
     const url = new URL(request.url ?? "/", "http://localhost");
@@ -2595,6 +2602,15 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       }
       let event: ReturnType<typeof readCoinpayWebhook>;
       try { event = readCoinpayWebhook(JSON.parse(raw)); } catch { json(response, 400, { error: "invalid JSON" }); return; }
+      if (options.musicStore) {
+        try {
+          if (await options.musicStore.owns(event.paymentId)) { json(response, 200, await options.musicStore.settle(event.paymentId)); return; }
+        } catch (error) {
+          console.error(`nixamp: CoinPay webhook for ${event.paymentId} (music) could not settle: ${error instanceof Error ? error.message : String(error)}`);
+          json(response, 500, { error: "could not settle; retry" });
+          return;
+        }
+      }
       if (!options.translationPasses) { json(response, 200, { settled: false, reason: "billing is off here" }); return; }
       try {
         json(response, 200, await options.translationPasses.settle(event.paymentId));
@@ -2728,6 +2744,8 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       !isPublicSharePath(path) &&
       // The AI label's catalogue, its songs and their words.
       !(isPublicLabelPath(path) && Boolean(options.stations?.label)) &&
+      // The music store: its pages, checkout, receipts and grants (nixamp.com).
+      !(isStorePath(path) && Boolean(options.musicStore)) &&
       // What is on, as MCP, for anybody.
       path !== "/mcp/public" &&
       // Supporting a copyright holder is for anybody listening.
@@ -3074,9 +3092,24 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       return;
     }
 
+    if (options.musicStore && options.support && isStorePath(path)) {
+      const support = options.support;
+      const accounts = options.accounts;
+      if (await handleStoreRoutes(request, response, path, url, {
+        store: options.musicStore,
+        coins: async () => (await support.coins()).coins,
+        account: async () => (accounts ? await accounts.whoIs(tokenFrom(request.headers)) : null),
+        json,
+        readBody,
+      })) return;
+    }
+
     if (options.stations?.label && (isPublicLabelPath(path) || path === "/api/v1/stations/label" || path.startsWith("/api/v1/stations/label/"))) {
       const control = isPublicLabelPath(path) ? { allowed: false } : await controlOf();
-      if (await handleLabelRoutes(request, response, path, { label: options.stations.label, canControl: control.allowed, json, readBody })) return;
+      if (await handleLabelRoutes(request, response, path, {
+        label: options.stations.label, canControl: control.allowed, json, readBody,
+        grants: storeGrants, site: storeSite, publicBase: options.stations.publicBase?.() ?? "",
+      })) return;
     }
 
     if (options.stations && (isPublicSharePath(path) || path.startsWith("/api/v1/stations/ai") || path.startsWith("/api/v1/stations/shares") || path.startsWith("/api/v1/stations/holders"))) {
@@ -7377,7 +7410,18 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     try { stamp = String(Math.round(statSync(file).mtimeMs)); } catch { stamp = ""; }
     const art = picture ? `/api/v1/stations/${station.id}/art?t=${encodeURIComponent(station.listenToken)}&f=${sha("sha1").update(file + stamp).digest("hex").slice(0, 12)}` : "";
     const words = await lyricsFinder.find(file).catch(() => null);
-    return factsFor({
+    // A label song is for sale on nixamp.com: the song, its album, everything by the artist.
+    const song = aiLabel.songAt(file);
+    const here = stations.publicBase?.() ?? "";
+    const shop = (process.env["NIXAMP_SITE"] || "https://nixamp.com").replace(/\/+$/, "");
+    const store = song && /^https:\/\//.test(here) ? {
+      song: buyLink(shop, here, "song", song.artist, song.album, song.n),
+      album: buyLink(shop, here, "album", song.artist, song.album),
+      artist: buyLink(shop, here, "artist", song.artist),
+      artistName: song.artistName,
+      albumTitle: song.albumTitle,
+    } : null;
+    return { ...factsFor({
       art,
       ...(words ? { lyrics: `/api/v1/stations/${station.id}/lyrics?t=${encodeURIComponent(station.listenToken)}&f=${sha("sha1").update(file + stamp).digest("hex").slice(0, 12)}` } : {}),
       station, file,
@@ -7386,7 +7430,7 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
       holders: holderStore.list(),
       share: share ? { basis: share.rights.basis, note: share.rights.note, by: share.by } : null,
       aiTrack: composed ? { made: composed.made } : null,
-    });
+    }), store };
   };
   // Channels as HLS, on demand, for Safari on a phone: one ffmpeg copying a
   // channel's fragments into short files while somebody is asking for them.
@@ -7531,6 +7575,20 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     log: (line) => console.log(line),
   }) : undefined;
   supportMonthly?.startSchedule();
+  // The AI label's songs for sale: purchases kept here, the music zipped by the server that holds it.
+  const jwtSecret = process.env["NIXAMP_JWT_SECRET"] ?? "";
+  const musicStore = supportPayments && supportPayments.enabled && pool && jwtSecret ? new MusicStore({
+    db: pool as unknown as import("./support.ts").Db,
+    support: supportPayments,
+    mail: process.env["RESEND_API_KEY"] ? { apiKey: process.env["RESEND_API_KEY"], from: process.env["NIXAMP_MAIL_FROM"] ?? "nixamp <notifications@nixamp.com>" } : null,
+    site: nixampSite,
+    secret: sha("sha256").update(`music-grant:${jwtSecret}`).digest("hex"),
+    servers: () => {
+      const listed = directory ? directory.list().map((one) => peerBase(one.url)).filter(Boolean) : [];
+      return [...new Set([...guidePeers(), ...listed])];
+    },
+    log: (line) => console.log(line),
+  }) : undefined;
   if (translationPasses) void translationPasses.access().catch(() => console.error("nixamp: translation checkout could not warm; it will retry on demand"));
   const liveVoice = accounts && process.env["NIXAMP_DUBBING"] !== "off" ? new LiveVoice({
     ...(pool ? { db: pool } : {}),
@@ -8085,6 +8143,7 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     ...(translationPasses ? { translationPasses } : {}),
     ...(supportPayments ? { support: supportPayments } : {}),
     ...(supportMonthly ? { supportSubscriptions: supportMonthly } : {}),
+    ...(musicStore ? { musicStore } : {}),
     ...(process.env["COINPAY_WEBHOOK_SECRET"] ? { coinpayWebhookSecret: process.env["COINPAY_WEBHOOK_SECRET"] } : {}),
     ...(sharedTranslations ? { sharedTranslations } : {}),
     ...(translator ? { translator } : {}),

package/src/station-usage.ts

@@ -38,13 +38,13 @@ export const USAGE = `nixamp station — make a collection into a station
 
   AI label (AI artists who release albums on their own; a station per genre; the catalogue at /label):
   nixamp station label                       artists, albums, this month's seconds, what it is waiting for
-  nixamp station label sign --roster         the first roster: velvet-ruckus, juno-kincaid, chrome-orchard, delta-wren,
-                                             ashen-cartography, lumi-kestrel
+  nixamp station label sign --roster         the roster: three artists in each of Rock, Hip-Hop, Synthwave, Country,
+                                             Metal and Pop (nixamp station label lists their keys)
   nixamp station label sign (--preset KEY | --name NAME --genre GENRE --sound TEXT [--voice TEXT] [--bio TEXT] [--themes TEXT])
   nixamp station label album KEY             plan the artist's next album now and record it
   nixamp station label set KEY [--sound TEXT] [--voice TEXT] [--bio TEXT] [--themes TEXT] [--off|--on]
   nixamp station label drop KEY [--files]
-  nixamp station label config [--holder "Profullstack, Inc."] [--budget SECONDS] [--every-days 30] [--seed-albums 2]
+  nixamp station label config [--holder "Profullstack, Inc."] [--budget SECONDS] [--every-days 30] [--seed-albums 1]
                               [--songs 8] [--seconds 150] [--on|--off] [--public|--unlisted]
   nixamp station label run                   record whatever is due now
   nixamp station label resume                after the provider ran out of credit