nixamp 0.61.2 → 0.62.0

package/dist/music-license.js

@@ -0,0 +1,266 @@
+/**
+ * Licences to use the AI label's music in somebody's own work: a game, an
+ * app, a video, a podcast. A download (music-store.ts) is for listening; a
+ * licence is permission to put the music in a project and publish it.
+ *
+ *   Creator     a song, $5     online videos, streams, podcasts, social posts, monetized or not
+ *   Indie       a song, $25    all of Creator, plus games, apps, sites, software and films,
+ *               an album, $100 for a licensee under US$100,000 of revenue a year
+ *   Commercial  a song, $250   any use in the licensee's own products and ads, any size
+ *   Catalog     $29 a year     Indie, for every artist the label releases, unlimited projects
+ *
+ * Every licence is worldwide, non-exclusive and for good (the catalogue pass:
+ * for every project published while it is active), and every use credits the
+ * artist with a link to their page. The terms are TERMS below (license-routes.ts
+ * serves them at /license/terms); each licence records the version it was sold
+ * under. Paid through nixamp.com's CoinPay business like the store.
+ */
+import { randomBytes, randomUUID } from "node:crypto";
+import { SupportError } from "./support.js";
+/** In cents, by tier and what is licensed; a missing pair is not sold. */
+export const LICENSE_PRICES = {
+    creator: { song: 500 },
+    indie: { song: 2500, album: 10000 },
+    commercial: { song: 25000 },
+    catalog: { catalog: 2900 },
+};
+export const TIER_NAMES = { creator: "Creator", indie: "Indie", commercial: "Commercial", catalog: "Catalog pass" };
+/** What each tier lets a licensee do, in a line. */
+export const TIER_USE = {
+    creator: "Online videos, livestreams, podcasts and social posts, monetized or not. Not games, apps, ads or broadcast.",
+    indie: "Everything in Creator, plus games, apps, websites, software and films, for a licensee earning under US$100,000 a year.",
+    commercial: "Any use in your own products, games, apps, films and advertising, broadcast included, at any size.",
+    catalog: "The Indie licence for every song by every artist the label releases, for any number of projects published while the pass is active.",
+};
+export const TERMS_VERSION = "1";
+const YEAR_MS = 365 * 24 * 3600_000;
+const EMAIL = /^[^\s@<>"]{1,64}@[^\s@<>"]{1,190}\.[a-z]{2,24}$/i;
+const CODE = /^NXL-[A-Z2-9]{4}-[A-Z2-9]{4}$/;
+/** A licence code: unambiguous letters and digits, for reading out or typing in. */
+function newCode() {
+    const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+    const bytes = randomBytes(8);
+    const chars = [...bytes].map((one) => alphabet[one % alphabet.length]).join("");
+    return `NXL-${chars.slice(0, 4)}-${chars.slice(4)}`;
+}
+function clean(value, max) {
+    return typeof value === "string" ? value.replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/\s+/g, " ").trim().slice(0, max) : "";
+}
+function httpsUrl(value) {
+    const text = clean(value, 300);
+    if (!text)
+        return "";
+    try {
+        const url = new URL(text);
+        return url.protocol === "https:" || url.protocol === "http:" ? url.toString() : "";
+    }
+    catch {
+        return "";
+    }
+}
+function row(one) {
+    const time = (value) => (value ? new Date(String(value)).getTime() : 0);
+    return {
+        id: String(one["id"]), code: String(one["code"]), token: String(one["token"]), email: String(one["email"]), userId: String(one["user_id"] ?? ""),
+        licensee: String(one["licensee"]), project: String(one["project"]), projectUrl: String(one["project_url"] ?? ""),
+        tier: String(one["tier"]), kind: String(one["kind"]), server: String(one["server"] ?? ""), artist: String(one["artist"] ?? ""),
+        album: String(one["album"] ?? ""), n: Number(one["n"] ?? 0), title: String(one["title"]), artistName: String(one["artist_name"]), creditUrl: String(one["credit_url"]),
+        amountCents: Number(one["amount_cents"]), coin: String(one["coin"]), paymentId: String(one["payment_id"] ?? ""),
+        status: one["status"] === "paid" ? "paid" : "pending", terms: String(one["terms"]), createdAt: time(one["created_at"]), paidAt: time(one["paid_at"]), expiresAt: time(one["expires_at"]),
+    };
+}
+export class MusicLicenses {
+    options;
+    schema = null;
+    constructor(options) {
+        this.options = options;
+    }
+    now() {
+        return this.options.now?.() ?? Date.now();
+    }
+    get holder() {
+        return this.options.holder ?? "Profullstack, Inc.";
+    }
+    ready() {
+        this.schema ??= (async () => {
+            await this.options.db.query(`CREATE TABLE IF NOT EXISTS music_licenses (
+        id TEXT PRIMARY KEY, code TEXT NOT NULL UNIQUE, token TEXT NOT NULL, email TEXT NOT NULL, user_id TEXT NOT NULL DEFAULT '',
+        licensee TEXT NOT NULL, project TEXT NOT NULL, project_url TEXT NOT NULL DEFAULT '',
+        tier TEXT NOT NULL, kind TEXT NOT NULL, server TEXT NOT NULL DEFAULT '', artist TEXT NOT NULL DEFAULT '', album TEXT NOT NULL DEFAULT '', n INTEGER NOT NULL DEFAULT 0,
+        title TEXT NOT NULL, artist_name TEXT NOT NULL, credit_url TEXT NOT NULL, amount_cents INTEGER NOT NULL, coin TEXT NOT NULL,
+        payment_id TEXT, status TEXT NOT NULL DEFAULT 'pending', terms TEXT NOT NULL,
+        created_at TIMESTAMPTZ NOT NULL, paid_at TIMESTAMPTZ, expires_at TIMESTAMPTZ)`);
+            await this.options.db.query("CREATE INDEX IF NOT EXISTS music_licenses_email ON music_licenses (lower(email))");
+            await this.options.db.query("CREATE INDEX IF NOT EXISTS music_licenses_user ON music_licenses (user_id)");
+            await this.options.db.query("CREATE INDEX IF NOT EXISTS music_licenses_payment ON music_licenses (payment_id)");
+        })().catch((error) => { this.schema = null; throw error; });
+        return this.schema;
+    }
+    /** What would be licensed and for how much; refused when the pair is not sold or the music is not there. */
+    async quote(input) {
+        const tier = String(input["tier"] ?? (input["kind"] === "catalog" ? "catalog" : "indie"));
+        const kind = (tier === "catalog" ? "catalog" : String(input["kind"] ?? ""));
+        const cents = LICENSE_PRICES[tier]?.[kind];
+        if (!cents)
+            throw new SupportError("That licence is not sold: Creator and Commercial are per song, Indie per song or album, the Catalog pass covers everything.", 400, "invalid_tier");
+        if (kind === "catalog") {
+            return { tier, kind, server: "", artist: "", album: "", n: 0, title: `Every artist released by ${this.holder}`, artistName: this.holder, creditUrl: `${this.options.site}/music`, amountCents: cents };
+        }
+        const item = await this.options.store.describe({ ...input, kind });
+        return {
+            tier, kind, server: item.server, artist: item.artist, album: item.album, n: item.n, title: item.title, artistName: item.artistName,
+            creditUrl: `${this.options.site}/music/artist/${this.options.serverId(item.server)}/${item.artist}`, amountCents: cents,
+        };
+    }
+    /** A licence waiting for its payment, and where to pay. */
+    async checkout(input, account) {
+        if (input["agree"] !== true)
+            throw new SupportError("Agree to the licence terms first.", 400, "terms_required");
+        const email = (clean(input["email"], 254) || account?.email || "").toLowerCase();
+        if (!EMAIL.test(email))
+            throw new SupportError("Give the email the licence should go to.", 400, "invalid_email");
+        const licensee = clean(input["licensee"], 120);
+        if (licensee.length < 2)
+            throw new SupportError("Say who the licence is for: your name or your company's.", 400, "licensee_required");
+        const project = clean(input["project"], 160);
+        if (project.length < 2)
+            throw new SupportError("Name the project the music goes in (the catalogue pass: your studio or channel).", 400, "project_required");
+        const quote = await this.quote(input);
+        await this.ready();
+        const id = randomUUID();
+        const token = randomUUID().replace(/-/g, "");
+        const code = newCode();
+        const checkout = await this.options.support.pay({
+            amountUsd: quote.amountCents / 100,
+            coin: input["coin"],
+            order: `license-${id}`,
+            description: `${TIER_NAMES[quote.tier]} licence: ${quote.title}${quote.kind === "catalog" ? ", one year" : ` by ${quote.artistName}`} for ${project}`,
+            metadata: { product: "music-license", license: id, tier: quote.tier, kind: quote.kind },
+            redirect: this.link(id, token),
+        });
+        await this.options.db.query(`INSERT INTO music_licenses (id, code, token, email, user_id, licensee, project, project_url, tier, kind, server, artist, album, n,
+      title, artist_name, credit_url, amount_cents, coin, payment_id, terms, created_at)
+      VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22)`, [id, code, token, email, account?.id ?? "", licensee, project, httpsUrl(input["projectUrl"]), quote.tier, quote.kind, quote.server, quote.artist, quote.album, quote.n,
+            quote.title, quote.artistName, quote.creditUrl, quote.amountCents, String(input["coin"]).toUpperCase(), checkout.paymentId, TERMS_VERSION, new Date(this.now())]);
+        return { url: checkout.url, id, token, code };
+    }
+    /** The licensee's own page: the certificate once paid. */
+    link(id, token) {
+        return `${this.options.site}/licenses/${id}?t=${token}`;
+    }
+    /** Anybody's check of a licence by its code: a client asking whether a game's music is licensed. */
+    verifyUrl(code) {
+        return `${this.options.site}/license/${code}`;
+    }
+    async get(id, token) {
+        await this.ready();
+        const found = (await this.options.db.query("SELECT * FROM music_licenses WHERE id = $1 AND token = $2", [id, token])).rows[0];
+        if (!found)
+            return null;
+        const license = row(found);
+        if (license.status === "pending" && license.paymentId && (await this.options.support.isPaid(license.paymentId)) === true)
+            return (await this.paid(license.id)) ?? license;
+        return license;
+    }
+    /** A paid licence by its code, for the public check; a pending one is not anybody's business. */
+    async byCode(code) {
+        if (!CODE.test(code))
+            return null;
+        await this.ready();
+        const found = (await this.options.db.query("SELECT * FROM music_licenses WHERE code = $1 AND status = 'paid'", [code])).rows[0];
+        return found ? row(found) : null;
+    }
+    async owns(paymentId) {
+        await this.ready();
+        return (await this.options.db.query("SELECT 1 FROM music_licenses WHERE payment_id = $1", [paymentId])).rows.length > 0;
+    }
+    /** CoinPay's webhook for one of ours. */
+    async settle(paymentId) {
+        await this.ready();
+        const found = (await this.options.db.query("SELECT id, status FROM music_licenses WHERE payment_id = $1", [paymentId])).rows[0];
+        if (!found)
+            return { settled: false };
+        if (found["status"] === "paid")
+            return { settled: true, license: String(found["id"]) };
+        if ((await this.options.support.isPaid(paymentId)) !== true)
+            return { settled: false, license: String(found["id"]) };
+        await this.paid(String(found["id"]));
+        return { settled: true, license: String(found["id"]) };
+    }
+    async forAccount(account) {
+        await this.ready();
+        const rows = await this.options.db.query("SELECT * FROM music_licenses WHERE status = 'paid' AND (user_id = $1 OR lower(email) = lower($2)) ORDER BY paid_at DESC LIMIT 500", [account.id, account.email]);
+        return rows.rows.map(row);
+    }
+    /** Marks it paid once; the catalogue pass runs a year from then. The first to get here sends the certificate. */
+    async paid(id) {
+        const now = new Date(this.now());
+        const updated = (await this.options.db.query("UPDATE music_licenses SET status = 'paid', paid_at = $2, expires_at = CASE WHEN kind = 'catalog' THEN $3::timestamptz ELSE NULL END WHERE id = $1 AND status = 'pending' RETURNING *", [id, now, new Date(this.now() + YEAR_MS)])).rows[0];
+        if (!updated) {
+            const again = (await this.options.db.query("SELECT * FROM music_licenses WHERE id = $1", [id])).rows[0];
+            return again ? row(again) : null;
+        }
+        const license = row(updated);
+        await this.mail(license.email, `Your music licence ${license.code}: ${license.title}`, [
+            `Thank you. ${license.licensee} now holds a ${TIER_NAMES[license.tier]} licence (${license.code}) for "${license.title}"${license.kind === "catalog" ? "" : ` by ${license.artistName}`}, for ${license.project}.`,
+            `What it covers: ${TIER_USE[license.tier]}${license.expiresAt ? ` Projects published before ${new Date(license.expiresAt).toISOString().slice(0, 10)} stay licensed for good.` : ""}`,
+            `Credit the music where your project has credits or a description, with a link to the artist's page: ${creditLine(license)}`,
+            `Your certificate, to keep or print: ${this.link(license.id, license.token)}`,
+            `Anybody can check it (a store, a platform, a client): ${this.verifyUrl(license.code)}`,
+            `The terms (version ${license.terms}): ${this.options.site}/license/terms`,
+        ]);
+        return license;
+    }
+    /** What the licensee's page and the public check show. */
+    view(license, full) {
+        const now = this.now();
+        return {
+            code: license.code, licensee: license.licensee, project: license.project, projectUrl: license.projectUrl,
+            tier: license.tier, tierName: TIER_NAMES[license.tier], use: TIER_USE[license.tier], kind: license.kind,
+            title: license.title, artistName: license.artistName, creditUrl: license.creditUrl, credit: creditLine(license),
+            status: license.status, active: license.status === "paid" && (!license.expiresAt || license.expiresAt > now),
+            paidAt: license.paidAt, expiresAt: license.expiresAt, terms: license.terms, termsUrl: `${this.options.site}/license/terms`, verify: this.verifyUrl(license.code),
+            ...(full ? { id: license.id, email: license.email, amountUsd: license.amountCents / 100, coin: license.coin, paymentId: license.paymentId, link: this.link(license.id, license.token) } : {}),
+        };
+    }
+    async mail(to, subject, lines) {
+        if (!this.options.mail) {
+            this.options.log?.(`  licences: no RESEND_API_KEY, so "${subject}" to ${to} was not sent`);
+            return;
+        }
+        try {
+            await (this.options.fetcher ?? fetch)("https://api.resend.com/emails", {
+                method: "POST",
+                signal: AbortSignal.timeout(15_000),
+                headers: { authorization: `Bearer ${this.options.mail.apiKey}`, "content-type": "application/json" },
+                body: JSON.stringify({ from: this.options.mail.from, to: [to], subject, text: `${lines.join("\n\n")}\n\nnixamp.com` }),
+            });
+        }
+        catch (error) {
+            this.options.log?.(`  licences: mail to ${to} failed: ${error.message}`);
+        }
+    }
+}
+/** The credit a licence asks for, ready to paste. */
+export function creditLine(license) {
+    return license.kind === "catalog"
+        ? `Music: "<song>" by <artist> (<the artist's nixamp page>), licensed from ${license.artistName} on nixamp (${license.code})`
+        : `Music: "${license.title}" by ${license.artistName} (${license.creditUrl}), licensed on nixamp (${license.code})`;
+}
+/** The licence terms, version TERMS_VERSION: plain words, shown at /license/terms and agreed to at checkout. */
+export function licenseTerms(holder, site) {
+    return [
+        { heading: "Who", text: `These terms are between ${holder} ("we"), which releases the AI label's music on nixamp, and the person or company named on the licence ("you").` },
+        { heading: "What you may do", text: "Use the licensed recordings, and their lyrics, in your own project: put them in it, edit, cut, loop and mix them, and publish, sell and distribute the project with the music inside it, worldwide, for as long as the project exists. The licence is non-exclusive: others may license the same music." },
+        { heading: "Which uses", text: `Creator: ${TIER_USE.creator} Indie: ${TIER_USE.indie} Commercial: ${TIER_USE.commercial} A song or album licence is for the one project named on it; the Catalog pass covers any number of your projects.` },
+        { heading: "The Catalog pass", text: `${TIER_USE.catalog} It runs one year from payment. A project first published while it is active stays licensed for good; a project published after it ends needs a new pass or its own licence.` },
+        { heading: "Credit", text: "Credit the music where your project shows credits or a description (end credits, an about screen, a video description, show notes), with a link to the artist's page on nixamp. The certificate gives the line to use. If there is nowhere to credit, put it where people can find it, such as your project's website." },
+        { heading: "What you may not do", text: "Sell, give away or publish the music on its own or as music (a track, an album, a sample pack, a stock or production library), or let others take it out of your project to use separately. Register the music as yours, or claim it with a content ID system (YouTube Content ID and the like). Use it as a trademark, jingle or sound logo. Use it to train or evaluate AI models. Use it in anything unlawful, defamatory or hateful." },
+        { heading: "Transfer", text: "The licence is yours and is not transferable, except with the project it is in: if you sell the project, the licence goes with it." },
+        { heading: "AI and rights", text: `The music and lyrics are made with AI and released by ${holder}. In some countries, including the United States, works made by AI have limited or no copyright protection. This licence is our written permission and our promise not to claim against your licensed use; we do not promise that nobody else can use the same music.` },
+        { heading: "No warranty", text: "The music is licensed as it is, without warranty. Our total liability under a licence is what you paid for it." },
+        { heading: "Ending", text: "If you break these terms the licence ends for new uses; tell us and fix it within 30 days and it continues." },
+        { heading: "Proof", text: `Every licence has a code (NXL-XXXX-XXXX) and a public page at ${site}/license/<code> that says who holds it, for what, and whether it is active.` },
+        { heading: "Law", text: "California law governs these terms." },
+    ];
+}

package/dist/server.d.ts

@@ -27,6 +27,7 @@ import { Importer } from "./handoff.ts";
 import { AiLabel } from "./ai-label.ts";
 import { MusicStore } from "./music-store.ts";
 import { MusicHub } from "./music-hub.ts";
+import { MusicLicenses } from "./music-license.ts";
 import { AiRadio } from "./ai-radio.ts";
 import { ListenerShares } from "./listener-shares.ts";
 import { Support, SupportSubscriptions } from "./support.ts";
@@ -834,6 +835,8 @@ export interface HandlerOptions {
     coinpayWebhookSecret?: string;
     /** The AI label's songs for sale, nixamp.com only (music-store.ts). */
     musicStore?: MusicStore;
+    /** Licences to use that music in games, apps and videos, nixamp.com only (music-license.ts). */
+    musicLicenses?: MusicLicenses;
     /** nixamp.com/music: every server's label in one app (music-hub.ts). */
     music?: {
         hub: MusicHub;

package/dist/server.js

@@ -68,6 +68,8 @@ import { handleMusicRoutes, isMusicPath, MusicHub, musicPageFor, serverId } from
 import { fileLedger, pgLedger, VeoBudgetError, VeoStudio } from "./veo-studio.js";
 import { KnownServers } from "./known-servers.js";
 import { handleStoreRoutes, isStorePath } from "./store-routes.js";
+import { MusicLicenses } from "./music-license.js";
+import { handleLicenseRoutes, isLicensePath } from "./license-routes.js";
 import { AiRadio } from "./ai-radio.js";
 import { ListenerShares } from "./listener-shares.js";
 import { HolderStore, TagReader, factsFor } from "./track-facts.js";
@@ -2179,6 +2181,10 @@ export function createHandler(engine, options) {
                         json(response, 200, await options.musicStore.settle(event.paymentId));
                         return;
                     }
+                    if (options.musicLicenses && await options.musicLicenses.owns(event.paymentId)) {
+                        json(response, 200, await options.musicLicenses.settle(event.paymentId));
+                        return;
+                    }
                 }
                 catch (error) {
                     console.error(`nixamp: CoinPay webhook for ${event.paymentId} (music) could not settle: ${error instanceof Error ? error.message : String(error)}`);
@@ -2321,6 +2327,7 @@ export function createHandler(engine, options) {
             !(isPublicLabelPath(path) && Boolean(options.stations?.label)) &&
             // The music store: its pages, checkout, receipts and grants (nixamp.com).
             !(isStorePath(path) && Boolean(options.musicStore)) &&
+            !(isLicensePath(path) && Boolean(options.musicLicenses)) &&
             // nixamp.com/music: the app and its catalogue, for anybody.
             !(isMusicPath(path) && Boolean(options.music)) &&
             !(/^\/radio\/(artist|album)\//.test(path) && Boolean(options.music)) &&
@@ -2918,6 +2925,18 @@ export function createHandler(engine, options) {
             }))
                 return;
         }
+        if (options.musicLicenses && isLicensePath(path)) {
+            const accounts = options.accounts;
+            if (await handleLicenseRoutes(request, response, path, url, {
+                licenses: options.musicLicenses,
+                account: async () => (accounts ? await accounts.whoIs(tokenFrom(request.headers)) : null),
+                json,
+                readBody,
+                serverId,
+                site: (process.env["NIXAMP_SITE"] || "https://nixamp.com").replace(/\/+$/, ""),
+            }))
+                return;
+        }
         if (options.stations?.label && (isPublicLabelPath(path) || path === "/api/v1/stations/label" || path.startsWith("/api/v1/stations/label/"))) {
             const control = isPublicLabelPath(path) ? { allowed: false } : await controlOf();
             if (await handleLabelRoutes(request, response, path, {
@@ -7514,6 +7533,16 @@ export async function serve(argv, version = "0.1.0") {
         ...(musicHub ? { resolveServer: (id) => musicHub.resolve(id) } : {}),
         log: (line) => console.log(line),
     }) : undefined;
+    // Licences to use that music in games, apps and videos (music-license.ts), paid the same way.
+    const musicLicenses = musicStore && supportPayments && pool ? new MusicLicenses({
+        db: pool,
+        support: supportPayments,
+        store: musicStore,
+        mail: process.env["RESEND_API_KEY"] ? { apiKey: process.env["RESEND_API_KEY"], from: process.env["NIXAMP_MAIL_FROM"] ?? "nixamp <notifications@nixamp.com>" } : null,
+        site: nixampSite,
+        serverId,
+        log: (line) => console.log(line),
+    }) : undefined;
     /**
      * A server says an album (or song) of its label landed: its artist's
      * followers are told. Only the account that owns a listed server may say
@@ -8151,6 +8180,7 @@ export async function serve(argv, version = "0.1.0") {
         ...(supportPayments ? { support: supportPayments } : {}),
         ...(supportMonthly ? { supportSubscriptions: supportMonthly } : {}),
         ...(musicStore ? { musicStore } : {}),
+        ...(musicLicenses ? { musicLicenses } : {}),
         ...(musicHub ? { music: { hub: musicHub, released: musicReleased, veo: musicVeo } } : {}),
         ...(process.env["COINPAY_WEBHOOK_SECRET"] ? { coinpayWebhookSecret: process.env["COINPAY_WEBHOOK_SECRET"] } : {}),
         ...(sharedTranslations ? { sharedTranslations } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.61.2",
+  "version": "0.62.0",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",

package/src/license-routes.ts

@@ -0,0 +1,258 @@
+/**
+ * Music licences on nixamp.com (music-license.ts): the pages and the API.
+ *
+ *   GET  /license?server=&kind=song|album&artist=&album=&n=   pick a licence for a song or album, then pay
+ *   GET  /license?kind=catalog                                the Catalog pass, $29 a year
+ *   GET  /license/terms                                       the terms, in plain words
+ *   GET  /license/NXL-XXXX-XXXX                               anybody's check of a licence
+ *   GET  /licenses/:id?t=                                     the licensee's certificate (printable)
+ *   POST /api/v1/licenses/checkout                            {tier, kind, server?, artist?, album?, n?, licensee, project, projectUrl?, email, coin, agree} -> {url}
+ *   GET  /api/v1/licenses/NXL-XXXX-XXXX                       the check, as JSON
+ *   GET  /api/v1/licenses                                     the signed-in account's licences
+ */
+import { createHash } from "node:crypto";
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { LICENSE_PRICES, TERMS_VERSION, TIER_NAMES, TIER_USE, licenseTerms, type License, type MusicLicenses, type Quote, type Tier } from "./music-license.ts";
+import { SupportError } from "./support.ts";
+
+const CHECK = /^\/license\/(NXL-[A-Z2-9]{4}-[A-Z2-9]{4})$/;
+const CHECK_JSON = /^\/api\/v1\/licenses\/(NXL-[A-Z2-9]{4}-[A-Z2-9]{4})$/;
+const CERTIFICATE = /^\/licenses\/([0-9a-f-]{36})$/;
+
+export function isLicensePath(path: string): boolean {
+  return path === "/license" || path === "/license/terms" || CHECK.test(path) || CERTIFICATE.test(path)
+    || path === "/api/v1/licenses/checkout" || path === "/api/v1/licenses" || CHECK_JSON.test(path);
+}
+
+export interface LicenseRoutesContext {
+  licenses: MusicLicenses;
+  account: () => Promise<{ id: string; email: string } | null>;
+  json: (response: ServerResponse, status: number, body: unknown) => void;
+  readBody: (request: IncomingMessage) => Promise<string>;
+  /** The opaque id a server goes by in nixamp.com's addresses. */
+  serverId: (base: string) => string;
+  site: string;
+}
+
+const escape = (text: string): string => text.replace(/[&<>"']/g, (one) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[one]!);
+const hash = (text: string): string => `'sha256-${createHash("sha256").update(text).digest("base64")}'`;
+const price = (cents: number): string => `$${(cents / 100).toFixed(cents % 100 ? 2 : 0)}`;
+const day = (ms: number): string => new Date(ms).toISOString().slice(0, 10);
+
+const STYLE = `
+:root{--bg:#080c09;--fg:#e8efe9;--muted:#9aa79d;--card:#0e1410;--line:#1f2a22;--accent:#3ddc84}
+*{box-sizing:border-box}html,body{margin:0;background:var(--bg);color:var(--fg);font:16px/1.55 system-ui,-apple-system,"Segoe UI",sans-serif}
+main{max-width:640px;margin:0 auto;padding:40px 16px}
+.card{background:var(--card);border:1px solid var(--line);border-radius:16px;padding:24px;margin-bottom:16px}
+h1{margin:0 0 4px;font-size:1.5rem;overflow-wrap:anywhere}h2{font-size:1.05rem;margin:22px 0 6px}.by{color:var(--muted);margin:0 0 16px}
+.cover{border-radius:10px;float:right;margin:0 0 8px 12px;width:120px;height:120px;object-fit:cover;max-width:35%}
+fieldset{border:0;padding:0;margin:16px 0 0}legend{color:var(--muted);font-size:.9rem;margin-bottom:6px}
+.tier{display:grid;grid-template-columns:auto 1fr auto;gap:4px 12px;align-items:start;border:1px solid var(--line);border-radius:12px;padding:12px;margin-bottom:8px;cursor:pointer}
+.tier:has(input:checked){border-color:var(--accent)}.tier strong{display:block}.tier span{color:var(--muted);font-size:.9rem}.tier b{color:var(--accent);white-space:nowrap}
+label.f{display:block;color:var(--muted);font-size:.9rem;margin:12px 0 4px}
+input[type=text],input[type=email],input[type=url],select{width:100%;padding:10px;border-radius:10px;border:1px solid var(--line);background:var(--bg);color:var(--fg);font:inherit}
+.agree{display:flex;gap:8px;align-items:flex-start;margin-top:14px;color:var(--muted);font-size:.9rem}
+button,a.go{display:block;text-align:center;text-decoration:none;margin-top:18px;width:100%;padding:12px;border:0;border-radius:999px;background:var(--accent);color:#06120a;font:inherit;font-weight:800;cursor:pointer}
+button:disabled{opacity:.5;cursor:wait}
+:focus-visible{outline:3px solid var(--accent);outline-offset:2px}
+#status{min-height:1.4em;margin-top:12px;color:var(--muted)}
+small,.muted{color:var(--muted)}a{color:var(--accent)}
+dl{display:grid;grid-template-columns:max-content 1fr;gap:6px 16px;margin:16px 0}dt{color:var(--muted)}dd{margin:0;overflow-wrap:anywhere}
+.ok{display:inline-block;padding:2px 10px;border-radius:999px;background:#14361f;color:var(--accent);font-weight:700;font-size:.85rem}
+.no{display:inline-block;padding:2px 10px;border-radius:999px;background:#3a1717;color:#ff8f8f;font-weight:700;font-size:.85rem}
+code{display:block;white-space:pre-wrap;background:var(--bg);border:1px solid var(--line);border-radius:10px;padding:10px;font-size:.9rem;overflow-wrap:anywhere}
+.print{background:transparent;border:1px solid var(--line);color:var(--fg)}
+@media print{:root{--bg:#fff;--fg:#000;--muted:#444;--card:#fff;--line:#999;--accent:#000}.noprint{display:none}.card{border-color:#000}}
+`;
+
+const SCRIPT = `
+(() => {
+  const $ = (s) => document.querySelector(s);
+  const print = $("#print");
+  if (print) print.addEventListener("click", () => window.print());
+  const form = $("#license");
+  if (!form) return;
+  const status = $("#status");
+  const pay = $("#pay");
+  const label = () => { const one = form.querySelector("input[name=tier]:checked"); pay.textContent = one ? "Pay " + one.dataset.price + " with crypto" : "Pick a licence"; };
+  form.addEventListener("change", label);
+  label();
+  fetch("/api/v1/store/coins").then((r) => r.json()).then((coins) => {
+    const cheap = ["USDC_POL", "USDC_SOL", "SOL", "POL", "LTC", "USDC_BASE", "USDC"];
+    const list = (coins.coins || []).slice().sort((a, b) => (cheap.indexOf(a) + 1 || 99) - (cheap.indexOf(b) + 1 || 99));
+    $("#coin").replaceChildren(...list.map((c) => Object.assign(document.createElement("option"), { value: c, textContent: c })));
+  }).catch(() => { status.textContent = "Payments are not available right now."; });
+  form.addEventListener("submit", async (event) => {
+    event.preventDefault();
+    pay.disabled = true;
+    status.textContent = "Starting the checkout…";
+    const data = new FormData(form);
+    try {
+      const r = await fetch("/api/v1/licenses/checkout", { method: "POST", headers: { "content-type": "application/json" }, credentials: "same-origin",
+        body: JSON.stringify({ ...JSON.parse(document.body.dataset.item), tier: data.get("tier"), licensee: data.get("licensee"), project: data.get("project"),
+          projectUrl: data.get("projectUrl"), email: data.get("email"), coin: data.get("coin"), agree: data.get("agree") === "on" }) });
+      const body = await r.json();
+      if (!r.ok) throw new Error(body.error || "The checkout did not start.");
+      status.textContent = "Taking you to CoinPay…";
+      location.href = body.url;
+    } catch (error) {
+      status.textContent = error.message;
+      pay.disabled = false;
+    }
+  });
+})();
+`;
+
+export const LICENSE_CSP = ["default-src 'none'", `script-src ${hash(SCRIPT)}`, `style-src ${hash(STYLE)}`, "img-src 'self' https:", "connect-src 'self'", "form-action 'none'", "base-uri 'none'", "frame-ancestors 'none'"].join("; ");
+
+function page(title: string, body: string, options: { data?: string; index?: boolean; description?: string } = {}): string {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escape(title)} · nixamp</title>${options.index ? "" : `<meta name="robots" content="noindex">`}${options.description ? `<meta name="description" content="${escape(options.description)}">` : ""}
+<link rel="icon" href="/favicon.png" type="image/png"><style>${STYLE}</style></head>
+<body${options.data ? ` data-item="${escape(options.data)}"` : ""}><main>${body}</main><script>${SCRIPT}</script></body></html>`;
+}
+
+function html(response: ServerResponse, status: number, text: string, method: string): void {
+  response.writeHead(status, { "content-type": "text/html; charset=utf-8", "content-security-policy": LICENSE_CSP, "cache-control": "no-store", "referrer-policy": "no-referrer" });
+  response.end(method === "HEAD" ? undefined : text);
+}
+
+/** The tiers sold for what is being licensed, cheapest first. */
+function tiersFor(kind: Quote["kind"]): Tier[] {
+  return (Object.keys(LICENSE_PRICES) as Tier[]).filter((tier) => LICENSE_PRICES[tier][kind]).sort((a, b) => LICENSE_PRICES[a][kind]! - LICENSE_PRICES[b][kind]!);
+}
+
+function certificate(license: License, ctx: LicenseRoutesContext, full: boolean): string {
+  const view = ctx.licenses.view(license, full);
+  const active = Boolean(view["active"]);
+  return `<div class="card">
+<p>${active ? `<span class="ok">Active licence</span>` : license.status === "paid" ? `<span class="no">Pass ended ${day(license.expiresAt)}</span>` : `<span class="no">Not paid yet</span>`}</p>
+<h1>${escape(TIER_NAMES[license.tier])} licence ${escape(license.code)}</h1>
+<p class="by">${escape(license.title)}${license.kind === "catalog" ? "" : ` · ${escape(license.artistName)}`}</p>
+<dl>
+<dt>Licensee</dt><dd>${escape(license.licensee)}</dd>
+<dt>Project</dt><dd>${escape(license.project)}${license.projectUrl ? ` · <a href="${escape(license.projectUrl)}" rel="nofollow noopener">${escape(license.projectUrl)}</a>` : ""}</dd>
+<dt>Covers</dt><dd>${escape(TIER_USE[license.tier])}</dd>
+<dt>Licensor</dt><dd>${escape(ctx.licenses.holder)}</dd>
+${license.paidAt ? `<dt>Issued</dt><dd>${day(license.paidAt)}</dd>` : ""}
+${license.expiresAt ? `<dt>New projects until</dt><dd>${day(license.expiresAt)} (projects published before then stay licensed)</dd>` : `<dt>Term</dt><dd>For good, worldwide, non-exclusive</dd>`}
+<dt>Terms</dt><dd><a href="/license/terms">Version ${escape(license.terms)}</a></dd>
+<dt>Check</dt><dd><a href="/license/${escape(license.code)}">${escape(ctx.site)}/license/${escape(license.code)}</a></dd>
+</dl>
+<h2>Credit line</h2>
+<p class="muted">Required wherever the project shows credits or a description, with the link:</p>
+<code>${escape(String(view["credit"]))}</code>
+${full ? `<button id="print" class="print noprint" type="button">Print or save as PDF</button>` : ""}
+</div>`;
+}
+
+export async function handleLicenseRoutes(request: IncomingMessage, response: ServerResponse, path: string, url: URL, ctx: LicenseRoutesContext): Promise<boolean> {
+  if (!isLicensePath(path)) return false;
+  const method = request.method ?? "GET";
+  const licenses = ctx.licenses;
+  try {
+    if (path === "/license" && (method === "GET" || method === "HEAD")) {
+      const asked = Object.fromEntries(url.searchParams.entries());
+      const kind = asked["kind"] === "catalog" ? "catalog" : asked["kind"] === "album" ? "album" : "song";
+      let quote: Quote;
+      try {
+        quote = await licenses.quote({ ...asked, kind, tier: tiersFor(kind)[0] });
+      } catch (error) {
+        html(response, 404, page("Not licensable", `<div class="card"><h1>Not licensable</h1><p class="by">${escape((error as Error).message)}</p><p><a href="/music">Back to the music</a></p></div>`), method);
+        return true;
+      }
+      const me = await ctx.account().catch(() => null);
+      const cover = quote.kind === "catalog" ? "" : `<img class="cover" src="${escape(`/api/v1/music/file/${ctx.serverId(quote.server)}/${quote.artist}/${quote.album}/cover.jpg`)}" alt="">`;
+      const tiers = tiersFor(quote.kind);
+      const options = tiers.map((tier, at) => `<label class="tier"><input type="radio" name="tier" value="${tier}" data-price="${price(LICENSE_PRICES[tier][quote.kind]!)}"${at === (tiers.length > 1 ? 1 : 0) ? " checked" : ""}>
+<div><strong>${escape(TIER_NAMES[tier])}</strong><span>${escape(TIER_USE[tier])}</span></div><b>${price(LICENSE_PRICES[tier][quote.kind]!)}${tier === "catalog" ? "/year" : ""}</b></label>`).join("");
+      const what = quote.kind === "catalog" ? `Every song by every artist ${escape(licenses.holder)} releases on nixamp` : quote.kind === "album" ? `The album "${escape(quote.title)}" by ${escape(quote.artistName)}` : `"${escape(quote.title)}" by ${escape(quote.artistName)}`;
+      html(response, 200, page(`License ${quote.title}`, `<div class="card">${cover}
+<h1>License ${quote.kind === "catalog" ? "the whole catalogue" : "this music"}</h1>
+<p class="by">${what}</p>
+<p class="muted">For your game, app, video or podcast. A download is for listening; a licence lets you put the music in your project and publish it. Worldwide, non-exclusive, and every use credits the artist with a link to their page.</p>
+<form id="license">
+<fieldset><legend>Licence</legend>${options}</fieldset>
+<label class="f" for="licensee">Licensed to (your name or company)</label>
+<input id="licensee" name="licensee" type="text" required minlength="2" maxlength="120" autocomplete="organization">
+<label class="f" for="project">${quote.kind === "catalog" ? "Your studio, channel or business" : "Project the music goes in"}</label>
+<input id="project" name="project" type="text" required minlength="2" maxlength="160">
+<label class="f" for="projectUrl">Project link (optional)</label>
+<input id="projectUrl" name="projectUrl" type="url" maxlength="300" placeholder="https://">
+<label class="f" for="email">Email (your certificate goes here)</label>
+<input id="email" name="email" type="email" required autocomplete="email" value="${escape(me?.email ?? "")}">
+<label class="f" for="coin">Pay with</label>
+<select id="coin" name="coin" required></select>
+<label class="agree"><input type="checkbox" name="agree" required> <span>I agree to the <a href="/license/terms" target="_blank" rel="noopener">licence terms</a>, including the credit with a link to the artist's page.</span></label>
+<button id="pay" type="submit">Pay</button>
+</form>
+<p id="status" role="status" aria-live="polite"></p>
+<small>Payments go through <a href="https://coinpayportal.com">CoinPay</a> to nixamp.com. You get a certificate with a licence code that anybody can check at ${escape(ctx.site)}/license/&lt;code&gt;.</small>
+</div>`, { data: JSON.stringify({ kind: quote.kind, ...(quote.kind === "catalog" ? {} : { server: ctx.serverId(quote.server), artist: quote.artist, album: quote.album, n: quote.n }) }) }), method);
+      return true;
+    }
+    if (path === "/license/terms" && (method === "GET" || method === "HEAD")) {
+      const sections = licenseTerms(licenses.holder, ctx.site).map((one) => `<h2>${escape(one.heading)}</h2><p>${escape(one.text)}</p>`).join("");
+      html(response, 200, page("Music licence terms", `<div class="card"><h1>Music licence terms</h1><p class="by">Version ${TERMS_VERSION} · ${escape(licenses.holder)}</p>${sections}<p><a href="/music">The music</a> · <a href="/license?kind=catalog">Catalog pass</a></p></div>`,
+        { index: true, description: `How you may use ${licenses.holder}'s AI music in your games, apps and videos: Creator, Indie, Commercial and the Catalog pass.` }), method);
+      return true;
+    }
+    const check = CHECK.exec(path);
+    if (check && (method === "GET" || method === "HEAD")) {
+      const license = await licenses.byCode(check[1]!);
+      html(response, license ? 200 : 404, page(license ? `Licence ${license.code}` : "No such licence", license
+        ? certificate(license, ctx, false)
+        : `<div class="card"><h1>No such licence</h1><p class="by">${escape(check[1]!)} is not a paid nixamp music licence.</p></div>`), method);
+      return true;
+    }
+    const mine = CERTIFICATE.exec(path);
+    if (mine && (method === "GET" || method === "HEAD")) {
+      const license = await licenses.get(mine[1]!, url.searchParams.get("t") ?? "");
+      if (!license) {
+        html(response, 404, page("No such licence", `<div class="card"><h1>No such licence</h1><p class="by">That link is not one of ours.</p></div>`), method);
+        return true;
+      }
+      const body = license.status === "paid"
+        ? certificate(license, ctx, true)
+        : `<div class="card"><h1>${escape(TIER_NAMES[license.tier])} licence ${escape(license.code)}</h1><p class="by">${escape(license.title)} · ${price(license.amountCents)} in ${escape(license.coin)}</p>
+<p>Waiting for your payment. Once CoinPay confirms it, your certificate is here and in your email (${escape(license.email)}). This page checks again when you reload it.</p>
+<a class="go" href="https://coinpayportal.com/pay/${escape(license.paymentId)}">Open the payment</a></div>`;
+      html(response, 200, page(`Licence ${license.code}`, body), method);
+      return true;
+    }
+    const checkJson = CHECK_JSON.exec(path);
+    if (checkJson && method === "GET") {
+      const license = await licenses.byCode(checkJson[1]!);
+      response.setHeader("access-control-allow-origin", "*");
+      ctx.json(response, license ? 200 : 404, license ? { license: licenses.view(license, false) } : { error: "no such licence", code: "not_found" });
+      return true;
+    }
+    if (path === "/api/v1/licenses/checkout" && method === "POST") {
+      let input: Record<string, unknown>;
+      try {
+        input = JSON.parse(await ctx.readBody(request)) as Record<string, unknown>;
+      } catch {
+        ctx.json(response, 400, { error: "the body is not JSON", code: "bad_json" });
+        return true;
+      }
+      const me = await ctx.account().catch(() => null);
+      ctx.json(response, 201, await licenses.checkout(input, me));
+      return true;
+    }
+    if (path === "/api/v1/licenses" && method === "GET") {
+      const me = await ctx.account().catch(() => null);
+      if (!me) {
+        ctx.json(response, 401, { error: "sign in to see your licences", code: "unauthorized" });
+        return true;
+      }
+      ctx.json(response, 200, { licenses: (await licenses.forAccount(me)).map((one) => licenses.view(one, true)) });
+      return true;
+    }
+    ctx.json(response, 405, { error: "not like that", code: "method_not_allowed" });
+    return true;
+  } catch (error) {
+    if (error instanceof SupportError) ctx.json(response, error.status, { error: error.message, code: error.code });
+    else ctx.json(response, 500, { error: error instanceof Error ? error.message : String(error), code: "internal" });
+    return true;
+  }
+}