nixamp 0.67.1 → 0.67.4

package/src/ai-label.ts

@@ -59,6 +59,12 @@ export interface LabelSong {
   videoTagged?: boolean;
   /** 2 for a storyboard video (scenes that move); absent or 1 for the cover-and-waveform kind, which is made again. */
   videoVersion?: number;
+  /**
+   * The singer in its filmed video: "synced" (close-ups lip-synced), "unsynced" (filmed, but no
+   * sync could be made, so the band plays there). Absent on a filmed video means the singer was
+   * never filmed, and with lip sync on it is filmed again.
+   */
+  singer?: "synced" | "unsynced";
   /** Who wrote the words and who sang them, e.g. "llama-3.3 + elevenlabs/music_v2_5". */
   made: string;
   composedAt: number;
@@ -819,6 +825,17 @@ export function closeUpTimes(seconds: number, lines: Array<{ start: number }>, c
  */
 export const FILMED = 6;
 
+/** Google's answer when the project's daily Veo requests are used up (HTTP 429). */
+export const VEO_QUOTA = /exceeded your current quota|RESOURCE_EXHAUSTED/i;
+
+/** The next midnight in California, when Google's daily quotas reset. */
+export function nextPacificMidnight(now: number): number {
+  const hour = (at: number): number => Number(new Intl.DateTimeFormat("en-US", { timeZone: "America/Los_Angeles", hour: "numeric", hourCycle: "h23" }).format(new Date(at)));
+  let at = Math.floor(now / 3_600_000) * 3_600_000 + 3_600_000;
+  for (let i = 0; i < 26 && hour(at) !== 0; i++) at += 3_600_000;
+  return at;
+}
+
 /**
  * A single's music video, cut from its filmed shots alone: 4 s cuts, each
  * shot's first half then its second, round and round the shots until the song
@@ -993,6 +1010,8 @@ export class AiLabel {
   private alignTried = new Set<string>();
   /** The month ("YYYY-MM") Veo said its budget was spent; no more shots until the next. */
   private veoSpentIn = "";
+  /** Until when Google's daily Veo quota is used up (its midnight, Pacific): nothing is asked before. */
+  private veoQuotaUntil = 0;
   /** Old videos already tried as storyboards since this server started. */
   private upgradeTried = new Set<string>();
   /** When each single was last put in front of the camera: one that came up short is tried again an hour on. */
@@ -1328,7 +1347,9 @@ export class AiLabel {
       .filter((album) => album.cover || album.coverTried)
       .flatMap((album) => album.songs.filter((song) => song.file && !this.videoFailed.has(song.file)).map((song) => ({ artist, album, song }))));
     // Only a single is filmed, and only with Veo footage: a song with an older (slideshow) video is filmed when its turn comes.
-    const missing = songs.filter(({ song }) => this.wantsVeo(song) && (song.videoVersion ?? 1) < FILMED && this.now() - (this.filmTriedAt.get(song.file) ?? 0) > 60 * 60_000);
+    // A filmed video whose singer was never filmed (a quota or a refusal took the close-ups) is filmed again while it stays up.
+    const singerless = (song: LabelSong): boolean => Boolean(this.deps.lipsync) && this.settings.lipsyncShots > 0 && (song.videoVersion ?? 1) >= FILMED && !song.singer;
+    const missing = songs.filter(({ song }) => this.wantsVeo(song) && ((song.videoVersion ?? 1) < FILMED || singerless(song)) && this.now() - (this.filmTriedAt.get(song.file) ?? 0) > 60 * 60_000);
     const untagged = songs.filter(({ song }) => song.video && !song.videoTagged && (song.videoVersion ?? 1) >= FILMED);
     const old: typeof songs = [];
     let made = 0;
@@ -1359,7 +1380,9 @@ export class AiLabel {
       const partial = join(album.folder, `.${randomBytes(4).toString("hex")}.video.mp4`);
       const scenes = join(album.folder, `.scenes-${song.n}-${randomBytes(3).toString("hex")}`);
       try {
-        song.videoVersion = await this.filmSong(artist, album, song, scenes, partial, upgrade);
+        const filmed = await this.filmSong(artist, album, song, scenes, partial, upgrade);
+        song.videoVersion = filmed.version;
+        if (filmed.singer) song.singer = filmed.singer;
         renameSync(partial, out);
         song.video = out;
         song.videoTagged = true;
@@ -1382,7 +1405,7 @@ export class AiLabel {
    * Fewer than half the shots filmed (a refusal, the budget spent) makes no
    * video at all: footage stretched that thin would be a loop, not a video.
    */
-  private async filmSong(artist: LabelArtist, _album: LabelAlbum, song: LabelSong, scenes: string, out: string, _upgrade = false): Promise<number> {
+  private async filmSong(artist: LabelArtist, _album: LabelAlbum, song: LabelSong, scenes: string, out: string, _upgrade = false): Promise<{ version: number; singer?: "synced" | "unsynced" }> {
     let seconds = song.seconds;
     try {
       const probed = await this.deps.probe(song.file);
@@ -1393,10 +1416,13 @@ export class AiLabel {
     const { band: clips, singer } = await this.filmShots(artist, _album, song, shots, scenes);
     const wanted = this.settings.veoShots + this.settings.storyShots;
     if (clips.length < Math.max(2, Math.ceil(wanted / 2))) throw new Error(`only ${clips.length} of ${wanted} shots filmed so far`);
+    // The singer is the point of the video: with lip sync on, nothing is cut until a close-up is filmed.
+    const singing = Boolean(this.deps.lipsync) && this.settings.lipsyncShots > 0;
+    if (singing && singer.length === 0) throw new Error("the singer's close-ups are not filmed yet");
     const pinned = await this.syncCloseUps(song, singer, seconds, shots);
     await (this.deps.filmedVideo ?? ((input) => renderFilmedVideo(this.deps.ffmpeg, input)))({ audio: song.file, clips, seconds, artist: artist.name, title: song.title, out, ...(pinned.length ? { pinned } : {}) });
     rmSync(shots, { recursive: true, force: true });
-    return FILMED;
+    return { version: FILMED, ...(singing ? { singer: pinned.length ? "synced" as const : "unsynced" as const } : {}) };
   }
 
   /**
@@ -1447,7 +1473,8 @@ export class AiLabel {
 
   /** Whether this song gets filmed Veo shots: an album's single, Veo on, and the month's budget not spent. */
   private wantsVeo(song: Pick<LabelSong, "n">): boolean {
-    return this.settings.veo && song.n === 1 && Boolean(this.deps.veo) && this.veoSpentIn !== new Date(this.now()).toISOString().slice(0, 7);
+    return this.settings.veo && song.n === 1 && Boolean(this.deps.veo) && this.veoSpentIn !== new Date(this.now()).toISOString().slice(0, 7)
+      && this.now() >= this.veoQuotaUntil;
   }
 
   /**
@@ -1497,10 +1524,11 @@ export class AiLabel {
     }
     // The singer's close-ups only where they can be lip-synced afterwards. Story scenes go without
     // the portraits: they would pull the whole band into every scene.
+    // The singer first: a day's few Veo requests go to what the video is for, then the story and the band.
     const plan = [
+      ...(this.deps.lipsync ? veoPrompts(artist, song, singers, this.settings.lipsyncShots, "singer").map((prompt, i) => ({ prompt, file: join(keep, `singer-${i}.mp4`), into: singer, refs: singerRefs })) : []),
       ...storyFiles.map((file, i) => ({ prompt: storyPrompts[i] ?? "", file, into: story, refs: [] as Buffer[] })),
       ...veoPrompts(artist, song, players, this.settings.veoShots).map((prompt, i) => ({ prompt, file: join(keep, `shot-${i}.mp4`), into: band, refs: playerRefs })),
-      ...(this.deps.lipsync ? veoPrompts(artist, song, singers, this.settings.lipsyncShots, "singer").map((prompt, i) => ({ prompt, file: join(keep, `singer-${i}.mp4`), into: singer, refs: singerRefs })) : []),
     ];
     for (const [i, { prompt, file, into, refs }] of plan.entries()) {
       try {
@@ -1526,6 +1554,12 @@ export class AiLabel {
           this.log(`Veo: ${(error as Error).message}; no more videos until next month`);
           break;
         }
+        if (VEO_QUOTA.test((error as Error).message)) {
+          // Google's daily request quota: every further ask today is refused, so none is made.
+          this.veoQuotaUntil = nextPacificMidnight(this.now());
+          this.log(`Veo: Google's daily quota is used up; filming resumes after ${new Date(this.veoQuotaUntil).toISOString()}`);
+          break;
+        }
         this.log(`Veo shot ${i + 1} for "${song.title}": ${(error as Error).message}`);
       }
     }

package/src/license-routes.ts

@@ -13,7 +13,7 @@
 import { createHash } from "node:crypto";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { LICENSE_PRICES, TERMS_VERSION, TIER_NAMES, TIER_USE, licenseTerms, type License, type MusicLicenses, type Quote, type Tier } from "./music-license.ts";
-import { SupportError } from "./support.ts";
+import { SupportError, paidIn, payUrl } from "./support.ts";
 
 const CHECK = /^\/license\/(NXL-[A-Z2-9]{4}-[A-Z2-9]{4})$/;
 const CHECK_JSON = /^\/api\/v1\/licenses\/(NXL-[A-Z2-9]{4}-[A-Z2-9]{4})$/;
@@ -74,14 +74,9 @@ const SCRIPT = `
   if (!form) return;
   const status = $("#status");
   const pay = $("#pay");
-  const label = () => { const one = form.querySelector("input[name=tier]:checked"); pay.textContent = one ? "Pay " + one.dataset.price + " with crypto" : "Pick a licence"; };
+  const label = () => { const one = form.querySelector("input[name=tier]:checked"); pay.textContent = one ? "Pay " + one.dataset.price : "Pick a licence"; };
   form.addEventListener("change", label);
   label();
-  fetch("/api/v1/store/coins").then((r) => r.json()).then((coins) => {
-    const cheap = ["USDC_POL", "USDC_SOL", "SOL", "POL", "LTC", "USDC_BASE", "USDC"];
-    const list = (coins.coins || []).slice().sort((a, b) => (cheap.indexOf(a) + 1 || 99) - (cheap.indexOf(b) + 1 || 99));
-    $("#coin").replaceChildren(...list.map((c) => Object.assign(document.createElement("option"), { value: c, textContent: c })));
-  }).catch(() => { status.textContent = "Payments are not available right now."; });
   form.addEventListener("submit", async (event) => {
     event.preventDefault();
     pay.disabled = true;
@@ -90,7 +85,7 @@ const SCRIPT = `
     try {
       const r = await fetch("/api/v1/licenses/checkout", { method: "POST", headers: { "content-type": "application/json" }, credentials: "same-origin",
         body: JSON.stringify({ ...JSON.parse(document.body.dataset.item), tier: data.get("tier"), licensee: data.get("licensee"), project: data.get("project"),
-          projectUrl: data.get("projectUrl"), email: data.get("email"), coin: data.get("coin"), agree: data.get("agree") === "on" }) });
+          projectUrl: data.get("projectUrl"), email: data.get("email"), agree: data.get("agree") === "on" }) });
       const body = await r.json();
       if (!r.ok) throw new Error(body.error || "The checkout did not start.");
       status.textContent = "Taking you to CoinPay…";
@@ -181,13 +176,11 @@ export async function handleLicenseRoutes(request: IncomingMessage, response: Se
 <input id="projectUrl" name="projectUrl" type="url" maxlength="300" placeholder="https://">
 <label class="f" for="email">Email (your certificate goes here)</label>
 <input id="email" name="email" type="email" required autocomplete="email" value="${escape(me?.email ?? "")}">
-<label class="f" for="coin">Pay with</label>
-<select id="coin" name="coin" required></select>
 <label class="agree"><input type="checkbox" name="agree" required> <span>I agree to the <a href="/license/terms" target="_blank" rel="noopener">licence terms</a>, including the credit with a link to the artist's page.</span></label>
 <button id="pay" type="submit">Pay</button>
 </form>
 <p id="status" role="status" aria-live="polite"></p>
-<small>Payments go through <a href="https://coinpayportal.com">CoinPay</a> to nixamp.com. You get a certificate with a licence code that anybody can check at ${escape(ctx.site)}/license/&lt;code&gt;.</small>
+<small>Payments go through <a href="https://coinpayportal.com">CoinPay</a> to nixamp.com: pick any coin, or PayPal, on CoinPay's page. You get a certificate with a licence code that anybody can check at ${escape(ctx.site)}/license/&lt;code&gt;.</small>
 </div>`, { data: JSON.stringify({ kind: quote.kind, ...(quote.kind === "catalog" ? {} : { server: ctx.serverId(quote.server), artist: quote.artist, album: quote.album, n: quote.n }) }) }), method);
       return true;
     }
@@ -214,9 +207,9 @@ export async function handleLicenseRoutes(request: IncomingMessage, response: Se
       }
       const body = license.status === "paid"
         ? certificate(license, ctx, true)
-        : `<div class="card"><h1>${escape(TIER_NAMES[license.tier])} licence ${escape(license.code)}</h1><p class="by">${escape(license.title)} · ${price(license.amountCents)} in ${escape(license.coin)}</p>
+        : `<div class="card"><h1>${escape(TIER_NAMES[license.tier])} licence ${escape(license.code)}</h1><p class="by">${escape(license.title)} · ${price(license.amountCents)}${escape(paidIn(license.coin))}</p>
 <p>Waiting for your payment. Once CoinPay confirms it, your certificate is here and in your email (${escape(license.email)}). This page checks again when you reload it.</p>
-<a class="go" href="https://coinpayportal.com/pay/${escape(license.paymentId)}">Open the payment</a></div>`;
+<a class="go" href="${escape(payUrl(license.paymentId))}">Open the payment</a></div>`;
       html(response, 200, page(`Licence ${license.code}`, body), method);
       return true;
     }

package/src/music-license.ts

@@ -17,7 +17,7 @@
  */
 import { randomBytes, randomUUID } from "node:crypto";
 import type { Db, Support } from "./support.ts";
-import { SupportError } from "./support.ts";
+import { SupportError, coinOf } from "./support.ts";
 import type { MusicStore } from "./music-store.ts";
 
 export type Tier = "creator" | "indie" | "commercial" | "catalog";
@@ -203,7 +203,8 @@ export class MusicLicenses {
     const code = newCode();
     const checkout = await this.options.support.pay({
       amountUsd: quote.amountCents / 100,
-      coin: input["coin"],
+      email,
+      accountId: account?.id || email,
       order: `license-${id}`,
       description: `${TIER_NAMES[quote.tier]} licence: ${quote.title}${quote.kind === "catalog" ? ", one year" : ` by ${quote.artistName}`} for ${project}`,
       metadata: { product: "music-license", license: id, tier: quote.tier, kind: quote.kind },
@@ -213,7 +214,7 @@ export class MusicLicenses {
       title, artist_name, credit_url, amount_cents, coin, payment_id, terms, created_at)
       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22)`,
     [id, code, token, email, account?.id ?? "", licensee, project, httpsUrl(input["projectUrl"]), quote.tier, quote.kind, quote.server, quote.artist, quote.album, quote.n,
-      quote.title, quote.artistName, quote.creditUrl, quote.amountCents, String(input["coin"]).toUpperCase(), checkout.paymentId, TERMS_VERSION, new Date(this.now())]);
+      quote.title, quote.artistName, quote.creditUrl, quote.amountCents, coinOf(input["coin"]), checkout.paymentId, TERMS_VERSION, new Date(this.now())]);
     return { url: checkout.url, id, token, code };
   }
 

package/src/music-store.ts

@@ -17,7 +17,7 @@
  */
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import type { Db, Support } from "./support.ts";
-import { SupportError } from "./support.ts";
+import { SupportError, coinOf } from "./support.ts";
 
 export type Kind = "song" | "album" | "artist";
 
@@ -225,7 +225,8 @@ export class MusicStore {
     const token = randomUUID().replace(/-/g, "");
     const checkout = await this.options.support.pay({
       amountUsd: item.amountCents / 100,
-      coin: input["coin"],
+      email,
+      accountId: account?.id || email,
       order: `music-${id}`,
       description: `${item.title} by ${item.artistName} (${item.kind === "song" ? "song" : item.kind === "album" ? "album" : "every album"}, MP3)`,
       metadata: { product: "music", purchase: id, kind: item.kind },
@@ -233,7 +234,7 @@ export class MusicStore {
     });
     await this.options.db.query(`INSERT INTO music_purchases (id, token, email, user_id, server, kind, artist, album, n, title, artist_name, amount_cents, coin, payment_id, created_at)
       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)`,
-    [id, token, email, account?.id ?? "", item.server, item.kind, item.artist, item.album, item.n, item.title, item.artistName, item.amountCents, String(input["coin"]).toUpperCase(), checkout.paymentId, new Date(this.now())]);
+    [id, token, email, account?.id ?? "", item.server, item.kind, item.artist, item.album, item.n, item.title, item.artistName, item.amountCents, coinOf(input["coin"]), checkout.paymentId, new Date(this.now())]);
     return { url: checkout.url, id, token };
   }
 

package/src/server.ts

@@ -2726,10 +2726,15 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       }
       let event: ReturnType<typeof readCoinpayWebhook>;
       try { event = readCoinpayWebhook(JSON.parse(raw)); } catch { json(response, 400, { error: "invalid JSON" }); return; }
+      // A hosted checkout session's payment names its session; the purchase
+      // row holds the session id (cs_...), an older one the payment id.
+      const refs = [event.sessionId, event.paymentId].filter(Boolean);
       if (options.musicStore) {
         try {
-          if (await options.musicStore.owns(event.paymentId)) { json(response, 200, await options.musicStore.settle(event.paymentId)); return; }
-          if (options.musicLicenses && await options.musicLicenses.owns(event.paymentId)) { json(response, 200, await options.musicLicenses.settle(event.paymentId)); return; }
+          for (const ref of refs) {
+            if (await options.musicStore.owns(ref)) { json(response, 200, await options.musicStore.settle(ref)); return; }
+            if (options.musicLicenses && await options.musicLicenses.owns(ref)) { json(response, 200, await options.musicLicenses.settle(ref)); return; }
+          }
         } catch (error) {
           console.error(`nixamp: CoinPay webhook for ${event.paymentId} (music) could not settle: ${error instanceof Error ? error.message : String(error)}`);
           json(response, 500, { error: "could not settle; retry" });
@@ -2738,7 +2743,7 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       }
       if (!options.translationPasses) { json(response, 200, { settled: false, reason: "billing is off here" }); return; }
       try {
-        json(response, 200, await options.translationPasses.settle(event.paymentId));
+        json(response, 200, await options.translationPasses.settle(event));
       } catch (error) {
         // A 5xx makes CoinPay deliver it again, which is what an unreachable
         // CoinPay or database needs.
@@ -2884,7 +2889,7 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       // llms.txt, the OpenAPI document, the health check and the desktop downloads (nixamp.com).
       !(isDiscoveryPath(path) && Boolean(options.accounts && options.site)) &&
       // Supporting a copyright holder is for anybody listening.
-      !/^\/support\/[a-z0-9-]{1,40}$/.test(path) && path !== "/support/cancel" && !/^\/api\/v1\/support\/[a-z0-9-]{1,40}$/.test(path) &&
+      !/^\/support\/[a-z0-9-]{1,40}$/.test(path) && path !== "/support/cancel" && !/^\/support\/pay\/[0-9a-f-]{36}\/[0-9a-f]{32}$/.test(path) && !/^\/api\/v1\/support\/[a-z0-9-]{1,40}$/.test(path) &&
       // A station's short link, which sends the browser to wherever it plays.
       !/^\/watch\/[a-z0-9]{10}$/.test(path) &&
       // A live room's page: the room's own key travels in ?play=, checked by its server.
@@ -2979,6 +2984,41 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       return;
     }
 
+    /*
+     * A monthly support's "pay this month" link, from its emails: a fresh
+     * CoinPay checkout session each time it is followed (one still open is
+     * reused), so a late payer is never sent to an expired session.
+     */
+    const supportPay = /^\/support\/pay\/([0-9a-f-]{36})\/([0-9a-f]{32})$/.exec(path);
+    if (supportPay && options.supportSubscriptions && (request.method === "GET" || request.method === "HEAD")) {
+      const page = (status: number, words: string, again?: string): void => {
+        const safe = (text: string): string => text.replace(/[&<>"']/g, (one) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[one]!);
+        response.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'", "referrer-policy": "no-referrer", "x-robots-tag": "noindex" });
+        response.end(request.method === "HEAD" ? undefined : `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Support · nixamp</title><body style="margin:0;background:#080c09;color:#e8efe9;font:16px/1.5 system-ui,sans-serif"><main style="max-width:520px;margin:0 auto;padding:48px 16px"><h1 style="font-size:1.4rem">Monthly support</h1><p>${safe(words)}</p>${again ? `<p><a style="color:#3ddc84" href="${safe(again)}">${safe(again.includes("/support/pay/") ? "Try again" : "Start again")}</a></p>` : ""}<p><a style="color:#3ddc84" href="https://nixamp.com/guide">Back to the stations</a></p></main></body>`);
+      };
+      // A HEAD (a mail scanner checking the link) never opens a checkout.
+      if (request.method === "HEAD") { page(200, ""); return; }
+      const verdict = guard.check(`support-pay:${callerOf(request.headers, request.socket.remoteAddress, behindProxy)}`, { allowed: 10, windowMs: 60_000 });
+      if (!verdict.ok) { page(429, "Too many at once; wait a minute and open the link again."); return; }
+      try {
+        const opened = await options.supportSubscriptions.open(supportPay[1]!, supportPay[2]!);
+        if (opened.state === "redirect") {
+          response.writeHead(303, { location: opened.url, "cache-control": "no-store", "referrer-policy": "no-referrer" });
+          response.end();
+          return;
+        }
+        const name = options.support?.holder(opened.holder)?.name ?? opened.holder;
+        const site = options.site ?? "https://nixamp.com";
+        if (opened.state === "paid") page(200, `This month's support for ${name} is paid. Thank you. Next month's link comes by email.`);
+        else if (opened.state === "canceled") page(200, `Your monthly support for ${name} was cancelled, so there is nothing to pay.`, `${site}/support/${opened.holder}`);
+        else page(200, `Your monthly support for ${name} stopped after a month went unpaid. Nothing is owed.`, `${site}/support/${opened.holder}`);
+      } catch (error) {
+        if (error instanceof SupportError) page(error.status, error.message, error.status >= 500 ? `${url.pathname}` : undefined);
+        else page(502, "The payment service did not answer; nothing was charged. Try the link again in a minute.", url.pathname);
+      }
+      return;
+    }
+
     /* Support a copyright holder: the page, the coins, and a CoinPay checkout. */
     const supportPage = /^\/support\/([a-z0-9-]{1,40})$/.exec(path);
     if (supportPage && options.support && (request.method === "GET" || request.method === "HEAD")) {
@@ -3012,11 +3052,18 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
           }
           let body: Record<string, unknown> = {};
           try { body = JSON.parse(await readBody(request)) as Record<string, unknown>; } catch { body = {}; }
+          // CoinPay files the payment under the payer: a signed-in member by
+          // account id (their email if the form left it empty), a guest by email.
+          const me = options.accounts ? await options.accounts.whoIs(tokenFrom(request.headers)).catch(() => null) : null;
+          const payer = {
+            email: typeof body["email"] === "string" && body["email"].trim() ? body["email"] : me?.email ?? "",
+            accountId: me?.id ?? null,
+          };
           if (body["monthly"] === true) {
             if (!options.supportSubscriptions) throw new SupportError("Monthly support is not set up here.", 503, "unavailable");
-            json(response, 200, await options.supportSubscriptions.start({ ...body, holder: holder.id }));
+            json(response, 200, await options.supportSubscriptions.start({ ...body, ...payer, holder: holder.id }));
           } else {
-            json(response, 200, await support.checkout({ ...body, holder: holder.id }));
+            json(response, 200, await support.checkout({ ...body, ...payer, holder: holder.id }));
           }
           return;
         }
@@ -4107,8 +4154,11 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
           if (!guard.check(`translation-checkout-ip:${caller}`, { allowed: 10, windowMs: 3600_000 }).ok) throw new SpeechError("Too many new checkouts. Resume your pending purchase.", 429);
           let body: Record<string, unknown>;
           try { body = JSON.parse(await readBody(request, 1024)); } catch { throw new SpeechError("Choose a translation pass.", 400); }
-          if (!body || typeof body !== "object" || typeof body["plan"] !== "string" || typeof body["coin"] !== "string" || typeof body["requestKey"] !== "string") throw new SpeechError("Choose a translation pass and payment currency.", 400);
-          json(response, 200, await service.checkout(who.id, body["plan"], body["coin"], body["requestKey"])); return;
+          if (!body || typeof body !== "object" || typeof body["plan"] !== "string" || typeof body["requestKey"] !== "string") throw new SpeechError("Choose a translation pass.", 400);
+          // A CoinPay hosted session (any coin or PayPal) filed under this
+          // account and its email; `coin` only comes from an older open page.
+          const email = who.email || (typeof body["email"] === "string" ? body["email"] : "");
+          json(response, 200, await service.checkout(who.id, body["plan"], typeof body["coin"] === "string" ? body["coin"] : "", body["requestKey"], { email, accountId: who.id })); return;
         }
         const order = path.match(/^\/api\/v1\/translation-passes\/orders\/([^/]+)$/);
         if (order && request.method === "GET") {
@@ -8019,7 +8069,7 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     ? new TranslationPasses({ db: pool, key: coinpayKeyFrom(), site: nixampSite, admins: [options.owner || ""] }) : undefined;
   // Payments to the copyright holders nixamp.com collects for, on its own CoinPay business.
   const supportPayments = accounts ? new Support({ key: coinpayKeyFrom(), site: nixampSite, holders: supportHoldersFrom() }) : undefined;
-  // Monthly support: each month a new CoinPay payment and its link by email.
+  // Monthly support: each month its stable pay link by email (a fresh CoinPay session per click).
   const supportMonthly = supportPayments && supportPayments.enabled && pool ? new SupportSubscriptions({
     db: pool as unknown as import("./support.ts").Db,
     support: supportPayments,

package/src/store-routes.ts

@@ -13,7 +13,7 @@ import { createHash } from "node:crypto";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { PRICES, type MusicStore } from "./music-store.ts";
 import { serverId } from "./music-hub.ts";
-import { SupportError } from "./support.ts";
+import { SupportError, paidIn, payUrl } from "./support.ts";
 
 const PURCHASE = /^\/purchases\/([0-9a-f-]{36})$/;
 const ONE = /^\/api\/v1\/store\/purchases\/([0-9a-f-]{36})$/;
@@ -61,12 +61,6 @@ const BUY_SCRIPT = `
 (async () => {
   const $ = (s) => document.querySelector(s);
   const status = $("#status");
-  try {
-    const coins = await (await fetch("/api/v1/store/coins")).json();
-    const cheap = ["USDC_POL", "USDC_SOL", "SOL", "POL", "LTC", "USDC_BASE", "USDC"];
-    const list = (coins.coins || []).slice().sort((a, b) => (cheap.indexOf(a) + 1 || 99) - (cheap.indexOf(b) + 1 || 99));
-    $("#coin").replaceChildren(...list.map((c) => Object.assign(document.createElement("option"), { value: c, textContent: c })));
-  } catch { status.textContent = "Payments are not available right now."; }
   $("#buy").addEventListener("submit", async (event) => {
     event.preventDefault();
     const button = $("#pay");
@@ -75,7 +69,7 @@ const BUY_SCRIPT = `
     const form = new FormData(event.currentTarget);
     try {
       const r = await fetch("/api/v1/store/checkout", { method: "POST", headers: { "content-type": "application/json" }, credentials: "same-origin",
-        body: JSON.stringify({ ...JSON.parse(document.body.dataset.item), email: form.get("email"), coin: form.get("coin") }) });
+        body: JSON.stringify({ ...JSON.parse(document.body.dataset.item), email: form.get("email") }) });
       const body = await r.json();
       if (!r.ok) throw new Error(body.error || "The checkout did not start.");
       status.textContent = "Taking you to CoinPay…";
@@ -128,12 +122,10 @@ export async function handleStoreRoutes(request: IncomingMessage, response: Serv
 <form id="buy">
 <label for="email">Email (your download link goes here)</label>
 <input id="email" name="email" type="email" required autocomplete="email" value="${escape(me?.email ?? "")}">
-<label for="coin">Pay with</label>
-<select id="coin" name="coin" required></select>
-<button id="pay" type="submit">Pay ${price(item.amountCents)} with crypto</button>
+<button id="pay" type="submit">Pay ${price(item.amountCents)}</button>
 </form>
 <p id="status" role="status" aria-live="polite"></p>
-<small>Payments go through <a href="https://coinpayportal.com">CoinPay</a> to nixamp.com. For small amounts pick a coin with low fees (USDC on Polygon or Solana, SOL, LTC). Listening on the live stations is always free.${me ? "" : ` <a href="/?redirect=${encodeURIComponent("/music/me")}#account-panel">Sign in</a> with the same email to keep everything under My music.`}</small>
+<small>Payments go through <a href="https://coinpayportal.com">CoinPay</a> to nixamp.com: pick any coin, or PayPal, on CoinPay's page. For small amounts a coin with low fees (USDC on Polygon or Solana, SOL) or PayPal costs least. Listening on the live stations is always free.${me ? "" : ` <a href="/?redirect=${encodeURIComponent("/music/me")}#account-panel">Sign in</a> with the same email to keep everything under My music.`}</small>
 </div>`, JSON.stringify({ server: serverId(item.server), kind: item.kind, artist: item.artist, album: item.album, n: item.n })), method);
       return true;
     }
@@ -148,9 +140,9 @@ export async function handleStoreRoutes(request: IncomingMessage, response: Serv
         ? `<div class="card"><h1>${escape(purchase.title)}</h1><p class="by">${escape(purchase.artistName)} · paid ${price(purchase.amountCents)}</p>
 <a class="go" href="${escape(store.zipUrl(purchase))}" download>Download the zip</a>
 <small>MP3s with the cover art and lyrics, plus each song's .lyrics.txt, cover.jpg and album.json. Keep this page's address (it is in your email too) to download again. Signed in to nixamp.com as ${escape(purchase.email)}, everything you bought is under <a href="/music/me">My music</a>, to play or download.</small></div>`
-        : `<div class="card"><h1>${escape(purchase.title)}</h1><p class="by">${escape(purchase.artistName)} · ${price(purchase.amountCents)} in ${escape(purchase.coin)}</p>
+        : `<div class="card"><h1>${escape(purchase.title)}</h1><p class="by">${escape(purchase.artistName)} · ${price(purchase.amountCents)}${escape(paidIn(purchase.coin))}</p>
 <p>Waiting for your payment. Once CoinPay confirms it, your download is here and in your email (${escape(purchase.email)}). This page checks again when you reload it.</p>
-<a class="go" href="https://coinpayportal.com/pay/${escape(purchase.paymentId)}">Open the payment</a></div>`;
+<a class="go" href="${escape(payUrl(purchase.paymentId))}">Open the payment</a></div>`;
       html(response, 200, page(purchase.title, body), method);
       return true;
     }