nixamp 0.78.5 → 0.80.1

package/dist/library-mcp.d.ts

@@ -9,10 +9,8 @@ export declare const LIBRARY_TOOLS: ({
     name: string;
     description: string;
     inputSchema: {
-        required?: undefined;
         type: string;
         properties: {
-            limit?: undefined;
             server: {
                 type: "string";
                 description: string;
@@ -25,6 +23,7 @@ export declare const LIBRARY_TOOLS: ({
             offset?: undefined;
             kind?: undefined;
             q?: undefined;
+            limit?: undefined;
             name?: undefined;
             id?: undefined;
             items?: undefined;
@@ -32,12 +31,12 @@ export declare const LIBRARY_TOOLS: ({
             source?: undefined;
             force?: undefined;
         };
+        required?: undefined;
     };
 } | {
     name: string;
     description: string;
     inputSchema: {
-        required?: undefined;
         type: string;
         properties: {
             server: {
@@ -77,6 +76,7 @@ export declare const LIBRARY_TOOLS: ({
             source?: undefined;
             force?: undefined;
         };
+        required?: undefined;
     };
 } | {
     name: string;
@@ -119,7 +119,6 @@ export declare const LIBRARY_TOOLS: ({
     inputSchema: {
         type: string;
         properties: {
-            limit?: undefined;
             artist?: undefined;
             album?: undefined;
             genre?: undefined;
@@ -128,6 +127,7 @@ export declare const LIBRARY_TOOLS: ({
             offset?: undefined;
             kind?: undefined;
             q?: undefined;
+            limit?: undefined;
             server: {
                 type: "string";
                 description: string;
@@ -154,7 +154,6 @@ export declare const LIBRARY_TOOLS: ({
     inputSchema: {
         type: string;
         properties: {
-            limit?: undefined;
             artist?: undefined;
             album?: undefined;
             genre?: undefined;
@@ -163,6 +162,7 @@ export declare const LIBRARY_TOOLS: ({
             offset?: undefined;
             kind?: undefined;
             q?: undefined;
+            limit?: undefined;
             name?: undefined;
             server: {
                 type: "string";
@@ -192,7 +192,6 @@ export declare const LIBRARY_TOOLS: ({
         required?: undefined;
         type: string;
         properties: {
-            limit?: undefined;
             artist?: undefined;
             album?: undefined;
             genre?: undefined;
@@ -201,6 +200,7 @@ export declare const LIBRARY_TOOLS: ({
             offset?: undefined;
             kind?: undefined;
             q?: undefined;
+            limit?: undefined;
             name?: undefined;
             id?: undefined;
             items?: undefined;

package/dist/music-hub.d.ts

@@ -61,7 +61,14 @@ export interface MusicHubOptions {
     peers: () => string[];
     fetcher?: typeof fetch;
     now?: () => number;
+    /**
+     * Label servers that moved, old https origin to new (a box gone, its label adopted
+     * on another): /music addresses under the old origin's id go to the new one's.
+     */
+    moved?: Record<string, string>;
 }
+/** NIXAMP_MUSIC_MOVED: "https://old:4321>https://new:4321", several separated by commas. */
+export declare function parseMoved(text: string | undefined): Record<string, string>;
 export declare class MusicHub {
     private readonly options;
     private cache;
@@ -70,6 +77,10 @@ export declare class MusicHub {
     private now;
     /** The https origin behind an opaque id, among the servers known now. */
     resolve(id: string): string;
+    /** The servers to gather, less any that moved (the same label would be listed twice). */
+    private peers;
+    /** The id a moved server goes by now, or "" when this id never moved. */
+    movedTo(id: string): string;
     /** The catalogue, gathered at most once a minute (a slow or gone server is left out, not waited on). */
     catalogue(): Promise<HubCatalogue>;
     private read;

package/dist/music-hub.js

@@ -23,6 +23,16 @@ export function artistFollowId(name) {
     const slug = name.split(/\s*;\s*/)[0].normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 60) || "artist";
     return `artist:${slug}`;
 }
+/** NIXAMP_MUSIC_MOVED: "https://old:4321>https://new:4321", several separated by commas. */
+export function parseMoved(text) {
+    const moved = {};
+    for (const pair of (text ?? "").split(",")) {
+        const [from, to] = pair.split(">").map((one) => one.trim().replace(/\/+$/, ""));
+        if (from && to && /^https?:\/\//.test(from) && /^https?:\/\//.test(to) && from !== to)
+            moved[from] = to;
+    }
+    return moved;
+}
 export class MusicHub {
     options;
     cache = null;
@@ -38,10 +48,22 @@ export class MusicHub {
         if (!/^[a-f0-9]{10}$/.test(id))
             return "";
         if (!this.bases.has(id))
-            for (const base of this.options.peers())
+            for (const base of this.peers())
                 this.bases.set(serverId(base), base);
         return this.bases.get(id) ?? "";
     }
+    /** The servers to gather, less any that moved (the same label would be listed twice). */
+    peers() {
+        const moved = this.options.moved ?? {};
+        return this.options.peers().filter((base) => !moved[base.replace(/\/+$/, "")]);
+    }
+    /** The id a moved server goes by now, or "" when this id never moved. */
+    movedTo(id) {
+        for (const [from, to] of Object.entries(this.options.moved ?? {}))
+            if (serverId(from) === id)
+                return serverId(to);
+        return "";
+    }
     /** The catalogue, gathered at most once a minute (a slow or gone server is left out, not waited on). */
     catalogue() {
         if (this.cache && this.now() - this.cache.at < 60_000)
@@ -64,7 +86,7 @@ export class MusicHub {
         }
     }
     async gather() {
-        const peers = [...new Set(this.options.peers())];
+        const peers = [...new Set(this.peers())];
         const holders = new Set();
         const genres = new Map();
         const stations = [];
@@ -181,6 +203,15 @@ export async function handleMusicRoutes(request, response, path, ctx) {
         ctx.json(response, 405, { error: "not like that" });
         return true;
     }
+    // A label that moved to another server: its old addresses (shared links, search results) go to the new ones.
+    const old = /^(\/music\/(?:artist|album|member)\/|\/api\/v1\/music\/(?:file|member)\/)([a-f0-9]{10})(\/.*)$/.exec(path);
+    const now = old ? ctx.hub.movedTo?.(old[2]) ?? "" : "";
+    if (old && now) {
+        const query = (request.url ?? "").includes("?") ? (request.url ?? "").slice((request.url ?? "").indexOf("?")) : "";
+        response.writeHead(301, { location: `${old[1]}${now}${old[3]}${query}`, "cache-control": "public, max-age=86400" });
+        response.end();
+        return true;
+    }
     if (path === "/api/v1/music") {
         ctx.json(response, 200, await ctx.hub.catalogue());
         return true;

package/dist/nixamp-link-api.d.ts

@@ -10,7 +10,8 @@
  *
  * All five want the site's own session: the person, signed in here. What
  * they hold on nixamp's side is a client token, and it never leaves the
- * server -- the page only ever learns a handle and a list of streams.
+ * server -- the page only ever learns a handle and a list of streams. The
+ * token is kept in memory only, for its hour; never in the database.
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { type Accounts } from "./accounts.ts";
@@ -32,6 +33,9 @@ export interface NixampLinkApiOptions {
     fetcher?: typeof fetch;
 }
 export declare function nixampLinkPath(path: string): boolean;
+/** nixamp.com refused the token held in memory. */
+export declare class StaleToken extends Error {
+}
 /**
  * Every server the nixamp account remembers, asked what it is doing.
  *

package/dist/nixamp-link-api.js

@@ -39,6 +39,9 @@ function landing(home, outcome, reason = "") {
         url.searchParams.set("reason", reason.slice(0, 200));
     return `${url.pathname}${url.search}${url.hash || "#settings"}`;
 }
+/** nixamp.com refused the token held in memory. */
+export class StaleToken extends Error {
+}
 /**
  * Every server the nixamp account remembers, asked what it is doing.
  *
@@ -54,8 +57,10 @@ export async function streamsFor(token, issuer, pageSite, fetcher) {
         headers: { authorization: `Bearer ${token}`, accept: "application/json" },
         signal: AbortSignal.timeout(8000),
     });
+    if (answer.status === 401)
+        throw new StaleToken("nixamp.com no longer accepts this connection; refresh from nixamp");
     if (!answer.ok)
-        throw new Error(answer.status === 401 ? "nixamp.com no longer accepts this connection" : `nixamp.com answered ${answer.status}`);
+        throw new Error(`nixamp.com answered ${answer.status}`);
     const body = (await answer.json().catch(() => ({})));
     servers = Array.isArray(body.servers) ? body.servers : [];
     const page = pageSite.replace(/\/+$/, "");
@@ -177,13 +182,18 @@ export async function handleNixampLinkApi(request, response, url, options) {
     }
     const token = await options.links.accessToken(account.id);
     if (token === "") {
-        json(response, 409, { error: "connect your nixamp account first", connected: false });
+        const { connected } = await options.links.of(account.id);
+        json(response, 409, connected
+            ? { error: "refresh from nixamp to see your streams", connected: true, refresh: true }
+            : { error: "connect your nixamp account first", connected: false });
         return true;
     }
     try {
         json(response, 200, { servers: await streamsFor(token, options.issuer, options.issuer, options.fetcher ?? fetch) });
     }
     catch (error) {
+        if (error instanceof StaleToken)
+            options.links.drop(account.id);
         json(response, 502, { error: error.message });
     }
     return true;

package/dist/nixamp-link-types.d.ts

@@ -5,6 +5,8 @@
 /** The connection as the account holder sees it. Never the tokens. */
 export interface LinkView {
     connected: boolean;
+    /** A token is in memory right now, so the streams can be read without asking nixamp.com again. */
+    ready: boolean;
     handle: string;
     nixampUserId: string;
     scope: string;

package/dist/nixamp-link.d.ts

@@ -1,8 +1,11 @@
 import type { Queryable } from "./follows.ts";
 import type { LinkView } from "./nixamp-link-types.ts";
 export type { LinkView } from "./nixamp-link-types.ts";
-/** What the school asks nixamp for: who you are, your servers, and to keep it. */
-export declare const LINK_SCOPE = "profile streams offline_access";
+/**
+ * What the school asks nixamp for: who you are and your servers. Not
+ * offline_access: a refresh token would have to be kept somewhere.
+ */
+export declare const LINK_SCOPE = "profile streams";
 export interface TokenGrant {
     access_token: string;
     refresh_token?: string;
@@ -32,10 +35,19 @@ export declare class NixampLinks {
     /** How nixamp.com and the servers it lists are reached, for what the tokens are used on. */
     readonly fetcher: typeof fetch;
     private ready;
+    /** Access tokens, in memory only, until they end. Never in the database. */
+    private readonly live;
     constructor(db: Queryable, exchange: OAuthExchange, clientId: string, now?: () => number, 
     /** How nixamp.com and the servers it lists are reached, for what the tokens are used on. */
     fetcher?: typeof fetch);
     private ensure;
+    /**
+     * Before 0.79 the tokens were kept in this table in plain text. Hand each
+     * refresh token back to nixamp.com (so no grant is left standing there),
+     * then drop the columns. The identity link stays; the person clicks
+     * "Refresh from nixamp" the next time they go live.
+     */
+    private forgetLegacyTokens;
     /**
      * The first leg: where to send the browser, and the two secrets the
      * callback must bring back. The state is the CSRF check, the verifier is
@@ -46,21 +58,22 @@ export declare class NixampLinks {
         state: string;
         verifier: string;
     };
-    /** The second leg: the code becomes tokens, the tokens say whose, and that is kept. */
+    /** The second leg: the code becomes a token, the token says whose; who is kept, the token only in memory. */
     finish(userId: string, leg: {
         code: string;
         verifier: string;
         redirectUri: string;
     }): Promise<LinkView>;
-    private expiry;
     of(userId: string): Promise<LinkView>;
+    private held;
     /**
-     * A token good for a call right now, refreshed when the one kept is about
-     * to end. "" when there is no connection, or the refresh was refused --
-     * which is what a grant withdrawn on nixamp.com looks like from here, and
-     * the row is dropped so the settings page says so too.
+     * A token good for a call right now, or "" when there is none in memory:
+     * not connected, expired, or the server restarted since. The page then
+     * offers "Refresh from nixamp".
      */
     accessToken(userId: string): Promise<string>;
-    /** Withdraw the grant on nixamp.com and forget it here. True when there was one. */
+    /** nixamp.com refused the token: forget it, so the page asks again. */
+    drop(userId: string): void;
+    /** Withdraw the token on nixamp.com and forget the connection here. True when there was one. */
     disconnect(userId: string): Promise<boolean>;
 }

package/dist/nixamp-link.js

@@ -9,11 +9,17 @@
  * broadcast backend a host may plug in, and plugging it in is a choice.
  *
  * So the school is an OAuth 2.1 client of nixamp.com, the way bittorrented
- * is: PKCE, a consent page on nixamp.com, a refresh token kept here against
- * the school account, and a grant the person can withdraw from either side.
- * What the connection buys is the list of the servers they run on nixamp and
- * what is live on them, so "go live" is a pick from a list rather than a
- * link pasted from a terminal.
+ * is: PKCE and a consent page on nixamp.com. What the connection buys is the
+ * list of the servers they run on nixamp and what is live on them, so "go
+ * live" is a pick from a list rather than a link pasted from a terminal.
+ *
+ * No token is kept at rest (fleet rule, 2026-10-28: nothing a user gave us
+ * may be readable by root on the box). The row here is the identity link
+ * only: which nixamp account, as which handle. The access token lives in
+ * this process's memory until it expires (an hour) and is never written to
+ * the database; no refresh token is asked for. When it is gone (expired, or
+ * the server restarted) the person, who is present to go live, clicks
+ * "Refresh from nixamp" and says yes once more on nixamp.com.
  *
  * The client half of OAuth is behind an interface, because the server on the
  * other end is this same program in production and a stub in a test.
@@ -27,18 +33,18 @@ const SCHEMA = `
     nixamp_user_id    TEXT NOT NULL,
     handle            TEXT NOT NULL DEFAULT '',
     scope             TEXT NOT NULL DEFAULT '',
-    access_token      TEXT NOT NULL DEFAULT '',
-    access_expires_at TIMESTAMPTZ,
-    refresh_token     TEXT NOT NULL DEFAULT '',
     created_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
     updated_at        TIMESTAMPTZ NOT NULL DEFAULT NOW()
   );
 `;
-/** What the school asks nixamp for: who you are, your servers, and to keep it. */
-export const LINK_SCOPE = "profile streams offline_access";
+/**
+ * What the school asks nixamp for: who you are and your servers. Not
+ * offline_access: a refresh token would have to be kept somewhere.
+ */
+export const LINK_SCOPE = "profile streams";
 /** How long before an access token's end it is treated as spent. */
 const EARLY_MS = 60_000;
-export const NOT_CONNECTED = { connected: false, handle: "", nixampUserId: "", scope: "", since: null };
+export const NOT_CONNECTED = { connected: false, ready: false, handle: "", nixampUserId: "", scope: "", since: null };
 /** The real thing: nixamp.com over HTTP. */
 export function nixampExchange(issuer, clientId, fetcher = fetch) {
     const base = issuer.replace(/\/+$/, "");
@@ -109,11 +115,12 @@ function asTime(value) {
     }
     return null;
 }
-function view(row) {
+function view(row, ready) {
     if (!row)
         return { ...NOT_CONNECTED };
     return {
         connected: true,
+        ready,
         handle: String(row["handle"] ?? ""),
         nixampUserId: String(row["nixamp_user_id"] ?? ""),
         scope: String(row["scope"] ?? ""),
@@ -127,6 +134,8 @@ export class NixampLinks {
     now;
     fetcher;
     ready = null;
+    /** Access tokens, in memory only, until they end. Never in the database. */
+    live = new Map();
     constructor(db, exchange, clientId, now = () => Date.now(), 
     /** How nixamp.com and the servers it lists are reached, for what the tokens are used on. */
     fetcher = fetch) {
@@ -137,9 +146,28 @@ export class NixampLinks {
         this.fetcher = fetcher;
     }
     async ensure() {
-        this.ready ??= this.db.query(SCHEMA).then(() => undefined);
+        this.ready ??= this.db.query(SCHEMA).then(() => this.forgetLegacyTokens());
         await this.ready;
     }
+    /**
+     * Before 0.79 the tokens were kept in this table in plain text. Hand each
+     * refresh token back to nixamp.com (so no grant is left standing there),
+     * then drop the columns. The identity link stays; the person clicks
+     * "Refresh from nixamp" the next time they go live.
+     */
+    async forgetLegacyTokens() {
+        const { rows: columns } = await this.db.query(`SELECT column_name FROM information_schema.columns
+        WHERE table_schema = current_schema() AND table_name = '${TABLE}' AND column_name IN ('access_token', 'refresh_token', 'access_expires_at')`);
+        if (columns.length === 0)
+            return;
+        const names = new Set(columns.map((row) => String(row["column_name"])));
+        if (names.has("refresh_token")) {
+            const { rows } = await this.db.query(`SELECT refresh_token FROM ${TABLE} WHERE refresh_token <> ''`);
+            for (const row of rows)
+                await this.exchange.revoke(String(row["refresh_token"] ?? "")).catch(() => undefined);
+        }
+        await this.db.query(`ALTER TABLE ${TABLE} DROP COLUMN IF EXISTS access_token, DROP COLUMN IF EXISTS refresh_token, DROP COLUMN IF EXISTS access_expires_at`);
+    }
     /**
      * The first leg: where to send the browser, and the two secrets the
      * callback must bring back. The state is the CSRF check, the verifier is
@@ -159,7 +187,7 @@ export class NixampLinks {
         });
         return { url, state, verifier };
     }
-    /** The second leg: the code becomes tokens, the tokens say whose, and that is kept. */
+    /** The second leg: the code becomes a token, the token says whose; who is kept, the token only in memory. */
     async finish(userId, leg) {
         const grant = await this.exchange.token(new URLSearchParams({
             grant_type: "authorization_code",
@@ -167,65 +195,54 @@ export class NixampLinks {
             code_verifier: leg.verifier,
             redirect_uri: leg.redirectUri,
         }));
+        // Asked for none, but a refresh token sent anyway is handed straight back.
+        if (grant.refresh_token)
+            await this.exchange.revoke(grant.refresh_token).catch(() => undefined);
         const who = await this.exchange.userinfo(grant.access_token);
         await this.ensure();
-        await this.db.query(`INSERT INTO ${TABLE} (user_id, nixamp_user_id, handle, scope, access_token, access_expires_at, refresh_token)
-       VALUES ($1, $2, $3, $4, $5, $6, $7)
+        await this.db.query(`INSERT INTO ${TABLE} (user_id, nixamp_user_id, handle, scope)
+       VALUES ($1, $2, $3, $4)
        ON CONFLICT (user_id) DO UPDATE SET nixamp_user_id = EXCLUDED.nixamp_user_id, handle = EXCLUDED.handle,
-         scope = EXCLUDED.scope, access_token = EXCLUDED.access_token, access_expires_at = EXCLUDED.access_expires_at,
-         refresh_token = EXCLUDED.refresh_token, updated_at = NOW()`, [userId, who.sub, who.handle ?? "", grant.scope ?? LINK_SCOPE, grant.access_token, this.expiry(grant), grant.refresh_token ?? ""]);
-        return this.of(userId);
-    }
-    expiry(grant) {
+         scope = EXCLUDED.scope, updated_at = NOW()`, [userId, who.sub, who.handle ?? "", grant.scope ?? LINK_SCOPE]);
         const seconds = typeof grant.expires_in === "number" && grant.expires_in > 0 ? grant.expires_in : 3600;
-        return new Date(this.now() + seconds * 1000);
+        this.live.set(userId, { token: grant.access_token, until: this.now() + seconds * 1000 });
+        return this.of(userId);
     }
     async of(userId) {
         await this.ensure();
         const { rows } = await this.db.query(`SELECT nixamp_user_id, handle, scope, created_at FROM ${TABLE} WHERE user_id = $1`, [userId]);
-        return view(rows[0]);
+        return view(rows[0], rows[0] !== undefined && this.held(userId) !== "");
+    }
+    held(userId) {
+        const kept = this.live.get(userId);
+        if (!kept)
+            return "";
+        if (kept.until - this.now() > EARLY_MS)
+            return kept.token;
+        this.live.delete(userId);
+        return "";
     }
     /**
-     * A token good for a call right now, refreshed when the one kept is about
-     * to end. "" when there is no connection, or the refresh was refused --
-     * which is what a grant withdrawn on nixamp.com looks like from here, and
-     * the row is dropped so the settings page says so too.
+     * A token good for a call right now, or "" when there is none in memory:
+     * not connected, expired, or the server restarted since. The page then
+     * offers "Refresh from nixamp".
      */
     async accessToken(userId) {
         await this.ensure();
-        const { rows } = await this.db.query(`SELECT access_token, access_expires_at, refresh_token FROM ${TABLE} WHERE user_id = $1`, [userId]);
-        const row = rows[0];
-        if (!row)
-            return "";
-        const access = String(row["access_token"] ?? "");
-        const until = asTime(row["access_expires_at"]);
-        if (access !== "" && until !== null && until - this.now() > EARLY_MS)
-            return access;
-        const refresh = String(row["refresh_token"] ?? "");
-        if (refresh === "")
-            return "";
-        let grant;
-        try {
-            grant = await this.exchange.token(new URLSearchParams({ grant_type: "refresh_token", refresh_token: refresh }));
-        }
-        catch {
-            await this.db.query(`DELETE FROM ${TABLE} WHERE user_id = $1`, [userId]);
-            return "";
-        }
-        await this.db.query(`UPDATE ${TABLE} SET access_token = $2, access_expires_at = $3, refresh_token = $4, updated_at = NOW() WHERE user_id = $1`, [userId, grant.access_token, this.expiry(grant), grant.refresh_token ?? refresh]);
-        return grant.access_token;
+        return this.held(userId);
+    }
+    /** nixamp.com refused the token: forget it, so the page asks again. */
+    drop(userId) {
+        this.live.delete(userId);
     }
-    /** Withdraw the grant on nixamp.com and forget it here. True when there was one. */
+    /** Withdraw the token on nixamp.com and forget the connection here. True when there was one. */
     async disconnect(userId) {
         await this.ensure();
-        const { rows } = await this.db.query(`SELECT refresh_token, access_token FROM ${TABLE} WHERE user_id = $1`, [userId]);
-        const row = rows[0];
-        if (!row)
-            return false;
-        const refresh = String(row["refresh_token"] ?? "");
-        const access = String(row["access_token"] ?? "");
-        await this.exchange.revoke(refresh !== "" ? refresh : access);
-        await this.db.query(`DELETE FROM ${TABLE} WHERE user_id = $1`, [userId]);
-        return true;
+        const token = this.held(userId);
+        this.live.delete(userId);
+        if (token !== "")
+            await this.exchange.revoke(token).catch(() => undefined);
+        const { rows } = await this.db.query(`DELETE FROM ${TABLE} WHERE user_id = $1 RETURNING user_id`, [userId]);
+        return rows.length > 0;
     }
 }

package/dist/oauth.d.ts

@@ -27,6 +27,7 @@ export interface Identity {
      * to an existing account and is never the new account's address.
      */
     verified?: boolean;
+    openprofileUrl?: string;
 }
 /**
  * CoinPay (coinpayportal.com), the house identity: OAuth 2.1, authorization

package/dist/oauth.js

@@ -41,7 +41,14 @@ export function coinpayProvider(clientId, clientSecret, base = "https://coinpayp
             // Never verified, whatever the answer says: CoinPay sends no mail to the
             // address it reports, so anybody can register a CoinPay account under
             // someone else's address. Its `sub` is the whole identity.
-            return { provider: "coinpay", subject, email, verified: false };
+            return {
+                provider: "coinpay",
+                subject,
+                email,
+                verified: false,
+                // Only when CoinPay names one: an absent field stays absent, not `undefined`.
+                ...(typeof who["openprofile_url"] === "string" ? { openprofileUrl: who["openprofile_url"] } : {}),
+            };
         },
     };
 }

package/dist/profiles.d.ts

@@ -22,7 +22,7 @@ export interface HostCard {
     avatarUrl: string;
 }
 export declare const EMPTY_PROFILE: Profile;
-/** A photo is a picture, not a document: a megabyte is plenty for a face. */
+/** A photo straight off a phone camera runs several megabytes; ten covers it. */
 export declare const PHOTO_LIMIT: number;
 export declare const NAME_LIMIT = 100;
 export declare const BIO_LIMIT = 1000;