nixamp 0.78.6 → 0.80.1

package/src/ai-text.ts

@@ -3,11 +3,12 @@
  *
  * AI radio asks for small things: a title and a prompt for the next track, a
  * genre and a verdict for a shared file. Whichever model has a key answers --
- * Gemini, then OpenAI, then Anthropic -- and when none has, the caller is told
- * so and does without (a rule of its own, or a person). The answer is parsed
- * and handed back as an object; a model that rambles round its JSON is read
- * for the first object in what it said.
+ * c0mpute, then Gemini, then OpenAI, then Anthropic -- and when none has, the
+ * caller is told so and does without (a rule of its own, or a person). The
+ * answer is parsed and handed back as an object; a model that rambles round
+ * its JSON is read for the first object in what it said.
  */
+import { ProviderError, createAiProviders, type AiRouter } from "@profullstack/ai-providers";
 import { aiKey } from "./ai-keys.ts";
 
 export interface AskOptions {
@@ -15,7 +16,7 @@ export interface AskOptions {
   system: string;
   /** The question, with what it should answer from. */
   prompt: string;
-  /** Milliseconds before giving up (default 30 s). */
+  /** Milliseconds before giving up on a hosted model (default 30 s); c0mpute gets at least C0MPUTE_MIN_WAIT_MS. */
   timeoutMs?: number;
   /** The longest answer, in tokens (default 1024): a song's words need more than a title does. */
   maxTokens?: number;
@@ -33,7 +34,7 @@ export interface Answer {
 
 export class NoModel extends Error {
   constructor() {
-    super("no language model key is set (GEMINI_API_KEY, OPENAI_API_KEY or ANTHROPIC_API_KEY)");
+    super("no language model key is set (C0MPUTE_API_KEY, GEMINI_API_KEY, OPENAI_API_KEY or ANTHROPIC_API_KEY)");
   }
 }
 
@@ -61,7 +62,7 @@ export function escapeInStrings(text: string): string {
 
 /** The first JSON object in a model's answer. */
 export function firstObject(text: string): Record<string, unknown> {
-  const fenced = text.replace(/^```(?:json)?\s*/i, "").replace(/```\s*$/, "");
+  const fenced = text.replace(/<think>[\s\S]*?<\/think>/gi, "").trim().replace(/^```(?:json)?\s*/i, "").replace(/```\s*$/, "");
   const cleaned = (() => {
     try { JSON.parse(fenced); return fenced; } catch { return escapeInStrings(fenced); }
   })();
@@ -80,14 +81,79 @@ export function firstObject(text: string): Record<string, unknown> {
   throw new Error("the model did not answer with a JSON object");
 }
 
+/** The c0mpute key, or "" when there is none or C0MPUTE_DISABLED turns it off. */
+export function c0mputeKey(env: Record<string, string | undefined> = process.env): string {
+  return /^(1|true|yes|on)$/i.test(env["C0MPUTE_DISABLED"] ?? "") ? "" : aiKey("C0MPUTE_API_KEY", env);
+}
+
 /** Whether any model can be asked. */
 export function hasModel(env: Record<string, string | undefined> = process.env): boolean {
-  return Boolean(aiKey("GEMINI_API_KEY", env) || aiKey("OPENAI_API_KEY", env) || aiKey("ANTHROPIC_API_KEY", env));
+  return Boolean(c0mputeKey(env) || aiKey("GEMINI_API_KEY", env) || aiKey("OPENAI_API_KEY", env) || aiKey("ANTHROPIC_API_KEY", env));
+}
+
+/**
+ * c0mpute's 9B model takes 30 s for a short JSON answer, longer on a busy
+ * node, so it never gets a hosted model's 30 s budget.
+ */
+export const C0MPUTE_MIN_WAIT_MS = 120_000;
+
+/** c0mpute alone: the fallbacks are this file's own chain, not the package's. */
+export function c0mputeRouter(key: string, options: { env?: Record<string, string | undefined>; fetcher?: typeof fetch; concurrency?: number } = {}): AiRouter {
+  return createAiProviders({
+    env: { ...(options.env ?? process.env), C0MPUTE_API_KEY: key },
+    paidFallback: false,
+    c0mpute: {
+      ...(options.fetcher ? { fetch: options.fetcher } : {}),
+      ...(options.concurrency ? { concurrency: options.concurrency } : {}),
+    },
+  });
+}
+
+export interface C0mputeAsk {
+  system: string;
+  user: string;
+  maxTokens: number;
+  timeoutMs: number;
+  temperature?: number;
+  signal?: AbortSignal;
+}
+
+/**
+ * One answer from c0mpute, read by `read`. An answer `read` refuses gets one
+ * more try on the same model, told what was wrong with it, before the caller
+ * moves on: a small model misses far more often than a hosted one.
+ */
+export async function askC0mpute<T>(router: AiRouter, ask: C0mputeAsk, read: (text: string) => T): Promise<{ model: string; value: T }> {
+  const { value } = await router.run(async (provider) => {
+    const first = await provider.generate(ask);
+    try {
+      return { model: first.model, value: read(first.text) };
+    } catch (error) {
+      const again = await provider.generate({
+        ...ask,
+        user: `${ask.user}\n\nYour previous answer could not be used: ${(error as Error).message}\nAnswer again with only the corrected JSON object.`,
+      });
+      try {
+        return { model: again.model, value: read(again.text) };
+      } catch (second) {
+        throw new ProviderError("c0mpute", (second as Error).message, { kind: "output" });
+      }
+    }
+  });
+  return value;
+}
+
+/** The router askJson shares across calls, so a dead or busy c0mpute is parked for all of them. */
+let shared: { key: string; router: AiRouter } | undefined;
+function sharedRouter(key: string, env: Record<string, string | undefined>): AiRouter {
+  if (shared?.key !== key) shared = { key, router: c0mputeRouter(key, { env }) };
+  return shared.router;
 }
 
 export async function askJson(options: AskOptions): Promise<Answer> {
   const env = options.env ?? process.env;
   const send = options.fetcher ?? fetch;
+  const c0mpute = c0mputeKey(env);
   const gemini = aiKey("GEMINI_API_KEY", env);
   const openai = aiKey("OPENAI_API_KEY", env);
   const anthropic = aiKey("ANTHROPIC_API_KEY", env);
@@ -95,6 +161,16 @@ export async function askJson(options: AskOptions): Promise<Answer> {
   // answers 400 "User location is not supported" from some networks) or is
   // down is not a reason to go without when another can answer.
   const tries: Array<() => Promise<Answer>> = [];
+  if (c0mpute) tries.push(() => askC0mpute(
+    options.fetcher ? c0mputeRouter(c0mpute, { env, fetcher: options.fetcher }) : sharedRouter(c0mpute, env),
+    {
+      system: `${options.system}\nAnswer with one JSON object and nothing else.`,
+      user: options.prompt,
+      maxTokens: options.maxTokens ?? 1024,
+      timeoutMs: Math.max(options.timeoutMs ?? 0, C0MPUTE_MIN_WAIT_MS),
+    },
+    firstObject,
+  ));
   if (gemini) tries.push(async () => {
     const model = env["NIXAMP_GEMINI_MODEL"] || "gemini-flash-latest";
     const response = await send(`https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent`, {

package/src/event-writer.ts

@@ -1,10 +1,13 @@
+import { jsonInstructions, type AiRouter } from "@profullstack/ai-providers";
+import { askC0mpute, c0mputeRouter, C0MPUTE_MIN_WAIT_MS, firstObject } from "./ai-text.ts";
 import { Guard } from "./guard.ts";
 
 export interface EventDraft { title: string; description: string; topic: string }
 export interface WriterInput extends EventDraft {
   hostName: string; startsAt: string; timezone: string; duration: string; recurrence: string;
 }
-export interface EventDraftResult { draft: EventDraft; provider: "openai" | "claude" }
+type Provider = "c0mpute" | "openai" | "claude";
+export interface EventDraftResult { draft: EventDraft; provider: Provider }
 export class EventWriterError extends Error {
   constructor(message: string, readonly status: number, readonly retryAfter?: number) { super(message); }
 }
@@ -37,8 +40,7 @@ Write in the language of the host's notes. Describe what students will learn and
 Keep concrete names and facts. Do not invent dates, prices, qualifications, prerequisites, links, credentials, or promises. Omit unknown logistics. Do not expand into unrelated subjects.
 The schedule and host name are context only; never propose changing them. Return plain text in the required JSON fields, with no HTML. Short paragraphs or simple bullet lists are fine.`;
 
-function draftFrom(text: string): EventDraft {
-  const value: unknown = JSON.parse(text);
+function draftOf(value: unknown): EventDraft {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid draft");
   const row = value as Record<string, unknown>;
   const draft = {} as EventDraft;
@@ -51,34 +53,46 @@ function draftFrom(text: string): EventDraft {
 }
 
 export interface EventWriterOptions {
-  openaiKey?: string; anthropicKey?: string;
+  c0mputeKey?: string; openaiKey?: string; anthropicKey?: string;
   openaiModel?: string; claudeModel?: string;
   fetch?: typeof globalThis.fetch;
+  /** Per hosted provider (default 25 s). */
   timeoutMs?: number;
+  /** For c0mpute, which needs longer (default C0MPUTE_MIN_WAIT_MS). */
+  c0mputeTimeoutMs?: number;
 }
 
 /** Server-side only. Drafting has no access to the event store and cannot publish. */
 export class EventWriter {
   private readonly guard = new Guard();
   private readonly active = new Set<string>();
-  constructor(private readonly options: EventWriterOptions) {}
+  // Its own router: a cancelled draft must not park c0mpute for AI radio, and
+  // a draft someone is waiting for must not queue behind a label's album.
+  private readonly c0mpute?: AiRouter;
+  constructor(private readonly options: EventWriterOptions) {
+    if (options.c0mputeKey) this.c0mpute = c0mputeRouter(options.c0mputeKey, { concurrency: 4, ...(options.fetch ? { fetcher: options.fetch } : {}) });
+  }
+
+  private key(provider: Exclude<Provider, "c0mpute">): string | undefined {
+    return provider === "openai" ? this.options.openaiKey : this.options.anthropicKey;
+  }
 
   async draft(accountId: string, value: unknown, signal?: AbortSignal): Promise<EventDraftResult> {
     if (!accountId) throw new EventWriterError("Sign in to use the AI writer.", 401);
     const input = writerInput(value);
-    if (!this.options.openaiKey && !this.options.anthropicKey) throw new EventWriterError("The AI writer is temporarily unavailable. You can keep writing here.", 503);
+    if (!this.c0mpute && !this.options.openaiKey && !this.options.anthropicKey) throw new EventWriterError("The AI writer is temporarily unavailable. You can keep writing here.", 503);
     if (this.active.has(accountId)) throw new EventWriterError("A draft is already being written. Wait for it or cancel it first.", 429, 5);
     if (this.active.size >= 4) throw new EventWriterError("The AI writer is busy. Try again in a moment.", 503, 10);
     const limit = this.guard.check(accountId, {allowed: 6, windowMs: 10 * 60_000});
     if (!limit.ok) throw new EventWriterError("You have requested several drafts. Try again in a few minutes.", 429, limit.retryAfter);
     this.active.add(accountId);
     try {
-      for (const provider of ["openai", "claude"] as const) {
-        const key = provider === "openai" ? this.options.openaiKey : this.options.anthropicKey;
-        if (!key) continue;
+      for (const provider of ["c0mpute", "openai", "claude"] as const) {
+        const key = provider === "c0mpute" ? "" : this.key(provider);
+        if (provider === "c0mpute" ? !this.c0mpute : !key) continue;
         if (signal?.aborted) throw new EventWriterError("Draft cancelled.", 499);
         try {
-          const draft = await this.generate(provider, key, input, signal);
+          const draft = provider === "c0mpute" ? await this.generateC0mpute(input, signal) : await this.generate(provider, key as string, input, signal);
           if (signal?.aborted) throw new EventWriterError("Draft cancelled.", 499);
           return {draft, provider};
         }
@@ -94,6 +108,17 @@ export class EventWriter {
     } finally { this.active.delete(accountId); }
   }
 
+  private async generateC0mpute(input: WriterInput, signal?: AbortSignal): Promise<EventDraft> {
+    const {value} = await askC0mpute(this.c0mpute as AiRouter, {
+      system: `${INSTRUCTIONS}\n\n${jsonInstructions("event_draft", SCHEMA)}`,
+      user: JSON.stringify(input),
+      maxTokens: 2048,
+      timeoutMs: this.options.c0mputeTimeoutMs ?? C0MPUTE_MIN_WAIT_MS,
+      ...(signal ? {signal} : {}),
+    }, text => draftOf(firstObject(text)));
+    return value;
+  }
+
   private async generate(provider: "openai" | "claude", key: string, input: WriterInput, signal?: AbortSignal): Promise<EventDraft> {
     const timeout = AbortSignal.timeout(this.options.timeoutMs ?? 25_000);
     const requestSignal = signal ? AbortSignal.any([signal, timeout]) : timeout;
@@ -121,6 +146,6 @@ export class EventWriter {
     if (body["stop_reason"] === "refusal" || blocks.some(block => block?.type === "refusal")) throw new Refused();
     if (openai ? body["status"] !== "completed" : body["stop_reason"] !== "end_turn") throw new Error("incomplete draft");
     const text = blocks.filter(block => block?.type === (openai ? "output_text" : "text")).map(block => typeof block.text === "string" ? block.text : "").join("");
-    return draftFrom(text);
+    return draftOf(JSON.parse(text));
   }
 }

package/src/label-routes.ts

@@ -202,6 +202,15 @@ export async function handleLabelRoutes(
       ctx.json(response, 202, label.status());
       return true;
     }
+    if (path === "/api/v1/stations/label/adopt" && method === "POST") {
+      // Albums already on disk (copied from another server) back on the label, with their old keys where given.
+      const input = await jsonBody(ctx, request);
+      const record = (value: unknown): Record<string, string> => value && typeof value === "object" && !Array.isArray(value)
+        ? Object.fromEntries(Object.entries(value as Record<string, unknown>).filter(([, one]) => typeof one === "string")) as Record<string, string>
+        : {};
+      ctx.json(response, 200, { adopted: await label.adopt({ keys: record(input["keys"]), albums: record(input["albums"]), enabled: input["enabled"] !== false }) });
+      return true;
+    }
     if (path === "/api/v1/stations/label/artists" && method === "POST") {
       const input = await jsonBody(ctx, request);
       if (input["roster"] === true) {

package/src/music-hub.ts

@@ -45,6 +45,21 @@ export interface MusicHubOptions {
   peers: () => string[];
   fetcher?: typeof fetch;
   now?: () => number;
+  /**
+   * Label servers that moved, old https origin to new (a box gone, its label adopted
+   * on another): /music addresses under the old origin's id go to the new one's.
+   */
+  moved?: Record<string, string>;
+}
+
+/** NIXAMP_MUSIC_MOVED: "https://old:4321>https://new:4321", several separated by commas. */
+export function parseMoved(text: string | undefined): Record<string, string> {
+  const moved: Record<string, string> = {};
+  for (const pair of (text ?? "").split(",")) {
+    const [from, to] = pair.split(">").map((one) => one.trim().replace(/\/+$/, ""));
+    if (from && to && /^https?:\/\//.test(from) && /^https?:\/\//.test(to) && from !== to) moved[from] = to;
+  }
+  return moved;
 }
 
 export class MusicHub {
@@ -60,10 +75,22 @@ export class MusicHub {
   /** The https origin behind an opaque id, among the servers known now. */
   resolve(id: string): string {
     if (!/^[a-f0-9]{10}$/.test(id)) return "";
-    if (!this.bases.has(id)) for (const base of this.options.peers()) this.bases.set(serverId(base), base);
+    if (!this.bases.has(id)) for (const base of this.peers()) this.bases.set(serverId(base), base);
     return this.bases.get(id) ?? "";
   }
 
+  /** The servers to gather, less any that moved (the same label would be listed twice). */
+  private peers(): string[] {
+    const moved = this.options.moved ?? {};
+    return this.options.peers().filter((base) => !moved[base.replace(/\/+$/, "")]);
+  }
+
+  /** The id a moved server goes by now, or "" when this id never moved. */
+  movedTo(id: string): string {
+    for (const [from, to] of Object.entries(this.options.moved ?? {})) if (serverId(from) === id) return serverId(to);
+    return "";
+  }
+
   /** The catalogue, gathered at most once a minute (a slow or gone server is left out, not waited on). */
   catalogue(): Promise<HubCatalogue> {
     if (this.cache && this.now() - this.cache.at < 60_000) return this.cache.value;
@@ -85,7 +112,7 @@ export class MusicHub {
   }
 
   private async gather(): Promise<HubCatalogue> {
-    const peers = [...new Set(this.options.peers())];
+    const peers = [...new Set(this.peers())];
     const holders = new Set<string>();
     const genres = new Map<string, { genre: string; stations: HubStation[]; artists: HubArtist[] }>();
     const stations: HubStation[] = [];
@@ -192,6 +219,15 @@ export async function handleMusicRoutes(request: IncomingMessage, response: Serv
     return true;
   }
   if (method !== "GET" && method !== "HEAD") { ctx.json(response, 405, { error: "not like that" }); return true; }
+  // A label that moved to another server: its old addresses (shared links, search results) go to the new ones.
+  const old = /^(\/music\/(?:artist|album|member)\/|\/api\/v1\/music\/(?:file|member)\/)([a-f0-9]{10})(\/.*)$/.exec(path);
+  const now = old ? ctx.hub.movedTo?.(old[2]!) ?? "" : "";
+  if (old && now) {
+    const query = (request.url ?? "").includes("?") ? (request.url ?? "").slice((request.url ?? "").indexOf("?")) : "";
+    response.writeHead(301, { location: `${old[1]}${now}${old[3]}${query}`, "cache-control": "public, max-age=86400" });
+    response.end();
+    return true;
+  }
   if (path === "/api/v1/music") {
     ctx.json(response, 200, await ctx.hub.catalogue());
     return true;

package/src/nixamp-link-api.ts

@@ -10,7 +10,8 @@
  *
  * All five want the site's own session: the person, signed in here. What
  * they hold on nixamp's side is a client token, and it never leaves the
- * server -- the page only ever learns a handle and a list of streams.
+ * server -- the page only ever learns a handle and a list of streams. The
+ * token is kept in memory only, for its hour; never in the database.
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { tokenFrom, type Accounts } from "./accounts.ts";
@@ -77,6 +78,9 @@ function landing(home: string, outcome: string, reason = ""): string {
   return `${url.pathname}${url.search}${url.hash || "#settings"}`;
 }
 
+/** nixamp.com refused the token held in memory. */
+export class StaleToken extends Error {}
+
 /**
  * Every server the nixamp account remembers, asked what it is doing.
  *
@@ -92,7 +96,8 @@ export async function streamsFor(token: string, issuer: string, pageSite: string
     headers: { authorization: `Bearer ${token}`, accept: "application/json" },
     signal: AbortSignal.timeout(8000),
   });
-  if (!answer.ok) throw new Error(answer.status === 401 ? "nixamp.com no longer accepts this connection" : `nixamp.com answered ${answer.status}`);
+  if (answer.status === 401) throw new StaleToken("nixamp.com no longer accepts this connection; refresh from nixamp");
+  if (!answer.ok) throw new Error(`nixamp.com answered ${answer.status}`);
   const body = (await answer.json().catch(() => ({}))) as { servers?: typeof servers };
   servers = Array.isArray(body.servers) ? body.servers : [];
   const page = pageSite.replace(/\/+$/, "");
@@ -210,10 +215,17 @@ export async function handleNixampLinkApi(
   // /api/v1/nixamp/streams
   if (request.method !== "GET") { json(response, 405, { error: "GET only" }); return true; }
   const token = await options.links.accessToken(account.id);
-  if (token === "") { json(response, 409, { error: "connect your nixamp account first", connected: false }); return true; }
+  if (token === "") {
+    const { connected } = await options.links.of(account.id);
+    json(response, 409, connected
+      ? { error: "refresh from nixamp to see your streams", connected: true, refresh: true }
+      : { error: "connect your nixamp account first", connected: false });
+    return true;
+  }
   try {
     json(response, 200, { servers: await streamsFor(token, options.issuer, options.issuer, options.fetcher ?? fetch) });
   } catch (error) {
+    if (error instanceof StaleToken) options.links.drop(account.id);
     json(response, 502, { error: (error as Error).message });
   }
   return true;

package/src/nixamp-link-types.ts

@@ -6,6 +6,8 @@
 /** The connection as the account holder sees it. Never the tokens. */
 export interface LinkView {
   connected: boolean;
+  /** A token is in memory right now, so the streams can be read without asking nixamp.com again. */
+  ready: boolean;
   handle: string;
   nixampUserId: string;
   scope: string;

package/src/nixamp-link.ts

@@ -9,11 +9,17 @@
  * broadcast backend a host may plug in, and plugging it in is a choice.
  *
  * So the school is an OAuth 2.1 client of nixamp.com, the way bittorrented
- * is: PKCE, a consent page on nixamp.com, a refresh token kept here against
- * the school account, and a grant the person can withdraw from either side.
- * What the connection buys is the list of the servers they run on nixamp and
- * what is live on them, so "go live" is a pick from a list rather than a
- * link pasted from a terminal.
+ * is: PKCE and a consent page on nixamp.com. What the connection buys is the
+ * list of the servers they run on nixamp and what is live on them, so "go
+ * live" is a pick from a list rather than a link pasted from a terminal.
+ *
+ * No token is kept at rest (fleet rule, 2026-10-28: nothing a user gave us
+ * may be readable by root on the box). The row here is the identity link
+ * only: which nixamp account, as which handle. The access token lives in
+ * this process's memory until it expires (an hour) and is never written to
+ * the database; no refresh token is asked for. When it is gone (expired, or
+ * the server restarted) the person, who is present to go live, clicks
+ * "Refresh from nixamp" and says yes once more on nixamp.com.
  *
  * The client half of OAuth is behind an interface, because the server on the
  * other end is this same program in production and a stub in a test.
@@ -32,16 +38,16 @@ const SCHEMA = `
     nixamp_user_id    TEXT NOT NULL,
     handle            TEXT NOT NULL DEFAULT '',
     scope             TEXT NOT NULL DEFAULT '',
-    access_token      TEXT NOT NULL DEFAULT '',
-    access_expires_at TIMESTAMPTZ,
-    refresh_token     TEXT NOT NULL DEFAULT '',
     created_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
     updated_at        TIMESTAMPTZ NOT NULL DEFAULT NOW()
   );
 `;
 
-/** What the school asks nixamp for: who you are, your servers, and to keep it. */
-export const LINK_SCOPE = "profile streams offline_access";
+/**
+ * What the school asks nixamp for: who you are and your servers. Not
+ * offline_access: a refresh token would have to be kept somewhere.
+ */
+export const LINK_SCOPE = "profile streams";
 
 /** How long before an access token's end it is treated as spent. */
 const EARLY_MS = 60_000;
@@ -67,7 +73,7 @@ export interface OAuthExchange {
   revoke(token: string): Promise<void>;
 }
 
-export const NOT_CONNECTED: LinkView = { connected: false, handle: "", nixampUserId: "", scope: "", since: null };
+export const NOT_CONNECTED: LinkView = { connected: false, ready: false, handle: "", nixampUserId: "", scope: "", since: null };
 
 /** The real thing: nixamp.com over HTTP. */
 export function nixampExchange(issuer: string, clientId: string, fetcher: typeof fetch = fetch): OAuthExchange {
@@ -134,10 +140,11 @@ function asTime(value: unknown): number | null {
   return null;
 }
 
-function view(row: Record<string, unknown> | undefined): LinkView {
+function view(row: Record<string, unknown> | undefined, ready: boolean): LinkView {
   if (!row) return { ...NOT_CONNECTED };
   return {
     connected: true,
+    ready,
     handle: String(row["handle"] ?? ""),
     nixampUserId: String(row["nixamp_user_id"] ?? ""),
     scope: String(row["scope"] ?? ""),
@@ -147,6 +154,8 @@ function view(row: Record<string, unknown> | undefined): LinkView {
 
 export class NixampLinks {
   private ready: Promise<void> | null = null;
+  /** Access tokens, in memory only, until they end. Never in the database. */
+  private readonly live = new Map<string, { token: string; until: number }>();
 
   constructor(
     private readonly db: Queryable,
@@ -158,10 +167,32 @@ export class NixampLinks {
   ) {}
 
   private async ensure(): Promise<void> {
-    this.ready ??= this.db.query(SCHEMA).then(() => undefined);
+    this.ready ??= this.db.query(SCHEMA).then(() => this.forgetLegacyTokens());
     await this.ready;
   }
 
+  /**
+   * Before 0.79 the tokens were kept in this table in plain text. Hand each
+   * refresh token back to nixamp.com (so no grant is left standing there),
+   * then drop the columns. The identity link stays; the person clicks
+   * "Refresh from nixamp" the next time they go live.
+   */
+  private async forgetLegacyTokens(): Promise<void> {
+    const { rows: columns } = await this.db.query(
+      `SELECT column_name FROM information_schema.columns
+        WHERE table_schema = current_schema() AND table_name = '${TABLE}' AND column_name IN ('access_token', 'refresh_token', 'access_expires_at')`,
+    );
+    if (columns.length === 0) return;
+    const names = new Set(columns.map((row) => String(row["column_name"])));
+    if (names.has("refresh_token")) {
+      const { rows } = await this.db.query(`SELECT refresh_token FROM ${TABLE} WHERE refresh_token <> ''`);
+      for (const row of rows) await this.exchange.revoke(String(row["refresh_token"] ?? "")).catch(() => undefined);
+    }
+    await this.db.query(
+      `ALTER TABLE ${TABLE} DROP COLUMN IF EXISTS access_token, DROP COLUMN IF EXISTS refresh_token, DROP COLUMN IF EXISTS access_expires_at`,
+    );
+  }
+
   /**
    * The first leg: where to send the browser, and the two secrets the
    * callback must bring back. The state is the CSRF check, the verifier is
@@ -182,7 +213,7 @@ export class NixampLinks {
     return { url, state, verifier };
   }
 
-  /** The second leg: the code becomes tokens, the tokens say whose, and that is kept. */
+  /** The second leg: the code becomes a token, the token says whose; who is kept, the token only in memory. */
   async finish(userId: string, leg: { code: string; verifier: string; redirectUri: string }): Promise<LinkView> {
     const grant = await this.exchange.token(new URLSearchParams({
       grant_type: "authorization_code",
@@ -190,22 +221,20 @@ export class NixampLinks {
       code_verifier: leg.verifier,
       redirect_uri: leg.redirectUri,
     }));
+    // Asked for none, but a refresh token sent anyway is handed straight back.
+    if (grant.refresh_token) await this.exchange.revoke(grant.refresh_token).catch(() => undefined);
     const who = await this.exchange.userinfo(grant.access_token);
     await this.ensure();
     await this.db.query(
-      `INSERT INTO ${TABLE} (user_id, nixamp_user_id, handle, scope, access_token, access_expires_at, refresh_token)
-       VALUES ($1, $2, $3, $4, $5, $6, $7)
+      `INSERT INTO ${TABLE} (user_id, nixamp_user_id, handle, scope)
+       VALUES ($1, $2, $3, $4)
        ON CONFLICT (user_id) DO UPDATE SET nixamp_user_id = EXCLUDED.nixamp_user_id, handle = EXCLUDED.handle,
-         scope = EXCLUDED.scope, access_token = EXCLUDED.access_token, access_expires_at = EXCLUDED.access_expires_at,
-         refresh_token = EXCLUDED.refresh_token, updated_at = NOW()`,
-      [userId, who.sub, who.handle ?? "", grant.scope ?? LINK_SCOPE, grant.access_token, this.expiry(grant), grant.refresh_token ?? ""],
+         scope = EXCLUDED.scope, updated_at = NOW()`,
+      [userId, who.sub, who.handle ?? "", grant.scope ?? LINK_SCOPE],
     );
-    return this.of(userId);
-  }
-
-  private expiry(grant: TokenGrant): Date {
     const seconds = typeof grant.expires_in === "number" && grant.expires_in > 0 ? grant.expires_in : 3600;
-    return new Date(this.now() + seconds * 1000);
+    this.live.set(userId, { token: grant.access_token, until: this.now() + seconds * 1000 });
+    return this.of(userId);
   }
 
   async of(userId: string): Promise<LinkView> {
@@ -214,52 +243,39 @@ export class NixampLinks {
       `SELECT nixamp_user_id, handle, scope, created_at FROM ${TABLE} WHERE user_id = $1`,
       [userId],
     );
-    return view(rows[0]);
+    return view(rows[0], rows[0] !== undefined && this.held(userId) !== "");
+  }
+
+  private held(userId: string): string {
+    const kept = this.live.get(userId);
+    if (!kept) return "";
+    if (kept.until - this.now() > EARLY_MS) return kept.token;
+    this.live.delete(userId);
+    return "";
   }
 
   /**
-   * A token good for a call right now, refreshed when the one kept is about
-   * to end. "" when there is no connection, or the refresh was refused --
-   * which is what a grant withdrawn on nixamp.com looks like from here, and
-   * the row is dropped so the settings page says so too.
+   * A token good for a call right now, or "" when there is none in memory:
+   * not connected, expired, or the server restarted since. The page then
+   * offers "Refresh from nixamp".
    */
   async accessToken(userId: string): Promise<string> {
     await this.ensure();
-    const { rows } = await this.db.query(
-      `SELECT access_token, access_expires_at, refresh_token FROM ${TABLE} WHERE user_id = $1`,
-      [userId],
-    );
-    const row = rows[0];
-    if (!row) return "";
-    const access = String(row["access_token"] ?? "");
-    const until = asTime(row["access_expires_at"]);
-    if (access !== "" && until !== null && until - this.now() > EARLY_MS) return access;
-    const refresh = String(row["refresh_token"] ?? "");
-    if (refresh === "") return "";
-    let grant: TokenGrant;
-    try {
-      grant = await this.exchange.token(new URLSearchParams({ grant_type: "refresh_token", refresh_token: refresh }));
-    } catch {
-      await this.db.query(`DELETE FROM ${TABLE} WHERE user_id = $1`, [userId]);
-      return "";
-    }
-    await this.db.query(
-      `UPDATE ${TABLE} SET access_token = $2, access_expires_at = $3, refresh_token = $4, updated_at = NOW() WHERE user_id = $1`,
-      [userId, grant.access_token, this.expiry(grant), grant.refresh_token ?? refresh],
-    );
-    return grant.access_token;
+    return this.held(userId);
+  }
+
+  /** nixamp.com refused the token: forget it, so the page asks again. */
+  drop(userId: string): void {
+    this.live.delete(userId);
   }
 
-  /** Withdraw the grant on nixamp.com and forget it here. True when there was one. */
+  /** Withdraw the token on nixamp.com and forget the connection here. True when there was one. */
   async disconnect(userId: string): Promise<boolean> {
     await this.ensure();
-    const { rows } = await this.db.query(`SELECT refresh_token, access_token FROM ${TABLE} WHERE user_id = $1`, [userId]);
-    const row = rows[0];
-    if (!row) return false;
-    const refresh = String(row["refresh_token"] ?? "");
-    const access = String(row["access_token"] ?? "");
-    await this.exchange.revoke(refresh !== "" ? refresh : access);
-    await this.db.query(`DELETE FROM ${TABLE} WHERE user_id = $1`, [userId]);
-    return true;
+    const token = this.held(userId);
+    this.live.delete(userId);
+    if (token !== "") await this.exchange.revoke(token).catch(() => undefined);
+    const { rows } = await this.db.query(`DELETE FROM ${TABLE} WHERE user_id = $1 RETURNING user_id`, [userId]);
+    return rows.length > 0;
   }
 }

package/src/oauth.ts

@@ -48,6 +48,7 @@ export interface Identity {
    * to an existing account and is never the new account's address.
    */
   verified?: boolean;
+  openprofileUrl?: string;
 }
 
 /**
@@ -73,7 +74,14 @@ export function coinpayProvider(clientId: string, clientSecret: string, base = "
       // Never verified, whatever the answer says: CoinPay sends no mail to the
       // address it reports, so anybody can register a CoinPay account under
       // someone else's address. Its `sub` is the whole identity.
-      return { provider: "coinpay", subject, email, verified: false };
+      return {
+        provider: "coinpay",
+        subject,
+        email,
+        verified: false,
+        // Only when CoinPay names one: an absent field stays absent, not `undefined`.
+        ...(typeof who["openprofile_url"] === "string" ? { openprofileUrl: who["openprofile_url"] } : {}),
+      };
     },
   };
 }