nixamp 0.1.0 → 0.3.0

package/src/directory.ts

@@ -0,0 +1,135 @@
+/**
+ * The public directory.
+ *
+ * A nixamp that agrees to be listed announces itself to nixamp.com every so
+ * often and is forgotten when it stops. There is no database behind it: an
+ * entry lives for a few minutes and a heartbeat renews it, so a restart of the
+ * directory costs one heartbeat rather than a migration, and a stream that
+ * dies falls out of the list without anyone having to notice.
+ *
+ * What is published is the *listen* link. The control key never leaves the
+ * machine it was minted on.
+ */
+
+/** How long an entry survives without a heartbeat. */
+export const TTL_MS = 4 * 60 * 1000;
+/** How often a publisher renews. Comfortably inside the TTL. */
+export const HEARTBEAT_MS = 90 * 1000;
+export const DEFAULT_DIRECTORY = "https://nixamp.com";
+
+export interface Listing {
+  /** Assigned by the directory, so a publisher cannot claim someone else's. */
+  id: string;
+  name: string;
+  /** The listen link, which is what a browser opens. */
+  url: string;
+  tracks: number;
+  nowPlaying: string;
+  /** Set by the directory from the request, never by the publisher. */
+  updatedAt: number;
+}
+
+/** What a publisher sends. Everything else about a listing is ours to decide. */
+export interface Announcement {
+  id?: string;
+  name: string;
+  url: string;
+  tracks: number;
+  nowPlaying: string;
+}
+
+const MAX_NAME = 60;
+const MAX_TRACK = 120;
+
+/** Trim and flatten, so one publisher cannot draw a box in someone's terminal. */
+export function clean(value: unknown, max: number): string {
+  if (typeof value !== "string") return "";
+  // Control characters include the escape that starts an ANSI sequence, and
+  // this text is rendered in a terminal as well as a browser.
+  return value.replace(/[\u0000-\u001f\u007f]/g, " ").trim().slice(0, max);
+}
+
+/**
+ * A URL we are willing to list. It has to be somewhere a browser can go, and
+ * it must not be a loopback or link-local address: those are only reachable
+ * from the machine that published them, so listing one is an entry nobody but
+ * the publisher can ever open.
+ */
+export function publishable(raw: string): URL | null {
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+  if (host === "localhost" || host === "::1" || host.endsWith(".localhost")) return null;
+  if (/^127\./.test(host) || /^169\.254\./.test(host)) return null;
+  return url;
+}
+
+export function parseAnnouncement(input: unknown): Announcement | null {
+  if (typeof input !== "object" || input === null) return null;
+  const record = input as Record<string, unknown>;
+
+  const url = typeof record["url"] === "string" ? record["url"] : "";
+  if (publishable(url) === null) return null;
+
+  const name = clean(record["name"], MAX_NAME);
+  const tracks = Number(record["tracks"]);
+  return {
+    ...(typeof record["id"] === "string" ? { id: clean(record["id"], 40) } : {}),
+    name: name || "a nixamp",
+    url,
+    tracks: Number.isFinite(tracks) && tracks >= 0 ? Math.min(1_000_000, Math.floor(tracks)) : 0,
+    nowPlaying: clean(record["nowPlaying"], MAX_TRACK),
+  };
+}
+
+/**
+ * The registry. In memory on purpose: see the note at the top of the file.
+ * One entry per URL, so a publisher restarting does not leave a ghost of
+ * itself behind next to the entry that replaced it.
+ */
+export class Directory {
+  private readonly items = new Map<string, Listing>();
+  private sequence = 0;
+
+  constructor(
+    private readonly ttl = TTL_MS,
+    private readonly now: () => number = Date.now,
+  ) {}
+
+  announce(announcement: Announcement): Listing {
+    this.sweep();
+    const existing = [...this.items.values()].find((item) => item.url === announcement.url);
+    const id = existing?.id ?? `s${++this.sequence}${this.now().toString(36)}`;
+    const listing: Listing = {
+      id,
+      name: announcement.name,
+      url: announcement.url,
+      tracks: announcement.tracks,
+      nowPlaying: announcement.nowPlaying,
+      updatedAt: this.now(),
+    };
+    this.items.set(id, listing);
+    return listing;
+  }
+
+  withdraw(id: string): void {
+    this.items.delete(id);
+  }
+
+  list(): Listing[] {
+    this.sweep();
+    return [...this.items.values()].sort((a, b) => b.updatedAt - a.updatedAt || a.id.localeCompare(b.id));
+  }
+
+  /** Forget anything that stopped renewing. */
+  private sweep(): void {
+    const cutoff = this.now() - this.ttl;
+    for (const [id, item] of this.items) if (item.updatedAt < cutoff) this.items.delete(id);
+  }
+}

package/src/ingest.ts

@@ -0,0 +1,297 @@
+/**
+ * Streaming into a nixamp, rather than out of one.
+ *
+ * A phone or a laptop sends live audio to the server, and the server plays it,
+ * serves it to listeners, and broadcasts it onward. Two ways in, because one is
+ * not enough:
+ *
+ * - A single long POST whose body is the stream. ffmpeg, OBS, curl and the
+ *   desktop app can all do this, and it is the efficient one.
+ * - A sequence of small POSTs, for browsers. Chrome only allows a streaming
+ *   request body over HTTP/2, and a nixamp on your own network is plain
+ *   HTTP/1.1, so a phone that wants to broadcast has to send chunks.
+ *
+ * Both end up writing into the same ffmpeg stdin, which is what makes the two
+ * paths interchangeable to everything downstream.
+ *
+ * And a third, which is the one anything native should use: RTMP. Point OBS,
+ * Larix or another ffmpeg at rtmp://this-machine/live/<key> and it publishes,
+ * with no nixamp-shaped client in the middle. ffmpeg listens for it (-rtmp_listen),
+ * so this costs no dependency and no protocol implementation. The HTTP paths
+ * above are not a workaround for that: they are what a *browser* has, since a
+ * web page cannot speak RTMP at all.
+ */
+import { spawn, type ChildProcess } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import type { Readable } from "node:stream";
+
+/** A live source is one session at a time: two would be two songs at once. */
+export interface IngestSession {
+  id: string;
+  /** What the sender called itself. */
+  name: string;
+  /** The container the sender is producing, e.g. webm from MediaRecorder. */
+  format: string;
+  startedAt: number;
+  bytes: number;
+}
+
+export interface IngestStatus {
+  live: boolean;
+  session: IngestSession | null;
+  /** Where a native broadcaster should publish, when one is being listened for. */
+  rtmp: { port: number; path: string } | null;
+}
+
+/** Containers a browser or a desktop encoder actually produces. */
+const FORMATS = new Set(["webm", "ogg", "mp4", "matroska", "mp3", "wav", "flv"]);
+
+/**
+ * ffmpeg's `-f` is a demuxer name, and passing an unknown one is how a stream
+ * dies four seconds in with a message nobody sees. An unrecognised container is
+ * refused up front instead.
+ */
+export function normaliseFormat(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const format = value.trim().toLowerCase();
+  if (format === "") return null;
+  // A MediaRecorder mime type: audio/webm;codecs=opus.
+  // The subtype may carry a hyphen: audio/x-matroska is what some browsers
+  // hand out, and stopping at the hyphen turned it into "x".
+  const fromMime = /^(?:audio|video)\/([a-z0-9-]+)/.exec(format)?.[1];
+  const candidate = fromMime ?? format;
+  const mapped = candidate === "x-matroska" ? "matroska" : candidate;
+  return FORMATS.has(mapped) ? mapped : null;
+}
+
+export interface IngestOptions {
+  ffmpeg: string[];
+  /** Where the decoded audio should go: a file ffmpeg writes, or a pipe. */
+  sink: string;
+  /** Called when a session starts, so the player can switch to it. */
+  onStart: (session: IngestSession) => void;
+  /** Called when it ends, cleanly or otherwise. */
+  onEnd: (session: IngestSession, error: string) => void;
+  /** Encoded audio, as it arrives from a live publisher. */
+  onAudio?: (chunk: Buffer) => void;
+}
+
+/**
+ * The live input.
+ *
+ * One session at a time: a second sender is refused rather than mixed, because
+ * mixing two uninvited streams is never what anybody meant.
+ */
+export class Ingest {
+  private child: ChildProcess | null = null;
+  private session: IngestSession | null = null;
+  private closing = false;
+  /** The RTMP listener, which outlives any one publisher. */
+  private rtmpChild: ChildProcess | null = null;
+  private rtmpPort: number | null = null;
+  private rtmpKey = "";
+
+  constructor(private readonly options: IngestOptions) {}
+
+  status(): IngestStatus {
+    return {
+      live: this.session !== null,
+      session: this.session,
+      rtmp: this.rtmpPort === null ? null : { port: this.rtmpPort, path: `/live/${this.rtmpKey}` },
+    };
+  }
+
+  get live(): boolean {
+    return this.session !== null;
+  }
+
+  /**
+   * Open a session. Returns the session, or null when one is already running:
+   * the caller answers 409, because "somebody else is already broadcasting" is
+   * a different problem from "your request was wrong".
+   */
+  open(name: string, format: string): IngestSession | null {
+    if (this.session !== null) return null;
+
+    const session: IngestSession = {
+      id: randomBytes(8).toString("hex"),
+      name: name || "a device",
+      format,
+      startedAt: Date.now(),
+      bytes: 0,
+    };
+
+    const [command, ...prefix] = this.options.ffmpeg as [string, ...string[]];
+    const child = spawn(
+      command,
+      [
+        ...prefix,
+        "-hide_banner",
+        "-loglevel", "error",
+        // The demuxer is stated because ffmpeg mis-probes a live, unseekable
+        // pipe: it reads a few kilobytes, guesses, and guesses wrong.
+        "-f", format,
+        "-i", "pipe:0",
+        "-vn",
+        "-c:a", "libmp3lame",
+        "-b:a", "192k",
+        "-y",
+        "-f", "mp3",
+        this.options.sink,
+      ],
+      { stdio: ["pipe", "ignore", "pipe"] },
+    );
+
+    let tail = "";
+    child.stderr?.on("data", (chunk: Buffer) => {
+      tail = (tail + chunk.toString()).slice(-2000);
+    });
+    // A sender that hangs up mid-write breaks the pipe, and an unhandled EPIPE
+    // takes the whole server down with it.
+    child.stdin?.on("error", () => this.close(""));
+    child.on("error", (error) => this.close(error.message));
+    child.on("close", (code) => this.close(code === 0 ? "" : tail.trim().split("\n").pop() ?? ""));
+
+    this.child = child;
+    this.session = session;
+    this.closing = false;
+    this.options.onStart(session);
+    return session;
+  }
+
+  /** Feed it. Returns false once the session is over. */
+  write(chunk: Buffer): boolean {
+    const child = this.child;
+    const session = this.session;
+    if (child === null || session === null || child.stdin === null) return false;
+    session.bytes += chunk.byteLength;
+    return child.stdin.write(chunk);
+  }
+
+  /** Pipe a whole request body in, for a sender that can stream one. */
+  async pump(body: Readable): Promise<void> {
+    for await (const chunk of body) {
+      if (!this.write(chunk as Buffer)) {
+        // Backpressure: wait for the drain rather than growing a buffer that
+        // is really the network's problem.
+        await new Promise((done) => this.child?.stdin?.once("drain", done) ?? done(null));
+      }
+      if (this.session === null) return;
+    }
+  }
+
+  /**
+   * Wait for an RTMP publisher, and keep waiting after each one leaves.
+   *
+   * ffmpeg is the RTMP server here: `-rtmp_listen 1` binds the port and blocks
+   * until somebody publishes. It serves one publisher and exits, so the
+   * listener is started again afterwards -- otherwise a broadcaster who
+   * reconnects finds nothing listening.
+   */
+  listenRtmp(port: number, key: string): void {
+    this.rtmpPort = port;
+    this.rtmpKey = key;
+    this.armRtmp();
+  }
+
+  /** Stop waiting for publishers. */
+  stopRtmp(): void {
+    this.rtmpPort = null;
+    const listener = this.rtmpChild;
+    this.rtmpChild = null;
+    listener?.kill("SIGKILL");
+  }
+
+  private armRtmp(): void {
+    const port = this.rtmpPort;
+    if (port === null || this.rtmpChild !== null) return;
+
+    const [command, ...prefix] = this.options.ffmpeg as [string, ...string[]];
+    const child = spawn(
+      command,
+      [
+        ...prefix,
+        "-hide_banner",
+        "-loglevel", "error",
+        "-rtmp_listen", "1",
+        // Wait indefinitely: a stream that starts tomorrow is still the stream.
+        "-timeout", "-1",
+        "-f", "flv",
+        "-i", `rtmp://0.0.0.0:${port}/live/${this.rtmpKey}`,
+        "-vn",
+        "-c:a", "libmp3lame",
+        "-b:a", "192k",
+        "-y",
+        "-f", "mp3",
+        this.options.sink,
+      ],
+      // stdout is watched rather than ignored: the encoded bytes are the only
+      // honest signal that a publisher turned up. ffmpeg does not announce a
+      // connect, a healthy stream says nothing at -loglevel error, and
+      // -progress only reports at the end in this build. Audio existing means
+      // audio arrived.
+      { stdio: ["ignore", "pipe", "pipe"] },
+    );
+
+    const session: IngestSession = {
+      id: randomBytes(8).toString("hex"),
+      name: "an RTMP publisher",
+      format: "flv",
+      startedAt: Date.now(),
+      bytes: 0,
+    };
+
+    let tail = "";
+    child.stderr?.on("data", (chunk: Buffer) => {
+      tail = (tail + chunk.toString()).slice(-2000);
+    });
+
+    child.stdout?.on("data", (chunk: Buffer) => {
+      if (this.rtmpChild !== child) return;
+      if (this.session === null) {
+        this.session = session;
+        this.options.onStart(session);
+      }
+      if (this.session === session) session.bytes += chunk.byteLength;
+      // Consumed and dropped for now. The pipe has to be read either way --
+      // an unread one fills and stalls the encoder -- and handing these bytes
+      // to the listeners is the next piece of work, not a missing one here.
+      this.options.onAudio?.(chunk);
+    });
+
+    child.on("error", () => {
+      if (this.rtmpChild === child) this.rtmpChild = null;
+    });
+
+    child.on("close", () => {
+      if (this.rtmpChild !== child) return;
+      this.rtmpChild = null;
+      if (this.session === session) {
+        this.session = null;
+        // A publisher disconnecting is how a broadcast ends, not an error.
+        this.options.onEnd(session, "");
+      }
+      // Listen again for the next one.
+      if (this.rtmpPort !== null) this.armRtmp();
+    });
+
+    this.rtmpChild = child;
+  }
+
+  /** End the session, whoever ended it. */
+  close(error = ""): void {
+    if (this.closing) return;
+    this.closing = true;
+    const session = this.session;
+    const child = this.child;
+    this.session = null;
+    this.child = null;
+    try {
+      child?.stdin?.end();
+    } catch {
+      // Already broken, which is usually why we are here.
+    }
+    child?.kill("SIGKILL");
+    if (session) this.options.onEnd(session, error);
+  }
+}

package/src/main.ts

@@ -7,6 +7,7 @@
  * ffmpeg decodes; we read every sample on its way to the speakers and draw it.
  */
 import { createApp, themes, type BrailleCanvas, type Container, type KeyEvent, type Theme } from "@profullstack/hqtui";
+import { fileURLToPath } from "node:url";
 import { resolve } from "node:path";
 import {
   detectTools, formatTime, peaks, RATE, Stream, toMono,
@@ -14,7 +15,8 @@ import {
 } from "./audio.ts";
 import { Analyser, bandEdges, bands, decay } from "./fft.ts";
 import { version } from "./meta.ts";
-import { displayName, loadPlaylist } from "./playlist.ts";
+import { displayName, loadSource } from "./playlist.ts";
+import { isRemote } from "./sources.ts";
 import { DEFAULT_PORT } from "./server.ts";
 
 const FFT_SIZE = 2048;
@@ -64,21 +66,98 @@ export function barGlyph(value: number): string {
 
 const HELP = `nixamp — it really whips the terminal's ass.
 
-  nixamp [path]                  play a directory or a file in the terminal
-  nixamp serve [path] [options]  play here, and hand out a browser remote
+  nixamp [source]                play it in the terminal
+  nixamp serve [source] [options]  play here, and hand out a browser remote
+  nixamp daemon start|stop|status  serve in the background, and let go of it
+  nixamp admin [--url U] [--key K] who is connected, and re-stream to them
+  nixamp login [--signup]        sign in to nixamp.com
+  nixamp logout / whoami        forget it, or check it
   nixamp update [version]        re-run the installer, keeping your choices
   nixamp uninstall [--yes]       remove everything the installer created
 
+A source is a directory, a file, an .m3u, an .m3u8, a .pls, or a URL to any
+of those.
+
 Options for serve:
   -p, --port N     port to listen on (default ${DEFAULT_PORT})
-  -h, --host HOST  address to bind (default 127.0.0.1; 0.0.0.0 for the LAN)
+  -h, --host HOST  address to bind (default 0.0.0.0, every interface)
       --web DIR    directory of built PWA files to serve at /
       --no-media   do not stream the library's bytes to remotes
+      --no-key     serve to anyone who can reach the port, with no share link
+      --open-port  let the port through the local firewall, and close it on exit
+      --publish    list it at nixamp.com/directory without asking first
+      --no-publish never list it, and do not ask
+      --name NAME  what to call it in the directory (default: this hostname)
+      --ingest     accept a live stream in at POST /api/ingest
+      --rtmp-in N  also listen for RTMP publishers (OBS, Larix) from port N
+      --rtmp-streams N  how many may publish at once (default 3, a port each)
+      --rtmp D     broadcast out, e.g. --rtmp youtube=<key>. Repeatable
+      --x402       charge for listening once more than 5 people are listening
+      --no-x402    never charge
 
   -v, --version    print the version
       --help       print this
 `;
 
+/**
+ * `nixamp daemon <start|stop|status>`.
+ *
+ * The daemon is `nixamp serve` with nobody holding its terminal, so this is
+ * mostly bookkeeping: start it detached, remember where it went, and be able
+ * to answer whether it is still there.
+ */
+async function runDaemon(argv: string[]): Promise<number> {
+  const d = await import("./daemon.ts");
+  const [action = "status", ...rest] = argv;
+  const entry = fileURLToPath(new URL("./main.js", import.meta.url));
+
+  if (action === "start") {
+    try {
+      const state = await d.start(rest, entry);
+      console.log(`nixamp daemon running (pid ${state.pid})`);
+      const url = d.daemonUrl(state);
+      console.log(`  ${state.key ? `${url}/s/${state.key}` : url}`);
+      console.log(`  ${state.source}`);
+      console.log("");
+      console.log("  nixamp admin        who is connected");
+      console.log("  nixamp daemon stop  when you are done");
+      return 0;
+    } catch (error) {
+      console.error((error as Error).message);
+      return 1;
+    }
+  }
+
+  if (action === "stop") {
+    const stopped = await d.stop();
+    console.log(stopped ? "nixamp daemon stopped" : "nixamp: no daemon was running");
+    return 0;
+  }
+
+  if (action === "status") {
+    const { running, state } = d.status();
+    if (!state) {
+      console.log("nixamp: no daemon. Start one with `nixamp daemon start`.");
+      return 1;
+    }
+    // A pid file outlives its process often enough that saying "running"
+    // without checking is how you report a daemon that died on Tuesday.
+    if (!running) {
+      console.log(`nixamp: the daemon (pid ${state.pid}) is gone. See ${state.log}`);
+      return 1;
+    }
+    const url = d.daemonUrl(state);
+    console.log(`nixamp daemon running (pid ${state.pid})`);
+    console.log(`  ${state.key ? `${url}/s/${state.key}` : url}`);
+    console.log(`  ${state.source}`);
+    console.log(`  up ${Math.round((Date.now() - state.startedAt) / 1000)}s`);
+    return 0;
+  }
+
+  console.error(`nixamp daemon: unknown action ${action}. Try start, stop or status.`);
+  return 64;
+}
+
 /**
  * The whole CLI, as a function. `bin/nixamp.mjs` imports and calls it: relying
  * on `import.meta.main` there would leave the installed binary doing nothing,
@@ -92,6 +171,25 @@ export async function main(): Promise<void> {
     await serve(rest, version());
     return;
   }
+  if (first === "daemon") {
+    process.exitCode = await runDaemon(rest);
+    return;
+  }
+  if (first === "admin") {
+    const { admin } = await import("./admin.ts");
+    await admin(rest);
+    return;
+  }
+  if (first === "login" || first === "signup") {
+    const { login } = await import("./session.ts");
+    process.exitCode = await login(first === "signup" ? [...rest, "--signup"] : rest);
+    return;
+  }
+  if (first === "logout" || first === "whoami") {
+    const session = await import("./session.ts");
+    process.exitCode = first === "logout" ? session.logout() : await session.whoami();
+    return;
+  }
   if (first === "update" || first === "uninstall") {
     const manage = await import("./manage.ts");
     process.exitCode = first === "update" ? manage.update(rest) : manage.uninstall(rest);
@@ -100,9 +198,12 @@ export async function main(): Promise<void> {
   if (first === "--version" || first === "-v") { console.log(version()); return; }
   if (first === "--help") { console.log(HELP); return; }
 
-  const target = resolve(first ?? ".");
+  // resolve() would turn https://host/x into /cwd/https:/host/x, so a URL is
+  // left exactly as it was typed.
+  const asked = first ?? ".";
+  const target = isRemote(asked) ? asked : resolve(asked);
   const tools = detectTools();
-  const tracks = loadPlaylist(tools, target);
+  const tracks = await loadSource(tools, target);
   if (tracks.length === 0) {
     console.error(`nixamp: no audio files under ${target}`);
     process.exit(1);

package/src/manage.ts

@@ -9,6 +9,7 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 
 /** What the installer recorded about this install. */
 export interface Manifest {
@@ -23,12 +24,15 @@ export interface Manifest {
 
 const SITE = "https://nixamp.com";
 
+/** Windows has its own installer, its own shim and its own removal script. */
+const windows = process.platform === "win32";
+
 /**
  * Where the installer put things. `NIXAMP_HOME` is exported by the shim it
  * wrote, which is the only thing that knows for certain; the walk up from this
  * file covers a shim from an older install that did not set it.
  */
-export function installRoot(from = new URL(".", import.meta.url).pathname): string | null {
+export function installRoot(from = fileURLToPath(new URL(".", import.meta.url))): string | null {
   const declared = process.env["NIXAMP_HOME"];
   if (declared && existsSync(join(declared, "manifest.json"))) return declared;
 
@@ -64,7 +68,11 @@ function notInstalled(what: string): number {
   console.error("");
   console.error("  Installed with npm or bun:  npm uninstall -g nixamp");
   console.error("  Running from a checkout:    delete the checkout");
-  console.error(`  Wanted the installed one:   curl -fsSL ${SITE}/install.sh | sh`);
+  console.error(
+    windows
+      ? `  Wanted the installed one:   irm ${SITE}/install.ps1 | iex`
+      : `  Wanted the installed one:   curl -fsSL ${SITE}/install.sh | sh`,
+  );
   return 69;
 }
 
@@ -78,13 +86,26 @@ export function update(argv: string[]): number {
   const manifest = root ? readManifest(root) : null;
   if (!root || !manifest) return notInstalled("update");
 
-  const installer = manifest.installer || `${SITE}/install.sh`;
-  const args = ["-s", "--", manifest.desktop ? "--desktop" : "--cli-only", "--prefix", manifest.prefix];
+  const installer = manifest.installer || `${SITE}/${windows ? "install.ps1" : "install.sh"}`;
   const wanted = argv.find((a) => !a.startsWith("-"));
-  if (wanted) args.push("--version", wanted);
 
   console.log(`nixamp ${manifest.version} is installed. Fetching the installer...`);
 
+  if (windows) {
+    // PowerShell fetches and runs it in one expression, which is also the
+    // documented install line, so an update takes a fresh install's path.
+    const flags = [manifest.desktop ? "" : "-CliOnly", "-Prefix", quote(manifest.prefix)];
+    if (wanted) flags.push("-Version", quote(wanted));
+    const expression = `& ([scriptblock]::Create((irm ${installer}))) ${flags.filter(Boolean).join(" ")}`;
+    const run = spawnSync("powershell", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", expression], {
+      stdio: "inherit",
+    });
+    return run.status ?? 1;
+  }
+
+  const args = ["-s", "--", manifest.desktop ? "--desktop" : "--cli-only", "--prefix", manifest.prefix];
+  if (wanted) args.push("--version", wanted);
+
   const fetcher = which("curl") ? ["curl", "-fsSL", installer] : which("wget") ? ["wget", "-qO-", installer] : null;
   if (!fetcher) {
     console.error("nixamp: curl or wget is required to update.");
@@ -118,17 +139,24 @@ export function uninstall(argv: string[]): number {
     return 0;
   }
 
-  const script = join(root, "uninstall.sh");
+  const script = join(root, windows ? "uninstall.ps1" : "uninstall.sh");
   if (!existsSync(script)) {
     console.error(`nixamp: ${script} is missing, so removal cannot be exact.`);
     console.error(`  The manifest lists: ${manifest.paths.join(", ")}`);
     return 1;
   }
 
-  const run = spawnSync("sh", [script], { stdio: "inherit" });
+  const run = windows
+    ? spawnSync("powershell", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", script], { stdio: "inherit" })
+    : spawnSync("sh", [script], { stdio: "inherit" });
   return run.status ?? 1;
 }
 
+/** A PowerShell single-quoted string: the only escape inside one is a doubled quote. */
+function quote(value: string): string {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+
 function which(command: string): boolean {
   return spawnSync("sh", ["-c", `command -v ${command}`], { stdio: "ignore" }).status === 0;
 }