nixamp 0.1.0 → 0.3.0

package/dist/server.js

@@ -11,11 +11,27 @@
  */
 import { createReadStream, statSync } from "node:fs";
 import { createServer as createHttpServer } from "node:http";
-import { networkInterfaces } from "node:os";
+import { hostname } from "node:os";
+import { spawn, spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { Connections } from "./connections.js";
+import { Broadcaster, DEFAULT_ENCODER, PRESETS, redact, } from "./broadcast.js";
+import { Ingest, normaliseFormat } from "./ingest.js";
+import { Channels, cleanId } from "./channels.js";
+import { RtmpListeners } from "./rtmp-in.js";
+import { Accounts, clearedCookie, sessionCookie, tokenFrom } from "./accounts.js";
+import { needsAdmin, Owner } from "./owner.js";
+import { readSession } from "./session.js";
+import { Directory, parseAnnouncement } from "./directory.js";
+import { confirm, DEFAULT_DIRECTORY, Publisher } from "./publish.js";
+import { applyRemoteConfig, createPaywall, FREE_LISTENERS, paywallFromEnv, } from "./paywall.js";
+import { isRemote } from "./sources.js";
+import { allowedForListening, elevate, firewallInUse, keyCookie, keyFrom, newKey, portCommands, reachableAddresses, scopeOf, shareLink, } from "./share.js";
 import { extname, join, normalize, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
 import { detectTools, peaks, RATE, Stream, toMono, } from "./audio.js";
 import { Analyser, bandEdges, bands, decay } from "./fft.js";
-import { loadPlaylist } from "./playlist.js";
+import { loadSource } from "./playlist.js";
 import { emptySnapshot, parseCommand, } from "./protocol.js";
 const FFT_SIZE = 2048;
 export const SERVE_BAND_COUNT = 24;
@@ -30,9 +46,24 @@ export function parseServeArgs(argv) {
     const options = {
         root: ".",
         port: Number.isInteger(fromEnv) && fromEnv > 0 && fromEnv <= 65535 ? fromEnv : DEFAULT_PORT,
-        host: "127.0.0.1",
+        // Every interface, because a player nobody else can reach is not much of a
+        // remote. The key in the link is what makes that safe; --no-key gives up
+        // both at once, and --host pins it back to one address.
+        host: "0.0.0.0",
         web: null,
         media: true,
+        key: true,
+        openPort: false,
+        announce: false,
+        directory: false,
+        publish: "ask",
+        name: "",
+        x402: false,
+        owner: "",
+        ingest: false,
+        rtmpIn: 0,
+        rtmpStreams: 3,
+        rtmp: [],
     };
     let sawRoot = false;
     for (let i = 0; i < argv.length; i++) {
@@ -60,6 +91,58 @@ export function parseServeArgs(argv) {
         else if (arg === "--no-media") {
             options.media = false;
         }
+        else if (arg === "--no-key") {
+            options.key = false;
+        }
+        else if (arg === "--open-port") {
+            options.openPort = true;
+        }
+        else if (arg === "--announce") {
+            options.announce = true;
+        }
+        else if (arg === "--directory") {
+            options.directory = true;
+        }
+        else if (arg === "--publish") {
+            options.publish = "yes";
+        }
+        else if (arg === "--no-publish") {
+            options.publish = "no";
+        }
+        else if (arg === "--name") {
+            options.name = value();
+        }
+        else if (arg === "--owner") {
+            options.owner = value();
+        }
+        else if (arg === "--ingest") {
+            options.ingest = true;
+        }
+        else if (arg === "--rtmp-streams") {
+            const count = Number(value());
+            if (!Number.isInteger(count) || count < 1 || count > 16) {
+                throw new Error("nixamp serve: --rtmp-streams must be between 1 and 16");
+            }
+            options.rtmpStreams = count;
+        }
+        else if (arg === "--rtmp-in") {
+            const port = Number(value());
+            if (!Number.isInteger(port) || port < 1 || port > 65535) {
+                throw new Error("nixamp serve: --rtmp-in must be a port number");
+            }
+            options.rtmpIn = port;
+            // Listening for RTMP is accepting a live stream, so it implies --ingest.
+            options.ingest = true;
+        }
+        else if (arg === "--rtmp") {
+            options.rtmp.push(value());
+        }
+        else if (arg === "--x402") {
+            options.x402 = true;
+        }
+        else if (arg === "--no-x402") {
+            options.x402 = false;
+        }
         else if (arg.startsWith("-")) {
             throw new Error(`nixamp serve: unknown option ${arg}`);
         }
@@ -80,6 +163,7 @@ const TYPES = {
     // The installer, so `curl https://nixamp.com/install.sh` is readable rather
     // than a download prompt.
     ".sh": "text/x-shellscript; charset=utf-8",
+    ".ps1": "text/plain; charset=utf-8",
     ".svg": "image/svg+xml",
     ".png": "image/png",
     ".ico": "image/x-icon",
@@ -343,6 +427,15 @@ export class PlayerEngine {
         }
         this.listeners.clear();
     }
+    replace(tracks, root) {
+        this.stop();
+        this.tracks = tracks;
+        this.root = root;
+        this.state.index = 0;
+        this.state.position = 0;
+        this.state.note = "";
+        this.push();
+    }
 }
 /** An engine with no library behind it, for the hosted PWA. */
 export class EmptyEngine {
@@ -361,6 +454,7 @@ export class EmptyEngine {
     trackPath() {
         return undefined;
     }
+    replace() { }
     stop() { }
 }
 const CORS = {
@@ -399,23 +493,404 @@ async function readBody(request, limit = 64 * 1024) {
  * drive it with a real socket and no ffmpeg in sight.
  */
 export function createHandler(engine, options) {
+    const tracker = options.connections ?? new Connections();
+    const started = Date.now();
+    /** Count a request in, count its bytes, and close it out exactly once. */
+    const watch = (request, response, kind, track) => {
+        const { id } = tracker.open(request, kind, track);
+        const write = response.write.bind(response);
+        response.write = ((chunk, ...rest) => {
+            if (typeof chunk === "string" || chunk instanceof Uint8Array) {
+                tracker.add(id, typeof chunk === "string" ? Buffer.byteLength(chunk) : chunk.byteLength);
+            }
+            return write(chunk, ...rest);
+        });
+        // 'close' fires for a finished response and for a listener that walked
+        // away, which are the same thing as far as "is it still going" goes.
+        response.once("close", () => tracker.close(id));
+    };
     return async function handle(request, response) {
         const url = new URL(request.url ?? "/", "http://localhost");
         const path = url.pathname;
+        const key = options.key ?? null;
+        const listenKey = options.listenKey ?? null;
         if (request.method === "OPTIONS") {
             response.writeHead(204, CORS);
             response.end();
             return;
         }
+        // Opening a share link is what hands a browser its key. It comes back as a
+        // cookie, so every later fetch, EventSource and <audio src> carries it
+        // without the page knowing anything about keys. Either key works here, and
+        // which one was used decides what the browser can then do.
+        if (key !== null && path.startsWith("/s/")) {
+            const offered = decodeURIComponent(path.slice("/s/".length));
+            if (scopeOf(offered, key, listenKey) === null) {
+                json(response, 404, { error: "not found" });
+                return;
+            }
+            response.writeHead(302, { ...CORS, "set-cookie": keyCookie(offered), location: "/" });
+            response.end();
+            return;
+        }
+        // /api/health answers unauthenticated on purpose: it is how you check the
+        // port is open from another device before wondering whether the link is
+        // wrong, and it says nothing about the library.
+        if (key !== null &&
+            path !== "/api/health" &&
+            path !== "/api/directory" &&
+            !path.startsWith("/api/v1/auth/")) {
+            const scope = scopeOf(keyFrom(request, url), key, listenKey);
+            if (scope === null) {
+                json(response, 401, { error: "this nixamp needs the key from its share link" });
+                return;
+            }
+            if (scope === "listen" && !allowedForListening(path)) {
+                json(response, 403, { error: "this link can listen, not drive" });
+                return;
+            }
+        }
         if (path === "/api/health") {
             json(response, 200, { name: "nixamp", version: options.version, media: options.media });
             return;
         }
+        // --- accounts ---------------------------------------------------------
+        //
+        // Before the share-key check, because signing in is how somebody without a
+        // key becomes somebody with one. The API is versioned and namespaced the
+        // way the rest of the fleet's is.
+        if (path.startsWith("/api/v1/auth/") && options.accounts) {
+            const accounts = options.accounts;
+            const secure = options.secureCookies ?? false;
+            if (path === "/api/v1/auth/me") {
+                const who = await accounts.whoIs(tokenFrom(request.headers));
+                if (who === null) {
+                    json(response, 401, { error: "not signed in" });
+                    return;
+                }
+                json(response, 200, { account: who });
+                return;
+            }
+            if (path === "/api/v1/auth/logout") {
+                response.writeHead(200, {
+                    ...CORS,
+                    "content-type": "application/json; charset=utf-8",
+                    "set-cookie": clearedCookie(),
+                });
+                response.end(JSON.stringify({ ok: true }));
+                return;
+            }
+            const signingUp = path === "/api/v1/auth/signup";
+            if (!signingUp && path !== "/api/v1/auth/login") {
+                json(response, 404, { error: "no such endpoint" });
+                return;
+            }
+            if (request.method !== "POST") {
+                json(response, 405, { error: "POST only" });
+                return;
+            }
+            let body;
+            try {
+                body = JSON.parse(await readBody(request));
+            }
+            catch {
+                json(response, 400, { error: "bad JSON" });
+                return;
+            }
+            const result = signingUp
+                ? await accounts.signUp(body.email, body.password)
+                : await accounts.signIn(body.email, body.password);
+            if (!result.ok) {
+                // 409 for an address that is taken, 401 for credentials that are not.
+                json(response, signingUp ? 409 : 401, { error: result.error });
+                return;
+            }
+            // The token goes back in the body for the CLI and the desktop app, and
+            // as a cookie for the browser, which then needs to know nothing about it.
+            response.writeHead(200, {
+                ...CORS,
+                "content-type": "application/json; charset=utf-8",
+                "set-cookie": sessionCookie(result.token, secure),
+            });
+            response.end(JSON.stringify({ account: result.account, token: result.token }));
+            return;
+        }
+        // The directory is public in both directions: anyone may read the list,
+        // and anyone running a nixamp may add themselves to it. It is answered
+        // before the key check, because a visitor to nixamp.com has no key and is
+        // exactly who it is for.
+        if (path === "/api/directory" && options.directory) {
+            if (request.method === "GET") {
+                json(response, 200, { streams: options.directory.list(), now: Date.now() });
+                return;
+            }
+            if (request.method === "POST") {
+                let announcement;
+                try {
+                    announcement = parseAnnouncement(JSON.parse(await readBody(request)));
+                }
+                catch {
+                    json(response, 400, { error: "bad JSON" });
+                    return;
+                }
+                if (announcement === null) {
+                    json(response, 422, { error: "a listing needs a name and a URL a browser can reach" });
+                    return;
+                }
+                json(response, 200, options.directory.announce(announcement));
+                return;
+            }
+            if (request.method === "DELETE") {
+                const id = url.searchParams.get("id");
+                if (id)
+                    options.directory.withdraw(id);
+                json(response, 200, { ok: true });
+                return;
+            }
+            json(response, 405, { error: "GET, POST or DELETE" });
+            return;
+        }
+        // Administering is a different question from listening, and it is asked
+        // after the share key: the control key answers both, but a listen key or a
+        // nixamp.com session answers only one of them.
+        if (options.owner && needsAdmin(path, request.method ?? "GET")) {
+            // A server started with --no-key has said that anyone who can reach the
+            // port may drive it, and prints exactly that. Locking administration to
+            // nobody would contradict it and leave such a server unadministrable.
+            const holdsControl = key === null || scopeOf(keyFrom(request, url), key, null) === "control";
+            const check = await options.owner.check(holdsControl, tokenFrom(request.headers));
+            if (path === "/api/admin") {
+                // Always answered, and honestly: the page has to know whether to draw
+                // an admin panel at all, and "no" is a real answer rather than a 403.
+                json(response, 200, { allowed: check.allowed, as: check.as, claimed: options.owner.claimed });
+                return;
+            }
+            if (!check.allowed) {
+                json(response, 403, {
+                    error: options.owner.claimed
+                        ? "sign in to nixamp.com as this server's owner, or use its control link"
+                        : "this server has no owner signed in; use its control link",
+                });
+                return;
+            }
+        }
+        // After the key check: a paying listener still needs the link, and a 402
+        // is a worse answer than a 401 to someone who has neither.
+        if (options.paywall && (await options.paywall(request, response, path)))
+            return;
+        // --- several streams at once ------------------------------------------
+        //
+        // A channel is one publisher and everybody listening to them. Two or three
+        // devices can publish at once, each to their own channel, and a listener
+        // picks which to hear.
+        if (path === "/api/channels" && options.channels) {
+            json(response, 200, { channels: options.channels.list(), listeners: options.channels.listeners });
+            return;
+        }
+        // Publishing. Anyone with the control link may; listening to the result is
+        // open to whoever has the share link, like the rest of the audio.
+        if (path.startsWith("/api/channels/") && options.channels) {
+            const channels = options.channels;
+            const rest = path.slice("/api/channels/".length);
+            const [rawId, action] = rest.split("/");
+            const id = cleanId(rawId);
+            if (action === undefined && request.method === "GET") {
+                // Listening. The response is the fan-out target: whatever ffmpeg
+                // produces for this channel is written to it until one end goes away.
+                const detach = channels.listen(id, response);
+                if (detach === null) {
+                    json(response, 404, { error: "nothing is playing on that channel" });
+                    return;
+                }
+                watch(request, response, "stream", id);
+                response.writeHead(200, {
+                    ...CORS,
+                    "content-type": "audio/mpeg",
+                    "cache-control": "no-store",
+                });
+                const leave = () => detach();
+                request.on("close", leave);
+                response.on("close", leave);
+                return;
+            }
+            if (action === undefined && request.method === "DELETE") {
+                // Asked once: the second call would answer false, having just stopped
+                // the thing it was asking about.
+                const stopped = channels.stop(id);
+                json(response, stopped ? 200 : 404, { ok: stopped });
+                return;
+            }
+            if (request.method !== "POST") {
+                json(response, 405, { error: "GET, POST or DELETE" });
+                return;
+            }
+            const format = normaliseFormat(url.searchParams.get("format") ?? request.headers["content-type"]);
+            if (format === null) {
+                json(response, 415, { error: "give a container ffmpeg knows: webm, ogg, mp4, mp3, wav" });
+                return;
+            }
+            const name = url.searchParams.get("name") ?? "";
+            // A chunked publisher sends many requests to one channel, so the first
+            // claims it and the rest feed what is already there.
+            if (action === "chunk") {
+                if (!channels.has(id) && channels.publish(id, name, format, "http") === null) {
+                    json(response, 409, { error: "that channel is already being published to" });
+                    return;
+                }
+                const chunks = [];
+                for await (const chunk of request)
+                    chunks.push(chunk);
+                channels.writeTo(id, Buffer.concat(chunks));
+                json(response, 200, { ok: true });
+                return;
+            }
+            const claimed = channels.publish(id, name, format, "http");
+            if (claimed === null) {
+                json(response, 409, { error: "that channel is already being published to" });
+                return;
+            }
+            try {
+                await claimed.pump(request);
+            }
+            catch {
+                // A publisher that hung up is not an error worth a 500.
+            }
+            claimed.close();
+            json(response, 200, { ok: true, bytes: claimed.info.bytes });
+            return;
+        }
+        // --- streaming in ---------------------------------------------------
+        //
+        // Both shapes write into the same ffmpeg, so everything downstream cannot
+        // tell which one a sender used.
+        if (path === "/api/ingest" && options.ingest) {
+            if (request.method === "GET") {
+                json(response, 200, options.ingest.status());
+                return;
+            }
+            if (request.method === "DELETE") {
+                options.ingest.close();
+                json(response, 200, { ok: true });
+                return;
+            }
+            if (request.method !== "POST") {
+                json(response, 405, { error: "GET, POST or DELETE" });
+                return;
+            }
+            const format = normaliseFormat(url.searchParams.get("format") ?? request.headers["content-type"]);
+            if (format === null) {
+                json(response, 415, { error: "give a container ffmpeg knows: webm, ogg, mp4, mp3, wav" });
+                return;
+            }
+            const session = options.ingest.open(url.searchParams.get("name") ?? "", format);
+            if (session === null) {
+                // Somebody else is already broadcasting, which is a different problem
+                // from the request being wrong.
+                json(response, 409, { error: "something is already streaming in" });
+                return;
+            }
+            try {
+                await options.ingest.pump(request);
+            }
+            catch {
+                // A sender that hung up is not an error worth a 500.
+            }
+            options.ingest.close();
+            json(response, 200, { ok: true, bytes: session.bytes });
+            return;
+        }
+        // A browser cannot stream a request body over plain HTTP/1.1, so a phone
+        // sends its recording a chunk at a time instead.
+        if (path === "/api/ingest/chunk" && options.ingest) {
+            if (request.method !== "POST") {
+                json(response, 405, { error: "POST only" });
+                return;
+            }
+            if (!options.ingest.live) {
+                const format = normaliseFormat(url.searchParams.get("format") ?? request.headers["content-type"]);
+                if (format === null) {
+                    json(response, 415, { error: "give a container ffmpeg knows: webm, ogg, mp4, mp3, wav" });
+                    return;
+                }
+                if (options.ingest.open(url.searchParams.get("name") ?? "", format) === null) {
+                    json(response, 409, { error: "something is already streaming in" });
+                    return;
+                }
+            }
+            const chunks = [];
+            for await (const chunk of request)
+                chunks.push(chunk);
+            options.ingest.write(Buffer.concat(chunks));
+            json(response, 200, options.ingest.status());
+            return;
+        }
+        // --- broadcasting out -------------------------------------------------
+        if (path === "/api/broadcast" && options.broadcaster) {
+            if (request.method === "GET") {
+                json(response, 200, options.broadcaster.status());
+                return;
+            }
+            if (request.method === "DELETE") {
+                options.broadcaster.stop();
+                json(response, 200, options.broadcaster.status());
+                return;
+            }
+            if (request.method !== "POST") {
+                json(response, 405, { error: "GET, POST or DELETE" });
+                return;
+            }
+            let source = "";
+            try {
+                source = String(JSON.parse(await readBody(request)).source ?? "");
+            }
+            catch {
+                json(response, 400, { error: "bad JSON" });
+                return;
+            }
+            const current = engine.snapshot();
+            const chosen = source || engine.trackPath(current.index) || "";
+            if (!chosen) {
+                json(response, 422, { error: "nothing to broadcast" });
+                return;
+            }
+            const plan = options.broadcast?.() ?? { destinations: [], settings: DEFAULT_ENCODER };
+            const started = options.broadcaster.start({
+                source: chosen,
+                destinations: plan.destinations,
+                settings: plan.settings,
+                webAudio: false,
+                // Music has no picture, and RTMP platforms insist on a video track.
+                needsVideo: true,
+            });
+            if (!started.ok) {
+                json(response, 422, { error: started.error });
+                return;
+            }
+            json(response, 200, options.broadcaster.status());
+            return;
+        }
+        // Names and URLs, never a key.
+        if (path === "/api/broadcast/destinations" && options.broadcast) {
+            json(response, 200, { destinations: options.broadcast().destinations.map(redact) });
+            return;
+        }
         if (path === "/api/state") {
             json(response, 200, engine.snapshot());
             return;
         }
+        // Everything the admin view draws, in one request: who is connected, and
+        // what this server is.
+        if (path === "/api/connections") {
+            json(response, 200, {
+                connections: tracker.list(),
+                active: tracker.active,
+                startedAt: started,
+                now: Date.now(),
+            });
+            return;
+        }
         if (path === "/api/events") {
+            watch(request, response, "events", "");
             response.writeHead(200, {
                 ...CORS,
                 "content-type": "text/event-stream; charset=utf-8",
@@ -461,6 +936,39 @@ export function createHandler(engine, options) {
             json(response, 200, engine.snapshot());
             return;
         }
+        // Re-stream: hand the running server a different source. The listeners
+        // stay connected; what they are listening to changes under them.
+        if (path === "/api/source") {
+            if (request.method !== "POST") {
+                json(response, 405, { error: "POST only" });
+                return;
+            }
+            let source = "";
+            try {
+                source = String(JSON.parse(await readBody(request)).source ?? "");
+            }
+            catch {
+                json(response, 400, { error: "bad JSON" });
+                return;
+            }
+            if (!source) {
+                json(response, 400, { error: "no source given" });
+                return;
+            }
+            try {
+                const tracks = await options.load(source);
+                if (tracks.length === 0) {
+                    json(response, 422, { error: `nothing to play at ${source}` });
+                    return;
+                }
+                engine.replace(tracks, source);
+                json(response, 200, engine.snapshot());
+            }
+            catch (error) {
+                json(response, 422, { error: error.message.replace(/^nixamp: /, "") });
+            }
+            return;
+        }
         if (path.startsWith("/api/media/")) {
             if (!options.media) {
                 json(response, 403, { error: "media streaming is off" });
@@ -472,9 +980,29 @@ export function createHandler(engine, options) {
                 json(response, 404, { error: "no such track" });
                 return;
             }
+            watch(request, response, "media", engine.snapshot().tracks[index]?.title ?? file);
             sendFile(request, response, file);
             return;
         }
+        // Whatever the source is, this comes back as MP3 a browser will play:
+        // a flac, a wma, a URL, an HLS stream. ffmpeg reads them all and we hand
+        // the bytes on as they arrive, so a live stream starts immediately rather
+        // than after it ends, which for a live stream is never.
+        if (path.startsWith("/api/stream/")) {
+            const index = Number(path.slice("/api/stream/".length));
+            const source = Number.isInteger(index) ? engine.trackPath(index) : undefined;
+            if (source === undefined) {
+                json(response, 404, { error: "no such track" });
+                return;
+            }
+            if (!options.media) {
+                json(response, 403, { error: "media streaming is off" });
+                return;
+            }
+            watch(request, response, "stream", engine.snapshot().tracks[index]?.title ?? source);
+            transcode(request, response, source, options.ffmpeg ?? ["ffmpeg"]);
+            return;
+        }
         if (path.startsWith("/api/")) {
             json(response, 404, { error: "no such endpoint" });
             return;
@@ -501,6 +1029,91 @@ export function createHandler(engine, options) {
         json(response, 404, { error: "not found" });
     };
 }
+/** Read a file, or null. The firewall probe asks about files it may not have. */
+function readIfPossible(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Decode anything and hand back MP3, as it is produced.
+ *
+ * No seeking: this is a pipe, and the length is not known until it ends. The
+ * player falls back to /api/media for a local file it can seek, and uses this
+ * for everything else.
+ */
+function transcode(request, response, source, ffmpeg) {
+    const [command, ...prefix] = ffmpeg;
+    const child = spawn(command, [
+        ...prefix,
+        "-hide_banner",
+        "-loglevel", "error",
+        // Reconnect through the sort of hiccup a long stream runs into. These
+        // belong to the http protocol, and ffmpeg rejects the whole command
+        // when they are handed to it for a file on disk.
+        ...(isRemote(source) ? ["-reconnect", "1", "-reconnect_streamed", "1", "-reconnect_delay_max", "5"] : []),
+        "-i", source,
+        "-vn",
+        "-f", "mp3",
+        "-b:a", "192k",
+        "-",
+    ], { stdio: ["ignore", "pipe", "pipe"] });
+    let failed = "";
+    child.stderr.on("data", (chunk) => {
+        // Keep the tail: ffmpeg says what went wrong on its last line.
+        failed = (failed + chunk.toString()).slice(-2000);
+    });
+    let started = false;
+    const begin = () => {
+        if (started)
+            return;
+        started = true;
+        response.writeHead(200, {
+            ...CORS,
+            "content-type": "audio/mpeg",
+            "cache-control": "no-store",
+            // Length is unknowable up front, and a browser is happy without it.
+            "transfer-encoding": "chunked",
+        });
+    };
+    // Wait for a first byte before promising success. ffmpeg rejects a bad option
+    // or a missing input immediately, and answering 200 with nothing looks the
+    // same from a player as a track that is simply silent.
+    child.stdout.once("data", begin);
+    // Both ends can fail: a listener closing the tab breaks the socket under the
+    // pipe, and an EPIPE nobody is listening for takes the process down.
+    child.stdout.on("error", () => child.kill("SIGKILL"));
+    response.on("error", () => child.kill("SIGKILL"));
+    child.stdout.pipe(response);
+    child.on("error", (error) => {
+        console.error(`nixamp: ffmpeg could not start: ${error.message}`);
+        if (!response.headersSent)
+            json(response, 500, { error: "ffmpeg could not start" });
+        else
+            response.end();
+    });
+    child.on("close", (code) => {
+        const message = failed.trim();
+        if (code !== 0 && code !== null)
+            console.error(`nixamp: ffmpeg exited ${code}: ${message}`);
+        if (!started) {
+            // Nothing was ever produced, so the status can still tell the truth.
+            json(response, 502, { error: "could not decode that source", detail: message.split("\n").pop() ?? "" });
+            return;
+        }
+        response.end();
+    });
+    // A listener that closes the tab should not leave an ffmpeg decoding into
+    // nothing for the rest of the album.
+    const stop = () => {
+        child.kill("SIGKILL");
+    };
+    request.on("close", stop);
+    response.on("close", stop);
+}
 function isFile(path) {
     try {
         return statSync(path).isFile();
@@ -559,38 +1172,264 @@ export function createServer(engine, options) {
         });
     });
 }
-/** Where a remote on another device should point its browser. */
-export function addressesFor(host, port) {
-    if (host !== "0.0.0.0" && host !== "::")
-        return [`http://${host}:${port}`];
-    const out = [`http://localhost:${port}`];
-    for (const entries of Object.values(networkInterfaces())) {
-        for (const entry of entries ?? []) {
-            if (entry.family === "IPv4" && !entry.internal)
-                out.push(`http://${entry.address}:${port}`);
-        }
-    }
-    return out;
-}
 export async function serve(argv, version = "0.1.0") {
     const options = parseServeArgs(argv);
-    const root = resolve(options.root);
+    const root = isRemote(options.root) ? options.root : resolve(options.root);
     const tools = detectTools();
-    const tracks = loadPlaylist(tools, root);
+    const tracks = await loadSource(tools, root);
     const engine = tracks.length > 0
         ? new PlayerEngine(tracks, root, tools)
         : new EmptyEngine(`No audio files under ${root}.`);
     const web = options.web !== null ? resolve(options.web) : defaultWebDir();
-    const server = createServer(engine, { web, media: options.media, version });
-    await new Promise((done) => server.listen(options.port, options.host, done));
+    const key = options.key ? newKey() : null;
+    // Minted whether or not it is published, so `nixamp admin` and the operator
+    // both have a link they can hand out without handing over the controls.
+    const listenKey = key === null ? null : newKey();
+    // Configuration can arrive from the directory later, so it is a box the
+    // paywall reads rather than a value it was handed once.
+    let paywallConfig = { ...paywallFromEnv(), enabled: options.x402 || paywallFromEnv().enabled };
+    const connections = new Connections();
+    const paywall = createPaywall({
+        config: () => paywallConfig,
+        liveListeners: () => connections.listening,
+        // The address a payer can actually reach: the public one where there is
+        // one, since a quote pointing at 192.168.1.5 is one they cannot pay from.
+        siteUrl: () => {
+            const bound = server.address();
+            const live = typeof bound === "object" && bound !== null ? bound.port : options.port;
+            const reachable = reachableAddresses(options.host, live);
+            return (reachable.find((a) => a.label === "on the internet") ?? reachable[0])?.url
+                ?? `http://127.0.0.1:${live}`;
+        },
+        // The operator drives with the control key, and is not a customer.
+        exempt: (request) => key !== null && scopeOf(keyFrom(request, new URL(request.url ?? "/", "http://localhost")), key, null) === "control",
+    });
+    const channels = new Channels({
+        ffmpeg: tools.ffmpeg,
+        onStart: (info) => console.log(`  ${info.name} is publishing to "${info.id}" (${info.format} over ${info.via}).`),
+        onEnd: (info) => console.log(`  "${info.id}" stopped.`),
+    });
+    const destinations = parseDestinations(options.rtmp);
+    const broadcaster = new Broadcaster(tools.ffmpeg);
+    const ingest = options.ingest
+        ? new Ingest({
+            ffmpeg: tools.ffmpeg,
+            sink: "pipe:1",
+            onStart: (session) => console.log(`  ${session.name} started streaming in (${session.format}).`),
+            onEnd: (session, error) => console.log(`  ${session.name} stopped streaming in${error ? `: ${error}` : ""}.`),
+        })
+        : undefined;
+    // The account signed in on this machine owns the server it starts. That is
+    // the whole claim: `nixamp login` then `nixamp serve`, and the phone in your
+    // pocket can administer it from anywhere by signing in as the same person.
+    const session = readSession();
+    const owner = new Owner({
+        ownerId: options.owner || (session?.token ? await ownerIdOf(session) : ""),
+        site: session?.site ?? DEFAULT_DIRECTORY,
+    });
+    const server = createServer(engine, {
+        web,
+        media: options.media,
+        owner,
+        channels,
+        ...(ingest ? { ingest } : {}),
+        broadcaster,
+        broadcast: () => ({ destinations, settings: DEFAULT_ENCODER }),
+        version,
+        key,
+        listenKey,
+        connections,
+        paywall,
+        ffmpeg: tools.ffmpeg,
+        load: (next) => loadSource(tools, next),
+        ...(options.directory ? { directory: new Directory() } : {}),
+        // Accounts live where the directory lives, and only there: a nixamp on a
+        // laptop has nobody to be an account of.
+        ...(options.directory && process.env["DATABASE_URL"]
+            ? {
+                accounts: new Accounts({
+                    connectionString: process.env["DATABASE_URL"],
+                    secret: process.env["NIXAMP_JWT_SECRET"] ?? "",
+                }),
+                secureCookies: (process.env["NIXAMP_SITE"] ?? "").startsWith("https://"),
+            }
+            : {}),
+    });
+    // A port already in use is the most ordinary failure there is, and it
+    // arrives as an unhandled 'error' event that takes the process down with a
+    // stack trace nobody reads.
+    await new Promise((done, fail) => {
+        server.once("error", (error) => {
+            fail(new Error(error.code === "EADDRINUSE"
+                ? `nixamp: port ${options.port} is already in use. Pass --port to pick another.`
+                : error.code === "EACCES"
+                    ? `nixamp: not allowed to listen on port ${options.port}. Ports below 1024 need root.`
+                    : `nixamp: could not listen on ${options.host}:${options.port}: ${error.message}`));
+        });
+        server.listen(options.port, options.host, done);
+    });
     const bound = server.address();
     const port = typeof bound === "object" && bound !== null ? bound.port : options.port;
+    const io = {
+        read: readIfPossible,
+        run: (command, args) => {
+            const done = spawnSync(command, args, { encoding: "utf8" });
+            return { status: done.status, stdout: done.stdout ?? "" };
+        },
+    };
+    if (options.announce) {
+        console.log(JSON.stringify({ nixamp: "listening", host: options.host, port, key, source: root }));
+    }
     console.log(`nixamp serve — ${tracks.length} tracks under ${root}`);
-    for (const address of addressesFor(options.host, port))
-        console.log(`  ${address}`);
+    console.log("");
+    // The link, not the address. Without the key the address is a 401, so
+    // printing a bare host:port would be printing something that does not work.
+    const addresses = reachableAddresses(options.host, port);
+    const width = Math.max(...addresses.map((a) => a.label.length));
+    for (const { label, url } of addresses) {
+        console.log(`  ${label.padEnd(width)}  ${shareLink(url, key)}`);
+    }
+    console.log("");
+    if (key === null) {
+        console.log("  No key: anyone who can reach this port can drive it and hear it.");
+    }
+    else {
+        console.log("  Open that link once on a phone or a laptop and it stays signed in.");
+        console.log(`  Anything without the key gets a 401. Key: ${key}`);
+        if (listenKey !== null) {
+            console.log("");
+            console.log("  A listen-only link, for someone you want to hear it but not drive it:");
+            for (const { label, url } of addresses) {
+                if (label === "here")
+                    continue;
+                console.log(`    ${shareLink(url, listenKey)}`);
+            }
+        }
+    }
+    if (addresses.some((a) => a.label === "on the internet")) {
+        console.log("");
+        console.log(key === null
+            ? "  The public address is open to anyone: --no-key means no key. --host 127.0.0.1 keeps it here."
+            : "  The public address works from anywhere, for anyone with the key. --host 127.0.0.1 keeps it here.");
+    }
+    if (!options.media)
+        console.log("  Audio stays on this machine: --no-media is set.");
+    if (owner.claimed) {
+        console.log(`  ${session?.email} can administer this from anywhere, signed in at ${session?.site}.`);
+    }
+    if (options.ingest)
+        console.log("  Accepting a live stream in at POST /api/ingest.");
+    let rtmp = null;
+    if (options.rtmpIn > 0) {
+        const publish = addresses.find((a) => a.label !== "here") ?? addresses[0];
+        const host = publish ? new URL(publish.url).hostname : "127.0.0.1";
+        // One listener per stream, because ffmpeg's RTMP listener serves a single
+        // connection per process. Three devices going live at once is three ports.
+        const slots = Array.from({ length: options.rtmpStreams }, (_, i) => ({
+            port: options.rtmpIn + i,
+            id: i === 0 ? "live" : `live-${i + 1}`,
+        }));
+        rtmp = new RtmpListeners(channels, tools.ffmpeg, listenKey ?? "live");
+        rtmp.listen(slots);
+        console.log("  Or publish from OBS, Larix or ffmpeg, one per URL:");
+        for (const slot of slots) {
+            console.log(`    rtmp://${host}:${slot.port}/live/${listenKey ?? "live"}   -> "${slot.id}"`);
+        }
+    }
+    if (destinations.length > 0) {
+        console.log(`  Ready to broadcast to ${destinations.map((d) => d.name).join(", ")}.`);
+    }
     if (web === null)
-        console.log("  (no built PWA found — run `bun run web:build` to serve one)");
+        console.log("  No built PWA found, so / has nothing to serve: run `bun run web:build`.");
+    // Listening on every interface proves the socket is open here and nothing
+    // about the path between here and the phone.
+    const listening = options.host === "0.0.0.0" || options.host === "::";
+    const firewall = listening ? firewallInUse(io) : null;
+    let closePort = null;
+    if (firewall !== null) {
+        const { open, close } = portCommands(firewall, port);
+        if (!options.openPort) {
+            console.log("");
+            console.log(`  ${firewall} is running, so other devices cannot reach this port yet:`);
+            console.log(`    sudo ${open.join(" ")}`);
+            console.log("  or start with --open-port and nixamp will do it, and undo it on exit.");
+        }
+        else {
+            const elevated = elevate(io, open);
+            if (elevated === null) {
+                console.log("");
+                console.log(`  --open-port needs root or passwordless sudo. Run this yourself:`);
+                console.log(`    sudo ${open.join(" ")}`);
+            }
+            else {
+                const done = spawnSync(elevated[0], elevated.slice(1), { encoding: "utf8" });
+                if (done.status === 0) {
+                    console.log("");
+                    console.log(`  Opened ${port}/tcp in ${firewall}. It closes again when this exits.`);
+                    // Leave the machine as it was found. A player should not be the
+                    // reason a port is still open next week.
+                    closePort = () => {
+                        const undo = elevate(io, close);
+                        if (undo)
+                            spawnSync(undo[0], undo.slice(1), { stdio: "ignore" });
+                    };
+                }
+                else {
+                    console.log("");
+                    console.log(`  Could not open the port: ${(done.stderr || done.stdout || "").trim() || "unknown error"}`);
+                }
+            }
+        }
+    }
+    // The listing carries the listen link, and only ever a public address: an
+    // entry pointing at 192.168.1.5 is one nobody outside that house can open.
+    const publishable_ = addresses.find((a) => a.label === "on the internet")
+        ?? addresses.find((a) => a.label === "on tailscale");
+    let publisher = null;
+    if (options.publish !== "no" && publishable_) {
+        const listen = shareLink(publishable_.url, listenKey);
+        const wanted = options.publish === "yes"
+            ? true
+            : await confirm(`\n  List this stream at ${DEFAULT_DIRECTORY}/directory so anyone can find it?\n  It publishes ${listen} — listen only, not the controls.`);
+        if (wanted) {
+            publisher = new Publisher({
+                directory: DEFAULT_DIRECTORY,
+                name: options.name || hostname(),
+                url: listen,
+                tracks: tracks.length,
+                nowPlaying: () => {
+                    const snapshot = engine.snapshot();
+                    return snapshot.tracks[snapshot.index]?.title ?? "";
+                },
+                onConfig: (remote) => {
+                    const next = applyRemoteConfig(paywallConfig, remote?.x402);
+                    if (JSON.stringify(next) === JSON.stringify(paywallConfig))
+                        return;
+                    paywallConfig = next;
+                    console.log(next.enabled
+                        ? `  nixamp.com turned paid listening on: $${(next.priceCents / 100).toFixed(2)} for ${next.passMinutes} minutes, over ${FREE_LISTENERS} listeners.`
+                        : "  nixamp.com turned paid listening off.");
+                },
+            });
+            const listing = await publisher.start();
+            console.log("");
+            console.log(listing
+                ? `  Listed at ${DEFAULT_DIRECTORY}/directory as "${listing.name}". It leaves the list when this stops.`
+                : `  Could not reach ${DEFAULT_DIRECTORY}; not listed.`);
+        }
+    }
+    else if (options.publish === "yes" && !publishable_) {
+        console.log("");
+        console.log("  --publish needs an address the world can reach. This machine has none.");
+    }
     const shutdown = () => {
+        rtmp?.stop();
+        channels.stopAll();
+        ingest?.stopRtmp();
+        ingest?.close();
+        broadcaster.stop();
+        void publisher?.stop();
+        closePort?.();
         engine.stop();
         server.close(() => process.exit(0));
         // A hung keep-alive should not outlive a ctrl-c.
@@ -599,12 +1438,72 @@ export async function serve(argv, version = "0.1.0") {
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
 }
+/**
+ * `--rtmp youtube=<key>` or `--rtmp name=rtmp://host/app/key`.
+ *
+ * A key is a password, so it is taken from the command line or the environment
+ * and never from a request: a client that could name its own destination could
+ * point your broadcast at itself.
+ */
+export function parseDestinations(specs) {
+    const out = [];
+    for (const [index, spec] of specs.entries()) {
+        const at = spec.indexOf("=");
+        if (at <= 0)
+            continue;
+        const name = spec.slice(0, at).trim();
+        const rest = spec.slice(at + 1).trim();
+        if (!name || !rest)
+            continue;
+        const preset = PRESETS[name.toLowerCase()];
+        if (preset && !/^rtmps?:\/\//i.test(rest)) {
+            out.push({ id: String(index + 1), name, url: preset, key: rest, enabled: true });
+            continue;
+        }
+        if (!/^rtmps?:\/\//i.test(rest))
+            continue;
+        // A full URL: the last path segment is the key.
+        const cut = rest.lastIndexOf("/");
+        if (cut <= "rtmp://".length)
+            continue;
+        out.push({
+            id: String(index + 1),
+            name,
+            url: rest.slice(0, cut),
+            key: rest.slice(cut + 1),
+            enabled: true,
+        });
+    }
+    return out;
+}
+/**
+ * Which account the signed-in session belongs to. Asked once at startup rather
+ * than trusted from the file: a token that nixamp.com no longer accepts should
+ * not confer ownership of anything.
+ */
+async function ownerIdOf(session) {
+    try {
+        const answer = await fetch(`${session.site}/api/v1/auth/me`, {
+            headers: { authorization: `Bearer ${session.token}` },
+        });
+        if (!answer.ok)
+            return "";
+        const body = (await answer.json());
+        return typeof body.account?.id === "string" ? body.account.id : "";
+    }
+    catch {
+        // Offline at startup means no remote administration until a restart, and
+        // the control key still works. Better than claiming an owner we cannot
+        // check.
+        return "";
+    }
+}
 /** The built PWA, when it is sitting next to us in the same install. */
 function defaultWebDir() {
     const fromEnv = process.env.NIXAMP_WEB_DIR;
     if (fromEnv && isFile(join(fromEnv, "index.html")))
         return fromEnv;
-    const here = new URL(".", import.meta.url).pathname;
+    const here = fileURLToPath(new URL(".", import.meta.url));
     for (const guess of [
         join(here, "..", "web", "dist"),
         join(here, "..", "..", "web", "dist"),