nixamp 0.16.0 → 0.17.0

package/src/server.ts

@@ -45,6 +45,9 @@ import {
   signInFailedPage,
   SignIn,
 } from "./oauth.ts";
+import { AuthorizationServer, clientsFrom } from "./oauth-server.ts";
+import { handleOAuthApi, oauthApiPath } from "./oauth-api.ts";
+import { WatchParties } from "./watch-party.ts";
 import { needsAdmin, needsMember, Owner } from "./owner.ts";
 import { createHash as sha } from "node:crypto";
 import { playJingle } from "./jingle.ts";
@@ -52,7 +55,9 @@ import { stateDir } from "./daemon.ts";
 import { readSession } from "./session.ts";
 import { Directory, ENDED_TTL_MS, parseAnnouncement, type Listing } from "./directory.ts";
 import { PartyLine, telnyxSms } from "./partyline.ts";
-import { HlsPackagers, withKey } from "./hls.ts";
+import { HlsPackagers, segmentType, withKey } from "./hls.ts";
+import { CompressionService } from "./compression/service.ts";
+import { handleChannelCompression, handleCompressionApi, handleStaticRelay, type RouteContext } from "./compression/routes.ts";
 import { DEFAULT_SITE as NICHEDB, Enricher, type EnrichKind, FIXTURE_TTL_MS } from "./enrich.ts";
 import {
   contentTypeFor, downloadArgs, fileNameFor, inputArgsFor, linkChannelId, mergeDownloadArgs, playableLink, resolveLink,
@@ -74,7 +79,8 @@ import { Durable } from "./durable.ts";
 import { notifyAll, resendEmail, webPush, type Notification } from "./notify.ts";
 import { inviteSubject, inviteText, isEmail, isPhone, watchLink } from "./invite.ts";
 import { handleLiveApi } from "./live-api.ts";
-import { LiveEvents, type LiveEvent } from "./live-events.ts";
+import { LiveEvents, eventStructuredData, isTicketed, type LiveEvent } from "./live-events.ts";
+import { Tickets, needsTicket, ticketFrom, ticketsFromEnv } from "./tickets.ts";
 import { Layouts } from "./layouts.ts";
 import { Rooms } from "./rooms.ts";
 import { confirm, DEFAULT_DIRECTORY, Publisher } from "./publish.ts";
@@ -85,8 +91,8 @@ import {
   type PaywallConfig,
   paywallFromEnv,
 } from "./paywall.ts";
-import { isRemote, playsInBrowser, sourceLabel } from "./sources.ts";
-import { codecsOf, probeAsync, videoArgs, type Codecs } from "./audio.ts";
+import { isRemote, isTransportStream, playsInBrowser, sourceLabel } from "./sources.ts";
+import { codecsOf, probeAsync, transportInputArgs, videoArgs, type Codecs } from "./audio.ts";
 import {
   allowedForListening,
   elevate,
@@ -550,11 +556,21 @@ export function toRemoteTracks(tracks: Loaded[]): RemoteTrack[] {
 }
 
 /** Video containers, as opposed to the songs that are most of a library. */
-const PICTURE = new Set([".mp4", ".mkv", ".avi", ".mov", ".m4v", ".webm", ".mpg", ".mpeg", ".wmv", ".flv"]);
+const PICTURE = new Set([
+  ".mp4", ".mkv", ".avi", ".mov", ".m4v", ".webm", ".mpg", ".mpeg", ".wmv", ".flv",
+  // Raw transport streams: a recording off a card, a receiver or an IPTV
+  // dump, which is 1080p or 4K television and was arriving as its own
+  // soundtrack because none of these names were on this list.
+  ".m2ts", ".mts", ".m2t", ".trp", ".tp",
+]);
 
 export function hasPicture(path: string): boolean {
   const dot = path.lastIndexOf(".");
-  return dot > 0 && PICTURE.has(path.slice(dot).toLowerCase());
+  if (dot > 0 && PICTURE.has(path.slice(dot).toLowerCase())) return true;
+  // A `.ts` is a transport stream or a TypeScript file, and only its first
+  // bytes know which. Asked of the file rather than of the name, and the
+  // answer is remembered, because this is asked once per track per listing.
+  return isTransportStream(path);
 }
 
 /**
@@ -1042,6 +1058,22 @@ export interface KnownSource {
 export const PROBE_TRIES = 3;
 export const PROBE_RETRY_MS = 1500;
 
+/**
+ * Whether a channel may carry H.265 as it is.
+ *
+ * A channel has one encode and many viewers, so it has to be something they
+ * can all play, and H.265 is not that: Safari and televisions decode it,
+ * Chrome on a desktop mostly does not and shows nothing rather than saying
+ * so. So an HEVC source is re-encoded by default -- to 1080p H.264, because a
+ * 4K re-encode does not keep up with playback -- and an operator whose
+ * audience is phones and televisions can say `NIXAMP_HEVC_CHANNELS=1` and
+ * have the 4K copied through untouched. A single viewer asking for a file
+ * over /api/media is a different matter: there the browser says for itself.
+ */
+export function hevcChannelsAllowed(env: NodeJS.ProcessEnv = process.env): boolean {
+  return env["NIXAMP_HEVC_CHANNELS"] === "1";
+}
+
 export async function pullChannel(
   channels: Channels,
   ffprobe: string[],
@@ -1092,16 +1124,27 @@ export async function pullChannel(
         // from the first, the sound from the second. With one input ffmpeg
         // picks for itself, as it always did.
         ...(audio ? ["-map", "0:v:0", "-map", "1:a:0"] : []),
-        ...videoArgs(codecs),
+        ...videoArgs(codecs, 0, { allowHevc: hevcChannelsAllowed() }),
       ]
     // No picture in it, so none is invented: MP3 is the thing every browser
     // plays and the thing a listener can join halfway through.
     : ["-vn", "-c:a", "libmp3lame", "-b:a", "192k", "-f", "mp3"];
+  // A transport stream is read further into before it is decoded, and given
+  // the timestamps a recording cut mid-stream does not carry. Ahead of the
+  // caller's own input arguments, which are headers for the address itself.
+  const opening = [...transportInputArgs(source, codecs.container), ...input];
   const channel = channels.pull(
-    id, name, source, encode, kind, true, undefined, input, kind === "video" ? audio : "",
+    id, name, source, encode, kind, true, undefined, opening, kind === "video" ? audio : "",
     { live, position: known.position ?? 0 },
   );
   if (channel && !assumed) channel.info.codecs = codecs;
+  // What comes out, as opposed to what went in. An H.265 source copied
+  // through stays H.265; one re-encoded arrives as H.264, and a packager
+  // told otherwise would cut fMP4 segments for a stream that did not need
+  // them.
+  if (channel && kind === "video") {
+    channel.info.emits = encode.includes("libx264") ? "h264" : codecs.video || "h264";
+  }
   return channel;
 }
 
@@ -1220,6 +1263,10 @@ export function isSignInPath(path: string): boolean {
     // Public to read, so it must not be behind a share key either.
     path === "/api/v1/opendirs" ||
     path.startsWith("/api/v1/opendirs/") ||
+    // nixamp as an authorization server: a client arriving here has no share
+    // key and is not asking for one, and the metadata document is public by
+    // the RFC that defines where it lives.
+    oauthApiPath(path) ||
     OAUTH_ROUTE.test(path)
   );
 }
@@ -1242,29 +1289,34 @@ function htmlText(value: string): string {
     .replaceAll("'", "'");
 }
 
+/**
+ * Whose site this shell belongs to.
+ *
+ * Read from the page rather than hard-coded, because one NixAmp serves several
+ * branded clients and each brings its own head. og:site_name first, then the
+ * part of the title before the dash, then the hostname.
+ */
+export function brandOf(shell: string, site: string): string {
+  const named = /<meta\s+property="og:site_name"\s+content="([^"]+)"/i.exec(shell);
+  if (named?.[1]) return named[1];
+  const titled = /<title>([^<]*)<\/title>/i.exec(shell);
+  const head = titled?.[1]?.split(/\s[—-]\s/)[0]?.trim();
+  if (head) return head;
+  try {
+    return new URL(site).hostname.replace(/^www\./, "");
+  } catch {
+    return "NixAmp";
+  }
+}
+
 function eventDocument(shell: string, event: Awaited<ReturnType<LiveEvents["get"]>>, site: string): string {
   if (!event) return shell;
-  const title = `${event.title} — BackToSchool.help`;
-  const description = event.description || `Listen to ${event.title} live on BackToSchool.help.`;
+  const brand = brandOf(shell, site);
+  const title = `${event.title} — ${brand}`;
+  const kindWord = event.kind === "concert" ? "Watch" : "Listen to";
+  const description = event.description || `${kindWord} ${event.title} live on ${brand}.`;
   const canonical = `${site.replace(/\/$/, "")}/live/${encodeURIComponent(event.slug)}`;
-  const structured = JSON.stringify({
-    "@context": "https://schema.org",
-    "@type": "Event",
-    name: event.title,
-    description,
-    eventStatus: event.status === "cancelled"
-      ? "https://schema.org/EventCancelled"
-      : event.status === "live"
-        ? "https://schema.org/EventInProgress"
-        : event.status === "ended"
-          ? "https://schema.org/EventCompleted"
-          : "https://schema.org/EventScheduled",
-    eventAttendanceMode: "https://schema.org/OnlineEventAttendanceMode",
-    ...(event.startsAt ? { startDate: event.startsAt } : {}),
-    ...(event.endsAt ? { endDate: event.endsAt } : {}),
-    url: canonical,
-    location: { "@type": "VirtualLocation", url: canonical },
-  }).replaceAll("<", "\\u003c");
+  const structured = JSON.stringify(eventStructuredData(event, canonical)).replaceAll("<", "\\u003c");
   return shell
     .replace(/<title>.*?<\/title>/s, `<title>${htmlText(title)}</title>`)
     .replace(/<meta name="description" content="[^"]*"\s*\/>/, `<meta name="description" content="${htmlText(description)}" />`)
@@ -1316,6 +1368,8 @@ export interface HandlerOptions {
   ytdlp?: string[] | null;
   /** Channels as HLS, for Safari on a phone, which plays a live stream no other way. */
   hls?: HlsPackagers;
+  /** Lossless relay compression, its policies, diagnostics and static representations. */
+  compression?: CompressionService;
   /** What a name is -- a film, a channel, a fixture -- asked of nichedb.dev and remembered. */
   enricher?: Enricher;
   /** A Netscape cookies file for sites that want a signed-in browser, when there is one. */
@@ -1440,6 +1494,16 @@ export interface HandlerOptions {
   layouts?: Layouts;
   /** Persistent participation state that must not be coupled to live audio. */
   rooms?: Rooms;
+  /** Tickets: a paid pass to one event's room. Absent means every show is free. */
+  tickets?: Tickets;
+  /**
+   * nixamp as an OAuth 2.1 authorization server, so another site can act on
+   * an account here. nixamp.com only: a nixamp on a laptop keeps no accounts
+   * and so has nobody to authorize.
+   */
+  authServer?: AuthorizationServer;
+  /** Watch parties bridged from a client site into nixamp rooms. */
+  parties?: WatchParties;
   /**
    * How an invite is sent: by email, by text, and the site the watch link is
    * built on. nixamp.com only; a personal nixamp has no mail to send from.
@@ -1514,6 +1578,24 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       }
       return channelEvent;
     };
+    // What the compression routes need from this handler: how to answer,
+    // how to count a stream, and whether this caller holds the controls.
+    const compressionCtx = (): RouteContext | null =>
+      options.compression
+        ? {
+            service: options.compression,
+            json,
+            readBody: (incoming) => readBody(incoming),
+            cors: CORS,
+            watch: (incoming, outgoing, track) => watch(incoming, outgoing, "stream", track),
+            controls: async () => {
+              if (key === null) return true;
+              if (scopeOf(keyFrom(request, url), key, null) === "control") return true;
+              if (options.owner) return (await options.owner.check(false, tokenFrom(request.headers))).allowed;
+              return false;
+            },
+          }
+        : null;
 
     if (request.method === "OPTIONS") {
       response.writeHead(204, CORS);
@@ -1555,11 +1637,23 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       return;
     }
 
+    // nixamp as an authorization server, and the watch parties that pairing
+    // exists for. Before the share-key check for the same reason sign-in is:
+    // a client site holds an account's token, never a server's key.
+    if (options.authServer && options.accounts && await handleOAuthApi(request, response, url, {
+      server: options.authServer,
+      accounts: options.accounts,
+      ...(options.parties ? { parties: options.parties } : {}),
+      ...(options.handles ? { handles: options.handles } : {}),
+      secureCookies: options.secureCookies ?? false,
+    })) return;
+
     if (options.events && await handleLiveApi(request, response, url, {
       events: options.events,
       ...(options.accounts ? { accounts: options.accounts } : {}),
       ...(options.layouts ? { layouts: options.layouts } : {}),
       ...(options.rooms ? { rooms: options.rooms } : {}),
+      ...(options.tickets ? { tickets: options.tickets } : {}),
       ...(options.invites?.site ? { site: options.invites.site } : {}),
       ...(options.invites?.email ? { email: options.invites.email } : {}),
     })) return;
@@ -3011,7 +3105,11 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         watch(request, response, "stream", entry.title);
         const codecs = await codecsOf({ ffmpeg: [], ffprobe: options.ffprobe ?? ["ffprobe"], play: null }, entry.source);
         if (codecs.video !== "") {
-          pipeFfmpeg(request, response, entry.source, options.ffmpeg ?? ["ffmpeg"], videoArgs(codecs), "video/mp4");
+          pipeFfmpeg(
+            request, response, entry.source, options.ffmpeg ?? ["ffmpeg"],
+            videoArgs(codecs, 0, { allowHevc: url.searchParams.get("hevc") === "1" }), "video/mp4",
+            transportInputArgs(entry.source, codecs.container),
+          );
         } else {
           transcode(request, response, entry.source, options.ffmpeg ?? ["ffmpeg"]);
         }
@@ -3246,6 +3344,12 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
     // A channel is one publisher and everybody listening to them. Two or three
     // devices can publish at once, each to their own channel, and a listener
     // picks which to hear.
+    // The server's compression at a glance, its switch, and the analyses.
+    if (path.startsWith("/api/compression")) {
+      const compression = compressionCtx();
+      if (compression && (await handleCompressionApi(request, response, compression, path))) return;
+    }
+
     if (path === "/api/channels" && options.channels) {
       // Without the source. Anyone holding the listen link may ask what is
       // on, and the address a channel is pulled from is the one thing about
@@ -3273,17 +3377,40 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
             json(response, 404, { error: "nothing is playing on that channel" });
             return;
           }
-        } else if (!options.events!.canManage(event, account?.id)) {
-          json(response, account ? 403 : 401, { error: account ? "only the event host can publish here" : "sign in to host this event" });
+          // A ticketed room is the one place a 402 belongs on the media
+          // itself: there is a thing to buy, it is this, and the answer says
+          // what it costs rather than pretending the room is not there.
+          if (isTicketed(event)) {
+            const held = await options.tickets?.holds(event, ticketFrom(request.headers, url)) ?? false;
+            if (needsTicket(event, account?.id, held)) {
+              json(response, 402, {
+                error: `${event.title} is a ticketed show.`,
+                ticket: options.tickets?.offer(event) ?? {
+                  ticketed: true,
+                  priceCents: event.ticketPriceCents,
+                  currency: event.ticketCurrency,
+                },
+              });
+              return;
+            }
+          }
+        } else if (!options.events!.canPerform(event, account?.id)) {
+          json(response, account ? 403 : 401, { error: account ? "only the people on this stage can publish here" : "sign in to host this event" });
           return;
         } else if (request.method === "POST" &&
                    (action === undefined || action === "chunk") &&
-                   event.status !== "live") {
+                   event.status !== "live" && event.status !== "encore") {
           json(response, 409, { error: "start the event before publishing audio" });
           return;
         }
       }
 
+      // Its compression policy, an analysis of it, and its relay to or from
+      // another nixamp. The ordinary playback URL above is untouched by any
+      // of it: a relay is a different media type on a different path.
+      const compression = compressionCtx();
+      if (compression && (await handleChannelCompression(request, response, compression, id, action, file))) return;
+
       // The same channel as HLS: a playlist of short files, which is what
       // Safari on an iPhone plays live -- it will not take the endless MP4
       // below, and spun on it a few times before giving up. Packaged on
@@ -3298,7 +3425,10 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
           return;
         }
         if (file === "index.m3u8") {
-          const playlist = await options.hls.playlist(id);
+          // A channel carrying H.265 is cut into fMP4 rather than transport
+          // segments: HLS in TS is defined for H.264 only, and Safari plays
+          // an HEVC channel packaged as TS as sound over a black screen.
+          const playlist = await options.hls.playlist(id, channels.info(id)?.emits === "hevc");
           if (playlist === null) {
             json(response, 503, { error: "that channel could not be packaged as HLS yet; try again in a moment" });
             return;
@@ -3321,7 +3451,8 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         watch(request, response, "stream", id);
         response.writeHead(200, {
           ...CORS,
-          "content-type": "video/mp2t",
+          // By its name: a TS segment, an fMP4 media segment, or the init.
+          "content-type": segmentType(file ?? ""),
           "cache-control": "no-store",
           "content-length": statSync(segment).size,
         });
@@ -3365,14 +3496,17 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       }
 
       if (action === undefined && request.method === "DELETE") {
-        // Asked once: the second call would answer false, having just stopped
-        // the thing it was asking about.
         // A member takes off what they put on, and nothing else.
         if (liveBy && channels.info(id)?.startedBy !== liveBy) {
           json(response, 403, { error: "that stream is not yours to take off" });
           return;
         }
-        const stopped = channels.stop(id);
+        // A channel fed by another nixamp's relay is taken off by stopping
+        // the relay, which takes the channel with it; otherwise it would
+        // dial again the moment the channel went. Asked once either way:
+        // the second call would answer false, having just stopped the
+        // thing it was asking about.
+        const stopped = (options.compression?.stopPull(id) ?? false) || channels.stop(id);
         // Taken off on purpose is forgotten on purpose: it must not come back
         // at the next restart.
         if (stopped) {
@@ -3380,7 +3514,7 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
           // Off the air is news too: told now, so the directory drops it
           // rather than listing it until the next heartbeat.
           void options.live?.announce?.();
-          if (event && event.status === "live") {
+          if (event && (event.status === "live" || event.status === "encore")) {
             await options.events?.transition(event.id, event.ownerId, "ended", event.version).catch(() => undefined);
           }
         }
@@ -3883,6 +4017,30 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       return;
     }
 
+    // A library file in the relay envelope: the same bytes as /api/media/N,
+    // framed and compressed once and kept. The original stays where it is
+    // and keeps answering ranges; this cannot be asked for one.
+    const staticRelay = /^\/api\/media\/(\d+)\/relay$/.exec(path);
+    if (staticRelay && request.method === "GET") {
+      const compression = compressionCtx();
+      if (!compression) {
+        json(response, 503, { error: "this server keeps no relay representations" });
+        return;
+      }
+      if (!options.media) {
+        json(response, 403, { error: "media streaming is off" });
+        return;
+      }
+      const index = Number(staticRelay[1]);
+      const file = engine.trackPath(index);
+      if (file === undefined) {
+        json(response, 404, { error: "no such track" });
+        return;
+      }
+      handleStaticRelay(request, response, compression, file, engine.snapshot().tracks?.[index]?.title ?? file);
+      return;
+    }
+
     if (path.startsWith("/api/media/")) {
       if (!options.media) {
         json(response, 403, { error: "media streaming is off" });
@@ -3904,6 +4062,11 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       // and above 20 megabits the original was always the better answer.
       const asked = Number(url.searchParams.get("kbps") ?? "");
       const capKbps = Number.isFinite(asked) && asked > 0 ? Math.min(20_000, Math.max(200, asked)) : 0;
+      // Whether this browser decodes H.265, which only it can know: Safari and
+      // televisions do, Chrome on a desktop does not and says nothing when
+      // handed it. Copying a 4K HEVC film is free; re-encoding one does not
+      // keep up with playing it, so the answer is worth carrying in the URL.
+      const allowHevc = url.searchParams.get("hevc") === "1";
 
       if (playsInBrowser(file) && capKbps === 0) {
         sendFile(request, response, file);
@@ -3922,7 +4085,11 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
           // added by an older nixamp goes to an audio element for ever, and
           // the only cure is noticing and adding it again.
           engine.sawPicture(index);
-          pipeFfmpeg(request, response, file, options.ffmpeg ?? ["ffmpeg"], videoArgs(codecs, capKbps), "video/mp4");
+          pipeFfmpeg(
+            request, response, file, options.ffmpeg ?? ["ffmpeg"],
+            videoArgs(codecs, capKbps, { allowHevc }), "video/mp4",
+            transportInputArgs(file, codecs.container),
+          );
           return;
         }
       }
@@ -4240,6 +4407,12 @@ function pipeFfmpeg(
   ffmpeg: string[],
   outputArgs: string[],
   contentType: string,
+  /**
+   * What to say before the input is opened. A transport stream needs telling
+   * how far to read before it decides what is in it, and to make up the
+   * timestamps a recording cut mid-stream does not have.
+   */
+  inputArgs: string[] = [],
 ): void {
   const [command, ...prefix] = ffmpeg as [string, ...string[]];
   const child = spawn(
@@ -4252,6 +4425,7 @@ function pipeFfmpeg(
       // belong to the http protocol, and ffmpeg rejects the whole command
       // when they are handed to it for a file on disk.
       ...(isRemote(source) ? ["-reconnect", "1", "-reconnect_streamed", "1", "-reconnect_delay_max", "5"] : []),
+      ...inputArgs,
       "-i", source,
       ...outputArgs,
       "-",
@@ -4469,10 +4643,22 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     cacheFile: join(stateDir(), "enrich.json"),
     onEvent: (message) => console.log(message),
   });
+  // Off unless a policy says otherwise: every channel plays exactly as it
+  // did, and a relay is a thing another nixamp asks for by name.
+  const compression = new CompressionService({
+    channels,
+    stateDir: stateDir(),
+    port: options.port,
+    ffprobe: tools.ffprobe,
+    cacheDir: join(stateDir(), "relay-cache"),
+    onEvent: (message) => console.log(message),
+  });
   const hls = new HlsPackagers({
     ffmpeg: tools.ffmpeg,
     listen: (id, listener) => channels.listen(id, listener),
     onEvent: (message) => console.log(message),
+    // TS unless the channel's policy, or the server's, asks for fMP4.
+    packaging: (id) => compression.packagingOf(id),
   });
 
   // The channels this server was carrying when it was last stopped, put back
@@ -4536,9 +4722,67 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
       : undefined;
   const follows = pool ? new Follows(pool) : undefined;
   const favorites = pool ? new Favorites(pool) : undefined;
+  const nixampSite = (process.env["NIXAMP_SITE"] ?? DEFAULT_DIRECTORY).replace(/\/+$/, "");
   const events = pool ? new LiveEvents(pool) : undefined;
   const layouts = pool ? new Layouts(pool) : undefined;
   const rooms = pool ? new Rooms(pool) : undefined;
+  // Tickets need somewhere for the money to go and a key to settle it with.
+  // Without a CoinPay key every event is simply a free one.
+  const ticketConfig = events
+    ? ticketsFromEnv(process.env["NIXAMP_SITE"] ?? DEFAULT_DIRECTORY)
+    : null;
+  const tickets = ticketConfig ? new Tickets(ticketConfig) : undefined;
+
+  // Accounts live where the directory lives, and only there: a nixamp on a
+  // laptop has nobody to be an account of. Made here rather than inline in
+  // the handler options because the authorization server issues its access
+  // tokens out of the same table -- an OAuth token IS a nixamp token with a
+  // client's name on it, which is why every existing route understands one.
+  const accounts =
+    options.directory && process.env["DATABASE_URL"]
+      ? new Accounts({
+          connectionString: process.env["DATABASE_URL"],
+          secret: process.env["NIXAMP_JWT_SECRET"] ?? "",
+        })
+      : undefined;
+
+  // nixamp as an OAuth 2.1 authorization server, and the watch parties a
+  // client site bridges through it. Both need the same three things -- a
+  // database, accounts, and a site to be the issuer of -- so both appear or
+  // neither does.
+  const authServer =
+    pool && accounts?.tokens
+      ? new AuthorizationServer({
+          db: pool,
+          tokens: accounts.tokens,
+          clients: clientsFrom(process.env),
+          issuer: nixampSite,
+        })
+      : undefined;
+  const parties =
+    pool && events && authServer
+      ? new WatchParties({
+          db: pool,
+          events,
+          site: nixampSite,
+          // A client may only point a watch link at its own site, which is
+          // read off the redirect URIs it registered rather than configured
+          // twice. Without it, "come and watch" could be sent anywhere.
+          hostsFor: (origin) => {
+            const client = authServer.client(origin);
+            if (!client) return [];
+            const hosts = new Set<string>();
+            for (const uri of client.redirectUris) {
+              try {
+                hosts.add(new URL(uri).hostname);
+              } catch {
+                // A malformed registration names no host, which allows none.
+              }
+            }
+            return [...hosts];
+          },
+        })
+      : undefined;
 
   // Names and certificates for signed-in servers, and the rate limit over
   // everything. All of it is nixamp.com's business: the DNS keys live only
@@ -4579,6 +4823,12 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
           { path: "/api/v1/invite", limit: 10 },
           { path: "/api/v1/dns", limit: 30 },
           { path: "/api/v1/certs", limit: 30 },
+          // A token endpoint is where a stolen code or refresh token would be
+          // tried, so it is address-bucketed: a client presenting its own id
+          // must not get the credentialed budget to guess with.
+          { path: "/api/v1/oauth/token", limit: 30, credential: false },
+          { path: "/api/v1/oauth/", limit: 60, credential: false },
+          { path: "/api/v1/watch-parties", limit: 60 },
           { path: "/api/health", open: true },
           { path: "/api/directory", limit: 120 },
         ],
@@ -4869,6 +5119,7 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     ytdlp: tools.ytdlp ?? null,
     cookies: cookiesFile(),
     hls,
+    compression,
     enricher,
     ...(tls ? { tls } : {}),
     // Untagged, so a directory of five thousand files answers at once; the
@@ -4881,6 +5132,9 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     ...(events ? { events } : {}),
     ...(layouts ? { layouts } : {}),
     ...(rooms ? { rooms } : {}),
+    ...(tickets ? { tickets } : {}),
+    ...(authServer ? { authServer } : {}),
+    ...(parties ? { parties } : {}),
     // Invites go out the same way follow notifications do, and only from a
     // site that has somebody to send them for.
     ...(pool
@@ -4915,12 +5169,9 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     ...(partyLine ? { partyLine } : {}),
     // Accounts live where the directory lives, and only there: a nixamp on a
     // laptop has nobody to be an account of.
-    ...(options.directory && process.env["DATABASE_URL"]
+    ...(accounts
       ? {
-          accounts: new Accounts({
-            connectionString: process.env["DATABASE_URL"],
-            secret: process.env["NIXAMP_JWT_SECRET"] ?? "",
-          }),
+          accounts,
           secureCookies: (process.env["NIXAMP_SITE"] ?? "").startsWith("https://"),
           // A deployment reached over https is one behind somebody's proxy, so
           // the socket address is that proxy and the forwarded header is the
@@ -5318,6 +5569,7 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
   const shutdown = (): void => {
     rtmp?.stop();
     enricher.save();
+    compression.stopAll();
     hls.stopAll();
     channels.stopAll();
     ingest?.stopRtmp();