nixamp 0.17.0 → 0.18.0

package/dist/compression/service.js

@@ -8,7 +8,7 @@
  * translates flags into the routes. There is no second copy of the rules.
  */
 import { statSync } from "node:fs";
-import { codecsOf } from "../audio.js";
+import { codecsOf, videoArgs } from "../audio.js";
 import { GIVE_UP, REDIAL } from "../channels.js";
 import { analyzeSample, SAMPLE_MAX_BYTES, SAMPLE_MAX_SECONDS } from "./analyze.js";
 import { Pool } from "./codec.js";
@@ -16,8 +16,9 @@ import { RelayError } from "./envelope.js";
 import { AnalysisJobs } from "./jobs.js";
 import { ChannelMetrics } from "./metrics.js";
 import { variantOf } from "./policy.js";
-import { receiveRelay, RelayRefused } from "./receiver.js";
+import { probeRelay, receiveRelay, RelayRefused } from "./receiver.js";
 import { RelayEncoder } from "./relay.js";
+import { relayThrough, sourceThrough, unreadable } from "./source.js";
 import { PolicyStore } from "./store.js";
 import { StaticCache } from "./static.js";
 /** The pseudo-channel whose policy governs static file representations. */
@@ -59,7 +60,17 @@ export async function analyzeFile(path, options = {}) {
         ...(ffprobe ? { ffprobeVersion: ffprobe.join(" ") } : {}),
     });
 }
-/** An incoming relay: this server as the receiver, dialling again when it drops. */
+/**
+ * An incoming relay: this server as the receiver.
+ *
+ * Two shapes, decided by what the sender says it carries. A channel-boundary
+ * relay is the sender's finished output, so it is fed straight into a
+ * channel here and dialled again by this class when it drops. A
+ * source-boundary relay is the original transport stream, so it is handed
+ * to a channel's own ffmpeg as a source read through us -- which plays it
+ * exactly as the sender would have, lets it be relayed on again, and puts
+ * the redialling in the channel where it already lives.
+ */
 class Incoming {
     id;
     from;
@@ -182,7 +193,25 @@ export class CompressionService {
         this.statics = options.cacheDir
             ? new StaticCache(options.cacheDir, { pool: this.pool, ...(options.maxCacheBytes !== undefined ? { maxBytes: options.maxCacheBytes } : {}) })
             : null;
+        // Whether a pulled source is read here rather than by ffmpeg, decided at
+        // every dial: only when the channel's policy asks for the source boundary
+        // and the source is one we can read exactly (a plain transport stream).
+        // A channel we brought in from another nixamp's source-boundary relay is
+        // itself read through us, so it can be relayed on.
+        this.channels.setThrough((info, from, input, audio) => {
+            const relayed = this.relaySource.get(info.id);
+            if (relayed)
+                return relayThrough(relayed.from, relayed.key);
+            const policy = this.store.get(info.id).losslessCompression;
+            if (policy.mode === "off" || policy.boundary !== "source")
+                return null;
+            if (unreadable(info, from, input, audio) !== null)
+                return null;
+            return sourceThrough(info.source ?? "");
+        });
     }
+    /** Incoming source-boundary relays, so their channel is read through us. */
+    relaySource = new Map();
     get channels() {
         return this.options.channels;
     }
@@ -197,8 +226,15 @@ export class CompressionService {
             reason = "compression is off for the whole server";
         }
         else if (lossless.mode !== "off" && lossless.boundary === "source") {
-            lossless.mode = "off";
-            reason = "original source bytes are unavailable: this server's sources are read by ffmpeg, and only the channel boundary can be relayed";
+            // The source boundary is available only for a source we can read here.
+            // A live channel that is not read through us cannot offer it; a channel
+            // that is not on yet is given the benefit of the doubt until it is.
+            const info = this.channels.info(id);
+            const why = info ? unreadable(info, 0, [], "") : null;
+            if (why !== null) {
+                lossless.mode = "off";
+                reason = `original source bytes are unavailable: ${why}`;
+            }
         }
         return {
             losslessCompression: lossless,
@@ -290,7 +326,9 @@ export class CompressionService {
         }
         // A receiver that cannot undo the transform gets a variant without it.
         const variantPolicy = { ...policy, tsAware: policy.tsAware && codecs.includes("ts-zstd") };
-        const variant = variantOf(variantPolicy);
+        // The boundary is part of the variant: a source relay and a channel
+        // relay are two different streams, and two different compressors.
+        const variant = `${policy.boundary}:${variantOf(variantPolicy)}`;
         let running = this.running.get(id);
         if (running && running.variant !== variant) {
             // One compressor per channel. A second variant would be a second
@@ -298,17 +336,31 @@ export class CompressionService {
             return { ok: false, status: 409, code: "VARIANT_IN_USE", error: "this channel is already being relayed under a different codec set; try again when that relay ends" };
         }
         if (!running) {
-            const started = this.startEncoder(id, variantPolicy, variant);
-            if (!started)
-                return { ok: false, status: 503, code: "CHANNEL_GONE", error: "the channel ended before the relay could start" };
+            const started = this.startEncoder(id, variantPolicy, variant, policy.boundary);
+            if (!started) {
+                return started === null
+                    ? { ok: false, status: 503, code: "CHANNEL_GONE", error: "the channel ended before the relay could start" }
+                    : { ok: false, status: 409, code: "SOURCE_BOUNDARY_UNAVAILABLE", error: "the source is not being read through this server, so its original bytes are not available to relay" };
+            }
             running = started;
         }
-        // The opening bytes and the join point, in the same tick.
-        const preface = this.channels.opening(id);
+        // For the channel boundary, the opening bytes are the preface. The source
+        // boundary has none: a joining demuxer re-syncs on the next PAT and
+        // keyframe, exactly as it does when a live source is joined.
+        const preface = policy.boundary === "source" ? [] : this.channels.opening(id);
         const session = running.encoder.join(listener, preface);
-        return { ok: true, session, codecs, generation: running.encoder.generation, kind: this.channels.kindOf(id) ?? "" };
+        return {
+            ok: true,
+            session,
+            codecs,
+            generation: running.encoder.generation,
+            kind: this.channels.kindOf(id) ?? "",
+            boundary: policy.boundary,
+            media: this.channels.info(id)?.codecs ?? null,
+        };
     }
-    startEncoder(id, policy, variant) {
+    /** Null: the channel ended. False: the source boundary was asked for but is not being read through us. */
+    startEncoder(id, policy, variant, boundary) {
         this.generation = (this.generation + 1) % 0xffff_ffff;
         const metrics = this.metrics.get(id) ?? new ChannelMetrics();
         this.metrics.set(id, metrics);
@@ -318,7 +370,7 @@ export class CompressionService {
             policy,
             pool: this.pool,
             metrics,
-            boundary: "channel",
+            boundary,
             onAbort: () => {
                 if (record && this.running.get(id) === record) {
                     this.running.delete(id);
@@ -335,24 +387,61 @@ export class CompressionService {
                 }
             },
         });
-        const detach = this.channels.listen(id, {
+        const face = {
             write: (chunk) => encoder.write(chunk),
             end: () => encoder.end(),
             pending: () => metrics.queueBytes,
-        });
+        };
+        // The source boundary taps the source's own bytes; the channel boundary
+        // is one more ordinary listener on the channel's output.
+        const detach = boundary === "source" ? this.channels.tapSource(id, face) : this.channels.listen(id, face);
         if (detach === null)
-            return null;
+            return boundary === "source" ? false : null;
         encoder.attach();
         record = { encoder, detach, variant };
         this.running.set(id, record);
         return record;
     }
-    /** Start listening to another nixamp's channel as one of ours. */
-    pull(id, from, key, name) {
+    /**
+     * Start listening to another nixamp's channel as one of ours. Probes the
+     * relay first to learn its boundary: a channel-boundary relay is decoded
+     * and its bytes are the channel's output directly; a source-boundary relay
+     * is the original transport stream, so it is read through ffmpeg here
+     * exactly as a pulled source would be, and can be relayed on again.
+     */
+    async pull(id, from, key, name) {
         if (!/^https?:\/\//i.test(from))
             return { ok: false, status: 400, error: "the relay address must be http or https" };
         if (this.channels.has(id) || this.incoming.has(id))
             return { ok: false, status: 409, error: `channel "${id}" is already on` };
+        let accepted;
+        try {
+            accepted = await probeRelay(from, key);
+        }
+        catch (error) {
+            const message = error instanceof RelayRefused ? `the relay refused: ${error.message}` : error.message;
+            return { ok: false, status: 502, error: message };
+        }
+        if (accepted.boundary === "source") {
+            // The upstream sends the original transport stream. Read it through
+            // ffmpeg here: the through-provider sees this registration and hands
+            // ffmpeg the decoded bytes. It can then be relayed on at either
+            // boundary, since its source now passes through this process.
+            const media = accepted.media;
+            const kind = accepted.kind === "audio" ? "audio" : "video";
+            const encode = kind === "video"
+                ? videoArgs(media ?? { video: "h264", audio: "aac", container: "mpegts" })
+                : ["-vn", "-c:a", "libmp3lame", "-b:a", "192k", "-f", "mp3"];
+            this.relaySource.set(id, { from, key });
+            // A placeholder source string: the through-provider supplies the bytes,
+            // so this is only what a listener would never see and a restart reads.
+            const channel = this.channels.pull(id, name, from, encode, kind, true, undefined, [], "", { live: true, position: 0 }, media ?? undefined);
+            if (!channel) {
+                this.relaySource.delete(id);
+                return { ok: false, status: 409, error: `channel "${id}" is already on` };
+            }
+            return { ok: true };
+        }
         const inbound = new Incoming(id, from, key, name, this.channels, this.options.onEvent ?? (() => undefined), (gone) => this.incoming.delete(gone));
         this.incoming.set(id, inbound);
         inbound.start();
@@ -360,6 +449,8 @@ export class CompressionService {
     }
     /** Stop an incoming relay, and the channel it feeds. */
     stopPull(id) {
+        if (this.relaySource.delete(id))
+            return this.channels.stop(id);
         const inbound = this.incoming.get(id);
         if (!inbound)
             return false;

package/dist/compression/source.d.ts

@@ -0,0 +1,17 @@
+import type { ChannelInfo, PullThrough } from "../channels.ts";
+/** The reason a source cannot be read here, or null when it can. */
+export declare function unreadable(info: ChannelInfo, from: number, input: string[], audio: string): string | null;
+/** Open a plain URL or a file as a stream of bytes, pulled shut by the signal. */
+export declare function openSource(source: string, signal: AbortSignal): Promise<AsyncIterable<Uint8Array>>;
+/** A transport-stream source read by us, for `Channels.setThrough`. */
+export declare function sourceThrough(source: string): PullThrough;
+/**
+ * A relay's decoded bytes as an async iterable, at the pace ffmpeg takes
+ * them. The decoder is asked to wait when too much is queued, which holds
+ * the socket read, which is backpressure all the way to the sender's
+ * per-listener queue. A clean end ends the iterable; a broken stream
+ * throws, and the channel's own redial dials again.
+ */
+export declare function relayBytes(url: string, key: string | null, signal: AbortSignal): AsyncGenerator<Buffer>;
+/** A source-boundary relay from another nixamp, as a source ffmpeg reads through us. */
+export declare function relayThrough(url: string, key: string | null): PullThrough;

package/dist/compression/source.js

@@ -0,0 +1,131 @@
+/**
+ * Reading a source ourselves, so its bytes exist here to be relayed.
+ *
+ * ffmpeg normally dials a channel's source and the original bytes never
+ * pass through this process. For a source-boundary relay they have to.
+ * This is the narrow set of sources that can be read here and piped to
+ * ffmpeg without changing how they play: a transport stream from a plain
+ * http(s) URL or a file, from its beginning, with no special request
+ * headers and no separate sound file. Anything else is left to ffmpeg,
+ * and a relay that asks for its source boundary is told why not.
+ *
+ * The second half is the receiving end of a source-boundary relay: the
+ * decoded original bytes, made into a source ffmpeg can be handed the
+ * same way, so a relayed transport stream plays here exactly as the
+ * original would have, and can be relayed on again.
+ */
+import { createReadStream, statSync } from "node:fs";
+import { receiveRelay } from "./receiver.js";
+/**
+ * ffmpeg input flags that carry per-request authentication a plain fetch
+ * would not send: a user agent, a referer, cookies, arbitrary headers. A
+ * source that needs any of these is ffmpeg's to dial. Transport demux
+ * tuning (`-probesize`, `-analyzeduration`, `-fflags`) is not on this list:
+ * it applies to a piped read too and is no reason to refuse the tee.
+ */
+const HEADER_FLAGS = new Set(["-headers", "-user_agent", "-user-agent", "-referer", "-cookies", "-icy", "-http_proxy", "-http_persistent"]);
+/** The reason a source cannot be read here, or null when it can. */
+export function unreadable(info, from, input, audio) {
+    const source = info.source ?? "";
+    if (info.via !== "pull" || source === "")
+        return "only a source this server pulls can be read here";
+    const container = info.codecs?.container ?? "";
+    if (!container.split(",").includes("mpegts"))
+        return `the source is ${container || "of unknown container"}, not a transport stream`;
+    if (input.some((arg) => HEADER_FLAGS.has(arg)))
+        return "the source needs request headers ffmpeg sends and nixamp does not";
+    if (audio !== "")
+        return "the source keeps its sound in a second file";
+    if (from > 0)
+        return "a film picked up mid-way cannot be read from its start";
+    if (/^https?:\/\//i.test(source))
+        return null;
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(source))
+        return "only http(s) URLs and files can be read here";
+    try {
+        if (!statSync(source).isFile())
+            return "the source is not a file";
+    }
+    catch {
+        return "the source file cannot be read";
+    }
+    return null;
+}
+/** Open a plain URL or a file as a stream of bytes, pulled shut by the signal. */
+export async function openSource(source, signal) {
+    if (/^https?:\/\//i.test(source)) {
+        const response = await fetch(source, { signal, redirect: "follow", headers: { "user-agent": "nixamp" } });
+        if (!response.ok || !response.body)
+            throw new Error(`the source answered ${response.status}`);
+        return response.body;
+    }
+    const stream = createReadStream(source, { highWaterMark: 256 * 1024 });
+    signal.addEventListener("abort", () => stream.destroy(), { once: true });
+    return stream;
+}
+/** A transport-stream source read by us, for `Channels.setThrough`. */
+export function sourceThrough(source) {
+    return { format: "mpegts", open: (signal) => openSource(source, signal) };
+}
+/** How many decoded bytes may wait for ffmpeg before the relay is asked to pause. */
+const RELAY_QUEUE = 8 * 1024 * 1024;
+/**
+ * A relay's decoded bytes as an async iterable, at the pace ffmpeg takes
+ * them. The decoder is asked to wait when too much is queued, which holds
+ * the socket read, which is backpressure all the way to the sender's
+ * per-listener queue. A clean end ends the iterable; a broken stream
+ * throws, and the channel's own redial dials again.
+ */
+export async function* relayBytes(url, key, signal) {
+    const queue = [];
+    let queued = 0;
+    let wake = null;
+    let room = null;
+    let done = false;
+    let failure = null;
+    void receiveRelay({
+        url,
+        key,
+        signal,
+        onBytes: async (bytes) => {
+            queue.push(bytes);
+            queued += bytes.length;
+            wake?.();
+            wake = null;
+            if (queued > RELAY_QUEUE)
+                await new Promise((resume) => { room = resume; });
+        },
+    }).then(() => {
+        done = true;
+        wake?.();
+    }, (error) => {
+        failure = error;
+        done = true;
+        wake?.();
+    });
+    for (;;) {
+        const next = queue.shift();
+        if (next) {
+            queued -= next.length;
+            // Captured into a local: `room` is only ever assigned inside a callback,
+            // which the compiler cannot see, so it would narrow the field to null.
+            const resume = room;
+            if (resume && queued <= RELAY_QUEUE / 2) {
+                resume();
+                room = null;
+            }
+            yield next;
+            continue;
+        }
+        if (done) {
+            if (failure)
+                throw failure;
+            return;
+        }
+        await new Promise((resume) => { wake = resume; });
+    }
+}
+/** A source-boundary relay from another nixamp, as a source ffmpeg reads through us. */
+export function relayThrough(url, key) {
+    return { format: "mpegts", open: async (signal) => relayBytes(url, key, signal) };
+}

package/dist/links.js

@@ -146,6 +146,14 @@ export function parseResolved(json, page) {
     }
     if (media === "")
         return null;
+    // A link that was the media all along -- an IPTV feed at /channel/906,
+    // with no extension to say so -- is answered by yt-dlp's generic
+    // extractor with wherever the feed redirected to, which for a panel is a
+    // second host and a token minted for that one request. ffmpeg follows a
+    // redirect itself, so the link is kept as pasted and every redial gets a
+    // fresh token instead of a 403 an hour in.
+    if (record["direct"] === true && parts.length === 0 && /^https?:\/\//i.test(page))
+        media = page;
     const title = typeof record["title"] === "string" && record["title"].trim() !== ""
         ? record["title"].trim().slice(0, 200)
         : fileNameOf(page);
@@ -269,9 +277,12 @@ export const RESOLVE_TIMEOUT_MS = 60_000;
 export async function resolveLink(ytdlp, url, options = {}) {
     if (isDirectMedia(url))
         return directLink(url);
-    if (!ytdlp || ytdlp.length === 0) {
-        return { error: "this server has no yt-dlp, so it can only play a direct link to a file or a stream" };
-    }
+    // Without yt-dlp, a link is taken as the media it may well be: an IPTV
+    // feed has no extension and no page behind it, and ffprobe -- asked next,
+    // before anything goes on the air -- tells a stream from a web page in a
+    // second. A page it cannot read is refused there, by name.
+    if (!ytdlp || ytdlp.length === 0)
+        return directLink(url);
     const [command, ...prefix] = ytdlp;
     return new Promise((done) => {
         let out = "";

package/dist/live-api.js

@@ -563,6 +563,7 @@ export async function handleLiveApi(request, response, url, options) {
             json(response, error.status, { error: error.message });
             return true;
         }
+        console.error(`live api ${request.method} ${path}:`, error instanceof Error ? error.message : error);
         json(response, 500, { error: "the live event service failed" });
         return true;
     }

package/dist/live-events.js

@@ -71,19 +71,22 @@ const EVENT_SCHEMA = `
     ON live_events (visibility, status, starts_at, updated_at DESC);
   CREATE INDEX IF NOT EXISTS live_events_owner
     ON live_events (owner_id, updated_at DESC);
-  CREATE INDEX IF NOT EXISTS live_events_kind
-    ON live_events (kind, status, starts_at);
 
   -- The repo has no migration runner, so a table that already exists is
   -- brought forward here. Every statement is idempotent, and the CHECKs are
   -- replaced by name rather than added twice: the originals were unnamed, so
   -- the ones carrying the old status list are found by what they say.
+  -- The columns come before any index on them: nixamp.com had live_events
+  -- from before 0.17.0, and an index on kind ahead of ADD COLUMN kind failed
+  -- there while every fresh database (tests, CI) sailed through.
   ALTER TABLE live_events ADD COLUMN IF NOT EXISTS kind               TEXT    NOT NULL DEFAULT 'talk';
   ALTER TABLE live_events ADD COLUMN IF NOT EXISTS doors_open_at      TIMESTAMPTZ;
   ALTER TABLE live_events ADD COLUMN IF NOT EXISTS ticket_price_cents INTEGER NOT NULL DEFAULT 0;
   ALTER TABLE live_events ADD COLUMN IF NOT EXISTS ticket_currency    TEXT    NOT NULL DEFAULT 'USD';
   ALTER TABLE live_events ADD COLUMN IF NOT EXISTS ticket_minutes     INTEGER NOT NULL DEFAULT 1440;
   ALTER TABLE live_events ADD COLUMN IF NOT EXISTS pay_to             TEXT;
+  CREATE INDEX IF NOT EXISTS live_events_kind
+    ON live_events (kind, status, starts_at);
 
   DO $$
   DECLARE stale record;
@@ -402,7 +405,12 @@ export class LiveEvents {
         this.db = db;
     }
     async ensure() {
-        this.ready ??= this.db.query(EVENT_SCHEMA).then(() => undefined);
+        // A failed schema run is not remembered: the next request tries again
+        // rather than answering 500 until the process restarts.
+        this.ready ??= this.db.query(EVENT_SCHEMA).then(() => undefined, (error) => {
+            this.ready = null;
+            throw error;
+        });
         await this.ready;
     }
     async create(ownerId, input) {

package/dist/owner.js

@@ -136,8 +136,18 @@ export function needsMember(path, method = "GET") {
         return true;
     if (method === "POST" && /^\/api\/channels\/[^/]+\/keep$/.test(path))
         return true;
+    // A link -- a YouTube page, an IPTV feed, a file somewhere -- is the one
+    // thing a member can go live with that needs nothing on the server first,
+    // and it was the one thing they could not. Going live with one is the same
+    // act as going live with a file here: counted, marked theirs, and capped
+    // by the handler. Fetching a link to keep (download) stays the owner's.
+    if (method === "POST" && path === "/api/links/play")
+        return true;
     // Only their own; the handler checks whose it is.
     if (method === "DELETE" && /^\/api\/channels\/[^/]+$/.test(path))
         return true;
+    // Renaming what they put on, likewise.
+    if (method === "PATCH" && /^\/api\/channels\/[^/]+$/.test(path))
+        return true;
     return false;
 }

package/dist/server.js

@@ -896,7 +896,10 @@ export async function pullChannel(channels, ffprobe, id, name, source, input = [
     // the timestamps a recording cut mid-stream does not carry. Ahead of the
     // caller's own input arguments, which are headers for the address itself.
     const opening = [...transportInputArgs(source, codecs.container), ...input];
-    const channel = channels.pull(id, name, source, encode, kind, true, undefined, opening, kind === "video" ? audio : "", { live, position: known.position ?? 0 });
+    const channel = channels.pull(id, name, source, encode, kind, true, undefined, opening, kind === "video" ? audio : "", { live, position: known.position ?? 0 }, 
+    // Known before the first dial: whether the source is a transport stream
+    // decides whether it can be read here for a source-boundary relay.
+    assumed ? undefined : codecs);
     if (channel && !assumed)
         channel.info.codecs = codecs;
     // What comes out, as opposed to what went in. An H.265 source copied
@@ -926,18 +929,25 @@ export function cookiesFile() {
         return "";
     }
 }
-/** What the page is told about a link it asked to play. */
-function shownLink(channelId, link) {
+/**
+ * What the page is told about a link it asked to play.
+ *
+ * Whether it is live is the channel's answer where there is one: yt-dlp
+ * says nothing about an IPTV feed's liveness, and a feed told to the page
+ * as a film got a Download button and a seek bar for a stream with no end.
+ */
+function shownLink(channelId, link, channel) {
+    const live = channel?.live ?? link.live;
     return {
         kind: "live",
         channel: channelId,
-        name: link.title,
-        live: link.live,
+        name: channel?.name ?? link.title,
+        live,
         video: link.video,
         duration: link.duration,
         extractor: link.extractor,
         // A live has no whole to keep; a bare file can be fetched by the browser itself.
-        download: !link.live && link.extractor !== "direct",
+        download: !live && link.extractor !== "direct",
     };
 }
 export function liveOnes(engine) {
@@ -2646,6 +2656,15 @@ export function createHandler(engine, options) {
             response.end(JSON.stringify({ match }));
             return;
         }
+        /*
+         * A link, fetched by this server and carried as a channel.
+         *
+         * Played: started on demand, stopped a minute after the last viewer
+         * leaves. Live (`{ live: true }`, and always for a member): kept,
+         * remembered across a restart, listed in the directory with a room
+         * code, and -- for a member -- marked theirs and counted against what
+         * they may have on at once, exactly like a file from the library.
+         */
         if (path === "/api/links/play" && request.method === "POST") {
             let body = {};
             try {
@@ -2666,11 +2685,54 @@ export function createHandler(engine, options) {
             }
             const channelId = linkChannelId(link);
             const known = links.get(link);
+            // A member's is always a live: a decoder started on somebody else's
+            // machine is theirs to own, not a thing left running anonymously.
+            const goLive = body.live === true || liveBy !== "";
+            /**
+             * On the air and kept, as going live means; for a member, theirs.
+             * Answers "" or a refusal. `fresh` is a channel this very request
+             * started, which is nobody's yet and was counted before it was.
+             */
+            const putOnTheAir = (fresh) => {
+                const channels = options.channels;
+                const info = channels.info(channelId);
+                if (!info)
+                    return "";
+                if (liveBy && !info.startedBy) {
+                    // Somebody's already, and not started on demand: the owner's.
+                    if (!fresh && !channels.isEphemeral(channelId))
+                        return "that stream is the owner's";
+                    if (!fresh) {
+                        const refusal = memberLiveRefusal(channels, liveBy);
+                        if (refusal)
+                            return refusal;
+                    }
+                    info.startedBy = liveBy;
+                }
+                channels.keep(channelId);
+                options.rememberChannels?.(rememberedNow(channels));
+                return "";
+            };
             if (options.channels.has(channelId) && known) {
-                json(response, 200, shownLink(channelId, known));
+                if (goLive) {
+                    const refusal = putOnTheAir(false);
+                    if (refusal) {
+                        json(response, refusal.endsWith("owner's") ? 403 : 429, { error: refusal });
+                        return;
+                    }
+                    void options.live?.announce?.();
+                }
+                json(response, 200, shownLink(channelId, known, options.channels.info(channelId)));
                 return;
             }
-            if (!options.channels.has(channelId) && options.channels.ephemeralCount >= MAX_ON_DEMAND) {
+            if (!options.channels.has(channelId) && liveBy) {
+                const refusal = memberLiveRefusal(options.channels, liveBy);
+                if (refusal) {
+                    json(response, 429, { error: refusal });
+                    return;
+                }
+            }
+            if (!options.channels.has(channelId) && !goLive && options.channels.ephemeralCount >= MAX_ON_DEMAND) {
                 json(response, 429, { error: `this server is already carrying ${MAX_ON_DEMAND} channels on demand; try again in a minute` });
                 return;
             }
@@ -2699,12 +2761,23 @@ export function createHandler(engine, options) {
                     json(response, 409, { error: "that link is already starting" });
                     return;
                 }
-                options.channels.ephemeral(channelId);
+                if (goLive)
+                    putOnTheAir(true);
+                else
+                    options.channels.ephemeral(channelId);
                 // Told to the directory now, so the room code arrives with the
                 // channel rather than at the next heartbeat, ninety seconds on.
                 void options.live?.announce?.();
             }
-            json(response, 200, shownLink(channelId, resolved));
+            else if (goLive) {
+                const refusal = putOnTheAir(false);
+                if (refusal) {
+                    json(response, refusal.endsWith("owner's") ? 403 : 429, { error: refusal });
+                    return;
+                }
+                void options.live?.announce?.();
+            }
+            json(response, 200, shownLink(channelId, resolved, options.channels.info(channelId)));
             return;
         }
         // The whole thing, to keep. The server fetches it through yt-dlp and
@@ -2970,6 +3043,41 @@ export function createHandler(engine, options) {
                 response.on("close", leave);
                 return;
             }
+            /*
+             * Rename what is on the air. A link goes on as "906" or whatever the
+             * file was called, and the directory lists that; the person who put it
+             * on knows what it is. The owner renames anything; a member, their own.
+             */
+            if (action === undefined && request.method === "PATCH") {
+                const info = channels.info(id);
+                if (!info) {
+                    json(response, 404, { error: "nothing is playing on that channel" });
+                    return;
+                }
+                if (liveBy && info.startedBy !== liveBy) {
+                    json(response, 403, { error: "that stream is not yours to rename" });
+                    return;
+                }
+                let body = {};
+                try {
+                    body = JSON.parse(await readBody(request));
+                }
+                catch {
+                    json(response, 400, { error: "bad JSON" });
+                    return;
+                }
+                const name = typeof body.name === "string" ? body.name.replace(/[\r\n\t]+/g, " ").trim().slice(0, 120) : "";
+                if (name === "") {
+                    json(response, 400, { error: "a name is needed" });
+                    return;
+                }
+                info.name = name;
+                options.rememberChannels?.(rememberedNow(channels));
+                // Listed under the new name now, not at the next heartbeat.
+                void options.live?.announce?.();
+                json(response, 200, { ok: true, channel: id, name });
+                return;
+            }
             if (action === undefined && request.method === "DELETE") {
                 // A member takes off what they put on, and nothing else.
                 if (liveBy && channels.info(id)?.startedBy !== liveBy) {

package/dist/share.js

@@ -335,6 +335,12 @@ export function allowedForListening(path) {
     // Having the server fetch a link is a decoder and a download on somebody
     // else's machine: the control link's to ask for, not the listen link's. A
     // viewer's link plays in their own browser.
+    // Putting a link on the air is the exception: a member reaches a server
+    // from nixamp.com with its listen link and their session, and the
+    // administering gate behind this one decides whether that session is a
+    // member's. A listen key alone still gets a 403 there.
+    if (path === "/api/links/play")
+        return true;
     if (path === "/api/links" || path.startsWith("/api/links/"))
         return false;
     return true;