nixamp 0.2.0 → 0.3.0

package/dist/ingest.js

@@ -0,0 +1,252 @@
+/**
+ * Streaming into a nixamp, rather than out of one.
+ *
+ * A phone or a laptop sends live audio to the server, and the server plays it,
+ * serves it to listeners, and broadcasts it onward. Two ways in, because one is
+ * not enough:
+ *
+ * - A single long POST whose body is the stream. ffmpeg, OBS, curl and the
+ *   desktop app can all do this, and it is the efficient one.
+ * - A sequence of small POSTs, for browsers. Chrome only allows a streaming
+ *   request body over HTTP/2, and a nixamp on your own network is plain
+ *   HTTP/1.1, so a phone that wants to broadcast has to send chunks.
+ *
+ * Both end up writing into the same ffmpeg stdin, which is what makes the two
+ * paths interchangeable to everything downstream.
+ *
+ * And a third, which is the one anything native should use: RTMP. Point OBS,
+ * Larix or another ffmpeg at rtmp://this-machine/live/<key> and it publishes,
+ * with no nixamp-shaped client in the middle. ffmpeg listens for it (-rtmp_listen),
+ * so this costs no dependency and no protocol implementation. The HTTP paths
+ * above are not a workaround for that: they are what a *browser* has, since a
+ * web page cannot speak RTMP at all.
+ */
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+/** Containers a browser or a desktop encoder actually produces. */
+const FORMATS = new Set(["webm", "ogg", "mp4", "matroska", "mp3", "wav", "flv"]);
+/**
+ * ffmpeg's `-f` is a demuxer name, and passing an unknown one is how a stream
+ * dies four seconds in with a message nobody sees. An unrecognised container is
+ * refused up front instead.
+ */
+export function normaliseFormat(value) {
+    if (typeof value !== "string")
+        return null;
+    const format = value.trim().toLowerCase();
+    if (format === "")
+        return null;
+    // A MediaRecorder mime type: audio/webm;codecs=opus.
+    // The subtype may carry a hyphen: audio/x-matroska is what some browsers
+    // hand out, and stopping at the hyphen turned it into "x".
+    const fromMime = /^(?:audio|video)\/([a-z0-9-]+)/.exec(format)?.[1];
+    const candidate = fromMime ?? format;
+    const mapped = candidate === "x-matroska" ? "matroska" : candidate;
+    return FORMATS.has(mapped) ? mapped : null;
+}
+/**
+ * The live input.
+ *
+ * One session at a time: a second sender is refused rather than mixed, because
+ * mixing two uninvited streams is never what anybody meant.
+ */
+export class Ingest {
+    options;
+    child = null;
+    session = null;
+    closing = false;
+    /** The RTMP listener, which outlives any one publisher. */
+    rtmpChild = null;
+    rtmpPort = null;
+    rtmpKey = "";
+    constructor(options) {
+        this.options = options;
+    }
+    status() {
+        return {
+            live: this.session !== null,
+            session: this.session,
+            rtmp: this.rtmpPort === null ? null : { port: this.rtmpPort, path: `/live/${this.rtmpKey}` },
+        };
+    }
+    get live() {
+        return this.session !== null;
+    }
+    /**
+     * Open a session. Returns the session, or null when one is already running:
+     * the caller answers 409, because "somebody else is already broadcasting" is
+     * a different problem from "your request was wrong".
+     */
+    open(name, format) {
+        if (this.session !== null)
+            return null;
+        const session = {
+            id: randomBytes(8).toString("hex"),
+            name: name || "a device",
+            format,
+            startedAt: Date.now(),
+            bytes: 0,
+        };
+        const [command, ...prefix] = this.options.ffmpeg;
+        const child = spawn(command, [
+            ...prefix,
+            "-hide_banner",
+            "-loglevel", "error",
+            // The demuxer is stated because ffmpeg mis-probes a live, unseekable
+            // pipe: it reads a few kilobytes, guesses, and guesses wrong.
+            "-f", format,
+            "-i", "pipe:0",
+            "-vn",
+            "-c:a", "libmp3lame",
+            "-b:a", "192k",
+            "-y",
+            "-f", "mp3",
+            this.options.sink,
+        ], { stdio: ["pipe", "ignore", "pipe"] });
+        let tail = "";
+        child.stderr?.on("data", (chunk) => {
+            tail = (tail + chunk.toString()).slice(-2000);
+        });
+        // A sender that hangs up mid-write breaks the pipe, and an unhandled EPIPE
+        // takes the whole server down with it.
+        child.stdin?.on("error", () => this.close(""));
+        child.on("error", (error) => this.close(error.message));
+        child.on("close", (code) => this.close(code === 0 ? "" : tail.trim().split("\n").pop() ?? ""));
+        this.child = child;
+        this.session = session;
+        this.closing = false;
+        this.options.onStart(session);
+        return session;
+    }
+    /** Feed it. Returns false once the session is over. */
+    write(chunk) {
+        const child = this.child;
+        const session = this.session;
+        if (child === null || session === null || child.stdin === null)
+            return false;
+        session.bytes += chunk.byteLength;
+        return child.stdin.write(chunk);
+    }
+    /** Pipe a whole request body in, for a sender that can stream one. */
+    async pump(body) {
+        for await (const chunk of body) {
+            if (!this.write(chunk)) {
+                // Backpressure: wait for the drain rather than growing a buffer that
+                // is really the network's problem.
+                await new Promise((done) => this.child?.stdin?.once("drain", done) ?? done(null));
+            }
+            if (this.session === null)
+                return;
+        }
+    }
+    /**
+     * Wait for an RTMP publisher, and keep waiting after each one leaves.
+     *
+     * ffmpeg is the RTMP server here: `-rtmp_listen 1` binds the port and blocks
+     * until somebody publishes. It serves one publisher and exits, so the
+     * listener is started again afterwards -- otherwise a broadcaster who
+     * reconnects finds nothing listening.
+     */
+    listenRtmp(port, key) {
+        this.rtmpPort = port;
+        this.rtmpKey = key;
+        this.armRtmp();
+    }
+    /** Stop waiting for publishers. */
+    stopRtmp() {
+        this.rtmpPort = null;
+        const listener = this.rtmpChild;
+        this.rtmpChild = null;
+        listener?.kill("SIGKILL");
+    }
+    armRtmp() {
+        const port = this.rtmpPort;
+        if (port === null || this.rtmpChild !== null)
+            return;
+        const [command, ...prefix] = this.options.ffmpeg;
+        const child = spawn(command, [
+            ...prefix,
+            "-hide_banner",
+            "-loglevel", "error",
+            "-rtmp_listen", "1",
+            // Wait indefinitely: a stream that starts tomorrow is still the stream.
+            "-timeout", "-1",
+            "-f", "flv",
+            "-i", `rtmp://0.0.0.0:${port}/live/${this.rtmpKey}`,
+            "-vn",
+            "-c:a", "libmp3lame",
+            "-b:a", "192k",
+            "-y",
+            "-f", "mp3",
+            this.options.sink,
+        ], 
+        // stdout is watched rather than ignored: the encoded bytes are the only
+        // honest signal that a publisher turned up. ffmpeg does not announce a
+        // connect, a healthy stream says nothing at -loglevel error, and
+        // -progress only reports at the end in this build. Audio existing means
+        // audio arrived.
+        { stdio: ["ignore", "pipe", "pipe"] });
+        const session = {
+            id: randomBytes(8).toString("hex"),
+            name: "an RTMP publisher",
+            format: "flv",
+            startedAt: Date.now(),
+            bytes: 0,
+        };
+        let tail = "";
+        child.stderr?.on("data", (chunk) => {
+            tail = (tail + chunk.toString()).slice(-2000);
+        });
+        child.stdout?.on("data", (chunk) => {
+            if (this.rtmpChild !== child)
+                return;
+            if (this.session === null) {
+                this.session = session;
+                this.options.onStart(session);
+            }
+            if (this.session === session)
+                session.bytes += chunk.byteLength;
+            // Consumed and dropped for now. The pipe has to be read either way --
+            // an unread one fills and stalls the encoder -- and handing these bytes
+            // to the listeners is the next piece of work, not a missing one here.
+            this.options.onAudio?.(chunk);
+        });
+        child.on("error", () => {
+            if (this.rtmpChild === child)
+                this.rtmpChild = null;
+        });
+        child.on("close", () => {
+            if (this.rtmpChild !== child)
+                return;
+            this.rtmpChild = null;
+            if (this.session === session) {
+                this.session = null;
+                // A publisher disconnecting is how a broadcast ends, not an error.
+                this.options.onEnd(session, "");
+            }
+            // Listen again for the next one.
+            if (this.rtmpPort !== null)
+                this.armRtmp();
+        });
+        this.rtmpChild = child;
+    }
+    /** End the session, whoever ended it. */
+    close(error = "") {
+        if (this.closing)
+            return;
+        this.closing = true;
+        const session = this.session;
+        const child = this.child;
+        this.session = null;
+        this.child = null;
+        try {
+            child?.stdin?.end();
+        }
+        catch {
+            // Already broken, which is usually why we are here.
+        }
+        child?.kill("SIGKILL");
+        if (session)
+            this.options.onEnd(session, error);
+    }
+}

package/dist/main.js

@@ -47,6 +47,8 @@ const HELP = `nixamp — it really whips the terminal's ass.
   nixamp serve [source] [options]  play here, and hand out a browser remote
   nixamp daemon start|stop|status  serve in the background, and let go of it
   nixamp admin [--url U] [--key K] who is connected, and re-stream to them
+  nixamp login [--signup]        sign in to nixamp.com
+  nixamp logout / whoami        forget it, or check it
   nixamp update [version]        re-run the installer, keeping your choices
   nixamp uninstall [--yes]       remove everything the installer created
 
@@ -60,6 +62,15 @@ Options for serve:
       --no-media   do not stream the library's bytes to remotes
       --no-key     serve to anyone who can reach the port, with no share link
       --open-port  let the port through the local firewall, and close it on exit
+      --publish    list it at nixamp.com/directory without asking first
+      --no-publish never list it, and do not ask
+      --name NAME  what to call it in the directory (default: this hostname)
+      --ingest     accept a live stream in at POST /api/ingest
+      --rtmp-in N  also listen for RTMP publishers (OBS, Larix) from port N
+      --rtmp-streams N  how many may publish at once (default 3, a port each)
+      --rtmp D     broadcast out, e.g. --rtmp youtube=<key>. Repeatable
+      --x402       charge for listening once more than 5 people are listening
+      --no-x402    never charge
 
   -v, --version    print the version
       --help       print this
@@ -140,6 +151,16 @@ export async function main() {
         await admin(rest);
         return;
     }
+    if (first === "login" || first === "signup") {
+        const { login } = await import("./session.js");
+        process.exitCode = await login(first === "signup" ? [...rest, "--signup"] : rest);
+        return;
+    }
+    if (first === "logout" || first === "whoami") {
+        const session = await import("./session.js");
+        process.exitCode = first === "logout" ? session.logout() : await session.whoami();
+        return;
+    }
     if (first === "update" || first === "uninstall") {
         const manage = await import("./manage.js");
         process.exitCode = first === "update" ? manage.update(rest) : manage.uninstall(rest);

package/dist/manage.js

@@ -9,6 +9,7 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 const SITE = "https://nixamp.com";
 /** Windows has its own installer, its own shim and its own removal script. */
 const windows = process.platform === "win32";
@@ -17,7 +18,7 @@ const windows = process.platform === "win32";
  * wrote, which is the only thing that knows for certain; the walk up from this
  * file covers a shim from an older install that did not set it.
  */
-export function installRoot(from = new URL(".", import.meta.url).pathname) {
+export function installRoot(from = fileURLToPath(new URL(".", import.meta.url))) {
     const declared = process.env["NIXAMP_HOME"];
     if (declared && existsSync(join(declared, "manifest.json")))
         return declared;

package/dist/owner.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Who may administer this server.
+ *
+ * Two ways to be allowed, and they answer different questions:
+ *
+ * - You hold the control key. That is possession of the share link the server
+ *   printed, which means you are at the machine or someone at it told you.
+ * - You are signed in to nixamp.com as the account that owns this server. That
+ *   is identity, and it works from a phone on the other side of the world.
+ *
+ * The server cannot check a nixamp.com token itself -- it has no part of that
+ * secret, and it should not. So it asks nixamp.com who the token belongs to and
+ * compares the answer to the owner it recorded at startup. Delegating identity
+ * and keeping authorisation local is what lets a nixamp on a laptop trust an
+ * account it has never seen.
+ */
+/** How long an answer from nixamp.com is trusted before asking again. */
+export declare const CACHE_MS = 60000;
+export interface OwnerOptions {
+    /** The account id that owns this server, from the CLI session at startup. */
+    ownerId: string;
+    /** Where to ask about a token. */
+    site: string;
+    fetcher?: typeof fetch;
+    now?: () => number;
+}
+export interface AdminCheck {
+    /** May this caller administer the server? */
+    allowed: boolean;
+    /** How they proved it, for the admin view to show. */
+    as: "key" | "owner" | null;
+}
+/**
+ * Ask nixamp.com who a token belongs to, and remember the answer briefly.
+ *
+ * Briefly, because an admin request should not cost a round trip to another
+ * host every time, and not for long, because a revoked session should stop
+ * working in about a minute rather than whenever the process restarts.
+ */
+export declare class Owner {
+    private readonly options;
+    private readonly cache;
+    constructor(options: OwnerOptions);
+    get claimed(): boolean;
+    /** The account a token belongs to, or "" for one nixamp.com does not accept. */
+    accountFor(token: string): Promise<string>;
+    check(hasControlKey: boolean, token: string): Promise<AdminCheck>;
+    /** Forget everything remembered, so a sign-out takes effect at once. */
+    forget(): void;
+}
+/** Paths only an administrator may reach. */
+export declare const ADMIN_PATHS: string[];
+export declare function needsAdmin(path: string, method?: string): boolean;

package/dist/owner.js

@@ -0,0 +1,96 @@
+/**
+ * Who may administer this server.
+ *
+ * Two ways to be allowed, and they answer different questions:
+ *
+ * - You hold the control key. That is possession of the share link the server
+ *   printed, which means you are at the machine or someone at it told you.
+ * - You are signed in to nixamp.com as the account that owns this server. That
+ *   is identity, and it works from a phone on the other side of the world.
+ *
+ * The server cannot check a nixamp.com token itself -- it has no part of that
+ * secret, and it should not. So it asks nixamp.com who the token belongs to and
+ * compares the answer to the owner it recorded at startup. Delegating identity
+ * and keeping authorisation local is what lets a nixamp on a laptop trust an
+ * account it has never seen.
+ */
+/** How long an answer from nixamp.com is trusted before asking again. */
+export const CACHE_MS = 60_000;
+/**
+ * Ask nixamp.com who a token belongs to, and remember the answer briefly.
+ *
+ * Briefly, because an admin request should not cost a round trip to another
+ * host every time, and not for long, because a revoked session should stop
+ * working in about a minute rather than whenever the process restarts.
+ */
+export class Owner {
+    options;
+    cache = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    get claimed() {
+        return this.options.ownerId !== "";
+    }
+    /** The account a token belongs to, or "" for one nixamp.com does not accept. */
+    async accountFor(token) {
+        if (!token)
+            return "";
+        const now = (this.options.now ?? Date.now)();
+        const remembered = this.cache.get(token);
+        if (remembered && now - remembered.at < CACHE_MS)
+            return remembered.id;
+        const send = this.options.fetcher ?? fetch;
+        try {
+            const answer = await send(`${this.options.site}/api/v1/auth/me`, {
+                headers: { authorization: `Bearer ${token}` },
+            });
+            if (!answer.ok) {
+                // Remember the refusal too, or a wrong token costs a round trip on
+                // every request it is presented with.
+                this.cache.set(token, { id: "", at: now });
+                return "";
+            }
+            const body = (await answer.json());
+            const id = typeof body.account?.id === "string" ? body.account.id : "";
+            this.cache.set(token, { id, at: now });
+            return id;
+        }
+        catch {
+            // nixamp.com being unreachable must not turn into "everyone is the
+            // owner". It turns into "nobody is", and the control key still works.
+            return "";
+        }
+    }
+    async check(hasControlKey, token) {
+        if (hasControlKey)
+            return { allowed: true, as: "key" };
+        if (!this.claimed)
+            return { allowed: false, as: null };
+        const account = await this.accountFor(token);
+        return account !== "" && account === this.options.ownerId
+            ? { allowed: true, as: "owner" }
+            : { allowed: false, as: null };
+    }
+    /** Forget everything remembered, so a sign-out takes effect at once. */
+    forget() {
+        this.cache.clear();
+    }
+}
+/** Paths only an administrator may reach. */
+export const ADMIN_PATHS = [
+    "/api/connections",
+    "/api/source",
+    "/api/broadcast",
+    "/api/ingest",
+    "/api/admin",
+];
+export function needsAdmin(path, method = "GET") {
+    if (ADMIN_PATHS.some((prefix) => path === prefix || path.startsWith(`${prefix}/`)))
+        return true;
+    // Publishing to a channel, or ending one, is administering the server.
+    // Listening to a channel is not: that is what the share link is for.
+    if (path.startsWith("/api/channels/") && method !== "GET")
+        return true;
+    return false;
+}

package/dist/paywall.d.ts

@@ -0,0 +1,60 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+/** Listeners who get in for nothing. The sixth is the one who pays. */
+export declare const FREE_LISTENERS = 5;
+export interface PaywallConfig {
+    enabled: boolean;
+    /** EVM address that receives the USDC. Without one there is nothing to pay to. */
+    payTo: string;
+    /** A scoped CoinPay key with payments:create. */
+    coinpayKey: string;
+    priceCents: number;
+    /** What one price buys. 1440 is a day. */
+    passMinutes: number;
+}
+export declare const DEFAULT_PAYWALL: PaywallConfig;
+/** Only the audio is behind the gate. */
+export declare const GATED: string[];
+export declare function isGated(path: string): boolean;
+/**
+ * Whether this request should be charged at all. Configuration first, because
+ * a disabled paywall must never answer 402; then the path, then how busy the
+ * stream is.
+ */
+export declare function shouldCharge(config: PaywallConfig, path: string, liveListeners: number): boolean;
+export interface PaywallOptions {
+    config: () => PaywallConfig;
+    /** How many listeners are on the audio routes right now. */
+    liveListeners: () => number;
+    /**
+     * The origin a payer is quoted, which has to be one they can reach. A
+     * function because the port is not known until the socket is bound.
+     */
+    siteUrl: () => string;
+    /** True for the operator's own browser, which never pays to hear its own music. */
+    exempt: (request: IncomingMessage) => boolean;
+}
+/**
+ * A node http shim over the gateway's Fetch-API handler. Returns true when it
+ * answered the request, so the server's own routing can stop.
+ */
+export declare function createPaywall(options: PaywallOptions): (request: IncomingMessage, response: ServerResponse, path: string) => Promise<boolean>;
+/**
+ * The gateway sells crawl access, and says so: its 402 tells the caller that
+ * "payment is required for training crawlers". Someone trying to hear a song
+ * is not a crawler, so the sentence is replaced on the way out. The offer
+ * itself is untouched -- only the words are ours.
+ */
+export declare function rewrite(answer: Response, siteUrl: string): Promise<Buffer>;
+/**
+ * Enough of a Fetch Request for the gateway: it reads the URL, the method and
+ * headers. A body would need streaming, and nothing it gates has one.
+ */
+export declare function toRequest(request: IncomingMessage, siteUrl: string): Request;
+/** Read a paywall out of the environment, for an operator who runs one by hand. */
+export declare function paywallFromEnv(env?: NodeJS.ProcessEnv): PaywallConfig;
+/**
+ * The directory's answer may carry a configuration, which is how a server is
+ * turned on and off from nixamp.com. Anything missing keeps what it had, and
+ * a payTo the operator did not set is never invented here.
+ */
+export declare function applyRemoteConfig(current: PaywallConfig, remote: unknown): PaywallConfig;

package/dist/paywall.js

@@ -0,0 +1,162 @@
+/**
+ * Paying to listen, once a stream is busy.
+ *
+ * A nixamp serving a handful of friends should cost nothing and ask nothing.
+ * Past that it is bandwidth someone is paying for, so the gate opens: over the
+ * free listener count, a new listener is answered 402 with an x402 offer and a
+ * dollar buys a day.
+ *
+ * Three things are deliberate. The count is of *live* listeners, so a stream
+ * quietens back to free on its own. Only the audio is gated, because a 402 on
+ * /api/state would break the page that has to render the offer. And nobody is
+ * ever cut off mid-track: the gate is asked once, when a request arrives, and
+ * a listener who got in stays in.
+ */
+import { createGateway } from "@profullstack/x402-gateway";
+/** Listeners who get in for nothing. The sixth is the one who pays. */
+export const FREE_LISTENERS = 5;
+export const DEFAULT_PAYWALL = {
+    enabled: false,
+    payTo: "",
+    coinpayKey: "",
+    priceCents: 100,
+    passMinutes: 1440,
+};
+/** Only the audio is behind the gate. */
+export const GATED = ["/api/stream/", "/api/media/"];
+export function isGated(path) {
+    return GATED.some((prefix) => path.startsWith(prefix));
+}
+/**
+ * Whether this request should be charged at all. Configuration first, because
+ * a disabled paywall must never answer 402; then the path, then how busy the
+ * stream is.
+ */
+export function shouldCharge(config, path, liveListeners) {
+    if (!config.enabled || !config.payTo)
+        return false;
+    if (!isGated(path))
+        return false;
+    return liveListeners > FREE_LISTENERS;
+}
+/**
+ * A node http shim over the gateway's Fetch-API handler. Returns true when it
+ * answered the request, so the server's own routing can stop.
+ */
+export function createPaywall(options) {
+    let built = null;
+    /** Rebuilt when the configuration changes, because it can change at runtime. */
+    const gateway = (config, siteUrl) => {
+        const key = `${siteUrl} ${JSON.stringify(config)}`;
+        if (built?.key === key)
+            return built.handle;
+        const gate = createGateway({
+            siteUrl,
+            siteName: "nixamp",
+            payTo: config.payTo,
+            priceCents: config.priceCents,
+            passMinutes: config.passMinutes,
+            coinpay: { apiKey: config.coinpayKey },
+            header: "x-nixamp-pass",
+            path: "/listen/pay",
+            // Whether to charge is about how busy this stream is, not about who is
+            // asking, so the agent lists play no part.
+            isPaidAgent: () => true,
+            benefits: ["Listen to this stream for a day, as many tracks as you like."],
+        });
+        built = { key, handle: (request) => gate.handle(request) };
+        return built.handle;
+    };
+    return async function paywall(request, response, path) {
+        const config = options.config();
+        // The sales page answers whenever the paywall is configured, so a listener
+        // can buy a pass before the stream is busy enough to need one.
+        const selling = config.enabled && config.payTo !== "" && path.startsWith("/listen/pay");
+        if (!selling && !shouldCharge(config, path, options.liveListeners()))
+            return false;
+        if (options.exempt(request))
+            return false;
+        const siteUrl = options.siteUrl();
+        const answer = await gateway(config, siteUrl)(toRequest(request, siteUrl));
+        if (answer === null)
+            return false;
+        const body = await rewrite(answer, siteUrl);
+        response.writeHead(answer.status, {
+            ...Object.fromEntries(answer.headers),
+            "content-length": String(body.byteLength),
+        });
+        response.end(body);
+        return true;
+    };
+}
+/**
+ * The gateway sells crawl access, and says so: its 402 tells the caller that
+ * "payment is required for training crawlers". Someone trying to hear a song
+ * is not a crawler, so the sentence is replaced on the way out. The offer
+ * itself is untouched -- only the words are ours.
+ */
+export async function rewrite(answer, siteUrl) {
+    const raw = Buffer.from(await answer.arrayBuffer());
+    if (answer.status !== 402 || !(answer.headers.get("content-type") ?? "").includes("json"))
+        return raw;
+    try {
+        const parsed = JSON.parse(raw.toString("utf8"));
+        parsed["error"] =
+            `This stream has more than ${FREE_LISTENERS} people listening. ` +
+                `A pass is ${parsed.pass?.price ?? "$1"} for a day: ${siteUrl}/listen/pay`;
+        return Buffer.from(JSON.stringify(parsed));
+    }
+    catch {
+        // Not JSON after all: send exactly what the gateway produced.
+        return raw;
+    }
+}
+/**
+ * Enough of a Fetch Request for the gateway: it reads the URL, the method and
+ * headers. A body would need streaming, and nothing it gates has one.
+ */
+export function toRequest(request, siteUrl) {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(request.headers)) {
+        if (value === undefined)
+            continue;
+        headers.set(name, Array.isArray(value) ? value.join(", ") : value);
+    }
+    return new Request(new URL(request.url ?? "/", siteUrl), {
+        method: request.method ?? "GET",
+        headers,
+    });
+}
+/** Read a paywall out of the environment, for an operator who runs one by hand. */
+export function paywallFromEnv(env = process.env) {
+    const price = Number(env["NIXAMP_PRICE_CENTS"]);
+    const minutes = Number(env["NIXAMP_PASS_MINUTES"]);
+    return {
+        enabled: env["NIXAMP_X402"] === "1",
+        payTo: env["NIXAMP_PAY_TO"] ?? "",
+        coinpayKey: env["COINPAY_X402_KEY"] ?? "",
+        priceCents: Number.isFinite(price) && price > 0 ? Math.floor(price) : DEFAULT_PAYWALL.priceCents,
+        passMinutes: Number.isFinite(minutes) && minutes > 0 ? Math.floor(minutes) : DEFAULT_PAYWALL.passMinutes,
+    };
+}
+/**
+ * The directory's answer may carry a configuration, which is how a server is
+ * turned on and off from nixamp.com. Anything missing keeps what it had, and
+ * a payTo the operator did not set is never invented here.
+ */
+export function applyRemoteConfig(current, remote) {
+    if (typeof remote !== "object" || remote === null)
+        return current;
+    const record = remote;
+    const price = Number(record["priceCents"]);
+    const minutes = Number(record["passMinutes"]);
+    return {
+        enabled: typeof record["enabled"] === "boolean" ? record["enabled"] : current.enabled,
+        payTo: typeof record["payTo"] === "string" && record["payTo"] ? record["payTo"] : current.payTo,
+        coinpayKey: typeof record["coinpayKey"] === "string" && record["coinpayKey"]
+            ? record["coinpayKey"]
+            : current.coinpayKey,
+        priceCents: Number.isFinite(price) && price > 0 ? Math.floor(price) : current.priceCents,
+        passMinutes: Number.isFinite(minutes) && minutes > 0 ? Math.floor(minutes) : current.passMinutes,
+    };
+}