nixamp 0.2.0 → 0.4.0

package/src/follows.ts

@@ -0,0 +1,307 @@
+/**
+ * Following a broadcaster, and where to reach the people who do.
+ *
+ * The phone line got here first, and its reminder is a different thing: you
+ * key a code, press 1, and are told once when that particular stream comes
+ * back. It is per-stream, one-shot, and tied to the handset you called from.
+ * That is right for somebody who dialled a number, and useless for somebody
+ * who wants to know whenever a person they like goes live, on whatever device
+ * they happen to be holding.
+ *
+ * So a follow is account to account, and delivery is a set of addresses rather
+ * than a phone number: an email, a phone if they gave one, and any number of
+ * browsers that have granted permission. One person with a laptop, a phone and
+ * a desktop app is three push subscriptions and one account.
+ *
+ * Unlike the rest of nixamp this is durable. The directory can afford to be a
+ * four-minute TTL because a stream that stops is a stream nobody is listening
+ * to; a follow has to outlive the stream by definition -- the whole point is
+ * to be told about a broadcast that is not happening yet.
+ *
+ * The query function is injected rather than a Pool being constructed here, so
+ * a test can describe a database instead of running one.
+ */
+
+/** The slice of `pg` this needs. Postgres in production, a fake in tests. */
+export interface Queryable {
+  query(text: string, values?: unknown[]): Promise<{ rows: Record<string, unknown>[] }>;
+}
+
+/** A browser, desktop app or phone that has granted notification permission. */
+export interface PushTarget {
+  endpoint: string;
+  p256dh: string;
+  auth: string;
+}
+
+/** Everywhere one follower can be reached. */
+export interface Reachable {
+  accountId: string;
+  email: string;
+  /** E.164, if they gave one. Empty when they never did. */
+  phone: string;
+  /** Whether each channel is on. A follower who wants none is still a follower. */
+  wantsEmail: boolean;
+  wantsSms: boolean;
+  wantsWeb: boolean;
+  push: PushTarget[];
+}
+
+/**
+ * The tables.
+ *
+ * Created on demand rather than in a migration because the auth module owns
+ * the schema this sits beside and there is no migration runner to hook into.
+ * `IF NOT EXISTS` throughout, so starting a second instance is not a race that
+ * takes the first one down.
+ *
+ * `follows` is keyed on the pair, which makes following twice a no-op rather
+ * than a duplicate to deduplicate later. `push_subscriptions` is keyed on the
+ * endpoint alone: an endpoint is issued by the browser vendor and is already
+ * unique, and the same browser re-subscribing should replace its row rather
+ * than accumulate one per sign-in.
+ */
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS follows (
+    follower_id  TEXT NOT NULL,
+    streamer_id  TEXT NOT NULL,
+    created_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (follower_id, streamer_id)
+  );
+  CREATE INDEX IF NOT EXISTS follows_streamer ON follows (streamer_id);
+
+  CREATE TABLE IF NOT EXISTS push_subscriptions (
+    endpoint    TEXT PRIMARY KEY,
+    account_id  TEXT NOT NULL,
+    p256dh      TEXT NOT NULL,
+    auth        TEXT NOT NULL,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+  );
+  CREATE INDEX IF NOT EXISTS push_account ON push_subscriptions (account_id);
+
+  CREATE TABLE IF NOT EXISTS notify_prefs (
+    account_id  TEXT PRIMARY KEY,
+    phone       TEXT NOT NULL DEFAULT '',
+    want_email  BOOLEAN NOT NULL DEFAULT TRUE,
+    want_sms    BOOLEAN NOT NULL DEFAULT FALSE,
+    want_web    BOOLEAN NOT NULL DEFAULT TRUE
+  );
+`;
+
+/** E.164, or nothing. A number we cannot dial is not a number worth storing. */
+export function phoneFrom(value: unknown): string {
+  if (typeof value !== "string") return "";
+  const digits = value.replace(/[^\d+]/g, "");
+  if (/^\+[1-9]\d{7,14}$/.test(digits)) return digits;
+  // A bare US ten-digit number is the common case and is unambiguous.
+  if (/^\d{10}$/.test(digits)) return `+1${digits}`;
+  if (/^1\d{10}$/.test(digits)) return `+${digits}`;
+  return "";
+}
+
+export class Follows {
+  private ready: Promise<void> | null = null;
+
+  constructor(private readonly db: Queryable) {}
+
+  /** Make the tables, once per process, on first use. */
+  private async ensure(): Promise<void> {
+    this.ready ??= this.db.query(SCHEMA).then(() => undefined);
+    await this.ready;
+  }
+
+  async follow(followerId: string, streamerId: string): Promise<boolean> {
+    // Following yourself is not an error worth an error, but it is not a
+    // follow either: you do not need telling that you went live.
+    if (!followerId || !streamerId || followerId === streamerId) return false;
+    await this.ensure();
+    await this.db.query(
+      `INSERT INTO follows (follower_id, streamer_id) VALUES ($1, $2)
+       ON CONFLICT DO NOTHING`,
+      [followerId, streamerId],
+    );
+    return true;
+  }
+
+  async unfollow(followerId: string, streamerId: string): Promise<void> {
+    await this.ensure();
+    await this.db.query(
+      "DELETE FROM follows WHERE follower_id = $1 AND streamer_id = $2",
+      [followerId, streamerId],
+    );
+  }
+
+  /** Who this account follows. */
+  async following(followerId: string): Promise<string[]> {
+    await this.ensure();
+    const { rows } = await this.db.query(
+      "SELECT streamer_id FROM follows WHERE follower_id = $1 ORDER BY created_at",
+      [followerId],
+    );
+    return rows.map((r) => String(r["streamer_id"]));
+  }
+
+  async isFollowing(followerId: string, streamerId: string): Promise<boolean> {
+    await this.ensure();
+    const { rows } = await this.db.query(
+      "SELECT 1 FROM follows WHERE follower_id = $1 AND streamer_id = $2",
+      [followerId, streamerId],
+    );
+    return rows.length > 0;
+  }
+
+  async followerCount(streamerId: string): Promise<number> {
+    await this.ensure();
+    const { rows } = await this.db.query(
+      "SELECT COUNT(*)::int AS n FROM follows WHERE streamer_id = $1",
+      [streamerId],
+    );
+    return Number(rows[0]?.["n"] ?? 0);
+  }
+
+  /** Remember a browser that has granted permission. */
+  async addPush(accountId: string, target: PushTarget): Promise<void> {
+    if (!accountId || !target.endpoint) return;
+    await this.ensure();
+    await this.db.query(
+      `INSERT INTO push_subscriptions (endpoint, account_id, p256dh, auth)
+       VALUES ($1, $2, $3, $4)
+       ON CONFLICT (endpoint) DO UPDATE
+         SET account_id = EXCLUDED.account_id,
+             p256dh = EXCLUDED.p256dh,
+             auth = EXCLUDED.auth`,
+      [target.endpoint, accountId, target.p256dh, target.auth],
+    );
+  }
+
+  /**
+   * Forget a browser.
+   *
+   * Called when somebody turns notifications off, and again when a push is
+   * rejected as gone: a subscription outlives the browser that made it, and
+   * pushing to a dead endpoint forever is how a table becomes mostly rubbish.
+   */
+  async removePush(endpoint: string): Promise<void> {
+    if (!endpoint) return;
+    await this.ensure();
+    await this.db.query("DELETE FROM push_subscriptions WHERE endpoint = $1", [endpoint]);
+  }
+
+  async setPrefs(
+    accountId: string,
+    prefs: { phone?: string; wantsEmail?: boolean; wantsSms?: boolean; wantsWeb?: boolean },
+  ): Promise<void> {
+    if (!accountId) return;
+    await this.ensure();
+    // Every column is COALESCEd on the way IN as well as on conflict. A caller
+    // setting only the switches sends no phone, and an unset field arrives as
+    // null -- which the ON CONFLICT branch handles fine and the INSERT branch
+    // does not, because these columns are NOT NULL. Saving preferences for the
+    // first time was a 500 until this said so.
+    //
+    // The casts are not decoration either: Postgres cannot infer the type of a
+    // parameter that is only ever seen inside COALESCE against a null.
+    await this.db.query(
+      `INSERT INTO notify_prefs (account_id, phone, want_email, want_sms, want_web)
+       VALUES ($1,
+               COALESCE($2::text, ''),
+               COALESCE($3::boolean, TRUE),
+               COALESCE($4::boolean, FALSE),
+               COALESCE($5::boolean, TRUE))
+       ON CONFLICT (account_id) DO UPDATE
+         SET phone = COALESCE($2::text, notify_prefs.phone),
+             want_email = COALESCE($3::boolean, notify_prefs.want_email),
+             want_sms = COALESCE($4::boolean, notify_prefs.want_sms),
+             want_web = COALESCE($5::boolean, notify_prefs.want_web)`,
+      [
+        accountId,
+        prefs.phone === undefined ? null : phoneFrom(prefs.phone),
+        prefs.wantsEmail ?? null,
+        prefs.wantsSms ?? null,
+        prefs.wantsWeb ?? null,
+      ],
+    );
+  }
+
+  async prefs(accountId: string): Promise<{ phone: string; wantsEmail: boolean; wantsSms: boolean; wantsWeb: boolean }> {
+    await this.ensure();
+    const { rows } = await this.db.query(
+      "SELECT phone, want_email, want_sms, want_web FROM notify_prefs WHERE account_id = $1",
+      [accountId],
+    );
+    const row = rows[0];
+    // Defaults for somebody who has never opened the settings: mail yes, web
+    // yes, texts no. A text costs them nothing but is the most intrusive of
+    // the three, so it is the one you have to ask for.
+    return {
+      phone: String(row?.["phone"] ?? ""),
+      wantsEmail: row === undefined ? true : row["want_email"] !== false,
+      wantsSms: row === undefined ? false : row["want_sms"] === true,
+      wantsWeb: row === undefined ? true : row["want_web"] !== false,
+    };
+  }
+
+  /**
+   * Everyone following this broadcaster, and every way to reach them.
+   *
+   * One query rather than one per follower. A broadcaster with a thousand
+   * followers going live should not be a thousand round trips while the
+   * publisher's heartbeat waits on the response.
+   */
+  async audience(streamerId: string): Promise<Reachable[]> {
+    if (!streamerId) return [];
+    await this.ensure();
+    const { rows } = await this.db.query(
+      `SELECT f.follower_id                     AS account_id,
+              COALESCE(u.email, '')             AS email,
+              COALESCE(p.phone, '')             AS phone,
+              COALESCE(p.want_email, TRUE)      AS want_email,
+              COALESCE(p.want_sms, FALSE)       AS want_sms,
+              COALESCE(p.want_web, TRUE)        AS want_web,
+              COALESCE(
+                json_agg(json_build_object('endpoint', s.endpoint, 'p256dh', s.p256dh, 'auth', s.auth))
+                  FILTER (WHERE s.endpoint IS NOT NULL),
+                '[]'
+              )                                 AS push
+         FROM follows f
+         LEFT JOIN users u              ON u.id = f.follower_id
+         LEFT JOIN notify_prefs p       ON p.account_id = f.follower_id
+         LEFT JOIN push_subscriptions s ON s.account_id = f.follower_id
+        WHERE f.streamer_id = $1
+        GROUP BY f.follower_id, u.email, p.phone, p.want_email, p.want_sms, p.want_web`,
+      [streamerId],
+    );
+
+    return rows.map((r) => ({
+      accountId: String(r["account_id"] ?? ""),
+      email: String(r["email"] ?? ""),
+      phone: String(r["phone"] ?? ""),
+      wantsEmail: r["want_email"] !== false,
+      wantsSms: r["want_sms"] === true,
+      wantsWeb: r["want_web"] !== false,
+      push: readPush(r["push"]),
+    }));
+  }
+}
+
+/** json_agg comes back as an array or as a string, depending on the driver. */
+function readPush(value: unknown): PushTarget[] {
+  const list = typeof value === "string" ? safeParse(value) : value;
+  if (!Array.isArray(list)) return [];
+  return list
+    .map((item) => (item ?? {}) as Record<string, unknown>)
+    .filter((item) => typeof item["endpoint"] === "string" && item["endpoint"] !== "")
+    .map((item) => ({
+      endpoint: String(item["endpoint"]),
+      p256dh: String(item["p256dh"] ?? ""),
+      auth: String(item["auth"] ?? ""),
+    }));
+}
+
+function safeParse(text: string): unknown {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return [];
+  }
+}

package/src/ingest.ts

@@ -0,0 +1,297 @@
+/**
+ * Streaming into a nixamp, rather than out of one.
+ *
+ * A phone or a laptop sends live audio to the server, and the server plays it,
+ * serves it to listeners, and broadcasts it onward. Two ways in, because one is
+ * not enough:
+ *
+ * - A single long POST whose body is the stream. ffmpeg, OBS, curl and the
+ *   desktop app can all do this, and it is the efficient one.
+ * - A sequence of small POSTs, for browsers. Chrome only allows a streaming
+ *   request body over HTTP/2, and a nixamp on your own network is plain
+ *   HTTP/1.1, so a phone that wants to broadcast has to send chunks.
+ *
+ * Both end up writing into the same ffmpeg stdin, which is what makes the two
+ * paths interchangeable to everything downstream.
+ *
+ * And a third, which is the one anything native should use: RTMP. Point OBS,
+ * Larix or another ffmpeg at rtmp://this-machine/live/<key> and it publishes,
+ * with no nixamp-shaped client in the middle. ffmpeg listens for it (-rtmp_listen),
+ * so this costs no dependency and no protocol implementation. The HTTP paths
+ * above are not a workaround for that: they are what a *browser* has, since a
+ * web page cannot speak RTMP at all.
+ */
+import { spawn, type ChildProcess } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import type { Readable } from "node:stream";
+
+/** A live source is one session at a time: two would be two songs at once. */
+export interface IngestSession {
+  id: string;
+  /** What the sender called itself. */
+  name: string;
+  /** The container the sender is producing, e.g. webm from MediaRecorder. */
+  format: string;
+  startedAt: number;
+  bytes: number;
+}
+
+export interface IngestStatus {
+  live: boolean;
+  session: IngestSession | null;
+  /** Where a native broadcaster should publish, when one is being listened for. */
+  rtmp: { port: number; path: string } | null;
+}
+
+/** Containers a browser or a desktop encoder actually produces. */
+const FORMATS = new Set(["webm", "ogg", "mp4", "matroska", "mp3", "wav", "flv"]);
+
+/**
+ * ffmpeg's `-f` is a demuxer name, and passing an unknown one is how a stream
+ * dies four seconds in with a message nobody sees. An unrecognised container is
+ * refused up front instead.
+ */
+export function normaliseFormat(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const format = value.trim().toLowerCase();
+  if (format === "") return null;
+  // A MediaRecorder mime type: audio/webm;codecs=opus.
+  // The subtype may carry a hyphen: audio/x-matroska is what some browsers
+  // hand out, and stopping at the hyphen turned it into "x".
+  const fromMime = /^(?:audio|video)\/([a-z0-9-]+)/.exec(format)?.[1];
+  const candidate = fromMime ?? format;
+  const mapped = candidate === "x-matroska" ? "matroska" : candidate;
+  return FORMATS.has(mapped) ? mapped : null;
+}
+
+export interface IngestOptions {
+  ffmpeg: string[];
+  /** Where the decoded audio should go: a file ffmpeg writes, or a pipe. */
+  sink: string;
+  /** Called when a session starts, so the player can switch to it. */
+  onStart: (session: IngestSession) => void;
+  /** Called when it ends, cleanly or otherwise. */
+  onEnd: (session: IngestSession, error: string) => void;
+  /** Encoded audio, as it arrives from a live publisher. */
+  onAudio?: (chunk: Buffer) => void;
+}
+
+/**
+ * The live input.
+ *
+ * One session at a time: a second sender is refused rather than mixed, because
+ * mixing two uninvited streams is never what anybody meant.
+ */
+export class Ingest {
+  private child: ChildProcess | null = null;
+  private session: IngestSession | null = null;
+  private closing = false;
+  /** The RTMP listener, which outlives any one publisher. */
+  private rtmpChild: ChildProcess | null = null;
+  private rtmpPort: number | null = null;
+  private rtmpKey = "";
+
+  constructor(private readonly options: IngestOptions) {}
+
+  status(): IngestStatus {
+    return {
+      live: this.session !== null,
+      session: this.session,
+      rtmp: this.rtmpPort === null ? null : { port: this.rtmpPort, path: `/live/${this.rtmpKey}` },
+    };
+  }
+
+  get live(): boolean {
+    return this.session !== null;
+  }
+
+  /**
+   * Open a session. Returns the session, or null when one is already running:
+   * the caller answers 409, because "somebody else is already broadcasting" is
+   * a different problem from "your request was wrong".
+   */
+  open(name: string, format: string): IngestSession | null {
+    if (this.session !== null) return null;
+
+    const session: IngestSession = {
+      id: randomBytes(8).toString("hex"),
+      name: name || "a device",
+      format,
+      startedAt: Date.now(),
+      bytes: 0,
+    };
+
+    const [command, ...prefix] = this.options.ffmpeg as [string, ...string[]];
+    const child = spawn(
+      command,
+      [
+        ...prefix,
+        "-hide_banner",
+        "-loglevel", "error",
+        // The demuxer is stated because ffmpeg mis-probes a live, unseekable
+        // pipe: it reads a few kilobytes, guesses, and guesses wrong.
+        "-f", format,
+        "-i", "pipe:0",
+        "-vn",
+        "-c:a", "libmp3lame",
+        "-b:a", "192k",
+        "-y",
+        "-f", "mp3",
+        this.options.sink,
+      ],
+      { stdio: ["pipe", "ignore", "pipe"] },
+    );
+
+    let tail = "";
+    child.stderr?.on("data", (chunk: Buffer) => {
+      tail = (tail + chunk.toString()).slice(-2000);
+    });
+    // A sender that hangs up mid-write breaks the pipe, and an unhandled EPIPE
+    // takes the whole server down with it.
+    child.stdin?.on("error", () => this.close(""));
+    child.on("error", (error) => this.close(error.message));
+    child.on("close", (code) => this.close(code === 0 ? "" : tail.trim().split("\n").pop() ?? ""));
+
+    this.child = child;
+    this.session = session;
+    this.closing = false;
+    this.options.onStart(session);
+    return session;
+  }
+
+  /** Feed it. Returns false once the session is over. */
+  write(chunk: Buffer): boolean {
+    const child = this.child;
+    const session = this.session;
+    if (child === null || session === null || child.stdin === null) return false;
+    session.bytes += chunk.byteLength;
+    return child.stdin.write(chunk);
+  }
+
+  /** Pipe a whole request body in, for a sender that can stream one. */
+  async pump(body: Readable): Promise<void> {
+    for await (const chunk of body) {
+      if (!this.write(chunk as Buffer)) {
+        // Backpressure: wait for the drain rather than growing a buffer that
+        // is really the network's problem.
+        await new Promise((done) => this.child?.stdin?.once("drain", done) ?? done(null));
+      }
+      if (this.session === null) return;
+    }
+  }
+
+  /**
+   * Wait for an RTMP publisher, and keep waiting after each one leaves.
+   *
+   * ffmpeg is the RTMP server here: `-rtmp_listen 1` binds the port and blocks
+   * until somebody publishes. It serves one publisher and exits, so the
+   * listener is started again afterwards -- otherwise a broadcaster who
+   * reconnects finds nothing listening.
+   */
+  listenRtmp(port: number, key: string): void {
+    this.rtmpPort = port;
+    this.rtmpKey = key;
+    this.armRtmp();
+  }
+
+  /** Stop waiting for publishers. */
+  stopRtmp(): void {
+    this.rtmpPort = null;
+    const listener = this.rtmpChild;
+    this.rtmpChild = null;
+    listener?.kill("SIGKILL");
+  }
+
+  private armRtmp(): void {
+    const port = this.rtmpPort;
+    if (port === null || this.rtmpChild !== null) return;
+
+    const [command, ...prefix] = this.options.ffmpeg as [string, ...string[]];
+    const child = spawn(
+      command,
+      [
+        ...prefix,
+        "-hide_banner",
+        "-loglevel", "error",
+        "-rtmp_listen", "1",
+        // Wait indefinitely: a stream that starts tomorrow is still the stream.
+        "-timeout", "-1",
+        "-f", "flv",
+        "-i", `rtmp://0.0.0.0:${port}/live/${this.rtmpKey}`,
+        "-vn",
+        "-c:a", "libmp3lame",
+        "-b:a", "192k",
+        "-y",
+        "-f", "mp3",
+        this.options.sink,
+      ],
+      // stdout is watched rather than ignored: the encoded bytes are the only
+      // honest signal that a publisher turned up. ffmpeg does not announce a
+      // connect, a healthy stream says nothing at -loglevel error, and
+      // -progress only reports at the end in this build. Audio existing means
+      // audio arrived.
+      { stdio: ["ignore", "pipe", "pipe"] },
+    );
+
+    const session: IngestSession = {
+      id: randomBytes(8).toString("hex"),
+      name: "an RTMP publisher",
+      format: "flv",
+      startedAt: Date.now(),
+      bytes: 0,
+    };
+
+    let tail = "";
+    child.stderr?.on("data", (chunk: Buffer) => {
+      tail = (tail + chunk.toString()).slice(-2000);
+    });
+
+    child.stdout?.on("data", (chunk: Buffer) => {
+      if (this.rtmpChild !== child) return;
+      if (this.session === null) {
+        this.session = session;
+        this.options.onStart(session);
+      }
+      if (this.session === session) session.bytes += chunk.byteLength;
+      // Consumed and dropped for now. The pipe has to be read either way --
+      // an unread one fills and stalls the encoder -- and handing these bytes
+      // to the listeners is the next piece of work, not a missing one here.
+      this.options.onAudio?.(chunk);
+    });
+
+    child.on("error", () => {
+      if (this.rtmpChild === child) this.rtmpChild = null;
+    });
+
+    child.on("close", () => {
+      if (this.rtmpChild !== child) return;
+      this.rtmpChild = null;
+      if (this.session === session) {
+        this.session = null;
+        // A publisher disconnecting is how a broadcast ends, not an error.
+        this.options.onEnd(session, "");
+      }
+      // Listen again for the next one.
+      if (this.rtmpPort !== null) this.armRtmp();
+    });
+
+    this.rtmpChild = child;
+  }
+
+  /** End the session, whoever ended it. */
+  close(error = ""): void {
+    if (this.closing) return;
+    this.closing = true;
+    const session = this.session;
+    const child = this.child;
+    this.session = null;
+    this.child = null;
+    try {
+      child?.stdin?.end();
+    } catch {
+      // Already broken, which is usually why we are here.
+    }
+    child?.kill("SIGKILL");
+    if (session) this.options.onEnd(session, error);
+  }
+}

package/src/main.ts

@@ -70,6 +70,8 @@ const HELP = `nixamp — it really whips the terminal's ass.
   nixamp serve [source] [options]  play here, and hand out a browser remote
   nixamp daemon start|stop|status  serve in the background, and let go of it
   nixamp admin [--url U] [--key K] who is connected, and re-stream to them
+  nixamp login [--signup]        sign in to nixamp.com
+  nixamp logout / whoami        forget it, or check it
   nixamp update [version]        re-run the installer, keeping your choices
   nixamp uninstall [--yes]       remove everything the installer created
 
@@ -83,6 +85,15 @@ Options for serve:
       --no-media   do not stream the library's bytes to remotes
       --no-key     serve to anyone who can reach the port, with no share link
       --open-port  let the port through the local firewall, and close it on exit
+      --publish    list it at nixamp.com/directory without asking first
+      --no-publish never list it, and do not ask
+      --name NAME  what to call it in the directory (default: this hostname)
+      --ingest     accept a live stream in at POST /api/ingest
+      --rtmp-in N  also listen for RTMP publishers (OBS, Larix) from port N
+      --rtmp-streams N  how many may publish at once (default 3, a port each)
+      --rtmp D     broadcast out, e.g. --rtmp youtube=<key>. Repeatable
+      --x402       charge for listening once more than 5 people are listening
+      --no-x402    never charge
 
   -v, --version    print the version
       --help       print this
@@ -169,6 +180,16 @@ export async function main(): Promise<void> {
     await admin(rest);
     return;
   }
+  if (first === "login" || first === "signup") {
+    const { login } = await import("./session.ts");
+    process.exitCode = await login(first === "signup" ? [...rest, "--signup"] : rest);
+    return;
+  }
+  if (first === "logout" || first === "whoami") {
+    const session = await import("./session.ts");
+    process.exitCode = first === "logout" ? session.logout() : await session.whoami();
+    return;
+  }
   if (first === "update" || first === "uninstall") {
     const manage = await import("./manage.ts");
     process.exitCode = first === "update" ? manage.update(rest) : manage.uninstall(rest);

package/src/manage.ts

@@ -9,6 +9,7 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 
 /** What the installer recorded about this install. */
 export interface Manifest {
@@ -31,7 +32,7 @@ const windows = process.platform === "win32";
  * wrote, which is the only thing that knows for certain; the walk up from this
  * file covers a shim from an older install that did not set it.
  */
-export function installRoot(from = new URL(".", import.meta.url).pathname): string | null {
+export function installRoot(from = fileURLToPath(new URL(".", import.meta.url))): string | null {
   const declared = process.env["NIXAMP_HOME"];
   if (declared && existsSync(join(declared, "manifest.json"))) return declared;