nixamp 0.2.0 → 0.4.0

package/src/paywall.ts

@@ -0,0 +1,198 @@
+/**
+ * Paying to listen, once a stream is busy.
+ *
+ * A nixamp serving a handful of friends should cost nothing and ask nothing.
+ * Past that it is bandwidth someone is paying for, so the gate opens: over the
+ * free listener count, a new listener is answered 402 with an x402 offer and a
+ * dollar buys a day.
+ *
+ * Three things are deliberate. The count is of *live* listeners, so a stream
+ * quietens back to free on its own. Only the audio is gated, because a 402 on
+ * /api/state would break the page that has to render the offer. And nobody is
+ * ever cut off mid-track: the gate is asked once, when a request arrives, and
+ * a listener who got in stays in.
+ */
+import { createGateway } from "@profullstack/x402-gateway";
+import type { IncomingMessage, ServerResponse } from "node:http";
+
+/** Listeners who get in for nothing. The sixth is the one who pays. */
+export const FREE_LISTENERS = 5;
+
+export interface PaywallConfig {
+  enabled: boolean;
+  /** EVM address that receives the USDC. Without one there is nothing to pay to. */
+  payTo: string;
+  /** A scoped CoinPay key with payments:create. */
+  coinpayKey: string;
+  priceCents: number;
+  /** What one price buys. 1440 is a day. */
+  passMinutes: number;
+}
+
+export const DEFAULT_PAYWALL: PaywallConfig = {
+  enabled: false,
+  payTo: "",
+  coinpayKey: "",
+  priceCents: 100,
+  passMinutes: 1440,
+};
+
+/** Only the audio is behind the gate. */
+export const GATED = ["/api/stream/", "/api/media/", "/api/live"];
+
+export function isGated(path: string): boolean {
+  return GATED.some((prefix) => path.startsWith(prefix));
+}
+
+/**
+ * Whether this request should be charged at all. Configuration first, because
+ * a disabled paywall must never answer 402; then the path, then how busy the
+ * stream is.
+ */
+export function shouldCharge(config: PaywallConfig, path: string, liveListeners: number): boolean {
+  if (!config.enabled || !config.payTo) return false;
+  if (!isGated(path)) return false;
+  return liveListeners > FREE_LISTENERS;
+}
+
+export interface PaywallOptions {
+  config: () => PaywallConfig;
+  /** How many listeners are on the audio routes right now. */
+  liveListeners: () => number;
+  /**
+   * The origin a payer is quoted, which has to be one they can reach. A
+   * function because the port is not known until the socket is bound.
+   */
+  siteUrl: () => string;
+  /** True for the operator's own browser, which never pays to hear its own music. */
+  exempt: (request: IncomingMessage) => boolean;
+}
+
+/**
+ * A node http shim over the gateway's Fetch-API handler. Returns true when it
+ * answered the request, so the server's own routing can stop.
+ */
+export function createPaywall(options: PaywallOptions) {
+  let built: { key: string; handle: (request: Request) => Promise<Response | null> } | null = null;
+
+  /** Rebuilt when the configuration changes, because it can change at runtime. */
+  const gateway = (config: PaywallConfig, siteUrl: string) => {
+    const key = `${siteUrl} ${JSON.stringify(config)}`;
+    if (built?.key === key) return built.handle;
+    const gate = createGateway({
+      siteUrl,
+      siteName: "nixamp",
+      payTo: config.payTo,
+      priceCents: config.priceCents,
+      passMinutes: config.passMinutes,
+      coinpay: { apiKey: config.coinpayKey },
+      header: "x-nixamp-pass",
+      path: "/listen/pay",
+      // Whether to charge is about how busy this stream is, not about who is
+      // asking, so the agent lists play no part.
+      isPaidAgent: () => true,
+      benefits: ["Listen to this stream for a day, as many tracks as you like."],
+    });
+    built = { key, handle: (request) => gate.handle(request) };
+    return built.handle;
+  };
+
+  return async function paywall(
+    request: IncomingMessage,
+    response: ServerResponse,
+    path: string,
+  ): Promise<boolean> {
+    const config = options.config();
+    // The sales page answers whenever the paywall is configured, so a listener
+    // can buy a pass before the stream is busy enough to need one.
+    const selling = config.enabled && config.payTo !== "" && path.startsWith("/listen/pay");
+    if (!selling && !shouldCharge(config, path, options.liveListeners())) return false;
+    if (options.exempt(request)) return false;
+
+    const siteUrl = options.siteUrl();
+    const answer = await gateway(config, siteUrl)(toRequest(request, siteUrl));
+    if (answer === null) return false;
+
+    const body = await rewrite(answer, siteUrl);
+    response.writeHead(answer.status, {
+      ...Object.fromEntries(answer.headers),
+      "content-length": String(body.byteLength),
+    });
+    response.end(body);
+    return true;
+  };
+}
+
+/**
+ * The gateway sells crawl access, and says so: its 402 tells the caller that
+ * "payment is required for training crawlers". Someone trying to hear a song
+ * is not a crawler, so the sentence is replaced on the way out. The offer
+ * itself is untouched -- only the words are ours.
+ */
+export async function rewrite(answer: Response, siteUrl: string): Promise<Buffer> {
+  const raw = Buffer.from(await answer.arrayBuffer());
+  if (answer.status !== 402 || !(answer.headers.get("content-type") ?? "").includes("json")) return raw;
+
+  try {
+    const parsed = JSON.parse(raw.toString("utf8")) as Record<string, unknown>;
+    parsed["error"] =
+      `This stream has more than ${FREE_LISTENERS} people listening. ` +
+      `A pass is ${(parsed as { pass?: { price?: string } }).pass?.price ?? "$1"} for a day: ${siteUrl}/listen/pay`;
+    return Buffer.from(JSON.stringify(parsed));
+  } catch {
+    // Not JSON after all: send exactly what the gateway produced.
+    return raw;
+  }
+}
+
+/**
+ * Enough of a Fetch Request for the gateway: it reads the URL, the method and
+ * headers. A body would need streaming, and nothing it gates has one.
+ */
+export function toRequest(request: IncomingMessage, siteUrl: string): Request {
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(request.headers)) {
+    if (value === undefined) continue;
+    headers.set(name, Array.isArray(value) ? value.join(", ") : value);
+  }
+  return new Request(new URL(request.url ?? "/", siteUrl), {
+    method: request.method ?? "GET",
+    headers,
+  });
+}
+
+/** Read a paywall out of the environment, for an operator who runs one by hand. */
+export function paywallFromEnv(env: NodeJS.ProcessEnv = process.env): PaywallConfig {
+  const price = Number(env["NIXAMP_PRICE_CENTS"]);
+  const minutes = Number(env["NIXAMP_PASS_MINUTES"]);
+  return {
+    enabled: env["NIXAMP_X402"] === "1",
+    payTo: env["NIXAMP_PAY_TO"] ?? "",
+    coinpayKey: env["COINPAY_X402_KEY"] ?? "",
+    priceCents: Number.isFinite(price) && price > 0 ? Math.floor(price) : DEFAULT_PAYWALL.priceCents,
+    passMinutes:
+      Number.isFinite(minutes) && minutes > 0 ? Math.floor(minutes) : DEFAULT_PAYWALL.passMinutes,
+  };
+}
+
+/**
+ * The directory's answer may carry a configuration, which is how a server is
+ * turned on and off from nixamp.com. Anything missing keeps what it had, and
+ * a payTo the operator did not set is never invented here.
+ */
+export function applyRemoteConfig(current: PaywallConfig, remote: unknown): PaywallConfig {
+  if (typeof remote !== "object" || remote === null) return current;
+  const record = remote as Record<string, unknown>;
+  const price = Number(record["priceCents"]);
+  const minutes = Number(record["passMinutes"]);
+  return {
+    enabled: typeof record["enabled"] === "boolean" ? record["enabled"] : current.enabled,
+    payTo: typeof record["payTo"] === "string" && record["payTo"] ? record["payTo"] : current.payTo,
+    coinpayKey:
+      typeof record["coinpayKey"] === "string" && record["coinpayKey"]
+        ? record["coinpayKey"]
+        : current.coinpayKey,
+    priceCents: Number.isFinite(price) && price > 0 ? Math.floor(price) : current.priceCents,
+    passMinutes: Number.isFinite(minutes) && minutes > 0 ? Math.floor(minutes) : current.passMinutes,
+  };
+}

package/src/playlist.ts

@@ -15,6 +15,11 @@ import {
 export const AUDIO_EXTENSIONS = new Set([
   ".mp3", ".flac", ".ogg", ".oga", ".opus", ".m4a", ".aac",
   ".wav", ".wma", ".aiff", ".aif", ".alac", ".mp4", ".webm",
+  // Video containers, for their audio. Everything on the way out of here is
+  // already decoded by ffmpeg and re-encoded to MP3 with -vn, so a film is a
+  // long track with a picture nobody asked for -- and a library of them was
+  // invisible to nixamp for want of the extension being on this list.
+  ".mkv", ".avi", ".mov", ".m4v", ".mpg", ".mpeg", ".wmv", ".flv",
 ]);
 
 export function isAudio(path: string): boolean {

package/src/publish.ts

@@ -0,0 +1,137 @@
+/**
+ * Publishing to the directory, and asking first.
+ *
+ * Listing a stream tells the world an address it can reach you on, so it is
+ * never done silently. The prompt defaults to yes; a terminal that cannot ask
+ * defaults to no, because "there was nobody to ask" is not consent.
+ */
+import { createInterface } from "node:readline/promises";
+import { DEFAULT_DIRECTORY, HEARTBEAT_MS, type Listing } from "./directory.ts";
+
+export interface PublishTarget {
+  directory: string;
+  name: string;
+  /** The listen link: what a stranger opens. Never the control key. */
+  url: string;
+  /**
+   * The same stream as bytes, for a listener that cannot hold a cookie.
+   *
+   * The phone line plays this address into a call. The listen link cannot be
+   * played: it is a redirect that sets a cookie, and Telnyx fetching it once
+   * gets a 401 in JSON, which is a caller hearing nothing.
+   */
+  audio?: string;
+  tracks: number;
+  nowPlaying: () => string;
+  /**
+   * The account this stream belongs to, from `nixamp login`.
+   *
+   * The directory used to take anybody's word for a listing. It cannot any
+   * more: a listing now carries a phone code people dial and minutes somebody
+   * pays for, so it has to be attributable. Reading the directory is still
+   * open to everyone -- it is announcing that needs a name behind it.
+   */
+  token?: string;
+  /**
+   * Called with whatever configuration the directory sent back. This is how
+   * nixamp.com turns x402 on and off for a server without it restarting.
+   */
+  onConfig?: (config: unknown) => void;
+  /** Called when the directory refused us for want of an account. */
+  onRefused?: () => void;
+}
+
+/**
+ * Ask, with yes as the default. Returns false without asking when there is no
+ * terminal on the other end, which is the case for the daemon and for CI.
+ */
+export async function confirm(question: string, tty = process.stdin.isTTY === true): Promise<boolean> {
+  if (!tty) return false;
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (await rl.question(`${question} [Y/n] `)).trim().toLowerCase();
+    return answer === "" || answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+}
+
+/**
+ * Announce, then keep announcing. The directory forgets an entry that stops
+ * renewing, so stopping the heartbeat is how a stream leaves the list even if
+ * the process dies without saying goodbye.
+ */
+export class Publisher {
+  private id: string | null = null;
+  private timer: ReturnType<typeof setInterval> | null = null;
+  /** Whether we have already said that the directory wants an account. */
+  private refused = false;
+
+  constructor(
+    private readonly target: PublishTarget,
+    private readonly fetcher: typeof fetch = fetch,
+  ) {}
+
+  async start(): Promise<Listing | null> {
+    const first = await this.announce();
+    this.timer = setInterval(() => void this.announce(), HEARTBEAT_MS);
+    this.timer.unref?.();
+    return first;
+  }
+
+  async announce(): Promise<Listing | null> {
+    try {
+      const response = await this.fetcher(`${this.target.directory}/api/directory`, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          ...(this.target.token ? { authorization: `Bearer ${this.target.token}` } : {}),
+        },
+        body: JSON.stringify({
+          ...(this.id ? { id: this.id } : {}),
+          name: this.target.name,
+          url: this.target.url,
+          ...(this.target.audio ? { audio: this.target.audio } : {}),
+          tracks: this.target.tracks,
+          nowPlaying: this.target.nowPlaying(),
+        }),
+      });
+      if (!response.ok) {
+        // Worth telling the operator about exactly once. A heartbeat that is
+        // refused every 90 seconds should not print every 90 seconds, and
+        // "could not reach the directory" would be the wrong thing to say
+        // about a directory that answered perfectly clearly.
+        if (response.status === 401 && !this.refused) {
+          this.refused = true;
+          this.target.onRefused?.();
+        }
+        return null;
+      }
+      const listing = (await response.json()) as Listing & { config?: unknown };
+      this.id = listing.id;
+      if (listing.config !== undefined) this.target.onConfig?.(listing.config);
+      return listing;
+    } catch {
+      // The directory being down is not a reason for a player to stop playing.
+      return null;
+    }
+  }
+
+  /** Leave the list now rather than waiting to be forgotten. */
+  async stop(): Promise<void> {
+    if (this.timer) clearInterval(this.timer);
+    this.timer = null;
+    if (this.id === null) return;
+    try {
+      await this.fetcher(`${this.target.directory}/api/directory?id=${encodeURIComponent(this.id)}`, {
+        method: "DELETE",
+        ...(this.target.token ? { headers: { authorization: `Bearer ${this.target.token}` } } : {}),
+      });
+    } catch {
+      // It expires on its own within the TTL, which is the point of the TTL.
+    }
+    this.id = null;
+  }
+}
+
+export { DEFAULT_DIRECTORY };

package/src/rtmp-in.ts

@@ -0,0 +1,90 @@
+/**
+ * RTMP publishers, several at once.
+ *
+ * ffmpeg's RTMP listener serves one connection and exits, so N simultaneous
+ * publishers means N listeners on N ports. That is the honest cost of using
+ * ffmpeg as the RTMP server rather than implementing the protocol, and it buys
+ * a broadcaster that every phone and desktop app already speaks.
+ *
+ * Each listener decodes to MP3 itself, so its channel fans those bytes out
+ * without decoding them a second time.
+ */
+import { spawn, type ChildProcess } from "node:child_process";
+import type { Channels } from "./channels.ts";
+
+export interface RtmpSlot {
+  port: number;
+  /** The channel a publisher on this port lands on. */
+  id: string;
+}
+
+/**
+ * Arm a listener per slot, and arm it again after each publisher leaves --
+ * otherwise a broadcaster who reconnects finds nothing listening.
+ */
+export class RtmpListeners {
+  private readonly running = new Map<number, ChildProcess>();
+  private stopped = false;
+
+  constructor(
+    private readonly channels: Channels,
+    private readonly ffmpeg: string[],
+    private readonly key: string,
+  ) {}
+
+  listen(slots: RtmpSlot[]): void {
+    for (const slot of slots) this.arm(slot);
+  }
+
+  private arm(slot: RtmpSlot): void {
+    if (this.stopped || this.running.has(slot.port)) return;
+
+    const [command, ...prefix] = this.ffmpeg as [string, ...string[]];
+    const child = spawn(
+      command,
+      [
+        ...prefix,
+        "-hide_banner",
+        "-loglevel", "error",
+        "-rtmp_listen", "1",
+        // Wait indefinitely: a stream that starts tomorrow is still the stream.
+        "-timeout", "-1",
+        "-f", "flv",
+        "-i", `rtmp://0.0.0.0:${slot.port}/live/${this.key}`,
+        "-vn",
+        "-c:a", "libmp3lame",
+        "-b:a", "192k",
+        "-y",
+        "-f", "mp3",
+        "pipe:1",
+      ],
+      { stdio: ["ignore", "pipe", "pipe"] },
+    );
+    this.running.set(slot.port, child);
+
+    // The first bytes are the only honest signal that a publisher turned up:
+    // ffmpeg does not announce a connect, and a healthy stream says nothing at
+    // -loglevel error.
+    let channel: ReturnType<Channels["attach"]> = null;
+    child.stdout?.on("data", (chunk: Buffer) => {
+      channel ??= this.channels.attach(slot.id, "an RTMP publisher", "flv", "rtmp");
+      channel?.feed(chunk);
+    });
+    child.stdout?.on("error", () => child.kill("SIGKILL"));
+    child.on("error", () => this.done(slot, child, channel));
+    child.on("close", () => this.done(slot, child, channel));
+  }
+
+  private done(slot: RtmpSlot, child: ChildProcess, channel: { close(): void } | null): void {
+    if (this.running.get(slot.port) !== child) return;
+    this.running.delete(slot.port);
+    channel?.close();
+    if (!this.stopped) this.arm(slot);
+  }
+
+  stop(): void {
+    this.stopped = true;
+    for (const child of this.running.values()) child.kill("SIGKILL");
+    this.running.clear();
+  }
+}