nixamp 0.2.0 → 0.4.0

package/src/server.ts

@@ -11,12 +11,42 @@
  */
 import { createReadStream, statSync } from "node:fs";
 import { createServer as createHttpServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
-import { networkInterfaces } from "node:os";
+import { hostname, networkInterfaces } from "node:os";
 import { spawn, spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { Connections, type Kind } from "./connections.ts";
-import { isRemote } from "./sources.ts";
 import {
+  Broadcaster,
+  DEFAULT_ENCODER,
+  type Destination,
+  type EncoderSettings,
+  PRESETS,
+  redact,
+} from "./broadcast.ts";
+import { Ingest, normaliseFormat } from "./ingest.ts";
+import { Channels, cleanId } from "./channels.ts";
+import { RtmpListeners } from "./rtmp-in.ts";
+import { Accounts, clearedCookie, sessionCookie, tokenFrom } from "./accounts.ts";
+import { needsAdmin, Owner } from "./owner.ts";
+import { readSession } from "./session.ts";
+import { Directory, ENDED_TTL_MS, parseAnnouncement, type Listing } from "./directory.ts";
+import { PartyLine, telnyxSms } from "./partyline.ts";
+import { CALL_IN_NUMBER, OPT_IN_PATH, optInPage } from "./optin.ts";
+import pg from "pg";
+import { Follows, phoneFrom } from "./follows.ts";
+import { Durable } from "./durable.ts";
+import { notifyAll, resendEmail, webPush, type Notification } from "./notify.ts";
+import { confirm, DEFAULT_DIRECTORY, Publisher } from "./publish.ts";
+import {
+  applyRemoteConfig,
+  createPaywall,
+  FREE_LISTENERS,
+  type PaywallConfig,
+  paywallFromEnv,
+} from "./paywall.ts";
+import { isRemote, playsInBrowser } from "./sources.ts";
+import {
+  allowedForListening,
   elevate,
   firewallInUse,
   keyCookie,
@@ -25,9 +55,12 @@ import {
   newKey,
   portCommands,
   reachableAddresses,
+  scopeOf,
   shareLink,
+  audioLink,
 } from "./share.ts";
 import { extname, join, normalize, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
 import {
   detectTools, peaks, RATE, Stream, toMono,
   type Tools, type Track,
@@ -67,6 +100,41 @@ export interface ServeOptions {
    * failed instead of started.
    */
   announce: boolean;
+  /** Host the public directory. Only the deployment behind nixamp.com does. */
+  directory: boolean;
+  /**
+   * List this stream at nixamp.com/directory. "ask" prompts, and is the
+   * default: publishing an address without being asked is not something a
+   * player gets to decide for you.
+   */
+  publish: "ask" | "yes" | "no";
+  /** What to call it in the list. Defaults to this machine's hostname. */
+  name: string;
+  /**
+   * Charge for listening once the stream is busy. Off unless asked for, and
+   * useless without somewhere to pay: see NIXAMP_PAY_TO.
+   */
+  x402: boolean;
+  /** The account id that may administer this server, if not the signed-in one. */
+  owner: string;
+  /** Accept a live stream from a phone or a desktop, over HTTP. */
+  ingest: boolean;
+  /**
+   * Also listen for RTMP publishers on this port, which is what OBS, Larix and
+   * anything else native speaks. 0 means do not.
+   */
+  rtmpIn: number;
+  /**
+   * How many RTMP publishers may be live at once. ffmpeg's listener serves one
+   * connection per process, so this is a port and a process each: 1935, 1936,
+   * and so on. HTTP publishers are not limited by this.
+   */
+  rtmpStreams: number;
+  /**
+   * RTMP destinations, as `name=rtmp://host/app/key` or `youtube=key` for one
+   * of the presets. Repeatable.
+   */
+  rtmp: string[];
 }
 
 /**
@@ -88,6 +156,15 @@ export function parseServeArgs(argv: string[]): ServeOptions {
     key: true,
     openPort: false,
     announce: false,
+    directory: false,
+    publish: "ask",
+    name: "",
+    x402: false,
+    owner: "",
+    ingest: false,
+    rtmpIn: 0,
+    rtmpStreams: 3,
+    rtmp: [],
   };
   let sawRoot = false;
   for (let i = 0; i < argv.length; i++) {
@@ -116,6 +193,38 @@ export function parseServeArgs(argv: string[]): ServeOptions {
       options.openPort = true;
     } else if (arg === "--announce") {
       options.announce = true;
+    } else if (arg === "--directory") {
+      options.directory = true;
+    } else if (arg === "--publish") {
+      options.publish = "yes";
+    } else if (arg === "--no-publish") {
+      options.publish = "no";
+    } else if (arg === "--name") {
+      options.name = value();
+    } else if (arg === "--owner") {
+      options.owner = value();
+    } else if (arg === "--ingest") {
+      options.ingest = true;
+    } else if (arg === "--rtmp-streams") {
+      const count = Number(value());
+      if (!Number.isInteger(count) || count < 1 || count > 16) {
+        throw new Error("nixamp serve: --rtmp-streams must be between 1 and 16");
+      }
+      options.rtmpStreams = count;
+    } else if (arg === "--rtmp-in") {
+      const port = Number(value());
+      if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error("nixamp serve: --rtmp-in must be a port number");
+      }
+      options.rtmpIn = port;
+      // Listening for RTMP is accepting a live stream, so it implies --ingest.
+      options.ingest = true;
+    } else if (arg === "--rtmp") {
+      options.rtmp.push(value());
+    } else if (arg === "--x402") {
+      options.x402 = true;
+    } else if (arg === "--no-x402") {
+      options.x402 = false;
     } else if (arg.startsWith("-")) {
       throw new Error(`nixamp serve: unknown option ${arg}`);
     } else if (!sawRoot) {
@@ -483,6 +592,12 @@ export interface HandlerOptions {
   version: string;
   /** The key from the share link, or null to serve to anyone who can connect. */
   key?: string | null;
+  /**
+   * A second key that may listen but not drive. The public directory hands
+   * this one out: a link that lets a stranger pause your music is not a link
+   * you can publish.
+   */
+  listenKey?: string | null;
   /** How to run ffmpeg, for the sources a browser cannot play by itself. */
   ffmpeg?: string[];
   /** Who is listening, for the admin view. */
@@ -492,6 +607,40 @@ export interface HandlerOptions {
    * imported so the handler stays a plain function of a request.
    */
   load: (source: string) => Promise<Track[]>;
+  /**
+   * The public directory, on the instance that hosts one. Only nixamp.com
+   * passes this; a nixamp on your laptop is a publisher, not a registry.
+   */
+  directory?: Directory;
+  /** Answers a request itself when listening has to be paid for. */
+  paywall?: (request: IncomingMessage, response: ServerResponse, path: string) => Promise<boolean>;
+  /** Live audio coming in from a phone or a desktop. */
+  ingest?: Ingest;
+  /** Several live streams at once, each with its own audience. */
+  channels?: Channels;
+  /** Live audio going out to RTMP. */
+  broadcaster?: Broadcaster;
+  /** Where a broadcast should send, and what it should look like. */
+  broadcast?: () => { destinations: Destination[]; settings: EncoderSettings };
+  /** Accounts, on the instance that keeps them. Only nixamp.com passes this. */
+  accounts?: Accounts;
+  /** True when this instance is reached over https, for the cookie's Secure. */
+  secureCookies?: boolean;
+  /** Who may administer this server. */
+  owner?: Owner;
+  /**
+   * The dial-in party line, on the instance that answers the phone number.
+   * Only nixamp.com passes this; a nixamp on a laptop has no number.
+   */
+  partyLine?: PartyLine;
+  /**
+   * Following broadcasters, and where to reach the people who do. Durable,
+   * unlike everything else here, because the point of a follow is to outlive
+   * the stream.
+   */
+  follows?: Follows;
+  /** The VAPID public key a browser needs before it can subscribe. */
+  vapidPublicKey?: string;
 }
 
 /**
@@ -526,6 +675,7 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
     const url = new URL(request.url ?? "/", "http://localhost");
     const path = url.pathname;
     const key = options.key ?? null;
+    const listenKey = options.listenKey ?? null;
 
     if (request.method === "OPTIONS") {
       response.writeHead(204, CORS);
@@ -533,29 +683,252 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       return;
     }
 
-    // Opening the share link is what hands a browser its key. It comes back as
-    // a cookie, so every later fetch, EventSource and <audio src> carries it
-    // without the page knowing anything about keys.
+    // Opening a share link is what hands a browser its key. It comes back as a
+    // cookie, so every later fetch, EventSource and <audio src> carries it
+    // without the page knowing anything about keys. Either key works here, and
+    // which one was used decides what the browser can then do.
     if (key !== null && path.startsWith("/s/")) {
       const offered = decodeURIComponent(path.slice("/s/".length));
-      if (!keysMatch(offered, key)) {
+      if (scopeOf(offered, key, listenKey) === null) {
         json(response, 404, { error: "not found" });
         return;
       }
-      response.writeHead(302, { ...CORS, "set-cookie": keyCookie(key), location: "/" });
+      response.writeHead(302, { ...CORS, "set-cookie": keyCookie(offered), location: "/" });
       response.end();
       return;
     }
 
+    // The page explaining the reminder texts. Public for the same reason the
+    // webhook is: the reader is a carrier reviewing the number, or somebody
+    // who just got a message and wants it to stop. Neither has a share link.
+    if (path === OPT_IN_PATH && options.partyLine) {
+      const body = optInPage();
+      response.writeHead(200, {
+        ...CORS,
+        "content-type": "text/html; charset=utf-8",
+        "content-length": Buffer.byteLength(body),
+      });
+      response.end(request.method === "HEAD" ? undefined : body);
+      return;
+    }
+
+    // --- following a broadcaster ------------------------------------------
+    //
+    // Behind the sign-in rather than the share key: a follow belongs to an
+    // account, and an account is the only thing that makes "notify me on my
+    // other device" mean anything.
+    if (path.startsWith("/api/v1/follows") && options.follows && options.accounts) {
+      const me = await options.accounts.whoIs(tokenFrom(request.headers));
+      if (me === null) {
+        json(response, 401, { error: "sign in to follow" });
+        return;
+      }
+      const follows = options.follows;
+
+      if (path === "/api/v1/follows" && request.method === "GET") {
+        const ids = await follows.following(me.id);
+        // An id is not a name. The directory is the only thing that knows what
+        // an account calls itself, from the last stream it announced -- which
+        // is empty for somebody who has never streamed, and the caller decides
+        // what to show for that rather than being handed a blank.
+        json(response, 200, {
+          following: ids.map((id) => ({
+            id,
+            name: options.directory?.nameOf(id) ?? "",
+            live: options.directory?.isLive(id) ?? false,
+          })),
+        });
+        return;
+      }
+
+      const streamer = path.slice("/api/v1/follows/".length);
+      if (!path.startsWith("/api/v1/follows/") || !streamer) {
+        json(response, 404, { error: "no such endpoint" });
+        return;
+      }
+
+      if (request.method === "PUT" || request.method === "POST") {
+        const added = await follows.follow(me.id, decodeURIComponent(streamer));
+        // Following yourself is refused rather than silently stored: you do
+        // not need telling that you went live.
+        json(response, added ? 200 : 422, added
+          ? { following: true, followers: await follows.followerCount(decodeURIComponent(streamer)) }
+          : { error: "you cannot follow yourself" });
+        return;
+      }
+      if (request.method === "DELETE") {
+        await follows.unfollow(me.id, decodeURIComponent(streamer));
+        json(response, 200, { following: false });
+        return;
+      }
+      if (request.method === "GET") {
+        json(response, 200, { following: await follows.isFollowing(me.id, decodeURIComponent(streamer)) });
+        return;
+      }
+      json(response, 405, { error: "PUT, DELETE or GET" });
+      return;
+    }
+
+    // --- where to reach a follower ----------------------------------------
+    if (path.startsWith("/api/v1/notify") && options.follows && options.accounts) {
+      // The key is public by design: it is what a browser needs before it can
+      // ask permission, and it is useless without the private half.
+      if (path === "/api/v1/notify/key" && request.method === "GET") {
+        json(response, 200, { publicKey: options.vapidPublicKey ?? "" });
+        return;
+      }
+
+      const me = await options.accounts.whoIs(tokenFrom(request.headers));
+      if (me === null) {
+        json(response, 401, { error: "sign in first" });
+        return;
+      }
+      const follows = options.follows;
+
+      if (path === "/api/v1/notify/prefs") {
+        if (request.method === "GET") {
+          json(response, 200, await follows.prefs(me.id));
+          return;
+        }
+        if (request.method !== "PUT" && request.method !== "POST") {
+          json(response, 405, { error: "GET or PUT" });
+          return;
+        }
+        let body: Record<string, unknown>;
+        try {
+          body = JSON.parse(await readBody(request)) as Record<string, unknown>;
+        } catch {
+          json(response, 400, { error: "bad JSON" });
+          return;
+        }
+        // A number we cannot dial is worse than no number: it is a text that
+        // silently goes nowhere for as long as nobody checks.
+        if (body["phone"] !== undefined && body["phone"] !== "" && !phoneFrom(body["phone"])) {
+          json(response, 422, { error: "that does not look like a phone number" });
+          return;
+        }
+        await follows.setPrefs(me.id, {
+          ...(body["phone"] === undefined ? {} : { phone: String(body["phone"]) }),
+          ...(typeof body["wantsEmail"] === "boolean" ? { wantsEmail: body["wantsEmail"] } : {}),
+          ...(typeof body["wantsSms"] === "boolean" ? { wantsSms: body["wantsSms"] } : {}),
+          ...(typeof body["wantsWeb"] === "boolean" ? { wantsWeb: body["wantsWeb"] } : {}),
+        });
+        json(response, 200, await follows.prefs(me.id));
+        return;
+      }
+
+      if (path === "/api/v1/notify/subscribe") {
+        if (request.method === "DELETE") {
+          const endpoint = url.searchParams.get("endpoint") ?? "";
+          await follows.removePush(endpoint);
+          json(response, 200, { ok: true });
+          return;
+        }
+        if (request.method !== "POST" && request.method !== "PUT") {
+          json(response, 405, { error: "POST or DELETE" });
+          return;
+        }
+        let body: { endpoint?: unknown; keys?: { p256dh?: unknown; auth?: unknown } };
+        try {
+          body = JSON.parse(await readBody(request)) as typeof body;
+        } catch {
+          json(response, 400, { error: "bad JSON" });
+          return;
+        }
+        const endpoint = typeof body.endpoint === "string" ? body.endpoint : "";
+        const p256dh = typeof body.keys?.p256dh === "string" ? body.keys.p256dh : "";
+        const auth = typeof body.keys?.auth === "string" ? body.keys.auth : "";
+        if (!endpoint || !p256dh || !auth) {
+          json(response, 422, { error: "a subscription needs an endpoint and both keys" });
+          return;
+        }
+        await follows.addPush(me.id, { endpoint, p256dh, auth });
+        json(response, 200, { ok: true });
+        return;
+      }
+
+      json(response, 404, { error: "no such endpoint" });
+      return;
+    }
+
+    // --- the party line ---------------------------------------------------
+    //
+    // Ahead of the share-key check because the caller is a telephone. Telnyx
+    // has no cookie and no link; what it has is an ed25519 signature over the
+    // body, which is a stronger claim than a key in a URL anyway.
+    if (path.startsWith("/api/v1/partyline/") && options.partyLine) {
+      const partyLine = options.partyLine;
+
+      if (path === "/api/v1/partyline/rooms") {
+        json(response, 200, { rooms: partyLine.list() });
+        return;
+      }
+
+      if (path !== "/api/v1/partyline/webhook") {
+        json(response, 404, { error: "no such endpoint" });
+        return;
+      }
+      if (request.method !== "POST") {
+        json(response, 405, { error: "POST only" });
+        return;
+      }
+
+      // The bytes as they arrived. Parsing first and reserialising would
+      // change the whitespace the signature was computed over.
+      let raw: string;
+      try {
+        raw = await readBody(request);
+      } catch {
+        json(response, 413, { error: "body too large" });
+        return;
+      }
+
+      const signature = request.headers["telnyx-signature-ed25519"];
+      const timestamp = request.headers["telnyx-timestamp"];
+      const ok = partyLine.verify(
+        raw,
+        typeof signature === "string" ? signature : undefined,
+        typeof timestamp === "string" ? timestamp : undefined,
+      );
+      if (!ok) {
+        json(response, 401, { error: "bad signature" });
+        return;
+      }
+
+      let event: { data?: { event_type?: string; payload?: Record<string, unknown> } };
+      try {
+        event = JSON.parse(raw) as typeof event;
+      } catch {
+        json(response, 400, { error: "bad JSON" });
+        return;
+      }
+
+      // Answer first, act second. Telnyx retries anything it does not hear
+      // back about quickly, and a retried call.answered would ask the caller
+      // which room they wanted twice.
+      json(response, 200, { ok: true });
+      void partyLine.handle(event.data ?? {}).catch(() => {});
+      return;
+    }
+
     // /api/health answers unauthenticated on purpose: it is how you check the
     // port is open from another device before wondering whether the link is
     // wrong, and it says nothing about the library.
-    if (key !== null && path !== "/api/health") {
-      const offered = keyFrom(request, url);
-      if (offered === null || !keysMatch(offered, key)) {
+    if (
+      key !== null &&
+      path !== "/api/health" &&
+      path !== "/api/directory" &&
+      !path.startsWith("/api/v1/auth/")
+    ) {
+      const scope = scopeOf(keyFrom(request, url), key, listenKey);
+      if (scope === null) {
         json(response, 401, { error: "this nixamp needs the key from its share link" });
         return;
       }
+      if (scope === "listen" && !allowedForListening(path)) {
+        json(response, 403, { error: "this link can listen, not drive" });
+        return;
+      }
     }
 
     if (path === "/api/health") {
@@ -563,6 +936,394 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       return;
     }
 
+    // --- accounts ---------------------------------------------------------
+    //
+    // Before the share-key check, because signing in is how somebody without a
+    // key becomes somebody with one. The API is versioned and namespaced the
+    // way the rest of the fleet's is.
+    if (path.startsWith("/api/v1/auth/") && options.accounts) {
+      const accounts = options.accounts;
+      const secure = options.secureCookies ?? false;
+
+      if (path === "/api/v1/auth/me") {
+        const who = await accounts.whoIs(tokenFrom(request.headers));
+        if (who === null) {
+          json(response, 401, { error: "not signed in" });
+          return;
+        }
+        json(response, 200, { account: who });
+        return;
+      }
+
+      if (path === "/api/v1/auth/logout") {
+        response.writeHead(200, {
+          ...CORS,
+          "content-type": "application/json; charset=utf-8",
+          "set-cookie": clearedCookie(),
+        });
+        response.end(JSON.stringify({ ok: true }));
+        return;
+      }
+
+      const signingUp = path === "/api/v1/auth/signup";
+      if (!signingUp && path !== "/api/v1/auth/login") {
+        json(response, 404, { error: "no such endpoint" });
+        return;
+      }
+      if (request.method !== "POST") {
+        json(response, 405, { error: "POST only" });
+        return;
+      }
+
+      let body: { email?: unknown; password?: unknown };
+      try {
+        body = JSON.parse(await readBody(request)) as typeof body;
+      } catch {
+        json(response, 400, { error: "bad JSON" });
+        return;
+      }
+
+      const result = signingUp
+        ? await accounts.signUp(body.email, body.password)
+        : await accounts.signIn(body.email, body.password);
+
+      if (!result.ok) {
+        // 409 for an address that is taken, 401 for credentials that are not.
+        json(response, signingUp ? 409 : 401, { error: result.error });
+        return;
+      }
+
+      // The token goes back in the body for the CLI and the desktop app, and
+      // as a cookie for the browser, which then needs to know nothing about it.
+      response.writeHead(200, {
+        ...CORS,
+        "content-type": "application/json; charset=utf-8",
+        "set-cookie": sessionCookie(result.token, secure),
+      });
+      response.end(JSON.stringify({ account: result.account, token: result.token }));
+      return;
+    }
+
+    // The directory is public to read and answered before the key check,
+    // because a visitor to nixamp.com has no key and is exactly who it is for.
+    //
+    // Announcing is not public any more. A listing now carries a phone number
+    // people dial and minutes we pay for, so it has to be attributable to
+    // somebody: broadcasters register, and a caller just dials. Reading stays
+    // open to everyone -- the whole point is a directory a stranger can browse.
+    if (path === "/api/directory" && options.directory) {
+      if (request.method === "GET") {
+        // Each stream carries its call-in code and how many people are on the
+        // phone for it. The code is published on purpose: it is a public
+        // call-in line, and a listing you cannot dial is a listing of nothing.
+        const onThePhone = options.partyLine;
+        const streams = options.directory.list().map((stream) => ({
+          ...stream,
+          callers: onThePhone ? onThePhone.listenersOn(stream.code) : 0,
+        }));
+        // Recently ended too, because following exists to hear about
+        // broadcasts you would otherwise miss -- and a list of only what is on
+        // can only be used to follow somebody during a broadcast you did not
+        // miss. No url and no code: there is nothing to listen to.
+        const recent = options.directory.recentlyEnded().map((stream) => ({
+          name: stream.name,
+          ownerId: stream.ownerId,
+          nowPlaying: stream.nowPlaying,
+          endedAt: stream.endedAt,
+        }));
+        json(response, 200, { streams, recent, callIn: CALL_IN_NUMBER, now: Date.now() });
+        return;
+      }
+      if (request.method === "POST") {
+        // Only where there are accounts to check against. An instance with no
+        // Accounts is somebody's laptop, which has no registration to demand.
+        let ownerId = "";
+        if (options.accounts) {
+          const who = await options.accounts.whoIs(tokenFrom(request.headers));
+          if (who === null) {
+            json(response, 401, {
+              error: "sign in to list a stream: nixamp login, then nixamp serve --directory",
+            });
+            return;
+          }
+          // From the token, never the body. A stream that could name its own
+          // owner could name somebody else's, and their followers would be
+          // told about a broadcast that person is not making.
+          ownerId = who.id;
+        }
+
+        let announcement;
+        try {
+          announcement = parseAnnouncement(JSON.parse(await readBody(request)));
+        } catch {
+          json(response, 400, { error: "bad JSON" });
+          return;
+        }
+        if (announcement === null) {
+          json(response, 422, { error: "a listing needs a name and a URL a browser can reach" });
+          return;
+        }
+        const listing = options.directory.announce(announcement, ownerId);
+        // A stream reappearing is the event somebody asked to be told about.
+        // Answered first and texted after, because the publisher's heartbeat
+        // should not wait on an SMS gateway.
+        json(response, 200, listing);
+        if (options.partyLine) {
+          void options.partyLine
+            .wentLive({ code: listing.code, name: listing.name, nowPlaying: listing.nowPlaying })
+            .catch(() => {});
+        }
+        return;
+      }
+      if (request.method === "DELETE") {
+        const id = url.searchParams.get("id");
+        if (id) options.directory.withdraw(id);
+        json(response, 200, { ok: true });
+        return;
+      }
+      json(response, 405, { error: "GET, POST or DELETE" });
+      return;
+    }
+
+    // Administering is a different question from listening, and it is asked
+    // after the share key: the control key answers both, but a listen key or a
+    // nixamp.com session answers only one of them.
+    if (options.owner && needsAdmin(path, request.method ?? "GET")) {
+      // A server started with --no-key has said that anyone who can reach the
+      // port may drive it, and prints exactly that. Locking administration to
+      // nobody would contradict it and leave such a server unadministrable.
+      const holdsControl =
+        key === null || scopeOf(keyFrom(request, url), key, null) === "control";
+      const check = await options.owner.check(holdsControl, tokenFrom(request.headers));
+
+      if (path === "/api/admin") {
+        // Always answered, and honestly: the page has to know whether to draw
+        // an admin panel at all, and "no" is a real answer rather than a 403.
+        json(response, 200, { allowed: check.allowed, as: check.as, claimed: options.owner.claimed });
+        return;
+      }
+      if (!check.allowed) {
+        json(response, 403, {
+          error: options.owner.claimed
+            ? "sign in to nixamp.com as this server's owner, or use its control link"
+            : "this server has no owner signed in; use its control link",
+        });
+        return;
+      }
+    }
+
+    // After the key check: a paying listener still needs the link, and a 402
+    // is a worse answer than a 401 to someone who has neither.
+    if (options.paywall && (await options.paywall(request, response, path))) return;
+
+    // --- several streams at once ------------------------------------------
+    //
+    // A channel is one publisher and everybody listening to them. Two or three
+    // devices can publish at once, each to their own channel, and a listener
+    // picks which to hear.
+    if (path === "/api/channels" && options.channels) {
+      json(response, 200, { channels: options.channels.list(), listeners: options.channels.listeners });
+      return;
+    }
+
+    // Publishing. Anyone with the control link may; listening to the result is
+    // open to whoever has the share link, like the rest of the audio.
+    if (path.startsWith("/api/channels/") && options.channels) {
+      const channels = options.channels;
+      const rest = path.slice("/api/channels/".length);
+      const [rawId, action] = rest.split("/");
+      const id = cleanId(rawId);
+
+      if (action === undefined && request.method === "GET") {
+        // Listening. The response is the fan-out target: whatever ffmpeg
+        // produces for this channel is written to it until one end goes away.
+        const detach = channels.listen(id, response);
+        if (detach === null) {
+          json(response, 404, { error: "nothing is playing on that channel" });
+          return;
+        }
+        watch(request, response, "stream", id);
+        response.writeHead(200, {
+          ...CORS,
+          "content-type": "audio/mpeg",
+          "cache-control": "no-store",
+        });
+        const leave = (): void => detach();
+        request.on("close", leave);
+        response.on("close", leave);
+        return;
+      }
+
+      if (action === undefined && request.method === "DELETE") {
+        // Asked once: the second call would answer false, having just stopped
+        // the thing it was asking about.
+        const stopped = channels.stop(id);
+        json(response, stopped ? 200 : 404, { ok: stopped });
+        return;
+      }
+
+      if (request.method !== "POST") {
+        json(response, 405, { error: "GET, POST or DELETE" });
+        return;
+      }
+
+      const format = normaliseFormat(url.searchParams.get("format") ?? request.headers["content-type"]);
+      if (format === null) {
+        json(response, 415, { error: "give a container ffmpeg knows: webm, ogg, mp4, mp3, wav" });
+        return;
+      }
+      const name = url.searchParams.get("name") ?? "";
+
+      // A chunked publisher sends many requests to one channel, so the first
+      // claims it and the rest feed what is already there.
+      if (action === "chunk") {
+        if (!channels.has(id) && channels.publish(id, name, format, "http") === null) {
+          json(response, 409, { error: "that channel is already being published to" });
+          return;
+        }
+        const chunks: Buffer[] = [];
+        for await (const chunk of request) chunks.push(chunk as Buffer);
+        channels.writeTo(id, Buffer.concat(chunks));
+        json(response, 200, { ok: true });
+        return;
+      }
+
+      const claimed = channels.publish(id, name, format, "http");
+      if (claimed === null) {
+        json(response, 409, { error: "that channel is already being published to" });
+        return;
+      }
+      try {
+        await claimed.pump(request);
+      } catch {
+        // A publisher that hung up is not an error worth a 500.
+      }
+      claimed.close();
+      json(response, 200, { ok: true, bytes: claimed.info.bytes });
+      return;
+    }
+
+    // --- streaming in ---------------------------------------------------
+    //
+    // Both shapes write into the same ffmpeg, so everything downstream cannot
+    // tell which one a sender used.
+    if (path === "/api/ingest" && options.ingest) {
+      if (request.method === "GET") {
+        json(response, 200, options.ingest.status());
+        return;
+      }
+      if (request.method === "DELETE") {
+        options.ingest.close();
+        json(response, 200, { ok: true });
+        return;
+      }
+      if (request.method !== "POST") {
+        json(response, 405, { error: "GET, POST or DELETE" });
+        return;
+      }
+
+      const format = normaliseFormat(url.searchParams.get("format") ?? request.headers["content-type"]);
+      if (format === null) {
+        json(response, 415, { error: "give a container ffmpeg knows: webm, ogg, mp4, mp3, wav" });
+        return;
+      }
+
+      const session = options.ingest.open(url.searchParams.get("name") ?? "", format);
+      if (session === null) {
+        // Somebody else is already broadcasting, which is a different problem
+        // from the request being wrong.
+        json(response, 409, { error: "something is already streaming in" });
+        return;
+      }
+
+      try {
+        await options.ingest.pump(request);
+      } catch {
+        // A sender that hung up is not an error worth a 500.
+      }
+      options.ingest.close();
+      json(response, 200, { ok: true, bytes: session.bytes });
+      return;
+    }
+
+    // A browser cannot stream a request body over plain HTTP/1.1, so a phone
+    // sends its recording a chunk at a time instead.
+    if (path === "/api/ingest/chunk" && options.ingest) {
+      if (request.method !== "POST") {
+        json(response, 405, { error: "POST only" });
+        return;
+      }
+      if (!options.ingest.live) {
+        const format = normaliseFormat(url.searchParams.get("format") ?? request.headers["content-type"]);
+        if (format === null) {
+          json(response, 415, { error: "give a container ffmpeg knows: webm, ogg, mp4, mp3, wav" });
+          return;
+        }
+        if (options.ingest.open(url.searchParams.get("name") ?? "", format) === null) {
+          json(response, 409, { error: "something is already streaming in" });
+          return;
+        }
+      }
+      const chunks: Buffer[] = [];
+      for await (const chunk of request) chunks.push(chunk as Buffer);
+      options.ingest.write(Buffer.concat(chunks));
+      json(response, 200, options.ingest.status());
+      return;
+    }
+
+    // --- broadcasting out -------------------------------------------------
+    if (path === "/api/broadcast" && options.broadcaster) {
+      if (request.method === "GET") {
+        json(response, 200, options.broadcaster.status());
+        return;
+      }
+      if (request.method === "DELETE") {
+        options.broadcaster.stop();
+        json(response, 200, options.broadcaster.status());
+        return;
+      }
+      if (request.method !== "POST") {
+        json(response, 405, { error: "GET, POST or DELETE" });
+        return;
+      }
+
+      let source = "";
+      try {
+        source = String((JSON.parse(await readBody(request)) as { source?: unknown }).source ?? "");
+      } catch {
+        json(response, 400, { error: "bad JSON" });
+        return;
+      }
+      const current = engine.snapshot();
+      const chosen = source || engine.trackPath(current.index) || "";
+      if (!chosen) {
+        json(response, 422, { error: "nothing to broadcast" });
+        return;
+      }
+
+      const plan = options.broadcast?.() ?? { destinations: [], settings: DEFAULT_ENCODER };
+      const started = options.broadcaster.start({
+        source: chosen,
+        destinations: plan.destinations,
+        settings: plan.settings,
+        webAudio: false,
+        // Music has no picture, and RTMP platforms insist on a video track.
+        needsVideo: true,
+      });
+      if (!started.ok) {
+        json(response, 422, { error: started.error });
+        return;
+      }
+      json(response, 200, options.broadcaster.status());
+      return;
+    }
+
+    // Names and URLs, never a key.
+    if (path === "/api/broadcast/destinations" && options.broadcast) {
+      json(response, 200, { destinations: options.broadcast().destinations.map(redact) });
+      return;
+    }
+
     if (path === "/api/state") {
       json(response, 200, engine.snapshot());
       return;
@@ -672,7 +1433,12 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         return;
       }
       watch(request, response, "media", engine.snapshot().tracks[index]?.title ?? file);
-      sendFile(request, response, file);
+      // A browser asks for every track here, and a matroska or an avi handed
+      // to it raw is bytes it cannot play. Seeking is what this route is for
+      // and transcoding gives it up, but an unseekable film beats a silent
+      // one -- and the seekable formats are untouched.
+      if (playsInBrowser(file)) sendFile(request, response, file);
+      else transcode(request, response, file, options.ffmpeg ?? ["ffmpeg"]);
       return;
     }
 
@@ -680,6 +1446,23 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
     // a flac, a wma, a URL, an HLS stream. ffmpeg reads them all and we hand
     // the bytes on as they arrive, so a live stream starts immediately rather
     // than after it ends, which for a live stream is never.
+    // One address that keeps playing, for a listener that cannot ask for the
+    // next track: the phone line hands exactly this to Telnyx.
+    if (path === "/api/live") {
+      if (!options.media) {
+        json(response, 403, { error: "media streaming is off" });
+        return;
+      }
+      const current = engine.snapshot();
+      if (current.tracks.length === 0) {
+        json(response, 404, { error: "nothing is playing" });
+        return;
+      }
+      watch(request, response, "stream", current.tracks[current.index]?.title ?? "live");
+      liveAudio(request, response, engine, options.ffmpeg ?? ["ffmpeg"]);
+      return;
+    }
+
     if (path.startsWith("/api/stream/")) {
       const index = Number(path.slice("/api/stream/".length));
       const source = Number.isInteger(index) ? engine.trackPath(index) : undefined;
@@ -731,6 +1514,138 @@ function readIfPossible(path: string): string | null {
   }
 }
 
+/** How long to wait before looking again when the player has not moved on. */
+const LIVE_GAP_MS = 500;
+/** How long to wait when there is nothing to play at all yet. */
+const LIVE_IDLE_MS = 2000;
+
+/**
+ * Whatever is playing, as one endless MP3.
+ *
+ * /api/stream/N is one track: it needs an index, and it stops at the end of
+ * the song. That is right for a browser, which knows what is playing and can
+ * ask for the next one. It is wrong for everything that cannot -- a telephone
+ * call, `curl | mpv`, anything handed a single address and expected to keep
+ * hearing sound. Those need one URL that never ends and never needs asking
+ * again, which is what a listener means by "the stream".
+ *
+ * So this follows the player rather than an index: transcode what is playing,
+ * and when that track ends look at what is playing now and keep writing into
+ * the same response. The listener sees one continuous audio/mpeg body.
+ *
+ * Read at native rate (-re), unlike /api/stream/N which is free to run ahead
+ * into a browser's buffer. Here running ahead would finish the song in two
+ * seconds and then sit waiting for the player to catch up, so the thing that
+ * decides what plays next would be minutes behind what the listener hears.
+ */
+function liveAudio(
+  request: IncomingMessage,
+  response: ServerResponse,
+  engine: Engine,
+  ffmpeg: string[],
+): void {
+  const [command, ...prefix] = ffmpeg as [string, ...string[]];
+  let child: ReturnType<typeof spawn> | null = null;
+  let waiting: ReturnType<typeof setTimeout> | null = null;
+  let closed = false;
+  let started = false;
+  let playing = -1;
+
+  // Held back until the first byte, for the reason transcode() holds it back:
+  // a 200 with nothing behind it is indistinguishable from silence.
+  const begin = (): void => {
+    if (started || closed) return;
+    started = true;
+    response.writeHead(200, {
+      ...CORS,
+      "content-type": "audio/mpeg",
+      "cache-control": "no-store",
+      "transfer-encoding": "chunked",
+    });
+  };
+
+  const later = (ms: number, run: () => void): void => {
+    if (waiting) clearTimeout(waiting);
+    waiting = setTimeout(run, ms);
+    waiting.unref?.();
+  };
+
+  const stop = (): void => {
+    if (closed) return;
+    closed = true;
+    if (waiting) clearTimeout(waiting);
+    waiting = null;
+    unsubscribe();
+    child?.kill("SIGKILL");
+    child = null;
+    if (!response.writableEnded) response.end();
+  };
+
+  const next = (): void => {
+    if (closed || child !== null) return;
+    if (waiting) {
+      clearTimeout(waiting);
+      waiting = null;
+    }
+    const snapshot = engine.snapshot();
+    const source = engine.trackPath(snapshot.index);
+    if (source === undefined) {
+      // A playlist that was replaced out from under us, or one that is empty
+      // for the moment. Keep the connection and keep looking.
+      later(LIVE_IDLE_MS, next);
+      return;
+    }
+
+    playing = snapshot.index;
+    const spawned = spawn(
+      command,
+      [
+        ...prefix,
+        "-hide_banner",
+        "-loglevel", "error",
+        ...(isRemote(source) ? ["-reconnect", "1", "-reconnect_streamed", "1", "-reconnect_delay_max", "5"] : []),
+        "-re",
+        "-i", source,
+        "-vn",
+        "-f", "mp3",
+        "-b:a", "192k",
+        "-",
+      ],
+      { stdio: ["ignore", "pipe", "pipe"] },
+    );
+    child = spawned;
+
+    spawned.stdout.once("data", begin);
+    spawned.stdout.on("error", () => spawned.kill("SIGKILL"));
+    // end: false, because the response outlives this track. Ending it here is
+    // exactly the bug this endpoint exists to avoid.
+    spawned.stdout.pipe(response, { end: false });
+    spawned.stderr.resume();
+
+    spawned.on("error", stop);
+    spawned.on("close", () => {
+      if (child !== spawned) return;
+      child = null;
+      if (closed) return;
+      // Follow the player if it has already moved on. If it has not, look
+      // again shortly -- which is also what makes a single-track library
+      // repeat rather than fall silent.
+      later(engine.snapshot().index === playing ? LIVE_GAP_MS : 0, next);
+    });
+  };
+
+  // A track change that lands while we are between songs is the signal to go
+  // now rather than wait out the poll.
+  const unsubscribe = engine.subscribe(() => {
+    if (child === null && !closed && engine.snapshot().index !== playing) next();
+  });
+
+  response.on("close", stop);
+  response.on("error", stop);
+  request.on("close", stop);
+  next();
+}
+
 /**
  * Decode anything and hand back MP3, as it is produced.
  *
@@ -886,13 +1801,237 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
 
   const web = options.web !== null ? resolve(options.web) : defaultWebDir();
   const key = options.key ? newKey() : null;
+  // Minted whether or not it is published, so `nixamp admin` and the operator
+  // both have a link they can hand out without handing over the controls.
+  const listenKey = key === null ? null : newKey();
+  // Configuration can arrive from the directory later, so it is a box the
+  // paywall reads rather than a value it was handed once.
+  let paywallConfig: PaywallConfig = { ...paywallFromEnv(), enabled: options.x402 || paywallFromEnv().enabled };
+  const connections = new Connections();
+  const paywall = createPaywall({
+    config: () => paywallConfig,
+    liveListeners: () => connections.listening,
+    // The address a payer can actually reach: the public one where there is
+    // one, since a quote pointing at 192.168.1.5 is one they cannot pay from.
+    siteUrl: () => {
+      const bound = server.address();
+      const live = typeof bound === "object" && bound !== null ? bound.port : options.port;
+      const reachable = reachableAddresses(options.host, live);
+      return (reachable.find((a) => a.label === "on the internet") ?? reachable[0])?.url
+        ?? `http://127.0.0.1:${live}`;
+    },
+    // The operator drives with the control key, and is not a customer.
+    exempt: (request) =>
+      key !== null && scopeOf(keyFrom(request, new URL(request.url ?? "/", "http://localhost")), key, null) === "control",
+  });
+
+  const channels = new Channels({
+    ffmpeg: tools.ffmpeg,
+    onStart: (info) =>
+      console.log(`  ${info.name} is publishing to "${info.id}" (${info.format} over ${info.via}).`),
+    onEnd: (info) => console.log(`  "${info.id}" stopped.`),
+  });
+
+  const destinations = parseDestinations(options.rtmp);
+  const broadcaster = new Broadcaster(tools.ffmpeg);
+  const ingest = options.ingest
+    ? new Ingest({
+        ffmpeg: tools.ffmpeg,
+        sink: "pipe:1",
+        onStart: (session) => console.log(`  ${session.name} started streaming in (${session.format}).`),
+        onEnd: (session, error) =>
+          console.log(`  ${session.name} stopped streaming in${error ? `: ${error}` : ""}.`),
+      })
+    : undefined;
+
+  // The account signed in on this machine owns the server it starts. That is
+  // the whole claim: `nixamp login` then `nixamp serve`, and the phone in your
+  // pocket can administer it from anywhere by signing in as the same person.
+  // Following outlives every stream, so unlike the rest of this it wants a
+  // database. Only where there is one: a nixamp on a laptop has no followers.
+  const pool =
+    options.directory && process.env["DATABASE_URL"]
+      ? new pg.Pool({ connectionString: process.env["DATABASE_URL"] })
+      : undefined;
+  const follows = pool ? new Follows(pool) : undefined;
+  // The two things that were promises kept only in memory: a caller who was
+  // told they would be texted, and the ended stream a code still points at.
+  const durable = pool ? new Durable(pool, (message) => console.log(message)) : undefined;
+
+  const vapidPublicKey = process.env["VAPID_PUBLIC_KEY"] ?? "";
+  const vapidPrivateKey = process.env["VAPID_PRIVATE_KEY"] ?? "";
+
+  /**
+   * Tell a broadcaster's followers, on whatever they asked to be told on.
+   *
+   * Fired from the directory on the transition to live rather than on every
+   * heartbeat, and awaited by nobody: a publisher's heartbeat should not sit
+   * waiting on a push service.
+   */
+  const tellFollowers = (listing: Listing): void => {
+    if (follows === undefined || !listing.ownerId) return;
+    const what = listing.nowPlaying ? ` Playing ${listing.nowPlaying}.` : "";
+    const note: Notification = {
+      title: `${listing.name} is live`,
+      body: `${what} Listen at ${DEFAULT_DIRECTORY}/directory, or call ${CALL_IN_NUMBER} and key ${listing.code}.`.trim(),
+      url: listing.url,
+    };
+    void follows
+      .audience(listing.ownerId)
+      .then((audience) =>
+        notifyAll(audience, note, {
+          ...(process.env["RESEND_API_KEY"]
+            ? {
+                email: resendEmail({
+                  apiKey: process.env["RESEND_API_KEY"],
+                  from: process.env["NIXAMP_MAIL_FROM"] ?? "nixamp <notifications@nixamp.com>",
+                  onEvent: (message) => console.log(message),
+                }),
+              }
+            : {}),
+          ...(process.env["TELNYX_API_KEY"] && process.env["PARTYLINE_SMS_FROM"]
+            ? {
+                sms: telnyxSms({
+                  apiKey: process.env["TELNYX_API_KEY"],
+                  from: process.env["PARTYLINE_SMS_FROM"],
+                  onEvent: (message) => console.log(message),
+                }),
+              }
+            : {}),
+          ...(vapidPublicKey && vapidPrivateKey
+            ? {
+                push: webPush({
+                  publicKey: vapidPublicKey,
+                  privateKey: vapidPrivateKey,
+                  subject: process.env["NIXAMP_SITE"] ?? DEFAULT_DIRECTORY,
+                  onEvent: (message) => console.log(message),
+                }),
+              }
+            : {}),
+          // A subscription the vendor has retired is a row to delete, not a
+          // failure to retry.
+          onGone: (endpoint) => follows.removePush(endpoint),
+          onEvent: (message) => console.log(message),
+        }),
+      )
+      .catch(() => {});
+  };
+
+  // Hoisted rather than built inline, because the party line needs the same
+  // instance: a second Directory would be a second set of stream codes, and
+  // the one the phone looked in would never be the one the publishers reach.
+  const directory = options.directory
+    ? new Directory(undefined, undefined, undefined, tellFollowers)
+    : undefined;
+
+  if (directory && durable) {
+    // Echoed rather than awaited: the directory answers from memory, so a
+    // database that is briefly unreachable should cost the durability and not
+    // the request.
+    directory.persistTo({
+      save: (item) => void durable.saveEnded(item),
+      drop: (id) => void durable.dropEnded(id),
+    });
+    // And put back what the last process knew, without holding up the listen.
+    void durable
+      .loadEnded(Date.now() - ENDED_TTL_MS)
+      .then((items) => {
+        if (items.length > 0) console.log(`  remembered ${items.length} stream(s) that had ended.`);
+        directory.seedEnded(items);
+      })
+      .catch(() => {});
+    void durable.sweep(Date.now() - ENDED_TTL_MS, new Date(Date.now() - 30 * 24 * 60 * 60 * 1000));
+  }
+
+  const session = readSession();
+  const owner = new Owner({
+    ownerId: options.owner || (session?.token ? await ownerIdOf(session) : ""),
+    site: session?.site ?? DEFAULT_DIRECTORY,
+  });
+
+  // The party line answers a phone number, and there is only one number. Both
+  // keys or neither: without the public key every webhook would be refused,
+  // which is a worse failure than not offering the endpoint.
+  const partyLine =
+    options.directory && process.env["TELNYX_API_KEY"] && process.env["TELNYX_PUBLIC_KEY"]
+      ? new PartyLine({
+          apiKey: process.env["TELNYX_API_KEY"],
+          publicKey: process.env["TELNYX_PUBLIC_KEY"],
+          streams: directory,
+          callIn: CALL_IN_NUMBER,
+          // Only when a sending number is configured. Without one the line
+          // still answers and still says when the stream ended; it just does
+          // not offer a text it could not send.
+          ...(process.env["PARTYLINE_SMS_FROM"]
+            ? {
+                sms: telnyxSms({
+                  apiKey: process.env["TELNYX_API_KEY"],
+                  from: process.env["PARTYLINE_SMS_FROM"],
+                  onEvent: (message) => console.log(message),
+                }),
+              }
+            : {}),
+          ...(process.env["PARTYLINE_GREETING"] ? { greeting: process.env["PARTYLINE_GREETING"] } : {}),
+          ...(process.env["PARTYLINE_VOICE"] ? { voice: process.env["PARTYLINE_VOICE"] } : {}),
+          onEvent: (message) => console.log(message),
+        })
+      : undefined;
+
+  if (partyLine && durable) {
+    // Put back everybody a previous process promised to text, then keep
+    // echoing. Seeding first means a stream that goes live during startup
+    // still finds them.
+    void durable
+      .loadReminders()
+      .then((waiting) => {
+        const owed = [...waiting.values()].reduce((n, set) => n + set.size, 0);
+        if (owed > 0) console.log(`  ${owed} caller(s) are still owed a text.`);
+        partyLine.persistRemindersTo(
+          {
+            add: (code, phone) => void durable.addReminder(code, phone),
+            take: (code) => durable.takeReminders(code),
+          },
+          waiting,
+        );
+      })
+      .catch(() => {
+        // Still worth echoing new ones even if the old list could not be read.
+        partyLine.persistRemindersTo({
+          add: (code, phone) => void durable.addReminder(code, phone),
+          take: (code) => durable.takeReminders(code),
+        });
+      });
+  }
+
   const server = createServer(engine, {
     web,
     media: options.media,
+    owner,
+    channels,
+    ...(ingest ? { ingest } : {}),
+    broadcaster,
+    broadcast: () => ({ destinations, settings: DEFAULT_ENCODER }),
     version,
     key,
+    listenKey,
+    connections,
+    paywall,
     ffmpeg: tools.ffmpeg,
     load: (next) => loadSource(tools, next),
+    ...(directory ? { directory } : {}),
+    ...(follows ? { follows, vapidPublicKey } : {}),
+    ...(partyLine ? { partyLine } : {}),
+    // Accounts live where the directory lives, and only there: a nixamp on a
+    // laptop has nobody to be an account of.
+    ...(options.directory && process.env["DATABASE_URL"]
+      ? {
+          accounts: new Accounts({
+            connectionString: process.env["DATABASE_URL"],
+            secret: process.env["NIXAMP_JWT_SECRET"] ?? "",
+          }),
+          secureCookies: (process.env["NIXAMP_SITE"] ?? "").startsWith("https://"),
+        }
+      : {}),
   });
 
   // A port already in use is the most ordinary failure there is, and it
@@ -944,6 +2083,14 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
   } else {
     console.log("  Open that link once on a phone or a laptop and it stays signed in.");
     console.log(`  Anything without the key gets a 401. Key: ${key}`);
+    if (listenKey !== null) {
+      console.log("");
+      console.log("  A listen-only link, for someone you want to hear it but not drive it:");
+      for (const { label, url } of addresses) {
+        if (label === "here") continue;
+        console.log(`    ${shareLink(url, listenKey)}`);
+      }
+    }
   }
   if (addresses.some((a) => a.label === "on the internet")) {
     console.log("");
@@ -954,6 +2101,31 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     );
   }
   if (!options.media) console.log("  Audio stays on this machine: --no-media is set.");
+  if (owner.claimed) {
+    console.log(`  ${session?.email} can administer this from anywhere, signed in at ${session?.site}.`);
+  }
+  if (options.ingest) console.log("  Accepting a live stream in at POST /api/ingest.");
+  let rtmp: RtmpListeners | null = null;
+  if (options.rtmpIn > 0) {
+    const publish = addresses.find((a) => a.label !== "here") ?? addresses[0];
+    const host = publish ? new URL(publish.url).hostname : "127.0.0.1";
+    // One listener per stream, because ffmpeg's RTMP listener serves a single
+    // connection per process. Three devices going live at once is three ports.
+    const slots = Array.from({ length: options.rtmpStreams }, (_, i) => ({
+      port: options.rtmpIn + i,
+      id: i === 0 ? "live" : `live-${i + 1}`,
+    }));
+    rtmp = new RtmpListeners(channels, tools.ffmpeg, listenKey ?? "live");
+    rtmp.listen(slots);
+
+    console.log("  Or publish from OBS, Larix or ffmpeg, one per URL:");
+    for (const slot of slots) {
+      console.log(`    rtmp://${host}:${slot.port}/live/${listenKey ?? "live"}   -> "${slot.id}"`);
+    }
+  }
+  if (destinations.length > 0) {
+    console.log(`  Ready to broadcast to ${destinations.map((d) => d.name).join(", ")}.`);
+  }
   if (web === null) console.log("  No built PWA found, so / has nothing to serve: run `bun run web:build`.");
 
   // Listening on every interface proves the socket is open here and nothing
@@ -994,7 +2166,69 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     }
   }
 
+  // The listing carries the listen link, and only ever a public address: an
+  // entry pointing at 192.168.1.5 is one nobody outside that house can open.
+  const publishable_ = addresses.find((a) => a.label === "on the internet")
+    ?? addresses.find((a) => a.label === "on tailscale");
+  let publisher: Publisher | null = null;
+
+  if (options.publish !== "no" && publishable_) {
+    const listen = shareLink(publishable_.url, listenKey);
+    // Announced next to the listen link, not instead of it: one is for a person
+    // with a browser, the other for the phone line and anything else that is
+    // handed one address and expected to play it.
+    const audio = audioLink(publishable_.url, listenKey);
+    const wanted = options.publish === "yes"
+      ? true
+      : await confirm(`\n  List this stream at ${DEFAULT_DIRECTORY}/directory so anyone can find it?\n  It publishes ${listen} — listen only, not the controls.`);
+
+    if (wanted) {
+      publisher = new Publisher({
+        directory: DEFAULT_DIRECTORY,
+        name: options.name || hostname(),
+        url: listen,
+        audio,
+        tracks: tracks.length,
+        // From `nixamp login`. The directory will not list a stream it cannot
+        // attribute to somebody, because a listing is now a phone code that
+        // costs money to answer.
+        ...(session?.token ? { token: session.token } : {}),
+        onRefused: () => {
+          console.log("");
+          console.log("  nixamp.com would not list this stream: it needs an account.");
+          console.log("  Run `nixamp login` (or `nixamp signup`) and start again.");
+        },
+        nowPlaying: () => {
+          const snapshot = engine.snapshot();
+          return snapshot.tracks[snapshot.index]?.title ?? "";
+        },
+        onConfig: (remote) => {
+          const next = applyRemoteConfig(paywallConfig, (remote as { x402?: unknown })?.x402);
+          if (JSON.stringify(next) === JSON.stringify(paywallConfig)) return;
+          paywallConfig = next;
+          console.log(next.enabled
+            ? `  nixamp.com turned paid listening on: $${(next.priceCents / 100).toFixed(2)} for ${next.passMinutes} minutes, over ${FREE_LISTENERS} listeners.`
+            : "  nixamp.com turned paid listening off.");
+        },
+      });
+      const listing = await publisher.start();
+      console.log("");
+      console.log(listing
+        ? `  Listed at ${DEFAULT_DIRECTORY}/directory as "${listing.name}". It leaves the list when this stops.`
+        : `  Could not reach ${DEFAULT_DIRECTORY}; not listed.`);
+    }
+  } else if (options.publish === "yes" && !publishable_) {
+    console.log("");
+    console.log("  --publish needs an address the world can reach. This machine has none.");
+  }
+
   const shutdown = (): void => {
+    rtmp?.stop();
+    channels.stopAll();
+    ingest?.stopRtmp();
+    ingest?.close();
+    broadcaster.stop();
+    void publisher?.stop();
     closePort?.();
     engine.stop();
     server.close(() => process.exit(0));
@@ -1005,11 +2239,69 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
   process.on("SIGTERM", shutdown);
 }
 
+/**
+ * `--rtmp youtube=<key>` or `--rtmp name=rtmp://host/app/key`.
+ *
+ * A key is a password, so it is taken from the command line or the environment
+ * and never from a request: a client that could name its own destination could
+ * point your broadcast at itself.
+ */
+export function parseDestinations(specs: string[]): Destination[] {
+  const out: Destination[] = [];
+  for (const [index, spec] of specs.entries()) {
+    const at = spec.indexOf("=");
+    if (at <= 0) continue;
+    const name = spec.slice(0, at).trim();
+    const rest = spec.slice(at + 1).trim();
+    if (!name || !rest) continue;
+
+    const preset = PRESETS[name.toLowerCase()];
+    if (preset && !/^rtmps?:\/\//i.test(rest)) {
+      out.push({ id: String(index + 1), name, url: preset, key: rest, enabled: true });
+      continue;
+    }
+    if (!/^rtmps?:\/\//i.test(rest)) continue;
+
+    // A full URL: the last path segment is the key.
+    const cut = rest.lastIndexOf("/");
+    if (cut <= "rtmp://".length) continue;
+    out.push({
+      id: String(index + 1),
+      name,
+      url: rest.slice(0, cut),
+      key: rest.slice(cut + 1),
+      enabled: true,
+    });
+  }
+  return out;
+}
+
+/**
+ * Which account the signed-in session belongs to. Asked once at startup rather
+ * than trusted from the file: a token that nixamp.com no longer accepts should
+ * not confer ownership of anything.
+ */
+async function ownerIdOf(session: { site: string; token: string }): Promise<string> {
+  try {
+    const answer = await fetch(`${session.site}/api/v1/auth/me`, {
+      headers: { authorization: `Bearer ${session.token}` },
+    });
+    if (!answer.ok) return "";
+    const body = (await answer.json()) as { account?: { id?: string } };
+    return typeof body.account?.id === "string" ? body.account.id : "";
+  } catch {
+    // Offline at startup means no remote administration until a restart, and
+    // the control key still works. Better than claiming an owner we cannot
+    // check.
+    return "";
+  }
+}
+
 /** The built PWA, when it is sitting next to us in the same install. */
 function defaultWebDir(): string | null {
   const fromEnv = process.env.NIXAMP_WEB_DIR;
   if (fromEnv && isFile(join(fromEnv, "index.html"))) return fromEnv;
-  const here = new URL(".", import.meta.url).pathname;
+  const here = fileURLToPath(new URL(".", import.meta.url));
   for (const guess of [
     join(here, "..", "web", "dist"),
     join(here, "..", "..", "web", "dist"),