nixamp 0.5.11 → 0.6.0

package/dist/main.js

@@ -51,6 +51,7 @@ const HELP = `nixamp — it really whips the terminal's ass.
   nixamp login [--with github]  sign in to nixamp.com, in a browser or here
   nixamp logout / whoami        forget it, or check it
   nixamp token create|list|revoke  tokens for a machine that cannot sign in
+  nixamp server list|add|remove  the machines you run, kept against your account
   nixamp update [version]        re-run the installer, keeping your choices
   nixamp uninstall [--yes]       remove everything the installer created
 
@@ -72,6 +73,9 @@ Options for serve:
                    its own interfaces. Also NIXAMP_PUBLIC_URL
       --no-lookup  do not ask ipinfo.io what this machine's public address is
                    when nothing local looks public
+      --tls-cert FILE --tls-key FILE  serve https rather than http. Needed by
+                   anyone opening this from a page that is itself https, since
+                   a browser refuses every request from https to http
       --ingest     accept a live stream in at POST /api/ingest
       --rtmp-in N  also listen for RTMP publishers (OBS, Larix) from port N
       --rtmp-streams N  how many may publish at once (default 3, a port each)
@@ -167,6 +171,18 @@ keeps serving its browser remote. One per user.
   nixamp admin    who is connected, and re-stream to them
 
 From inside the player, d hands the music to a daemon without stopping it.
+`,
+    server: `nixamp server -- the machines you run.
+
+  nixamp server list             every server on your account
+  nixamp server add --here       remember the daemon on this machine
+  nixamp server add URL --name x remember one somewhere else
+  nixamp server remove ID        forget it
+
+A share link printed in a terminal you have since closed is a server you have
+lost. This keeps the address against your account, so the answer is the same
+here, in the browser and in the desktop app. The share key is kept with it only
+if you pass one, since it is the secret that opens the machine.
 `,
     attach: `nixamp attach — the player, in front of the running daemon.
 
@@ -276,6 +292,11 @@ export async function main() {
         process.exitCode = await login(first === "signup" ? [...rest, "--signup"] : rest);
         return;
     }
+    if (first === "server" || first === "servers") {
+        const { servers } = await import("./session.js");
+        process.exitCode = await servers(rest);
+        return;
+    }
     if (first === "token" || first === "tokens") {
         const { tokens } = await import("./session.js");
         process.exitCode = await tokens(rest);

package/dist/server.d.ts

@@ -4,6 +4,7 @@ import { Broadcaster, type Destination, type EncoderSettings } from "./broadcast
 import { Ingest } from "./ingest.ts";
 import { Channels } from "./channels.ts";
 import { Accounts } from "./accounts.ts";
+import { Servers } from "./servers.ts";
 import { SignIn } from "./oauth.ts";
 import { Owner } from "./owner.ts";
 import { Directory } from "./directory.ts";
@@ -56,6 +57,18 @@ export interface ServeOptions {
      * listing is skipped and the printed links only work inside the house.
      */
     publicUrl: string;
+    /**
+     * A certificate and its key, to serve https rather than http.
+     *
+     * Needed by anybody whose nixamp is opened from a page that is itself https:
+     * a browser refuses every request from an https page to an http one --
+     * fetch, event stream and media alike -- and no header on either side lifts
+     * that. It is deliberately not required: a nixamp on 192.168.1.5 cannot have
+     * a certificate for that address, and forcing one would put a browser
+     * warning in front of everybody at home to fix a problem they do not have.
+     */
+    tlsCert: string;
+    tlsKey: string;
     /**
      * Ask an outside service what this machine's public address is, when no
      * interface holds one and none was given. Behind NAT that is the only way to
@@ -248,8 +261,15 @@ export interface HandlerOptions {
     accounts?: Accounts;
     /** Providers to sign in with, and the terminals waiting to be connected. */
     signIn?: SignIn;
+    /** The servers each account runs, on the instance that keeps accounts. */
+    servers?: Servers;
     /** True when this instance is reached over https, for the cookie's Secure. */
     secureCookies?: boolean;
+    /** A certificate and key in PEM, when this server is to speak https itself. */
+    tls?: {
+        cert: string;
+        key: string;
+    };
     /**
      * True when a proxy sits in front, so `x-forwarded-for` names the caller.
      * False everywhere else on purpose: the header is trivially forged, and

package/dist/server.js

@@ -11,6 +11,7 @@
  */
 import { createReadStream, statSync } from "node:fs";
 import { createServer as createHttpServer } from "node:http";
+import { createServer as createHttpsServer } from "node:https";
 import { hostname } from "node:os";
 import { spawn, spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
@@ -20,6 +21,7 @@ import { Ingest, normaliseFormat } from "./ingest.js";
 import { Channels, cleanId } from "./channels.js";
 import { RtmpListeners } from "./rtmp-in.js";
 import { Accounts, clearedCookie, sessionCookie, tokenFrom } from "./accounts.js";
+import { Servers } from "./servers.js";
 import { DeviceGrants } from "./device.js";
 import { BAD_KEY_LIMIT, callerOf, Guard, SIGN_IN_LIMIT } from "./guard.js";
 import { deviceDonePage, devicePage, exchangeCode, providersFrom, signInFailedPage, SignIn, } from "./oauth.js";
@@ -70,6 +72,8 @@ export function parseServeArgs(argv) {
         name: "",
         publicUrl: process.env["NIXAMP_PUBLIC_URL"] ?? "",
         lookup: true,
+        tlsCert: process.env["NIXAMP_TLS_CERT"] ?? "",
+        tlsKey: process.env["NIXAMP_TLS_KEY"] ?? "",
         x402: false,
         owner: "",
         ingest: false,
@@ -78,6 +82,11 @@ export function parseServeArgs(argv) {
         rtmp: [],
     };
     let sawRoot = false;
+    const bothOrNeither = () => {
+        if (Boolean(options.tlsCert) !== Boolean(options.tlsKey)) {
+            throw new Error("nixamp serve: --tls-cert and --tls-key go together");
+        }
+    };
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
         const value = () => {
@@ -130,6 +139,12 @@ export function parseServeArgs(argv) {
             }
             options.publicUrl = given.replace(/\/+$/, "");
         }
+        else if (arg === "--tls-cert") {
+            options.tlsCert = value();
+        }
+        else if (arg === "--tls-key") {
+            options.tlsKey = value();
+        }
         else if (arg === "--no-lookup") {
             options.lookup = false;
         }
@@ -175,6 +190,7 @@ export function parseServeArgs(argv) {
             sawRoot = true;
         }
     }
+    bothOrNeither();
     return options;
 }
 const TYPES = {
@@ -534,7 +550,12 @@ const OAUTH_ROUTE = /^\/api\/v1\/([a-z0-9-]+)\/oauth\/(start|callback)$/;
  * the share-key check rather than behind it.
  */
 export function isSignInPath(path) {
-    return path.startsWith("/api/v1/auth/") || OAUTH_ROUTE.test(path);
+    return (path.startsWith("/api/v1/auth/") ||
+        // The account's own server list: nixamp.com's API, gated by the session
+        // rather than by a share key it has nothing to do with.
+        path === "/api/v1/servers" ||
+        path.startsWith("/api/v1/servers/") ||
+        OAUTH_ROUTE.test(path));
 }
 function html(response, code, body) {
     response.writeHead(code, {
@@ -973,6 +994,73 @@ export function createHandler(engine, options) {
                 json(response, 404, { error: "no such endpoint" });
                 return;
             }
+            // --- the servers this account runs ----------------------------------
+            //
+            // Kept against the account rather than the machine, so the list reads the
+            // same from the CLI, the PWA and the desktop app -- which is the whole
+            // point: a share link in a terminal you closed is a server you have lost.
+            if ((path === "/api/v1/servers" || path.startsWith("/api/v1/servers/")) && options.servers) {
+                const servers = options.servers;
+                const who = await accounts.whoIs(tokenFrom(request.headers));
+                if (who === null) {
+                    json(response, 401, { error: "not signed in" });
+                    return;
+                }
+                if (path === "/api/v1/servers" && request.method === "GET") {
+                    json(response, 200, { servers: await servers.list(who.id) });
+                    return;
+                }
+                if (path === "/api/v1/servers" && request.method === "POST") {
+                    let body;
+                    try {
+                        body = JSON.parse(await readBody(request));
+                    }
+                    catch {
+                        json(response, 400, { error: "bad JSON" });
+                        return;
+                    }
+                    const made = await servers.add(who, {
+                        ...(typeof body.name === "string" ? { name: body.name } : {}),
+                        ...(typeof body.url === "string" ? { url: body.url } : {}),
+                        ...(typeof body.key === "string" ? { key: body.key } : {}),
+                    });
+                    if (made === null) {
+                        json(response, 422, { error: "that needs an http or https address" });
+                        return;
+                    }
+                    json(response, 201, { server: made });
+                    return;
+                }
+                const id = path.slice("/api/v1/servers/".length);
+                if (id && request.method === "DELETE") {
+                    const gone = await servers.remove(who.id, id);
+                    json(response, gone ? 200 : 404, gone ? { ok: true } : { error: "no such server" });
+                    return;
+                }
+                if (id && (request.method === "PATCH" || request.method === "PUT")) {
+                    let body;
+                    try {
+                        body = JSON.parse(await readBody(request));
+                    }
+                    catch {
+                        json(response, 400, { error: "bad JSON" });
+                        return;
+                    }
+                    const changed = await servers.update(who.id, id, {
+                        ...(typeof body.name === "string" ? { name: body.name } : {}),
+                        ...(typeof body.url === "string" ? { url: body.url } : {}),
+                        ...(typeof body.key === "string" ? { key: body.key } : {}),
+                    });
+                    if (changed === null) {
+                        json(response, 404, { error: "no such server, or a bad address" });
+                        return;
+                    }
+                    json(response, 200, { server: changed });
+                    return;
+                }
+                json(response, 405, { error: "GET, POST, PATCH or DELETE" });
+                return;
+            }
             // --- tokens a person made on purpose --------------------------------
             if (path === "/api/v1/auth/tokens" || path.startsWith("/api/v1/auth/tokens/")) {
                 const who = await accounts.whoIs(tokenFrom(request.headers));
@@ -1898,14 +1986,20 @@ function sendFile(request, response, file) {
 }
 export function createServer(engine, options) {
     const handle = createHandler(engine, options);
-    return createHttpServer((request, response) => {
+    const onRequest = (request, response) => {
         handle(request, response).catch(() => {
             if (!response.headersSent)
                 json(response, 500, { error: "server error" });
             else
                 response.end();
         });
-    });
+    };
+    // https when there is a certificate to serve it with, and the same handler
+    // either way: nothing above this line knows or cares which it got.
+    if (options.tls) {
+        return createHttpsServer({ cert: options.tls.cert, key: options.tls.key }, onRequest);
+    }
+    return createHttpServer(onRequest);
 }
 export async function serve(argv, version = "0.1.0") {
     const options = parseServeArgs(argv);
@@ -2112,6 +2206,18 @@ export async function serve(argv, version = "0.1.0") {
             });
         });
     }
+    // Read before listening, so a missing or unreadable certificate is a sentence
+    // now rather than a connection that resets later.
+    const tls = options.tlsCert
+        ? (() => {
+            try {
+                return { cert: readFileSync(options.tlsCert, "utf8"), key: readFileSync(options.tlsKey, "utf8") };
+            }
+            catch (error) {
+                throw new Error(`nixamp serve: could not read the certificate: ${error.message}`);
+            }
+        })()
+        : undefined;
     const server = createServer(engine, {
         web,
         media: options.media,
@@ -2127,6 +2233,7 @@ export async function serve(argv, version = "0.1.0") {
         paywall,
         ffmpeg: tools.ffmpeg,
         ffprobe: tools.ffprobe,
+        ...(tls ? { tls } : {}),
         load: (next) => loadSource(tools, next),
         ...(directory ? { directory } : {}),
         ...(follows ? { follows, vapidPublicKey } : {}),
@@ -2148,6 +2255,9 @@ export async function serve(argv, version = "0.1.0") {
                 // Whichever providers this deployment was given both halves of, plus
                 // the device grant, which is worth having even with no provider at
                 // all: a browser already signed in can approve a terminal.
+                // The same pool the follows and reminders use: three small tables in
+                // one database do not want three sets of connections.
+                ...(pool ? { servers: new Servers(pool) } : {}),
                 signIn: new SignIn(providersFrom(process.env), new DeviceGrants(), process.env["NIXAMP_SITE"] ?? DEFAULT_DIRECTORY),
             }
             : {}),
@@ -2181,12 +2291,12 @@ export async function serve(argv, version = "0.1.0") {
     // is and nothing local looks public, ask. What comes back is a fact about the
     // router and not about this port -- the port still has to be forwarded -- so
     // it is marked as a guess and everything that prints it says so.
-    const localAddresses = reachableAddresses(options.host, port, options.publicUrl);
+    const localAddresses = reachableAddresses(options.host, port, options.publicUrl, tls ? "https" : "http");
     const guessedPublic = options.lookup && !options.publicUrl && !localAddresses.some((a) => a.label === "on the internet")
         ? await lookupPublicIp()
         : "";
     const addresses = guessedPublic
-        ? reachableAddresses(options.host, port, `http://${guessedPublic.includes(":") ? `[${guessedPublic}]` : guessedPublic}:${port}`)
+        ? reachableAddresses(options.host, port, `${tls ? "https" : "http"}://${guessedPublic.includes(":") ? `[${guessedPublic}]` : guessedPublic}:${port}`, tls ? "https" : "http")
         : localAddresses;
     // Listening on every interface proves the socket is open here and nothing
     // about the path between here and the phone.

package/dist/servers.d.ts

@@ -0,0 +1,46 @@
+import type { Account } from "./accounts.ts";
+import type { Queryable } from "./follows.ts";
+export interface ServerEntry {
+    id: string;
+    name: string;
+    url: string;
+    /** Empty when the owner chose not to keep it here. */
+    key: string;
+    createdAt: number;
+    updatedAt: number;
+    lastSeenAt: number | null;
+}
+/** What a caller may set. Anything else is the server's business. */
+export interface ServerInput {
+    name?: string;
+    url?: string;
+    key?: string;
+}
+/**
+ * An address a browser could open, with nothing else smuggled in.
+ *
+ * A stored URL is handed back to other clients and put in an href, so a
+ * javascript: or data: entry here is a link somebody else clicks. Only http
+ * and https, and nothing after the origin: a nixamp is a host and a port.
+ */
+export declare function cleanUrl(value: unknown): string;
+/** A name is a label, not an essay, and never empty on screen. */
+export declare function cleanName(value: unknown, url: string): string;
+export declare class Servers {
+    private readonly db;
+    private ready;
+    constructor(db: Queryable);
+    private ensure;
+    list(userId: string): Promise<ServerEntry[]>;
+    /**
+     * Remember a server, or update the one already at that address.
+     *
+     * Upserted on the address rather than refused, because the common way to
+     * call this twice is a daemon announcing itself after a restart, and that
+     * should move the entry forward rather than fail.
+     */
+    add(account: Account, input: ServerInput): Promise<ServerEntry | null>;
+    /** Scoped to the owner, so somebody else's id changes nothing. */
+    update(userId: string, id: string, input: ServerInput): Promise<ServerEntry | null>;
+    remove(userId: string, id: string): Promise<boolean>;
+}

package/dist/servers.js

@@ -0,0 +1,155 @@
+/**
+ * The servers a person runs.
+ *
+ * A nixamp is a machine somewhere with an address and a key, and until now the
+ * only record of one was the share link in whatever terminal printed it. Lose
+ * the terminal and you have lost the server: the daemon is still playing, and
+ * nothing anywhere can tell you where. This is the list, kept against the
+ * account rather than the machine, so it reads the same from the CLI, the PWA
+ * and the desktop app.
+ *
+ * The share key is optional and, when given, is the listen-or-control secret
+ * for somebody else's machine sitting in our database. It is stored because a
+ * list you cannot click is half a feature, and it is optional because that is
+ * a choice which belongs to the person whose server it is.
+ */
+import { randomBytes } from "node:crypto";
+const TABLE = "nixamp_servers";
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS ${TABLE} (
+    id           TEXT PRIMARY KEY,
+    user_id      TEXT NOT NULL,
+    name         TEXT NOT NULL DEFAULT '',
+    url          TEXT NOT NULL,
+    share_key    TEXT NOT NULL DEFAULT '',
+    created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    last_seen_at TIMESTAMPTZ
+  );
+  CREATE INDEX IF NOT EXISTS ${TABLE}_user ON ${TABLE} (user_id);
+  CREATE UNIQUE INDEX IF NOT EXISTS ${TABLE}_user_url ON ${TABLE} (user_id, url);
+`;
+function asTime(value) {
+    if (value instanceof Date)
+        return value.getTime();
+    if (typeof value === "string") {
+        const at = Date.parse(value);
+        return Number.isNaN(at) ? null : at;
+    }
+    return typeof value === "number" ? value : null;
+}
+function toEntry(row) {
+    return {
+        id: String(row["id"] ?? ""),
+        name: String(row["name"] ?? ""),
+        url: String(row["url"] ?? ""),
+        key: String(row["share_key"] ?? ""),
+        createdAt: asTime(row["created_at"]) ?? 0,
+        updatedAt: asTime(row["updated_at"]) ?? 0,
+        lastSeenAt: asTime(row["last_seen_at"]),
+    };
+}
+/**
+ * An address a browser could open, with nothing else smuggled in.
+ *
+ * A stored URL is handed back to other clients and put in an href, so a
+ * javascript: or data: entry here is a link somebody else clicks. Only http
+ * and https, and nothing after the origin: a nixamp is a host and a port.
+ */
+export function cleanUrl(value) {
+    if (typeof value !== "string" || value.trim() === "")
+        return "";
+    let parsed;
+    try {
+        parsed = new URL(value.trim());
+    }
+    catch {
+        return "";
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+        return "";
+    return parsed.origin;
+}
+/** A name is a label, not an essay, and never empty on screen. */
+export function cleanName(value, url) {
+    const given = typeof value === "string" ? value.trim().slice(0, 60) : "";
+    if (given)
+        return given;
+    // The host is a better default than "untitled", and it is what somebody
+    // would have typed anyway.
+    try {
+        return new URL(url).host;
+    }
+    catch {
+        return "a nixamp";
+    }
+}
+export class Servers {
+    db;
+    ready = null;
+    constructor(db) {
+        this.db = db;
+    }
+    async ensure() {
+        this.ready ??= this.db.query(SCHEMA).then(() => undefined);
+        await this.ready;
+    }
+    async list(userId) {
+        await this.ensure();
+        const { rows } = await this.db.query(`SELECT id, name, url, share_key, created_at, updated_at, last_seen_at FROM ${TABLE}
+        WHERE user_id = $1 ORDER BY created_at`, [userId]);
+        return rows.map(toEntry);
+    }
+    /**
+     * Remember a server, or update the one already at that address.
+     *
+     * Upserted on the address rather than refused, because the common way to
+     * call this twice is a daemon announcing itself after a restart, and that
+     * should move the entry forward rather than fail.
+     */
+    async add(account, input) {
+        const url = cleanUrl(input.url);
+        if (!url)
+            return null;
+        await this.ensure();
+        const { rows } = await this.db.query(`INSERT INTO ${TABLE} (id, user_id, name, url, share_key, last_seen_at)
+       VALUES ($1, $2, $3, $4, $5, NOW())
+       ON CONFLICT (user_id, url) DO UPDATE
+         SET name = EXCLUDED.name, share_key = EXCLUDED.share_key,
+             updated_at = NOW(), last_seen_at = NOW()
+       RETURNING id, name, url, share_key, created_at, updated_at, last_seen_at`, [
+            randomBytes(8).toString("hex"),
+            account.id,
+            cleanName(input.name, url),
+            url,
+            typeof input.key === "string" ? input.key.slice(0, 200) : "",
+        ]);
+        return rows[0] ? toEntry(rows[0]) : null;
+    }
+    /** Scoped to the owner, so somebody else's id changes nothing. */
+    async update(userId, id, input) {
+        await this.ensure();
+        const url = input.url === undefined ? undefined : cleanUrl(input.url);
+        if (input.url !== undefined && !url)
+            return null;
+        const { rows } = await this.db.query(`UPDATE ${TABLE}
+          SET name = COALESCE($3, name),
+              url = COALESCE($4, url),
+              share_key = COALESCE($5, share_key),
+              updated_at = NOW()
+        WHERE user_id = $1 AND id = $2
+        RETURNING id, name, url, share_key, created_at, updated_at, last_seen_at`, [
+            userId,
+            id,
+            input.name === undefined ? null : cleanName(input.name, url ?? ""),
+            url ?? null,
+            input.key === undefined ? null : input.key.slice(0, 200),
+        ]);
+        return rows[0] ? toEntry(rows[0]) : null;
+    }
+    async remove(userId, id) {
+        await this.ensure();
+        const { rows } = await this.db.query(`DELETE FROM ${TABLE} WHERE user_id = $1 AND id = $2 RETURNING id`, [userId, id]);
+        return rows.length > 0;
+    }
+}

package/dist/session.d.ts

@@ -98,3 +98,12 @@ export declare function tokens(argv: string[], fetcher?: typeof fetch): Promise<
 export declare function logout(): number;
 /** `nixamp whoami`, which asks the server rather than trusting the file. */
 export declare function whoami(fetcher?: typeof fetch): Promise<number>;
+/**
+ * `nixamp server list|add|remove`, the account's own list of machines.
+ *
+ * A share link printed in a terminal you have since closed is a server you
+ * have lost: the daemon is still playing and nothing can tell you where. This
+ * keeps the address against the account, so the answer is the same here, in
+ * the browser and in the desktop app.
+ */
+export declare function servers(argv: string[], fetcher?: typeof fetch): Promise<number>;

package/dist/session.js

@@ -481,3 +481,100 @@ export async function whoami(fetcher = fetch) {
         return 0;
     }
 }
+/**
+ * `nixamp server list|add|remove`, the account's own list of machines.
+ *
+ * A share link printed in a terminal you have since closed is a server you
+ * have lost: the daemon is still playing and nothing can tell you where. This
+ * keeps the address against the account, so the answer is the same here, in
+ * the browser and in the desktop app.
+ */
+export async function servers(argv, fetcher = fetch) {
+    const session = readSession();
+    if (session === null) {
+        console.error("nixamp: not signed in. Try `nixamp login`.");
+        return 1;
+    }
+    const [command = "list", ...rest] = argv;
+    const where = `${session.site}/api/v1/servers`;
+    const headers = { authorization: `Bearer ${session.token}`, "content-type": "application/json" };
+    const at = (flag) => {
+        const index = rest.indexOf(flag);
+        return index === -1 ? undefined : rest[index + 1];
+    };
+    try {
+        if (command === "add" || command === "register") {
+            // `--here` is the common case: the daemon on this machine, with the
+            // address and key it already printed, rather than retyped by hand.
+            let url = rest.find((a) => /^https?:\/\//.test(a)) ?? at("--url") ?? "";
+            let key = at("--key") ?? "";
+            if (rest.includes("--here")) {
+                const daemon = await import("./daemon.js");
+                const state = daemon.readState();
+                if (state === null) {
+                    console.error("nixamp: no daemon is running here. Start one, or pass a URL.");
+                    return 1;
+                }
+                // The address worth remembering is the one somebody else can open.
+                const reachable = state.urls?.find((u) => u.label === "on the internet") ?? state.urls?.[0];
+                url = reachable?.url ?? "";
+                key = key || (state.key ?? "");
+            }
+            if (!url) {
+                console.error("nixamp: which server? Give a URL, or --here for the daemon on this machine.");
+                return 64;
+            }
+            const answer = await fetcher(where, {
+                method: "POST",
+                headers,
+                body: JSON.stringify({ url, name: at("--name") ?? "", ...(key ? { key } : {}) }),
+            });
+            const body = (await answer.json().catch(() => ({})));
+            if (!answer.ok || !body.server) {
+                console.error(`nixamp: ${body.error ?? `could not add it (${answer.status})`}`);
+                return 1;
+            }
+            console.log(`${body.server.id}  ${body.server.name}  ${body.server.url}`);
+            return 0;
+        }
+        if (command === "remove" || command === "rm" || command === "forget") {
+            const id = rest.find((a) => !a.startsWith("-")) ?? "";
+            if (!id) {
+                console.error("nixamp: which one? `nixamp server list` shows their ids.");
+                return 64;
+            }
+            const answer = await fetcher(`${where}/${encodeURIComponent(id)}`, { method: "DELETE", headers });
+            if (!answer.ok) {
+                console.error(`nixamp: ${answer.status === 404 ? "no server with that id" : "could not remove it"}`);
+                return 1;
+            }
+            console.log(`Forgot ${id}.`);
+            return 0;
+        }
+        if (command === "list" || command === "ls") {
+            const answer = await fetcher(where, { headers });
+            const body = (await answer.json().catch(() => ({})));
+            if (!answer.ok) {
+                console.error(`nixamp: ${body.error ?? `could not list them (${answer.status})`}`);
+                return 1;
+            }
+            const rows = body.servers ?? [];
+            if (rows.length === 0) {
+                console.log("No servers yet. `nixamp server add --here` remembers the one on this machine.");
+                return 0;
+            }
+            const width = Math.max(...rows.map((row) => row.name.length));
+            for (const row of rows) {
+                const link = row.key ? `${row.url}/s/${row.key}` : row.url;
+                console.log(`${row.id}  ${row.name.padEnd(width)}  ${link}`);
+            }
+            return 0;
+        }
+        console.error(`nixamp: no such server command: ${command}`);
+        return 64;
+    }
+    catch (error) {
+        console.error(`nixamp: could not reach ${session.site}: ${error.message}`);
+        return 69;
+    }
+}

package/dist/share.d.ts

@@ -45,7 +45,7 @@ export declare function lookupPublicIp(send?: typeof fetch, timeoutMs?: number):
  * somewhere else can open. It is labelled for what it is, because the key in
  * the link is then the only thing between a stranger and the library.
  */
-export declare function reachableAddresses(host: string, port: number, publicUrl?: string): {
+export declare function reachableAddresses(host: string, port: number, publicUrl?: string, scheme?: "http" | "https"): {
     label: string;
     url: string;
 }[];

package/dist/share.js

@@ -115,11 +115,11 @@ export async function lookupPublicIp(send = fetch, timeoutMs = 2500) {
  * somewhere else can open. It is labelled for what it is, because the key in
  * the link is then the only thing between a stranger and the library.
  */
-export function reachableAddresses(host, port, publicUrl = "") {
+export function reachableAddresses(host, port, publicUrl = "", scheme = "http") {
     const link = (address) => {
         // A bare IPv6 address needs brackets before it is a URL.
         const authority = address.includes(":") ? `[${address}]` : address;
-        return `http://${authority}:${port}`;
+        return `${scheme}://${authority}:${port}`;
     };
     // An address somebody told us about, because it is one this machine cannot
     // know: a tunnel, a reverse proxy, or a router forwarding a port. It goes
@@ -145,7 +145,7 @@ export function reachableAddresses(host, port, publicUrl = "") {
     found.sort((x, y) => order[x.kind] - order[y.kind]);
     return [
         ...told,
-        { label: "here", url: `http://localhost:${port}` },
+        { label: "here", url: `${scheme}://localhost:${port}` },
         ...found.map(({ label, url }) => ({ label, url })),
     ];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.5.11",
+  "version": "0.6.0",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",