nixamp 0.5.11 → 0.6.0

package/src/main.ts

@@ -75,6 +75,7 @@ const HELP = `nixamp — it really whips the terminal's ass.
   nixamp login [--with github]  sign in to nixamp.com, in a browser or here
   nixamp logout / whoami        forget it, or check it
   nixamp token create|list|revoke  tokens for a machine that cannot sign in
+  nixamp server list|add|remove  the machines you run, kept against your account
   nixamp update [version]        re-run the installer, keeping your choices
   nixamp uninstall [--yes]       remove everything the installer created
 
@@ -96,6 +97,9 @@ Options for serve:
                    its own interfaces. Also NIXAMP_PUBLIC_URL
       --no-lookup  do not ask ipinfo.io what this machine's public address is
                    when nothing local looks public
+      --tls-cert FILE --tls-key FILE  serve https rather than http. Needed by
+                   anyone opening this from a page that is itself https, since
+                   a browser refuses every request from https to http
       --ingest     accept a live stream in at POST /api/ingest
       --rtmp-in N  also listen for RTMP publishers (OBS, Larix) from port N
       --rtmp-streams N  how many may publish at once (default 3, a port each)
@@ -193,6 +197,18 @@ keeps serving its browser remote. One per user.
   nixamp admin    who is connected, and re-stream to them
 
 From inside the player, d hands the music to a daemon without stopping it.
+`,
+  server: `nixamp server -- the machines you run.
+
+  nixamp server list             every server on your account
+  nixamp server add --here       remember the daemon on this machine
+  nixamp server add URL --name x remember one somewhere else
+  nixamp server remove ID        forget it
+
+A share link printed in a terminal you have since closed is a server you have
+lost. This keeps the address against your account, so the answer is the same
+here, in the browser and in the desktop app. The share key is kept with it only
+if you pass one, since it is the secret that opens the machine.
 `,
   attach: `nixamp attach — the player, in front of the running daemon.
 
@@ -310,6 +326,11 @@ export async function main(): Promise<void> {
     process.exitCode = await login(first === "signup" ? [...rest, "--signup"] : rest);
     return;
   }
+  if (first === "server" || first === "servers") {
+    const { servers } = await import("./session.ts");
+    process.exitCode = await servers(rest);
+    return;
+  }
   if (first === "token" || first === "tokens") {
     const { tokens } = await import("./session.ts");
     process.exitCode = await tokens(rest);

package/src/server.ts

@@ -11,6 +11,7 @@
  */
 import { createReadStream, statSync } from "node:fs";
 import { createServer as createHttpServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
+import { createServer as createHttpsServer } from "node:https";
 import { hostname, networkInterfaces } from "node:os";
 import { spawn, spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
@@ -27,6 +28,7 @@ import { Ingest, normaliseFormat } from "./ingest.ts";
 import { Channels, cleanId } from "./channels.ts";
 import { RtmpListeners } from "./rtmp-in.ts";
 import { Accounts, clearedCookie, sessionCookie, tokenFrom } from "./accounts.ts";
+import { Servers } from "./servers.ts";
 import { DeviceGrants } from "./device.ts";
 import { BAD_KEY_LIMIT, callerOf, Guard, SIGN_IN_LIMIT } from "./guard.ts";
 import {
@@ -131,6 +133,18 @@ export interface ServeOptions {
    * listing is skipped and the printed links only work inside the house.
    */
   publicUrl: string;
+  /**
+   * A certificate and its key, to serve https rather than http.
+   *
+   * Needed by anybody whose nixamp is opened from a page that is itself https:
+   * a browser refuses every request from an https page to an http one --
+   * fetch, event stream and media alike -- and no header on either side lifts
+   * that. It is deliberately not required: a nixamp on 192.168.1.5 cannot have
+   * a certificate for that address, and forcing one would put a browser
+   * warning in front of everybody at home to fix a problem they do not have.
+   */
+  tlsCert: string;
+  tlsKey: string;
   /**
    * Ask an outside service what this machine's public address is, when no
    * interface holds one and none was given. Behind NAT that is the only way to
@@ -188,6 +202,8 @@ export function parseServeArgs(argv: string[]): ServeOptions {
     name: "",
     publicUrl: process.env["NIXAMP_PUBLIC_URL"] ?? "",
     lookup: true,
+    tlsCert: process.env["NIXAMP_TLS_CERT"] ?? "",
+    tlsKey: process.env["NIXAMP_TLS_KEY"] ?? "",
     x402: false,
     owner: "",
     ingest: false,
@@ -196,6 +212,11 @@ export function parseServeArgs(argv: string[]): ServeOptions {
     rtmp: [],
   };
   let sawRoot = false;
+  const bothOrNeither = (): void => {
+    if (Boolean(options.tlsCert) !== Boolean(options.tlsKey)) {
+      throw new Error("nixamp serve: --tls-cert and --tls-key go together");
+    }
+  };
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i] as string;
     const value = (): string => {
@@ -236,6 +257,10 @@ export function parseServeArgs(argv: string[]): ServeOptions {
         throw new Error("nixamp serve: --public-url must be a URL, e.g. https://nixamp.example.com");
       }
       options.publicUrl = given.replace(/\/+$/, "");
+    } else if (arg === "--tls-cert") {
+      options.tlsCert = value();
+    } else if (arg === "--tls-key") {
+      options.tlsKey = value();
     } else if (arg === "--no-lookup") {
       options.lookup = false;
     } else if (arg === "--name") {
@@ -271,6 +296,7 @@ export function parseServeArgs(argv: string[]): ServeOptions {
       sawRoot = true;
     }
   }
+  bothOrNeither();
   return options;
 }
 
@@ -660,7 +686,14 @@ const OAUTH_ROUTE = /^\/api\/v1\/([a-z0-9-]+)\/oauth\/(start|callback)$/;
  * the share-key check rather than behind it.
  */
 export function isSignInPath(path: string): boolean {
-  return path.startsWith("/api/v1/auth/") || OAUTH_ROUTE.test(path);
+  return (
+    path.startsWith("/api/v1/auth/") ||
+    // The account's own server list: nixamp.com's API, gated by the session
+    // rather than by a share key it has nothing to do with.
+    path === "/api/v1/servers" ||
+    path.startsWith("/api/v1/servers/") ||
+    OAUTH_ROUTE.test(path)
+  );
 }
 
 function html(response: ServerResponse, code: number, body: string): void {
@@ -737,8 +770,12 @@ export interface HandlerOptions {
   accounts?: Accounts;
   /** Providers to sign in with, and the terminals waiting to be connected. */
   signIn?: SignIn;
+  /** The servers each account runs, on the instance that keeps accounts. */
+  servers?: Servers;
   /** True when this instance is reached over https, for the cookie's Secure. */
   secureCookies?: boolean;
+  /** A certificate and key in PEM, when this server is to speak https itself. */
+  tls?: { cert: string; key: string };
   /**
    * True when a proxy sits in front, so `x-forwarded-for` names the caller.
    * False everywhere else on purpose: the header is trivially forged, and
@@ -1213,6 +1250,77 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         return;
       }
 
+      // --- the servers this account runs ----------------------------------
+      //
+      // Kept against the account rather than the machine, so the list reads the
+      // same from the CLI, the PWA and the desktop app -- which is the whole
+      // point: a share link in a terminal you closed is a server you have lost.
+      if ((path === "/api/v1/servers" || path.startsWith("/api/v1/servers/")) && options.servers) {
+        const servers = options.servers;
+        const who = await accounts.whoIs(tokenFrom(request.headers));
+        if (who === null) {
+          json(response, 401, { error: "not signed in" });
+          return;
+        }
+
+        if (path === "/api/v1/servers" && request.method === "GET") {
+          json(response, 200, { servers: await servers.list(who.id) });
+          return;
+        }
+
+        if (path === "/api/v1/servers" && request.method === "POST") {
+          let body: { name?: unknown; url?: unknown; key?: unknown };
+          try {
+            body = JSON.parse(await readBody(request)) as typeof body;
+          } catch {
+            json(response, 400, { error: "bad JSON" });
+            return;
+          }
+          const made = await servers.add(who, {
+            ...(typeof body.name === "string" ? { name: body.name } : {}),
+            ...(typeof body.url === "string" ? { url: body.url } : {}),
+            ...(typeof body.key === "string" ? { key: body.key } : {}),
+          });
+          if (made === null) {
+            json(response, 422, { error: "that needs an http or https address" });
+            return;
+          }
+          json(response, 201, { server: made });
+          return;
+        }
+
+        const id = path.slice("/api/v1/servers/".length);
+        if (id && request.method === "DELETE") {
+          const gone = await servers.remove(who.id, id);
+          json(response, gone ? 200 : 404, gone ? { ok: true } : { error: "no such server" });
+          return;
+        }
+
+        if (id && (request.method === "PATCH" || request.method === "PUT")) {
+          let body: { name?: unknown; url?: unknown; key?: unknown };
+          try {
+            body = JSON.parse(await readBody(request)) as typeof body;
+          } catch {
+            json(response, 400, { error: "bad JSON" });
+            return;
+          }
+          const changed = await servers.update(who.id, id, {
+            ...(typeof body.name === "string" ? { name: body.name } : {}),
+            ...(typeof body.url === "string" ? { url: body.url } : {}),
+            ...(typeof body.key === "string" ? { key: body.key } : {}),
+          });
+          if (changed === null) {
+            json(response, 404, { error: "no such server, or a bad address" });
+            return;
+          }
+          json(response, 200, { server: changed });
+          return;
+        }
+
+        json(response, 405, { error: "GET, POST, PATCH or DELETE" });
+        return;
+      }
+
       // --- tokens a person made on purpose --------------------------------
       if (path === "/api/v1/auth/tokens" || path.startsWith("/api/v1/auth/tokens/")) {
         const who = await accounts.whoIs(tokenFrom(request.headers));
@@ -2201,12 +2309,19 @@ function sendFile(request: IncomingMessage, response: ServerResponse, file: stri
 
 export function createServer(engine: Engine, options: HandlerOptions): Server {
   const handle = createHandler(engine, options);
-  return createHttpServer((request, response) => {
+  const onRequest = (request: IncomingMessage, response: ServerResponse): void => {
     handle(request, response).catch(() => {
       if (!response.headersSent) json(response, 500, { error: "server error" });
       else response.end();
     });
-  });
+  };
+
+  // https when there is a certificate to serve it with, and the same handler
+  // either way: nothing above this line knows or cares which it got.
+  if (options.tls) {
+    return createHttpsServer({ cert: options.tls.cert, key: options.tls.key }, onRequest) as unknown as Server;
+  }
+  return createHttpServer(onRequest);
 }
 
 
@@ -2434,6 +2549,18 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
       });
   }
 
+  // Read before listening, so a missing or unreadable certificate is a sentence
+  // now rather than a connection that resets later.
+  const tls = options.tlsCert
+    ? (() => {
+        try {
+          return { cert: readFileSync(options.tlsCert, "utf8"), key: readFileSync(options.tlsKey, "utf8") };
+        } catch (error) {
+          throw new Error(`nixamp serve: could not read the certificate: ${(error as Error).message}`);
+        }
+      })()
+    : undefined;
+
   const server = createServer(engine, {
     web,
     media: options.media,
@@ -2449,6 +2576,7 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     paywall,
     ffmpeg: tools.ffmpeg,
     ffprobe: tools.ffprobe,
+    ...(tls ? { tls } : {}),
     load: (next) => loadSource(tools, next),
     ...(directory ? { directory } : {}),
     ...(follows ? { follows, vapidPublicKey } : {}),
@@ -2470,6 +2598,9 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
           // Whichever providers this deployment was given both halves of, plus
           // the device grant, which is worth having even with no provider at
           // all: a browser already signed in can approve a terminal.
+          // The same pool the follows and reminders use: three small tables in
+          // one database do not want three sets of connections.
+          ...(pool ? { servers: new Servers(pool) } : {}),
           signIn: new SignIn(
             providersFrom(process.env),
             new DeviceGrants(),
@@ -2514,13 +2645,18 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
   // is and nothing local looks public, ask. What comes back is a fact about the
   // router and not about this port -- the port still has to be forwarded -- so
   // it is marked as a guess and everything that prints it says so.
-  const localAddresses = reachableAddresses(options.host, port, options.publicUrl);
+  const localAddresses = reachableAddresses(options.host, port, options.publicUrl, tls ? "https" : "http");
   const guessedPublic =
     options.lookup && !options.publicUrl && !localAddresses.some((a) => a.label === "on the internet")
       ? await lookupPublicIp()
       : "";
   const addresses = guessedPublic
-    ? reachableAddresses(options.host, port, `http://${guessedPublic.includes(":") ? `[${guessedPublic}]` : guessedPublic}:${port}`)
+    ? reachableAddresses(
+        options.host,
+        port,
+        `${tls ? "https" : "http"}://${guessedPublic.includes(":") ? `[${guessedPublic}]` : guessedPublic}:${port}`,
+        tls ? "https" : "http",
+      )
     : localAddresses;
 
   // Listening on every interface proves the socket is open here and nothing

package/src/servers.ts

@@ -0,0 +1,189 @@
+/**
+ * The servers a person runs.
+ *
+ * A nixamp is a machine somewhere with an address and a key, and until now the
+ * only record of one was the share link in whatever terminal printed it. Lose
+ * the terminal and you have lost the server: the daemon is still playing, and
+ * nothing anywhere can tell you where. This is the list, kept against the
+ * account rather than the machine, so it reads the same from the CLI, the PWA
+ * and the desktop app.
+ *
+ * The share key is optional and, when given, is the listen-or-control secret
+ * for somebody else's machine sitting in our database. It is stored because a
+ * list you cannot click is half a feature, and it is optional because that is
+ * a choice which belongs to the person whose server it is.
+ */
+import { randomBytes } from "node:crypto";
+import type { Account } from "./accounts.ts";
+import type { Queryable } from "./follows.ts";
+
+const TABLE = "nixamp_servers";
+
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS ${TABLE} (
+    id           TEXT PRIMARY KEY,
+    user_id      TEXT NOT NULL,
+    name         TEXT NOT NULL DEFAULT '',
+    url          TEXT NOT NULL,
+    share_key    TEXT NOT NULL DEFAULT '',
+    created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    last_seen_at TIMESTAMPTZ
+  );
+  CREATE INDEX IF NOT EXISTS ${TABLE}_user ON ${TABLE} (user_id);
+  CREATE UNIQUE INDEX IF NOT EXISTS ${TABLE}_user_url ON ${TABLE} (user_id, url);
+`;
+
+export interface ServerEntry {
+  id: string;
+  name: string;
+  url: string;
+  /** Empty when the owner chose not to keep it here. */
+  key: string;
+  createdAt: number;
+  updatedAt: number;
+  lastSeenAt: number | null;
+}
+
+/** What a caller may set. Anything else is the server's business. */
+export interface ServerInput {
+  name?: string;
+  url?: string;
+  key?: string;
+}
+
+function asTime(value: unknown): number | null {
+  if (value instanceof Date) return value.getTime();
+  if (typeof value === "string") {
+    const at = Date.parse(value);
+    return Number.isNaN(at) ? null : at;
+  }
+  return typeof value === "number" ? value : null;
+}
+
+function toEntry(row: Record<string, unknown>): ServerEntry {
+  return {
+    id: String(row["id"] ?? ""),
+    name: String(row["name"] ?? ""),
+    url: String(row["url"] ?? ""),
+    key: String(row["share_key"] ?? ""),
+    createdAt: asTime(row["created_at"]) ?? 0,
+    updatedAt: asTime(row["updated_at"]) ?? 0,
+    lastSeenAt: asTime(row["last_seen_at"]),
+  };
+}
+
+/**
+ * An address a browser could open, with nothing else smuggled in.
+ *
+ * A stored URL is handed back to other clients and put in an href, so a
+ * javascript: or data: entry here is a link somebody else clicks. Only http
+ * and https, and nothing after the origin: a nixamp is a host and a port.
+ */
+export function cleanUrl(value: unknown): string {
+  if (typeof value !== "string" || value.trim() === "") return "";
+  let parsed: URL;
+  try {
+    parsed = new URL(value.trim());
+  } catch {
+    return "";
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return "";
+  return parsed.origin;
+}
+
+/** A name is a label, not an essay, and never empty on screen. */
+export function cleanName(value: unknown, url: string): string {
+  const given = typeof value === "string" ? value.trim().slice(0, 60) : "";
+  if (given) return given;
+  // The host is a better default than "untitled", and it is what somebody
+  // would have typed anyway.
+  try {
+    return new URL(url).host;
+  } catch {
+    return "a nixamp";
+  }
+}
+
+export class Servers {
+  private ready: Promise<void> | null = null;
+
+  constructor(private readonly db: Queryable) {}
+
+  private async ensure(): Promise<void> {
+    this.ready ??= this.db.query(SCHEMA).then(() => undefined);
+    await this.ready;
+  }
+
+  async list(userId: string): Promise<ServerEntry[]> {
+    await this.ensure();
+    const { rows } = await this.db.query(
+      `SELECT id, name, url, share_key, created_at, updated_at, last_seen_at FROM ${TABLE}
+        WHERE user_id = $1 ORDER BY created_at`,
+      [userId],
+    );
+    return rows.map(toEntry);
+  }
+
+  /**
+   * Remember a server, or update the one already at that address.
+   *
+   * Upserted on the address rather than refused, because the common way to
+   * call this twice is a daemon announcing itself after a restart, and that
+   * should move the entry forward rather than fail.
+   */
+  async add(account: Account, input: ServerInput): Promise<ServerEntry | null> {
+    const url = cleanUrl(input.url);
+    if (!url) return null;
+    await this.ensure();
+    const { rows } = await this.db.query(
+      `INSERT INTO ${TABLE} (id, user_id, name, url, share_key, last_seen_at)
+       VALUES ($1, $2, $3, $4, $5, NOW())
+       ON CONFLICT (user_id, url) DO UPDATE
+         SET name = EXCLUDED.name, share_key = EXCLUDED.share_key,
+             updated_at = NOW(), last_seen_at = NOW()
+       RETURNING id, name, url, share_key, created_at, updated_at, last_seen_at`,
+      [
+        randomBytes(8).toString("hex"),
+        account.id,
+        cleanName(input.name, url),
+        url,
+        typeof input.key === "string" ? input.key.slice(0, 200) : "",
+      ],
+    );
+    return rows[0] ? toEntry(rows[0]) : null;
+  }
+
+  /** Scoped to the owner, so somebody else's id changes nothing. */
+  async update(userId: string, id: string, input: ServerInput): Promise<ServerEntry | null> {
+    await this.ensure();
+    const url = input.url === undefined ? undefined : cleanUrl(input.url);
+    if (input.url !== undefined && !url) return null;
+    const { rows } = await this.db.query(
+      `UPDATE ${TABLE}
+          SET name = COALESCE($3, name),
+              url = COALESCE($4, url),
+              share_key = COALESCE($5, share_key),
+              updated_at = NOW()
+        WHERE user_id = $1 AND id = $2
+        RETURNING id, name, url, share_key, created_at, updated_at, last_seen_at`,
+      [
+        userId,
+        id,
+        input.name === undefined ? null : cleanName(input.name, url ?? ""),
+        url ?? null,
+        input.key === undefined ? null : input.key.slice(0, 200),
+      ],
+    );
+    return rows[0] ? toEntry(rows[0]) : null;
+  }
+
+  async remove(userId: string, id: string): Promise<boolean> {
+    await this.ensure();
+    const { rows } = await this.db.query(
+      `DELETE FROM ${TABLE} WHERE user_id = $1 AND id = $2 RETURNING id`,
+      [userId, id],
+    );
+    return rows.length > 0;
+  }
+}

package/src/session.ts

@@ -549,3 +549,113 @@ export async function whoami(fetcher: typeof fetch = fetch): Promise<number> {
     return 0;
   }
 }
+
+/**
+ * `nixamp server list|add|remove`, the account's own list of machines.
+ *
+ * A share link printed in a terminal you have since closed is a server you
+ * have lost: the daemon is still playing and nothing can tell you where. This
+ * keeps the address against the account, so the answer is the same here, in
+ * the browser and in the desktop app.
+ */
+export async function servers(argv: string[], fetcher: typeof fetch = fetch): Promise<number> {
+  const session = readSession();
+  if (session === null) {
+    console.error("nixamp: not signed in. Try `nixamp login`.");
+    return 1;
+  }
+  const [command = "list", ...rest] = argv;
+  const where = `${session.site}/api/v1/servers`;
+  const headers = { authorization: `Bearer ${session.token}`, "content-type": "application/json" };
+  const at = (flag: string): string | undefined => {
+    const index = rest.indexOf(flag);
+    return index === -1 ? undefined : rest[index + 1];
+  };
+
+  try {
+    if (command === "add" || command === "register") {
+      // `--here` is the common case: the daemon on this machine, with the
+      // address and key it already printed, rather than retyped by hand.
+      let url = rest.find((a) => /^https?:\/\//.test(a)) ?? at("--url") ?? "";
+      let key = at("--key") ?? "";
+      if (rest.includes("--here")) {
+        const daemon = await import("./daemon.ts");
+        const state = daemon.readState();
+        if (state === null) {
+          console.error("nixamp: no daemon is running here. Start one, or pass a URL.");
+          return 1;
+        }
+        // The address worth remembering is the one somebody else can open.
+        const reachable = state.urls?.find((u) => u.label === "on the internet") ?? state.urls?.[0];
+        url = reachable?.url ?? "";
+        key = key || (state.key ?? "");
+      }
+      if (!url) {
+        console.error("nixamp: which server? Give a URL, or --here for the daemon on this machine.");
+        return 64;
+      }
+
+      const answer = await fetcher(where, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ url, name: at("--name") ?? "", ...(key ? { key } : {}) }),
+      });
+      const body = (await answer.json().catch(() => ({}))) as { server?: ServerRow; error?: string };
+      if (!answer.ok || !body.server) {
+        console.error(`nixamp: ${body.error ?? `could not add it (${answer.status})`}`);
+        return 1;
+      }
+      console.log(`${body.server.id}  ${body.server.name}  ${body.server.url}`);
+      return 0;
+    }
+
+    if (command === "remove" || command === "rm" || command === "forget") {
+      const id = rest.find((a) => !a.startsWith("-")) ?? "";
+      if (!id) {
+        console.error("nixamp: which one? `nixamp server list` shows their ids.");
+        return 64;
+      }
+      const answer = await fetcher(`${where}/${encodeURIComponent(id)}`, { method: "DELETE", headers });
+      if (!answer.ok) {
+        console.error(`nixamp: ${answer.status === 404 ? "no server with that id" : "could not remove it"}`);
+        return 1;
+      }
+      console.log(`Forgot ${id}.`);
+      return 0;
+    }
+
+    if (command === "list" || command === "ls") {
+      const answer = await fetcher(where, { headers });
+      const body = (await answer.json().catch(() => ({}))) as { servers?: ServerRow[]; error?: string };
+      if (!answer.ok) {
+        console.error(`nixamp: ${body.error ?? `could not list them (${answer.status})`}`);
+        return 1;
+      }
+      const rows = body.servers ?? [];
+      if (rows.length === 0) {
+        console.log("No servers yet. `nixamp server add --here` remembers the one on this machine.");
+        return 0;
+      }
+      const width = Math.max(...rows.map((row) => row.name.length));
+      for (const row of rows) {
+        const link = row.key ? `${row.url}/s/${row.key}` : row.url;
+        console.log(`${row.id}  ${row.name.padEnd(width)}  ${link}`);
+      }
+      return 0;
+    }
+
+    console.error(`nixamp: no such server command: ${command}`);
+    return 64;
+  } catch (error) {
+    console.error(`nixamp: could not reach ${session.site}: ${(error as Error).message}`);
+    return 69;
+  }
+}
+
+/** One row of the account's server list, as the API sends it. */
+interface ServerRow {
+  id: string;
+  name: string;
+  url: string;
+  key: string;
+}

package/src/share.ts

@@ -132,11 +132,12 @@ export function reachableAddresses(
   host: string,
   port: number,
   publicUrl = "",
+  scheme: "http" | "https" = "http",
 ): { label: string; url: string }[] {
   const link = (address: string): string => {
     // A bare IPv6 address needs brackets before it is a URL.
     const authority = address.includes(":") ? `[${address}]` : address;
-    return `http://${authority}:${port}`;
+    return `${scheme}://${authority}:${port}`;
   };
 
   // An address somebody told us about, because it is one this machine cannot
@@ -162,7 +163,7 @@ export function reachableAddresses(
   found.sort((x, y) => order[x.kind] - order[y.kind]);
   return [
     ...told,
-    { label: "here", url: `http://localhost:${port}` },
+    { label: "here", url: `${scheme}://localhost:${port}` },
     ...found.map(({ label, url }) => ({ label, url })),
   ];
 }

package/web/dist/assets/{hls-3VKVEQE3-Bug6MFON.js → hls-3VKVEQE3-CSh9YGnu.js}

@@ -1 +1 @@
-import{t as e}from"./index-CRfW9BIP.js";var t=3;async function n(n){let{media:r,src:i,isTv:a}=n,{default:o}=await e(async()=>{let{default:e}=await import(`./hls-n74Cnh8A.js`);return{default:e}},[]);if(!o.isSupported())return n.onError(`This browser cannot play HLS streams.`),{destroy:()=>void 0,levels:()=>[]};let s=new o({...a?{maxBufferLength:60,maxMaxBufferLength:120,backBufferLength:30,liveSyncDurationCount:4}:{backBufferLength:90},enableWorker:!0}),c=0,l=!1;s.on(o.Events.ERROR,(e,r)=>{if(!l&&r.fatal){if(c>=t){n.onError(`This stream kept failing and has been stopped.`),s.destroy();return}switch(c+=1,r.type){case o.ErrorTypes.NETWORK_ERROR:n.onNotice(`Reconnecting…`),s.startLoad();break;case o.ErrorTypes.MEDIA_ERROR:n.onNotice(`Recovering…`),s.recoverMediaError();break;default:n.onError(`This stream could not be played.`),s.destroy()}}}),s.on(o.Events.MANIFEST_PARSED,()=>{l||(n.onNotice(null),n.onReady?.({live:s.levels.length>0&&!Number.isFinite(r.duration),levels:u()}))}),s.on(o.Events.LEVEL_LOADED,(e,t)=>{l||n.onReady?.({live:t.details.live,levels:u()})}),s.on(o.Events.FRAG_BUFFERED,()=>{l||n.onNotice(null)});function u(){return s.levels.map((e,t)=>({index:t,height:e.height||null,bitrate:e.bitrate||null,label:e.height?`${String(e.height)}p`:`${String(Math.round((e.bitrate||0)/1e3))}k`}))}return s.loadSource(i),s.attachMedia(r),{destroy(){l=!0,s.destroy()},levels:u,setLevel(e){s.currentLevel=e},currentLevel:()=>s.autoLevelEnabled?-1:s.currentLevel}}export{n as createHlsEngine};
+import{t as e}from"./index-PgqcCBW4.js";var t=3;async function n(n){let{media:r,src:i,isTv:a}=n,{default:o}=await e(async()=>{let{default:e}=await import(`./hls-n74Cnh8A.js`);return{default:e}},[]);if(!o.isSupported())return n.onError(`This browser cannot play HLS streams.`),{destroy:()=>void 0,levels:()=>[]};let s=new o({...a?{maxBufferLength:60,maxMaxBufferLength:120,backBufferLength:30,liveSyncDurationCount:4}:{backBufferLength:90},enableWorker:!0}),c=0,l=!1;s.on(o.Events.ERROR,(e,r)=>{if(!l&&r.fatal){if(c>=t){n.onError(`This stream kept failing and has been stopped.`),s.destroy();return}switch(c+=1,r.type){case o.ErrorTypes.NETWORK_ERROR:n.onNotice(`Reconnecting…`),s.startLoad();break;case o.ErrorTypes.MEDIA_ERROR:n.onNotice(`Recovering…`),s.recoverMediaError();break;default:n.onError(`This stream could not be played.`),s.destroy()}}}),s.on(o.Events.MANIFEST_PARSED,()=>{l||(n.onNotice(null),n.onReady?.({live:s.levels.length>0&&!Number.isFinite(r.duration),levels:u()}))}),s.on(o.Events.LEVEL_LOADED,(e,t)=>{l||n.onReady?.({live:t.details.live,levels:u()})}),s.on(o.Events.FRAG_BUFFERED,()=>{l||n.onNotice(null)});function u(){return s.levels.map((e,t)=>({index:t,height:e.height||null,bitrate:e.bitrate||null,label:e.height?`${String(e.height)}p`:`${String(Math.round((e.bitrate||0)/1e3))}k`}))}return s.loadSource(i),s.attachMedia(r),{destroy(){l=!0,s.destroy()},levels:u,setLevel(e){s.currentLevel=e},currentLevel:()=>s.autoLevelEnabled?-1:s.currentLevel}}export{n as createHlsEngine};