nixamp 0.7.41 → 0.9.3

package/src/server.ts

@@ -55,6 +55,13 @@ import { CALL_IN_NUMBER, OPT_IN_PATH, optInPage } from "./optin.ts";
 import pg from "pg";
 import { Follows, phoneFrom } from "./follows.ts";
 import { Favorites, favoriteUrl } from "./favorites.ts";
+import { Catalogs, shownCatalog, shownEntry } from "./catalogs.ts";
+import { Porkbun, isIPv4, isIPv6, type DnsZone } from "./dns.ts";
+import { NameError, Names } from "./names.ts";
+import { AcmeIssuer, Certs } from "./certs.ts";
+import { claimName, fetchCert, labelFor, readCertFiles, writeCertFiles } from "./naming.ts";
+import { forbiddenLibrary, readLibrary } from "./library.ts";
+import { createThrottle, presentedCredential, type Throttle } from "@profullstack/throttle";
 import { Durable } from "./durable.ts";
 import { notifyAll, resendEmail, webPush, type Notification } from "./notify.ts";
 import { confirm, DEFAULT_DIRECTORY, Publisher } from "./publish.ts";
@@ -119,6 +126,8 @@ export interface ServeOptions {
   newKey: boolean;
   /** Start without the noise it makes when it wakes up. */
   noJingle: boolean;
+  /** Do not ask nixamp.com for a name and a certificate, even when signed in. */
+  noName: boolean;
   /**
    * Ask the local firewall to let the port through, and put it back on the way
    * out. Off by default because it changes the machine, not just this process.
@@ -202,7 +211,9 @@ export function parseServeArgs(argv: string[]): ServeOptions {
   // A platform that hands out the port does it through PORT; a flag still wins.
   const fromEnv = Number(process.env.PORT);
   const options: ServeOptions = {
-    root: ".",
+    // Empty, not ".": nothing about a server should depend on where it was
+    // started from. The saved library fills it in, or the start refuses.
+    root: "",
     port: Number.isInteger(fromEnv) && fromEnv > 0 && fromEnv <= 65535 ? fromEnv : DEFAULT_PORT,
     // Every interface, because a player nobody else can reach is not much of a
     // remote. The key in the link is what makes that safe; --no-key gives up
@@ -213,6 +224,7 @@ export function parseServeArgs(argv: string[]): ServeOptions {
     key: true,
     newKey: false,
     noJingle: false,
+    noName: false,
     openPort: false,
     announce: false,
     directory: false,
@@ -289,6 +301,8 @@ export function parseServeArgs(argv: string[]): ServeOptions {
       options.newKey = true;
     } else if (arg === "--no-jingle") {
       options.noJingle = true;
+    } else if (arg === "--no-name") {
+      options.noName = true;
     } else if (arg === "--ingest") {
       options.ingest = true;
     } else if (arg === "--rtmp-streams") {
@@ -912,6 +926,44 @@ export class PlayerEngine implements Engine {
  * looking at what is on wants "that album from the web", not every track in
  * it. An entry names where to start, so clicking it plays.
  */
+/**
+ * A fetch-shaped Request for the throttle, built from the Node one.
+ *
+ * @profullstack/throttle is written against the web Request so it runs at an
+ * edge; this server is Node's http. Only what the throttle reads is carried
+ * across: method, URL and headers. The body is not, because metering is
+ * decided before anybody reads it.
+ */
+export function requestFor(request: IncomingMessage, origin = "http://localhost"): Request {
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(request.headers)) {
+    if (typeof value === "string") headers.set(name, value);
+    else if (Array.isArray(value)) headers.set(name, value.join(", "));
+  }
+  // The address, for a throttle that has no socket to ask.
+  if (!headers.has("x-forwarded-for") && request.socket?.remoteAddress) {
+    headers.set("x-forwarded-for", request.socket.remoteAddress);
+  }
+  return new Request(`${origin}${request.url ?? "/"}`, { method: request.method ?? "GET", headers });
+}
+
+/** Write a refusal the throttle produced back through the Node response. */
+export async function answerWith(response: ServerResponse, refused: Response): Promise<void> {
+  const headers: Record<string, string> = { ...CORS };
+  refused.headers.forEach((value, name) => {
+    headers[name] = value;
+  });
+  response.writeHead(refused.status, headers);
+  response.end(Buffer.from(await refused.arrayBuffer()));
+}
+
+/**
+ * How many channels a server will start on demand at once. Each is an ffmpeg,
+ * and a catalog has thousands of entries; this is what keeps a room full of
+ * curious people from becoming a room full of decoders.
+ */
+export const MAX_ON_DEMAND = 4;
+
 /**
  * Probe a source and start carrying it as a channel of its own.
  *
@@ -985,7 +1037,7 @@ const CORS: Record<string, string> = {
   // control API has to be reachable cross-origin. It exposes no filesystem
   // paths and takes six commands; binding to 127.0.0.1 is what keeps it shut.
   "access-control-allow-origin": "*",
-  "access-control-allow-methods": "GET, POST, OPTIONS",
+  "access-control-allow-methods": "GET, POST, PUT, DELETE, OPTIONS",
   "access-control-allow-headers": "content-type",
   "access-control-max-age": "86400",
 };
@@ -1095,6 +1147,8 @@ export interface HandlerOptions {
   channels?: Channels;
   /** Write down the channels this server pulls, so a restart puts them back. */
   rememberChannels?: (list: RememberedChannel[]) => void;
+  /** The m3u catalogs this server keeps, browsable by group. */
+  catalogs?: Catalogs;
   /** Live audio going out to RTMP. */
   broadcaster?: Broadcaster;
   /** Where a broadcast should send, and what it should look like. */
@@ -1171,6 +1225,18 @@ export interface HandlerOptions {
   follows?: Follows;
   /** The servers an account hearted. nixamp.com only, like follows. */
   favorites?: Favorites;
+  /** Names under `<handle>.<zone>` for an account's servers. nixamp.com only. */
+  names?: Names;
+  /** One wildcard certificate per handle, issued and renewed here. nixamp.com only. */
+  certs?: Certs;
+  /** The zone the names live in, e.g. "nixamp.com". */
+  dnsZone?: string;
+  /**
+   * The rate limit over everything, from @profullstack/throttle. Fetch-shaped,
+   * so the handler builds a Request from the Node one and writes back the
+   * Response it is refused with.
+   */
+  throttle?: Throttle;
   /** The VAPID public key a browser needs before it can subscribe. */
   vapidPublicKey?: string;
 }
@@ -1219,6 +1285,17 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       return;
     }
 
+    // Metered before anything is done for the request, so a caller over its
+    // allowance costs nothing but this check. The throttle decides; this only
+    // carries its refusal back through Node's response.
+    if (options.throttle) {
+      const refused = await options.throttle.handle(requestFor(request));
+      if (refused) {
+        await answerWith(response, refused);
+        return;
+      }
+    }
+
     // Opening a share link is what hands a browser its key. It comes back as a
     // cookie, so every later fetch, EventSource and <audio src> carries it
     // without the page knowing anything about keys. Either key works here, and
@@ -1261,6 +1338,99 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
     // Behind the sign-in rather than the share key: a follow belongs to an
     // account, and an account is the only thing that makes "notify me on my
     // other device" mean anything.
+    // --- names and certificates for an account's servers --------------------
+    //
+    // A server that is signed in becomes `<label>.<handle>.<zone>`, with A and
+    // AAAA records nixamp.com writes with keys only nixamp.com holds, and it
+    // serves https with the one wildcard certificate its handle has. Nothing
+    // about DNS or ACME ever reaches the box; it asks, and is answered.
+    if ((path === "/api/v1/dns" || path.startsWith("/api/v1/dns/")) && options.names && options.accounts && options.handles) {
+      const me = await options.accounts.whoIs(tokenFrom(request.headers));
+      if (me === null) {
+        json(response, 401, { error: "sign in to name a server" });
+        return;
+      }
+      const handle = await options.handles.of(me.id);
+      if (!handle) {
+        json(response, 422, { error: "this account has no handle yet" });
+        return;
+      }
+      const names = options.names;
+      const zone = `${handle}.${options.dnsZone ?? ""}`.replace(/\.$/, "");
+
+      if (path === "/api/v1/dns" && request.method === "GET") {
+        json(response, 200, { zone, names: await names.list(me.id, handle) });
+        return;
+      }
+      const label = decodeURIComponent(path.slice("/api/v1/dns/".length));
+      if (!label) {
+        json(response, 404, { error: "no such endpoint" });
+        return;
+      }
+      if (request.method === "PUT" || request.method === "POST") {
+        let body: { a?: unknown; aaaa?: unknown; ttl?: unknown } = {};
+        try {
+          body = JSON.parse((await readBody(request)) || "{}") as typeof body;
+        } catch {
+          json(response, 400, { error: "bad JSON" });
+          return;
+        }
+        // "auto" is the address this request came from, for whichever family
+        // it came in on: a server names itself without knowing its address.
+        const caller = callerOf(request.headers, request.socket.remoteAddress, options.behindProxy ?? false);
+        const family = (value: unknown, is: (ip: unknown) => boolean): string | null | undefined => {
+          if (value === null) return null;
+          if (value === undefined) return undefined;
+          if (value === "auto") return is(caller) ? caller : undefined;
+          return String(value);
+        };
+        try {
+          const name = await names.set(me.id, handle, label, {
+            a: family(body.a, isIPv4),
+            aaaa: family(body.aaaa, isIPv6),
+            ...(typeof body.ttl === "number" ? { ttl: body.ttl } : {}),
+          });
+          json(response, 200, { name });
+        } catch (error) {
+          const status = error instanceof NameError ? error.status : 500;
+          json(response, status, { error: (error as Error).message });
+        }
+        return;
+      }
+      if (request.method === "DELETE") {
+        const gone = await names.remove(me.id, handle, label);
+        json(response, gone ? 200 : 404, gone ? { ok: true } : { error: "no such name of yours" });
+        return;
+      }
+      json(response, 405, { error: "GET, PUT or DELETE" });
+      return;
+    }
+
+    if (path === "/api/v1/certs" && options.certs && options.accounts && options.handles) {
+      const me = await options.accounts.whoIs(tokenFrom(request.headers));
+      if (me === null) {
+        json(response, 401, { error: "sign in to get a certificate" });
+        return;
+      }
+      const handle = await options.handles.of(me.id);
+      if (!handle) {
+        json(response, 422, { error: "this account has no handle yet" });
+        return;
+      }
+      const state = await options.certs.forHandle(handle);
+      const host = `*.${handle}.${options.dnsZone ?? ""}`.replace(/\.$/, "");
+      if (state.status === "ready") {
+        json(response, 200, { status: "ready", cert: state.cert, key: state.key, expiresAt: state.expiresAt, host, renewing: state.renewing });
+        return;
+      }
+      if (state.status === "failed") {
+        json(response, 503, { status: "failed", error: state.error, host });
+        return;
+      }
+      json(response, 202, { status: "issuing", host });
+      return;
+    }
+
     // Favourites: the servers you hearted, kept against your account. Reading
     // the directory and listening need no account; remembering where you
     // listened does, because there has to be somebody to remember it for.
@@ -2098,9 +2268,14 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         // phone for it. The code is published on purpose: it is a public
         // call-in line, and a listing you cannot dial is a listing of nothing.
         const onThePhone = options.partyLine;
-        const streams = options.directory.list().map((stream) => ({
+        // The admin link goes only to the account that owns the listing. A
+        // directory that handed out control links would be a directory of
+        // machines anyone could take over.
+        const me = options.accounts ? await options.accounts.whoIs(tokenFrom(request.headers)) : null;
+        const streams = options.directory.list().map(({ admin, ...stream }) => ({
           ...stream,
           callers: onThePhone ? onThePhone.listenersOn(stream.code) : 0,
+          ...(admin && me !== null && stream.ownerId === me.id ? { admin } : {}),
         }));
         // Recently ended too, because following exists to hear about
         // broadcasts you would otherwise miss -- and a list of only what is on
@@ -2293,6 +2468,140 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
 
     // --- several streams at once ------------------------------------------
     //
+    // --- catalogs: m3u lists you can browse ---------------------------------
+    //
+    // An IPTV list is thousands of entries with groups and logos. Kept as a
+    // catalog it stays browsable; poured into the playlist it was three
+    // thousand flat rows. Anyone with the link browses and plays; adding,
+    // refreshing and removing is administering (see needsAdmin).
+    if ((path === "/api/catalogs" || path.startsWith("/api/catalogs/")) && options.catalogs) {
+      const catalogs = options.catalogs;
+
+      if (path === "/api/catalogs" && request.method === "GET") {
+        // Where a list is read from is the administrator's business, not a
+        // listener's: it can carry a provider's credentials in the URL.
+        const holdsControl = key === null || scopeOf(keyFrom(request, url), key, null) === "control";
+        const admin = options.owner
+          ? (await options.owner.check(holdsControl, tokenFrom(request.headers))).allowed
+          : holdsControl;
+        json(response, 200, { catalogs: catalogs.list().map((one) => shownCatalog(one, admin)) });
+        return;
+      }
+
+      if (path === "/api/catalogs" && request.method === "POST") {
+        let body: { source?: unknown; name?: unknown } = {};
+        try {
+          body = JSON.parse(await readBody(request)) as typeof body;
+        } catch {
+          json(response, 400, { error: "bad JSON" });
+          return;
+        }
+        try {
+          const added = await catalogs.add(String(body.source ?? ""), String(body.name ?? ""));
+          json(response, added.error ? 422 : 200, {
+            ok: !added.error,
+            catalog: shownCatalog(added, true),
+            ...(added.error ? { error: added.error } : {}),
+          });
+        } catch (error) {
+          json(response, 422, { error: (error as Error).message.replace(/^nixamp: /, "") });
+        }
+        return;
+      }
+
+      const [rawId = "", action = "", entryId = "", sub = ""] = path.slice("/api/catalogs/".length).split("/");
+      const id = decodeURIComponent(rawId);
+      if (!catalogs.get(id)) {
+        json(response, 404, { error: "no such catalog" });
+        return;
+      }
+
+      if (action === "" && request.method === "DELETE") {
+        json(response, 200, { ok: catalogs.remove(id) });
+        return;
+      }
+      if (action === "refresh" && request.method === "POST") {
+        const refreshed = await catalogs.refresh(id);
+        json(response, refreshed && !refreshed.error ? 200 : 422, {
+          ok: refreshed !== null && !refreshed.error,
+          ...(refreshed ? { catalog: shownCatalog(refreshed, true) } : {}),
+          ...(refreshed?.error ? { error: refreshed.error } : {}),
+        });
+        return;
+      }
+      if (action === "groups" && request.method === "GET") {
+        json(response, 200, { groups: catalogs.groups(id) ?? [] });
+        return;
+      }
+      if (action === "entries" && entryId === "" && request.method === "GET") {
+        const page = catalogs.entries_(id, {
+          group: url.searchParams.get("group") ?? "",
+          q: url.searchParams.get("q") ?? "",
+          offset: Number(url.searchParams.get("offset") ?? "0") || 0,
+          limit: Number(url.searchParams.get("limit") ?? "200") || 200,
+        }) ?? { total: 0, entries: [] };
+        json(response, 200, { total: page.total, entries: page.entries.map(shownEntry) });
+        return;
+      }
+
+      const entry = action === "entries" && entryId !== "" ? catalogs.entry(id, decodeURIComponent(entryId)) : null;
+      if (!entry) {
+        json(response, 404, { error: "no such entry" });
+        return;
+      }
+
+      // Play. A live entry becomes a channel, started for whoever asked and
+      // stopped a minute after the last viewer leaves; a film is played on
+      // its own, straight from the source through ffmpeg.
+      if (sub === "play" && request.method === "POST") {
+        if (!entry.live) {
+          json(response, 200, {
+            kind: "vod",
+            url: `/api/catalogs/${encodeURIComponent(id)}/entries/${encodeURIComponent(entry.id)}/stream`,
+            name: entry.title,
+          });
+          return;
+        }
+        if (!options.channels) {
+          json(response, 503, { error: "this server cannot carry channels" });
+          return;
+        }
+        const channelId = cleanId(`cat-${entry.id}`);
+        if (!options.channels.has(channelId)) {
+          if (options.channels.ephemeralCount >= MAX_ON_DEMAND) {
+            json(response, 429, { error: `this server is already carrying ${MAX_ON_DEMAND} channels on demand; try again in a minute` });
+            return;
+          }
+          const started = await pullChannel(options.channels, options.ffprobe ?? ["ffprobe"], channelId, entry.title, entry.source);
+          if (!started) {
+            json(response, 409, { error: "that channel is already starting" });
+            return;
+          }
+          options.channels.ephemeral(channelId);
+        }
+        json(response, 200, { kind: "live", channel: channelId, name: entry.title });
+        return;
+      }
+
+      if (sub === "stream" && request.method === "GET") {
+        if (!options.media) {
+          json(response, 403, { error: "media streaming is off" });
+          return;
+        }
+        watch(request, response, "stream", entry.title);
+        const codecs = await codecsOf({ ffmpeg: [], ffprobe: options.ffprobe ?? ["ffprobe"], play: null }, entry.source);
+        if (codecs.video !== "") {
+          pipeFfmpeg(request, response, entry.source, options.ffmpeg ?? ["ffmpeg"], videoArgs(codecs), "video/mp4");
+        } else {
+          transcode(request, response, entry.source, options.ffmpeg ?? ["ffmpeg"]);
+        }
+        return;
+      }
+
+      json(response, 404, { error: "no such endpoint" });
+      return;
+    }
+
     // A channel is one publisher and everybody listening to them. Two or three
     // devices can publish at once, each to their own channel, and a listener
     // picks which to hear.
@@ -3323,7 +3632,20 @@ export function createServer(engine: Engine, options: HandlerOptions): Server {
 
 export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
   const options = parseServeArgs(argv);
-  const root = isRemote(options.root) ? options.root : resolve(options.root);
+  // Told which folder, or the one that was saved. Never the directory this
+  // happens to be running in: a daemon restarted from a home directory served
+  // the home directory, keys and all, under a public listing.
+  const chosen = options.root || readLibrary();
+  if (!chosen) {
+    throw new Error(
+      "nixamp serve: which folder? Say `nixamp library ~/Music` once, or `nixamp daemon start ~/Music`.",
+    );
+  }
+  const root = isRemote(chosen) ? chosen : resolve(chosen);
+  const why = isRemote(root) ? "" : forbiddenLibrary(root);
+  if (why) {
+    throw new Error(`nixamp will not serve ${why}. Pick a folder with your media in it: nixamp library ~/Music`);
+  }
   const tools = detectTools();
   // Names now, tags later.
   //
@@ -3393,6 +3715,12 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     });
   }
 
+  // The m3u catalogs kept here: read from disk now, and any that were never
+  // read are fetched in the background so browsing does not wait on a provider.
+  const catalogs = new Catalogs(stateDir(), options.port);
+  catalogs.load();
+  void catalogs.warm().catch(() => undefined);
+
   const destinations = parseDestinations(options.rtmp);
   const broadcaster = new Broadcaster(tools.ffmpeg);
   const ingest = options.ingest
@@ -3416,6 +3744,54 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
       : undefined;
   const follows = pool ? new Follows(pool) : undefined;
   const favorites = pool ? new Favorites(pool) : undefined;
+
+  // Names and certificates for signed-in servers, and the rate limit over
+  // everything. All of it is nixamp.com's business: the DNS keys live only
+  // here, the certificates are issued here, and a personal nixamp has neither
+  // a database nor strangers to meter. Without the registrar's keys the names
+  // are simply not offered, rather than written into a zone that does not
+  // exist.
+  const zoneName = (() => {
+    try {
+      return new URL(process.env["NIXAMP_SITE"] ?? DEFAULT_DIRECTORY).hostname;
+    } catch {
+      return "nixamp.com";
+    }
+  })();
+  const porkbunKey = process.env["PORKBUN_API_KEY"] ?? "";
+  const porkbunSecret = process.env["PORKBUN_SECRET_API_KEY"] ?? "";
+  const zone: DnsZone | null = porkbunKey && porkbunSecret ? new Porkbun(zoneName, porkbunKey, porkbunSecret) : null;
+  const names = pool && zone ? new Names(pool, zone) : undefined;
+  let certs: Certs | undefined;
+  if (pool && zone) {
+    const issuer = new AcmeIssuer({
+      directoryUrl: process.env["NIXAMP_ACME_DIRECTORY"] ?? "https://acme-v02.api.letsencrypt.org/directory",
+      email: process.env["NIXAMP_ACME_EMAIL"] ?? `hostmaster@${zoneName}`,
+      // The key is kept by the store, so the issuer asks for it each time
+      // rather than holding one that a second instance would not share.
+      accountKey: () => (certs as Certs).accountKey(),
+    });
+    certs = new Certs(pool, zone, issuer, { log: (line) => console.log(`  ${line}`) });
+  }
+  const throttle = pool
+    ? createThrottle({
+        rules: [
+          // Sign-in stays address-bucketed however the request is dressed, or
+          // a guess with an Authorization header buys itself the bigger budget.
+          { path: "/api/v1/auth/", limit: 20, credential: false },
+          { path: "/api/v1/dns/", limit: 30 },
+          { path: "/api/v1/dns", limit: 30 },
+          { path: "/api/v1/certs", limit: 30 },
+          { path: "/api/health", open: true },
+          { path: "/api/directory", limit: 120 },
+        ],
+        // A signed-in browser carries its session as a cookie, and is a
+        // credential the same as a bearer token: a person on a dashboard is
+        // not an anonymous scraper.
+        credentialFrom: (request) =>
+          presentedCredential(request.headers) ?? (tokenFrom(Object.fromEntries(request.headers)) || null),
+      })
+    : undefined;
   // The two things that were promises kept only in memory: a caller who was
   // told they would be texted, and the ended stream a code still points at.
   const durable = pool ? new Durable(pool, (message) => console.log(message)) : undefined;
@@ -3567,7 +3943,7 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
 
   // Read before listening, so a missing or unreadable certificate is a sentence
   // now rather than a connection that resets later.
-  const tls = options.tlsCert
+  let tls: { cert: string; key: string } | undefined = options.tlsCert
     ? (() => {
         try {
           return { cert: readFileSync(options.tlsCert, "utf8"), key: readFileSync(options.tlsKey, "utf8") };
@@ -3577,6 +3953,45 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
       })()
     : undefined;
 
+  // A signed-in server names itself.
+  //
+  // Nothing about DNS or certificates reaches this machine: it asks nixamp.com
+  // for `<label>.<handle>.<zone>` pointing at the address it is calling from,
+  // and for the handle's wildcard certificate, and serves https under that
+  // name. The registrar's keys stay on nixamp.com. Skipped when the operator
+  // named or certified the server by hand, when it listens on one interface
+  // only, or with --no-name.
+  let certExpiresAt = 0;
+  let namedHost = "";
+  const namedSession = readSession();
+  if (
+    !options.noName && !options.publicUrl && !options.tlsCert &&
+    (options.host === "0.0.0.0" || options.host === "::") && namedSession?.token
+  ) {
+    const say = (line: string): void => console.log(`  ${line}`);
+    const named = await claimName(namedSession.site, namedSession.token, labelFor(options.name, hostname()), say);
+    if (named) {
+      namedHost = named.host;
+      // The certificate is the handle's, so the cache is keyed by the handle's
+      // wildcard rather than by this machine's label.
+      const wildcard = `*.${named.host.split(".").slice(1).join(".")}`;
+      let files = readCertFiles(stateDir(), wildcard);
+      if (!files) {
+        const got = await fetchCert(namedSession.site, namedSession.token, {}, say);
+        if (got) {
+          writeCertFiles(stateDir(), got);
+          files = { cert: got.cert, key: got.key, expiresAt: got.expiresAt };
+        }
+      }
+      if (files) {
+        tls = { cert: files.cert, key: files.key };
+        certExpiresAt = files.expiresAt;
+      }
+      options.publicUrl = `${tls ? "https" : "http"}://${named.host}:${options.port}`;
+      console.log(`  This server is ${named.host}${tls ? "" : " -- no certificate yet, so http for now"}.`);
+    }
+  }
+
   // Filled in below, when the RTMP listeners are opened. Read through a
   // function so the handler sees the list rather than the empty array it was
   // built with.
@@ -3595,6 +4010,7 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     owner,
     channels,
     rememberChannels: remembering,
+    catalogs,
     publishUrls: () => publishUrls,
     serverName: options.name || hostname(),
     homeSource: root,
@@ -3652,6 +4068,10 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     ...(directory ? { directory } : {}),
     ...(follows ? { follows, vapidPublicKey } : {}),
     ...(favorites ? { favorites } : {}),
+    ...(names ? { names } : {}),
+    ...(certs ? { certs } : {}),
+    dnsZone: zoneName,
+    ...(throttle ? { throttle } : {}),
     ...(partyLine ? { partyLine } : {}),
     // Accounts live where the directory lives, and only there: a nixamp on a
     // laptop has nobody to be an account of.
@@ -3704,6 +4124,23 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
   const bound = server.address();
   const port = typeof bound === "object" && bound !== null ? bound.port : options.port;
 
+  // A named server keeps its certificate fresh without a restart: once a day
+  // it asks for the handle's certificate again and, when a newer one has been
+  // issued, swaps it into the running listener.
+  if (namedHost && namedSession?.token) {
+    const renew = setInterval(() => {
+      void fetchCert(namedSession.site, namedSession.token, { waitMs: 0 }, () => undefined).then((got) => {
+        if (!got || got.expiresAt <= certExpiresAt) return;
+        writeCertFiles(stateDir(), got);
+        certExpiresAt = got.expiresAt;
+        const secure = server as unknown as { setSecureContext?: (context: { cert: string; key: string }) => void };
+        secure.setSecureContext?.({ cert: got.cert, key: got.key });
+        console.log(`  Renewed the certificate for ${namedHost}.`);
+      });
+    }, 24 * 60 * 60 * 1000);
+    renew.unref();
+  }
+
   const io = {
     read: readIfPossible,
     run: (command: string, args: string[]) => {
@@ -3922,6 +4359,10 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
         name: options.name || hostname(),
         url: listen,
         audio,
+        // The control link, for the owner to open this machine as its
+        // administrator from the directory. The directory shows it to the
+        // owning account and strips it for everyone else.
+        ...(key ? { admin: shareLink(publishable_.url, key) } : {}),
         // Asked at every heartbeat rather than once, because the library is
         // read after the port opens and is still arriving when this is made.
         tracks: () => engine.snapshot(false).trackCount,