nixamp 0.7.6 → 0.7.8

package/dist/admin.js

@@ -21,7 +21,15 @@ export function resolveTarget(argv) {
     }
     const state = readState();
     if (state === null) {
-        throw new Error("nixamp: no daemon is running. Start one with `nixamp daemon start`, or pass --url.");
+        // Named, with an example. "or pass --url" is only an instruction if you
+        // already know what belongs after it, and the whole point of this message
+        // is that you are looking at a machine you have no handle on.
+        throw new Error("nixamp: no daemon is running on this machine.\n" +
+            "  Start one:        nixamp daemon start ~/Music\n" +
+            "  Or administer another machine, with its share link:\n" +
+            "                    nixamp admin --url https://server1.you.nixamp.com:4321 --key KEY\n" +
+            "  The URL and key are the two halves of the link that server printed:\n" +
+            "  https://host:4321/s/KEY");
     }
     const url_ = daemonUrl(state);
     // Talking to our own daemon, whose certificate names somewhere else. Nothing

package/dist/main.js

@@ -621,7 +621,11 @@ export function view({ ui, theme, height }, state) {
 }
 if (import.meta.main) {
     main().catch((error) => {
-        console.error(error);
+        // The same rule the installed launcher uses: a message we wrote is one the
+        // reader can act on, and printing a stack over it buries the sentence that
+        // says what to do.
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(message.startsWith("nixamp:") ? message : error);
         process.exit(1);
     });
 }

package/dist/owner.js

@@ -85,7 +85,17 @@ export const ADMIN_PATHS = [
     "/api/ingest",
     "/api/admin",
 ];
+/**
+ * Going live and coming back off, which is administering a server.
+ *
+ * Listed separately from ADMIN_PATHS on purpose: those match by prefix, and
+ * `/api/live` itself is the public listen address -- the one the phone line is
+ * handed. Gating it by prefix would shut the front door to lock the office.
+ */
+const LIVE_CONTROL = ["/api/live/state", "/api/live/start", "/api/live/stop"];
 export function needsAdmin(path, method = "GET") {
+    if (LIVE_CONTROL.includes(path))
+        return true;
     if (ADMIN_PATHS.some((prefix) => path === prefix || path.startsWith(`${prefix}/`)))
         return true;
     // Publishing to a channel, or ending one, is administering the server.

package/dist/server.d.ts

@@ -160,6 +160,8 @@ export interface Engine {
      * this server somewhere else", which throws the library away on purpose.
      */
     replace(tracks: Track[], root: string): void;
+    /** The library, arriving after the server was already listening. */
+    fill(tracks: Track[], root: string): void;
     /**
      * Play something as well as everything here.
      *
@@ -270,6 +272,21 @@ export declare class PlayerEngine implements Engine {
      */
     drop(group: string): number;
     groups(): string[];
+    /**
+     * The library, arriving after the server was already listening.
+     *
+     * Walking a directory is the slow part of starting -- eighty thousand files
+     * under a home directory takes far longer than the fifteen seconds
+     * `nixamp daemon start` waits for the server to say it is up, so starting a
+     * daemon with no source given looked exactly like hanging and then failed
+     * about a server that was working. The port opens first now and this puts
+     * the library in behind it.
+     *
+     * Unlike `replace` it stops nothing and clears no listeners: whoever
+     * connected in the first second is still connected, and simply sees the
+     * playlist appear.
+     */
+    fill(tracks: Loaded[], root: string): void;
     retag(tracks: Track[], root: string): void;
 }
 /** An engine with no library behind it, for the hosted PWA. */
@@ -281,6 +298,7 @@ export declare class EmptyEngine implements Engine {
     subscribe(listener: (snapshot: Snapshot) => void): () => void;
     trackPath(): undefined;
     replace(): void;
+    fill(): void;
     add(): number;
     drop(): number;
     groups(): string[];
@@ -339,6 +357,43 @@ export interface HandlerOptions {
         destinations: Destination[];
         settings: EncoderSettings;
     };
+    /**
+     * Going live: whether this server is listed, and how to change that.
+     *
+     * Listing used to be a question asked once at startup and never again, so a
+     * server started with --no-publish had no listing, no phone code, and no
+     * link to hand anybody -- and no way to change its mind short of stopping
+     * and starting it. It is an action now, because that is what it is.
+     */
+    live?: {
+        status: () => {
+            live: boolean;
+            code: string;
+            name: string;
+            url: string;
+            possible: boolean;
+        };
+        start: () => Promise<{
+            live: boolean;
+            code: string;
+            name: string;
+            url: string;
+            error?: string;
+        }>;
+        stop: () => Promise<void>;
+    };
+    /**
+     * Where OBS should point, one entry per stream this server will accept.
+     *
+     * There is deliberately no single link. ffmpeg's RTMP listener serves one
+     * connection per process, so three people going live at once is three ports
+     * and three URLs -- and a panel offering one address for all of them would
+     * be offering an address that works exactly once.
+     */
+    publishUrls?: () => {
+        id: string;
+        url: string;
+    }[];
     /** Accounts, on the instance that keeps them. Only nixamp.com passes this. */
     accounts?: Accounts;
     /** Providers to sign in with, and the terminals waiting to be connected. */

package/dist/server.js

@@ -41,7 +41,7 @@ import { confirm, DEFAULT_DIRECTORY, Publisher } from "./publish.js";
 import { applyRemoteConfig, createPaywall, FREE_LISTENERS, paywallFromEnv, } from "./paywall.js";
 import { isRemote, playsInBrowser, sourceLabel } from "./sources.js";
 import { codecsOf, videoArgs } from "./audio.js";
-import { allowedForListening, elevate, firewallInUse, keyCookie, keyFrom, lookupPublicIp, newKey, portCommands, reachableAddresses, scopeOf, shareLink, audioLink, } from "./share.js";
+import { allowedForListening, elevate, firewallInUse, certifiable, keyCookie, keyFrom, lookupPublicIp, newKey, portCommands, reachableAddresses, scopeOf, shareLink, audioLink, } from "./share.js";
 import { extname, join, normalize, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { detectTools, peaks, RATE, Stream, toMono, } from "./audio.js";
@@ -584,6 +584,30 @@ export class PlayerEngine {
         }
         return seen;
     }
+    /**
+     * The library, arriving after the server was already listening.
+     *
+     * Walking a directory is the slow part of starting -- eighty thousand files
+     * under a home directory takes far longer than the fifteen seconds
+     * `nixamp daemon start` waits for the server to say it is up, so starting a
+     * daemon with no source given looked exactly like hanging and then failed
+     * about a server that was working. The port opens first now and this puts
+     * the library in behind it.
+     *
+     * Unlike `replace` it stops nothing and clears no listeners: whoever
+     * connected in the first second is still connected, and simply sees the
+     * playlist appear.
+     */
+    fill(tracks, root) {
+        // Something is already loaded, so this is a scan that finished after
+        // somebody pointed the server elsewhere. Theirs wins.
+        if (this.tracks.length > 0)
+            return;
+        this.tracks = tracks;
+        this.root = root;
+        this.state.note = tracks.length === 0 ? `No audio files under ${root}.` : "";
+        this.push(true);
+    }
     retag(tracks, root) {
         // Matched by path rather than by position, because the list is no longer
         // required to be the one that was sent for tagging: somebody can add an
@@ -630,6 +654,7 @@ export class EmptyEngine {
         return undefined;
     }
     replace() { }
+    fill() { }
     add() {
         return 0;
     }
@@ -1789,12 +1814,44 @@ export function createHandler(engine, options) {
         }
         // Everything the admin view draws, in one request: who is connected, and
         // what this server is.
+        // Going live, and coming back off. Admin-gated by ADMIN_PATHS, because
+        // listing somebody's machine in a public directory is not a thing a
+        // listener gets to do.
+        if (path === "/api/live/state") {
+            if (!options.live) {
+                json(response, 200, { live: false, possible: false, code: "", name: "", url: "" });
+                return;
+            }
+            json(response, 200, options.live.status());
+            return;
+        }
+        if (path === "/api/live/start" || path === "/api/live/stop") {
+            if (request.method !== "POST") {
+                json(response, 405, { error: "POST only" });
+                return;
+            }
+            if (!options.live) {
+                json(response, 409, { error: "this nixamp cannot be listed; it has no address the world can reach" });
+                return;
+            }
+            if (path === "/api/live/stop") {
+                await options.live.stop();
+                json(response, 200, options.live.status());
+                return;
+            }
+            const started = await options.live.start();
+            json(response, started.error ? 502 : 200, started);
+            return;
+        }
         if (path === "/api/connections") {
             json(response, 200, {
                 connections: tracker.list(),
                 active: tracker.active,
                 startedAt: started,
                 now: Date.now(),
+                // Where to point OBS. Printed at startup since RTMP was added, which
+                // is no use at all to somebody looking at the admin panel a day later.
+                publish: options.publishUrls?.() ?? [],
             });
             return;
         }
@@ -2341,10 +2398,9 @@ export async function serve(argv, version = "0.1.0") {
     //
     // So the filenames are enough to start: the server is up and answering in the
     // time it takes to walk the directory, and the titles fill in behind it.
-    const tracks = await loadSource(tools, root, false);
-    const engine = tracks.length > 0
-        ? new PlayerEngine(tracks, root, tools)
-        : new EmptyEngine(`No audio files under ${root}.`);
+    // Empty on purpose. The walk happens below, once the port is open: it is
+    // the slowest part of starting and nothing about it needs to happen first.
+    const engine = new PlayerEngine([], root, tools);
     const web = options.web !== null ? resolve(options.web) : defaultWebDir();
     const key = options.key ? newKey() : null;
     // Minted whether or not it is published, so `nixamp admin` and the operator
@@ -2543,11 +2599,59 @@ export async function serve(argv, version = "0.1.0") {
             }
         })()
         : undefined;
+    // Filled in below, when the RTMP listeners are opened. Read through a
+    // function so the handler sees the list rather than the empty array it was
+    // built with.
+    let publishUrls = [];
+    // Declared up here, not beside the publishing below: the port opens before
+    // that code runs, so an admin asking to go live in the first moments would
+    // otherwise reach a binding that has not been initialised.
+    let publisher = null;
+    let listing = null;
+    let publishable_;
     const server = createServer(engine, {
         web,
         media: options.media,
         owner,
         channels,
+        publishUrls: () => publishUrls,
+        live: {
+            status: () => ({
+                live: publisher !== null,
+                code: listing?.code ?? "",
+                name: listing?.name ?? (options.name || hostname()),
+                url: listing?.url ?? (publishable_ ? shareLink(publishable_.url, listenKey) : ""),
+                // Whether going live is even possible here. A laptop behind a router
+                // with no address the world can reach cannot be listed, and a button
+                // that could only fail is worse than one that is not offered.
+                possible: publishable_ !== undefined,
+            }),
+            start: async () => {
+                if (publisher === null)
+                    publisher = makePublisher();
+                if (publisher === null) {
+                    return { live: false, code: "", name: "", url: "", error: "this machine has no address the world can reach" };
+                }
+                const first = await publisher.start();
+                if (first === null) {
+                    // Nothing was listed, so nothing should claim to be: a publisher
+                    // left running here would heartbeat at a directory that refused it.
+                    await publisher.stop();
+                    publisher = null;
+                    return {
+                        live: false, code: "", name: "", url: "",
+                        error: `${DEFAULT_DIRECTORY} would not list this stream. Run \`nixamp login\` on that machine.`,
+                    };
+                }
+                listing = first;
+                return { live: true, code: first.code, name: first.name, url: first.url };
+            },
+            stop: async () => {
+                await publisher?.stop();
+                publisher = null;
+                listing = null;
+            },
+        },
         ...(ingest ? { ingest } : {}),
         broadcaster,
         broadcast: () => ({ destinations, settings: DEFAULT_ENCODER }),
@@ -2651,19 +2755,30 @@ export async function serve(argv, version = "0.1.0") {
             guessedPublic: guessedPublic !== "",
         }));
     }
-    // The other half of "names now, tags later". It runs while the banner is
-    // printed and while the publish prompt waits, and it is deliberately not
-    // awaited: nothing downstream needs it, and a library that takes a minute to
-    // read should cost nobody a minute of silence.
-    if (tracks.length > 0 && !isRemote(root)) {
-        void loadTagged(tools, root)
+    // Names now, tags later, and both after the door is open. Not awaited:
+    // nothing below needs the library, and a directory that takes a minute to
+    // walk should cost nobody a minute of not being able to connect.
+    void loadSource(tools, root, false)
+        .then((found) => {
+        engine.fill(found, root);
+        if (found.length === 0) {
+            console.log(`nixamp serve — no audio files under ${root}`);
+            return;
+        }
+        console.log(`nixamp serve — ${found.length} tracks under ${root}`);
+        if (isRemote(root))
+            return;
+        return loadTagged(tools, root)
             .then((tagged) => engine.retag(tagged, root))
             .catch(() => {
-            // Filenames are a working player. A failure here is worth nothing but
-            // titles that stay as they are.
+            // Filenames are a working player. A failure here is worth nothing
+            // but titles that stay as they are.
         });
-    }
-    console.log(`nixamp serve — ${tracks.length} tracks under ${root}`);
+    })
+        .catch((error) => {
+        console.log(`nixamp: could not read ${root}: ${error.message}`);
+    });
+    console.log(`nixamp serve — reading ${root}`);
     console.log("");
     const width = Math.max(...addresses.map((a) => a.label.length));
     for (const { label, url } of addresses) {
@@ -2716,9 +2831,13 @@ export async function serve(argv, version = "0.1.0") {
         }));
         rtmp = new RtmpListeners(channels, tools.ffmpeg, listenKey ?? "live");
         rtmp.listen(slots);
+        publishUrls = slots.map((slot) => ({
+            id: slot.id,
+            url: `rtmp://${host}:${slot.port}/live/${listenKey ?? "live"}`,
+        }));
         console.log("  Or publish from OBS, Larix or ffmpeg, one per URL:");
-        for (const slot of slots) {
-            console.log(`    rtmp://${host}:${slot.port}/live/${listenKey ?? "live"}   -> "${slot.id}"`);
+        for (const entry of publishUrls) {
+            console.log(`    ${entry.url}   -> "${entry.id}"`);
         }
     }
     if (destinations.length > 0) {
@@ -2764,49 +2883,67 @@ export async function serve(argv, version = "0.1.0") {
     }
     // The listing carries the listen link, and only ever a public address: an
     // entry pointing at 192.168.1.5 is one nobody outside that house can open.
-    const publishable_ = addresses.find((a) => a.label === "on the internet")
+    // Never a bare IP over https: a certificate is issued for a name, so a
+    // listing pointing at one is a listing nobody can open.
+    publishable_ = addresses.find((a) => a.label === "on the internet" && certifiable(a.url))
+        ?? addresses.find((a) => a.label === "on tailscale" && certifiable(a.url))
+        ?? addresses.find((a) => a.label === "on the internet")
         ?? addresses.find((a) => a.label === "on tailscale");
-    let publisher = null;
-    if (options.publish !== "no" && publishable_) {
+    /**
+     * Make a publisher for this server. Called at startup when the operator says
+     * yes, and again whenever somebody goes live from the admin panel.
+     *
+     * A declaration rather than an assignment, so it exists from the moment the
+     * function is entered -- the port is open well before this line is reached.
+     */
+    function makePublisher() {
+        if (!publishable_)
+            return null;
         const listen = shareLink(publishable_.url, listenKey);
         // Announced next to the listen link, not instead of it: one is for a person
         // with a browser, the other for the phone line and anything else that is
         // handed one address and expected to play it.
         const audio = audioLink(publishable_.url, listenKey);
+        return new Publisher({
+            directory: DEFAULT_DIRECTORY,
+            name: options.name || hostname(),
+            url: listen,
+            audio,
+            // Asked of the engine rather than a variable, because the library is
+            // now read after the port opens and may still be arriving.
+            tracks: engine.snapshot(false).trackCount,
+            // From `nixamp login`. The directory will not list a stream it cannot
+            // attribute to somebody, because a listing is now a phone code that
+            // costs money to answer.
+            ...(session?.token ? { token: session.token } : {}),
+            onRefused: () => {
+                console.log("");
+                console.log("  nixamp.com would not list this stream: it needs an account.");
+                console.log("  Run `nixamp login` (or `nixamp signup`) and start again.");
+            },
+            nowPlaying: () => {
+                const snapshot = engine.snapshot();
+                return snapshot.tracks?.[snapshot.index]?.title ?? "";
+            },
+            onConfig: (remote) => {
+                const next = applyRemoteConfig(paywallConfig, remote?.x402);
+                if (JSON.stringify(next) === JSON.stringify(paywallConfig))
+                    return;
+                paywallConfig = next;
+                console.log(next.enabled
+                    ? `  nixamp.com turned paid listening on: $${(next.priceCents / 100).toFixed(2)} for ${next.passMinutes} minutes, over ${FREE_LISTENERS} listeners.`
+                    : "  nixamp.com turned paid listening off.");
+            },
+        });
+    }
+    if (options.publish !== "no" && publishable_) {
+        const listen = shareLink(publishable_.url, listenKey);
         const wanted = options.publish === "yes"
             ? true
             : await confirm(`\n  List this stream at ${DEFAULT_DIRECTORY}/directory so anyone can find it?\n  It publishes ${listen} — listen only, not the controls.`);
         if (wanted) {
-            publisher = new Publisher({
-                directory: DEFAULT_DIRECTORY,
-                name: options.name || hostname(),
-                url: listen,
-                audio,
-                tracks: tracks.length,
-                // From `nixamp login`. The directory will not list a stream it cannot
-                // attribute to somebody, because a listing is now a phone code that
-                // costs money to answer.
-                ...(session?.token ? { token: session.token } : {}),
-                onRefused: () => {
-                    console.log("");
-                    console.log("  nixamp.com would not list this stream: it needs an account.");
-                    console.log("  Run `nixamp login` (or `nixamp signup`) and start again.");
-                },
-                nowPlaying: () => {
-                    const snapshot = engine.snapshot();
-                    return snapshot.tracks?.[snapshot.index]?.title ?? "";
-                },
-                onConfig: (remote) => {
-                    const next = applyRemoteConfig(paywallConfig, remote?.x402);
-                    if (JSON.stringify(next) === JSON.stringify(paywallConfig))
-                        return;
-                    paywallConfig = next;
-                    console.log(next.enabled
-                        ? `  nixamp.com turned paid listening on: $${(next.priceCents / 100).toFixed(2)} for ${next.passMinutes} minutes, over ${FREE_LISTENERS} listeners.`
-                        : "  nixamp.com turned paid listening off.");
-                },
-            });
-            const listing = await publisher.start();
+            publisher = makePublisher();
+            listing = (await publisher?.start()) ?? null;
             console.log("");
             console.log(listing
                 ? `  Listed at ${DEFAULT_DIRECTORY}/directory as "${listing.name}". It leaves the list when this stops.`

package/dist/session.js

@@ -512,7 +512,9 @@ export async function servers(argv, fetcher = fetch) {
                 const daemon = await import("./daemon.js");
                 const state = daemon.readState();
                 if (state === null) {
-                    console.error("nixamp: no daemon is running here. Start one, or pass a URL.");
+                    console.error("nixamp: no daemon is running here.\n" +
+                        "  Start one:  nixamp daemon start ~/Music\n" +
+                        "  Or give the share link of the one you mean: https://host:4321/s/KEY");
                     return 1;
                 }
                 // The address worth remembering is the one somebody else can open.

package/dist/share.d.ts

@@ -45,6 +45,16 @@ export declare function lookupPublicIp(send?: typeof fetch, timeoutMs?: number):
  * somewhere else can open. It is labelled for what it is, because the key in
  * the link is then the only thing between a stranger and the library.
  */
+/**
+ * Whether a browser could ever verify a certificate for this address.
+ *
+ * A certificate is issued for a name. Handed an https link to a bare IP, a
+ * browser has nothing to match it against and refuses the connection before it
+ * asks anything -- and from the page it looks identical to a machine that is
+ * switched off. Offering such a link is offering one that cannot work, so the
+ * links are labelled and the ones that can work go first.
+ */
+export declare function certifiable(url: string): boolean;
 export declare function reachableAddresses(host: string, port: number, publicUrl?: string, scheme?: "http" | "https"): {
     label: string;
     url: string;

package/dist/share.js

@@ -115,6 +115,25 @@ export async function lookupPublicIp(send = fetch, timeoutMs = 2500) {
  * somewhere else can open. It is labelled for what it is, because the key in
  * the link is then the only thing between a stranger and the library.
  */
+/**
+ * Whether a browser could ever verify a certificate for this address.
+ *
+ * A certificate is issued for a name. Handed an https link to a bare IP, a
+ * browser has nothing to match it against and refuses the connection before it
+ * asks anything -- and from the page it looks identical to a machine that is
+ * switched off. Offering such a link is offering one that cannot work, so the
+ * links are labelled and the ones that can work go first.
+ */
+export function certifiable(url) {
+    if (!url.startsWith("https://"))
+        return true;
+    try {
+        return !isIpAddress(new URL(url).hostname.replace(/^\[|\]$/g, ""));
+    }
+    catch {
+        return true;
+    }
+}
 export function reachableAddresses(host, port, publicUrl = "", scheme = "http") {
     const link = (address) => {
         // A bare IPv6 address needs brackets before it is a URL.
@@ -143,11 +162,22 @@ export function reachableAddresses(host, port, publicUrl = "", scheme = "http")
     }
     const order = { private: 0, cgnat: 1, public: 2 };
     found.sort((x, y) => order[x.kind] - order[y.kind]);
-    return [
+    const all = [
         ...told,
         { label: "here", url: `${scheme}://localhost:${port}` },
         ...found.map(({ label, url }) => ({ label, url })),
     ];
+    // Serving https, an address that is a bare IP cannot be verified by anyone,
+    // so it is said last and said differently rather than handed out as though
+    // it were a link somebody could use.
+    if (scheme !== "https")
+        return all;
+    return [
+        ...all.filter((entry) => certifiable(entry.url)),
+        ...all
+            .filter((entry) => !certifiable(entry.url))
+            .map((entry) => ({ label: `${entry.label} (no certificate for an IP)`, url: entry.url })),
+    ];
 }
 /** The full link, key and all. */
 export function shareLink(base, key) {
@@ -187,6 +217,11 @@ export function allowedForListening(path) {
     // album out of somebody else's playlist.
     if (path === "/api/source" || path.startsWith("/api/source/"))
         return false;
+    // Listing this machine in a public directory is not listening to it. The
+    // listen address itself, /api/live, stays open: that is the thing a listen
+    // key is for.
+    if (path === "/api/live/state" || path === "/api/live/start" || path === "/api/live/stop")
+        return false;
     return true;
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",

package/src/admin.ts

@@ -57,7 +57,17 @@ export function resolveTarget(argv: string[]): AdminOptions {
 
   const state = readState();
   if (state === null) {
-    throw new Error("nixamp: no daemon is running. Start one with `nixamp daemon start`, or pass --url.");
+    // Named, with an example. "or pass --url" is only an instruction if you
+    // already know what belongs after it, and the whole point of this message
+    // is that you are looking at a machine you have no handle on.
+    throw new Error(
+      "nixamp: no daemon is running on this machine.\n" +
+        "  Start one:        nixamp daemon start ~/Music\n" +
+        "  Or administer another machine, with its share link:\n" +
+        "                    nixamp admin --url https://server1.you.nixamp.com:4321 --key KEY\n" +
+        "  The URL and key are the two halves of the link that server printed:\n" +
+        "  https://host:4321/s/KEY",
+    );
   }
   const url_ = daemonUrl(state);
   // Talking to our own daemon, whose certificate names somewhere else. Nothing

package/src/main.ts

@@ -634,7 +634,11 @@ export function view(
 
 if (import.meta.main) {
   main().catch((error) => {
-    console.error(error);
+    // The same rule the installed launcher uses: a message we wrote is one the
+    // reader can act on, and printing a stack over it buries the sentence that
+    // says what to do.
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(message.startsWith("nixamp:") ? message : error);
     process.exit(1);
   });
 }

package/src/owner.ts

@@ -104,7 +104,17 @@ export const ADMIN_PATHS = [
   "/api/admin",
 ];
 
+/**
+ * Going live and coming back off, which is administering a server.
+ *
+ * Listed separately from ADMIN_PATHS on purpose: those match by prefix, and
+ * `/api/live` itself is the public listen address -- the one the phone line is
+ * handed. Gating it by prefix would shut the front door to lock the office.
+ */
+const LIVE_CONTROL = ["/api/live/state", "/api/live/start", "/api/live/stop"];
+
 export function needsAdmin(path: string, method = "GET"): boolean {
+  if (LIVE_CONTROL.includes(path)) return true;
   if (ADMIN_PATHS.some((prefix) => path === prefix || path.startsWith(`${prefix}/`))) return true;
   // Publishing to a channel, or ending one, is administering the server.
   // Listening to a channel is not: that is what the share link is for.