nixamp 0.9.12 → 0.10.1

package/dist/audio.d.ts

@@ -13,6 +13,8 @@ export interface Tools {
     ffprobe: string[];
     /** Argv prefix for the player, or null when nothing can make sound here. */
     play: string[] | null;
+    /** yt-dlp, which turns a pasted page into a media address; null when there is none. */
+    ytdlp?: string[] | null;
 }
 /**
  * Find the tools. A bare `ffmpeg` on PATH is tried first; mise shims are common
@@ -98,7 +100,7 @@ export interface Codecs {
  * answering other requests, and a synchronous probe per media request is how
  * the whole library came to be tagged with the process wedged solid.
  */
-export declare function codecsOf(tools: Tools, path: string): Promise<Codecs>;
+export declare function codecsOf(tools: Tools, path: string, input?: string[]): Promise<Codecs>;
 /**
  * How to get this file into a browser, given what is inside it.
  *

package/dist/audio.js

@@ -12,11 +12,11 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 export const RATE = 44100;
 export const CHANNELS = 2;
-function works(argv) {
+function works(argv, flag = "-version") {
     const [cmd, ...rest] = argv;
     if (!cmd)
         return false;
-    const r = spawnSync(cmd, [...rest, "-version"], { encoding: "utf8", timeout: 10_000 });
+    const r = spawnSync(cmd, [...rest, flag], { encoding: "utf8", timeout: 10_000 });
     return !r.error && r.status === 0;
 }
 /**
@@ -73,10 +73,16 @@ export function detectTools() {
     const ffmpeg = pick("ffmpeg");
     const ffprobe = pick("ffprobe");
     const play = pick("ffplay");
+    // yt-dlp is not an ffmpeg, so mise's ffmpeg tree is not where it lives;
+    // the installer puts it beside nixamp, and pip puts it in ~/.local/bin too.
+    // Asked with its own spelling: ffmpeg answers -version, yt-dlp only --version.
+    const ytdlp = [["yt-dlp"], [join(homedir(), ".local", "bin", "yt-dlp")], ["/usr/local/bin/yt-dlp"], ["/usr/bin/yt-dlp"], ["/opt/homebrew/bin/yt-dlp"]]
+        .find((argv) => works(argv, "--version")) ?? null;
     return {
         ffmpeg: ffmpeg ?? ["ffmpeg"],
         ffprobe: ffprobe ?? ["ffprobe"],
         play,
+        ytdlp,
     };
 }
 export function probe(tools, path) {
@@ -341,7 +347,7 @@ function readTags(stdout, fallback) {
  * answering other requests, and a synchronous probe per media request is how
  * the whole library came to be tagged with the process wedged solid.
  */
-export async function codecsOf(tools, path) {
+export async function codecsOf(tools, path, input = []) {
     const [cmd, ...rest] = tools.ffprobe;
     const empty = { video: "", audio: "", container: "" };
     if (!cmd)
@@ -352,6 +358,8 @@ export async function codecsOf(tools, path) {
             "-v", "quiet",
             "-print_format", "json",
             "-show_entries", "format=format_name:stream=codec_type,codec_name",
+            // Headers the source's site expects, for a link resolved by yt-dlp.
+            ...input,
             path,
         ], { stdio: ["ignore", "pipe", "ignore"] });
         let out = "";

package/dist/channels.d.ts

@@ -116,7 +116,7 @@ export declare class Channel {
      * because you looked away, and a room where the picture depends on who is
      * in it is not a room anybody can be invited to.
      */
-    pull(source: string, encode: string[], paced?: boolean, stall?: number): void;
+    pull(source: string, encode: string[], paced?: boolean, stall?: number, input?: string[]): void;
     /**
      * Start the source over, now.
      *
@@ -209,7 +209,7 @@ export declare class Channels {
      * about it is the same too, which is the point -- a re-stream stops being a
      * special case and becomes one more thing that is on.
      */
-    pull(id: string, name: string, source: string, encode: string[], kind: "audio" | "video", paced?: boolean, stall?: number): Channel | null;
+    pull(id: string, name: string, source: string, encode: string[], kind: "audio" | "video", paced?: boolean, stall?: number, input?: string[]): Channel | null;
     /**
      * Dial a pulled channel's source again, now. False for a channel that is
      * not there or is not ours to dial: a publisher's stream restarts at the

package/dist/channels.js

@@ -168,7 +168,7 @@ export class Channel {
      * because you looked away, and a room where the picture depends on who is
      * in it is not a room anybody can be invited to.
      */
-    pull(source, encode, paced = true, stall = STALL) {
+    pull(source, encode, paced = true, stall = STALL, input = []) {
         this.stall = stall;
         if (this.info.kind === "video")
             this.fragments = new Fragments();
@@ -195,6 +195,10 @@ export class Channel {
                 // hour of film in ninety seconds and a room that cannot be in it
                 // together; a live source is already paced and loses nothing.
                 ...(paced ? ["-re"] : []),
+                // What the source's site expects on the request: a user agent, a
+                // referer, a cookie. A link resolved by yt-dlp comes with these,
+                // and a CDN that got them from yt-dlp and not from us answers 403.
+                ...input,
                 "-i", source,
                 ...encode,
                 "pipe:1",
@@ -556,7 +560,7 @@ export class Channels {
      * about it is the same too, which is the point -- a re-stream stops being a
      * special case and becomes one more thing that is on.
      */
-    pull(id, name, source, encode, kind, paced = true, stall = STALL) {
+    pull(id, name, source, encode, kind, paced = true, stall = STALL, input = []) {
         if (this.open.has(id))
             return null;
         const channel = new Channel({
@@ -571,7 +575,7 @@ export class Channels {
             source,
         }, this.options, (gone) => this.open.delete(gone));
         this.open.set(id, channel);
-        channel.pull(source, encode, paced, stall);
+        channel.pull(source, encode, paced, stall, input);
         return channel;
     }
     /**

package/dist/directory.d.ts

@@ -69,6 +69,12 @@ export interface Listing {
     playing: boolean;
     /** The live channels on it, by name: what a visitor could actually watch. */
     channels: string[];
+    /**
+     * A phone code for each of those channels, by name: its own room, so the
+     * people calling about one live are not put in with the people calling
+     * about another on the same server.
+     */
+    channelCodes: Record<string, string>;
     /** Set by the directory from the request, never by the publisher. */
     updatedAt: number;
     /** When this stream first announced itself: the "started at" a caller hears. */
@@ -143,6 +149,8 @@ export declare class Directory {
      */
     private readonly onLive;
     private readonly items;
+    /** Every code a channel has had on each listing, so a returning channel keeps its own. */
+    private readonly channelHistory;
     /** Streams that stopped, so the phone line can say when. */
     private readonly ended;
     private sequence;
@@ -181,8 +189,30 @@ export declare class Directory {
     announce(announcement: Announcement, ownerId?: string): Listing;
     withdraw(id: string): void;
     list(): Listing[];
-    /** The live stream on this code, if there is one. */
+    /**
+     * The live stream on this code, if there is one.
+     *
+     * A channel's code answers as the channel: the same listing, named for the
+     * channel and playing nothing else, so the phone line says "the live room
+     * for FIBA World Cup" rather than the server's name and whatever its own
+     * player has on.
+     */
     liveByCode(code: string): Listing | undefined;
+    /**
+     * A code for each channel, kept while the channel stays on.
+     *
+     * One code per server meant every live on it shared a room: somebody
+     * calling about the basketball landed with the people talking about the
+     * film. Each live is its own room now, and a channel that is still there at
+     * the next heartbeat keeps the code it was given.
+     */
+    private codesFor;
+    /**
+     * Whether a code is somebody's already: a stream's own, a channel's on any
+     * stream, or a recently-ended stream's. A listing renewing itself is not
+     * "somebody else", or its channels would be re-coded every heartbeat.
+     */
+    private taken;
     /**
      * Streams that stopped recently, most recent first.
      *
@@ -201,7 +231,7 @@ export declare class Directory {
     endedByCode(code: string): Ended | undefined;
     private endedByUrl;
     private remember;
-    /** A code no live and no recently-ended stream is using. */
+    /** A code no live stream, no channel on one, and no recently-ended stream is using. */
     private freeCode;
     /** Forget anything that stopped renewing, keeping a note of when it did. */
     private sweep;

package/dist/directory.js

@@ -104,6 +104,8 @@ export class Directory {
     randomCode;
     onLive;
     items = new Map();
+    /** Every code a channel has had on each listing, so a returning channel keeps its own. */
+    channelHistory = new Map();
     /** Streams that stopped, so the phone line can say when. */
     ended = new Map();
     sequence = 0;
@@ -179,12 +181,19 @@ export class Directory {
             // listing always meant, and no channels is the honest empty list.
             playing: announcement.playing ?? true,
             channels: announcement.channels ?? [],
+            channelCodes: this.codesFor(announcement.channels ?? [], 
+            // What each channel has been called before, on this listing: a
+            // channel that was gone for a heartbeat -- a server restarting puts
+            // its channels back a moment after it announces -- comes back to the
+            // code people were given, not a new one.
+            { ...(this.channelHistory.get(id) ?? {}), ...(existing?.channelCodes ?? {}) }, id),
             updatedAt: this.now(),
             // A stream that never stopped keeps its original start. One that did
             // starts again now, because that is what a caller is being told about.
             startedAt: existing?.startedAt ?? this.now(),
         };
         this.items.set(id, listing);
+        this.channelHistory.set(id, { ...(this.channelHistory.get(id) ?? {}), ...listing.channelCodes });
         // The transition, not the heartbeat: existing means it was already live.
         if (existing === undefined)
             this.onLive(listing);
@@ -195,15 +204,69 @@ export class Directory {
         if (item !== undefined)
             this.remember(item);
         this.items.delete(id);
+        this.channelHistory.delete(id);
     }
     list() {
         this.sweep();
         return [...this.items.values()].sort((a, b) => b.updatedAt - a.updatedAt || a.id.localeCompare(b.id));
     }
-    /** The live stream on this code, if there is one. */
+    /**
+     * The live stream on this code, if there is one.
+     *
+     * A channel's code answers as the channel: the same listing, named for the
+     * channel and playing nothing else, so the phone line says "the live room
+     * for FIBA World Cup" rather than the server's name and whatever its own
+     * player has on.
+     */
     liveByCode(code) {
         this.sweep();
-        return [...this.items.values()].find((item) => item.code === code);
+        const own = [...this.items.values()].find((item) => item.code === code);
+        if (own !== undefined)
+            return own;
+        for (const item of this.items.values()) {
+            const channel = Object.entries(item.channelCodes).find(([, one]) => one === code)?.[0];
+            if (channel !== undefined)
+                return { ...item, code, name: channel, nowPlaying: "" };
+        }
+        return undefined;
+    }
+    /**
+     * A code for each channel, kept while the channel stays on.
+     *
+     * One code per server meant every live on it shared a room: somebody
+     * calling about the basketball landed with the people talking about the
+     * film. Each live is its own room now, and a channel that is still there at
+     * the next heartbeat keeps the code it was given.
+     */
+    codesFor(channels, had, own = "") {
+        const codes = {};
+        for (const name of channels) {
+            if (codes[name] !== undefined)
+                continue;
+            const kept = had?.[name];
+            codes[name] = kept !== undefined && !this.taken(kept, codes, own) ? kept : this.freeCode(codes, own);
+        }
+        return codes;
+    }
+    /**
+     * Whether a code is somebody's already: a stream's own, a channel's on any
+     * stream, or a recently-ended stream's. A listing renewing itself is not
+     * "somebody else", or its channels would be re-coded every heartbeat.
+     */
+    taken(code, besides = {}, own = "") {
+        if (Object.values(besides).includes(code))
+            return true;
+        for (const item of this.items.values()) {
+            if (item.code === code)
+                return true;
+        }
+        // Every code a channel has ever had on a listing that is still up is
+        // that channel's to come back to, on every listing but the one asking.
+        for (const [id, codes] of this.channelHistory) {
+            if (id !== own && Object.values(codes).includes(code))
+                return true;
+        }
+        return [...this.ended.values()].some((i) => i.code === code);
     }
     /**
      * Streams that stopped recently, most recent first.
@@ -263,15 +326,13 @@ export class Directory {
         this.ended.set(item.id, record);
         this.mirror?.save(record);
     }
-    /** A code no live and no recently-ended stream is using. */
-    freeCode() {
+    /** A code no live stream, no channel on one, and no recently-ended stream is using. */
+    freeCode(besides = {}, own = "") {
         for (let tries = 0; tries < 40; tries += 1) {
             const code = this.randomCode();
             if (code.length !== 6)
                 continue;
-            const taken = [...this.items.values()].some((i) => i.code === code) ||
-                [...this.ended.values()].some((i) => i.code === code);
-            if (!taken)
+            if (!this.taken(code, besides, own))
                 return code;
         }
         return "";
@@ -283,6 +344,7 @@ export class Directory {
             if (item.updatedAt < cutoff) {
                 this.remember(item);
                 this.items.delete(id);
+                this.channelHistory.delete(id);
             }
         }
         const forget = this.now() - ENDED_TTL_MS;

package/dist/links.d.ts

@@ -0,0 +1,62 @@
+export interface ResolvedLink {
+    /** What to call it: the page's title, or the file's name for a bare file. */
+    title: string;
+    /** Where the bytes are: what ffmpeg is pointed at. */
+    media: string;
+    /** Whether it is on now, which decides pacing and whether it can be saved. */
+    live: boolean;
+    /** Seconds, when known. */
+    duration: number;
+    /** Whether there is a picture. Unknown reads as yes; ffprobe settles it. */
+    video: boolean;
+    /** Headers the site expects on the media request, if any. */
+    headers: Record<string, string>;
+    /** Which site, as yt-dlp names it -- "soundcloud", "youtube", "generic". */
+    extractor: string;
+    /** The file type yt-dlp would save, for naming a download. */
+    ext: string;
+    /** The page it came from. */
+    page: string;
+}
+export declare function isDirectMedia(url: string): boolean;
+/** A link somebody pasted, or "" when it is not one this can play. */
+export declare function playableLink(entered: unknown): string;
+/** A channel id for a link: stable, so two people pasting the same link share one decoder. */
+export declare function linkChannelId(url: string): string;
+/** The format a download would pick, so it can be named before it is fetched. */
+export declare function saveFormat(audioOnly: boolean): string;
+/** How yt-dlp is asked where a link's media is, for playing or for the format a download would take. */
+export declare function resolveArgs(url: string, cookies?: string, format?: string): string[];
+/** How yt-dlp is asked to hand over the whole thing, down a pipe. */
+export declare function downloadArgs(url: string, audioOnly: boolean, cookies?: string): string[];
+/** yt-dlp's answer, read into what the player needs. Null when it is not an answer. */
+export declare function parseResolved(json: unknown, page: string): ResolvedLink | null;
+/** A bare file link, described without asking anybody. */
+export declare function directLink(url: string): ResolvedLink;
+/**
+ * ffmpeg's input options for a site that wants headers on the media request.
+ *
+ * yt-dlp's answer came with the headers it would have sent; ffmpeg has to
+ * send the same ones or the CDN answers 403 to a request that worked a
+ * second ago. The user agent has its own flag; the rest go as one block.
+ */
+export declare function inputArgsFor(headers: Record<string, string>): string[];
+/** A file name for a download: the title, made safe, with the right ending. */
+export declare function fileNameFor(link: ResolvedLink, audioOnly: boolean): string;
+/** What a browser should call the bytes, from the file name's ending. */
+export declare function contentTypeFor(fileName: string): string;
+/** The one line of yt-dlp's complaint worth repeating to a person. */
+export declare function reasonFrom(stderr: string): string;
+/** How long resolving may take before it is a link that is not going to answer. */
+export declare const RESOLVE_TIMEOUT_MS = 60000;
+/**
+ * Where a link's media is, by asking yt-dlp. A bare file is answered without
+ * asking. An error is a sentence for the person who pasted it.
+ */
+export declare function resolveLink(ytdlp: string[] | null, url: string, options?: {
+    cookies?: string;
+    timeoutMs?: number;
+    format?: string;
+}): Promise<ResolvedLink | {
+    error: string;
+}>;

package/dist/server.d.ts

@@ -368,7 +368,15 @@ export declare const MAX_ON_DEMAND = 4;
  * ones back, so that both agree on what a source is encoded as. Null when
  * that channel id is already on.
  */
-export declare function pullChannel(channels: Channels, ffprobe: string[], id: string, name: string, source: string): Promise<Channel | null>;
+export declare function pullChannel(channels: Channels, ffprobe: string[], id: string, name: string, source: string, input?: string[]): Promise<Channel | null>;
+/**
+ * A Netscape cookies file beside the state, if the operator has put one there.
+ *
+ * YouTube and Vimeo refuse a datacenter without a signed-in cookie; the
+ * person who runs the server can export one from their browser and drop it
+ * at ~/.local/state/nixamp/cookies.txt, and every link is asked for with it.
+ */
+export declare function cookiesFile(): string;
 export declare function liveOnes(engine: Engine): {
     name: string;
     at: number;
@@ -412,6 +420,10 @@ export interface HandlerOptions {
     ffmpeg?: string[];
     /** Where ffprobe is, for asking what is inside a file before re-encoding it. */
     ffprobe?: string[];
+    /** yt-dlp, which turns a pasted page into a media address. Null when there is none. */
+    ytdlp?: string[] | null;
+    /** A Netscape cookies file for sites that want a signed-in browser, when there is one. */
+    cookies?: string;
     /** Who is listening, for the admin view. */
     connections?: Connections;
     /**
@@ -476,6 +488,8 @@ export interface HandlerOptions {
             name: string;
             url: string;
             possible: boolean;
+            /** A phone code per live channel, by name, as the directory assigned them. */
+            channelCodes?: Record<string, string>;
         };
         start: () => Promise<{
             live: boolean;

package/dist/server.js

@@ -34,6 +34,7 @@ import { stateDir } from "./daemon.js";
 import { readSession } from "./session.js";
 import { Directory, ENDED_TTL_MS, parseAnnouncement } from "./directory.js";
 import { PartyLine, telnyxSms } from "./partyline.js";
+import { contentTypeFor, downloadArgs, fileNameFor, inputArgsFor, linkChannelId, playableLink, resolveLink, saveFormat, } from "./links.js";
 import { CALL_IN_NUMBER, OPT_IN_PATH, optInPage } from "./optin.js";
 import pg from "pg";
 import { Follows, phoneFrom } from "./follows.js";
@@ -766,15 +767,47 @@ export const MAX_ON_DEMAND = 4;
  * ones back, so that both agree on what a source is encoded as. Null when
  * that channel id is already on.
  */
-export async function pullChannel(channels, ffprobe, id, name, source) {
-    const codecs = await codecsOf({ ffmpeg: [], ffprobe, play: null }, source);
+export async function pullChannel(channels, ffprobe, id, name, source, input = []) {
+    const codecs = await codecsOf({ ffmpeg: [], ffprobe, play: null }, source, input);
     const kind = codecs.video === "" ? "audio" : "video";
     const encode = kind === "video"
         ? videoArgs(codecs)
         // No picture in it, so none is invented: MP3 is the thing every browser
         // plays and the thing a listener can join halfway through.
         : ["-vn", "-c:a", "libmp3lame", "-b:a", "192k", "-f", "mp3"];
-    return channels.pull(id, name, source, encode, kind);
+    return channels.pull(id, name, source, encode, kind, true, undefined, input);
+}
+/** What a link resolves to, kept so a download can be named without asking twice. */
+const links = new Map();
+/**
+ * A Netscape cookies file beside the state, if the operator has put one there.
+ *
+ * YouTube and Vimeo refuse a datacenter without a signed-in cookie; the
+ * person who runs the server can export one from their browser and drop it
+ * at ~/.local/state/nixamp/cookies.txt, and every link is asked for with it.
+ */
+export function cookiesFile() {
+    const path = join(stateDir(), "cookies.txt");
+    try {
+        return statSync(path).isFile() ? path : "";
+    }
+    catch {
+        return "";
+    }
+}
+/** What the page is told about a link it asked to play. */
+function shownLink(channelId, link) {
+    return {
+        kind: "live",
+        channel: channelId,
+        name: link.title,
+        live: link.live,
+        video: link.video,
+        duration: link.duration,
+        extractor: link.extractor,
+        // A live has no whole to keep; a bare file can be fetched by the browser itself.
+        download: !link.live && link.extractor !== "direct",
+    };
 }
 export function liveOnes(engine) {
     const tracks = engine.snapshot().tracks ?? [];
@@ -1925,6 +1958,9 @@ export function createHandler(engine, options) {
                 const streams = options.directory.list().map(({ admin, ...stream }) => ({
                     ...stream,
                     callers: onThePhone ? onThePhone.listenersOn(stream.code) : 0,
+                    // And on the phone for each live on it, by name: every live is its
+                    // own room, so each has its own count.
+                    channelCallers: Object.fromEntries(Object.entries(stream.channelCodes).map(([name, code]) => [name, onThePhone ? onThePhone.listenersOn(code) : 0])),
                     ...(admin && me !== null && stream.ownerId === me.id ? { admin } : {}),
                 }));
                 // Recently ended too, because following exists to hear about
@@ -2089,6 +2125,9 @@ export function createHandler(engine, options) {
                     // Whether it has a picture, so the page puts it in the element
                     // that can show one. Never the source: that is the owner's.
                     kind: one.kind ?? "audio",
+                    // Its own room on the phone line, as the directory assigned it;
+                    // empty until the next heartbeat has told the directory it is on.
+                    code: state?.channelCodes?.[one.name] ?? "",
                     // How it has been going, for whoever may do something about it.
                     redials: one.redials ?? 0,
                     error: one.error ?? "",
@@ -2217,6 +2256,9 @@ export function createHandler(engine, options) {
                         return;
                     }
                     options.channels.ephemeral(channelId);
+                    // Told to the directory now, so the room code arrives with the
+                    // channel rather than at the next heartbeat, ninety seconds on.
+                    void options.live?.announce?.();
                 }
                 json(response, 200, { kind: "live", channel: channelId, name: entry.title });
                 return;
@@ -2267,6 +2309,120 @@ export function createHandler(engine, options) {
             json(response, 404, { error: "no such endpoint" });
             return;
         }
+        // --- any link, played -------------------------------------------------
+        //
+        // Paste a page -- YouTube, a podcast, SoundCloud, a TikTok live -- and the
+        // server works out where the media is and plays it as a channel of its
+        // own, the way a catalog entry is played: started for whoever asked,
+        // stopped a minute after the last viewer leaves. Open to anyone holding
+        // the link, like picking something from a catalog.
+        if (path === "/api/links/play" && request.method === "POST") {
+            let body = {};
+            try {
+                body = JSON.parse(await readBody(request));
+            }
+            catch {
+                json(response, 400, { error: "bad JSON" });
+                return;
+            }
+            const link = playableLink(body.url);
+            if (link === "") {
+                json(response, 400, { error: "that is not a link this can play" });
+                return;
+            }
+            if (!options.channels) {
+                json(response, 503, { error: "this server cannot carry channels" });
+                return;
+            }
+            const channelId = linkChannelId(link);
+            const known = links.get(link);
+            if (options.channels.has(channelId) && known) {
+                json(response, 200, shownLink(channelId, known));
+                return;
+            }
+            if (!options.channels.has(channelId) && options.channels.ephemeralCount >= MAX_ON_DEMAND) {
+                json(response, 429, { error: `this server is already carrying ${MAX_ON_DEMAND} channels on demand; try again in a minute` });
+                return;
+            }
+            const resolved = known ?? await resolveLink(options.ytdlp ?? null, link, { cookies: options.cookies ?? "" });
+            if ("error" in resolved) {
+                json(response, 422, { error: resolved.error });
+                return;
+            }
+            links.set(link, resolved);
+            if (!options.channels.has(channelId)) {
+                const started = await pullChannel(options.channels, options.ffprobe ?? ["ffprobe"], channelId, resolved.title, resolved.media, inputArgsFor(resolved.headers));
+                if (!started) {
+                    json(response, 409, { error: "that link is already starting" });
+                    return;
+                }
+                options.channels.ephemeral(channelId);
+                // Told to the directory now, so the room code arrives with the
+                // channel rather than at the next heartbeat, ninety seconds on.
+                void options.live?.announce?.();
+            }
+            json(response, 200, shownLink(channelId, resolved));
+            return;
+        }
+        // The whole thing, to keep. The server fetches it through yt-dlp and
+        // hands the bytes straight on as a download, so the person's own machine
+        // ends up with the file and the server keeps nothing. A live stream has
+        // no whole to hand over.
+        if (path === "/api/links/download") {
+            const link = playableLink(url.searchParams.get("url"));
+            if (link === "") {
+                json(response, 400, { error: "that is not a link this can fetch" });
+                return;
+            }
+            if (!options.ytdlp || options.ytdlp.length === 0) {
+                json(response, 503, { error: "this server has no yt-dlp to fetch with" });
+                return;
+            }
+            const resolved = links.get(link) ?? await resolveLink(options.ytdlp, link, { cookies: options.cookies ?? "" });
+            if ("error" in resolved) {
+                json(response, 422, { error: resolved.error });
+                return;
+            }
+            links.set(link, resolved);
+            if (resolved.live) {
+                json(response, 409, { error: "that is live; there is no whole file to download yet" });
+                return;
+            }
+            const audioOnly = url.searchParams.get("audio") === "1" || !resolved.video;
+            // Named for the format the download will actually take, which is not
+            // always the one played: a track played from an HLS playlist is saved
+            // as the plain MP3 the site also offers, and ".m4a" on an MP3 is a
+            // file nothing will open.
+            const saved = await resolveLink(options.ytdlp, link, { cookies: options.cookies ?? "", format: saveFormat(audioOnly) });
+            const fileName = fileNameFor("error" in saved ? resolved : { ...resolved, ext: saved.ext || resolved.ext }, audioOnly);
+            const [command, ...prefix] = options.ytdlp;
+            const child = spawn(command, [...prefix, ...downloadArgs(link, audioOnly, options.cookies ?? "")], {
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+            response.writeHead(200, {
+                "content-type": contentTypeFor(fileName),
+                "content-disposition": `attachment; filename="${fileName.replace(/["\\]/g, "")}"; filename*=UTF-8''${encodeURIComponent(fileName)}`,
+                "cache-control": "no-store",
+            });
+            child.stdout?.pipe(response);
+            let complaint = "";
+            child.stderr?.on("data", (chunk) => {
+                if (complaint.length < 20_000)
+                    complaint += chunk.toString("utf8");
+            });
+            child.on("error", () => response.end());
+            child.on("close", (code) => {
+                if (code !== 0)
+                    console.log(`  a download of ${link} failed: ${complaint.split("\n").filter((one) => one.startsWith("ERROR")).pop() ?? code}`);
+                response.end();
+            });
+            // The person closed the tab: stop fetching what nobody will keep.
+            response.on("close", () => {
+                if (child.exitCode === null)
+                    child.kill("SIGKILL");
+            });
+            return;
+        }
         // A channel is one publisher and everybody listening to them. Two or three
         // devices can publish at once, each to their own channel, and a listener
         // picks which to hear.
@@ -3613,6 +3769,7 @@ export async function serve(argv, version = "0.1.0") {
             status: () => ({
                 live: publisher !== null,
                 code: listing?.code ?? "",
+                channelCodes: listing?.channelCodes ?? {},
                 name: listing?.name ?? (options.name || hostname()),
                 url: listing?.url ?? (publishable_ ? shareLink(publishable_.url, listenKey, false) : ""),
                 // Whether going live is even possible here. A laptop behind a router
@@ -3663,6 +3820,11 @@ export async function serve(argv, version = "0.1.0") {
         paywall,
         ffmpeg: tools.ffmpeg,
         ffprobe: tools.ffprobe,
+        // For a pasted link: where its media is, and the whole of it to keep.
+        // A cookie jar beside the state, when the operator has put one there,
+        // for the sites that will not talk to a datacenter without one.
+        ytdlp: tools.ytdlp ?? null,
+        cookies: cookiesFile(),
         ...(tls ? { tls } : {}),
         // Untagged, so a directory of five thousand files answers at once; the
         // tags follow through `tag` below.

package/dist/share.js

@@ -327,8 +327,10 @@ export function allowedForListening(path) {
         return false;
     // Listing this machine in a public directory is not listening to it. The
     // listen address itself, /api/live, stays open: that is the thing a listen
-    // key is for.
-    if (path === "/api/live/state" || path === "/api/live/start" || path === "/api/live/stop")
+    // key is for -- and so is knowing the phone code, which /api/live/state
+    // answers: a joiner is told the number to call and the code to key, and
+    // the code is in the public directory anyway.
+    if (path === "/api/live/start" || path === "/api/live/stop")
         return false;
     return true;
 }