nixamp 0.28.44 → 0.29.1

package/dist/audio.js

@@ -6,6 +6,7 @@
  * same bytes to the output process. Running two decoders instead would drift
  * apart within seconds and the bars would stop matching what you hear.
  */
+import { protocolArgs } from "./decoder-policy.js";
 import { spawn, spawnSync } from "node:child_process";
 import { readdirSync } from "node:fs";
 import { homedir } from "node:os";
@@ -109,6 +110,7 @@ export function probe(tools, path) {
         ...rest,
         "-v", "quiet", "-print_format", "json",
         "-show_format", "-show_entries", "format_tags=title,artist,album",
+        ...protocolArgs(path),
         path,
     ], { encoding: "utf8", timeout: 20_000, maxBuffer: 4 * 1024 * 1024 });
     if (result.error || result.status !== 0)
@@ -190,6 +192,7 @@ export class Stream {
             // being on disk. Measured with that condition in place: still 13.8x.
             "-re",
             ...(from > 0 ? ["-ss", String(from)] : []),
+            ...protocolArgs(track.path),
             "-i", track.path,
             "-f", "f32le", "-ac", String(CHANNELS), "-ar", String(RATE), "-",
         ], { stdio: ["ignore", "pipe", "pipe"] });

package/dist/channels.d.ts

@@ -1,3 +1,4 @@
+import { type PlaylistInput } from "./playlist-input.ts";
 import type { Readable } from "node:stream";
 /** Somewhere for a channel's audio to go. A response, in practice. */
 export interface Listener {
@@ -105,6 +106,13 @@ export interface PullResume {
     /** For a list of things rather than one: every entry, in order. */
     playlist?: string[];
     playlistAt?: number;
+    /**
+     * How a station plays its list: round and round, in a shuffled order, with
+     * edits landing on the next track and broken entries passed over. Only for
+     * lists of files on this machine; not remembered, because whoever owns the
+     * rotation (the station) puts it back.
+     */
+    rotation?: Pick<PlaylistInput, "repeat" | "order" | "current" | "excluded" | "onFailure" | "passOver">;
 }
 /**
  * A source read by us rather than by ffmpeg: what to tell ffmpeg it is,
@@ -220,6 +228,10 @@ export declare class Channel {
     private redial;
     /** For a channel playing a list: move to the next entry. Null when there is no list. */
     private advance;
+    /** The list being played entry by entry, when it is one; what skip() moves on. */
+    private playlistInput;
+    /** On to the next entry of a list of files. False when this is not one. */
+    skip(): boolean;
     private failures;
     private timer;
     /** Fires when a pulled source has said nothing for STALL. */
@@ -485,6 +497,8 @@ export declare class Channels {
     setThrough(provider: ThroughProvider | null): void;
     /** The kind of a channel, for a relay to say what it is carrying. */
     kindOf(id: string): "audio" | "video" | undefined;
+    /** The next entry, now, on a channel playing a list of files. */
+    skip(id: string): boolean;
     stop(id: string): boolean;
     stopAll(): void;
 }

package/dist/channels.js

@@ -14,6 +14,7 @@
  * what live means. MP3 frames are self-describing, so a player finds the next
  * frame boundary and carries on; there is nothing to catch up on.
  */
+import { protocolArgs } from "./decoder-policy.js";
 import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
@@ -134,6 +135,12 @@ export class Channel {
     redial = null;
     /** For a channel playing a list: move to the next entry. Null when there is no list. */
     advance = null;
+    /** The list being played entry by entry, when it is one; what skip() moves on. */
+    playlistInput = null;
+    /** On to the next entry of a list of files. False when this is not one. */
+    skip() {
+        return this.playlistInput?.skip() ?? false;
+    }
     failures = 0;
     timer = null;
     /** Fires when a pulled source has said nothing for STALL. */
@@ -236,7 +243,7 @@ export class Channel {
         // A list plays entry by entry: the one that is on is what gets dialled,
         // and an entry that ended is followed by the next, at once.
         const list = resume.playlist && resume.playlist.length > 0 ? resume.playlist : null;
-        const localPlaylist = list && list.length > 1 && list.every(one => !/^https?:\/\//i.test(one)) ? list : null;
+        const localPlaylist = list && (list.length > 1 || resume.rotation) && list.every(one => !/^https?:\/\//i.test(one)) ? list : null;
         let at = 0;
         if (list) {
             this.info.playlist = list;
@@ -287,7 +294,9 @@ export class Channel {
                 ffprobe: this.options.ffprobe ?? this.options.ffmpeg.map(one => one.replace(/ffmpeg(?=(?:\.exe)?$)/, "ffprobe")),
                 files: localPlaylist, at: this.info.playlistAt ?? 0, position: from,
                 video: this.info.kind === "video", width: this.info.codecs?.width, height: this.info.codecs?.height,
+                ...resume.rotation,
             }) : null;
+            this.playlistInput = playlistInput;
             const through = this.outroOn ? null : playlistInput
                 ? { format: "mpegts", open: async (signal) => playlistInput.open(signal) }
                 : this.options.through?.(this.info, from, input, audio) ?? null;
@@ -338,10 +347,10 @@ export class Channel {
                         // What the source's site expects on the request: a user agent, a
                         // referer, a cookie. A link resolved by yt-dlp comes with these,
                         // and a CDN that got them from yt-dlp and not from us answers 403.
-                        ...input, ...seek, "-i", current,
+                        ...input, ...seek, ...protocolArgs(current), "-i", current,
                         // The sound, when the site keeps it apart from the picture: a
                         // second input, dialled the same way, that the encode maps in.
-                        ...(audio ? [...remoteArgs, ...(paced ? ["-re"] : []), ...input, ...seek, "-i", audio] : []),
+                        ...(audio ? [...remoteArgs, ...(paced ? ["-re"] : []), ...input, ...seek, ...protocolArgs(audio), "-i", audio] : []),
                     ]),
                 ...(playlistEncode ?? encode),
                 "pipe:1",
@@ -1159,6 +1168,10 @@ export class Channels {
     kindOf(id) {
         return this.open.get(id)?.info.kind;
     }
+    /** The next entry, now, on a channel playing a list of files. */
+    skip(id) {
+        return this.open.get(id)?.skip() ?? false;
+    }
     stop(id) {
         const channel = this.open.get(id);
         if (!channel)

package/dist/decoder-policy.d.ts

@@ -0,0 +1,20 @@
+/**
+ * What a decoder may open while reading one source.
+ *
+ * ffmpeg follows references inside what it reads: an .m3u8 names segments, a
+ * concat list names files, a playlist on disk can name a URL. A file in
+ * somebody's library is untrusted input, and without a list of protocols it
+ * can make this machine fetch any address it likes, on the LAN included. So
+ * a file on disk may open files and pipes and nothing else, and a link may
+ * open the network protocols a stream needs and not the local file system.
+ *
+ * Sources this does not recognise (an ingest URL, a lavfi graph) are left
+ * alone rather than broken: the list is for what comes out of a library or a
+ * pasted link, which is where untrusted references come from.
+ */
+/** A file in a library: itself, and the pipes the pipeline is built from. */
+export declare const LOCAL_PROTOCOLS = "file,pipe,fd";
+/** A link: the network, as streams use it, and never `file`. */
+export declare const REMOTE_PROTOCOLS: string;
+/** The `-protocol_whitelist` to put before this source's `-i`, or nothing. */
+export declare function protocolArgs(source: string): string[];

package/dist/decoder-policy.js

@@ -0,0 +1,34 @@
+/**
+ * What a decoder may open while reading one source.
+ *
+ * ffmpeg follows references inside what it reads: an .m3u8 names segments, a
+ * concat list names files, a playlist on disk can name a URL. A file in
+ * somebody's library is untrusted input, and without a list of protocols it
+ * can make this machine fetch any address it likes, on the LAN included. So
+ * a file on disk may open files and pipes and nothing else, and a link may
+ * open the network protocols a stream needs and not the local file system.
+ *
+ * Sources this does not recognise (an ingest URL, a lavfi graph) are left
+ * alone rather than broken: the list is for what comes out of a library or a
+ * pasted link, which is where untrusted references come from.
+ */
+/** A file in a library: itself, and the pipes the pipeline is built from. */
+export const LOCAL_PROTOCOLS = "file,pipe,fd";
+/** A link: the network, as streams use it, and never `file`. */
+export const REMOTE_PROTOCOLS = [
+    "http", "https", "tcp", "tls", "crypto", "data", "httpproxy",
+    "rtmp", "rtmps", "rtmpt", "rtmpts", "rtmpe", "rtmpte", "ffrtmpcrypt", "ffrtmphttp",
+].join(",");
+/** The `-protocol_whitelist` to put before this source's `-i`, or nothing. */
+export function protocolArgs(source) {
+    if (source === "-" || source.startsWith("pipe:"))
+        return ["-protocol_whitelist", LOCAL_PROTOCOLS];
+    if (/^(https?|rtmp[a-z]*):\/\//i.test(source))
+        return ["-protocol_whitelist", REMOTE_PROTOCOLS];
+    if (/^file:/i.test(source))
+        return ["-protocol_whitelist", LOCAL_PROTOCOLS];
+    // Any other scheme (two letters or more, so `C:\` is still a path).
+    if (/^[a-z][a-z0-9+.-]+:/i.test(source))
+        return [];
+    return ["-protocol_whitelist", LOCAL_PROTOCOLS];
+}

package/dist/destinations.d.ts

@@ -0,0 +1,5 @@
+export type Lookup = (host: string) => Promise<string[]>;
+/** Not somewhere on the public internet: loopback, private, link-local, reserved. */
+export declare function isPrivateAddress(address: string): boolean;
+/** "" when this link may be fetched for a member, else why not. */
+export declare function refusedDestination(link: string, lookup?: Lookup): Promise<string>;

package/dist/destinations.js

@@ -0,0 +1,82 @@
+/**
+ * Whether a link somebody else pasted may be fetched from this machine.
+ *
+ * A member -- any nixamp.com account -- may put a link on the air on a server
+ * that is not theirs. Fetching it is a request from inside the owner's
+ * network, so a link to the router, the cloud metadata address or a service
+ * on localhost would be the member reaching things only the owner can. The
+ * owner may fetch what they like: it is their network. A member's link has to
+ * resolve to a public address, every address it resolves to, at every hop
+ * this code follows.
+ *
+ * What it cannot see: a redirect yt-dlp or ffmpeg follows on its own, and a
+ * name that resolves differently a second later. The decoder's protocol list
+ * (decoder-policy.ts) keeps those off the file system; keeping them off the
+ * LAN entirely needs the fetch to happen here, which is later work.
+ */
+import { lookup as dnsLookup } from "node:dns/promises";
+import { isIP } from "node:net";
+const defaultLookup = async (host) => (await dnsLookup(host, { all: true, verbatim: true })).map((one) => one.address);
+function v4Number(address) {
+    return address.split(".").reduce((sum, part) => sum * 256 + Number(part), 0);
+}
+function inV4(address, base, bits) {
+    const mask = bits === 0 ? 0 : (0xffffffff << (32 - bits)) >>> 0;
+    return ((v4Number(address) & mask) >>> 0) === ((v4Number(base) & mask) >>> 0);
+}
+const PRIVATE_V4 = [
+    ["0.0.0.0", 8], ["10.0.0.0", 8], ["100.64.0.0", 10], ["127.0.0.0", 8],
+    ["169.254.0.0", 16], ["172.16.0.0", 12], ["192.0.0.0", 24], ["192.0.2.0", 24],
+    ["192.168.0.0", 16], ["198.18.0.0", 15], ["198.51.100.0", 24], ["203.0.113.0", 24],
+    ["224.0.0.0", 4], ["240.0.0.0", 4],
+];
+/** Not somewhere on the public internet: loopback, private, link-local, reserved. */
+export function isPrivateAddress(address) {
+    const kind = isIP(address);
+    if (kind === 4)
+        return PRIVATE_V4.some(([base, bits]) => inV4(address, base, bits));
+    if (kind !== 6)
+        return true;
+    const lower = address.toLowerCase();
+    const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(lower);
+    if (mapped)
+        return isPrivateAddress(mapped[1]);
+    if (lower === "::" || lower === "::1")
+        return true;
+    const first = parseInt(lower.split(":")[0] || "0", 16);
+    // fc00::/7 unique local, fe80::/10 link-local, ff00::/8 multicast.
+    if ((first & 0xfe00) === 0xfc00)
+        return true;
+    if ((first & 0xffc0) === 0xfe80)
+        return true;
+    if ((first & 0xff00) === 0xff00)
+        return true;
+    return false;
+}
+/** "" when this link may be fetched for a member, else why not. */
+export async function refusedDestination(link, lookup = defaultLookup) {
+    let url;
+    try {
+        url = new URL(link);
+    }
+    catch {
+        return "that is not a link";
+    }
+    if (!/^(https?|rtmps?):$/i.test(url.protocol))
+        return "only http, https and rtmp links can be played here";
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    if (host === "" || /^localhost$/i.test(host) || /\.localhost$/i.test(host))
+        return "that link points at this machine";
+    let addresses;
+    try {
+        addresses = isIP(host) ? [host] : await lookup(host);
+    }
+    catch {
+        return "that link's host does not resolve";
+    }
+    if (addresses.length === 0)
+        return "that link's host does not resolve";
+    if (addresses.some(isPrivateAddress))
+        return "that link points inside a private network, which only this server's owner may play";
+    return "";
+}

package/dist/library.d.ts

@@ -1,6 +1,8 @@
 export interface Config {
     /** The folder the daemon serves when it is not told which. */
     library?: string;
+    /** Whether this machine is listed in the public directory; unset until chosen. */
+    publish?: boolean;
 }
 export declare function configPath(): string;
 export declare function readConfig(): Config;

package/dist/library.js

@@ -28,7 +28,10 @@ export function readConfig() {
         if (typeof parsed !== "object" || parsed === null)
             return {};
         const record = parsed;
-        return { ...(typeof record["library"] === "string" ? { library: record["library"] } : {}) };
+        return {
+            ...(typeof record["library"] === "string" ? { library: record["library"] } : {}),
+            ...(typeof record["publish"] === "boolean" ? { publish: record["publish"] } : {}),
+        };
     }
     catch {
         return {};

package/dist/links.d.ts

@@ -70,6 +70,8 @@ export declare function playlistFrom(text: string, base: string): {
     sources: string[];
     image: string;
 };
+/** Asked of every address before it is fetched: "" to go ahead, else why not. */
+export type Guard = (url: string) => Promise<string>;
 /**
  * A pasted .m3u, read and turned into a channel's worth of entries. Fetched
  * here rather than by yt-dlp, which would take the first entry and stop, or
@@ -78,6 +80,7 @@ export declare function playlistFrom(text: string, base: string): {
 export declare function resolvePlaylist(url: string, options?: {
     timeoutMs?: number;
     fetcher?: typeof fetch;
+    guard?: Guard;
 }): Promise<ResolvedLink | {
     error: string;
 }>;
@@ -133,6 +136,7 @@ export declare function resolveLink(ytdlp: string[] | null, url: string, options
     cookies?: string;
     timeoutMs?: number;
     format?: string;
+    guard?: Guard;
 }): Promise<ResolvedLink | {
     error: string;
 }>;

package/dist/links.js

@@ -106,6 +106,7 @@ export function playlistFrom(text, base) {
     const image = entries.map((entry) => pictureUrl(entry.logo)).find((one) => one !== "") ?? "";
     return { hls: false, sources: entries.map((entry) => entry.source), image };
 }
+const PLAYLIST_MAX_REDIRECTS = 5;
 /**
  * A pasted .m3u, read and turned into a channel's worth of entries. Fetched
  * here rather than by yt-dlp, which would take the first entry and stop, or
@@ -117,7 +118,24 @@ export async function resolvePlaylist(url, options = {}) {
     const timer = setTimeout(() => abort.abort(), options.timeoutMs ?? PLAYLIST_FETCH_TIMEOUT_MS);
     let text = "";
     try {
-        const answer = await get(url, { signal: abort.signal, headers: { "user-agent": "nixamp" }, redirect: "follow" });
+        // Followed here, one hop at a time, when there is a guard: a public
+        // address that redirects to the router is the router.
+        let at = url;
+        let answer;
+        for (let hop = 0;; hop += 1) {
+            if (options.guard) {
+                const refused = await options.guard(at);
+                if (refused)
+                    return { error: refused };
+            }
+            answer = await get(at, { signal: abort.signal, headers: { "user-agent": "nixamp" }, redirect: options.guard ? "manual" : "follow" });
+            const next = answer.headers.get("location");
+            if (!options.guard || answer.status < 300 || answer.status >= 400 || !next)
+                break;
+            if (hop >= PLAYLIST_MAX_REDIRECTS)
+                return { error: "that playlist redirects too many times" };
+            at = new URL(next, at).toString();
+        }
         if (!answer.ok)
             return { error: `that playlist could not be fetched (HTTP ${answer.status})` };
         text = (await answer.text()).slice(0, PLAYLIST_MAX_BYTES);
@@ -442,7 +460,7 @@ export async function resolveLink(ytdlp, url, options = {}) {
     if (isDirectMedia(url))
         return directLink(url);
     if (isPlaylistLink(url))
-        return resolvePlaylist(url, { timeoutMs: options.timeoutMs });
+        return resolvePlaylist(url, { timeoutMs: options.timeoutMs, guard: options.guard });
     // Without yt-dlp, a link is taken as the media it may well be: an IPTV
     // feed has no extension and no page behind it, and ffprobe -- asked next,
     // before anything goes on the air -- tells a stream from a web page in a

package/dist/live-interpreter.d.ts

@@ -1,72 +1 @@
-import type { SpeakerTurn } from "./speaker-turns.ts";
-export interface Caption {
-    channel: string;
-    at: number;
-    until: number;
-    text: string;
-    language?: string;
-    original?: string;
-    sourceLanguage?: string;
-    speaker?: string;
-    voiceProfile?: "lower" | "higher" | "unknown";
-}
-export interface VoiceChoice {
-    id: string;
-    name: string;
-    gender: string;
-    language: string;
-}
-export interface AudioWindow {
-    samples: Float32Array;
-    at: number;
-    until: number;
-    freshAt: number;
-}
-export interface Speaker {
-    id: string;
-    profile: string;
-    voice: string;
-}
-/** Match provider labels across overlapping timestamps. A speaker absent from
- * the rolling context gets a new label; pitch alone never identifies someone. */
-export declare class SpeakerTracker {
-    private readonly random;
-    private previous;
-    private sequence;
-    readonly speakers: Map<string, Speaker>;
-    constructor(random?: () => number);
-    reset(): void;
-    reconcile(turns: SpeakerTurn[], at: number, voices: VoiceChoice[]): Map<string, Speaker>;
-}
-/** Listener-local interpretation for the playing media. One request in flight and only the latest pending audio window. */
-export declare class Interpreter {
-    private readonly options;
-    readonly tracker: SpeakerTracker;
-    private generation;
-    private pending;
-    private committedUntil;
-    private running;
-    private controller;
-    private translating;
-    private translationController;
-    private recognitionFailures;
-    private translationFailures;
-    private translations;
-    constructor(options: {
-        language: () => string;
-        speakers: () => boolean;
-        voices: () => VoiceChoice[];
-        channel: () => string;
-        lines: (lines: Caption[]) => void;
-        status: (text: string) => void;
-        failed: (message: string) => void;
-        fetcher?: typeof fetch;
-    });
-    reset(): void;
-    push(window: AudioWindow): void;
-    private json;
-    private run;
-    private translate;
-}
-/** Preserve all words while respecting the speech API's character limit. */
-export declare function splitCaption(line: Caption): Caption[];
+export { Interpreter, SpeakerTracker, splitCaption, type Caption, type VoiceChoice, type AudioWindow, type Speaker } from "@profullstack/live-translate/core";