nixamp 0.36.3 → 0.37.0

package/dist/listener-shares.js

@@ -0,0 +1,486 @@
+/**
+ * Listener shares: anybody may hand a station a track -- a link to an MP3,
+ * or the file itself -- and AI sorts it onto the air.
+ *
+ * The person sharing says on what basis it may be broadcast (they made it,
+ * they have permission or a licence, it is Creative Commons or public
+ * domain) and ticks that they mean it. Nixamp copies the file here (the same
+ * guarded fetch as a handoff: public addresses only, every redirect checked,
+ * a size cap), ffprobe must find music in it, and then a language model
+ * reads what the file says about itself and answers two things: which genre
+ * station it belongs on, and whether it looks like something the sharer
+ * could not have the right to (a major-label release, a rip). "clear" goes on
+ * the air when the owner chose AI moderation; "doubt" waits for the owner;
+ * "refuse" (not music, spam) is turned away. With no model key, or with owner
+ * moderation, everything waits for the owner.
+ *
+ * Approved tracks play on "Shared: <genre>" stations, made and kept in step
+ * here, public and listed when the owner said so. Anybody listening may
+ * report what is playing: a reported track leaves the rotation at once and
+ * waits for the owner, which is the takedown path, not an afterthought.
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { createWriteStream, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, extname, join } from "node:path";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { askJson, hasModel } from "./ai-text.js";
+import { genreBuckets } from "./auto-stations.js";
+import { isAudio } from "./playlist.js";
+import { StationError } from "./stations.js";
+export const SHARE_BASES = ["owned", "permission", "licensed", "creative-commons", "public-domain"];
+export const SHARE_GENRES = ["Rock", "Punk", "Metal", "Alternative", "Pop", "Hip-Hop", "Electronic", "Industrial", "Reggae", "Jazz", "Blues", "Classical", "Country & Folk", "Soul & R&B", "Latin", "Ambient", "Experimental", "World", "Mixed"];
+export const SHARE_DEFAULTS = { open: false, moderation: "ai", publish: true, maxBytes: 60 * 1024 * 1024, perHour: 6 };
+const MAX_REDIRECTS = 3;
+const MIN_SECONDS = 20;
+const MAX_SECONDS = 20 * 60;
+const MAX_HELD = 500;
+function clean(value, max) {
+    return typeof value === "string" ? value.replace(/[\u0000-\u001f\u007f]/g, " ").trim().slice(0, max) : "";
+}
+/** What a sharer may see of their share. */
+export function sharerView(share) {
+    return {
+        id: share.id, state: share.state, reason: share.reason, title: share.title, artist: share.artist,
+        genre: share.genre, duration: share.duration, createdAt: share.createdAt, updatedAt: share.updatedAt,
+    };
+}
+/** What the owner sees: all of it but the sharer's token. */
+export function ownerShareView(share) {
+    const { token: _token, ...rest } = share;
+    return rest;
+}
+const SYSTEM = [
+    "You screen tracks that members of the public share to a community internet radio station, and file each under a genre.",
+    "You see only what the file says about itself, its name, where it came from and what the sharer declared.",
+    "verdict \"refuse\": not music (speech, silence, a test tone), spam or advertising, or titles that are hateful or sexual.",
+    "verdict \"doubt\": anything suggesting a commercially released recording by a signed or well-known artist, or a rip or leak (label or distributor names, 'Official Audio', 'VEVO', 'Remastered', bitrate or scene tags, a famous song title), unless the sharer's basis plausibly covers it (e.g. public domain for a pre-1926 recording).",
+    "verdict \"clear\": plausibly the sharer's own or independent work, or Creative Commons or public domain music consistent with the declaration.",
+    `genre: exactly one of ${SHARE_GENRES.join(", ")}.`,
+    "Answer as JSON: {\"verdict\": \"clear|doubt|refuse\", \"reason\": \"one short sentence\", \"genre\": \"...\", \"title\": \"tidy title or empty\", \"artist\": \"tidy artist or empty\"}.",
+].join(" ");
+export class ListenerShares {
+    file;
+    deps;
+    shares = new Map();
+    settings = { ...SHARE_DEFAULTS };
+    salt = randomBytes(16).toString("hex");
+    sourceId = "";
+    recent = new Map();
+    syncing = null;
+    constructor(file, deps) {
+        this.file = file;
+        this.deps = deps;
+        try {
+            const parsed = JSON.parse(readFileSync(file, "utf8"));
+            for (const one of parsed.shares ?? [])
+                if (one?.id)
+                    this.shares.set(one.id, one);
+            this.settings = { ...this.settings, ...(parsed.settings ?? {}) };
+            if (typeof parsed.salt === "string" && parsed.salt)
+                this.salt = parsed.salt;
+        }
+        catch {
+            // Nothing yet.
+        }
+        // A share that was being fetched or checked when the server stopped is
+        // not coming back; say so rather than leave it spinning.
+        for (const one of this.shares.values()) {
+            if (one.state === "fetching" || one.state === "checking") {
+                one.state = "failed";
+                one.reason = "the server restarted while this was being read; share it again";
+            }
+        }
+    }
+    static fileFor(stateDir, port) {
+        return join(stateDir, `shares-${port}.json`);
+    }
+    now() {
+        return this.deps.now?.() ?? Date.now();
+    }
+    save() {
+        mkdirSync(dirname(this.file), { recursive: true });
+        const temporary = `${this.file}.${process.pid}.tmp`;
+        writeFileSync(temporary, `${JSON.stringify({ version: 1, salt: this.salt, settings: this.settings, shares: [...this.shares.values()] }, null, 2)}\n`, { mode: 0o600 });
+        renameSync(temporary, this.file);
+    }
+    source() {
+        if (this.sourceId && this.deps.index.source(this.sourceId))
+            return this.sourceId;
+        mkdirSync(this.deps.root, { recursive: true });
+        this.sourceId = this.deps.index.addManagedSource(this.deps.root).id;
+        return this.sourceId;
+    }
+    setting() {
+        return { ...this.settings, model: (this.deps.canAsk ?? hasModel)() };
+    }
+    configure(input) {
+        if (input["open"] !== undefined)
+            this.settings.open = input["open"] === true;
+        if (input["publish"] !== undefined)
+            this.settings.publish = input["publish"] === true;
+        if (input["moderation"] !== undefined) {
+            if (input["moderation"] !== "ai" && input["moderation"] !== "owner")
+                throw new StationError("invalid_moderation", "moderation is ai or owner");
+            this.settings.moderation = input["moderation"];
+        }
+        if (input["maxMb"] !== undefined) {
+            const mb = Number(input["maxMb"]);
+            if (!Number.isInteger(mb) || mb < 1 || mb > 500)
+                throw new StationError("invalid_size", "maxMb is 1 to 500");
+            this.settings.maxBytes = mb * 1024 * 1024;
+        }
+        if (input["perHour"] !== undefined) {
+            const perHour = Number(input["perHour"]);
+            if (!Number.isInteger(perHour) || perHour < 1 || perHour > 1000)
+                throw new StationError("invalid_rate", "perHour is 1 to 1000");
+            this.settings.perHour = perHour;
+        }
+        this.save();
+        void this.sync();
+        return this.settings;
+    }
+    list(state) {
+        return [...this.shares.values()].filter((one) => !state || one.state === state).sort((a, b) => b.createdAt - a.createdAt);
+    }
+    get(id) {
+        return this.shares.get(id);
+    }
+    /** The share, if this token is the one its sharer was given. */
+    forSharer(id, token) {
+        const share = this.shares.get(id);
+        if (!share || token.length !== share.token.length)
+            return undefined;
+        return createHash("sha256").update(token).digest("hex") === createHash("sha256").update(share.token).digest("hex") ? share : undefined;
+    }
+    fromOf(caller) {
+        return createHash("sha256").update(`${this.salt}:${caller}`).digest("hex").slice(0, 16);
+    }
+    /** Throws when shares are closed or this sharer has shared enough for the hour. */
+    admit(caller) {
+        if (!this.settings.open)
+            throw new StationError("shares_closed", "this server is not taking shared tracks", 403);
+        if (this.list("held").length >= MAX_HELD)
+            throw new StationError("queue_full", "too many tracks are waiting to be checked; try again later", 503);
+        const from = this.fromOf(caller);
+        const at = this.now();
+        const times = (this.recent.get(from) ?? []).filter((one) => one > at - 3600_000);
+        if (times.length >= this.settings.perHour)
+            throw new StationError("rate_limited", `at most ${this.settings.perHour} shares an hour`, 429);
+        times.push(at);
+        this.recent.set(from, times);
+        return from;
+    }
+    declared(input) {
+        const basis = input["basis"];
+        if (typeof basis !== "string" || !SHARE_BASES.includes(basis)) {
+            throw new StationError("rights_required", `say on what basis it may be broadcast: ${SHARE_BASES.join(", ")}`);
+        }
+        if (input["agree"] !== true && input["agree"] !== "1" && input["agree"] !== "true") {
+            throw new StationError("agreement_required", "confirm you have the right to share this for broadcast");
+        }
+        return { basis: basis, note: clean(input["note"], 300), by: clean(input["by"], 60) };
+    }
+    blank(via, url, name, rights, from) {
+        const id = randomBytes(6).toString("hex");
+        const ext = extname(name).toLowerCase();
+        const safe = name.split(/[\\/]/).pop().replace(/[^\w .()-]/g, "_").replace(/^\.+/, "").slice(0, 120) || "track";
+        return {
+            id, token: randomBytes(16).toString("base64url"), via, url, name: safe,
+            file: join(this.deps.root, id, isAudio(`x${ext}`) ? safe : `${safe}.mp3`),
+            bytes: 0, sha256: "", state: "fetching", reason: "", title: "", artist: "", genre: "", duration: 0,
+            rights: { basis: rights.basis, note: rights.note }, by: rights.by, from,
+            check: { model: "", verdict: "", reason: "" }, reports: [], createdAt: this.now(), updatedAt: this.now(),
+        };
+    }
+    /** A link to a music file. Answers at once; the fetch and the check carry on. */
+    fromUrl(input, caller) {
+        const rights = this.declared(input);
+        const link = clean(input["url"], 2000);
+        let parsed;
+        try {
+            parsed = new URL(link);
+        }
+        catch {
+            throw new StationError("invalid_url", "paste a link to a music file (https://.../song.mp3)");
+        }
+        if (parsed.protocol !== "https:" && parsed.protocol !== "http:")
+            throw new StationError("invalid_url", "links are http or https");
+        if ([...this.shares.values()].some((one) => one.url === link && one.state !== "failed" && one.state !== "withdrawn")) {
+            throw new StationError("already_shared", "that link has been shared already", 409);
+        }
+        const from = this.admit(caller);
+        const share = this.blank("url", link, decodeURIComponent(parsed.pathname.split("/").pop() || "track.mp3"), rights, from);
+        this.shares.set(share.id, share);
+        this.save();
+        void this.fetchAndCheck(share);
+        return share;
+    }
+    /** The file itself, as the request body. Resolves once it is all here; the check carries on. */
+    async fromUpload(request, input, caller) {
+        const rights = this.declared(input);
+        const name = clean(input["name"], 200) || "upload.mp3";
+        const type = String(request.headers["content-type"] ?? "");
+        if (!type.startsWith("audio/") && !isAudio(name))
+            throw new StationError("not_audio", "share a music file (MP3, OGG, FLAC, M4A, WAV)");
+        const declaredLength = Number(request.headers["content-length"] ?? "0");
+        if (declaredLength > this.settings.maxBytes)
+            throw new StationError("too_big", `files up to ${Math.round(this.settings.maxBytes / 1048576)} MB`, 413);
+        const from = this.admit(caller);
+        const share = this.blank("upload", "", name, rights, from);
+        this.shares.set(share.id, share);
+        try {
+            await this.write(share, request);
+        }
+        catch (error) {
+            this.fail(share, error.message);
+            throw error instanceof StationError ? error : new StationError("upload_failed", share.reason);
+        }
+        void this.check(share);
+        return share;
+    }
+    /** The sharer takes it back: off the air and its copy gone. */
+    withdraw(share) {
+        share.state = "withdrawn";
+        share.reason = "withdrawn by the person who shared it";
+        rmSync(dirname(share.file), { recursive: true, force: true });
+        share.updatedAt = this.now();
+        this.save();
+        void this.sync();
+        return share;
+    }
+    /** A listener says what is playing should not be: off the air at once, for the owner to look at. */
+    report(input, caller) {
+        let share;
+        if (typeof input.share === "string")
+            share = this.shares.get(input.share);
+        else if (typeof input.station === "string") {
+            const file = this.deps.nowPlaying(input.station);
+            share = [...this.shares.values()].find((one) => one.file === file);
+        }
+        if (!share || share.state !== "approved")
+            return { reported: false, title: "" };
+        share.reports.push({ at: this.now(), reason: clean(input.reason, 300), from: this.fromOf(caller) });
+        share.state = "reported";
+        share.reason = `reported by a listener${share.reports.at(-1).reason ? `: ${share.reports.at(-1).reason}` : ""}`;
+        share.updatedAt = this.now();
+        this.save();
+        this.deps.log?.(`  shares: "${share.title || share.name}" was reported and is off the air until the owner looks at it`);
+        // Off the air now, not when the song ends: the station moves past it.
+        const playingOn = typeof input.station === "string" ? input.station : "";
+        void this.sync().then(() => { if (playingOn)
+            this.deps.runner.skip(playingOn); });
+        return { reported: true, title: share.title || share.name };
+    }
+    /** The owner's decision. */
+    decide(id, decision, reason = "") {
+        const share = this.shares.get(id);
+        if (!share)
+            throw new StationError("not_found", "no such share", 404);
+        if (decision === "delete") {
+            rmSync(dirname(share.file), { recursive: true, force: true });
+            this.shares.delete(id);
+        }
+        else if (decision === "approve") {
+            if (!["held", "rejected", "reported"].includes(share.state))
+                throw new StationError("not_waiting", `it is ${share.state}`, 409);
+            share.state = "approved";
+            share.reason = reason || "approved by the owner";
+        }
+        else {
+            share.state = "rejected";
+            share.reason = reason || "not accepted by the owner";
+        }
+        if (share)
+            share.updatedAt = this.now();
+        this.save();
+        void this.sync();
+        return decision === "delete" ? null : share;
+    }
+    fail(share, reason) {
+        share.state = "failed";
+        share.reason = reason;
+        share.updatedAt = this.now();
+        rmSync(dirname(share.file), { recursive: true, force: true });
+        this.save();
+    }
+    /** Bytes to the share's file, counted, capped and hashed. */
+    async write(share, body) {
+        mkdirSync(dirname(share.file), { recursive: true });
+        const part = `${share.file}.part`;
+        const hash = createHash("sha256");
+        let bytes = 0;
+        const max = this.settings.maxBytes;
+        const counter = new Transform({
+            transform(chunk, _encoding, done) {
+                bytes += chunk.length;
+                if (bytes > max)
+                    return done(new StationError("too_big", `files up to ${Math.round(max / 1048576)} MB`, 413));
+                hash.update(chunk);
+                done(null, chunk);
+            },
+        });
+        try {
+            await pipeline(body, counter, createWriteStream(part, { mode: 0o640 }));
+        }
+        catch (error) {
+            rmSync(part, { force: true });
+            throw error;
+        }
+        const sha256 = hash.digest("hex");
+        if ([...this.shares.values()].some((one) => one.id !== share.id && one.sha256 === sha256 && one.state !== "withdrawn" && one.state !== "failed")) {
+            rmSync(part, { force: true });
+            throw new StationError("already_shared", "that track has been shared already", 409);
+        }
+        renameSync(part, share.file);
+        share.bytes = bytes;
+        share.sha256 = sha256;
+        share.state = "checking";
+        share.updatedAt = this.now();
+        this.save();
+    }
+    async fetchAndCheck(share) {
+        try {
+            const send = this.deps.fetcher ?? fetch;
+            let at = share.url;
+            let response = null;
+            for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+                const refused = await this.deps.guard(at);
+                if (refused)
+                    throw new Error(refused);
+                response = await send(at, { redirect: "manual", signal: AbortSignal.timeout(5 * 60_000), headers: { "user-agent": "nixamp-shares" } });
+                const location = response.headers.get("location");
+                if (response.status >= 300 && response.status < 400 && location) {
+                    at = new URL(location, at).toString();
+                    continue;
+                }
+                break;
+            }
+            if (!response || !response.ok || !response.body)
+                throw new Error(`the link answered HTTP ${response?.status ?? "nothing"}`);
+            const type = (response.headers.get("content-type") ?? "").toLowerCase();
+            if (type.startsWith("text/html"))
+                throw new Error("that link is a web page, not a music file; link the .mp3 itself");
+            const length = Number(response.headers.get("content-length") ?? "0");
+            if (length > this.settings.maxBytes)
+                throw new Error(`the file is over ${Math.round(this.settings.maxBytes / 1048576)} MB`);
+            await this.write(share, Readable.fromWeb(response.body));
+        }
+        catch (error) {
+            this.fail(share, error.message);
+            return;
+        }
+        await this.check(share);
+    }
+    /** ffprobe, then the model: on the air, waiting, or turned away. */
+    async check(share) {
+        try {
+            await this.deps.index.scan(this.source(), this.deps.probe).done;
+            const item = this.deps.index.itemAt(share.file);
+            if (!item || item.state !== "ready")
+                throw new Error(item?.error || "there is no music in that file that a station can play");
+            if (item.duration > 0 && item.duration < MIN_SECONDS)
+                throw new Error(`it is ${Math.round(item.duration)} s; a track is at least ${MIN_SECONDS} s`);
+            if (item.duration > MAX_SECONDS)
+                throw new Error("it is over 20 minutes; share a track, not a mix or a show");
+            share.duration = Math.round(item.duration);
+            share.title = item.title || share.name.replace(/\.[a-z0-9]+$/i, "");
+            share.artist = item.artist;
+            share.genre = genreBuckets(item.genre)[0] ?? "";
+            let verdict = "doubt";
+            let reason = "waiting for the owner (no AI check on this server)";
+            if ((this.deps.canAsk ?? hasModel)()) {
+                try {
+                    const answer = await (this.deps.ask ?? askJson)({
+                        system: SYSTEM,
+                        prompt: JSON.stringify({
+                            file: share.name, title: item.title, artist: item.artist, album: item.album, genreTag: item.genre, year: item.year,
+                            seconds: share.duration, from: share.url ? new URL(share.url).host : "uploaded", declared: share.rights,
+                        }),
+                    });
+                    const said = answer.value;
+                    verdict = said["verdict"] === "clear" || said["verdict"] === "refuse" ? said["verdict"] : "doubt";
+                    reason = clean(said["reason"], 300) || verdict;
+                    const genre = SHARE_GENRES.find((one) => one.toLowerCase() === String(said["genre"] ?? "").toLowerCase());
+                    if (!share.genre && genre)
+                        share.genre = genre;
+                    if (!item.title && clean(said["title"], 200))
+                        share.title = clean(said["title"], 200);
+                    if (!item.artist && clean(said["artist"], 200))
+                        share.artist = clean(said["artist"], 200);
+                    share.check = { model: answer.model, verdict, reason };
+                }
+                catch (error) {
+                    reason = `waiting for the owner (the AI check failed: ${error.message})`;
+                }
+            }
+            share.genre ||= "Mixed";
+            if (verdict === "refuse") {
+                share.state = "rejected";
+                share.reason = reason;
+                rmSync(dirname(share.file), { recursive: true, force: true });
+            }
+            else if (verdict === "clear" && this.settings.moderation === "ai") {
+                share.state = "approved";
+                share.reason = "";
+            }
+            else {
+                share.state = "held";
+                share.reason = verdict === "clear" ? "waiting for the owner" : reason;
+            }
+            share.updatedAt = this.now();
+            this.save();
+            this.deps.log?.(`  shares: "${share.title}" (${share.genre}) is ${share.state}${share.reason ? `: ${share.reason}` : ""}`);
+            await this.sync();
+        }
+        catch (error) {
+            this.fail(share, error.message);
+        }
+    }
+    /** Each genre's shared station, with exactly the approved tracks; one with none goes quiet. */
+    sync() {
+        if (this.syncing)
+            return this.syncing.then(() => this.sync());
+        this.syncing = (async () => {
+            const byGenre = new Map();
+            for (const share of this.shares.values()) {
+                if (share.state !== "approved")
+                    continue;
+                byGenre.set(share.genre, [...(byGenre.get(share.genre) ?? []), share.file]);
+            }
+            const genres = new Set([...byGenre.keys(), ...this.deps.store.list().filter((one) => one.auto.startsWith("share:")).map((one) => one.auto.slice(6))]);
+            for (const genre of genres) {
+                const files = (byGenre.get(genre) ?? []).filter((file) => this.deps.index.itemAt(file)?.state === "ready");
+                const existing = this.deps.store.byAuto(`share:${genre}`);
+                if (files.length === 0) {
+                    if (existing && existing.desired === "running")
+                        this.deps.runner.stop(existing.id);
+                    if (existing && existing.listed)
+                        this.deps.store.setAccess(existing.id, { listed: false }, this.deps.owner || "shares");
+                    continue;
+                }
+                let station = existing;
+                if (!station) {
+                    station = this.deps.store.create({ name: `Shared: ${genre}`, description: `${genre} shared by listeners. Share yours, or report a track, from the guide.`, shuffle: true, repeat: true }, files, this.deps.owner);
+                    this.deps.store.markAuto(station.id, `share:${genre}`);
+                }
+                else {
+                    this.deps.store.update(station.id, {}, files);
+                }
+                if (this.settings.publish) {
+                    this.deps.store.setAccess(station.id, {
+                        visibility: "public",
+                        listed: true,
+                        rights: { basis: "permission", note: "Each track was shared by someone who declared the right to have it broadcast; listeners can report any track off the air." },
+                    }, this.deps.owner || "shares");
+                }
+                else if (station.visibility === "public") {
+                    this.deps.store.setAccess(station.id, { visibility: "unlisted" }, this.deps.owner || "shares");
+                }
+                if (station.desired !== "running" && this.deps.mayStart())
+                    await this.deps.runner.start(station.id).catch(() => undefined);
+            }
+        })().finally(() => { this.syncing = null; });
+        return this.syncing;
+    }
+}

package/dist/server.d.ts

@@ -24,6 +24,8 @@ import { HlsPackagers } from "./hls.ts";
 import { LibraryIndex, type Probed } from "./library-index.ts";
 import { ListenerStore } from "./library-user.ts";
 import { Importer } from "./handoff.ts";
+import { AiRadio } from "./ai-radio.ts";
+import { ListenerShares } from "./listener-shares.ts";
 import { StationRunner } from "./station-runner.ts";
 import { StationStore } from "./stations.ts";
 import { StationUsage, type Limits } from "./station-metering.ts";
@@ -591,6 +593,12 @@ export interface HandlerOptions {
         };
         /** This server's public https address, once it is known. */
         publicBase?: () => string;
+        /** Stations whose music is composed by AI. */
+        ai?: AiRadio;
+        /** Tracks anybody may share, sorted onto the air by AI. */
+        shares?: ListenerShares;
+        /** Proxies (by address) whose X-Forwarded-For is believed, for per-sharer limits. */
+        trustedProxies?: () => Set<string>;
     };
     web: string | null;
     /** Branded clients on this same backend, keyed by an explicitly configured host. */

package/dist/server.js

@@ -60,10 +60,13 @@ import { LibraryIndex, probeItem, trackOf } from "./library-index.js";
 import { ListenerStore } from "./library-user.js";
 import { Importer } from "./handoff.js";
 import { handleHandoffs } from "./handoff-routes.js";
+import { handleAiRoutes, isPublicSharePath } from "./ai-routes.js";
+import { AiRadio } from "./ai-radio.js";
+import { ListenerShares } from "./listener-shares.js";
 import { STATION_PAGE, STATION_PAGE_CSP, STATION_PAGE_HTML } from "./station-page.js";
 import { GUIDE_CSP, guideHosts, renderGuide } from "./station-guide.js";
 import { StationRunner } from "./station-runner.js";
-import { StationError, StationStore, stationOfChannel } from "./stations.js";
+import { StationError, StationStore, channelOf, stationOfChannel } from "./stations.js";
 import { STATION_CONTROL_LIMIT, StationUsage, limitsFromEnv } from "./station-metering.js";
 import { StationBreaks } from "./station-breaks.js";
 import { DEFAULT_AUTO, syncAutoStations } from "./auto-stations.js";
@@ -2149,6 +2152,8 @@ export function createHandler(engine, options) {
             !isSignInPath(path) &&
             // A station's link is its own key, checked by the station.
             !isStationListenPath(path) &&
+            // Sharing a track and reporting one are for anybody the guide reaches.
+            !isPublicSharePath(path) &&
             !STATION_PAGE.test(path) &&
             !isGuidePage &&
             !eventChannelRequest) {
@@ -2277,6 +2282,29 @@ export function createHandler(engine, options) {
             });
             return;
         }
+        if (options.stations && (isPublicSharePath(path) || path.startsWith("/api/v1/stations/ai") || path.startsWith("/api/v1/stations/shares"))) {
+            const control = await controlOf();
+            // Behind a proxy we trust (dev2 for live.streaming), the sharer is the
+            // first address it names; otherwise whoever connected.
+            const socket = (request.socket.remoteAddress ?? "").replace(/^::ffff:/, "");
+            const trusted = behindProxy || (options.stations.trustedProxies?.().has(socket) ?? false);
+            const caller = callerOf(request.headers, socket, trusted);
+            const handled = await handleAiRoutes(request, response, path, url, {
+                ...(options.stations.ai ? { ai: options.stations.ai } : {}),
+                ...(options.stations.shares ? { shares: options.stations.shares } : {}),
+                canControl: control.allowed,
+                caller,
+                json,
+                readBody,
+                headers: CORS,
+                throttle: () => {
+                    const verdict = guard.check(`shares:${caller}`, STATION_CONTROL_LIMIT);
+                    return verdict.ok ? null : { retryAfter: verdict.retryAfter };
+                },
+            });
+            if (handled)
+                return;
+        }
         if (options.stations && (path === "/api/v1/stations" || path.startsWith("/api/v1/stations/"))) {
             const control = await controlOf();
             const encrypted = request.socket.encrypted === true;
@@ -6215,7 +6243,7 @@ export async function serve(argv, version = "0.1.0") {
     const stationStore = new StationStore(StationStore.fileFor(stateDir(), options.port));
     // What stations deliver, per month, and the operator's limits on it.
     const stationUsage = new StationUsage(StationUsage.fileFor(stateDir(), options.port));
-    const stationLimits = limitsFromEnv();
+    const stationLimits = limitsFromEnv(process.env, readConfig().limits ?? {});
     process.once("exit", () => stationUsage.flush());
     // Breaks between songs and films: the network's spot, or a house one.
     const stationBreaks = new StationBreaks({
@@ -6308,6 +6336,7 @@ export async function serve(argv, version = "0.1.0") {
     };
     const stations = {
         store: stationStore, runner: stationRunner, usage: stationUsage, limits: stationLimits, auto: stationAuto,
+        trustedProxies: () => new Set([...(process.env["NIXAMP_TRUSTED_PROXIES"] ?? "").split(","), ...(readConfig().trustedProxies ?? [])].map((one) => one.trim()).filter(Boolean)),
         // Known once the server has worked out its addresses, after it is listening.
         publicBase: () => (publishable_?.url ?? "").replace(/\/+$/, ""),
     };
@@ -6321,6 +6350,38 @@ export async function serve(argv, version = "0.1.0") {
         log: (line) => console.log(line),
     });
     importer.resume();
+    const mayStartStation = () => stationLimits.runningStations === 0 || stationStore.list().filter((one) => one.desired === "running").length < stationLimits.runningStations;
+    // AI radio: music composed for its stations, a few tracks a day, in a folder of our own.
+    const aiRadio = new AiRadio(AiRadio.fileFor(stateDir(), options.port), {
+        index: libraryIndex,
+        store: stationStore,
+        runner: stationRunner,
+        probe: probeFile,
+        ffmpeg: tools.ffmpeg,
+        root: join(stateDir(), "ai-music"),
+        owner: options.owner || "",
+        mayStart: mayStartStation,
+        log: (line) => console.log(line),
+    });
+    aiRadio.startSchedule();
+    // Tracks anybody shares from the guide, checked by AI before they air.
+    const listenerShares = new ListenerShares(ListenerShares.fileFor(stateDir(), options.port), {
+        index: libraryIndex,
+        store: stationStore,
+        runner: stationRunner,
+        probe: probeFile,
+        guard: (url) => refusedDestination(url),
+        root: join(stateDir(), "shares"),
+        owner: options.owner || "",
+        mayStart: mayStartStation,
+        nowPlaying: (id) => {
+            const info = channels.info(channelOf(id));
+            return info?.playlist?.[info.playlistAt ?? 0] ?? "";
+        },
+        log: (line) => console.log(line),
+    });
+    stations.ai = aiRadio;
+    stations.shares = listenerShares;
     // Channels as HLS, on demand, for Safari on a phone: one ffmpeg copying a
     // channel's fragments into short files while somebody is asking for them.
     // What things are, from nichedb.dev, remembered beside the keys so a