nixamp 0.38.1 → 0.39.0

package/dist/directory-mcp.d.ts

@@ -0,0 +1,89 @@
+/**
+ * The station directory as MCP tools anybody may use: what is on, anywhere.
+ *
+ * nixamp.com's guide lists every public, listed station on every server in
+ * its directory (each server is asked for its own guide). These tools read
+ * that list, so an agent with no account and no nixamp installed can find a
+ * station and hand somebody its link, and can share a track to a server that
+ * takes listener shares -- the same as the guide's form, with the same
+ * declaration. Nothing here changes a station; that is the owner's, with the
+ * owner's tools.
+ */
+export declare const PUBLIC_TOOLS: readonly [{
+    readonly name: "stations_list";
+    readonly description: "Every public station on nixamp, on any server: name, radio or TV, group (ai, shared, radio, tv), whether it is live, what is playing, and the link to watch or listen. No sign-in needed.";
+    readonly inputSchema: {
+        readonly type: "object";
+        readonly properties: {
+            readonly kind: {
+                readonly type: "string";
+                readonly enum: readonly ["audio", "video"];
+                readonly description: "Only radio (audio) or only TV (video).";
+            };
+            readonly group: {
+                readonly type: "string";
+                readonly enum: readonly ["ai", "shared", "radio", "tv"];
+            };
+        };
+    };
+}, {
+    readonly name: "station_find";
+    readonly description: "Find public nixamp stations whose name, or what is playing, matches the words given (e.g. \"data structures\", \"lofi\", \"jazz\"). Returns each match with its link.";
+    readonly inputSchema: {
+        readonly type: "object";
+        readonly properties: {
+            readonly query: {
+                readonly type: "string";
+                readonly description: "Words to look for.";
+            };
+        };
+        readonly required: readonly ["query"];
+    };
+}, {
+    readonly name: "station_share";
+    readonly description: "Share a music file by its link with the server a station is on, for its listener-share stations. The sharer must have the right to have it broadcast and say on what basis; AI files it under a genre and checks it before it airs. Returns a status link.";
+    readonly inputSchema: {
+        readonly type: "object";
+        readonly properties: {
+            readonly station: {
+                readonly type: "string";
+                readonly description: "A station's link or id from stations_list: the track goes to that station's server.";
+            };
+            readonly url: {
+                readonly type: "string";
+                readonly description: "A direct link to the MP3 (or OGG, FLAC, M4A, WAV).";
+            };
+            readonly basis: {
+                readonly type: "string";
+                readonly enum: readonly ["owned", "permission", "licensed", "creative-commons", "public-domain"];
+            };
+            readonly note: {
+                readonly type: "string";
+                readonly description: "Licence, credit, a link to the artist.";
+            };
+            readonly by: {
+                readonly type: "string";
+                readonly description: "A name to credit the sharer with.";
+            };
+            readonly agree: {
+                readonly type: "boolean";
+                readonly description: "true: the sharer has the right to share this for broadcast.";
+            };
+        };
+        readonly required: readonly ["station", "url", "basis", "agree"];
+    };
+}];
+export declare function isPublicTool(name: string): boolean;
+export interface PublicToolOptions {
+    /** The guide's stations; nixamp.com's own list by default. */
+    guide?: () => Promise<unknown[]>;
+    fetcher?: typeof fetch;
+    site?: string;
+}
+export declare function callPublicTool(name: string, args: Record<string, unknown>, options?: PublicToolOptions): Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError?: boolean | undefined;
+}>;

package/dist/directory-mcp.js

@@ -0,0 +1,103 @@
+/**
+ * The station directory as MCP tools anybody may use: what is on, anywhere.
+ *
+ * nixamp.com's guide lists every public, listed station on every server in
+ * its directory (each server is asked for its own guide). These tools read
+ * that list, so an agent with no account and no nixamp installed can find a
+ * station and hand somebody its link, and can share a track to a server that
+ * takes listener shares -- the same as the guide's form, with the same
+ * declaration. Nothing here changes a station; that is the owner's, with the
+ * owner's tools.
+ */
+const STRING = { type: "string" };
+export const PUBLIC_TOOLS = [
+    {
+        name: "stations_list",
+        description: "Every public station on nixamp, on any server: name, radio or TV, group (ai, shared, radio, tv), whether it is live, what is playing, and the link to watch or listen. No sign-in needed.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                kind: { type: "string", enum: ["audio", "video"], description: "Only radio (audio) or only TV (video)." },
+                group: { type: "string", enum: ["ai", "shared", "radio", "tv"] },
+            },
+        },
+    },
+    {
+        name: "station_find",
+        description: "Find public nixamp stations whose name, or what is playing, matches the words given (e.g. \"data structures\", \"lofi\", \"jazz\"). Returns each match with its link.",
+        inputSchema: { type: "object", properties: { query: { ...STRING, description: "Words to look for." } }, required: ["query"] },
+    },
+    {
+        name: "station_share",
+        description: "Share a music file by its link with the server a station is on, for its listener-share stations. The sharer must have the right to have it broadcast and say on what basis; AI files it under a genre and checks it before it airs. Returns a status link.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                station: { ...STRING, description: "A station's link or id from stations_list: the track goes to that station's server." },
+                url: { ...STRING, description: "A direct link to the MP3 (or OGG, FLAC, M4A, WAV)." },
+                basis: { type: "string", enum: ["owned", "permission", "licensed", "creative-commons", "public-domain"] },
+                note: { ...STRING, description: "Licence, credit, a link to the artist." },
+                by: { ...STRING, description: "A name to credit the sharer with." },
+                agree: { type: "boolean", description: "true: the sharer has the right to share this for broadcast." },
+            },
+            required: ["station", "url", "basis", "agree"],
+        },
+    },
+];
+export function isPublicTool(name) {
+    return PUBLIC_TOOLS.some((tool) => tool.name === name);
+}
+const say = (text, isError = false) => ({ content: [{ type: "text", text }], ...(isError ? { isError: true } : {}) });
+async function stations(options) {
+    const raw = options.guide
+        ? await options.guide()
+        : await (async () => {
+            const answer = await (options.fetcher ?? fetch)(`${(options.site ?? "https://nixamp.com").replace(/\/+$/, "")}/api/v1/stations/guide`, { signal: AbortSignal.timeout(15_000) });
+            if (!answer.ok)
+                throw new Error(`the guide answered HTTP ${answer.status}`);
+            return (await answer.json()).stations ?? [];
+        })();
+    return raw.filter((one) => typeof one === "object" && one !== null && typeof one.name === "string" && typeof one.page === "string");
+}
+function line(one) {
+    const now = one.nowPlaying && (one.nowPlaying.title || one.nowPlaying.artist) ? ` — now: ${[one.nowPlaying.title, one.nowPlaying.artist].filter(Boolean).join(" — ")}` : "";
+    return `${one.name} [${one.kind === "video" ? "TV" : "radio"}${one.group ? `, ${one.group}` : ""}] ${one.state === "live" ? "LIVE" : one.state}${now}\n  ${one.page}`;
+}
+export async function callPublicTool(name, args, options = {}) {
+    try {
+        const all = await stations(options);
+        if (name === "stations_list") {
+            const shown = all.filter((one) => (!args["kind"] || one.kind === args["kind"]) && (!args["group"] || one.group === args["group"]));
+            return say(shown.length ? shown.map(line).join("\n") : "No public stations match.");
+        }
+        if (name === "station_find") {
+            const words = String(args["query"] ?? "").toLowerCase().split(/\s+/).filter(Boolean);
+            if (words.length === 0)
+                return say("Say what to look for.", true);
+            const hay = (one) => [one.name, one.nowPlaying?.title, one.nowPlaying?.artist, one.group, one.kind === "video" ? "tv video" : "radio audio"].join(" ").toLowerCase();
+            const found = all.filter((one) => words.every((word) => hay(one).includes(word)));
+            return say(found.length ? found.map(line).join("\n") : `No public station matches "${String(args["query"])}". stations_list shows them all.`);
+        }
+        if (name === "station_share") {
+            const wanted = String(args["station"] ?? "");
+            const station = all.find((one) => one.page === wanted || one.id === wanted || (wanted && one.page.includes(`/station/${wanted}`)));
+            if (!station)
+                return say("Which station? Pass a link or id from stations_list.", true);
+            const origin = new URL(station.page).origin;
+            const answer = await (options.fetcher ?? fetch)(`${origin}/api/v1/share`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ url: args["url"], basis: args["basis"], note: args["note"] ?? "", by: args["by"] ?? "", agree: args["agree"] === true }),
+                signal: AbortSignal.timeout(20_000),
+            });
+            const body = (await answer.json().catch(() => ({})));
+            if (!answer.ok)
+                return say(`${String(body["error"] ?? `HTTP ${answer.status}`)} (${String(body["code"] ?? answer.status)})`, true);
+            return say(`Shared. It is being fetched and checked now; how it goes: ${origin}${String(body["status"])}`);
+        }
+        return say(`No such tool: ${name}`, true);
+    }
+    catch (error) {
+        return say(`Could not read the station guide: ${error.message}`, true);
+    }
+}

package/dist/mcp.d.ts

@@ -1,6 +1,7 @@
 import { wavOf, type Window } from "./transcribe.ts";
 import { type Described } from "./media-local.ts";
 import { type StationToolOptions } from "./station-mcp.ts";
+import { type PublicToolOptions } from "./directory-mcp.ts";
 export declare const PROTOCOL_VERSION = "2025-06-18";
 interface Request {
     jsonrpc: "2.0";
@@ -16,6 +17,8 @@ interface ToolDefinition {
 export declare const TOOLS: ToolDefinition[];
 export interface McpOptions {
     fetcher?: typeof fetch;
+    /** Where the public station tools read the guide; nixamp.com's by default. */
+    guide?: PublicToolOptions["guide"];
     /** Where stations are asked; the tests hand in a local daemon. */
     stations?: StationToolOptions;
     /** Injected by the tests; the session on disk otherwise. */

package/dist/mcp.js

@@ -31,6 +31,7 @@ import { describeFile, keepFile } from "./media-local.js";
 import { fileFingerprint, idFrom, languageCode, mediaOfUrl, transcriptIdOf } from "./transcripts.js";
 import { personaLines, readPersona, readVoices, writePersona } from "./profile.js";
 import { STATION_TOOLS, callStationTool, isStationTool } from "./station-mcp.js";
+import { PUBLIC_TOOLS, callPublicTool, isPublicTool } from "./directory-mcp.js";
 import { LIBRARY_TOOLS, callLibraryTool, isLibraryTool } from "./library-mcp.js";
 export const PROTOCOL_VERSION = "2025-06-18";
 const STRING = { type: "string" };
@@ -218,6 +219,7 @@ export const TOOLS = [
         },
     },
     ...STATION_TOOLS,
+    ...PUBLIC_TOOLS,
     ...LIBRARY_TOOLS,
 ];
 function said(line) {
@@ -250,6 +252,14 @@ function describe(row) {
  * pipe, and so the same call is reachable from anywhere else that wants it.
  */
 export async function callTool(name, args, options = {}) {
+    // What is on anywhere: nixamp.com's guide, open to anybody.
+    if (isPublicTool(name)) {
+        return callPublicTool(name, args, {
+            ...(options.guide ? { guide: options.guide } : {}),
+            ...(options.fetcher ? { fetcher: options.fetcher } : {}),
+            ...(options.session?.site ? { site: options.session.site } : {}),
+        });
+    }
     // Stations first: on this machine they need the daemon, not a sign-in.
     if (isStationTool(name) || isLibraryTool(name)) {
         const local = { ...(options.fetcher ? { fetcher: options.fetcher } : {}), ...(options.session !== undefined ? { session: options.session } : {}), ...(options.stations ?? {}) };

package/dist/server.js

@@ -64,7 +64,7 @@ import { handleAiRoutes, isPublicSharePath } from "./ai-routes.js";
 import { AiRadio } from "./ai-radio.js";
 import { ListenerShares } from "./listener-shares.js";
 import { STATION_APP_CSP, STATION_PAGE, STATION_PAGE_CSP, STATION_PAGE_HTML } from "./station-page.js";
-import { GUIDE_CSP, guideHosts, PeerGuides, renderGuide } from "./station-guide.js";
+import { GUIDE_CSP, guideHosts, guidePeers, peerBase, PeerGuides, renderGuide } from "./station-guide.js";
 import { StationRunner } from "./station-runner.js";
 import { StationError, StationStore, channelOf, stationOfChannel } from "./stations.js";
 import { STATION_CONTROL_LIMIT, StationUsage, limitsFromEnv } from "./station-metering.js";
@@ -103,6 +103,7 @@ import { LANGUAGES, Translator } from "./translate.js";
 import { StoredTranslations } from "./translate-jobs.js";
 import { Transcripts, fileFingerprint, formatOf, idFrom, languageCode, linesFrom, mediaOfLive, mediaOfUrl, toSrt, toText, toVtt, transcriptIdOf, wire, } from "./transcripts.js";
 import { handleMessage as mcpMessage } from "./mcp.js";
+import { PUBLIC_TOOLS, callPublicTool, isPublicTool } from "./directory-mcp.js";
 import { Media, factsFromRequest, holderFrom, mediaId, openFileListing, openFileOf } from "./media.js";
 import { mediaPage } from "./media-page.js";
 import { describeFile, refreshChanged } from "./media-local.js";
@@ -2158,6 +2159,8 @@ export function createHandler(engine, options) {
             !isStationListenPath(path) &&
             // Sharing a track and reporting one are for anybody the guide reaches.
             !isPublicSharePath(path) &&
+            // What is on, as MCP, for anybody.
+            path !== "/mcp/public" &&
             !STATION_PAGE.test(path) &&
             !isPublicAsset &&
             !isGuidePage &&
@@ -2233,7 +2236,7 @@ export function createHandler(engine, options) {
             });
             const own = new Set(entries.map((one) => one.page));
             const others = options.stations.peers ? (await options.stations.peers.entries()).filter((one) => !own.has(one.page)) : [];
-            const page = renderGuide([...entries, ...others]);
+            const page = renderGuide([...entries, ...others], options.stations.publicBase?.() ?? "");
             response.writeHead(200, {
                 "content-type": "text/html; charset=utf-8",
                 "cache-control": "no-cache",
@@ -3440,6 +3443,77 @@ export function createHandler(engine, options) {
          * GET: nothing here has to be pushed, so a client is told so and gets
          * on with POST.
          */
+        /*
+         * nixamp.com/mcp/public: what is on, anywhere, for any agent with no
+         * account. /mcp stays a 401 without a token, because that 401 is how an
+         * MCP client finds out it should sign in (OAuth discovery).
+         */
+        if (path === "/mcp/public" && options.stations) {
+            if (request.method === "OPTIONS") {
+                response.writeHead(204, CORS);
+                response.end();
+                return;
+            }
+            if (request.method !== "POST") {
+                json(response, 405, { error: "POST a JSON-RPC message" });
+                return;
+            }
+            const stationGuide = async () => {
+                if (!options.stations)
+                    return [];
+                const own = guideEntries({
+                    store: options.stations.store, runner: options.stations.runner, channels: options.channels, canControl: false, account: "",
+                    select: () => null, trackFor: (file) => trackFor(engine, file), base: options.site ?? "", publicBase: options.stations.publicBase?.() ?? "",
+                    json, readBody, headers: CORS,
+                });
+                const shown = new Set(own.map((one) => one.page));
+                const others = options.stations.peers ? (await options.stations.peers.entries()).filter((one) => !shown.has(one.page)) : [];
+                return [...own, ...others];
+            };
+            let parsed;
+            try {
+                parsed = JSON.parse(await readBody(request, 256 * 1024));
+            }
+            catch {
+                json(response, 400, { jsonrpc: "2.0", id: null, error: { code: -32700, message: "parse error" } });
+                return;
+            }
+            const messages = (Array.isArray(parsed) ? parsed : [parsed]);
+            const answers = [];
+            for (const message of messages) {
+                const id = message?.id ?? null;
+                const method = typeof message?.method === "string" ? message.method : "";
+                if (method.startsWith("notifications/"))
+                    continue;
+                if (method === "initialize") {
+                    answers.push({ jsonrpc: "2.0", id, result: {
+                            protocolVersion: message.params?.["protocolVersion"] ?? "2025-06-18",
+                            capabilities: { tools: { listChanged: false } },
+                            serverInfo: { name: "nixamp", title: "nixamp: every public radio and TV station", version: "2" },
+                            instructions: "Find what is on across every nixamp server (stations_list, station_find) and share a track to a station's server (station_share). Sign in (a nixamp token as the bearer, or OAuth) for watch parties, rooms, transcripts and managing your own stations.",
+                        } });
+                }
+                else if (method === "ping") {
+                    answers.push({ jsonrpc: "2.0", id, result: {} });
+                }
+                else if (method === "tools/list") {
+                    answers.push({ jsonrpc: "2.0", id, result: { tools: PUBLIC_TOOLS } });
+                }
+                else if (method === "tools/call" && isPublicTool(String(message.params?.["name"] ?? ""))) {
+                    answers.push({ jsonrpc: "2.0", id, result: await callPublicTool(String(message.params["name"]), (message.params?.["arguments"] ?? {}), { guide: stationGuide }) });
+                }
+                else {
+                    answers.push({ jsonrpc: "2.0", id, error: { code: -32001, message: "only the station tools are public; for the rest use /mcp with a nixamp token as the bearer (`nixamp token create`), or OAuth" } });
+                }
+            }
+            if (answers.length === 0) {
+                response.writeHead(202, CORS);
+                response.end();
+                return;
+            }
+            json(response, 200, Array.isArray(parsed) ? answers : answers[0]);
+            return;
+        }
         if (path === "/mcp" && options.accounts && options.site) {
             if (request.method === "GET") {
                 response.writeHead(405, { ...CORS, allow: "POST, DELETE" });
@@ -3457,6 +3531,18 @@ export function createHandler(engine, options) {
             }
             const token = tokenFrom(request.headers);
             const who = await options.accounts.whoIs(token);
+            const stationGuide = async () => {
+                if (!options.stations)
+                    return [];
+                const own = guideEntries({
+                    store: options.stations.store, runner: options.stations.runner, channels: options.channels, canControl: false, account: "",
+                    select: () => null, trackFor: (file) => trackFor(engine, file), base: options.site ?? "", publicBase: options.stations.publicBase?.() ?? "",
+                    json, readBody, headers: CORS,
+                });
+                const shown = new Set(own.map((one) => one.page));
+                const others = options.stations.peers ? (await options.stations.peers.entries()).filter((one) => !shown.has(one.page)) : [];
+                return [...own, ...others];
+            };
             if (who === null) {
                 const error = JSON.stringify({ error: "sign in: a nixamp token as the bearer (`nixamp token create`), or OAuth" });
                 response.writeHead(401, {
@@ -3484,7 +3570,7 @@ export function createHandler(engine, options) {
                     answers.push({ jsonrpc: "2.0", id: null, error: { code: -32600, message: "invalid request" } });
                     continue;
                 }
-                const answer = await mcpMessage(message, { session, fetcher: fetch });
+                const answer = await mcpMessage(message, { session, fetcher: fetch, guide: stationGuide });
                 if (answer)
                     answers.push(answer);
             }
@@ -6353,7 +6439,13 @@ export async function serve(argv, version = "0.1.0") {
         trustedProxies: () => new Set([...(process.env["NIXAMP_TRUSTED_PROXIES"] ?? "").split(","), ...(readConfig().trustedProxies ?? [])].map((one) => one.trim()).filter(Boolean)),
         // Known once the server has worked out its addresses, after it is listening.
         publicBase: () => (publishable_?.url ?? "").replace(/\/+$/, ""),
-        peers: new PeerGuides(),
+        // Other servers' guides: the configured peers, and on a directory
+        // (nixamp.com) every server listed in it, so its guide is every public
+        // station anywhere.
+        peers: new PeerGuides(() => {
+            const listed = directory ? directory.list().map((one) => peerBase(one.url)).filter(Boolean).slice(0, 100) : [];
+            return [...new Set([...guidePeers(), ...listed])];
+        }),
     };
     // Music handed over from BitTorrented, copied into a folder of our own.
     const importer = new Importer(join(stateDir(), `handoffs-${options.port}.json`), {

package/dist/station-guide.d.ts

@@ -18,8 +18,8 @@ export interface GuideEntry {
  * gateway that cannot run its script against this server (the Moshpit's
  * /n/<name>), and for a crawler. Everything from a station is escaped.
  */
-export declare function renderGuide(entries: GuideEntry[]): string;
-export declare const GUIDE_HTML = "<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Live \u00B7 stations</title>\n<meta name=\"description\" content=\"Radio and TV stations, live now: AI-composed music, tracks shared by listeners, and more.\">\n<link rel=\"icon\" href=\"data:,\">\n<style>\n:root{--bg:#f6f5f2;--fg:#17171a;--muted:#5d5d66;--card:#fff;--line:#dedcd6;--accent:#1f6feb;--live:#0b7a3b;--warn:#a1460b}\n@media (prefers-color-scheme:dark){:root{--bg:#121214;--fg:#ececf1;--muted:#a4a4b0;--card:#1c1c20;--line:#2c2c33;--accent:#6aa7ff;--live:#3fbf7f;--warn:#f0a35e}}\n*{box-sizing:border-box}html,body{margin:0;background:var(--bg);color:var(--fg);font:16px/1.5 system-ui,-apple-system,\"Segoe UI\",sans-serif}\nmain{max-width:880px;margin:0 auto;padding:40px 16px}\nh1{margin:0 0 4px;font-size:1.8rem}p.lead{color:var(--muted);margin:0 0 24px}\nh2{font-size:1rem;letter-spacing:.06em;text-transform:uppercase;color:var(--muted);margin:28px 0 10px}\n.grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(240px,1fr));gap:12px}\n.card{background:var(--card);border:1px solid var(--line);border-radius:14px;padding:16px;position:relative}\n.card:hover,.card:focus-within{border-color:var(--accent)}\na.station{color:inherit;text-decoration:none;display:block}a.station:focus-visible{outline:2px solid var(--accent);outline-offset:4px;border-radius:6px}\n.name{font-weight:700;font-size:1.05rem}.now{color:var(--muted);font-size:.9rem;margin-top:6px;min-height:1.4em}\n.live{color:var(--live);font-size:.8rem;font-weight:700}.empty{color:var(--muted)}\nbutton.report{margin-top:10px;background:none;border:0;padding:0;color:var(--muted);font:inherit;font-size:.8rem;text-decoration:underline;cursor:pointer}\nbutton.report:hover{color:var(--warn)}\n#share{background:var(--card);border:1px solid var(--line);border-radius:14px;padding:16px;margin-top:12px}\n#share label{display:block;font-size:.9rem;margin:10px 0 4px;color:var(--muted)}\n#share input[type=url],#share input[type=text],#share select{width:100%;padding:9px 10px;border:1px solid var(--line);border-radius:8px;background:var(--bg);color:var(--fg);font:inherit}\n#share .agree{display:flex;gap:8px;align-items:flex-start;color:var(--fg);margin-top:12px}\n#share button[type=submit]{margin-top:14px;background:var(--accent);color:#fff;border:0;border-radius:8px;padding:10px 16px;font:inherit;font-weight:600;cursor:pointer}\n#share .or{color:var(--muted);font-size:.85rem;margin:8px 0 0}\n#status{margin-top:10px;font-size:.9rem;min-height:1.4em}\nfooter{margin-top:40px;color:var(--muted);font-size:.85rem}footer a{color:inherit}\n</style>\n</head>\n<body>\n<main>\n  <h1>Live</h1>\n  <p class=\"lead\">Radio and TV, on the air now. Pick one and press play.</p>\n  <h2 id=\"ai-title\" hidden>AI Radio</h2>\n  <div id=\"ai\" class=\"grid\" aria-live=\"polite\"></div>\n  <h2 id=\"shared-title\" hidden>Shared by listeners</h2>\n  <div id=\"shared\" class=\"grid\" aria-live=\"polite\"></div>\n  <h2 id=\"radio-title\" hidden>Radio</h2>\n  <div id=\"radio\" class=\"grid\" aria-live=\"polite\"></div>\n  <h2 id=\"tv-title\" hidden>TV</h2>\n  <div id=\"tv\" class=\"grid\" aria-live=\"polite\"></div>\n  <p id=\"empty\" class=\"empty\">Nothing is on the air here yet.</p>\n  <h2 id=\"share-title\" hidden>Share a track</h2>\n  <form id=\"share\" hidden>\n    <label for=\"url\">A link to an MP3</label>\n    <input id=\"url\" name=\"url\" type=\"url\" placeholder=\"https://example.com/my-song.mp3\" inputmode=\"url\">\n    <p class=\"or\">or upload one (up to <span id=\"max\">60 MB</span>)</p>\n    <input id=\"file\" name=\"file\" type=\"file\" accept=\"audio/*,.mp3,.ogg,.flac,.m4a,.wav\">\n    <label for=\"basis\">Why it may be broadcast</label>\n    <select id=\"basis\" name=\"basis\" required>\n      <option value=\"owned\">I made it</option>\n      <option value=\"permission\">I have the artist's permission</option>\n      <option value=\"licensed\">It is licensed for broadcast</option>\n      <option value=\"creative-commons\">It is Creative Commons (allows sharing)</option>\n      <option value=\"public-domain\">It is in the public domain</option>\n    </select>\n    <label for=\"note\">Anything we should know (licence, link to the artist)</label>\n    <input id=\"note\" name=\"note\" type=\"text\" maxlength=\"300\">\n    <label for=\"by\">Credit me as (optional)</label>\n    <input id=\"by\" name=\"by\" type=\"text\" maxlength=\"60\">\n    <label class=\"agree\"><input type=\"checkbox\" name=\"agree\" value=\"1\"> I have the right to share this for broadcast here. AI files it under a genre and checks it before it airs; anything can be reported off the air.</label>\n    <button type=\"submit\">Share it</button>\n    <div id=\"status\" role=\"status\" aria-live=\"polite\"></div>\n  </form>\n  <footer>Played by <a href=\"https://nixamp.com\">nixamp</a>, on the Moshpit.</footer>\n</main>\n<script>\n(async () => {\n  const el = (tag, cls, text) => { const n = document.createElement(tag); if (cls) n.className = cls; if (text) n.textContent = text; return n; };\n  const say = (text) => { document.querySelector(\"#status\").textContent = text; };\n  const report = async (id, button) => {\n    if (!confirm(\"Report the track playing now? It comes off the air until the owner looks at it.\")) return;\n    button.disabled = true;\n    try {\n      const r = await fetch(\"/api/v1/share/report\", { method: \"POST\", headers: { \"content-type\": \"application/json\" }, body: JSON.stringify({ station: id }) });\n      const body = await r.json();\n      button.textContent = body.reported ? \"Reported: off the air\" : \"Nothing shared is playing\";\n    } catch { button.textContent = \"Could not report; try again\"; button.disabled = false; }\n  };\n  const draw = (stations) => {\n    for (const group of [\"ai\", \"shared\", \"radio\", \"tv\"]) {\n      const grid = document.querySelector(\"#\" + group);\n      grid.replaceChildren();\n      const list = stations.filter((s) => (s.group || (s.kind === \"video\" ? \"tv\" : \"radio\")) === group);\n      document.querySelector(\"#\" + group + \"-title\").hidden = list.length === 0;\n      for (const s of list) {\n        const card = el(\"div\", \"card\");\n        const a = el(\"a\", \"station\");\n        a.href = s.page;\n        a.append(el(\"div\", \"live\", s.state === \"live\" ? \"\u25CF LIVE\" : \"off the air\"), el(\"div\", \"name\", s.name),\n          el(\"div\", \"now\", s.nowPlaying ? [s.nowPlaying.title, s.nowPlaying.artist].filter(Boolean).join(\" \u2014 \") : \"\"));\n        card.append(a);\n        if (group === \"shared\" && !s.peer) {\n          const b = el(\"button\", \"report\", \"Report this track\");\n          b.type = \"button\";\n          b.addEventListener(\"click\", () => report(s.id, b));\n          card.append(b);\n        }\n        grid.append(card);\n      }\n    }\n    document.querySelector(\"#empty\").hidden = stations.length > 0;\n  };\n  const load = async () => {\n    try {\n      const r = await fetch(\"/api/v1/stations/guide\", { cache: \"no-store\" });\n      if (r.ok && (r.headers.get(\"content-type\") || \"\").includes(\"json\")) draw((await r.json()).stations);\n    } catch {}\n  };\n  const watch = async (status) => {\n    for (let i = 0; i < 120; i++) {\n      await new Promise((done) => setTimeout(done, 3000));\n      try {\n        const share = (await (await fetch(status, { cache: \"no-store\" })).json()).share;\n        if (!share) return;\n        const words = { fetching: \"Fetching it\u2026\", checking: \"Listening to it and checking it\u2026\", held: \"Waiting for the owner to look at it\", approved: \"On the air\", rejected: \"Not accepted\", failed: \"Could not use it\", withdrawn: \"Withdrawn\", reported: \"Reported\" };\n        say((words[share.state] || share.state) + (share.genre ? \" \u00B7 \" + share.genre : \"\") + (share.reason ? \" \u2014 \" + share.reason : \"\"));\n        if (![\"fetching\", \"checking\"].includes(share.state)) { load(); return; }\n      } catch {}\n    }\n  };\n  const form = document.querySelector(\"#share\");\n  try {\n    const info = await (await fetch(\"/api/v1/share\", { cache: \"no-store\" })).json();\n    if (info.open) {\n      document.querySelector(\"#share-title\").hidden = false;\n      form.hidden = false;\n      document.querySelector(\"#max\").textContent = info.maxMb + \" MB\";\n    }\n  } catch {}\n  form.addEventListener(\"submit\", async (event) => {\n    event.preventDefault();\n    const data = new FormData(form);\n    const file = data.get(\"file\");\n    const link = String(data.get(\"url\") || \"\").trim();\n    const fields = { basis: String(data.get(\"basis\") || \"\"), note: String(data.get(\"note\") || \"\"), by: String(data.get(\"by\") || \"\"), agree: data.get(\"agree\") ? \"1\" : \"\" };\n    if (!fields.agree) { say(\"Tick the box to confirm you have the right to share it.\"); return; }\n    if (!link && !(file && file.size)) { say(\"Paste a link to an MP3, or choose a file.\"); return; }\n    say(file && file.size && !link ? \"Uploading\u2026\" : \"Sending\u2026\");\n    try {\n      const r = file && file.size && !link\n        ? await fetch(\"/api/v1/share/upload?\" + new URLSearchParams({ ...fields, name: file.name }), { method: \"PUT\", headers: { \"content-type\": file.type || \"audio/mpeg\" }, body: file })\n        : await fetch(\"/api/v1/share\", { method: \"POST\", headers: { \"content-type\": \"application/json\" }, body: JSON.stringify({ ...fields, agree: true, url: link }) });\n      const body = await r.json();\n      if (!r.ok) { say(body.error || \"That did not work.\"); return; }\n      form.reset();\n      say(\"Got it. Checking it now\u2026\");\n      watch(body.status);\n    } catch { say(\"Could not reach the station; try again.\"); }\n  });\n  await load();\n  setInterval(load, 15000);\n})();\n</script>\n</body>\n</html>\n";
+export declare function renderGuide(entries: GuideEntry[], apiBase?: string): string;
+export declare const GUIDE_HTML = "<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Live \u00B7 stations</title>\n<meta name=\"description\" content=\"Radio and TV stations, live now: AI-composed music, tracks shared by listeners, and more.\">\n<link rel=\"icon\" href=\"data:,\">\n<style>\n:root{--bg:#f6f5f2;--fg:#17171a;--muted:#5d5d66;--card:#fff;--line:#dedcd6;--accent:#1f6feb;--live:#0b7a3b;--warn:#a1460b}\n@media (prefers-color-scheme:dark){:root{--bg:#121214;--fg:#ececf1;--muted:#a4a4b0;--card:#1c1c20;--line:#2c2c33;--accent:#6aa7ff;--live:#3fbf7f;--warn:#f0a35e}}\n*{box-sizing:border-box}html,body{margin:0;background:var(--bg);color:var(--fg);font:16px/1.5 system-ui,-apple-system,\"Segoe UI\",sans-serif}\nmain{max-width:880px;margin:0 auto;padding:40px 16px}\nh1{margin:0 0 4px;font-size:1.8rem}p.lead{color:var(--muted);margin:0 0 24px}\nh2{font-size:1rem;letter-spacing:.06em;text-transform:uppercase;color:var(--muted);margin:28px 0 10px}\n.grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(240px,1fr));gap:12px}\n.card{background:var(--card);border:1px solid var(--line);border-radius:14px;padding:16px;position:relative}\n.card:hover,.card:focus-within{border-color:var(--accent)}\na.station{color:inherit;text-decoration:none;display:block}a.station:focus-visible{outline:2px solid var(--accent);outline-offset:4px;border-radius:6px}\n.name{font-weight:700;font-size:1.05rem}.now{color:var(--muted);font-size:.9rem;margin-top:6px;min-height:1.4em}\n.live{color:var(--live);font-size:.8rem;font-weight:700}.empty{color:var(--muted)}\nbutton.report{margin-top:10px;background:none;border:0;padding:0;color:var(--muted);font:inherit;font-size:.8rem;text-decoration:underline;cursor:pointer}\nbutton.report:hover{color:var(--warn)}\n#share{background:var(--card);border:1px solid var(--line);border-radius:14px;padding:16px;margin-top:12px}\n#share label{display:block;font-size:.9rem;margin:10px 0 4px;color:var(--muted)}\n#share input[type=url],#share input[type=text],#share select{width:100%;padding:9px 10px;border:1px solid var(--line);border-radius:8px;background:var(--bg);color:var(--fg);font:inherit}\n#share .agree{display:flex;gap:8px;align-items:flex-start;color:var(--fg);margin-top:12px}\n#share button[type=submit]{margin-top:14px;background:var(--accent);color:#fff;border:0;border-radius:8px;padding:10px 16px;font:inherit;font-weight:600;cursor:pointer}\n#share .or{color:var(--muted);font-size:.85rem;margin:8px 0 0}\n#status{margin-top:10px;font-size:.9rem;min-height:1.4em}\nfooter{margin-top:40px;color:var(--muted);font-size:.85rem}footer a{color:inherit}\n</style>\n</head>\n<body>\n<main>\n  <h1>Live</h1>\n  <p class=\"lead\">Radio and TV, on the air now. Pick one and press play.</p>\n  <h2 id=\"ai-title\" hidden>AI Radio</h2>\n  <div id=\"ai\" class=\"grid\" aria-live=\"polite\"></div>\n  <h2 id=\"shared-title\" hidden>Shared by listeners</h2>\n  <div id=\"shared\" class=\"grid\" aria-live=\"polite\"></div>\n  <h2 id=\"radio-title\" hidden>Radio</h2>\n  <div id=\"radio\" class=\"grid\" aria-live=\"polite\"></div>\n  <h2 id=\"tv-title\" hidden>TV</h2>\n  <div id=\"tv\" class=\"grid\" aria-live=\"polite\"></div>\n  <p id=\"empty\" class=\"empty\">Nothing is on the air here yet.</p>\n  <h2 id=\"share-title\" hidden>Share a track</h2>\n  <form id=\"share\" hidden>\n    <label for=\"url\">A link to an MP3</label>\n    <input id=\"url\" name=\"url\" type=\"url\" placeholder=\"https://example.com/my-song.mp3\" inputmode=\"url\">\n    <p class=\"or\">or upload one (up to <span id=\"max\">60 MB</span>)</p>\n    <input id=\"file\" name=\"file\" type=\"file\" accept=\"audio/*,.mp3,.ogg,.flac,.m4a,.wav\">\n    <label for=\"basis\">Why it may be broadcast</label>\n    <select id=\"basis\" name=\"basis\" required>\n      <option value=\"owned\">I made it</option>\n      <option value=\"permission\">I have the artist's permission</option>\n      <option value=\"licensed\">It is licensed for broadcast</option>\n      <option value=\"creative-commons\">It is Creative Commons (allows sharing)</option>\n      <option value=\"public-domain\">It is in the public domain</option>\n    </select>\n    <label for=\"note\">Anything we should know (licence, link to the artist)</label>\n    <input id=\"note\" name=\"note\" type=\"text\" maxlength=\"300\">\n    <label for=\"by\">Credit me as (optional)</label>\n    <input id=\"by\" name=\"by\" type=\"text\" maxlength=\"60\">\n    <label class=\"agree\"><input type=\"checkbox\" name=\"agree\" value=\"1\"> I have the right to share this for broadcast here. AI files it under a genre and checks it before it airs; anything can be reported off the air.</label>\n    <button type=\"submit\">Share it</button>\n    <div id=\"status\" role=\"status\" aria-live=\"polite\"></div>\n  </form>\n  <footer>Played by <a href=\"https://nixamp.com\">nixamp</a>, on the Moshpit.</footer>\n</main>\n<script>\n(async () => {\n  const el = (tag, cls, text) => { const n = document.createElement(tag); if (cls) n.className = cls; if (text) n.textContent = text; return n; };\n  const say = (text) => { document.querySelector(\"#status\").textContent = text; };\n  // This server's own address: through a gateway (pit.moshcode.sh/n/...) the\n  // page's origin is not the server's, and a relative fetch would ask the gateway.\n  const API = document.body.dataset.api || \"\";\n  const report = async (s, button) => {\n    // Click twice: a sandboxed page (the gateway's) cannot open confirm().\n    if (button.dataset.armed !== \"1\") { button.dataset.armed = \"1\"; button.textContent = \"Click again to take it off the air\"; return; }\n    button.disabled = true;\n    try {\n      const r = await fetch(new URL(s.page).origin + \"/api/v1/share/report\", { method: \"POST\", headers: { \"content-type\": \"application/json\" }, body: JSON.stringify({ station: s.id }) });\n      const body = await r.json();\n      button.textContent = body.reported ? \"Reported: off the air\" : \"Nothing shared is playing\";\n    } catch { button.textContent = \"Could not report; try again\"; button.disabled = false; }\n  };\n  const draw = (stations) => {\n    for (const group of [\"ai\", \"shared\", \"radio\", \"tv\"]) {\n      const grid = document.querySelector(\"#\" + group);\n      grid.replaceChildren();\n      const list = stations.filter((s) => (s.group || (s.kind === \"video\" ? \"tv\" : \"radio\")) === group);\n      document.querySelector(\"#\" + group + \"-title\").hidden = list.length === 0;\n      for (const s of list) {\n        const card = el(\"div\", \"card\");\n        const a = el(\"a\", \"station\");\n        a.href = s.page;\n        a.append(el(\"div\", \"live\", s.state === \"live\" ? \"\u25CF LIVE\" : \"off the air\"), el(\"div\", \"name\", s.name),\n          el(\"div\", \"now\", s.nowPlaying ? [s.nowPlaying.title, s.nowPlaying.artist].filter(Boolean).join(\" \u2014 \") : \"\"));\n        card.append(a);\n        if (group === \"shared\") {\n          const b = el(\"button\", \"report\", \"Report this track\");\n          b.type = \"button\";\n          b.addEventListener(\"click\", () => report(s, b));\n          card.append(b);\n        }\n        grid.append(card);\n      }\n    }\n    document.querySelector(\"#empty\").hidden = stations.length > 0;\n  };\n  const load = async () => {\n    try {\n      const r = await fetch(API + \"/api/v1/stations/guide\", { cache: \"no-store\" });\n      if (r.ok && (r.headers.get(\"content-type\") || \"\").includes(\"json\")) draw((await r.json()).stations);\n    } catch {}\n  };\n  const watch = async (status) => {\n    for (let i = 0; i < 120; i++) {\n      await new Promise((done) => setTimeout(done, 3000));\n      try {\n        const share = (await (await fetch(API + status, { cache: \"no-store\" })).json()).share;\n        if (!share) return;\n        const words = { fetching: \"Fetching it\u2026\", checking: \"Listening to it and checking it\u2026\", held: \"Waiting for the owner to look at it\", approved: \"On the air\", rejected: \"Not accepted\", failed: \"Could not use it\", withdrawn: \"Withdrawn\", reported: \"Reported\" };\n        say((words[share.state] || share.state) + (share.genre ? \" \u00B7 \" + share.genre : \"\") + (share.reason ? \" \u2014 \" + share.reason : \"\"));\n        if (![\"fetching\", \"checking\"].includes(share.state)) { load(); return; }\n      } catch {}\n    }\n  };\n  const form = document.querySelector(\"#share\");\n  try {\n    const info = await (await fetch(API + \"/api/v1/share\", { cache: \"no-store\" })).json();\n    if (info.open) {\n      document.querySelector(\"#share-title\").hidden = false;\n      form.hidden = false;\n      document.querySelector(\"#max\").textContent = info.maxMb + \" MB\";\n    }\n  } catch {}\n  form.addEventListener(\"submit\", async (event) => {\n    event.preventDefault();\n    const data = new FormData(form);\n    const file = data.get(\"file\");\n    const link = String(data.get(\"url\") || \"\").trim();\n    const fields = { basis: String(data.get(\"basis\") || \"\"), note: String(data.get(\"note\") || \"\"), by: String(data.get(\"by\") || \"\"), agree: data.get(\"agree\") ? \"1\" : \"\" };\n    if (!fields.agree) { say(\"Tick the box to confirm you have the right to share it.\"); return; }\n    if (!link && !(file && file.size)) { say(\"Paste a link to an MP3, or choose a file.\"); return; }\n    say(file && file.size && !link ? \"Uploading\u2026\" : \"Sending\u2026\");\n    try {\n      const r = file && file.size && !link\n        ? await fetch(API + \"/api/v1/share/upload?\" + new URLSearchParams({ ...fields, name: file.name }), { method: \"PUT\", headers: { \"content-type\": file.type || \"audio/mpeg\" }, body: file })\n        : await fetch(API + \"/api/v1/share\", { method: \"POST\", headers: { \"content-type\": \"application/json\" }, body: JSON.stringify({ ...fields, agree: true, url: link }) });\n      const body = await r.json();\n      if (!r.ok) { say(body.error || \"That did not work.\"); return; }\n      form.reset();\n      say(\"Got it. Checking it now\u2026\");\n      watch(body.status);\n    } catch { say(\"Could not reach the station; try again.\"); }\n  });\n  await load();\n  setInterval(load, 15000);\n})();\n</script>\n</body>\n</html>\n";
 export declare const GUIDE_CSP: string;
 /**
  * The hosts whose front page is the guide: `guideHosts` in config.json

package/dist/station-guide.js

@@ -36,11 +36,15 @@ const SCRIPT = `
 (async () => {
   const el = (tag, cls, text) => { const n = document.createElement(tag); if (cls) n.className = cls; if (text) n.textContent = text; return n; };
   const say = (text) => { document.querySelector("#status").textContent = text; };
-  const report = async (id, button) => {
-    if (!confirm("Report the track playing now? It comes off the air until the owner looks at it.")) return;
+  // This server's own address: through a gateway (pit.moshcode.sh/n/...) the
+  // page's origin is not the server's, and a relative fetch would ask the gateway.
+  const API = document.body.dataset.api || "";
+  const report = async (s, button) => {
+    // Click twice: a sandboxed page (the gateway's) cannot open confirm().
+    if (button.dataset.armed !== "1") { button.dataset.armed = "1"; button.textContent = "Click again to take it off the air"; return; }
     button.disabled = true;
     try {
-      const r = await fetch("/api/v1/share/report", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ station: id }) });
+      const r = await fetch(new URL(s.page).origin + "/api/v1/share/report", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ station: s.id }) });
       const body = await r.json();
       button.textContent = body.reported ? "Reported: off the air" : "Nothing shared is playing";
     } catch { button.textContent = "Could not report; try again"; button.disabled = false; }
@@ -58,10 +62,10 @@ const SCRIPT = `
         a.append(el("div", "live", s.state === "live" ? "● LIVE" : "off the air"), el("div", "name", s.name),
           el("div", "now", s.nowPlaying ? [s.nowPlaying.title, s.nowPlaying.artist].filter(Boolean).join(" — ") : ""));
         card.append(a);
-        if (group === "shared" && !s.peer) {
+        if (group === "shared") {
           const b = el("button", "report", "Report this track");
           b.type = "button";
-          b.addEventListener("click", () => report(s.id, b));
+          b.addEventListener("click", () => report(s, b));
           card.append(b);
         }
         grid.append(card);
@@ -71,7 +75,7 @@ const SCRIPT = `
   };
   const load = async () => {
     try {
-      const r = await fetch("/api/v1/stations/guide", { cache: "no-store" });
+      const r = await fetch(API + "/api/v1/stations/guide", { cache: "no-store" });
       if (r.ok && (r.headers.get("content-type") || "").includes("json")) draw((await r.json()).stations);
     } catch {}
   };
@@ -79,7 +83,7 @@ const SCRIPT = `
     for (let i = 0; i < 120; i++) {
       await new Promise((done) => setTimeout(done, 3000));
       try {
-        const share = (await (await fetch(status, { cache: "no-store" })).json()).share;
+        const share = (await (await fetch(API + status, { cache: "no-store" })).json()).share;
         if (!share) return;
         const words = { fetching: "Fetching it…", checking: "Listening to it and checking it…", held: "Waiting for the owner to look at it", approved: "On the air", rejected: "Not accepted", failed: "Could not use it", withdrawn: "Withdrawn", reported: "Reported" };
         say((words[share.state] || share.state) + (share.genre ? " · " + share.genre : "") + (share.reason ? " — " + share.reason : ""));
@@ -89,7 +93,7 @@ const SCRIPT = `
   };
   const form = document.querySelector("#share");
   try {
-    const info = await (await fetch("/api/v1/share", { cache: "no-store" })).json();
+    const info = await (await fetch(API + "/api/v1/share", { cache: "no-store" })).json();
     if (info.open) {
       document.querySelector("#share-title").hidden = false;
       form.hidden = false;
@@ -107,8 +111,8 @@ const SCRIPT = `
     say(file && file.size && !link ? "Uploading…" : "Sending…");
     try {
       const r = file && file.size && !link
-        ? await fetch("/api/v1/share/upload?" + new URLSearchParams({ ...fields, name: file.name }), { method: "PUT", headers: { "content-type": file.type || "audio/mpeg" }, body: file })
-        : await fetch("/api/v1/share", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ ...fields, agree: true, url: link }) });
+        ? await fetch(API + "/api/v1/share/upload?" + new URLSearchParams({ ...fields, name: file.name }), { method: "PUT", headers: { "content-type": file.type || "audio/mpeg" }, body: file })
+        : await fetch(API + "/api/v1/share", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ ...fields, agree: true, url: link }) });
       const body = await r.json();
       if (!r.ok) { say(body.error || "That did not work."); return; }
       form.reset();
@@ -130,7 +134,7 @@ const GROUPS = ["ai", "shared", "radio", "tv"];
  * gateway that cannot run its script against this server (the Moshpit's
  * /n/<name>), and for a crawler. Everything from a station is escaped.
  */
-export function renderGuide(entries) {
+export function renderGuide(entries, apiBase = "") {
     const groupOf = (one) => one.group ?? (one.kind === "video" ? "tv" : "radio");
     const cards = (group) => entries
         .filter((one) => groupOf(one) === group && /^https?:\/\//.test(one.page))
@@ -143,7 +147,8 @@ export function renderGuide(entries) {
             .replace(`<h2 id="${group}-title" hidden>`, made ? `<h2 id="${group}-title">` : `<h2 id="${group}-title" hidden>`)
             .replace(`<div id="${group}" class="grid" aria-live="polite"></div>`, `<div id="${group}" class="grid" aria-live="polite">${made}</div>`);
     }
-    return page.replace('<p id="empty" class="empty">', entries.length ? '<p id="empty" class="empty" hidden>' : '<p id="empty" class="empty">');
+    const api = /^https:\/\/[^\s"<>]+$/.test(apiBase) ? apiBase.replace(/\/+$/, "") : "";
+    return (page.replace('<p id="empty" class="empty">', entries.length ? '<p id="empty" class="empty" hidden>' : '<p id="empty" class="empty">')).replace("<body>", api ? `<body data-api="${escape(api)}">` : "<body>");
 }
 export const GUIDE_HTML = `<!doctype html>
 <html lang="en">
@@ -197,7 +202,7 @@ export const GUIDE_HTML = `<!doctype html>
 </html>
 `;
 export const GUIDE_CSP = [
-    "default-src 'none'", `script-src ${hash(SCRIPT)}`, `style-src ${hash(STYLE)}`, "connect-src 'self'",
+    "default-src 'none'", `script-src ${hash(SCRIPT)}`, `style-src ${hash(STYLE)}`, "connect-src 'self' https:",
     "img-src 'self' data:", "base-uri 'none'", "form-action 'none'", "frame-ancestors 'none'",
 ].join("; ");
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.38.1",
+  "version": "0.39.0",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",