nixamp 0.39.2 → 0.40.0

package/src/ai-radio.ts

@@ -302,6 +302,15 @@ export class AiRadio {
     return this.stations.get(key);
   }
 
+  /** The track AI radio composed at this path, if it did. */
+  trackAt(file: string): AiTrack | undefined {
+    for (const station of this.stations.values()) {
+      const hit = station.tracks.find((one) => one.file === file);
+      if (hit) return hit;
+    }
+    return undefined;
+  }
+
   /** What the owner sees: the stations, this month's seconds, and why nothing is being made. */
   status(): Record<string, unknown> {
     const month = monthOf(this.now());

package/src/ai-routes.ts

@@ -13,6 +13,7 @@ import { AI_KEY_NAMES, aiKeysSet, saveAiKey, type AiKeyName } from "./ai-keys.ts
 import type { AiRadio } from "./ai-radio.ts";
 import { SHARE_BASES, SHARE_GENRES, ownerShareView, sharerView, type ListenerShares } from "./listener-shares.ts";
 import { StationError } from "./stations.ts";
+import type { HolderStore } from "./track-facts.ts";
 
 const PUBLIC = /^\/api\/v1\/share(?:\/(upload|report|[a-f0-9]{12}))?$/;
 
@@ -24,6 +25,8 @@ export function isPublicSharePath(path: string): boolean {
 export interface AiRoutesContext {
   ai?: AiRadio;
   shares?: ListenerShares;
+  /** The copyright holders the owner registered, for the now-playing card. */
+  holders?: HolderStore;
   canControl: boolean;
   /** Who is asking, for per-sharer limits (an address; hashed before it is kept). */
   caller: string;
@@ -57,7 +60,8 @@ export async function handleAiRoutes(
 ): Promise<boolean> {
   const method = request.method ?? "GET";
   const publicPath = PUBLIC.exec(path);
-  const ownerPath = path === "/api/v1/stations/ai" || path.startsWith("/api/v1/stations/ai/") || path === "/api/v1/stations/shares" || path.startsWith("/api/v1/stations/shares/");
+  const ownerPath = path === "/api/v1/stations/ai" || path.startsWith("/api/v1/stations/ai/") || path === "/api/v1/stations/shares" || path.startsWith("/api/v1/stations/shares/")
+    || path === "/api/v1/stations/holders" || path.startsWith("/api/v1/stations/holders/");
   if (!publicPath && !ownerPath) return false;
   try {
     if (publicPath) {
@@ -114,6 +118,30 @@ export async function handleAiRoutes(
       return true;
     }
 
+    if (path === "/api/v1/stations/holders" || path.startsWith("/api/v1/stations/holders/")) {
+      const holders = ctx.holders;
+      if (!holders) {
+        ctx.json(response, 404, { error: "copyright holders are not kept here", code: "not_found" });
+        return true;
+      }
+      if (path === "/api/v1/stations/holders" && method === "GET") {
+        ctx.json(response, 200, { holders: holders.list() });
+        return true;
+      }
+      if (path === "/api/v1/stations/holders" && method === "POST") {
+        ctx.json(response, 200, { holder: holders.set(await jsonBody(ctx, request)) });
+        return true;
+      }
+      const one = /^\/api\/v1\/stations\/holders\/([a-z0-9-]{1,40})$/.exec(path);
+      if (one && method === "DELETE") {
+        if (!holders.remove(one[1]!)) throw new StationError("not_found", "no such holder", 404);
+        ctx.json(response, 200, { deleted: one[1] });
+        return true;
+      }
+      ctx.json(response, 404, { error: "no such holder route", code: "not_found" });
+      return true;
+    }
+
     if (path === "/api/v1/stations/shares" || path.startsWith("/api/v1/stations/shares/")) {
       const shares = ctx.shares;
       if (!shares) {

package/src/listener-shares.ts

@@ -215,6 +215,11 @@ export class ListenerShares {
     return this.shares.get(id);
   }
 
+  /** The share whose copy is this file, if it is one. */
+  atFile(file: string): Share | undefined {
+    return [...this.shares.values()].find((one) => one.file === file);
+  }
+
   /** The share, if this token is the one its sharer was given. */
   forSharer(id: string, token: string): Share | undefined {
     const share = this.shares.get(id);

package/src/server.ts

@@ -80,6 +80,8 @@ import { handleHandoffs } from "./handoff-routes.ts";
 import { handleAiRoutes, isPublicSharePath } from "./ai-routes.ts";
 import { AiRadio } from "./ai-radio.ts";
 import { ListenerShares } from "./listener-shares.ts";
+import { HolderStore, TagReader, factsFor } from "./track-facts.ts";
+import { SUPPORT_CSP, SUPPORT_PAGE, Support, SupportError, supportHoldersFrom } from "./support.ts";
 import { STATION_APP_CSP, STATION_PAGE, STATION_PAGE_CSP, STATION_PAGE_HTML } from "./station-page.ts";
 import { GUIDE_CSP, guideHosts, guidePeers, peerBase, PeerGuides, renderGuide, type GuideEntry } from "./station-guide.ts";
 import { StationRunner } from "./station-runner.ts";
@@ -1736,6 +1738,10 @@ export interface HandlerOptions {
     ai?: AiRadio;
     /** Tracks anybody may share, sorted onto the air by AI. */
     shares?: ListenerShares;
+    /** What a listener may know about the track on the air. */
+    facts?: (station: Station, file: string) => Promise<import("./track-facts.ts").TrackFacts>;
+    /** Copyright holders, matched to tracks by artist or station. */
+    holders?: import("./track-facts.ts").HolderStore;
     /** Proxies (by address) whose X-Forwarded-For is believed, for per-sharer limits. */
     trustedProxies?: () => Set<string>;
     /** Other servers' public stations, for this guide to list beside its own. */
@@ -1914,6 +1920,8 @@ export interface HandlerOptions {
   speech?: Speech;
   liveVoice?: LiveVoice;
   translationPasses?: TranslationPasses;
+  /** Payments to copyright holders nixamp.com collects for (support.ts). */
+  support?: Support;
   /** Signing secret of nixamp's CoinPay business, for /api/v1/webhooks/coinpay. */
   coinpayWebhookSecret?: string;
   sharedTranslations?: SharedTranslations;
@@ -2687,6 +2695,8 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       !isPublicSharePath(path) &&
       // What is on, as MCP, for anybody.
       path !== "/mcp/public" &&
+      // Supporting a copyright holder is for anybody listening.
+      !/^\/support\/[a-z0-9-]{1,40}$/.test(path) && !/^\/api\/v1\/support\/[a-z0-9-]{1,40}$/.test(path) &&
       // A station's short link, which sends the browser to wherever it plays.
       !/^\/watch\/[a-z0-9]{10}$/.test(path) &&
       !STATION_PAGE.test(path) &&
@@ -2753,6 +2763,50 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
      * in the directory). It sends the browser to the station's own page, on
      * the server that plays it. Nothing private or unlisted is ever found.
      */
+    /* Support a copyright holder: the page, the coins, and a CoinPay checkout. */
+    const supportPage = /^\/support\/([a-z0-9-]{1,40})$/.exec(path);
+    if (supportPage && options.support && (request.method === "GET" || request.method === "HEAD")) {
+      if (!options.support.holder(supportPage[1]!)) {
+        json(response, 404, { error: "nobody by that name is supported here", code: "not_found" });
+        return;
+      }
+      response.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-cache", "content-security-policy": SUPPORT_CSP, "referrer-policy": "no-referrer", "x-content-type-options": "nosniff" });
+      response.end(request.method === "HEAD" ? undefined : SUPPORT_PAGE);
+      return;
+    }
+    const supportApi = /^\/api\/v1\/support\/([a-z0-9-]{1,40})$/.exec(path);
+    if (supportApi && options.support) {
+      const support = options.support;
+      const holder = support.holder(supportApi[1]!);
+      if (!holder) {
+        json(response, 404, { error: "nobody by that name is supported here", code: "not_found" });
+        return;
+      }
+      try {
+        if (request.method === "GET") {
+          const { coins } = support.enabled ? await support.coins() : { coins: [] as string[] };
+          json(response, 200, { id: holder.id, name: holder.name, coins, ...(support.enabled ? {} : { error: "Support payments are not set up here." }) });
+          return;
+        }
+        if (request.method === "POST") {
+          const verdict = guard.check(`support:${callerOf(request.headers, request.socket.remoteAddress, behindProxy)}`, { allowed: 10, windowMs: 60_000 });
+          if (!verdict.ok) {
+            json(response, 429, { error: "too many at once; wait a minute", code: "rate_limited", retryAfter: verdict.retryAfter });
+            return;
+          }
+          let body: Record<string, unknown> = {};
+          try { body = JSON.parse(await readBody(request)) as Record<string, unknown>; } catch { body = {}; }
+          json(response, 200, await support.checkout({ ...body, holder: holder.id }));
+          return;
+        }
+        json(response, 405, { error: "GET or POST", code: "method_not_allowed" });
+      } catch (error) {
+        if (error instanceof SupportError) json(response, error.status, { error: error.message, code: error.code });
+        else json(response, 502, { error: "the payment service did not answer; nothing was charged", code: "provider" });
+      }
+      return;
+    }
+
     const stationShortLink = /^\/watch\/([a-z0-9]{10})$/.exec(path);
     if (stationShortLink && options.stations && (request.method === "GET" || request.method === "HEAD")) {
       const encrypted = (request.socket as { encrypted?: boolean }).encrypted === true;
@@ -2856,7 +2910,7 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       return;
     }
 
-    if (options.stations && (isPublicSharePath(path) || path.startsWith("/api/v1/stations/ai") || path.startsWith("/api/v1/stations/shares"))) {
+    if (options.stations && (isPublicSharePath(path) || path.startsWith("/api/v1/stations/ai") || path.startsWith("/api/v1/stations/shares") || path.startsWith("/api/v1/stations/holders"))) {
       const control = await controlOf();
       // Behind a proxy we trust (dev2 for live.streaming), the sharer is the
       // first address it names; otherwise whoever connected.
@@ -2866,6 +2920,7 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
       const handled = await handleAiRoutes(request, response, path, url, {
         ...(options.stations.ai ? { ai: options.stations.ai } : {}),
         ...(options.stations.shares ? { shares: options.stations.shares } : {}),
+        ...(options.stations.holders ? { holders: options.stations.holders } : {}),
         canControl: control.allowed,
         caller,
         json,
@@ -2916,6 +2971,7 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         ...(options.stations.usage ? { usage: options.stations.usage } : {}),
         ...(options.stations.limits ? { limits: options.stations.limits } : {}),
         ...(options.stations.auto ? { auto: options.stations.auto } : {}),
+        ...(options.stations.facts ? { facts: options.stations.facts } : {}),
         ...(options.stations.peers ? { peers: () => options.stations!.peers!.entries() } : {}),
         throttle: () => {
           const verdict = guard.check(`stations:${control.account || callerOf(request.headers, request.socket.remoteAddress, behindProxy)}`, STATION_CONTROL_LIMIT);
@@ -7006,6 +7062,23 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
   });
   stations.ai = aiRadio;
   stations.shares = listenerShares;
+  // The now-playing card: the file's own tags, where it came from here, and
+  // the copyright holders the owner registered.
+  const tagReader = new TagReader(tools.ffprobe);
+  const holderStore = new HolderStore(HolderStore.fileFor(stateDir(), options.port));
+  stations.holders = holderStore;
+  stations.facts = async (station, file) => {
+    const share = listenerShares.atFile(file);
+    const composed = aiRadio.trackAt(file);
+    return factsFor({
+      station, file,
+      tags: await tagReader.read(file),
+      known: trackFor(engine, file),
+      holders: holderStore.list(),
+      share: share ? { basis: share.rights.basis, note: share.rights.note, by: share.by } : null,
+      aiTrack: composed ? { made: composed.made } : null,
+    });
+  };
   // Channels as HLS, on demand, for Safari on a phone: one ffmpeg copying a
   // channel's fragments into short files while somebody is asking for them.
   // What things are, from nichedb.dev, remembered beside the keys so a
@@ -7138,6 +7211,8 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
   // is temporarily unconfigured. Self-hosters can explicitly sponsor usage.
   const translationPasses = accounts && pool && process.env["NIXAMP_TRANSLATION_BILLING"] !== "off"
     ? new TranslationPasses({ db: pool, key: coinpayKeyFrom(), site: nixampSite }) : undefined;
+  // Payments to the copyright holders nixamp.com collects for, on its own CoinPay business.
+  const supportPayments = accounts ? new Support({ key: coinpayKeyFrom(), site: nixampSite, holders: supportHoldersFrom() }) : undefined;
   if (translationPasses) void translationPasses.access().catch(() => console.error("nixamp: translation checkout could not warm; it will retry on demand"));
   const liveVoice = accounts && process.env["NIXAMP_DUBBING"] !== "off" ? new LiveVoice({
     ...(pool ? { db: pool } : {}),
@@ -7690,6 +7765,7 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     ...(speech ? { speech } : {}),
     ...(liveVoice ? { liveVoice } : {}),
     ...(translationPasses ? { translationPasses } : {}),
+    ...(supportPayments ? { support: supportPayments } : {}),
     ...(process.env["COINPAY_WEBHOOK_SECRET"] ? { coinpayWebhookSecret: process.env["COINPAY_WEBHOOK_SECRET"] } : {}),
     ...(sharedTranslations ? { sharedTranslations } : {}),
     ...(translator ? { translator } : {}),

package/src/station-cli.ts

@@ -253,6 +253,28 @@ export async function station(argv: string[]): Promise<number> {
         return await aiCommand(argv.slice(1), call, show, json);
       case "shares":
         return await sharesCommand(argv.slice(1), call, show);
+      case "holder":
+      case "holders": {
+        const sub = argv[1] ?? "list";
+        const all = (flagName: string): string[] => argv.flatMap((one, at) => (one === flagName && argv[at + 1] ? [argv[at + 1]!] : []));
+        const line = (h: Record<string, unknown>): string =>
+          `${String(h["name"])}  [${String(h["id"])}]\n  artists   ${((h["artists"] as string[]) ?? []).join(", ") || "-"}\n  stations  ${((h["stations"] as string[]) ?? []).join(", ") || "-"}\n  support   ${String(h["support"] || "-")}${h["license"] ? `\n  licence   ${String(h["license"])}` : ""}`;
+        if (sub === "list") return show(await call("GET", "/api/v1/stations/holders"), (body) => ((body["holders"] as Record<string, unknown>[]) ?? []).map(line).join("\n\n") || "No copyright holders yet. nixamp station holder set NAME --artist ARTIST --support URL");
+        if (sub === "remove") return show(await call("DELETE", `/api/v1/stations/holders/${argv[2] ?? ""}`), () => `Removed ${argv[2]}.`);
+        if (sub === "set") {
+          const name = argv[2];
+          if (!name || name.startsWith("--")) { console.error("nixamp station holder set needs a NAME"); return 2; }
+          const body: Record<string, unknown> = { name };
+          if (all("--artist").length) body["artists"] = all("--artist");
+          if (all("--station").length) body["stations"] = all("--station");
+          if (flag(argv, "--support")) body["support"] = flag(argv, "--support");
+          if (flag(argv, "--label")) body["label"] = flag(argv, "--label");
+          if (flag(argv, "--license")) body["license"] = flag(argv, "--license");
+          return show(await call("POST", "/api/v1/stations/holders", body), (answer) => line(answer["holder"] as Record<string, unknown>));
+        }
+        console.error(`nixamp station holder: no command "${sub}".\n\n${USAGE}`);
+        return 2;
+      }
       case "delete": {
         const station = needId();
         if (!station) return 2;

package/src/station-mcp.ts

@@ -123,6 +123,21 @@ export const STATION_TOOLS = [
       },
     },
   },
+  {
+    name: "station_holders",
+    description: "Copyright holders for the now-playing card: who holds a track's copyright (matched by artist name or station) and the link that supports them. action list (default), set (name, artists, stations, support https URL, label, license), remove (id).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        server: SERVER,
+        action: { type: "string", enum: ["list", "set", "remove"] },
+        id: STRING, name: STRING,
+        artists: { type: "array", items: STRING }, stations: { type: "array", items: STRING },
+        support: { ...STRING, description: "https link where listeners subscribe or donate, e.g. https://nixamp.com/support/profullstack" },
+        label: STRING, license: STRING,
+      },
+    },
+  },
   {
     name: "station_unpublish",
     description: "Take a station out of the directory, or make it private: its links stop working and listeners are disconnected.",
@@ -213,6 +228,15 @@ export async function callStationTool(name: string, args: Record<string, unknown
       if (answer === undefined) return say("action is status, create, generate, update, remove, budget or resume", true);
       return answer.ok ? say(JSON.stringify(answer.body, null, 2)) : refused(answer.body);
     }
+    if (name === "station_holders") {
+      const action = String(args["action"] ?? "list");
+      const answer = action === "list" ? await call("GET", "/api/v1/stations/holders")
+        : action === "set" ? await call("POST", "/api/v1/stations/holders", pick(["id", "name", "artists", "stations", "support", "label", "license"]))
+        : action === "remove" && typeof args["id"] === "string" ? await call("DELETE", `/api/v1/stations/holders/${encodeURIComponent(args["id"])}`)
+        : null;
+      if (!answer) return say("action is list, set or remove (remove needs id)", true);
+      return answer.ok ? say(JSON.stringify(answer.body, null, 2)) : refused(answer.body);
+    }
     if (name === "station_shares") {
       const action = String(args["action"] ?? "status");
       const share = typeof args["id"] === "string" && /^[a-f0-9]{12}$/.test(args["id"]) ? args["id"] : "";

package/src/station-routes.ts

@@ -16,12 +16,13 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { Channels } from "./channels.ts";
 import type { StationRunner } from "./station-runner.ts";
 import { alertsFor, type Limits, type StationUsage } from "./station-metering.ts";
+import type { TrackFacts } from "./track-facts.ts";
 import {
   StationError, channelOf, tokensMatch, type OwnerStation, type PublicStation, type Station, type StationStore,
 } from "./stations.ts";
 
 /** The three things a station's link opens. */
-const LISTEN = /^\/api\/v1\/stations\/([a-z0-9]{10})\/(stream|state|listen\.m3u|events)$/;
+const LISTEN = /^\/api\/v1\/stations\/([a-z0-9]{10})\/(stream|state|listen\.m3u|events|now)$/;
 
 /** Whether this path is one a station's own link may open, without the server's key. */
 export function isStationListenPath(path: string): boolean {
@@ -59,6 +60,8 @@ export interface StationContext {
   limits?: Limits;
   /** Null to go ahead with a change, or how long to wait (control rate limit). */
   throttle?: () => { retryAfter: number } | null;
+  /** What a listener may know about the track on the air (track-facts.ts). */
+  facts?: (station: Station, file: string) => Promise<TrackFacts>;
   /** Auto stations: run a sync with these settings (and keep them), or read them. */
   auto?: { sync: (input: Record<string, unknown>) => Promise<unknown>; setting: () => unknown };
   /** The public stations other servers list (guide peers); absent when there are none. */
@@ -210,7 +213,19 @@ export async function handleStations(
         const view = publicView(ctx, station);
         return { station: station.id, playback: `${station.id}:${ctx.channels.info(channelOf(station.id))?.startedAt ?? 0}`, track: `${station.id}:${instance}`, at: Date.now(), state: view.state, nowPlaying: view.nowPlaying };
       };
-      send("hello", now());
+      // Each "now" carries what is known about the track: who made it, AI or
+      // not, whose copyright, how to support them.
+      const withFacts = async (): Promise<Record<string, unknown>> => {
+        const payload = now();
+        const file = nowPlayingFile(ctx, station);
+        if (!ctx.facts || !file) return payload;
+        try {
+          return { ...payload, facts: await ctx.facts(station, file) };
+        } catch {
+          return payload;
+        }
+      };
+      void withFacts().then((payload) => send("hello", payload));
       const tick = setInterval(() => {
         const current = ctx.store.get(station.id);
         if (!current) {
@@ -222,7 +237,7 @@ export async function handleStations(
         if (file !== lastFile) {
           lastFile = file;
           instance += 1;
-          send("now", now());
+          void withFacts().then((payload) => send("now", payload));
         } else if (state !== lastState) {
           send("state", now());
         }
@@ -241,6 +256,11 @@ export async function handleStations(
       response.on("close", leave);
       return true;
     }
+    if (what === "now") {
+      const file = ctx.runner.observed(station.id) === "live" || ctx.runner.observed(station.id) === "recovering" ? nowPlayingFile(ctx, station) : "";
+      ctx.json(response, 200, { station: station.id, facts: file && ctx.facts ? await ctx.facts(station, file).catch(() => null) : null });
+      return true;
+    }
     if (what === "state") {
       ctx.json(response, 200, publicView(ctx, station));
       return true;

package/src/station-usage.ts

@@ -41,6 +41,11 @@ export const USAGE = `nixamp station — make a collection into a station
   nixamp station shares approve|reject|delete SHARE
   nixamp station shares trust ADDRESS [--remove]   believe this proxy's X-Forwarded-For
 
+  Copyright holders (the now-playing card: who holds a track's copyright, and how to support them):
+  nixamp station holder list
+  nixamp station holder set NAME [--artist ARTIST]... [--station ID]... [--support https://...] [--label Subscribe] [--license TEXT]
+  nixamp station holder remove ID
+
   --json        machine-readable output
   --url, --key  another server, as with \`nixamp admin\`
 

package/src/support.ts

@@ -0,0 +1,206 @@
+/**
+ * Support a copyright holder: a payment through nixamp.com's own CoinPay
+ * business, for the holders whose money that business may take.
+ *
+ * A station's now-playing card links a track's holder to their support page.
+ * Holders who collect for themselves register their own link on the station
+ * (`nixamp station holder set NAME --support URL`); this page is for the
+ * holders nixamp.com collects for -- today Profullstack's own music (the
+ * band Þrøngva, AI radio) -- named in NIXAMP_SUPPORT_HOLDERS ("id=Name,...").
+ *
+ * One payment, in crypto, on CoinPay's hosted checkout. CoinPay offers no
+ * crypto subscription a business key can start (its plan/subscribe API is
+ * Stripe's, which we do not use), so "monthly" is not offered rather than
+ * pretended.
+ */
+import { createHash, randomUUID } from "node:crypto";
+
+export interface SupportHolder { id: string; name: string }
+
+export function supportHoldersFrom(env: Record<string, string | undefined> = process.env): SupportHolder[] {
+  const raw = env["NIXAMP_SUPPORT_HOLDERS"] ?? "profullstack=Profullstack";
+  return raw.split(",").map((one) => one.trim()).filter(Boolean).map((one) => {
+    const [id, ...name] = one.split("=");
+    return { id: (id ?? "").trim().toLowerCase(), name: name.join("=").trim() || (id ?? "").trim() };
+  }).filter((one) => /^[a-z0-9-]{1,40}$/.test(one.id));
+}
+
+export const AMOUNTS = [3, 5, 10, 25, 50];
+const MIN_USD = 1;
+const MAX_USD = 1000;
+
+export class SupportError extends Error {
+  constructor(message: string, readonly status = 400, readonly code = "invalid") {
+    super(message);
+  }
+}
+
+export class Support {
+  private merchant: Promise<{ business: string; coins: string[] }> | null = null;
+  private merchantUntil = 0;
+
+  constructor(private readonly options: { key: string; site: string; holders: SupportHolder[]; fetcher?: typeof fetch; now?: () => number }) {}
+
+  holder(id: string): SupportHolder | undefined {
+    return this.options.holders.find((one) => one.id === id.toLowerCase());
+  }
+
+  get enabled(): boolean {
+    return Boolean(this.options.key);
+  }
+
+  private async provider(path: string, init: RequestInit = {}): Promise<Record<string, unknown>> {
+    if (!this.options.key) throw new SupportError("Support payments are not set up here.", 503, "unavailable");
+    const response = await (this.options.fetcher ?? fetch)(`https://coinpayportal.com${path}`, {
+      ...init,
+      signal: AbortSignal.timeout(15_000),
+      headers: { authorization: `Bearer ${this.options.key}`, "content-type": "application/json", ...(init.headers ?? {}) },
+    });
+    const body = (await response.json().catch(() => ({}))) as Record<string, unknown>;
+    if (!response.ok || body["success"] !== true) throw new SupportError("The payment service did not answer; nothing was charged. Try again.", 502, "provider");
+    return body;
+  }
+
+  /** The business and the coins it has a wallet for, asked at most every 10 minutes. */
+  async coins(): Promise<{ business: string; coins: string[] }> {
+    const now = this.options.now?.() ?? Date.now();
+    if (!this.merchant || now >= this.merchantUntil) {
+      this.merchantUntil = now + 600_000;
+      this.merchant = this.provider("/api/supported-coins").then((body) => {
+        const business = String(body["business_id"] ?? "");
+        if (!/^[0-9a-f-]{36}$/.test(business)) throw new SupportError("Support payments are not set up here.", 503, "unavailable");
+        const coins = (Array.isArray(body["coins"]) ? body["coins"] : [])
+          .filter((coin): coin is { symbol: string; is_active: boolean; has_wallet: boolean } => typeof coin === "object" && coin !== null)
+          .filter((coin) => coin.is_active && coin.has_wallet && typeof coin.symbol === "string")
+          .map((coin) => coin.symbol);
+        return { business, coins };
+      }).catch((error: unknown) => { this.merchant = null; throw error; });
+    }
+    return this.merchant;
+  }
+
+  /** A CoinPay checkout for this much, to this holder; the address to send the payer to. */
+  async checkout(input: { holder?: unknown; amountUsd?: unknown; coin?: unknown; station?: unknown; track?: unknown }): Promise<{ url: string }> {
+    const holder = typeof input.holder === "string" ? this.holder(input.holder) : undefined;
+    if (!holder) throw new SupportError("Nobody by that name is supported here.", 404, "not_found");
+    const amount = Number(input.amountUsd);
+    if (!Number.isFinite(amount) || amount < MIN_USD || amount > MAX_USD) throw new SupportError(`Choose an amount from $${MIN_USD} to $${MAX_USD}.`, 400, "invalid_amount");
+    const { business, coins } = await this.coins();
+    const coin = typeof input.coin === "string" ? input.coin.toUpperCase() : "";
+    if (!coins.includes(coin)) throw new SupportError(`Pay with one of: ${coins.join(", ")}.`, 400, "invalid_coin");
+    const clean = (value: unknown): string => (typeof value === "string" ? value.replace(/[\u0000-\u001f]/g, " ").slice(0, 120) : "");
+    const order = randomUUID();
+    const created = await this.provider("/api/payments/create", {
+      method: "POST",
+      headers: { "idempotency-key": `nixamp-support-${order}` },
+      body: JSON.stringify({
+        business_id: business,
+        amount_usd: Math.round(amount * 100) / 100,
+        currency: coin.toLowerCase(),
+        payment_method: "crypto",
+        description: `Support ${holder.name} on nixamp`,
+        metadata: { app: "nixamp", product: "support", holder: holder.id, order, station: clean(input.station), track: clean(input.track) },
+        redirect_url: `${this.options.site}/support/${holder.id}?thanks=1`,
+      }),
+    });
+    const payment = created["payment"] as { id?: unknown } | undefined;
+    const id = typeof payment?.id === "string" ? payment.id : "";
+    if (!/^[A-Za-z0-9_-]{6,80}$/.test(id)) throw new SupportError("The checkout did not start; nothing was charged. Try again.", 502, "provider");
+    return { url: `https://coinpayportal.com/pay/${id}` };
+  }
+}
+
+const STYLE = `
+:root{--bg:#080c09;--fg:#e8efe9;--muted:#9aa79d;--card:#0e1410;--line:#1f2a22;--accent:#3ddc84}
+*{box-sizing:border-box}html,body{margin:0;background:var(--bg);color:var(--fg);font:16px/1.5 system-ui,-apple-system,"Segoe UI",sans-serif}
+main{max-width:520px;margin:0 auto;padding:48px 16px}
+.card{background:var(--card);border:1px solid var(--line);border-radius:16px;padding:24px}
+h1{margin:0 0 6px;font-size:1.5rem}p{color:var(--muted);margin:0 0 18px}
+.amounts{display:flex;flex-wrap:wrap;gap:8px;margin:0 0 14px}
+.amounts button{flex:1 1 64px;padding:10px;border-radius:10px;border:1px solid var(--line);background:transparent;color:var(--fg);font:inherit;font-weight:700;cursor:pointer}
+.amounts button[aria-pressed=true]{border-color:var(--accent);color:var(--accent)}
+label{display:block;color:var(--muted);font-size:.9rem;margin:10px 0 4px}
+input,select{width:100%;padding:10px;border-radius:10px;border:1px solid var(--line);background:var(--bg);color:var(--fg);font:inherit}
+button.go{margin-top:18px;width:100%;padding:12px;border:0;border-radius:999px;background:var(--accent);color:#06120a;font:inherit;font-weight:800;cursor:pointer}
+button:focus-visible,input:focus-visible,select:focus-visible{outline:3px solid var(--accent);outline-offset:2px}
+#status{min-height:1.4em;margin-top:12px;color:var(--muted)}
+.thanks{color:var(--accent);font-weight:700}
+small{display:block;margin-top:18px;color:var(--muted)}small a{color:inherit}
+`;
+
+const SCRIPT = `
+(async () => {
+  const holder = location.pathname.split("/").filter(Boolean)[1] || "";
+  const params = new URLSearchParams(location.search);
+  const $ = (s) => document.querySelector(s);
+  let amount = 5;
+  for (const b of document.querySelectorAll(".amounts button")) {
+    b.addEventListener("click", () => {
+      amount = Number(b.dataset.usd);
+      $("#other").value = "";
+      for (const o of document.querySelectorAll(".amounts button")) o.setAttribute("aria-pressed", String(o === b));
+    });
+  }
+  if (params.get("thanks")) { $("#status").className = "thanks"; $("#status").textContent = "Thank you. Your payment is on its way."; }
+  try {
+    const info = await (await fetch("/api/v1/support/" + encodeURIComponent(holder), { cache: "no-store" })).json();
+    if (info.name) { $("#who").textContent = info.name; document.title = "Support " + info.name + " · nixamp"; }
+    const coins = info.coins || [];
+    $("#coin").replaceChildren(...coins.map((c) => { const o = document.createElement("option"); o.value = c; o.textContent = c.replace(/_/g, " "); return o; }));
+    if (!coins.length) { $("#go").disabled = true; $("#status").textContent = info.error || "Payments are not available right now."; }
+  } catch { $("#status").textContent = "Payments are not available right now."; }
+  $("#form").addEventListener("submit", async (event) => {
+    event.preventDefault();
+    const other = Number($("#other").value);
+    const usd = other > 0 ? other : amount;
+    $("#go").disabled = true;
+    $("#status").textContent = "Starting the checkout…";
+    try {
+      const r = await fetch("/api/v1/support/" + encodeURIComponent(holder), { method: "POST", headers: { "content-type": "application/json" },
+        body: JSON.stringify({ amountUsd: usd, coin: $("#coin").value, station: params.get("station") || "", track: params.get("track") || "" }) });
+      const body = await r.json();
+      if (r.ok && body.url) { location.href = body.url; return; }
+      $("#status").textContent = body.error || "That did not work.";
+    } catch { $("#status").textContent = "Could not reach the payment service."; }
+    $("#go").disabled = false;
+  });
+})();
+`;
+
+const hash = (text: string): string => `'sha256-${createHash("sha256").update(text).digest("base64")}'`;
+
+export const SUPPORT_PAGE = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Support · nixamp</title>
+<link rel="icon" href="/favicon.png">
+<style>${STYLE}</style>
+</head>
+<body>
+<main>
+  <div class="card">
+    <h1>Support <span id="who">the artist</span></h1>
+    <p>Pay the copyright holder of the music you are listening to, directly. One payment, in crypto, through CoinPay.</p>
+    <form id="form">
+      <div class="amounts">${AMOUNTS.map((usd, at) => `<button type="button" data-usd="${usd}" aria-pressed="${at === 1}">$${usd}</button>`).join("")}</div>
+      <label for="other">Or another amount (US$)</label>
+      <input id="other" type="number" min="1" max="1000" step="1" inputmode="numeric">
+      <label for="coin">Pay with</label>
+      <select id="coin"></select>
+      <button id="go" class="go" type="submit">Continue to payment</button>
+      <div id="status" role="status" aria-live="polite"></div>
+    </form>
+    <small>Payments go through <a href="https://coinpayportal.com">CoinPay</a> to nixamp.com, which pays the holder. Nothing recurs.</small>
+  </div>
+</main>
+<script>${SCRIPT}</script>
+</body>
+</html>
+`;
+
+export const SUPPORT_CSP = [
+  "default-src 'none'", `script-src ${hash(SCRIPT)}`, `style-src ${hash(STYLE)}`, "connect-src 'self'",
+  "img-src 'self' data:", "base-uri 'none'", "form-action 'none'", "frame-ancestors 'none'",
+].join("; ");