nixamp 0.7.3 → 0.7.5

package/README.md

@@ -354,8 +354,14 @@ anywhere else with `--url` and `--key`.
 ╰───────────────────────────────────────────────────────────────────────╯
 ```
 
-Press `r` to re-stream: hand the running server a different URL or path and the
-listeners stay connected while what they are hearing changes under them.
+Press `a` to add: hand the running server a folder, an album URL or a file and
+it joins the playlist under its own heading, with the library still there and
+the listeners still connected. Press `r` to replace instead, which is the
+bigger thing — this server now serves that, and the library it had is gone
+until you restart it.
+
+An added block can be taken back out from the playlist itself: its heading
+carries an `×`.
 
 ## How it works
 

package/dist/admin.d.ts

@@ -68,6 +68,8 @@ export interface View {
     error: string;
     typing: boolean;
     restreaming: string;
+    /** Whether what is being typed replaces the playlist rather than joining it. */
+    replacing?: boolean;
     /** Labelled addresses, and the key that makes them work. */
     links: {
         label: string;

package/dist/admin.js

@@ -6,7 +6,7 @@
  * or against a nixamp on a different machine entirely.
  */
 import { createApp, themes } from "@profullstack/hqtui";
-import { daemonUrl, readState } from "./daemon.js";
+import { daemonUrl, isLoopbackTls, readState } from "./daemon.js";
 import { KEY_HEADER } from "./share.js";
 /** Where to point, from the flags or from the daemon that is running. */
 export function resolveTarget(argv) {
@@ -23,8 +23,13 @@ export function resolveTarget(argv) {
     if (state === null) {
         throw new Error("nixamp: no daemon is running. Start one with `nixamp daemon start`, or pass --url.");
     }
+    const url_ = daemonUrl(state);
+    // Talking to our own daemon, whose certificate names somewhere else. Nothing
+    // is in the way on loopback, so there is nothing for a certificate to prove.
+    if (isLoopbackTls(url_))
+        process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = "0";
     return {
-        url: daemonUrl(state),
+        url: url_,
         key: key ?? state.key,
         // A state file written before 0.5.3 has no list; loopback stands in.
         links: state.urls ?? [{ label: "here", url: daemonUrl(state) }],
@@ -105,6 +110,9 @@ export async function admin(argv) {
     let snapshot = null;
     let error = "";
     let restreaming = "";
+    // Which of the two things typing a source means. Adding is the ordinary one
+    // and has its own key; replacing throws the library away, so it has another.
+    let replacing = false;
     let typing = false;
     const app = await createApp({ theme: themes.matrix, title: "nixamp admin", quitKeys: ["ctrl+c"] });
     const refresh = async () => {
@@ -124,13 +132,16 @@ export async function admin(argv) {
             if (key === "escape") {
                 typing = false;
                 restreaming = "";
+                replacing = false;
             }
             else if (key === "enter") {
                 const url = restreaming.trim();
+                const asReplacement = replacing;
                 typing = false;
                 restreaming = "";
+                replacing = false;
                 if (url)
-                    void restream(target, headers, url).then(() => refresh());
+                    void restream(target, headers, url, asReplacement).then(() => refresh());
             }
             else if (key === "backspace")
                 restreaming = restreaming.slice(0, -1);
@@ -143,26 +154,38 @@ export async function admin(argv) {
             app.quit();
             return;
         }
+        if (key === "a") {
+            typing = true;
+            replacing = false;
+            app.invalidate();
+        }
         if (key === "r") {
             typing = true;
+            replacing = true;
             app.invalidate();
         }
     });
     app.on("exit", () => clearInterval(timer));
     app.render(({ ui, theme }) => draw(ui, theme, {
-        url: target.url, report, snapshot, error, typing, restreaming,
+        url: target.url, report, snapshot, error, typing, restreaming, replacing,
         links: target.links, key: target.key, source: target.source,
     }));
     await app.start();
     clearInterval(timer);
 }
-/** Ask the server to play something else, which is what re-streaming is. */
-async function restream(target, headers, url) {
+/**
+ * Hand the server something else to play.
+ *
+ * Two different asks down one route: adding puts an album on the end of the
+ * playlist, replacing points the server somewhere else entirely. The server
+ * adds unless told otherwise, so only the second one says anything.
+ */
+async function restream(target, headers, url, replacing = false) {
     try {
         await fetch(`${target.url}/api/source`, {
             method: "POST",
             headers: { ...headers, "content-type": "application/json" },
-            body: JSON.stringify({ source: url }),
+            body: JSON.stringify({ source: url, ...(replacing ? { replace: true } : {}) }),
         });
     }
     catch {
@@ -244,14 +267,20 @@ export function draw(ui, theme, view) {
         });
     });
     if (view.typing) {
-        ui.panel({ title: "Re-stream a URL or a path", size: 4 }, (p) => {
+        ui.panel({
+            title: view.replacing ? "Replace the playlist with a URL or a path" : "Add a URL or a path",
+            size: 4,
+        }, (p) => {
             p.text(`${view.restreaming}_`, { fg: theme.accent });
-            p.label("Enter plays it here. Escape forgets it.");
+            p.label(view.replacing
+                ? "Enter drops this library and serves that instead. Escape forgets it."
+                : "Enter adds it to the playlist. Escape forgets it.");
         });
     }
     ui.statusBar({
         items: [
-            { key: "r", label: "Re-stream" },
+            { key: "a", label: "Add" },
+            { key: "r", label: "Replace" },
             { key: "q", label: "Quit" },
         ],
         right: [{ key: "", label: report ? `${report.connections.length} seen` : "connecting" }],

package/dist/daemon.d.ts

@@ -48,6 +48,16 @@ export declare function status(): {
 };
 /** The URL an admin client should talk to. */
 export declare function daemonUrl(state: DaemonState): string;
+/**
+ * Whether this address is our own machine over TLS with a certificate that
+ * cannot possibly name it.
+ *
+ * A certificate proves you reached the host you asked for. Asking for loopback
+ * proves that already: nothing is in the way to impersonate. So a daemon with a
+ * certificate for some public name is still reachable at 127.0.0.1, and a
+ * client refusing to talk to it is protecting nobody from anything.
+ */
+export declare function isLoopbackTls(url: string): boolean;
 /**
  * What `nixamp daemon start` and `nixamp daemon status` print, as lines, so it
  * can be tested without starting a daemon.

package/dist/daemon.js

@@ -61,8 +61,37 @@ export function status() {
 }
 /** The URL an admin client should talk to. */
 export function daemonUrl(state) {
+    // A daemon serving https has a certificate for a name, and loopback is not
+    // that name. Asking it for https://localhost fails verification even though
+    // it is the same process on the same machine, which is how turning TLS on
+    // silently broke `nixamp admin` and `nixamp attach`. Prefer the address it
+    // was told to publish, which is the one the certificate is actually for.
+    const told = state.urls?.find((entry) => entry.label === "on the internet" && entry.url.startsWith("https://"));
+    if (told)
+        return told.url;
+    const scheme = state.urls?.[0]?.url.startsWith("https://") ? "https" : "http";
     const host = state.host === "0.0.0.0" || state.host === "::" ? "127.0.0.1" : state.host;
-    return `http://${host.includes(":") ? `[${host}]` : host}:${state.port}`;
+    return `${scheme}://${host.includes(":") ? `[${host}]` : host}:${state.port}`;
+}
+/**
+ * Whether this address is our own machine over TLS with a certificate that
+ * cannot possibly name it.
+ *
+ * A certificate proves you reached the host you asked for. Asking for loopback
+ * proves that already: nothing is in the way to impersonate. So a daemon with a
+ * certificate for some public name is still reachable at 127.0.0.1, and a
+ * client refusing to talk to it is protecting nobody from anything.
+ */
+export function isLoopbackTls(url) {
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol !== "https:")
+            return false;
+        return parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "::1";
+    }
+    catch {
+        return false;
+    }
 }
 /**
  * How long it has been up, as a person would say it. Written here rather than

package/dist/protocol.d.ts

@@ -20,6 +20,14 @@ export interface RemoteTrack {
      * a browser could show played its soundtrack over a blank panel.
      */
     video?: boolean;
+    /**
+     * The source this track came in with, when it was not part of the library.
+     *
+     * Absent means it belongs to whatever this server was started on. Present
+     * means somebody added a folder or an album afterwards, and the name is what
+     * a client puts at the top of that block so the two are not one soup.
+     */
+    group?: string;
 }
 /** Everything a remote needs to draw the player. */
 export interface Snapshot {

package/dist/server.d.ts

@@ -124,6 +124,17 @@ export declare function parseRange(header: string | undefined, size: number): By
  * `..` in a request path is the oldest bug in static file serving.
  */
 export declare function safeJoin(rootDir: string, urlPath: string): string | null;
+/**
+ * A track and the source it arrived with.
+ *
+ * The library a server was started on has no group: it is simply what this
+ * machine has. Anything added afterwards carries the name of the folder or
+ * album it came from, which is what lets a client draw the two apart instead
+ * of running them together.
+ */
+export type Loaded = Track & {
+    group?: string;
+};
 /** What the HTTP layer needs from a player. Tests hand it a fake. */
 export interface Engine {
     /** `withTracks` false leaves the library out, for a frame that is only motion. */
@@ -133,11 +144,29 @@ export interface Engine {
     /** Absolute path of a track, or undefined when the index is not one. */
     trackPath(index: number): string | undefined;
     /**
-     * Play something else instead. Re-streaming is the whole reason the admin
-     * view exists: point a running server at a URL without restarting it and
-     * dropping every listener.
+     * Play something else instead of everything here.
+     *
+     * The big hammer, and no longer what adding a folder does: this is "point
+     * this server somewhere else", which throws the library away on purpose.
      */
     replace(tracks: Track[], root: string): void;
+    /**
+     * Play something as well as everything here.
+     *
+     * What somebody means by putting a folder in a box: the album shows up at
+     * the bottom of the playlist under its own name, and the music that was
+     * already there is still there. Answers how many tracks were new.
+     */
+    add(tracks: Track[], from: string): number;
+    /**
+     * Take an added source back out again, by the name `add` gave it.
+     *
+     * Nothing that came with the library can be dropped this way; the library is
+     * what the server is, and there is a command line for changing that.
+     */
+    drop(group: string): number;
+    /** Every added source, in the order they were added. */
+    groups(): string[];
     /**
      * The same tracks, now with their tags.
      *
@@ -150,7 +179,7 @@ export interface Engine {
     retag(tracks: Track[], root: string): void;
     stop(): void;
 }
-export declare function toRemoteTracks(tracks: Track[]): RemoteTrack[];
+export declare function toRemoteTracks(tracks: Loaded[]): RemoteTrack[];
 export declare function hasPicture(path: string): boolean;
 /**
  * The headless player: the terminal app's engine without the terminal.
@@ -172,7 +201,7 @@ export declare class PlayerEngine implements Engine {
     private timer;
     private dirty;
     private state;
-    constructor(tracks: Track[], root: string, tools: Tools, 
+    constructor(tracks: Loaded[], root: string, tools: Tools, 
     /** Frames a second pushed to remotes. */
     fps?: number);
     private readonly silent;
@@ -199,6 +228,30 @@ export declare class PlayerEngine implements Engine {
     private push;
     stop(): void;
     replace(tracks: Track[], root: string): void;
+    /**
+     * Load something as well as what is already here.
+     *
+     * Adding a folder used to be `replace`, so pointing a server at an album on
+     * the web threw away the music on its disk: the playlist you were looking at
+     * turned into somebody else's twenty-eight tracks, and clicking your own
+     * files played theirs. Nothing about playback changes here -- whatever was
+     * playing keeps playing, at the same index, because the new tracks go on the
+     * end.
+     *
+     * Paths already loaded are skipped, so adding the same album twice is not
+     * two copies of it.
+     */
+    add(tracks: Track[], from: string): number;
+    /**
+     * Take an added source back out.
+     *
+     * The track that is playing is followed rather than an index: removing an
+     * album from above the current track would otherwise slide the playlist out
+     * from under a listener mid-song. If the playing track is itself in what is
+     * being removed, playback stops -- there is nothing to keep playing.
+     */
+    drop(group: string): number;
+    groups(): string[];
     retag(tracks: Track[], root: string): void;
 }
 /** An engine with no library behind it, for the hosted PWA. */
@@ -210,6 +263,9 @@ export declare class EmptyEngine implements Engine {
     subscribe(listener: (snapshot: Snapshot) => void): () => void;
     trackPath(): undefined;
     replace(): void;
+    add(): number;
+    drop(): number;
+    groups(): string[];
     retag(): void;
     stop(): void;
 }

package/dist/server.js

@@ -39,7 +39,7 @@ import { Durable } from "./durable.js";
 import { notifyAll, resendEmail, webPush } from "./notify.js";
 import { confirm, DEFAULT_DIRECTORY, Publisher } from "./publish.js";
 import { applyRemoteConfig, createPaywall, FREE_LISTENERS, paywallFromEnv, } from "./paywall.js";
-import { isRemote, playsInBrowser } from "./sources.js";
+import { isRemote, playsInBrowser, sourceLabel } from "./sources.js";
 import { codecsOf, videoArgs } from "./audio.js";
 import { allowedForListening, elevate, firewallInUse, keyCookie, keyFrom, lookupPublicIp, newKey, portCommands, reachableAddresses, scopeOf, shareLink, audioLink, } from "./share.js";
 import { extname, join, normalize, resolve, sep } from "node:path";
@@ -293,6 +293,9 @@ export function toRemoteTracks(tracks) {
         // every track to the audio element -- a film's soundtrack over a blank
         // panel, which is exactly what it looked like.
         ...(hasPicture(t.path) ? { video: true } : {}),
+        // Only for what was added; the library's own tracks say nothing, which is
+        // how a client knows they are the library.
+        ...(t.group ? { group: t.group } : {}),
     }));
 }
 /** Video containers, as opposed to the songs that are most of a library. */
@@ -501,15 +504,89 @@ export class PlayerEngine {
         this.state.note = "";
         this.push(true);
     }
+    /**
+     * Load something as well as what is already here.
+     *
+     * Adding a folder used to be `replace`, so pointing a server at an album on
+     * the web threw away the music on its disk: the playlist you were looking at
+     * turned into somebody else's twenty-eight tracks, and clicking your own
+     * files played theirs. Nothing about playback changes here -- whatever was
+     * playing keeps playing, at the same index, because the new tracks go on the
+     * end.
+     *
+     * Paths already loaded are skipped, so adding the same album twice is not
+     * two copies of it.
+     */
+    add(tracks, from) {
+        const group = sourceLabel(from);
+        const known = new Set(this.tracks.map((track) => track.path));
+        const fresh = tracks.filter((track) => !known.has(track.path)).map((track) => ({ ...track, group }));
+        if (fresh.length === 0)
+            return 0;
+        this.tracks = [...this.tracks, ...fresh];
+        // The list itself changed, so it has to ride this frame; a count nobody
+        // can index into is worse than no news at all.
+        this.push(true);
+        return fresh.length;
+    }
+    /**
+     * Take an added source back out.
+     *
+     * The track that is playing is followed rather than an index: removing an
+     * album from above the current track would otherwise slide the playlist out
+     * from under a listener mid-song. If the playing track is itself in what is
+     * being removed, playback stops -- there is nothing to keep playing.
+     */
+    drop(group) {
+        if (group === "")
+            return 0;
+        const playingPath = this.tracks[this.state.index]?.path;
+        const kept = this.tracks.filter((track) => track.group !== group);
+        const removed = this.tracks.length - kept.length;
+        if (removed === 0)
+            return 0;
+        this.tracks = kept;
+        const stillThere = kept.findIndex((track) => track.path === playingPath);
+        if (stillThere === -1) {
+            this.halt();
+            this.state.index = this.clamp(this.state.index);
+        }
+        else {
+            this.state.index = stillThere;
+        }
+        this.push(true);
+        return removed;
+    }
+    groups() {
+        const seen = [];
+        for (const track of this.tracks) {
+            if (track.group && !seen.includes(track.group))
+                seen.push(track.group);
+        }
+        return seen;
+    }
     retag(tracks, root) {
-        // Dropped rather than applied if the library moved underneath: somebody
-        // re-streamed while the tagging was still running, and these tags describe
-        // something nobody is playing any more.
-        if (root !== this.root || tracks.length !== this.tracks.length)
-            return;
-        if (tracks.some((track, at) => track.path !== this.tracks[at]?.path))
+        // Matched by path rather than by position, because the list is no longer
+        // required to be the one that was sent for tagging: somebody can add an
+        // album while a library's tags are still being read, and an exact-shape
+        // check would throw away every tag for it. Tags that describe tracks which
+        // are no longer here simply match nothing, which is the same protection
+        // the shape check was giving.
+        void root;
+        const byPath = new Map(tracks.map((track) => [track.path, track]));
+        let changed = false;
+        const merged = this.tracks.map((track) => {
+            const tagged = byPath.get(track.path);
+            if (!tagged || tagged === track)
+                return track;
+            changed = true;
+            // The group is ours, not the tagger's: it knows what a track is called,
+            // not which pile it is in.
+            return { ...tagged, ...(track.group ? { group: track.group } : {}) };
+        });
+        if (!changed)
             return;
-        this.tracks = tracks;
+        this.tracks = merged;
         // No stop, no index reset: the only thing that changes is what the titles
         // say, and every remote finds out because a snapshot goes out -- carrying
         // the list, since the titles are the whole point of this one.
@@ -534,6 +611,15 @@ export class EmptyEngine {
         return undefined;
     }
     replace() { }
+    add() {
+        return 0;
+    }
+    drop() {
+        return 0;
+    }
+    groups() {
+        return [];
+    }
     retag() { }
     stop() { }
 }
@@ -845,7 +931,18 @@ export function createHandler(engine, options) {
             path !== "/api/health" &&
             path !== "/api/directory" &&
             !isSignInPath(path)) {
-            const scope = scopeOf(keyFrom(request, url), key, listenKey);
+            let scope = scopeOf(keyFrom(request, url), key, listenKey);
+            // A key is how somebody who was invited proves it. It is not the only way
+            // to be allowed in: the person who owns this server is allowed in whether
+            // or not they still have the link, and their nixamp.com session says who
+            // they are. Without this, signing in as yourself and opening your own
+            // server was refused, and the address of a machine you administer was
+            // useless without a link you had to go and find.
+            if (scope === null && options.owner) {
+                const check = await options.owner.check(false, tokenFrom(request.headers));
+                if (check.allowed)
+                    scope = "control";
+            }
             if (scope === null) {
                 // Counted, not because a 128-bit key falls to guessing, but because
                 // somebody hammering one should stop costing this server anything.
@@ -856,7 +953,9 @@ export function createHandler(engine, options) {
                     response.end(JSON.stringify({ error: "too many attempts; wait a moment" }));
                     return;
                 }
-                json(response, 401, { error: "this nixamp needs the key from its share link" });
+                json(response, 401, {
+                    error: "this nixamp needs the key from its share link, or sign in as its owner",
+                });
                 return;
             }
             if (scope === "listen" && !allowedForListening(path)) {
@@ -1719,16 +1818,50 @@ export function createHandler(engine, options) {
             json(response, 200, engine.snapshot());
             return;
         }
-        // Re-stream: hand the running server a different source. The listeners
-        // stay connected; what they are listening to changes under them.
+        // Take an added source back out of the playlist. The library it was added
+        // to is untouched -- there is no group name that names it.
+        if (path === "/api/source/remove") {
+            if (request.method !== "POST") {
+                json(response, 405, { error: "POST only" });
+                return;
+            }
+            let group = "";
+            try {
+                group = String(JSON.parse(await readBody(request)).group ?? "");
+            }
+            catch {
+                json(response, 400, { error: "bad JSON" });
+                return;
+            }
+            if (!group) {
+                json(response, 400, { error: "no group given" });
+                return;
+            }
+            const removed = engine.drop(group);
+            if (removed === 0) {
+                json(response, 404, { error: `nothing here came from ${group}` });
+                return;
+            }
+            json(response, 200, { ...engine.snapshot(), removed, groups: engine.groups() });
+            return;
+        }
+        // Hand the running server another source. The listeners stay connected;
+        // by default they get more to listen to, and only an explicit `replace`
+        // swaps what this server is for something else.
         if (path === "/api/source") {
             if (request.method !== "POST") {
                 json(response, 405, { error: "POST only" });
                 return;
             }
             let source = "";
+            let replacing = false;
             try {
-                source = String(JSON.parse(await readBody(request)).source ?? "");
+                const body = JSON.parse(await readBody(request));
+                source = String(body.source ?? "");
+                // Adding is what somebody means by putting a folder in a box, so it is
+                // the default. Replacing is the much larger claim that this server now
+                // serves that instead, so it is the one you have to ask for.
+                replacing = body.replace === true;
             }
             catch {
                 json(response, 400, { error: "bad JSON" });
@@ -1744,8 +1877,21 @@ export function createHandler(engine, options) {
                     json(response, 422, { error: `nothing to play at ${source}` });
                     return;
                 }
-                engine.replace(tracks, source);
-                // Names now, tags later, here as much as at startup: re-streaming a
+                let added = tracks.length;
+                if (replacing) {
+                    engine.replace(tracks, source);
+                }
+                else {
+                    added = engine.add(tracks, source);
+                    if (added === 0) {
+                        // Everything there was already here. Not an error -- the playlist
+                        // is exactly what the caller asked for -- but worth saying, so a
+                        // client can tell that apart from having added an album.
+                        json(response, 200, { ...engine.snapshot(), added: 0, groups: engine.groups() });
+                        return;
+                    }
+                }
+                // Names now, tags later, here as much as at startup: loading a
                 // directory of five thousand files used to read every tag before it
                 // answered, with the event loop held the whole time.
                 if (options.tag) {
@@ -1754,7 +1900,7 @@ export function createHandler(engine, options) {
                         .then((tagged) => engine.retag(tagged, source))
                         .catch(() => { });
                 }
-                json(response, 200, engine.snapshot());
+                json(response, 200, { ...engine.snapshot(), added, replaced: replacing, groups: engine.groups() });
             }
             catch (error) {
                 json(response, 422, { error: error.message.replace(/^nixamp: /, "") });

package/dist/share.js

@@ -180,7 +180,12 @@ export function scopeOf(offered, control, listen) {
 }
 /** Paths a listen key may have. Everything else needs the control key. */
 export function allowedForListening(path) {
-    if (path === "/api/command" || path === "/api/source")
+    if (path === "/api/command")
+        return false;
+    // Prefix, not equality: everything under this changes what the server plays,
+    // and an exact check let a listen key reach /api/source/remove and delete an
+    // album out of somebody else's playlist.
+    if (path === "/api/source" || path.startsWith("/api/source/"))
         return false;
     return true;
 }

package/dist/sources.d.ts

@@ -33,5 +33,14 @@ export declare function parseM3u(text: string, base: string): Entry[];
 /** A .pls, which Shoutcast and Icecast hand out as often as an .m3u. */
 export declare function parsePls(text: string, base: string): Entry[];
 /** The last useful part of a path or URL, for when nothing named the track. */
+/**
+ * What to call a whole source, as a heading over the tracks it brought.
+ *
+ * `nameOf` answers for a file; this answers for the thing a person added --
+ * usually the last segment either way, but a URL that is only a host has no
+ * segment to take, and "the album at that address" reads better as the host
+ * than as the whole URL repeated over every row.
+ */
+export declare function sourceLabel(source: string): string;
 export declare function nameOf(source: string): string;
 export declare function playsInBrowser(source: string): boolean;

package/dist/sources.js

@@ -94,6 +94,30 @@ export function parsePls(text, base) {
     });
 }
 /** The last useful part of a path or URL, for when nothing named the track. */
+/**
+ * What to call a whole source, as a heading over the tracks it brought.
+ *
+ * `nameOf` answers for a file; this answers for the thing a person added --
+ * usually the last segment either way, but a URL that is only a host has no
+ * segment to take, and "the album at that address" reads better as the host
+ * than as the whole URL repeated over every row.
+ */
+export function sourceLabel(source) {
+    const trimmed = source.replace(/\/+$/, "");
+    if (trimmed === "")
+        return source;
+    const named = nameOf(trimmed);
+    if (named !== trimmed && named !== "")
+        return named;
+    if (!isRemote(trimmed))
+        return trimmed;
+    try {
+        return new URL(trimmed).host;
+    }
+    catch {
+        return trimmed;
+    }
+}
 export function nameOf(source) {
     const remote = isRemote(source);
     const path = remote ? new URL(source).pathname : source;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.7.3",
+  "version": "0.7.5",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",