rowkav09 · Oct 11, 2026 · Oct 11, 2026 · Oct 11, 2026 · Oct 11, 2026 · Oct 11, 2026
diff --git a/.github/workflows/beta.yml b/.github/workflows/beta.yml
@@ -167,7 +167,7 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: '*'
           path: dist
@@ -203,7 +203,7 @@ jobs:
         with:
           node-version: 22
       - name: Download platform artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: '*'
           path: dist

diff --git a/.github/workflows/hosted-build.yml b/.github/workflows/hosted-build.yml
@@ -33,6 +33,8 @@ jobs:
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
+      - name: Install dependencies
+        run: npm ci --omit=dev
       - name: Test hosted service
         run: node --test test/hosted-*.test.js
       - name: Write Vercel project settings (mirrors the live project)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -107,10 +107,10 @@ jobs:
         uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: release-${{ github.ref_name }}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: release-windows-${{ github.ref_name }}
       - name: One SHA256SUMS for every asset

diff --git a/README.md b/README.md
@@ -7,11 +7,13 @@
 
 Your media server knows what you are playing. nowplaying turns that into a card for your GitHub README and a status in Discord, without exposing your server to the internet. It runs on your PC and reads playback from Plex, Jellyfin, Emby or Navidrome. Spotify and a paired YouTube extension can also feed the card.
 
-| Music | Film | TV |
+| Studio · music | Editorial · film | Hi-Fi · TV |
 | :---: | :---: | :---: |
-| ![Example card showing Holocene by Bon Iver](docs/assets/cards/music-playing.svg) | ![Example card showing Spirited Away](docs/assets/cards/movie-playing.svg) | ![Example card showing Lost, S04E05](docs/assets/cards/episode-playing.svg) |
+| ![Studio: Blue Monday by New Order with sample cover art](docs/assets/cards/studio.svg) | ![Editorial: Dune Part Two with sample poster art](docs/assets/cards/editorial-film.svg) | ![Hi-Fi: Lost, The Constant, with sample poster art](docs/assets/cards/terminal-episode.svg) |
 
-*Example cards, not live playback. [More states and styles](docs/card-examples.md).*
+Studio puts artwork behind the card. Editorial pairs a large cover with warm paper and serif type. Hi-Fi adds record grooves and an amber timeline. Classic, Paper and Compact are also available. **[Explore all six styles, with music, film and TV examples →](docs/card-examples.md)**
+
+*Examples rendered by the app with illustrated sample artwork. Your card uses the current album cover or poster; hosted covers require **Include cover art** in Settings.*
 
 > **Development builds:** The [`dev` prerelease](https://github.com/rowkavdev/nowplaying/releases/tag/dev) is a moving test build, not an accepted stable release. It can break. Downloads are not code-signed; verify the checksum before running one. Windows has an installer and portable ZIP. **Linux x86_64 is experimental:** RPM, DEB, Arch and portable tarball downloads are available for desktop testing. [Linux installation and requirements](docs/wiki/Install-on-Linux.md). macOS desktop support is still experimental.
 
@@ -27,31 +29,31 @@ On Linux, follow [Install on Linux](docs/wiki/Install-on-Linux.md) to choose an
 
 2. Install it for your Windows user. On first launch, **Settings opens in your browser**. Find a media server or enter its address, then sign in. A full subnet scan only runs when you enter that subnet yourself. You can connect more than one server.
 3. Play something. Open the tray icon's status page, or visit [`http://127.0.0.1:47832/card.svg`](http://127.0.0.1:47832/card.svg) on that PC. The page at [`/healthz`](http://127.0.0.1:47832/healthz) says only that the configured app is responding, not that your server is connected.
-4. If you want a public README card, turn on **Hosted card** in Settings and copy its Markdown snippet. If you want Discord Rich Presence, turn it on separately in **Settings > Discord** and keep the Discord desktop app open.
+4. If you want a public README card, choose a style in **Settings > Appearance** and save it. Turn on **Hosted card** under **Sharing**, enable **Include cover art** if you want covers and posters, save, then copy its Markdown snippet. If you want Discord Rich Presence, turn it on separately in **Settings > Discord** and keep the Discord desktop app open.
 
 Provider sign-in: [Plex](docs/wiki/Connect-Plex.md) · [Jellyfin](docs/wiki/Connect-Jellyfin.md) · [Emby](docs/wiki/Connect-Emby.md) · [Navidrome](docs/wiki/Connect-Navidrome.md). For the full installation path, see [Quick start](docs/wiki/Quick-Start.md) and the [dev-build test checklist](docs/testing-dev-build.md).
 
 ## Choose where it shows up
 
 | Output | Source | How it works |
 | --- | --- | --- |
-| **Local card** | Media servers, Spotify, paired YouTube extension | An SVG on your PC. Choose a theme, width and visible fields in Settings. |
+| **Local card** | Media servers, Spotify, paired YouTube extension | An SVG on your PC. Choose a style, width and visible fields in Settings. |
 | **Hosted README card** | The same card state | Opt-in. Your PC pushes filtered playback fields to the card service; it never calls your media server. Copy the public link from Settings. Optional GitHub sign-in joins up to 10 PCs under one card. |
 | **Discord Rich Presence** | Media servers and paired YouTube extension | Opt-in. Your PC talks directly to the Discord desktop app. Music, films and episodes get fitting statuses. **Spotify never goes to Discord.** |
 
 [Connect Spotify](docs/wiki/Connect-Spotify.md) with your own Spotify app Client ID, or [pair the YouTube extension](docs/wiki/Connect-YouTube.md). Spotify music and podcasts can appear on the card; the YouTube extension is loaded manually and skips Shorts and ads. These are optional, not needed for a media-server card.
 
 ## Privacy is set on your PC
 
-- **Hosted cards are off until you turn them on.** The public service receives the card's filtered state, not your server address, username, password, token, artwork or listening history. Its latest update expires after ten minutes. [See exactly what leaves your PC](docs/hosted-upload.md).
+- **Hosted cards are off until you turn them on.** The public service receives the card's filtered state, not your server address, username, password, token, artwork links or listening history. **Include cover art** optionally adds a small sanitized image. Its latest update expires after ten minutes. [See exactly what leaves your PC](docs/hosted-upload.md).
 - **Sign-ins stay in the operating system credential store:** Windows Credential Manager or Linux Secret Service. Settings and server addresses are in `%LOCALAPPDATA%\nowplaying\config.json` on Windows or `~/.config/nowplaying/config.json` on Linux, with XDG directory overrides respected. These files do not contain passwords or tokens; check server addresses before sharing them.
 - **Settings > Privacy** can hide titles, artwork, progress or whole media types before they reach the card or Discord. A hidden type looks like nothing playing. [Privacy guide](docs/wiki/Privacy-and-safe-configuration.md).
 - **Discord cover art is uploaded to a temporary host.** Discord can't reach a private Plex, Jellyfin or Emby address, so "Show my server's cover" is on for a new setup and sends the cover to Litterbox (72-hour retention), with tmpfiles.org (48-hour retention) as a fallback when the first host fails. An existing install keeps it off until you tick it in Settings > Discord, and you can untick it there at any time. [Details](docs/artwork.md#discord-cover-upload).
 - **Local Settings binds to `127.0.0.1`.** The hosted card doesn't require a public port or inbound access to your PC. A public README card is visible to anyone who opens it; [GitHub may cache its image](docs/wiki/Add-a-README-card.md#if-the-readme-looks-stale).
 
 ## Settings, updates and problems
 
-Open **Settings** from the tray icon to manage servers, Discord, hosted cards, privacy and the card's appearance. The local status page shows connections and logs. [Customization](docs/customization.md) · [Updates and release channels](docs/wiki/Updates-and-release-channels.md) · [Troubleshooting](docs/wiki/Troubleshooting.md).
+Open **Settings** from the tray icon to manage servers, Discord, hosted cards, privacy and the card's appearance. Settings keeps configuration beside live logs, with shortcuts for servers, appearance, Discord, privacy, sharing and startup. Choose a card style from the visual gallery, preview changes, and save each section separately. [Settings guide](docs/settings.md) · [Customization](docs/customization.md) · [Updates and release channels](docs/wiki/Updates-and-release-channels.md) · [Troubleshooting](docs/wiki/Troubleshooting.md).
 
 If something fails on a dev build, [open an issue](https://github.com/rowkavdev/nowplaying/issues/new) with the build number, operating system and desktop environment, package format, what you tried and what happened. Leave out server addresses and tokens.
 

diff --git a/docs/README.md b/docs/README.md
@@ -10,8 +10,9 @@ Two audiences, two homes:
 | Guide | Covers | Status |
 | --- | --- | --- |
 | [Provider configuration](providers.md) | Plex, Jellyfin, Navidrome and Emby adapter options and normalized output | Current |
+| [Settings](settings.md) | Finding controls, previews, section saves and logs | Current |
 | [Customization](customization.md) | Templates, privacy controls, card themes and Discord settings | Current |
-| [Card examples](card-examples.md) | Renderer-generated gallery of every card state and theme | Current |
+| [Card examples](card-examples.md) | Six styles, artwork examples for music, film and TV, and playback states | Current |
 | [Hosted card deployment](hosted-card.md) | Running the card endpoint: routes, headers, caching, health checks | Current |
 | [Hosted card: what leaves your PC](hosted-upload.md) | Exactly which fields the app pushes to the card service | Current |
 | [Updates](updates.md) | Update policy, channels, verification, atomic install and rollback | Current |

diff --git a/docs/assets/cards/compact.svg b/docs/assets/cards/compact.svg
diff --git a/docs/assets/cards/editorial-episode.svg b/docs/assets/cards/editorial-episode.svg