@feralfile/cli 2.0.0 → 2.0.1

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@feralfile/cli",
-    "version": "2.0.0",
+    "version": "2.0.1",
     "description": "CLI for building, signing, and playing DP-1 playlists of digital art on Feral File devices",
     "repository": {
         "type": "git",

package/dist/src/commands/play.js

@@ -59,12 +59,20 @@ const { signPlaylist } = require('../utilities/playlist-signer');
  * can redirect the user instead of silently wrapping, say, an Art Blocks
  * collection *page* as a web item. Returns null for anything `play` should
  * handle itself (plain URLs and file paths parse to null here).
+ *
+ * A recognized-but-`unsupported` result (e.g. a legacy Art Blocks
+ * `/projects/{id}` URL, or an unsupported-chain OpenSea link) is also a
+ * discovery input — it's a marketplace URL, not a playable file — so it is
+ * redirected to `find` too, which surfaces the specific reason.
  */
 function describeDiscoveryInput(source) {
     const parsed = (0, marketplace_url_1.parseFindInput)(source);
-    if (!parsed || parsed.kind === 'unsupported') {
+    if (!parsed) {
         return null;
     }
+    if (parsed.kind === 'unsupported') {
+        return 'a marketplace URL';
+    }
     switch (parsed.kind) {
         case 'token':
             return 'an on-chain token reference';

package/dist/src/utilities/playlist-builder.js

@@ -534,18 +534,37 @@ function validateDP1Playlist(playlist) {
  * misclassified HTML pages and extensionless URLs as static images, stamping
  * them with a display duration that cut interactive artworks off.)
  *
+ * The extension is taken from the URL *pathname* only — the query string and
+ * fragment are stripped first, so a signed URL like `art.png?sig=a.b` or
+ * `clip.mp4#t=1` still resolves to its real extension instead of parsing `b`
+ * or `mp4#t=1`. Misreading those would mislabel media as undetermined and
+ * (via buildUrlItem) route it through the interactive-web timing path.
+ *
  * @param {string} url - Media or page URL
  * @returns {string} MIME type, or '' when undetermined
  * @example
- * detectMimeType('https://example.com/image.png'); // 'image/png'
- * detectMimeType('https://example.com/art.html');  // 'text/html'
- * detectMimeType('https://example.com/output/abc'); // ''
+ * detectMimeType('https://example.com/image.png');        // 'image/png'
+ * detectMimeType('https://example.com/art.png?sig=a.b');  // 'image/png'
+ * detectMimeType('https://example.com/art.html');         // 'text/html'
+ * detectMimeType('https://example.com/output/abc');       // ''
  */
 function detectMimeType(url) {
     if (!url) {
         return '';
     }
-    const extension = url.split('.').pop()?.toLowerCase().split('?')[0];
+    // Use the pathname only: drop query + fragment so a dot inside `?sig=a.b`
+    // or `#v=1.2` can't masquerade as the file extension.
+    let pathname;
+    try {
+        pathname = new URL(url).pathname;
+    }
+    catch {
+        // Not an absolute URL (bare path/filename) — strip fragment then query.
+        pathname = String(url).split('#')[0].split('?')[0];
+    }
+    const lastSegment = pathname.split('/').pop() || '';
+    const dotIndex = lastSegment.lastIndexOf('.');
+    const extension = dotIndex >= 0 ? lastSegment.slice(dotIndex + 1).toLowerCase() : '';
     const mimeTypes = {
         jpg: 'image/jpeg',
         jpeg: 'image/jpeg',

package/docs/CONFIGURATION.md

@@ -36,7 +36,7 @@ Optional settings used where headless/browser‑like behavior is needed.
 
 Used for signing DP‑1 playlists.
 
-- `playlist.privateKey` (string, Ed25519 private key in hex or base64): Used by the `sign` command to create DP-1 v1.1.0 multi-signatures. The `verify` command may derive the matching public key from this value (or `PLAYLIST_PRIVATE_KEY`) when you omit `--public-key`; **dp1-js applies that derived key only when verifying legacy flat `signature` strings**, not when checking `signatures[]` envelopes. If that derivation fails, `verify` prints a warning on stderr and continues without derived key material. The derived public key is emitted as PEM so Node can decode it without ambiguity. Hex may include or omit the `0x` prefix. You can also set this via `PLAYLIST_PRIVATE_KEY` in `.env`. `play` verifies playlists before delivery and only auto-signs the synthesized media URL fallback when signing is configured. `send` and `publish` verify before delivery or upload and reject unsigned or broken playlists.
+- `playlist.privateKey` (string, Ed25519 private key in hex or base64): Used by the `sign` command to create DP-1 v1.1.0 multi-signatures. The `verify` command may derive the matching public key from this value (or `PLAYLIST_PRIVATE_KEY`) when you omit `--public-key`; **dp1-js applies that derived key only when verifying legacy flat `signature` strings**, not when checking `signatures[]` envelopes. If that derivation fails, `verify` prints a warning on stderr and continues without derived key material. The derived public key is emitted as PEM so Node can decode it without ambiguity. Hex may include or omit the `0x` prefix. You can also set this via `PLAYLIST_PRIVATE_KEY` in `.env`. `play` verifies playlists before delivery and only auto-signs the synthesized media URL fallback when signing is configured. `play` and `publish` verify before delivery or upload and reject unsigned or broken playlists.
 
   **Signing and key encoding:** Signing paths (`sign`, deterministic `build` when configured, and `-k/--key` overrides) pass the private key string through to **`dp1-js`** (`SignMultiEd25519`) without an extra decoding step in ff-cli. `dp1-js` recognizes **hex** (optional `0x`) or **base64** encodings of the PKCS#8 DER blob produced by the OpenSSL examples below, then loads the key for Ed25519. Use those formats; ff-cli does not add a separate normalizer ahead of the library.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feralfile/cli",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "CLI for building, signing, and playing DP-1 playlists of digital art on Feral File devices",
   "repository": {
     "type": "git",