@feralfile/cli 2.4.0 → 2.6.0

package/config.json.example

@@ -7,17 +7,16 @@
   },
   "feedServers": [
     {
-      "baseUrl": "https://dp1-feed-operator-api-prod.autonomy-system.workers.dev/api/v1",
-      "apiKey": "YOUR_FEED_SERVER_API_KEY_OPTIONAL"
+      "baseUrl": "https://dp1-feed-operator-api-prod.autonomy-system.workers.dev/api/v1"
     },
     {
-      "baseUrl": "http://localhost:8787",
-      "apiKey": "YOUR_FEED_SERVER_API_KEY_OPTIONAL"
+      "baseUrl": "http://localhost:8787"
     }
   ],
   "playlist": {
     "privateKey": "YOUR_ED25519_PRIVATE_KEY__base64_PKCS8_DER_recommended__or_32byte_raw_seed_as_hex_or_base64__run_ff-cli_setup_to_generate",
-    "role": "agent"
+    "role": "agent",
+    "curatorName": "YOUR_CURATOR_NAME"
   },
   "ff1Relayer": {
     "baseUrl": "https://tv-cast-coordination.autonomy-system.workers.dev"

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@feralfile/cli",
-    "version": "2.4.0",
+    "version": "2.6.0",
     "description": "CLI for building, signing, and playing DP-1 playlists of digital art on Feral File devices",
     "repository": {
         "type": "git",
@@ -60,7 +60,7 @@
     "dependencies": {
         "@feralfile/source-resolver": "^1.0.0",
         "@napi-rs/keyring": "1.3.0",
-        "axios": "^1.6.2",
+        "axios": "^1.20.0",
         "bonjour-service": "^1.3.0",
         "chalk": "^4.1.2",
         "commander": "^11.1.0",
@@ -68,7 +68,7 @@
         "dp1-js": "2.3.1",
         "ff1": "^1.0.0",
         "fuzzysort": "^3.1.0",
-        "viem": "^2.38.2"
+        "viem": "^2.56.3"
     },
     "devDependencies": {
         "@types/node": "^24.7.1",

package/dist/src/commands/enrich.js

@@ -12,7 +12,7 @@ const path_1 = require("path");
 const enrich_playlist_1 = require("../utilities/enrich-playlist");
 const playlist_verifier_1 = require("../utilities/playlist-verifier");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
-const { getNFTTokenInfoBatch } = require('../utilities/nft-indexer');
+const { resolveTokenBatch } = require('../utilities/nft-indexer');
 /**
  * writePlaylistAtomically replaces a file only once the new bytes are safely on
  * disk.
@@ -63,7 +63,16 @@ async function writePlaylistAtomically(destination, contents, expectedDigest) {
             // of it, or widen who can reach it. Carry the ownership across, and when
             // that is not permitted refuse the in-place replacement instead of
             // completing it with different access than the file had.
-            if (current && (current.uid !== process.getuid?.() || current.gid !== process.getgid?.())) {
+            //
+            // Only where POSIX identity exists. Windows has no getuid/getgid and
+            // reports uid and gid as 0 on every stat, so the comparison there would
+            // always "differ" and chown a file whose ownership never moved. (libuv
+            // makes fchown a no-op on Windows, so nothing would break — but the
+            // branch would be asserting something it cannot know.)
+            const uid = process.getuid?.();
+            const gid = process.getgid?.();
+            const canCompareOwnership = uid !== undefined && gid !== undefined;
+            if (current && canCompareOwnership && (current.uid !== uid || current.gid !== gid)) {
                 try {
                     await handle.chown(current.uid, current.gid);
                 }
@@ -230,12 +239,22 @@ exports.enrichCommand = new commander_1.Command('enrich')
             printedProgress = true;
             process.stdout.write(chalk_1.default.dim(`\r  ${done}/${count} looked up...`));
         };
-        // getNFTTokenInfoBatch is (tokens, duration, onProgress) — the second
+        // resolveTokenBatch is (tokens, duration, onProgress) — the second
         // positional is DP-1 display seconds, not the callback. Enrichment never
         // sets duration (the curator's timing is not ours to touch), so it is
         // passed undefined and the callback goes third. find.ts carries the same
         // warning; getting this wrong silently returns unusable results.
-        const lookup = (tokens, onProgressCallback) => getNFTTokenInfoBatch(tokens, undefined, onProgressCallback);
+        //
+        // The raw results are used rather than getNFTTokenInfoBatch's items so
+        // the indexer's still rides beside each item: the item itself drops the
+        // still whenever it equals the indexer's chosen source, and enrichment
+        // needs it against the curator's source instead.
+        const lookup = async (tokens, onProgressCallback) => {
+            const results = await resolveTokenBatch(tokens, undefined, onProgressCallback);
+            return results
+                .filter((result) => result.success && result.item)
+                .map((result) => ({ ...result.item, still: result.still }));
+        };
         const result = await (0, enrich_playlist_1.enrichPlaylistManifests)(playlist, lookup, {
             force: options.force,
             assumeEthereum: options.assumeEthereum,

package/dist/src/commands/find.js

@@ -641,8 +641,7 @@ async function doPublish(savedPath, serverArg, nonInteractive) {
         serverIndex = n;
     }
     const serverUrl = feedConfig.baseURLs[serverIndex];
-    const serverApiKey = feedConfig.servers?.[serverIndex]?.apiKey ?? feedConfig.apiKey;
-    const result = await publishPlaylist(savedPath, serverUrl, serverApiKey);
+    const result = await publishPlaylist(savedPath, serverUrl);
     if (result.success) {
         console.log(chalk_1.default.green('✓ Published'));
         if (result.playlistId) {

package/dist/src/commands/play.js

@@ -128,7 +128,6 @@ exports.playCommand = new commander_1.Command('play')
             console.log(chalk_1.default.yellow(`\nTry:  ff-cli find "${source}" --play${deviceFlag}`));
             process.exit(1);
         }
-        const config = (0, config_1.getConfig)();
         // No explicit duration: a direct video/audio URL plays its natural
         // length (DP-1 §4.1); static media uses config.defaultDuration.
         const resolved = probed ?? (await (0, playlist_source_1.resolvePlaySource)(source));
@@ -143,7 +142,11 @@ exports.playCommand = new commander_1.Command('play')
         // A direct media/web URL is wrapped in an unsigned single-item playlist,
         // so it must be signed before the verify gate; a loaded playlist is sent
         // as-is. castPlaylist owns the sign → verify → send sequence.
-        const privateKey = config.playlist?.privateKey || process.env.PLAYLIST_PRIVATE_KEY;
+        // Resolve through getPlaylistConfig rather than reading config.playlist directly: it is the one
+        // place that knows a config value may still be the config.json.example placeholder, in which case a
+        // valid PLAYLIST_PRIVATE_KEY must win. Duplicating the `config || env` precedence here is what made
+        // this path sign with the template literal while every other signing path used the real key.
+        const privateKey = (0, config_1.getPlaylistConfig)().privateKey || undefined;
         const result = await (0, playlist_cast_1.castPlaylist)(resolved.playlist, {
             deviceName: options.device,
             skipVerify: options.skipVerify,

package/dist/src/commands/publish.js

@@ -56,7 +56,6 @@ exports.publishCommand = new commander_1.Command('publish')
             process.exit(1);
         }
         let serverUrl = feedConfig.baseURLs[0];
-        let serverApiKey = feedConfig.apiKey;
         if (feedConfig.baseURLs.length > 1) {
             if (!options.server) {
                 console.log(chalk_1.default.yellow('Multiple feed servers found. Select one:'));
@@ -77,14 +76,8 @@ exports.publishCommand = new commander_1.Command('publish')
                 process.exit(1);
             }
             serverUrl = feedConfig.baseURLs[serverIndex];
-            if (feedConfig.servers && feedConfig.servers[serverIndex]) {
-                serverApiKey = feedConfig.servers[serverIndex].apiKey;
-            }
-        }
-        else if (feedConfig.servers && feedConfig.servers[0]) {
-            serverApiKey = feedConfig.servers[0].apiKey;
         }
-        const result = await publishPlaylist(file, serverUrl, serverApiKey);
+        const result = await publishPlaylist(file, serverUrl);
         if (result.success) {
             console.log(chalk_1.default.green('Published'));
             if (result.playlistId) {

package/dist/src/commands/status.js

@@ -10,15 +10,47 @@ const config_files_1 = require("./helpers/config-files");
 const config_1 = require("../config");
 const ed25519_key_derive_1 = require("../utilities/ed25519-key-derive");
 const playlist_signing_role_1 = require("../utilities/playlist-signing-role");
+const signing_identity_1 = require("../utilities/signing-identity");
 const config_placeholders_1 = require("../utilities/config-placeholders");
 exports.statusCommand = new commander_1.Command('status')
     .description('Show configuration status')
-    .action(async () => {
+    // Identity discovery must cover every key `sign` accepts, not just the configured one. `sign --key`
+    // signs with a key the config never mentions, so reporting only the configured identity would hand the
+    // user the wrong did:key to declare in curators[] — and a wrong declaration fails exactly like a
+    // missing one.
+    .option('-k, --key <privateKey>', 'Report the signing identity for this key instead of the configured one')
+    .action(async (options) => {
     try {
+        const overrideKey = options.key?.trim();
+        if (overrideKey) {
+            try {
+                console.log(chalk_1.default.green(`Signing identity (did:key) ${(0, signing_identity_1.playlistSigningDidKey)(overrideKey)}`));
+                console.log(chalk_1.default.dim("  declare this in the playlist's curators[] before signing"));
+                return;
+            }
+            catch (error) {
+                console.log(chalk_1.default.red(`--key unusable: ${error.message}`));
+                process.exit(1);
+            }
+        }
         const configPath = await (0, config_files_1.resolveExistingConfigPath)();
         if (!configPath) {
             console.log(chalk_1.default.red('config.json not found'));
             console.log(chalk_1.default.dim('Run: ff-cli setup'));
+            // PLAYLIST_PRIVATE_KEY is a supported signing source on its own, and the did:key it implies is
+            // the one value a user must know before they can write a publishable playlist — it has to be
+            // declared in curators[] before signing. Exiting silently here would leave an environment-only
+            // user unable to obtain it from anywhere. The exit status still reports "not configured".
+            const envKey = process.env.PLAYLIST_PRIVATE_KEY?.trim();
+            if (envKey) {
+                try {
+                    console.log(chalk_1.default.green(`\nSigning identity (did:key) ${(0, signing_identity_1.playlistSigningDidKey)(envKey)}`));
+                    console.log(chalk_1.default.dim("  from PLAYLIST_PRIVATE_KEY; declare it in the playlist's curators[]"));
+                }
+                catch (error) {
+                    console.log(chalk_1.default.red(`\nPLAYLIST_PRIVATE_KEY unusable: ${error.message}`));
+                }
+            }
             process.exit(1);
         }
         const config = await (0, config_files_1.readConfigFile)(configPath);
@@ -38,6 +70,17 @@ exports.statusCommand = new commander_1.Command('status')
                 playlistRoleError = playlistRoleMaterial;
             }
         }
+        // The feed matches a signature's kid against the document's own curators[], so this value is not
+        // decoration: without it a user cannot write a publishable playlist, and it appears nowhere else.
+        let signingDidKey;
+        if (hasPlaylistSigningKey) {
+            try {
+                signingDidKey = (0, signing_identity_1.playlistSigningDidKey)(playlistKeyMaterial);
+            }
+            catch {
+                signingDidKey = undefined;
+            }
+        }
         const statuses = [
             {
                 label: 'Config file',
@@ -55,6 +98,13 @@ exports.statusCommand = new commander_1.Command('status')
                         : undefined,
                 hint: ' (needed for signing and legacy verification)',
             },
+            {
+                label: 'Signing identity (did:key)',
+                ok: Boolean(signingDidKey),
+                optional: false,
+                detail: signingDidKey,
+                hint: " (declare this in the playlist's curators[] so the feed accepts a publish)",
+            },
             {
                 label: 'Playlist signing role',
                 ok: hasValidPlaylistRole,

package/dist/src/config.js

@@ -121,10 +121,38 @@ function getPlaylistConfig() {
     const config = getConfig();
     const playlistConfig = config.playlist || {};
     return {
-        privateKey: playlistConfig.privateKey || process.env.PLAYLIST_PRIVATE_KEY || null,
+        // `config init` writes the sample file through verbatim, so an untouched config carries the
+        // YOUR_ED25519_PRIVATE_KEY... literal. It is truthy, so without this it would beat a perfectly good
+        // PLAYLIST_PRIVATE_KEY and every signing path would fail on a key the user never chose.
+        privateKey: (0, config_placeholders_1.isMissingConfigValue)(playlistConfig.privateKey)
+            ? process.env.PLAYLIST_PRIVATE_KEY || null
+            : playlistConfig.privateKey || null,
         role: playlistConfig.role || process.env.PLAYLIST_ROLE || null,
+        curatorName: resolveCuratorName(playlistConfig.curatorName),
     };
 }
+/** The literal shipped in config.json.example, and the only curator name treated as unset. */
+const CURATOR_NAME_TEMPLATE = 'YOUR_CURATOR_NAME';
+/**
+ * Resolve the curator name recorded in a built playlist's signed `curators[]`.
+ *
+ * Two hazards meet here, and they pull in opposite directions. The sample value must not win over the
+ * environment, or a freshly initialized config publishes under a placeholder. But the generic
+ * YOUR_/your_ placeholder test is too broad for a human name — a real studio called "YOUR_STUDIO" would
+ * be silently replaced, and the wrong attribution would then be sealed inside a signature. So only the
+ * exact template literal counts as unset.
+ *
+ * A non-string value is treated as unset rather than passed through: config.json is arbitrary runtime
+ * JSON, and this value is assigned into the document *after* the builder has validated it, so a number
+ * here would be signed into a malformed playlist instead of being rejected.
+ */
+function resolveCuratorName(configured) {
+    const fromConfig = typeof configured === 'string' ? configured.trim() : '';
+    if (fromConfig && fromConfig !== CURATOR_NAME_TEMPLATE) {
+        return fromConfig;
+    }
+    return process.env.PLAYLIST_CURATOR_NAME?.trim() || null;
+}
 /**
  * Resolve the effective playlist signing role used by runtime paths.
  *
@@ -146,12 +174,15 @@ function resolveEffectivePlaylistRole(config) {
 /**
  * Get feed configuration for DP1 feed API
  *
- * Supports both legacy (feed.baseURLs/apiKey) and new (feedServers array) formats.
+ * Supports both legacy (feed.baseURLs) and new (feedServers array) formats.
+ *
+ * No API key is returned. The feed authorizes writes from the signatures inside the document, so a key
+ * is neither sent nor accepted; an `apiKey` left in an existing config file is simply ignored rather
+ * than being an error, so old configs keep working.
  *
  * @returns {Object} Feed configuration
  * @returns {string[]} returns.baseURLs - Array of base URLs for feed APIs
- * @returns {string} [returns.apiKey] - Optional API key for authentication (legacy)
- * @returns {Array<Object>} [returns.servers] - Array of feed servers with individual API keys (new)
+ * @returns {Array<Object>} [returns.servers] - Array of configured feed servers (new format)
  */
 function getFeedConfig() {
     const config = getConfig();
@@ -179,7 +210,6 @@ function getFeedConfig() {
     }
     return {
         baseURLs: urls,
-        apiKey: feedConfig.apiKey,
     };
 }
 /**
@@ -281,6 +311,16 @@ function validateConfig() {
                 }
             }
         }
+        // curatorName is signed into curators[] as a public name, and it is written into the document after
+        // the builder has validated it — so a malformed value is not caught anywhere downstream. Reporting a
+        // clean config while `build` emits an invalid signed playlist is the failure worth preventing here.
+        const curatorNameValue = config.playlist
+            ?.curatorName;
+        if (curatorNameValue !== undefined && curatorNameValue !== null) {
+            if (typeof curatorNameValue !== 'string' || curatorNameValue.trim().length === 0) {
+                errors.push('playlist.curatorName must be a non-empty string');
+            }
+        }
         if (config.playlist?.role !== undefined || process.env.PLAYLIST_ROLE !== undefined) {
             try {
                 resolveEffectivePlaylistRole(config);

package/dist/src/utilities/enrich-playlist.js

@@ -129,7 +129,43 @@ function coordinateKeyOf(provenance) {
     if (token.length === 0) {
         return null;
     }
-    return `${canonicalChain(chain)}:${address.trim().toLowerCase()}:${token}`;
+    const canonical = canonicalChain(chain);
+    const standard = effectiveStandard(canonical, address, contract.standard);
+    return `${canonical}:${standard}:${address.trim().toLowerCase()}:${token}`;
+}
+/**
+ * Standards the indexer keys CIDs on. Mirrors CID_STANDARDS in nft-indexer.js.
+ */
+const CID_STANDARDS = new Set(['erc721', 'erc1155', 'fa2']);
+/**
+ * effectiveStandard names the standard a coordinate is looked up under, so the
+ * correlation key separates what the indexer separates.
+ *
+ * The indexer keys ERC-721 and ERC-1155 tokens at one address under different
+ * CIDs, so a hybrid contract can hold both standards at one token id. Two
+ * playlist items asserting different standards for one coordinate are two
+ * lookups, and each answer must reach only the item that asked for it.
+ *
+ * When the playlist asserts nothing the client detects, and this mirrors that
+ * detection (resolveTokenStandard in nft-indexer.js) so the request key and
+ * the key read off the response agree. The mirror is deliberate rather than
+ * an import: this module takes its lookup by injection and stays free of the
+ * indexer client. If the two ever drift, correlation fails closed — the item
+ * reports not-indexed — rather than attributing one token's metadata to
+ * another.
+ */
+function effectiveStandard(canonicalChainName, address, asserted) {
+    const normalized = typeof asserted === 'string' ? asserted.trim().toLowerCase() : '';
+    if (CID_STANDARDS.has(normalized)) {
+        return normalized;
+    }
+    if (canonicalChainName === 'tezos' || address.trim().startsWith('KT')) {
+        return 'fa2';
+    }
+    if (canonicalChainName === 'evm') {
+        return 'erc721';
+    }
+    return 'other';
 }
 /**
  * describeItem names an item for operator output, preferring its title.
@@ -160,14 +196,22 @@ function coordinateFor(item) {
         return null;
     }
     const normalized = chain.trim().toLowerCase();
-    return {
+    const coordinate = {
         chain: CHAIN_ALIASES[normalized] ?? normalized,
         contractAddress: address,
         tokenId: token,
     };
+    // Carried as written. The indexer client accepts the standards its CIDs
+    // are keyed on and falls back to detection for anything else, so an
+    // unexpected value costs nothing beyond the lookup it would have lost anyway.
+    const standard = contract.standard;
+    if (typeof standard === 'string' && standard.trim().length > 0) {
+        coordinate.standard = standard.trim().toLowerCase();
+    }
+    return coordinate;
 }
 /**
- * stillFromIndexerSource recovers a thumbnail the manifest builder suppressed.
+ * stillFor recovers a thumbnail the manifest builder suppressed.
  *
  * `resolveStillUri` blanks a still that equals the source it was given, on the
  * reasonable ground that pointing a thumbnail at the artwork itself adds
@@ -179,64 +223,26 @@ function coordinateFor(item) {
  * exists to repair: a live work the app cannot rasterize, whose grid tile
  * stays empty.
  *
- * Recovering it is the inverse of the suppression. When the indexer's source
- * differs from the item's and is an http(s) URL, that source IS the still that
- * was elided, so it becomes the thumbnail relative to the item's own source.
+ * Recovery is the same rule applied against the curator's source instead of
+ * the indexer's: the still the indexer names for the token (`resolved.still`,
+ * its `display.image_url`) is used whenever it differs from the item's own
+ * source. It is the same field `find` and `build` write into
+ * `thumbnails.default`, and it is taken on the indexer's word, as they take
+ * it. No guess is made from a URL's shape — the indexer's source is often a
+ * live rendition and its stills are often extensionless CDN URLs, so a
+ * suffix check gets both cases wrong — and a lookup that names no still
+ * leaves the item without one.
  */
-function stillFromIndexerSource(item, resolved) {
-    const indexerSource = typeof resolved.source === 'string' ? resolved.source.trim() : '';
+function stillFor(item, resolved) {
+    const still = typeof resolved.still === 'string' ? resolved.still.trim() : '';
     const itemSource = typeof item.source === 'string' ? item.source.trim() : '';
-    if (!indexerSource || indexerSource === itemSource) {
+    if (!still || still === itemSource) {
         return '';
     }
-    if (!indexerSource.startsWith('http://') && !indexerSource.startsWith('https://')) {
+    if (!still.startsWith('http://') && !still.startsWith('https://')) {
         return '';
     }
-    // The indexer's source is not necessarily a still. getBestMediaUrl prefers
-    // display.animation_url and media assets over display.image_url, so it is
-    // frequently a live HTML rendition — and writing one into the thumbnail slot
-    // is worse than leaving the slot empty: the grid still cannot rasterize it,
-    // and the item now claims a still it does not have.
-    //
-    // Only a URL that is demonstrably an image is used. The indexer exposes no
-    // separately identified still on the item this command receives, so the file
-    // extension is the evidence available; carrying a real image field through
-    // the batch result would be the better fix and belongs upstream.
-    return looksLikeImage(indexerSource) ? indexerSource : '';
-}
-/**
- * Media the app can draw a grid tile from, matching the types
- * playlist-builder.js already recognizes. SVG and video belong here: the app
- * rasterizes both, and excluding them left works with the empty tile this
- * command exists to remove. HTML is deliberately absent — an unrasterizable
- * page in the thumbnail slot is worse than an empty slot, because the item
- * then claims a still it does not have.
- */
-const RASTERIZABLE_EXTENSIONS = [
-    '.png',
-    '.jpg',
-    '.jpeg',
-    '.gif',
-    '.webp',
-    '.avif',
-    '.bmp',
-    '.svg',
-    '.mp4',
-    '.webm',
-];
-/**
- * looksLikeImage tests a URL's path extension, ignoring query and fragment.
- */
-function looksLikeImage(url) {
-    let pathname = url;
-    try {
-        pathname = new URL(url).pathname;
-    }
-    catch {
-        pathname = url.split('?')[0].split('#')[0];
-    }
-    const lower = pathname.toLowerCase();
-    return RASTERIZABLE_EXTENSIONS.some((extension) => lower.endsWith(extension));
+    return still;
 }
 /**
  * hasThumbnail reports whether a manifest already carries a default still.
@@ -258,9 +264,10 @@ function hasThumbnail(manifest) {
  * thumbnails) is what enrichment exists to fetch and is taken as given.
  */
 function manifestFor(item, resolved) {
-    const still = stillFromIndexerSource(item, resolved);
+    const still = stillFor(item, resolved);
+    const curatorTitle = typeof item.title === 'string' ? item.title.trim() : '';
+    const resolvedTitle = typeof resolved.title === 'string' ? resolved.title.trim() : '';
     let manifest = resolved.inlineManifest;
-    let rekey = false;
     if (manifest && still && !hasThumbnail(manifest)) {
         manifest = {
             ...manifest,
@@ -269,30 +276,36 @@ function manifestFor(item, resolved) {
                 thumbnails: { default: { uri: still } },
             },
         };
-        rekey = true;
     }
-    else if (!manifest && still) {
-        // Nothing was emitted because the still was the only content the token
-        // had, and it had been suppressed. A thumbnail-only manifest is worth its
-        // payload in a way a title-only one is not: it is the difference between
-        // a grid tile and an empty square.
-        const synthesizedTitle = typeof item.title === 'string' ? item.title.trim() : '';
-        manifest = {
-            refVersion: '1.1.0',
-            id: derivedManifestId('', `${synthesizedTitle}\n${still}`),
-            created: MANIFEST_CREATED,
-            locale: 'en',
-            metadata: {
-                ...(synthesizedTitle ? { title: synthesizedTitle } : {}),
-                thumbnails: { default: { uri: still } },
-            },
-        };
+    else if (!manifest) {
+        // Nothing was emitted because the token had only a title, or only a still
+        // that was suppressed against the indexer's source. Either can still be
+        // worth a manifest here, for a reason `find` and `build` never meet: their
+        // items always carry the token's title, so a title-only manifest would
+        // repeat what the item already says. A curator's item may carry no title
+        // at all, and the tombstone then shows nothing — so a substantiated title
+        // is written when the item lacks one, and a still is written whenever
+        // there is one, because it is the difference between a grid tile and an
+        // empty square.
+        const synthesizedTitle = curatorTitle || resolvedTitle;
+        const titleWorthCarrying = !curatorTitle && resolvedTitle.length > 0;
+        if (still || titleWorthCarrying) {
+            manifest = {
+                refVersion: '1.1.0',
+                id: derivedManifestId('', `${synthesizedTitle}\n${still}`),
+                created: MANIFEST_CREATED,
+                locale: 'en',
+                metadata: {
+                    ...(synthesizedTitle ? { title: synthesizedTitle } : {}),
+                    ...(still ? { thumbnails: { default: { uri: still } } } : {}),
+                },
+            };
+        }
     }
     if (!manifest) {
         return undefined;
     }
     const metadata = manifest.metadata ?? {};
-    const curatorTitle = typeof item.title === 'string' ? item.title.trim() : '';
     const overrideTitle = curatorTitle.length > 0 && metadata.title !== curatorTitle;
     // The id is derived from the finished payload every time, not only when this
     // command changed something. The indexer keys its id on the token
@@ -304,10 +317,6 @@ function manifestFor(item, resolved) {
     //
     // The original id is folded in, so the result stays anchored to the token
     // rather than floating free of it, and stays deterministic across runs.
-    //
-    // `rekey` is read only to record that a thumbnail was recovered; the
-    // derivation below covers it either way.
-    void rekey;
     const finalMetadata = overrideTitle ? { ...metadata, title: curatorTitle } : metadata;
     return {
         ...manifest,

package/dist/src/utilities/index.js

@@ -505,7 +505,7 @@ async function buildPlaylistDirect(params, options = {}) {
         console.log(chalk.cyan('\nPublishing to feed server...'));
         try {
             const { publishPlaylist } = require('./playlist-publisher');
-            publishResult = await publishPlaylist(savedPath, playlistSettings.feedServer.baseUrl, playlistSettings.feedServer.apiKey);
+            publishResult = await publishPlaylist(savedPath, playlistSettings.feedServer.baseUrl);
             if (publishResult.success) {
                 console.log(chalk.green(`✓ Published to feed server`));
                 if (publishResult.playlistId) {