@feralfile/cli 2.5.0 → 2.7.0

package/dist/src/utilities/nft-indexer.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * NFT Indexer Client
  * This module provides functions to interact with NFT indexing services
@@ -48,8 +49,15 @@ const JOB_STATUS_QUERY = `
 /**
  * buildTokensListQuery builds the `tokens { items { ... } }` request body used by queryTokens.
  *
- * Selection uses only `display` and `media_assets`. The indexer merges metadata and enrichment
- * into `display`; the client does not repeat that merge by fetching raw metadata fields.
+ * Presentation comes only from `display` and `media_assets`. The indexer merges metadata and
+ * enrichment into `display`; the client does not repeat that merge by fetching raw metadata fields.
+ *
+ * `chain` and `standard` are selected because the row is the only place either fact is known.
+ * `detectTokenStandard` has an address and a chain name and nothing else, so it answers `erc721` for
+ * every EVM contract — which wrote `erc721` into playlists for every ERC-1155 token `find` reached by
+ * owner or by contract. The indexer stores what the token actually is (`erc721`, `erc1155`, `fa2`)
+ * beside its CAIP-2 `chain` (`eip155:1`, `tezos:mainnet`), so the row answers both questions and
+ * detection drops to a fallback. Do not remove these two fields from the selection.
  *
  * @param {Object} [params]
  * @param {Array<string>} [params.token_cids]
@@ -74,6 +82,8 @@ function buildTokensListQuery(params = {}) {
           token_number
           current_owner
           burned
+          chain
+          standard
           display {
             name
             description
@@ -106,10 +116,18 @@ function initializeIndexer(_config) {
     logger.debug('[NFT Indexer] Using endpoint:', GRAPHQL_ENDPOINT);
 }
 /**
- * Detect token standard based on chain and contract address
+ * detectTokenStandard guesses a token standard from a chain name and an address.
+ *
+ * This is the last-resort fallback, not the answer. It sees no token — only a
+ * chain name and an address format — so it cannot tell ERC-721 from ERC-1155
+ * and answers `erc721` for every EVM contract. It is still needed in two
+ * places: a lookup by coordinate has to build *some* CID before the indexer has
+ * been asked anything (see buildTokenCID), and a token row that arrived without
+ * a `standard` field has nothing better to offer.
  *
- * Determines the appropriate ERC/token standard for the given blockchain
- * and contract format.
+ * Prefer, in order: the indexer row's own `standard`, a caller's assertion, and
+ * only then this. On-chain detection is deliberately not attempted here — the
+ * indexer already stores the answer and selecting it costs nothing.
  *
  * @param {string} chain - Blockchain network
  * @param {string} contractAddress - Contract address
@@ -121,13 +139,122 @@ function detectTokenStandard(chain, contractAddress) {
     if (lowerChain === 'tezos' || contractAddress.startsWith('KT')) {
         return 'fa2';
     }
-    // Ethereum uses ERC721
-    // TODO: Enhance with on-chain detection for ERC1155 support
+    // Ethereum: erc721 is a guess, not a reading. Only the indexer row or a
+    // caller's assertion can distinguish an ERC-1155 token from an ERC-721 one.
     if (lowerChain === 'ethereum') {
         return 'erc721';
     }
     return 'other';
 }
+/**
+ * Token standards the indexer keys CIDs on. A standard outside this set —
+ * asserted by a caller or arriving on a row — says nothing the CID can carry,
+ * so detection decides instead.
+ */
+const CID_STANDARDS = new Set(['erc721', 'erc1155', 'fa2']);
+/**
+ * normalizeCidStandard returns a standard the CID format can carry, or ''.
+ *
+ * Both the indexer row and a caller's assertion are untrusted strings from
+ * outside this module ('ERC1155', ' fa2 ', 'ERC-1155', undefined). Anything not
+ * in CID_STANDARDS is treated as absent rather than passed through, so a
+ * misspelled standard never reaches a CID or a DP-1 `provenance.contract`.
+ *
+ * @param {unknown} value - Candidate standard
+ * @returns {string} Normalized standard, or '' when it is not one we can use
+ */
+function normalizeCidStandard(value) {
+    const normalized = typeof value === 'string' ? value.trim().toLowerCase() : '';
+    return CID_STANDARDS.has(normalized) ? normalized : '';
+}
+/**
+ * resolveTokenStandard picks the standard a CID is built with.
+ *
+ * detectTokenStandard cannot tell ERC-721 from ERC-1155 — it has only a chain
+ * and an address, and answers erc721 for every EVM contract. The indexer keys
+ * the two differently (`eip155:1:erc721:…` and `eip155:1:erc1155:…`), so an
+ * ERC-1155 token looked up by detection alone is simply never found. When the
+ * caller knows the standard — a DP-1 playlist carries it in
+ * `provenance.contract.standard` — that assertion wins.
+ *
+ * @param {string} chain - Blockchain network
+ * @param {string} contractAddress - Contract address
+ * @param {string} [asserted] - Standard the caller vouches for, if any
+ * @returns {string} Token standard for the CID
+ */
+function resolveTokenStandard(chain, contractAddress, asserted) {
+    return normalizeCidStandard(asserted) || detectTokenStandard(chain, contractAddress);
+}
+/**
+ * CAIP-2 namespaces mapped to the chain values DP-1 `provenance.contract` allows.
+ *
+ * The indexer names a token's chain in CAIP-2 (`eip155:1`, `tezos:mainnet`),
+ * which is authoritative: it comes from the row rather than from the caller's
+ * guess at which network an address belongs to. Namespaces outside this map
+ * have no DP-1 equivalent, so they fall back to the caller's chain name.
+ */
+const CAIP2_NAMESPACE_TO_DP1_CHAIN = {
+    eip155: 'evm',
+    tezos: 'tezos',
+    bitmark: 'bitmark',
+};
+/**
+ * dp1ChainFromCaip2 derives a DP-1 chain from a CAIP-2 chain id.
+ *
+ * @param {unknown} caip2Chain - CAIP-2 chain id from an indexer row, e.g. `eip155:1`
+ * @returns {string} DP-1 chain (`evm`, `tezos`, `bitmark`), or '' when unknown or absent
+ */
+function dp1ChainFromCaip2(caip2Chain) {
+    if (typeof caip2Chain !== 'string') {
+        return '';
+    }
+    const namespace = caip2Chain.trim().toLowerCase().split(':')[0];
+    return CAIP2_NAMESPACE_TO_DP1_CHAIN[namespace] || '';
+}
+/**
+ * Client chain names mapped to the chain values DP-1 `provenance.contract` allows.
+ *
+ * This is for DP-1 provenance output, NOT for indexer queries: the indexer uses
+ * `eth`/`tez`/`bmk` while DP-1 uses `evm`/`tezos`/`bitmark`. It answers only for
+ * tokens that reached us without an indexer row — a caller-supplied coordinate.
+ */
+const CHAIN_NAME_TO_DP1_CHAIN = {
+    ethereum: 'evm',
+    polygon: 'evm',
+    arbitrum: 'evm',
+    optimism: 'evm',
+    base: 'evm',
+    zora: 'evm',
+    tezos: 'tezos', // DP1 spec uses 'tezos', not 'tez'
+    bitmark: 'bitmark', // DP1 spec uses 'bitmark', not 'bmk'
+};
+/**
+ * resolveDp1Chain picks the DP-1 chain for a token's `provenance.contract`.
+ *
+ * The row's CAIP-2 chain and the caller's chain name are not two guesses to try
+ * in turn — they are different claims, and the row's is the network the indexer
+ * recorded. So a token carrying a row chain is answered from that chain alone:
+ * a namespace with no DP-1 equivalent becomes `other`, never the caller's name.
+ * Falling through would be actively wrong, because the owner and contract paths
+ * label every non-KT address `ethereum` before mapping — a Solana row would
+ * inherit that label and be published as an EVM contract. `other` is a true
+ * statement about a chain DP-1 cannot name; `evm` is a false one.
+ *
+ * The name map answers only when the token has no row chain at all, which is a
+ * token assembled from a caller-supplied coordinate rather than an indexer row.
+ *
+ * @param {Object} token - Token in the internal standard format
+ * @param {string} [token.caip2Chain] - CAIP-2 chain from the indexer row, when it came from one
+ * @param {string} [token.chain] - Client chain name the caller inferred
+ * @returns {string} DP-1 chain (`evm`, `tezos`, `bitmark`, or `other`)
+ */
+function resolveDp1Chain(token) {
+    const rowChain = typeof token.caip2Chain === 'string' ? token.caip2Chain.trim() : '';
+    if (rowChain) {
+        return dp1ChainFromCaip2(rowChain) || 'other';
+    }
+    return CHAIN_NAME_TO_DP1_CHAIN[String(token.chain || '').toLowerCase()] || 'other';
+}
 /**
  * Build CAIP-2 token CID for indexer v2
  *
@@ -137,15 +264,19 @@ function detectTokenStandard(chain, contractAddress) {
  * @param {string} chain - Blockchain network (ethereum, polygon, tezos, etc)
  * @param {string} contractAddress - Contract address
  * @param {string} tokenId - Token ID
+ * @param {string} [standard] - Asserted token standard; detected when omitted
  * @returns {string} Token CID in CAIP-2 format
  * @example
  * // Returns: eip155:1:erc721:0xabc123:456
  * const cid = buildTokenCID('ethereum', '0xabc123', '456');
  * @example
+ * // Returns: eip155:1:erc1155:0xabc123:456
+ * const cid = buildTokenCID('ethereum', '0xabc123', '456', 'erc1155');
+ * @example
  * // Returns: tezos:mainnet:fa2:KT1abc:789
  * const cid = buildTokenCID('tezos', 'KT1abc', '789');
  */
-function buildTokenCID(chain, contractAddress, tokenId) {
+function buildTokenCID(chain, contractAddress, tokenId, standard) {
     // Map chain names to CAIP-2 format (supports only Ethereum and Tezos)
     const caip2Map = {
         ethereum: 'eip155:1',
@@ -157,8 +288,8 @@ function buildTokenCID(chain, contractAddress, tokenId) {
     if (!caip2Chain) {
         throw new Error(`Unsupported chain: ${chain}. Only ethereum and tezos are supported.`);
     }
-    const standard = detectTokenStandard(chain, contractAddress);
-    return `${caip2Chain}:${standard}:${contractAddress}:${tokenId}`;
+    const resolvedStandard = resolveTokenStandard(chain, contractAddress, standard);
+    return `${caip2Chain}:${resolvedStandard}:${contractAddress}:${tokenId}`;
 }
 /**
  * Unified GraphQL query for tokens from indexer v2
@@ -317,11 +448,19 @@ function getBestMediaUrl(display = {}, mediaAssets = []) {
  * is null or partial, we only use what is present (for example `Token #${token_number}` for name);
  * we do not splice in raw `metadata` or enrichment because those are not selected from GraphQL.
  *
+ * The row's own `standard` and `chain` outrank both the asserted `standard` and the `chain`
+ * argument, because they are the token's identity as the indexer recorded it while the arguments are
+ * the caller's inference — `find` by owner or by contract only knows "the address starts with 0x, so
+ * ethereum". Precedence for the standard is row → asserted → detection; the CAIP-2 `chain` is kept
+ * beside the caller's chain name (not in place of it) as `caip2Chain`, because the name still selects
+ * the CID prefix and the detection fallback while the CAIP-2 value answers DP-1's chain enum.
+ *
  * @param {Object} indexerData - Token fields from indexer GraphQL
- * @param {string} chain - Blockchain network
+ * @param {string} chain - Blockchain network the caller inferred
+ * @param {string} [standard] - Asserted token standard; used when the row carries none
  * @returns {Object} Standardized token data
  */
-function mapIndexerDataToStandardFormat(indexerData, chain) {
+function mapIndexerDataToStandardFormat(indexerData, chain, standard) {
     if (!indexerData) {
         return {
             success: false,
@@ -334,14 +473,17 @@ function mapIndexerDataToStandardFormat(indexerData, chain) {
     const artistName = extractArtistName(display.artists);
     const name = display.name || `Token #${indexerData.token_number}`;
     const description = display.description || '';
-    const standard = detectTokenStandard(chain, indexerData.contract_address);
+    const resolvedStandard = normalizeCidStandard(indexerData.standard) ||
+        resolveTokenStandard(chain, indexerData.contract_address, standard);
+    const caip2Chain = typeof indexerData.chain === 'string' ? indexerData.chain : '';
     return {
         success: true,
         token: {
             chain,
+            caip2Chain,
             contractAddress: indexerData.contract_address,
             tokenId: indexerData.token_number,
-            standard,
+            standard: resolvedStandard,
             name,
             description,
             image: {
@@ -438,26 +580,13 @@ function convertToDP1Item(tokenData, duration) {
             error: `Source URL too long (${sourceUrl.length} chars, max 1024)`,
         };
     }
-    // Map chain name to DP1 format (according to DP1 spec)
-    // NOTE: This is for DP1 provenance output, NOT for indexer queries
-    // The indexer uses 'eth'/'tez'/'bmk', but DP1 spec uses 'evm'/'tezos'/'bitmark'
-    const chainMap = {
-        ethereum: 'evm',
-        polygon: 'evm',
-        arbitrum: 'evm',
-        optimism: 'evm',
-        base: 'evm',
-        zora: 'evm',
-        tezos: 'tezos', // DP1 spec uses 'tezos', not 'tez'
-        bitmark: 'bitmark', // DP1 spec uses 'bitmark', not 'bmk'
-    };
     // Build via dp1-js PlaylistItemBuilder so leaf blocks match DP-1 AJV schema.
     const itemBuilder = new PlaylistItemBuilder()
         .id(itemId)
         .source(sourceUrl)
         .license('open')
         .provenance(new ProvenanceBuilder().type('onChain').contract(new ContractBuilder()
-        .chain(chainMap[token.chain.toLowerCase()] || 'other')
+        .chain(resolveDp1Chain(token))
         .standard(token.standard || detectTokenStandard(token.chain, token.contractAddress))
         .address(token.contractAddress)
         .tokenId(String(token.tokenId))));
@@ -492,8 +621,34 @@ function convertToDP1Item(tokenData, duration) {
     return {
         success: true,
         item: dp1Item,
+        still: stillOf(token),
     };
 }
+/**
+ * stillOf names the token's still image as the indexer identifies it, or ''.
+ *
+ * This is `display.image_url`, the field the indexer reserves for a still and
+ * the same one `buildInlineManifestForToken` writes into `thumbnails.default`.
+ * It is returned beside the DP-1 item rather than inside it because the item
+ * only carries the still when it differs from the item's own source, and a
+ * consumer building a manifest against a *different* source (see
+ * enrich-playlist.ts) needs the still regardless. Nothing about the URL's
+ * shape is inspected: the indexer's word that it is an image is the evidence,
+ * and a suffix check would reject the extensionless CDN URLs it commonly
+ * returns.
+ *
+ * @param {Object} token - Token in the internal standard format
+ * @returns {string} http(s) still URL, or '' when the indexer named none
+ */
+function stillOf(token) {
+    const image = token.image;
+    // Only `thumbnail` qualifies. `image.url` is the media getBestMediaUrl
+    // selected as the source, which is the live rendition whenever one exists —
+    // exactly what must never land in a thumbnail slot.
+    const candidate = typeof image === 'string' ? image : typeof image === 'object' && image ? image.thumbnail : '';
+    const trimmed = String(candidate || '').trim();
+    return trimmed.startsWith('http://') || trimmed.startsWith('https://') ? trimmed : '';
+}
 /**
  * Get NFT token information from indexer and return as DP1 item (supports single or batch)
  * @param {Object|Array} params - Token parameters (single object or array)
@@ -507,8 +662,8 @@ async function getNFTTokenInfo(params) {
         return await getNFTTokenInfoBatch(params.tokens, duration);
     }
     // Handle single token
-    const { chain, contractAddress, tokenId } = params;
-    const result = await getNFTTokenInfoSingle({ chain, contractAddress, tokenId }, duration);
+    const { chain, contractAddress, tokenId, standard } = params;
+    const result = await getNFTTokenInfoSingle({ chain, contractAddress, tokenId, standard }, duration);
     return result;
 }
 /**
@@ -530,7 +685,7 @@ async function getNFTTokenInfo(params) {
  */
 async function getNFTTokenInfoSingle(params, duration, options = {}) {
     let chain = params.chain;
-    const { contractAddress, tokenId } = params;
+    const { contractAddress, tokenId, standard } = params;
     // DEFENSIVE: Auto-detect and correct chain based on contract address format
     if (contractAddress.startsWith('KT') && chain !== 'tezos') {
         logger.warn(`[NFT Indexer] Chain mismatch detected! Contract ${contractAddress} starts with KT but chain="${chain}". Auto-correcting to "tezos".`);
@@ -547,7 +702,7 @@ async function getNFTTokenInfoSingle(params, duration, options = {}) {
     });
     try {
         // Build token CID in CAIP-2 format
-        const tokenCID = buildTokenCID(chain, contractAddress, tokenId);
+        const tokenCID = buildTokenCID(chain, contractAddress, tokenId, standard);
         logger.info(`[NFT Indexer] Built token CID: ${tokenCID}`);
         // Query the indexer
         logger.info(`[NFT Indexer] Querying indexer GraphQL for token...`);
@@ -556,7 +711,7 @@ async function getNFTTokenInfoSingle(params, duration, options = {}) {
         if (!indexerData) {
             logger.info(`[NFT Indexer] Token not in database, triggering async indexing...`);
             // Trigger background indexing workflow
-            const indexResult = await triggerIndexingAsync(chain, contractAddress, tokenId);
+            const indexResult = await triggerIndexingAsync(chain, contractAddress, tokenId, standard);
             if (!indexResult.success) {
                 logger.debug(`[NFT Indexer] Failed to trigger indexing:`, indexResult.error);
                 return {
@@ -609,7 +764,7 @@ async function getNFTTokenInfoSingle(params, duration, options = {}) {
             }
         }
         // Map to standard format and convert to DP1
-        const tokenData = mapIndexerDataToStandardFormat(indexerData, chain);
+        const tokenData = mapIndexerDataToStandardFormat(indexerData, chain, standard);
         return convertToDP1Item(tokenData, duration);
     }
     catch (error) {
@@ -621,15 +776,21 @@ async function getNFTTokenInfoSingle(params, duration, options = {}) {
     }
 }
 /**
- * Get NFT token information in batch and return as DP1 items (parallel processing)
+ * Resolve a batch of tokens and return every outcome (parallel processing)
  *
  * For missing tokens: triggers indexing per token, polls by job_id, then fetches again.
  *
- * @param {Array} tokens - Array of token parameters
+ * Unlike getNFTTokenInfoBatch this keeps one result per input token, in input
+ * order: a resolved token as `{ success: true, item, still }`, a failed one as
+ * `{ success: false, error, token }`. Callers that must know which request an
+ * answer belongs to, or that need the still beside the item, use this.
+ *
+ * @param {Array} tokens - Array of token parameters (chain, contractAddress, tokenId, standard?)
  * @param {number} duration - Display duration in seconds
- * @returns {Promise<Array>} Array of DP1 items
+ * @param {Function} [onProgress] - Called with (done, total) after each batch
+ * @returns {Promise<Array>} One result per input token
  */
-async function getNFTTokenInfoBatch(tokens, duration, onProgress) {
+async function resolveTokenBatch(tokens, duration, onProgress) {
     logger.info(`[NFT Indexer] 📦 Starting batch processing for ${tokens.length} token(s)...`);
     logger.debug('[NFT Indexer] Batch tokens:', tokens);
     const results = [];
@@ -669,6 +830,23 @@ async function getNFTTokenInfoBatch(tokens, duration, onProgress) {
     const successCount = results.filter((r) => r.success && r.item).length;
     const failedCount = results.length - successCount;
     logger.info(`[NFT Indexer] Final: ${successCount} items with data, ${failedCount} without`);
+    return results;
+}
+/**
+ * Get NFT token information in batch and return as DP1 items (parallel processing)
+ *
+ * For missing tokens: triggers indexing per token, polls by job_id, then fetches again.
+ *
+ * Returns only the resolved items. Failures are dropped, not represented, so
+ * the result is neither aligned with nor as long as the input; a caller that
+ * needs the association uses resolveTokenBatch.
+ *
+ * @param {Array} tokens - Array of token parameters
+ * @param {number} duration - Display duration in seconds
+ * @returns {Promise<Array>} Array of DP1 items
+ */
+async function getNFTTokenInfoBatch(tokens, duration, onProgress) {
+    const results = await resolveTokenBatch(tokens, duration, onProgress);
     // Return only items (not error objects)
     const items = results.filter((r) => r.success && r.item).map((r) => r.item);
     logger.info(`[NFT Indexer] Returning ${items.length} items`);
@@ -719,10 +897,10 @@ async function getCollectionInfo(params) {
  * @returns {number} [returns.job_id] - Postgres queue job id; use with jobStatus / pollForJobCompletion
  * @returns {string} [returns.error] - Error message if failed
  */
-async function triggerIndexingAsync(chain, contractAddress, tokenId) {
+async function triggerIndexingAsync(chain, contractAddress, tokenId, standard) {
     try {
         // Build token CID
-        const tokenCID = buildTokenCID(chain, contractAddress, tokenId);
+        const tokenCID = buildTokenCID(chain, contractAddress, tokenId, standard);
         logger.debug('[NFT Indexer] Triggering token indexing job via GraphQL mutation:', {
             tokenCID,
         });
@@ -1050,6 +1228,7 @@ module.exports = {
     getNFTTokenInfo,
     // Batch processing
     getNFTTokenInfoBatch,
+    resolveTokenBatch,
     // Single token processing
     getNFTTokenInfoSingle,
     // Additional functions

package/dist/src/utilities/playlist-builder.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Playlist Builder Utilities
  *
@@ -14,6 +15,14 @@ const { playlistSigningDidKey } = require('./signing-identity');
 const { buildInlineManifestForToken } = require('./ref-manifest');
 /** Default display background that passes DP-1 hex color validation. */
 const DEFAULT_BACKGROUND = '#111111';
+/**
+ * DP-1 signature role that carries ownership of a playlist.
+ *
+ * The feed derives a playlist's owners from `curators[]` and then requires one of those keys to have
+ * signed as `curator`: being named is a claim, signing in this role is the proof. Playlist groups use
+ * the same role; channels use `publisher`, which ff-cli does not publish.
+ */
+const PLAYLIST_OWNER_ROLE = 'curator';
 /**
  * isTimeBasedMedia reports whether an item's media has an intrinsic runtime
  * (video or audio) per DP-1 §4.1 "time-based sources".
@@ -497,7 +506,16 @@ async function buildDP1Playlist(paramsOrItems, options = {}) {
             if (!declared.some((curator) => curator && curator.key === key)) {
                 playlist.curators = [...declared, { name: playlistConfig.curatorName || 'ff-cli', key }];
             }
-            playlist.signatures = [await signPlaylist(playlist, playlistConfig.privateKey)];
+            // Sign in the `curator` role, not the configured one. Declaring the key in curators[] is the
+            // document claiming that key is an owner; the feed treats a declared key as an owner only when the
+            // same key also signed in the owner role, so any other role leaves the document declared, verified
+            // and unpublishable — the exact shape that made every ff-cli playlist fail before (#107). The role
+            // has to follow the claim the builder just wrote. `playlist.role` still governs `ff-cli sign`,
+            // where the user chooses what claim to make; to build under a different role, build without a
+            // configured key and sign the result explicitly.
+            playlist.signatures = [
+                await signPlaylist(playlist, playlistConfig.privateKey, PLAYLIST_OWNER_ROLE),
+            ];
             delete playlist.signature;
         }
     }

package/dist/src/utilities/playlist-cast.js

@@ -1,39 +1,25 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.castPlaylist = castPlaylist;
+/**
+ * DP-1 signature role used when signing a playlist for playback.
+ *
+ * A cast never passes through a feed, so a document signed here carries no `feed` signature and its own
+ * entry is the only one a player could judge. DP-1 §7.1.1 rule 1 has players verify a `feed` or `curator`
+ * signature, so the configured role (shipped default `agent`) is the weakest choice available for a
+ * document this CLI is minting itself.
+ *
+ * Scope: this governs only the envelope the CLI *creates* — direct media, which arrives unsigned and must
+ * be signed before delivery. A playlist that already carries signatures is cast verbatim whatever its
+ * roles, because rewriting someone else's envelope is not this function's business. No player in this
+ * ecosystem enforces rule 1 today (ff-player performs no signature verification at all), so this is about
+ * not minting the weakest document we could, rather than about a failure observed on a device.
+ *
+ * This also has to match what the builder wrote: a wrapped media URL arrives here already declaring the
+ * signing key in `curators[]` and signed as `curator`, and signing REPLACES `signatures[]` rather than
+ * appending — so any other role here silently downgrades that envelope on its way to the device.
+ */
+const PLAYBACK_SIGNING_ROLE = 'curator';
 // playlist-signer and ff1-device are still CommonJS; require keeps interop simple.
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const { signPlaylist } = require('./playlist-signer');
@@ -68,7 +54,7 @@ async function castPlaylist(playlist, options = {}) {
                 };
             }
             try {
-                const signature = await signPlaylist(current, options.signingKey);
+                const signature = await signPlaylist(current, options.signingKey, PLAYBACK_SIGNING_ROLE);
                 current = {
                     ...current,
                     signature: undefined,
@@ -87,7 +73,7 @@ async function castPlaylist(playlist, options = {}) {
                 };
             }
         }
-        const { verifyPlaylist } = await Promise.resolve().then(() => __importStar(require('./playlist-verifier')));
+        const { verifyPlaylist } = await import('./playlist-verifier.js');
         const verifyResult = await verifyPlaylist(current);
         if (!verifyResult.valid) {
             return {

package/dist/src/utilities/playlist-publisher.js

@@ -7,6 +7,12 @@ exports.publishPlaylist = publishPlaylist;
 const axios_1 = __importDefault(require("axios"));
 const fs_1 = __importDefault(require("fs"));
 const playlist_verifier_1 = require("./playlist-verifier");
+/**
+ * DP-1 signature role that carries ownership of a playlist.
+ *
+ * Mirrors the feed's owner role for playlists (channels use `publisher`, which ff-cli does not publish).
+ */
+const OWNER_ROLE = 'curator';
 /**
  * Publish a verified playlist to a DP-1 feed server
  *
@@ -68,7 +74,9 @@ async function publishPlaylist(filePath, feedServerUrl) {
                     `  Re-sign it as a DP-1 v1.1 envelope:\n` +
                     `    1. remove the "signature" field\n` +
                     `    2. declare your key: "curators": [{ "name": "Your name", "key": "<did:key from ff-cli status>" }]\n` +
-                    `    3. ff-cli sign <file>`,
+                    `    3. ff-cli sign <file> -r ${OWNER_ROLE}\n` +
+                    `  The role matters: a declared key counts as an owner only when it also signed as "${OWNER_ROLE}",\n` +
+                    `  and plain "ff-cli sign" uses playlist.role, which defaults to "agent".`,
             };
         }
         // Step 3: Verify signature integrity before publishing.
@@ -92,20 +100,81 @@ async function publishPlaylist(filePath, feedServerUrl) {
             .map((c) => (typeof c?.key === 'string' ? c.key.trim() : ''))
             .filter((k) => k.length > 0));
         const signatures = Array.isArray(playlist.signatures)
-            ? (playlist.signatures ?? [])
+            ? (playlist
+                .signatures ?? [])
             : [];
         const signingKids = signatures
             .map((sig) => (typeof sig?.kid === 'string' ? sig.kid.trim() : ''))
             .filter((k) => k.length > 0);
-        if (signingKids.length > 0 && !signingKids.some((kid) => curatorKeys.has(kid))) {
+        const declaredSignatures = signatures.filter((sig) => curatorKeys.has(typeof sig?.kid === 'string' ? sig.kid.trim() : ''));
+        // Same predicate as `no declared signature`, expressed through the set the next gate also needs.
+        if (signingKids.length > 0 && declaredSignatures.length === 0) {
             return {
                 success: false,
                 error: 'Playlist is signed, but the signing key is not declared as a curator.',
                 message: `The feed accepts a publish when a signature's kid appears in the playlist's own curators[].\n` +
                     `  Add this to the playlist before signing:\n` +
                     `    "curators": [{ "name": "Your name", "key": "${signingKids[0]}" }]\n` +
-                    `  then sign again from the unsigned file — signing appends, so re-signing an already-signed\n` +
-                    `  playlist leaves the earlier signature covering a document that no longer exists.`,
+                    `  then sign again from the unsigned file, with the same key you just declared:\n` +
+                    `    ff-cli sign <file> -r ${OWNER_ROLE} --key <private key for ${signingKids[0]}>\n` +
+                    `  Drop --key if that key is your configured one; "sign" uses the configured key otherwise, and a\n` +
+                    `  signature from an undeclared key would not satisfy the feed. The role is ff-cli's requirement\n` +
+                    `  rather than every feed's: see the owner-role check for why publishing without it is refused.\n` +
+                    `  Start from the unsigned file\n` +
+                    `  because declaring curators[] changes the signed payload: signing appends, so the earlier\n` +
+                    `  signature would be left covering a document that no longer exists.`,
+            };
+        }
+        // Step 4b: a declared key must also have signed AS curator.
+        //
+        // Being named in curators[] is a claim; signing in the owner role is the proof, and the feed requires
+        // both before it treats a key as an owner. A document that is declared but signed under another role
+        // (ff-cli's own default was `agent`) verifies cleanly and is still refused, and the server answers in
+        // terms of ownership — which reads as "fix curators[]", the one part that is already correct. Naming
+        // the role and the remedy here is the difference between a one-flag fix and a wrong-end search.
+        //
+        // This is deliberately stricter than a feed that ignores the role: such a feed accepts the document
+        // today and freezes it the moment role-aware ownership lands, because a replace and a delete both
+        // need an owner signature the document does not carry. Refusing now keeps that document from being
+        // created at all.
+        if (declaredSignatures.length > 0 &&
+            !declaredSignatures.some((sig) => sig.role === OWNER_ROLE)) {
+            const rolesUsed = [
+                ...new Set(declaredSignatures
+                    .map((sig) => (typeof sig.role === 'string' ? sig.role.trim() : ''))
+                    .filter((role) => role.length > 0)),
+            ];
+            const seen = rolesUsed.length > 0 ? rolesUsed.map((role) => `"${role}"`).join(', ') : 'no role';
+            // List every key eligible to repair this, not the one that happens to have signed.
+            //
+            // The gate above accepts an owner-role signature from ANY declared key, so on a playlist declaring
+            // several curators the holder of any one of them can append it. Naming only the key that signed
+            // under the wrong role describes an impossible fix to everyone else — they may not hold it — while
+            // a key they do hold would have worked. `sign` still defaults to the configured key, which need not
+            // be declared at all, so the eligible set has to be stated rather than assumed.
+            const eligibleKeys = [...curatorKeys];
+            const eligibleList = eligibleKeys.length > 0 ? eligibleKeys.join(', ') : 'a key declared in curators[]';
+            return {
+                success: false,
+                error: `Playlist is signed by a declared curator, but under a non-owner role (${seen}).`,
+                message: `This is ff-cli's check, not a feed's answer. Feeds are moving to role-aware ownership, where\n` +
+                    `  a key in curators[] counts as an owner only if it also signed as "${OWNER_ROLE}". A feed that\n` +
+                    `  does not check the role yet will accept this document, and then be unable to authorize a\n` +
+                    `  replace or a delete for it: both need an owner signature it does not carry. Publishing it is\n` +
+                    `  what makes that permanent, so ff-cli refuses here instead.\n` +
+                    `\n` +
+                    `  curators[] is already correct — only the role is missing, so add that signature to this file:\n` +
+                    `    ff-cli sign <file> -r ${OWNER_ROLE} --key <private key for a declared curator>\n` +
+                    `  Any key this playlist declares will do — you do not need the one that signed under the wrong\n` +
+                    `  role. Declared: ${eligibleList}\n` +
+                    `  It must be one of those: a ${OWNER_ROLE} signature from an undeclared key satisfies neither\n` +
+                    `  this check nor role-aware ownership, since both read roles only from declared keys. "sign"\n` +
+                    `  uses the configured key unless --key says otherwise; drop --key if a declared key is already\n` +
+                    `  your configured one, and confirm which identity a key carries with\n` +
+                    `  "ff-cli status --key <private key>".\n` +
+                    `  Signing appends, and the payload hash excludes signatures, so the existing entry stays valid\n` +
+                    `  and the document ends up carrying both. No unsigned copy is needed: you only have to start\n` +
+                    `  from one when changing signed content such as curators[] itself.`,
             };
         }
         // Step 5: Send validated playlist to feed server.