feat: media pipeline E2E verified — PSSH, authority, IPFS pin, GUI IPC fixes

Complete end-to-end media DRM pipeline now working: Creator mint → buy →
download to node → DASH/CENC playback inside PC2.

Key fixes:
- PSSH extraction: multi-pattern search (protocolVersion, data, protectionType)
- PSSH metadata: embed ciphertext, dataToEncryptHash, contract-compatible kid
- Authority address: corrected to 0x8fe6bf98 (real AuthorityGateway on Base)
- IPFS pin: rewritten local detection using ipfs-unixfs-exporter (bypasses
  Helia fs.stat/fs.ls hangs on large directory DAGs)
- GUI IPC: rebuilt bundle.min.js to deploy duplicate wallet signature fix
- Chipotle client: enhanced retry logic, broader error pattern matching
- Market app: skip signMessage in Chipotle mode, deduplicate SIWE login
- ddrm-config template: corrected authority address

Also includes Particle Auth SDK asset updates (Lit SDK upgrade).

Docs updated: SESSION_HANDOVER.md and ROADMAP.md reflect E2E completion.

Made-with: Cursor

Author: SashaMIT

deploy/web-gateway/ddrm-config.json.template

@@ -0,0 +1,16 @@
+{
+  "version": 1,
+  "network": "chipotle-dev",
+  "apiUrl": "https://api.dev.litprotocol.com",
+  "usageKey": "REPLACE_WITH_USAGE_API_KEY",
+  "pkpId": "0x09bdfc8f8ec5a3bd2970497b930bd94839f22227",
+  "authority": "0x8fe6bf9877B78BF0126819ff2593235E54Ee1E29",
+  "chain": "base",
+  "chainId": 8453,
+  "rpc": "https://mainnet.base.org",
+  "actions": {
+    "nonMediaEncrypt": "QmUdZUxe6BVoXiZcw4hE86YCHsgQVGEmgbN6sr7MhnL8pp",
+    "nonMediaDecrypt": "QmfWksjQkuLxVGEZdHrbFKxUb2sL4K34bLYbD3mAKv2CZA"
+  },
+  "notes": "This file is deployed on each supernode. PC2 nodes fetch it on first startup. NEVER commit the real usageKey to git — provision it manually on each supernode after deployment."
+}

docs/core/ROADMAP.md

@@ -139,7 +139,7 @@ These diagrams from Rong define the north star. Every work stream should move us
 - [ ] Auto-pin + DHT announce for purchased content (CDN effect)
 
 **Creator Tools:**
-- [x] Local media encoding pipeline — FFmpeg transcode + Bento4 fragment/package + CENC-AES-128-CTR encrypt + DASH packaging + IPFS upload. Adaptive codec selection (NVIDIA GPU / SVT-AV1 / x264). Creator Dashboard integration with detailed sub-step progress UI. Chipotle Lit Action CEK encryption. *(implemented Mar 17-18 — pending Lit API recovery for E2E completion)*
+- [x] Local media encoding pipeline — FFmpeg transcode + Bento4 fragment/package + CENC-AES-128-CTR encrypt + DASH packaging + IPFS upload. Adaptive codec selection (NVIDIA GPU / SVT-AV1 / x264). Creator Dashboard integration with detailed sub-step progress UI. Chipotle Lit Action CEK encryption. **E2E verified Mar 18**: Creator mint → buy → download → DASH playback inside PC2. *(completed Mar 17-18)*
   - [x] Media encoding progress UX — real-time sub-step tracking (Analyze → Transcode → Fragment → CENC Encrypt → IPFS Upload), per-step inline progress bars, live FFmpeg stats (speed, FPS, elapsed time), weighted overall progress *(implemented Mar 18)*
 - [ ] App Factory — local packaging pipeline (build → bundle → IPFS pin → publish)
 - [x] Creator Dashboard dApp — upload any file, set price/royalties, encrypt via Lit Protocol, upload to IPFS *(implemented Mar 13 — pc2-node/data/test-apps/elacity-creator/)*
@@ -173,7 +173,7 @@ These diagrams from Rong define the north star. Every work stream should move us
   - [x] **WASM-native PDF rendering** — Replaced `lopdf` (WASM crash) with `hayro` pure-Rust PDF rasterizer for full-fidelity rendering (layout, fonts, tables, images). Fixed WASI compilation target (`wasm32-wasip1`). Node.js canvas fallback text wrapping fixed. Elacity brand blue (`#3b82f6`) applied to viewer. "Mint on Elacity" right-click for non-dDRM files. Wallet bridge restored *(completed Mar 16)*
   - [x] **WASM crypto hardening (Phases A-C)** — AES-GCM decrypt-only mode in WASM (CEK never in Node.js heap, 50MB threshold), fMP4 strip+decrypt combined in single WASM call (Rust port with 64-bit box support), `build-wasm.sh` pipeline, `wasm32-wasip1` toolchain. PDF text extraction spike confirmed `hayro-syntax` lacks CMap resolution — keeping `pdfjs-dist`. Phase D (Lit Chipotle) COMPLETE. Phase E (ECDH to WASM) conditional on Chipotle envelope format.
   - [x] **Bug fixes (Mar 16)** — Fixed double-signature bug (duplicate `pc2-wallet-bridge.js` + `IPC.js` handlers), fixed WASM text renderer exceeding JPEG 65535px limit, fixed video autoplay after signing, fixed `eth_requestAccounts` prompting unnecessarily (use `eth_accounts` first). Removed duplicate `eth_sendTransaction` handler from ParticleNetworkContext
-  - [x] **Bug fixes (Mar 18)** — Fixed duplicate wallet signatures (IPC.js + pc2-wallet-bridge.js dual handling), fixed "Network fee: Unavailable" (removed explicit gas estimation, let MetaMask handle), fixed duplicate chain switch popup (check current chain before switching), fixed duplicate SIWE login on account change, fixed media encode `dataToEncryptHash` propagation for correct minting contentId, fixed IPFS directory pinning for DASH packages (Helia `storeDirectory` + local directory detection in `pinRemoteCID`)
+  - [x] **Bug fixes (Mar 18)** — Fixed duplicate wallet signatures (IPC.js + pc2-wallet-bridge.js dual handling), fixed "Network fee: Unavailable" (removed explicit gas estimation, let MetaMask handle), fixed duplicate chain switch popup (check current chain before switching), fixed duplicate SIWE login on account change, fixed media encode `dataToEncryptHash` propagation for correct minting contentId, fixed IPFS directory pinning for DASH packages (Helia `storeDirectory` + local directory detection in `pinRemoteCID`), fixed PSSH extraction (multi-pattern search), fixed PSSH ciphertext/hash/kid embedding, fixed authority address (`0x8fe6bf98...` AuthorityGateway on Base), fixed GUI IPC rebuild (bundle.min.js), **E2E verified: mint → buy → download → playback**
   - [x] **dDRM Viewer native windowing** — launches as UIWindow via IPC `postMessage` → `launch_app()` (not browser popup), integrated with taskbar *(completed Mar 15)*
   - [x] **.ddrm.json capsule format** — descriptor files for non-media assets with CID, Lit params, mimeType. MIME: `application/x-ddrm+json`. Saved to Documents *(completed Mar 15)*
   - [x] **GUI capsule integration** — custom shield icon, MIME registration, double-click opens dDRM Viewer, content_type_to_icon mapping *(completed Mar 15)*
@@ -315,7 +315,7 @@ These diagrams from Rong define the north star. Every work stream should move us
 - [x] **dDRM Viewer** — dedicated secure viewer app with native PC2 windowing, scrollable document view, .ddrm.json capsule support *(completed Mar 15)*
 - [x] **GUI file type integration** — `.ddrm.json` icon, MIME, double-click → dDRM Viewer *(completed Mar 15)*
 - [x] **PC2 Media Runtime** — server-side DASH/CENC decryption: Rust WASM cenc-decrypt crate + MSE player + DRM stripping + Lit CEK recovery. End-to-end video playback verified *(completed Mar 16)*
-- [x] **Lit Chipotle migration** — Datil deprecated ~April 25, 2026. Replaced v7 SDK with REST API. `chipotle-client.ts` module, `LIT_BACKEND` feature flag, dual-mode rollback. Non-media encrypt/decrypt E2E verified on new dev network. Auto-provisioning coded. **RELEASE BLOCKER: supernode deployment pending.** See `docs/core/LIT_PRODUCTION_CHECKLIST.md` *(completed Mar 13-18)*
+- [x] **Lit Chipotle migration** — Datil deprecated ~April 25, 2026. Replaced v7 SDK with REST API. `chipotle-client.ts` module, `LIT_BACKEND` feature flag, dual-mode rollback. Non-media + media encrypt/decrypt E2E verified on new dev network. Auto-provisioning coded. **RELEASE BLOCKER: supernode deployment pending.** See `docs/core/LIT_PRODUCTION_CHECKLIST.md` *(completed Mar 13-18)*
 - [ ] On-chain content indexer — replace Elacity GraphQL dependency with event scanner (The Graph / custom). See [DECENTRALIZATION_STATUS.md](./DECENTRALIZATION_STATUS.md) Tier 1.1
 - [ ] Self-provisioned RLI tokens — each PC2 node mints own capacity credits, removes Elacity wallet dependency. See Tier 1.3
 - [ ] AI Model Marketplace alpha — encrypt GGUF/SafeTensors model → IPFS → ACCESS_TOKEN → decrypt on PC2 → load in Ollama
@@ -738,7 +738,7 @@ Starting Month 1 (March 2026):
 | Release | Target | Focus |
 |---------|--------|-------|
 | v1.1.0 | March 2026 | Merge Jetson branch, bug fixes, AV1 player |
-| v1.2.0 | April 2026 | **Lit Chipotle dDRM** (non-media DONE, media encoding pipeline BUILT — pending Lit API recovery), local media encoding (FFmpeg+Bento4+CENC+DASH), supernode provisioning, hardware expansion, installer improvements, WireGuard bundling |
+| v1.2.0 | April 2026 | **Lit Chipotle dDRM** (non-media DONE, media E2E DONE Mar 18), local media encoding (FFmpeg+Bento4+CENC+DASH — E2E verified), supernode provisioning deployment, hardware expansion, installer improvements, WireGuard bundling |
 | v1.3.0 | May 2026 | AI Model Marketplace alpha (GGUF→Ollama), dApp bundles, datasets, `@elacity-js/asset-packager` |
 | v1.4.0 | June 2026 | WASM-native CENC encrypt + PSSH gen (replace Bento4 binaries), fiat onramp, Rust optimization sprint |
 | v1.5.0 | July 2026 | dApp Store v1 (categories, ratings, HTML5 games, 3D viewer), mobile companion alpha |

docs/core/SESSION_HANDOVER.md

@@ -11,7 +11,7 @@
 **Release:** v1.1.0 tagged and released on 2026-03-03 (134 commits squash-merged to main)
 **Launcher:** v1.1.1 released — version display, one-click updates, full networking install
 **DAO Proposal:** Live at https://elastos.com/proposals/69a24f49247f130078064edd
-**Last Commit:** feat: media encoding pipeline (transcode→fragment→CENC→DASH→IPFS), IPC duplicate fix
+**Last Commit:** feat: media pipeline E2E — PSSH extraction fix, authority address fix, IPFS pin fix, GUI IPC rebuild, end-to-end video playback + download verified
 
 ### What Just Shipped (v1.1.0 on main)
 
@@ -348,7 +348,7 @@ Full technical spec at `docs/core/ACCESS_PACKAGE_SPEC.md`. Key decisions:
 - [x] **PC2 Media Runtime** — Rust WASM `cenc-decrypt` crate (AES-128-CTR per-sample, 16-byte IVs), MSE player (no EME/CDM), DRM stripping (init+segment), two-phase Lit auth, SA-aware PSSH selection. **End-to-end DASH video playback verified** *(completed Mar 16)*
 - [x] Lit Chipotle migration — Phases 0-5 complete (Mar 13-17). `chipotle-client.ts` replaces Lit SDK. `LIT_BACKEND=chipotle|datil` feature flag. **E2E round-trip verified** (Mar 17): encrypt + decrypt + plaintext match confirmed.
 
-#### Media Encoding Pipeline — WORKING (Pending Lit API Recovery) (Mar 17-18)
+#### Media Encoding Pipeline — WORKING END-TO-END (Mar 17-18)
 
 Built a complete local media encoding pipeline for the Creator Dashboard. Video/audio files uploaded by creators are transcoded, fragmented, CENC-encrypted, and packaged as DASH streams — all on the local PC2 node, no cloud dependency.
 
@@ -380,8 +380,9 @@ Built a complete local media encoding pipeline for the Creator Dashboard. Video/
 
 **IPFS integration:**
 - `uploadDashToIPFS()` uses Helia `storeDirectory()` for correct UnixFS directory CIDs
-- `pinRemoteCID()` enhanced: local `fs.stat()` check for directories, instant recursive fetch for already-local content
+- `pinRemoteCID()` enhanced: uses `ipfs-unixfs-exporter` for robust local directory detection, bypasses Helia `fs.stat()`/`fs.ls()` hangs on large DAGs, `fetchDirectoryRecursive()` uses `entry.size` metadata instead of reading all bytes
 - Best-effort replication of individual DASH files to Elacity IPFS gateway for multi-node reachability
+- Downloaded content stored in PC2 virtual filesystem (IPFS blockstore) with `.edrm` descriptor in user's Videos folder — NOT in native OS Finder
 
 **Critical bug fix — Duplicate wallet signatures (IPC):**
 - Root cause: Both `src/gui/src/IPC.js` and `pc2-node/src/wallet-bridge/pc2-wallet-bridge.js` independently listened for `pc2-wallet-rpc` messages and forwarded them to `window.ethereum`
@@ -396,12 +397,21 @@ Built a complete local media encoding pipeline for the Creator Dashboard. Video/
 - Market `onAccountChange` deduplication — prevents double SIWE login
 - `EncodeJob` interface returns `dataToEncryptHash` and `ciphertext` for correct minting `contentId`
 
-**Current status:** Pipeline works end-to-end through transcoding, fragmenting, and IPFS upload. CENC encryption step blocked by Lit Chipotle API outage (Phala TEE backend TLS failure). Retry mechanism in place — will recover automatically when Lit infrastructure comes back.
+**Current status:** Pipeline works end-to-end. **Video playback verified** — Creator mint → buy → download → PC2 Media Player plays DASH/CENC-encrypted video. Download saves `.edrm` descriptor to user's Videos folder in PC2 virtual filesystem.
+
+**Critical fixes applied (Mar 18 — E2E session):**
+- **PSSH extraction pattern** — `extractPSSHJson()` searched for `{"data":{` but Bento4 PSSH JSON starts with `{"protocolVersion":`. Fixed to search multiple patterns.
+- **PSSH missing ciphertext/hash** — `buildPSSHJson()` was called before CEK encryption, so PSSH lacked `ciphertext` and `dataToEncryptHash`. Restructured flow: encrypt CEK first, then build PSSH with result.
+- **PSSH wrong authority address** — `DEFAULT_AUTHORITY` was `0x580c26De...` (incorrect contract). Changed to `0x8fe6bf98...` (the real AuthorityGateway on Base that implements `hasAccessByContentId`). Long-term: authority should be passed dynamically per-channel from creator app.
+- **PSSH kid mismatch** — `kid` was a random UUID from `generateCEK()`, but contract registers `hashToContentId(dataToEncryptHash)`. Fixed: `buildPSSHJson` now derives kid from encryption hash using same formula as creator app.
+- **IPFS pin hanging** — `pinRemoteCID` called `fs.stat()` and `fs.ls()` which both hang on large UnixFS directory DAGs in Helia. Rewrote local detection to use `ipfs-unixfs-exporter` directly against blockstore (fast, bypasses Helia's blocking layers).
+- **GUI IPC not rebuilt** — `src/gui/src/IPC.js` had the duplicate wallet fix in source but GUI bundle was never rebuilt. Ran `npm run build:only` in `src/gui/` to compile fix into `dist/bundle.min.js`.
 
 **Known issues:**
 - Elacity frontend UA receipt parsing: `UAReceiptFetcher.enrichOperationsWithContracts` throws `TypeError` after successful on-chain purchase. Bug is in Elacity's frontend, not our code.
 - MPD parser error for image assets: Elacity's media player tries to parse image metadata as DASH manifest. Expected for non-video content.
 - Lit Datil deprecation: Datil network being deprecated ~April 25, 2026 in favor of Chipotle (REST API, API key auth, TEE-based). Migration required.
+- Authority address is hardcoded to Base AuthorityGateway `0x8fe6bf98...`. Works for all Base channels (shared gateway). Long-term: creator app should pass resolved authority into encode endpoint for per-channel support.
 
 #### PC2 Media Runtime — WORKING END-TO-END (Mar 15-16)
 
@@ -482,7 +492,7 @@ Comprehensive player hardening and UX polish:
 1. ~~**Lit Chipotle migration**~~ — **DONE (Mar 13-18)** — Phases 0-5 complete. Migrated to new `chipotle-dev` network. All Lit Action CIDs registered. Pinned encrypt action (`non-media-encrypt-chipotle.js`). Auto-provisioning from supernodes built. **E2E verified** (PDF, image, text — all decrypt via Chipotle on new platform).
 2. ~~**End-to-end testing**~~ — **DONE (Mar 18)** — Full Creator mint → buy → dDRM Viewer decrypt verified on new Lit dev network. WASM rendering, watermarks, on-chain access check all confirmed working.
 3. **Deploy supernode provisioning** — `/api/ddrm/provision` endpoint coded but NOT deployed to supernodes. See `docs/core/LIT_PRODUCTION_CHECKLIST.md` for deployment steps. **This is a v1.2.0 release blocker.**
-4. **Media pipeline on Chipotle** — Full encoding pipeline built and tested (transcode, fragment, IPFS upload all working). CENC encryption blocked by Lit Chipotle API outage (Phala TEE backend). Retry mechanism in place (5 attempts, exponential backoff). Will complete E2E once Lit recovers. See media encoding pipeline section above.
+4. ~~**Media pipeline on Chipotle**~~ — **DONE (Mar 18)** — Full encoding pipeline E2E verified: transcode → fragment → CENC encrypt → DASH package → IPFS upload → mint → buy → download → playback. PSSH includes ciphertext, hash, contract-compatible kid, correct authority. Lit Chipotle API recovered.
 5. **P-256 ECDH unwrap to WASM (Phase E)** — conditional on Chipotle envelope format. If Chipotle returns CEK directly, this phase is eliminated.
 6. **`cenc-encrypt` Rust WASM crate** — Symmetric counterpart to `cenc-decrypt`. AES-128-CTR encryption in WASM, replaces `mp4encrypt` Bento4 binary. Uses identical crypto primitives from `cenc-decrypt/cenc.rs`. Target: `wasm32-wasip1`.
 7. **`pssh-gen` Rust WASM crate** — PSSH box generator per ISO 23001-7. Produces binary PSSH boxes from Elacity dDRM metadata. Replaces JSON-based approach in `dashPackager.ts`.
@@ -697,7 +707,7 @@ Chipotle TEE available `Lit.Actions` methods:
 - [dDRM Pipeline E2E](fd6755f0-d73c-4e41-8df3-0f57f15071a2) — @elacity-js/access, Creator Dashboard, Lit Action trust model (Path A), capacity credit auto-detection, decrypt endpoint, decentralization analysis. Also: hayro PDF rendering, WASM text fixes, Mint context menu, wallet bridge restore, Elacity branding, WASM crypto hardening Phases A-C, double-signature fix, TXT dimension cap, video autoplay, fMP4 strip+decrypt in Rust
 - [Secure Viewer & PDF](fd6755f0-d73c-4e41-8df3-0f57f15071a2) — secure viewer pipeline, PDF hybrid rendering, two-layer encryption fix, Lit Pinata/relayer integration, auto-decrypt, parallel pages, dDRM Viewer app, .ddrm.json capsules, WASM renderer, GUI integration
 - [Media Runtime E2E](fd6755f0-d73c-4e41-8df3-0f57f15071a2) — server-side DASH/CENC decryption pipeline, Rust WASM cenc-decrypt crate, MSE player, DRM stripping (init+segment), 16-byte IV fix, Smart Account PSSH, two-phase Lit auth
-- [Media Encoding Pipeline](current) — Local media encoding pipeline (FFmpeg→Bento4→CENC→DASH→IPFS), Chipotle CEK encryption, Creator Dashboard media UI, IPC duplicate wallet fix, MetaMask gas estimation fix
+- [Media Encoding Pipeline](current) — Local media encoding pipeline (FFmpeg→Bento4→CENC→DASH→IPFS), Chipotle CEK encryption, Creator Dashboard media UI, IPC duplicate wallet fix, MetaMask gas estimation fix, PSSH extraction/authority/kid fixes, IPFS pin hang fix, GUI rebuild, **E2E playback + download verified**
 
 ---
 

pc2-node/.gitignore

@@ -33,6 +33,7 @@ Thumbs.db
 data/.chipotle-api-key
 data/.chipotle-user-key
 data/.chipotle-account-key
+data/.chipotle-provision.json
 
 # Dev-only test scripts containing secrets
 scripts/test-chipotle-phase1.mjs

pc2-node/data/test-apps/elacity-market/app.js

@@ -1713,17 +1713,29 @@
 
     // Phase 1: Ask the server to start a Lit session and return the SIWE message
     prepareLitAuth(checksumAddr).then(function (prepareResult) {
-      showToast('Please sign the Lit authentication message...', 'info');
-
-      // Phase 2: Sign the SIWE message from the server (contains ReCap capabilities)
-      return Wallet.signMessage(prepareResult.siweMessage).then(function (sig) {
-        var authSig = {
-          sig: sig,
-          derivedVia: 'web3.eth.personal.sign',
-          signedMessage: prepareResult.siweMessage,
+
+      // Chipotle mode: server returns siweMessage=null, no signing needed
+      var authSigPromise;
+      if (prepareResult.chipotleMode || !prepareResult.siweMessage) {
+        authSigPromise = Promise.resolve({
+          sig: '0x',
+          derivedVia: 'chipotle-api-key',
+          signedMessage: '',
           address: checksumAddr
-        };
+        });
+      } else {
+        showToast('Please sign the Lit authentication message...', 'info');
+        authSigPromise = Wallet.signMessage(prepareResult.siweMessage).then(function (sig) {
+          return {
+            sig: sig,
+            derivedVia: 'web3.eth.personal.sign',
+            signedMessage: prepareResult.siweMessage,
+            address: checksumAddr
+          };
+        });
+      }
 
+      return authSigPromise.then(function (authSig) {
         window.parent.postMessage({
           msg: 'launchApp',
           appName: 'pc2-media-runtime',
@@ -2341,8 +2353,10 @@
       onAccountChange: function () {
         updateWalletUI();
         if (state.initializing) return;
+        if (state._lastSignedAddress === Wallet.getAddress()) return;
         ElacityAPI.clearAuth();
         state.assetsItems = [];
+        state._lastSignedAddress = Wallet.getAddress();
         Wallet.siweLogin()
           .then(function () {
             updateWalletUI();
@@ -2371,6 +2385,7 @@
       })
       .then(function () {
         state.initializing = false;
+        state._lastSignedAddress = Wallet.getAddress();
         updateWalletUI();
         syncSubscriptionsFromAPI();
         if (state.activeView === 'library') renderMyAssetsView();

pc2-node/data/test-apps/elacity-market/wallet.js

@@ -173,6 +173,7 @@ var Wallet = (function () {
   // ── Chain Switching ──────────────────────────────────
 
   function switchToBase() {
+    if (currentChainId === BASE_CHAIN_ID) return Promise.resolve();
     return getProvider().request({
       method: 'wallet_switchEthereumChain',
       params: [{ chainId: BASE_CHAIN_ID }]