CLI Packager: commands and recovery

Open the included CLI#

Download and extract the complete Windows Suite from Package Content. Open PowerShell in the extracted folder. Commands below assume the supplied FFmpeg, FFprobe and Shaka binaries are beside drmx-packager.exe.

.\drmx-packager.exe version
.\drmx-packager.exe help
.\drmx-packager.exe credentials list
.\drmx-packager.exe credentials test --profile "Production"

First create the Production profile in Desktop Packager, or replace that name with your own saved profile. Use preview.6 or newer for renewable long-upload authorization.

Package a 1080p master#

Replace the source path, Content ID and output path below. The output folder must be new or empty. PowerShell uses a backtick at the end of a continued line; do not add spaces after it.

.\drmx-packager.exe package `
  --profile "Production" `
  --content_id "training-2026-001" `
  --content_title "Training session" `
  --input_source "D:\Sources\training.mp4" `
  --encoding_ladder "sd,hd,full-hd" `
  --video_codec h264 --encoding_preset fast `
  --rate_control smart-quality-vbr --max_frame_rate 24 `
  --audio_bitrate_kbps 128 --segment_duration 6 `
  --packaging_profile maximum-compatibility `
  --key_protection shaka-standard --encrypt_audio `
  --drm_systems "widevine,fairplay,playready,wiseplay" `
  --ffmpeg ".\ffmpeg.exe" --ffprobe ".\ffprobe.exe" `
  --shaka ".\packager-win-x64.exe" `
  --upload-concurrency 8 `
  -o "D:\Protected\training-2026-001"

This analyzes the source, encodes the selected ladder once, encrypts the configured outputs, verifies manifests, removes temporary clear renditions and uploads the protected package. A source smaller than a requested rung is not upscaled. For UHD, see 4K, 8K and long videos.

To keep the protected output locally, append --no-upload. To use a verified customer-owned destination, append --storage_connection_id "YOUR-STORAGE-CONNECTION-ID". Your configured default is used when this option is omitted.

Understand progress and completion#

A successful upload reports the verified object count, total bytes, inventory SHA-256 and registered manifest URLs. The last stage includes server verification of object sizes, manifest paths and package KIDs. Keep the Packaging Session ID from the output: it identifies the same package during recovery.

Desktop consumes structured CLI progress. For your own integration, add --progress-format ndjson and parse one JSON object per line; optional fields such as percent can be null. Treat a nonzero process exit code as failure or cancellation, even if earlier phases completed.

Resume without re-encoding#

Use upload after local encryption completed, including after restarting the computer or after the original Packaging Access Token expired. Your saved profile must belong to the same Site ID as the completed package. Replace the example session UUID and folder with the values from your log.

.\drmx-packager.exe upload `
  --profile "Production" `
  --session "11111111-2222-4333-8444-555555555555" `
  --input "D:\Protected\training-2026-001" `
  --upload-concurrency 4

Keep the entire output root, including both encryption-format folders when Maximum Compatibility created two outputs. For 1AICLOUD, the CLI compares remote byte lengths and SHA-256 metadata, skips matching objects and continues incomplete work. An incomplete multipart object restarts that object; already completed objects remain reusable. Customer-owned presigned storage may retransmit objects on a manual resume.

The uploader backs off after throttling or temporary network errors and renews temporary 1AICLOUD credentials while keeping the same destination and package prefix. Failed large-object parts are retried independently. Start with 4–8 parallel objects; higher concurrency is not always faster. Stop another process uploading the same folder before resuming.

.\drmx-packager.exe upload `
  --session "11111111-2222-4333-8444-555555555555" `
  --input "D:\Protected\training-2026-001" --dry-run

This dry run reads local file counts and sizes only; it does not contact storage, prove server authorization or validate encryption. The session UUID must still be syntactically valid. Legacy session-based workflows can use a valid DRMX_PACKAGING_TOKEN; saved-profile recovery is simpler when that token has expired.

Automate with protected environment credentials#

Unattended jobs can supply DRMX_PACKAGER_SITE_ID, DRMX_PACKAGER_ACCESS_KEY and DRMX_PACKAGER_KMS_TOKEN through their secret store. Optionally set DRMX_PACKAGER_SERVER. Omit --profile in this mode. Do not write real credentials into scripts, source control, command arguments or logs.

Run one package command per source and assign a unique Content ID and empty destination each time. Check the exit code before continuing. Use upload for a completed package that failed during upload, instead of automatically repeating package. Windows uses the bundled executables shown above. On an approved Linux CLI installation, use ./drmx-packager, ./ffmpeg, ./ffprobe and ./packager-linux-x64, with shell-appropriate line continuations.

Troubleshooting#