# CLI Packager: commands and recovery

Package a master video, automate with protected credentials, interpret progress and resume an interrupted upload without re-encoding.

Canonical: https://docs.drm-x.com/packaging/cli
Updated: 2026-09-09

![Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.](https://docs.drm-x.com/assets/media-license-flow.svg)Your backend decides access; DRM-X enforces the signed policy. Encrypted media and DRM licenses follow separate delivery paths.

## Open the included CLI[#](#open-the-included-cli)

Download and extract the complete Windows Suite from [Package Content](https://6.drm-x.com/console/package-content). Open PowerShell in the extracted folder. Commands below assume the supplied FFmpeg, FFprobe and Shaka binaries are beside `drmx-packager.exe`.

```
.\drmx-packager.exe version
.\drmx-packager.exe help
.\drmx-packager.exe credentials list
.\drmx-packager.exe credentials test --profile "Production"
```

First create the **Production** profile in [Desktop Packager](https://docs.drm-x.com/packaging/desktop), or replace that name with your own saved profile. Use preview.6 or newer for renewable long-upload authorization.



## Package a 1080p master[#](#package-a-1080p-master)

Replace the source path, Content ID and output path below. The output folder must be new or empty. PowerShell uses a backtick at the end of a continued line; do not add spaces after it.

```
.\drmx-packager.exe package `
--profile "Production" `
--content_id "training-2026-001" `
--content_title "Training session" `
--input_source "D:\Sources\training.mp4" `
--encoding_ladder "sd,hd,full-hd" `
--video_codec h264 --encoding_preset fast `
--rate_control smart-quality-vbr --max_frame_rate 24 `
--audio_bitrate_kbps 128 --segment_duration 6 `
--packaging_profile maximum-compatibility `
--key_protection shaka-standard --encrypt_audio `
--drm_systems "widevine,fairplay,playready,wiseplay" `
--ffmpeg ".\ffmpeg.exe" --ffprobe ".\ffprobe.exe" `
--shaka ".\packager-win-x64.exe" `
--upload-concurrency 8 `
-o "D:\Protected\training-2026-001"
```

This analyzes the source, encodes the selected ladder once, encrypts the configured outputs, verifies manifests, removes temporary clear renditions and uploads the protected package. A source smaller than a requested rung is not upscaled. For UHD, see [4K, 8K and long videos](https://docs.drm-x.com/packaging/large-videos).

To keep the protected output locally, append `--no-upload`. To use a verified customer-owned destination, append `--storage_connection_id "YOUR-STORAGE-CONNECTION-ID"`. Your configured default is used when this option is omitted.



## Understand progress and completion[#](#understand-progress-and-completion)

Analyze
Read source tracksEncode
Create the ladderEncrypt
Protect each outputVerify
Check manifestsUpload
Transfer and publish

A successful upload reports the verified object count, total bytes, inventory SHA-256 and registered manifest URLs. The last stage includes server verification of object sizes, manifest paths and package KIDs. Keep the Packaging Session ID from the output: it identifies the same package during recovery.

Desktop consumes structured CLI progress. For your own integration, add `--progress-format ndjson` and parse one JSON object per line; optional fields such as `percent` can be null. Treat a nonzero process exit code as failure or cancellation, even if earlier phases completed.



## Resume without re-encoding[#](#resume-without-re-encoding)

Use `upload` after local encryption completed, including after restarting the computer or after the original Packaging Access Token expired. Your saved profile must belong to the same Site ID as the completed package. Replace the example session UUID and folder with the values from your log.

```
.\drmx-packager.exe upload `
--profile "Production" `
--session "11111111-2222-4333-8444-555555555555" `
--input "D:\Protected\training-2026-001" `
--upload-concurrency 4
```

**Keep the entire output root**, including both encryption-format folders when Maximum Compatibility created two outputs. For 1AICLOUD, the CLI compares remote byte lengths and SHA-256 metadata, skips matching objects and continues incomplete work. An incomplete multipart object restarts that object; already completed objects remain reusable. Customer-owned presigned storage may retransmit objects on a manual resume.

The uploader backs off after throttling or temporary network errors and renews temporary 1AICLOUD credentials while keeping the same destination and package prefix. Failed large-object parts are retried independently. Start with 4–8 parallel objects; higher concurrency is not always faster. Stop another process uploading the same folder before resuming.

```
.\drmx-packager.exe upload `
--session "11111111-2222-4333-8444-555555555555" `
--input "D:\Protected\training-2026-001" --dry-run
```

This dry run reads local file counts and sizes only; it does not contact storage, prove server authorization or validate encryption. The session UUID must still be syntactically valid. Legacy session-based workflows can use a valid `DRMX_PACKAGING_TOKEN`; saved-profile recovery is simpler when that token has expired.



## Automate with protected environment credentials[#](#automate-with-protected-environment-credentials)

Unattended jobs can supply `DRMX_PACKAGER_SITE_ID`, `DRMX_PACKAGER_ACCESS_KEY` and `DRMX_PACKAGER_KMS_TOKEN` through their secret store. Optionally set `DRMX_PACKAGER_SERVER`. Omit `--profile` in this mode. Do not write real credentials into scripts, source control, command arguments or logs.

Run one package command per source and assign a unique Content ID and empty destination each time. Check the exit code before continuing. Use `upload` for a completed package that failed during upload, instead of automatically repeating `package`. Windows uses the bundled executables shown above. On an approved Linux CLI installation, use `./drmx-packager`, `./ffmpeg`, `./ffprobe` and `./packager-linux-x64`, with shell-appropriate line continuations.



## Troubleshooting[#](#troubleshooting)

| Message or symptom | Next action | 
| --- | --- |

| Upload temporarily busy or interrupted | Allow backoff to finish. If the retry budget is exhausted, keep the output and resume with concurrency 4 or 2. | 

| 401 / credential validation failed | Test the saved profile, check the Site ID and rotate/re-save revoked credentials. A viewer DRM License Token cannot authorize packaging. | 

| Output must be empty | Use a new folder for encoding; use upload to recover an already completed protected package. | 

| Another upload may be using this protected folder | Close the other upload process. The adjacent lock file can remain after exit; only an active file lock blocks recovery. | 

| Length, checksum or manifest verification failed | Preserve the log and output. Do not edit manifests or publish manually. Resume unchanged files or contact support with the session ID and redacted error. | 

| UHD rung removed | The source dimensions are too small for that rung. Use an actual UHD source to produce UHD output. |