Player: now-playing title with cover, start banner, one status pill; media art for everyone

The swapper sends the media's poster and banner once (`art`, Jellyfin
images or AniList by parsed name); state carries their hashes and every
member fetches them from /i/ like avatars. state.media.swapBy names who
put the media up. uosc and the standard bar show cover, title and
episode; a banner card shows before playback starts. The top-left health
pill and the waiting pill become one frosted status pill in plain words.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/server/lib/src/server_hub.dart

@@ -1,5 +1,6 @@
 import 'dart:async';
 import 'dart:convert';
+import 'dart:typed_data';
 
 import 'package:relic/relic.dart';
 import 'package:sync_relay_core/core.dart';
@@ -162,9 +163,17 @@ class ServerHub {
 /// `GET /a/<sid>/<token>/<hash>`: a current member's picture by its
 /// content hash, for members (valid, unkicked token) only. The bytes for a
 /// hash never change, so clients may cache them for good.
-void mountAvatarRoute(RelicApp app, ServerHub hub) {
+void mountAvatarRoute(RelicApp app, ServerHub hub) =>
+    _mountPictureRoute(app, hub, 'a', hub.engine.avatarFor);
+
+/// `GET /i/<sid>/<token>/<hash>`: the current media's art (`art`) by hash,
+/// same rules as [mountAvatarRoute].
+void mountArtRoute(RelicApp app, ServerHub hub) =>
+    _mountPictureRoute(app, hub, 'i', hub.engine.artFor);
+
+void _mountPictureRoute(RelicApp app, ServerHub hub, String prefix, Uint8List? Function(String hash) lookup) {
   Response status(int code) => Response(code, body: Body.fromString('status $code'));
-  app.get('/a/:sid/:token/:hash', (final req) {
+  app.get('/$prefix/:sid/:token/:hash', (final req) {
     final sid = req.pathParameters.raw[#sid] ?? '';
     final token = req.pathParameters.raw[#token] ?? '';
     final hash = req.pathParameters.raw[#hash] ?? '';
@@ -178,7 +187,7 @@ void mountAvatarRoute(RelicApp app, ServerHub hub) {
       default:
         break;
     }
-    final bytes = hub.engine.avatarFor(hash);
+    final bytes = lookup(hash);
     final type = bytes == null ? null : avatarImageType(bytes);
     if (bytes == null || type == null) return status(404);
     return Response.ok(
@@ -402,6 +411,12 @@ void mountSyncRoute(
               if (name != null) viewer.name = name;
               hub.engine.applyProfile(token, name: name, avatar: avatar);
               hub.changed();
+            case 'art':
+              if (token == null) return;
+              final art = ArtMessage.fromJson(decoded);
+              if (hub.engine.applyArt(token, art.mediaId, poster: art.poster, banner: art.banner)) {
+                hub.broadcastState();
+              }
             case 'report':
               if (token == null) return;
               final report = ReportMessage.fromJson(decoded);

packages/server/lib/src/sync_server.dart

@@ -65,6 +65,7 @@ class SyncServer {
     mountSessionMediaRoute(_app, sessions);
     mountRelayRoutes(_app, sessions, () => hub.relay);
     mountAvatarRoute(_app, hub);
+    mountArtRoute(_app, hub);
     mountJellyfinRelayRoute(
         _app, sessions, () => hub.jellyfin, () => _relayClient ??= HttpClient());
     // advertiseHost is only an explicit override; otherwise echo what the client dialled.

packages/server/test/server_auth_test.dart

@@ -390,6 +390,98 @@ void main() {
       } catch (_) {}
     });
 
+    test('art: swapper only, current mediaId, hashes in state, /i serves', () async {
+      final jpeg = Uint8List.fromList([0xFF, 0xD8, 0xFF, ...List<int>.generate(200, (i) => (i * 3) % 256)]);
+      final png = Uint8List.fromList([0x89, 0x50, 0x4E, 0x47, ...List<int>.generate(200, (i) => i % 256)]);
+      final clients = <WebSocketChannel>[];
+      final subs = <StreamSubscription<Object?>>[];
+      Future<(WebSocketChannel, List<Map<String, Object?>>, String)> connect(String name) async {
+        final ch = WebSocketChannel.connect(Uri.parse('ws://127.0.0.1:${server.boundPort}/sync'));
+        final messages = <Map<String, Object?>>[];
+        clients.add(ch);
+        subs.add(ch.stream.listen((m) => messages.add(Map<String, Object?>.from(jsonDecode('$m') as Map))));
+        ch.sink.add(jsonEncode(HelloMessage(
+            proto: RelayConstants.protoVersion,
+            secret: 'shh',
+            user: HelloUser(name: name),
+            media: const HelloMedia(name: 'f.bin', size: 8192, duration: 10.0)).toJson()));
+        final deadline = DateTime.now().add(const Duration(seconds: 5));
+        while (!messages.any((m) => m['t'] == 'welcome')) {
+          if (DateTime.now().isAfter(deadline)) fail('no welcome');
+          await Future.delayed(const Duration(milliseconds: 20));
+        }
+        return (ch, messages, messages.firstWhere((m) => m['t'] == 'welcome')['token'] as String);
+      }
+
+      Future<Map<String, Object?>> waitFor(
+          List<Map<String, Object?>> messages, bool Function(Map<String, Object?>) test) async {
+        final deadline = DateTime.now().add(const Duration(seconds: 5));
+        while (DateTime.now().isBefore(deadline)) {
+          for (final m in messages) {
+            if (test(m)) return m;
+          }
+          await Future.delayed(const Duration(milliseconds: 20));
+        }
+        fail('timed out; got $messages');
+      }
+
+      Map<String, Object?>? artOf(Map<String, Object?> state) =>
+          (state['media'] as Map?)?['art'] as Map<String, Object?>?;
+      Future<HttpClientResponse> artGet(String token, String hash) async =>
+          (await http.get('127.0.0.1', server.boundPort, '/i/default/$token/$hash')).close();
+
+      try {
+        final (a, aMsgs, aToken) = await connect('alice');
+        final (b, bMsgs, bToken) = await connect('bob');
+        a.sink.add(jsonEncode(const SwapIntent(
+            media: HelloMedia(name: 'Show - 01.mkv', size: 1, duration: 0, url: 'http://example.com/a.mkv')).toJson()));
+        final swapped = await waitFor(bMsgs, (m) => m['t'] == 'state' && (m['media'] as Map?)?['name'] == 'Show - 01.mkv');
+        final mediaId = swapped['mediaId'] as int;
+
+        // Not the swapper, or a stale mediaId: ignored.
+        b.sink.add(jsonEncode(ArtMessage(mediaId: mediaId, poster: base64Encode(png)).toJson()));
+        a.sink.add(jsonEncode(ArtMessage(mediaId: mediaId - 1, poster: base64Encode(png)).toJson()));
+        await Future.delayed(const Duration(milliseconds: 300));
+        expect(server.hub.engine.poster, isNull);
+
+        a.sink.add(jsonEncode(ArtMessage(mediaId: mediaId, poster: base64Encode(jpeg), banner: base64Encode(png)).toJson()));
+        final withArt = await waitFor(bMsgs, (m) => m['t'] == 'state' && artOf(m) != null);
+        final art = artOf(withArt)!;
+        expect(art, {'poster': avatarHashOf(jpeg), 'banner': avatarHashOf(png)});
+
+        // Any member (a guest without Jellyfin) fetches it.
+        final ok = await artGet(bToken, art['poster'] as String);
+        expect(ok.statusCode, 200);
+        expect(ok.headers.contentType?.mimeType, 'image/jpeg');
+        expect(ok.headers.value('cache-control'), contains('immutable'));
+        expect(await ok.expand((c) => c).toList(), jpeg);
+        final unknown = await artGet(bToken, '0123456789abcdef');
+        expect(unknown.statusCode, 404);
+        await unknown.drain();
+        final noToken = await artGet('nope', art['poster'] as String);
+        expect(noToken.statusCode, 401);
+        await noToken.drain();
+
+        // Any swap clears the art.
+        b.sink.add(jsonEncode(const SwapIntent(
+            media: HelloMedia(name: 'Other.mkv', size: 1, duration: 0, url: 'http://example.com/b.mkv')).toJson()));
+        final cleared = await waitFor(aMsgs, (m) => m['t'] == 'state' && (m['media'] as Map?)?['name'] == 'Other.mkv');
+        expect(artOf(cleared), isNull);
+        final gone = await artGet(aToken, art['poster'] as String);
+        expect(gone.statusCode, 404);
+        await gone.drain();
+      } finally {
+        for (final sub in subs) {
+          await sub.cancel();
+        }
+        for (final ch in clients) {
+          try {
+            await ch.sink.close();
+          } catch (_) {}
+        }
+      }
+    });
+
     test('profile: rename + avatar feed, state carries hash, /a gated', () async {
       final png = Uint8List.fromList([0x89, 0x50, 0x4E, 0x47, ...List<int>.generate(296, (i) => (i * 7) % 256)]);
       final ch = WebSocketChannel.connect(