feat(dl): add --all-drm to license Widevine and PlayReady per track

Each DRM system sends one challenge per KID set in a run, also when a vault has the content keys. Needs a CDM for each system in the cdm config.

docs/guide/cli-reference.md

@@ -83,7 +83,7 @@ unshackle dl [OPTIONS] SERVICE [SERVICE ARGS...]
 | `-c`, `--channels` | - | Audio channels; matches sub-layouts (5.1 ≈ 6.0). |
 | `-naa`, `--noatmos` | off | Exclude Dolby Atmos audio tracks. |
 | `--worst` | off | Pick the lowest bitrate within the requested quality. **Requires `-q`.** |
-| `--best-available`, `--warn-only` | off | Warn and continue when a requested resolution, range, or language is absent, instead of failing. |
+| `--best-available`, `--warn-only` | off | Warn and continue when a requested resolution, range, or language is absent, instead of failing. With `--all-drm`, also when one DRM system does not license. |
 | `-rvb`, `--real-video-bitrate` | off | Probe real media size for true video bitrates, overriding the manifest. |
 | `-rab`, `--real-audio-bitrate` | off | Same for audio (slower). |
 
@@ -194,6 +194,7 @@ order the service used, then renumbers the episodes into the order you asked for
 | `--cdm-only` / `--vaults-only` | Use only the CDM, or only Key Vaults, for key acquisition. |
 | `--cdm <name>` | Use the named CDM device from the `cdm` config mapping for this run, ignoring the service/default mapping. Over `--remote`, that device licenses the remote session, not the server CDM. |
 | `--skip-dl` | Skip the download but still retrieve keys. |
+| `--all-drm` | License each track with both Widevine and PlayReady. Needs a CDM for each DRM system. Not for use with `--vaults-only` or `--cdm`. |
 | `--export` | Export track info and keys to a `mediaexport` JSON file in the exports directory. |
 
 ### Network & proxy

docs/guide/downloading.md

@@ -97,7 +97,7 @@ By default a missing requested resolution is an error. Two flags change that:
 
 | Flag | Behaviour |
 | --- | --- |
-| `--best-available` (`--warn-only`) | If the requested resolution(s) are not present, continue with the best that *is* available instead of failing. Also softens missing video/audio/subtitle languages and hybrid fallbacks. |
+| `--best-available` (`--warn-only`) | If the requested resolution(s) are not present, continue with the best that *is* available instead of failing. Also softens missing video/audio/subtitle languages and hybrid fallbacks, and with `--all-drm` a DRM system that does not license. |
 | `--worst` | Within the specified quality, pick the **lowest** bitrate rendition. **Requires `-q/--quality`.** |
 
 ```shell title="Never fail on a missing resolution"
@@ -662,6 +662,7 @@ Before committing to a long download, inspect what unshackle *would* do:
 | `--list` | List the tracks the service exposes for each title, then stop. No selection, no download. |
 | `--list-titles` | List every title the service returned, then stop. `-w`, `--latest-episode` and `--latest-episodes` are not applied to this listing. |
 | `--skip-dl` | Skip downloading but still acquire the decryption keys. |
+| `--all-drm` | License each track with both Widevine and PlayReady. See [Widevine and PlayReady on the same title](drm-and-cdm.md#widevine-and-playready-on-the-same-title). |
 
 ```shell title="See the track selection without downloading"
 unshackle dl -q 1080 -v H.265 -r HDR10 --list EXAMPLE 81234567
@@ -795,6 +796,13 @@ older unshackle `version: 2` files and unidl's own export files.
 unshackle dl --skip-dl --export EXAMPLE 81234567
 ```
 
+Add `--all-drm` to send a challenge for each DRM system the title offers. The export then
+holds the DRM init data of both.
+
+```shell title="License with Widevine and PlayReady, no download"
+unshackle dl --skip-dl --all-drm --export EXAMPLE 81234567
+```
+
 The file name tells what the file holds, in the form
 `{title}.{scope}.{resolutions}.{codecs}.{ranges}.{manifests}.{audio}-{SERVICE}.json`:
 

docs/guide/drm-and-cdm.md

@@ -482,6 +482,42 @@ Use the `cdm` mapping's [DRM-based selection](#advanced-selection-by-quality-drm
 to configure a device for each system. unshackle selects the right one per track
 automatically.
 
+### License both systems with `--all-drm`
+
+By default a track licenses with one DRM system. `--all-drm` sends a challenge for
+Widevine and for PlayReady on each track that offers both. Use it with `--skip-dl` and
+`--export` to keep the content keys and the DRM init data of both systems. The two
+systems can return different sets of KIDs, and unshackle keeps the content keys of both.
+
+```shell
+unshackle dl --skip-dl --all-drm --export EXAMPLE 81234567
+```
+
+- The `cdm` mapping must name a device for each system. A single device name, or `--cdm`,
+  stops the run with an error that names the missing system.
+- Each DRM system sends one challenge for a set of KIDs in a run. A content key in a
+  Key Vault does not stop the challenge, so `--vaults-only` is refused.
+- A service with a Widevine licence function only gets the PlayReady challenge through that
+  function. If its licence server refuses the challenge, that DRM system does not license.
+- If one DRM system does not license, the title fails. With `--best-available` unshackle
+  shows a warning and continues, if the other system gave the content key of the track.
+  unshackle does not send the challenge again for the same KIDs in that run.
+- A track gets its DRM systems from the manifest. For a DASH track or a direct URL,
+  unshackle also reads the init segment for a system that the manifest does not carry.
+- The service gets a challenge from each DRM system for each set of KIDs. A licence server
+  that limits the request rate can answer `429`, and unshackle then tries again.
+
+!!! note "Where `--all-drm` licenses one system only"
+    - A service that gets a different manifest for each DRM system. unshackle shows a
+      warning one time when a track offers one system only.
+    - A service that fetched its playback for one DRM system and refuses the other. That
+      system does not license, so the title fails unless you use `--best-available`.
+    - An HLS playlist that changes its `EXT-X-KEY` entries part-way: only the first set
+      licenses with the second system.
+    - A remote session that the server CDM licenses, and `unshackle import`. unshackle
+      shows a warning and ignores the flag.
+    - A remote CDM that stores content keys can answer without a challenge to the service.
+
 ## Keys, vaults, and caching
 
 Fetching a license is comparatively slow and, for some services, rate-limited.