fix(netflix): improve audio and subtitle track hydration logic

- Update joc value for atmos content profile from 6 to 16
- Add informative log message summarizing total audio and subtitle tracks to hydrate
- Refactor hydration loop to handle mismatched lengths of audio and subtitle tracks more clearly
- Skip hydration if no audio tracks are available for the current index
- Ensure valid subtitle track ID is used in manifest request to avoid API errors
- Add detailed debug logs for processing hydrated audio and subtitle streams
- Handle exceptions gracefully for each stream and track hydration step with warnings
- Log when no tracks need hydration to improve observability

.gitignore

@@ -1,5 +1,4 @@
 # unshackle
-unshackle.yaml
 unshackle.yml
 update_check.json
 *.mkv
@@ -25,7 +24,6 @@ unshackle/certs/
 unshackle/WVDs/
 unshackle/PRDs/
 temp/
-services/
 
 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -235,3 +233,4 @@ cython_debug/
 marimo/_static/
 marimo/_lsp/
 __marimo__/
+Cache

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "unshackle"
-version = "1.4.4"
+version = "1.4.3"
 description = "Modular Movie, TV, and Music Archival Software."
 authors = [{ name = "unshackle team" }]
 requires-python = ">=3.10,<3.13"

unshackle/commands/dl.py

@@ -299,6 +299,21 @@ class dl:
         if getattr(config, "decryption_map", None):
             config.decryption = config.decryption_map.get(self.service, config.decryption)
 
+        with console.status("Loading DRM CDM...", spinner="dots"):
+            try:
+                self.cdm = self.get_cdm(self.service, self.profile)
+            except ValueError as e:
+                self.log.error(f"Failed to load CDM, {e}")
+                sys.exit(1)
+
+            if self.cdm:
+                if hasattr(self.cdm, "device_type") and self.cdm.device_type.name in ["ANDROID", "CHROME"]:
+                    self.log.info(f"Loaded Widevine CDM: {self.cdm.system_id} (L{self.cdm.security_level})")
+                else:
+                    self.log.info(
+                        f"Loaded PlayReady CDM: {self.cdm.certificate_chain.get_name()} (L{self.cdm.security_level})"
+                    )
+
         with console.status("Loading Key Vaults...", spinner="dots"):
             self.vaults = Vaults(self.service)
             total_vaults = len(config.key_vaults)
@@ -337,24 +352,6 @@ class dl:
             else:
                 self.log.debug("No vaults are currently active")
 
-        with console.status("Loading DRM CDM...", spinner="dots"):
-            try:
-                self.cdm = self.get_cdm(self.service, self.profile)
-            except ValueError as e:
-                self.log.error(f"Failed to load CDM, {e}")
-                sys.exit(1)
-
-            if self.cdm:
-                if isinstance(self.cdm, DecryptLabsRemoteCDM):
-                    drm_type = "PlayReady" if self.cdm.is_playready else "Widevine"
-                    self.log.info(f"Loaded {drm_type} Remote CDM: DecryptLabs (L{self.cdm.security_level})")
-                elif hasattr(self.cdm, "device_type") and self.cdm.device_type.name in ["ANDROID", "CHROME"]:
-                    self.log.info(f"Loaded Widevine CDM: {self.cdm.system_id} (L{self.cdm.security_level})")
-                else:
-                    self.log.info(
-                        f"Loaded PlayReady CDM: {self.cdm.certificate_chain.get_name()} (L{self.cdm.security_level})"
-                    )
-
         self.proxy_providers = []
         if no_proxy:
             ctx.params["proxy"] = None
@@ -877,12 +874,7 @@ class dl:
                                         ),
                                         licence=partial(
                                             service.get_playready_license
-                                            if (
-                                                isinstance(self.cdm, PlayReadyCdm)
-                                                or (
-                                                    isinstance(self.cdm, DecryptLabsRemoteCDM) and self.cdm.is_playready
-                                                )
-                                            )
+                                            if isinstance(self.cdm, PlayReadyCdm)
                                             and hasattr(service, "get_playready_license")
                                             else service.get_widevine_license,
                                             title=title,
@@ -1167,7 +1159,13 @@ class dl:
                     final_filename = title.get_filename(media_info, show_service=not no_source)
 
                     if not no_folder and isinstance(title, (Episode, Song)):
-                        final_dir /= title.get_filename(media_info, show_service=not no_source, folder=True)
+                        if isinstance(title, Episode):
+                            # Create nested structure: {title}/Season {season:02}/{filename}
+                            final_dir /= title.get_filename(media_info, show_service=not no_source, folder=True)
+                            final_dir /= title.get_season_folder()
+                        else:
+                            # For Song, use existing logic
+                            final_dir /= title.get_filename(media_info, show_service=not no_source, folder=True)
 
                     final_dir.mkdir(parents=True, exist_ok=True)
                     final_path = final_dir / f"{final_filename}{muxed_path.suffix}"
@@ -1209,22 +1207,10 @@ class dl:
         if not drm:
             return
 
-        if isinstance(drm, Widevine):
-            if not isinstance(self.cdm, (WidevineCdm, DecryptLabsRemoteCDM)) or (
-                isinstance(self.cdm, DecryptLabsRemoteCDM) and self.cdm.is_playready
-            ):
-                widevine_cdm = self.get_cdm(self.service, self.profile, drm="widevine")
-                if widevine_cdm:
-                    self.log.info("Switching to Widevine CDM for Widevine content")
-                    self.cdm = widevine_cdm
-        elif isinstance(drm, PlayReady):
-            if not isinstance(self.cdm, (PlayReadyCdm, DecryptLabsRemoteCDM)) or (
-                isinstance(self.cdm, DecryptLabsRemoteCDM) and not self.cdm.is_playready
-            ):
-                playready_cdm = self.get_cdm(self.service, self.profile, drm="playready")
-                if playready_cdm:
-                    self.log.info("Switching to PlayReady CDM for PlayReady content")
-                    self.cdm = playready_cdm
+        if isinstance(drm, Widevine) and not isinstance(self.cdm, WidevineCdm):
+            self.cdm = self.get_cdm(self.service, self.profile, drm="widevine")
+        elif isinstance(drm, PlayReady) and not isinstance(self.cdm, PlayReadyCdm):
+            self.cdm = self.get_cdm(self.service, self.profile, drm="playready")
 
         if isinstance(drm, Widevine):
             with self.DRM_TABLE_LOCK:
@@ -1462,8 +1448,8 @@ class dl:
                     return Credential(*credentials)
                 return Credential.loads(credentials)  # type: ignore
 
+    @staticmethod
     def get_cdm(
-        self,
         service: str,
         profile: Optional[str] = None,
         drm: Optional[str] = None,
@@ -1497,18 +1483,10 @@ class dl:
 
         cdm_api = next(iter(x for x in config.remote_cdm if x["name"] == cdm_name), None)
         if cdm_api:
-            is_decrypt_lab = True if cdm_api.get("type") == "decrypt_labs" else False
-            if is_decrypt_lab:
-                del cdm_api["name"]
-                del cdm_api["type"]
-
-                # All DecryptLabs CDMs use DecryptLabsRemoteCDM
-                return DecryptLabsRemoteCDM(service_name=service, vaults=self.vaults, **cdm_api)
-            else:
-                del cdm_api["name"]
-                if "type" in cdm_api:
-                    del cdm_api["type"]
-                return RemoteCdm(**cdm_api)
+            is_decrypt_lab = True if cdm_api["type"] == "decrypt_labs" else False
+            del cdm_api["name"]
+            del cdm_api["type"]
+            return DecryptLabsRemoteCDM(service_name=service, **cdm_api) if is_decrypt_lab else RemoteCdm(**cdm_api)
 
         prd_path = config.directories.prds / f"{cdm_name}.prd"
         if not prd_path.is_file():

unshackle/core/__init__.py

@@ -1 +1 @@
-__version__ = "1.4.4"
+__version__ = "1.4.3"

unshackle/core/__main__.py

@@ -69,7 +69,7 @@ def main(version: bool, debug: bool, log_path: Path) -> None:
                     r" ▀▀▀ ▀▀ █▪ ▀▀▀▀ ▀▀▀ · ▀  ▀ ·▀▀▀ ·▀  ▀.▀▀▀  ▀▀▀ ",
                     style="ascii.art",
                 ),
-                f"v [repr.number]{__version__}[/] - © 2025 - github.com/unshackle-dl/unshackle",
+                "v 3.3.3 Copyright © 2019-2025 rlaphoenix" + f"\nv [repr.number]{__version__}[/] - unshackle",
             ),
             (1, 11, 1, 10),
             expand=True,

unshackle/core/cdm/decrypt_labs_remote_cdm.py

@@ -1,585 +1,143 @@
-from __future__ import annotations
-
 import base64
 import secrets
-from typing import Any, Dict, List, Optional, Union
+from typing import Optional, Type, Union
 from uuid import UUID
 
 import requests
-from pywidevine.device import DeviceTypes
-from requests import Session
+from pywidevine import PSSH, Device, DeviceTypes, Key, RemoteCdm
+from pywidevine.license_protocol_pb2 import SignedDrmCertificate, SignedMessage
 
-from unshackle.core.vaults import Vaults
+# Copyright 2024 by DevYukine.
 
 
-class MockCertificateChain:
-    """Mock certificate chain for PlayReady compatibility."""
-
-    def __init__(self, name: str):
-        self._name = name
-
-    def get_name(self) -> str:
-        return self._name
-
-
-class Key:
-    """Key object compatible with pywidevine."""
-
-    def __init__(self, kid: str, key: str, type_: str = "CONTENT"):
-        if isinstance(kid, str):
-            clean_kid = kid.replace("-", "")
-            if len(clean_kid) == 32:
-                self.kid = UUID(hex=clean_kid)
-            else:
-                self.kid = UUID(hex=clean_kid.ljust(32, "0"))
-        else:
-            self.kid = kid
-
-        if isinstance(key, str):
-            self.key = bytes.fromhex(key)
-        else:
-            self.key = key
-
-        self.type = type_
-
-
-class DecryptLabsRemoteCDMExceptions:
-    """Exception classes for compatibility with pywidevine CDM."""
-
-    class InvalidSession(Exception):
-        """Raised when session ID is invalid."""
-
-    class TooManySessions(Exception):
-        """Raised when session limit is reached."""
-
-    class InvalidInitData(Exception):
-        """Raised when PSSH/init data is invalid."""
-
-    class InvalidLicenseType(Exception):
-        """Raised when license type is invalid."""
-
-    class InvalidLicenseMessage(Exception):
-        """Raised when license message is invalid."""
-
-    class InvalidContext(Exception):
-        """Raised when session has no context data."""
-
-    class SignatureMismatch(Exception):
-        """Raised when signature verification fails."""
-
-
-class DecryptLabsRemoteCDM:
-    """
-    Decrypt Labs Remote CDM implementation compatible with pywidevine's CDM interface.
-
-    This class provides a drop-in replacement for pywidevine's local CDM using
-    Decrypt Labs' KeyXtractor API service.
-    """
-
-    service_certificate_challenge = b"\x08\x04"
-
+class DecryptLabsRemoteCDM(RemoteCdm):
     def __init__(
         self,
+        device_type: Union[DeviceTypes, str],
+        system_id: int,
+        security_level: int,
+        host: str,
         secret: str,
-        host: str = "https://keyxtractor.decryptlabs.com",
-        device_name: str = "ChromeCDM",
-        service_name: Optional[str] = None,
-        vaults: Optional[Vaults] = None,
-        device_type: Optional[str] = None,
-        system_id: Optional[int] = None,
-        security_level: Optional[int] = None,
-        **kwargs,
+        device_name: str,
+        service_name: str,
     ):
-        """
-        Initialize Decrypt Labs Remote CDM for Widevine and PlayReady schemes.
-
-        Args:
-            secret: Decrypt Labs API key (matches config format)
-            host: Decrypt Labs API host URL (matches config format)
-            device_name: DRM scheme (ChromeCDM, L1, L2 for Widevine; SL2, SL3 for PlayReady)
-            service_name: Service name for key caching and vault operations
-            vaults: Vaults instance for local key caching
-            device_type: Device type (CHROME, ANDROID, PLAYREADY) - for compatibility
-            system_id: System ID - for compatibility
-            security_level: Security level - for compatibility
-        """
-        _ = kwargs
-
-        self.secret = secret
-        self.host = host.rstrip("/")
-        self.device_name = device_name
-        self.service_name = service_name or ""
-        self.vaults = vaults
-
-        self._device_type_str = device_type
-        if device_type:
-            self.device_type = self._get_device_type_enum(device_type)
-
-        self._is_playready = (device_type and device_type.upper() == "PLAYREADY") or (device_name in ["SL2", "SL3"])
-
-        if self._is_playready:
-            self.system_id = system_id or 0
-            self.security_level = security_level or (2000 if device_name == "SL2" else 3000)
-        else:
-            self.system_id = system_id or 26830
-            self.security_level = security_level or 3
-
-        self._sessions: Dict[bytes, Dict[str, Any]] = {}
-        self._pssh_b64 = None
-        self._http_session = Session()
-        self._http_session.headers.update(
-            {
-                "decrypt-labs-api-key": self.secret,
-                "Content-Type": "application/json",
-                "User-Agent": "unshackle-decrypt-labs-cdm/1.0",
-            }
-        )
-
-    def _get_device_type_enum(self, device_type: str):
-        """Convert device type string to enum for compatibility."""
-        device_type_upper = device_type.upper()
-        if device_type_upper == "ANDROID":
-            return DeviceTypes.ANDROID
-        elif device_type_upper == "CHROME":
-            return DeviceTypes.CHROME
-        else:
-            return DeviceTypes.CHROME
-
-    @property
-    def is_playready(self) -> bool:
-        """Check if this CDM is in PlayReady mode."""
-        return self._is_playready
-
-    @property
-    def certificate_chain(self) -> MockCertificateChain:
-        """Mock certificate chain for PlayReady compatibility."""
-        return MockCertificateChain(f"{self.device_name}_Remote")
-
-    def set_pssh_b64(self, pssh_b64: str) -> None:
-        """Store base64-encoded PSSH data for PlayReady compatibility."""
-        self._pssh_b64 = pssh_b64
-
-    def _generate_session_id(self) -> bytes:
-        """Generate a unique session ID."""
-        return secrets.token_bytes(16)
-
-    def _get_init_data_from_pssh(self, pssh: Any) -> str:
-        """Extract init data from various PSSH formats."""
-        if self.is_playready and self._pssh_b64:
-            return self._pssh_b64
-
-        if hasattr(pssh, "dumps"):
-            dumps_result = pssh.dumps()
-
-            if isinstance(dumps_result, str):
-                try:
-                    base64.b64decode(dumps_result)
-                    return dumps_result
-                except Exception:
-                    return base64.b64encode(dumps_result.encode("utf-8")).decode("utf-8")
-            else:
-                return base64.b64encode(dumps_result).decode("utf-8")
-        elif hasattr(pssh, "raw"):
-            raw_data = pssh.raw
-            if isinstance(raw_data, str):
-                raw_data = raw_data.encode("utf-8")
-            return base64.b64encode(raw_data).decode("utf-8")
-        elif hasattr(pssh, "__class__") and "WrmHeader" in pssh.__class__.__name__:
-            if self.is_playready:
-                raise ValueError("PlayReady WRM header received but no PSSH B64 was set via set_pssh_b64()")
-
-            if hasattr(pssh, "raw_bytes"):
-                return base64.b64encode(pssh.raw_bytes).decode("utf-8")
-            elif hasattr(pssh, "bytes"):
-                return base64.b64encode(pssh.bytes).decode("utf-8")
-            else:
-                raise ValueError(f"Cannot extract PSSH data from WRM header type: {type(pssh)}")
-        else:
-            raise ValueError(f"Unsupported PSSH type: {type(pssh)}")
-
-    def open(self) -> bytes:
-        """
-        Open a new CDM session.
-
-        Returns:
-            Session identifier as bytes
-        """
-        session_id = self._generate_session_id()
-        self._sessions[session_id] = {
-            "service_certificate": None,
-            "keys": [],
-            "pssh": None,
-            "challenge": None,
-            "decrypt_labs_session_id": None,
-        }
-        return session_id
-
-    def close(self, session_id: bytes) -> None:
-        """
-        Close a CDM session.
-
-        Args:
-            session_id: Session identifier
-
-        Raises:
-            ValueError: If session ID is invalid
-        """
-        if session_id not in self._sessions:
-            raise DecryptLabsRemoteCDMExceptions.InvalidSession(f"Invalid session ID: {session_id.hex()}")
-
-        del self._sessions[session_id]
-
-    def get_service_certificate(self, session_id: bytes) -> Optional[bytes]:
-        """
-        Get the service certificate for a session.
-
-        Args:
-            session_id: Session identifier
-
-        Returns:
-            Service certificate if set, None otherwise
-
-        Raises:
-            ValueError: If session ID is invalid
-        """
-        if session_id not in self._sessions:
-            raise DecryptLabsRemoteCDMExceptions.InvalidSession(f"Invalid session ID: {session_id.hex()}")
-
-        return self._sessions[session_id]["service_certificate"]
-
-    def set_service_certificate(self, session_id: bytes, certificate: Optional[Union[bytes, str]]) -> str:
-        """
-        Set the service certificate for a session.
-
-        Args:
-            session_id: Session identifier
-            certificate: Service certificate (bytes or base64 string)
-
-        Returns:
-            Certificate status message
-
-        Raises:
-            ValueError: If session ID is invalid
-        """
-        if session_id not in self._sessions:
-            raise DecryptLabsRemoteCDMExceptions.InvalidSession(f"Invalid session ID: {session_id.hex()}")
-
-        if certificate is None:
-            self._sessions[session_id]["service_certificate"] = None
-            return "Removed"
-
-        if isinstance(certificate, str):
-            certificate = base64.b64decode(certificate)
-
-        self._sessions[session_id]["service_certificate"] = certificate
-        return "Successfully set Service Certificate"
-
-    def has_cached_keys(self, session_id: bytes) -> bool:
-        """
-        Check if cached keys are available for the session.
-
-        Args:
-            session_id: Session identifier
-
-        Returns:
-            True if cached keys are available
-
-        Raises:
-            ValueError: If session ID is invalid
-        """
-        if session_id not in self._sessions:
-            raise DecryptLabsRemoteCDMExceptions.InvalidSession(f"Invalid session ID: {session_id.hex()}")
-
-        session = self._sessions[session_id]
-        pssh = session.get("pssh")
-
-        if not pssh:
-            return False
-
-        if self.vaults:
-            key_ids = []
-            if hasattr(pssh, "key_ids"):
-                key_ids = pssh.key_ids
-            elif hasattr(pssh, "kids"):
-                key_ids = pssh.kids
-
-            for kid in key_ids:
-                key, _ = self.vaults.get_key(kid)
-                if key and key.count("0") != len(key):
-                    return True
-
-        if self.service_name:
-            try:
-                key_ids = []
-                if hasattr(pssh, "key_ids"):
-                    key_ids = [kid.hex for kid in pssh.key_ids]
-                elif hasattr(pssh, "kids"):
-                    key_ids = [kid.hex for kid in pssh.kids]
-
-                if key_ids:
-                    response = self._http_session.post(
-                        f"{self.host}/get-cached-keys",
-                        json={"service": self.service_name, "kid": key_ids},
-                        timeout=30,
-                    )
-
-                if response.status_code == 200:
-                    data = response.json()
-                    return (
-                        data.get("message") == "success"
-                        and "cached_keys" in data
-                        and isinstance(data["cached_keys"], list)
-                        and len(data["cached_keys"]) > 0
-                    )
-
-            except Exception:
-                pass
-
-        return False
-
-    def get_license_challenge(
-        self, session_id: bytes, pssh_or_wrm: Any, license_type: str = "STREAMING", privacy_mode: bool = True
-    ) -> bytes:
-        """
-        Generate a license challenge using Decrypt Labs API.
-
-        Args:
-            session_id: Session identifier
-            pssh_or_wrm: PSSH object or WRM header (for PlayReady compatibility)
-            license_type: Type of license (STREAMING, OFFLINE, AUTOMATIC) - for compatibility only
-            privacy_mode: Whether to use privacy mode - for compatibility only
-
-        Returns:
-            License challenge as bytes
-
-        Raises:
-            InvalidSession: If session ID is invalid
-            requests.RequestException: If API request fails
-        """
-        _ = license_type, privacy_mode
-
-        if session_id not in self._sessions:
-            raise DecryptLabsRemoteCDMExceptions.InvalidSession(f"Invalid session ID: {session_id.hex()}")
-
-        session = self._sessions[session_id]
-
-        session["pssh"] = pssh_or_wrm
-        init_data = self._get_init_data_from_pssh(pssh_or_wrm)
-
-        if self.has_cached_keys(session_id):
-            self._load_cached_keys(session_id)
-            return b""
-
-        request_data = {"scheme": self.device_name, "init_data": init_data}
-
-        if self.device_name in ["L1", "L2", "SL2", "SL3"] and self.service_name:
-            request_data["service"] = self.service_name
-
-        if session["service_certificate"]:
-            request_data["service_certificate"] = base64.b64encode(session["service_certificate"]).decode("utf-8")
-
-        response = self._http_session.post(f"{self.host}/get-request", json=request_data, timeout=30)
-
-        if response.status_code != 200:
-            raise requests.RequestException(f"API request failed: {response.status_code} {response.text}")
-
-        data = response.json()
-
-        if data.get("message") != "success":
-            error_msg = data.get("message", "Unknown error")
-            if "details" in data:
-                error_msg += f" - Details: {data['details']}"
-            if "error" in data:
-                error_msg += f" - Error: {data['error']}"
-            raise requests.RequestException(f"API error: {error_msg}")
-
-        if data.get("message_type") == "cached-keys" or "cached_keys" in data:
-            cached_keys = data.get("cached_keys", [])
-            session["keys"] = self._parse_cached_keys(cached_keys)
-            return b""
-
-        challenge = base64.b64decode(data["challenge"])
-        session["challenge"] = challenge
-        session["decrypt_labs_session_id"] = data["session_id"]
-
-        return challenge
-
-    def parse_license(self, session_id: bytes, license_message: Union[bytes, str]) -> None:
-        """
-        Parse license response using Decrypt Labs API.
-
-        Args:
-            session_id: Session identifier
-            license_message: License response from license server
-
-        Raises:
-            ValueError: If session ID is invalid or no challenge available
-            requests.RequestException: If API request fails
-        """
-        if session_id not in self._sessions:
-            raise DecryptLabsRemoteCDMExceptions.InvalidSession(f"Invalid session ID: {session_id.hex()}")
-
-        session = self._sessions[session_id]
-
-        if session["keys"]:
-            return
-
-        if not session.get("challenge") or not session.get("decrypt_labs_session_id"):
-            raise ValueError("No challenge available - call get_license_challenge first")
-
-        if isinstance(license_message, str):
-            if self.is_playready and license_message.strip().startswith("<?xml"):
-                license_message = license_message.encode("utf-8")
-            else:
-                try:
-                    license_message = base64.b64decode(license_message)
-                except Exception:
-                    license_message = license_message.encode("utf-8")
-
-        pssh = session["pssh"]
-        init_data = self._get_init_data_from_pssh(pssh)
-
-        license_request_b64 = base64.b64encode(session["challenge"]).decode("utf-8")
-        license_response_b64 = base64.b64encode(license_message).decode("utf-8")
-
-        request_data = {
-            "scheme": self.device_name,
-            "session_id": session["decrypt_labs_session_id"],
-            "init_data": init_data,
-            "license_request": license_request_b64,
-            "license_response": license_response_b64,
-        }
-
-        response = self._http_session.post(f"{self.host}/decrypt-response", json=request_data, timeout=30)
-
-        if response.status_code != 200:
-            raise requests.RequestException(f"License decrypt failed: {response.status_code} {response.text}")
-
-        data = response.json()
-
-        if data.get("message") != "success":
-            error_msg = data.get("message", "Unknown error")
-            if "error" in data:
-                error_msg += f" - Error: {data['error']}"
-            if "details" in data:
-                error_msg += f" - Details: {data['details']}"
-            raise requests.RequestException(f"License decrypt error: {error_msg}")
-
-        session["keys"] = self._parse_keys_response(data)
-
-        if self.vaults and session["keys"]:
-            key_dict = {UUID(hex=key["kid"]): key["key"] for key in session["keys"] if key["type"] == "CONTENT"}
-            self.vaults.add_keys(key_dict)
-
-    def get_keys(self, session_id: bytes, type_: Optional[str] = None) -> List[Key]:
-        """
-        Get keys from the session.
-
-        Args:
-            session_id: Session identifier
-            type_: Optional key type filter (CONTENT, SIGNING, etc.)
-
-        Returns:
-            List of Key objects
-
-        Raises:
-            InvalidSession: If session ID is invalid
-        """
-        if session_id not in self._sessions:
-            raise DecryptLabsRemoteCDMExceptions.InvalidSession(f"Invalid session ID: {session_id.hex()}")
-
-        key_dicts = self._sessions[session_id]["keys"]
-        keys = [Key(kid=k["kid"], key=k["key"], type_=k["type"]) for k in key_dicts]
-
-        if type_:
-            keys = [key for key in keys if key.type == type_]
-
-        return keys
-
-    def _load_cached_keys(self, session_id: bytes) -> None:
-        """Load cached keys from vaults and Decrypt Labs API."""
-        session = self._sessions[session_id]
-        pssh = session["pssh"]
-        keys = []
-
-        if self.vaults:
-            key_ids = []
-            if hasattr(pssh, "key_ids"):
-                key_ids = pssh.key_ids
-            elif hasattr(pssh, "kids"):
-                key_ids = pssh.kids
-
-            for kid in key_ids:
-                key, _ = self.vaults.get_key(kid)
-                if key and key.count("0") != len(key):
-                    keys.append({"kid": kid.hex, "key": key, "type": "CONTENT"})
-
-        if not keys and self.service_name:
-            try:
-                key_ids = []
-                if hasattr(pssh, "key_ids"):
-                    key_ids = [kid.hex for kid in pssh.key_ids]
-                elif hasattr(pssh, "kids"):
-                    key_ids = [kid.hex for kid in pssh.kids]
-
-                if key_ids:
-                    response = self._http_session.post(
-                        f"{self.host}/get-cached-keys",
-                        json={"service": self.service_name, "kid": key_ids},
-                        timeout=30,
-                    )
-
-                    if response.status_code == 200:
-                        data = response.json()
-                        if data.get("message") == "success" and "cached_keys" in data:
-                            keys = self._parse_cached_keys(data["cached_keys"])
-
-            except Exception:
-                pass
-
-        session["keys"] = keys
-
-    def _parse_cached_keys(self, cached_keys_data: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
-        """Parse cached keys from API response.
-
-        Args:
-            cached_keys_data: List of cached key objects from API
-
-        Returns:
-            List of key dictionaries
-        """
-        keys = []
-
+        self.response_counter = 0
+        self.pssh = None
+        self.api_session_ids = {}
+        self.license_request = None
+        self.service_name = service_name
+        self.keys = {}
         try:
-            if cached_keys_data and isinstance(cached_keys_data, list):
-                for key_data in cached_keys_data:
-                    if "kid" in key_data and "key" in key_data:
-                        keys.append({"kid": key_data["kid"], "key": key_data["key"], "type": "CONTENT"})
+            super().__init__(device_type, system_id, security_level, host, secret, device_name)
         except Exception:
             pass
-        return keys
+        self.req_session = requests.Session()
+        self.req_session.headers.update({"decrypt-labs-api-key": secret})
 
-    def _parse_keys_response(self, data: Dict[str, Any]) -> List[Dict[str, Any]]:
-        """Parse keys from decrypt response."""
-        keys = []
+    @classmethod
+    def from_device(cls, device: Device) -> Type["DecryptLabsRemoteCDM"]:
+        raise NotImplementedError("You cannot load a DecryptLabsRemoteCDM from a local Device file.")
 
-        if "keys" in data and isinstance(data["keys"], str):
-            keys_string = data["keys"]
+    def open(self) -> bytes:
+        # We stub this method to return a random session ID for now, later we save the api session id and resolve by our random generated one.
+        return bytes.fromhex(secrets.token_hex(16))
 
-            for line in keys_string.split("\n"):
-                line = line.strip()
-                if line.startswith("--key "):
-                    key_part = line[6:]
-                    if ":" in key_part:
-                        kid, key = key_part.split(":", 1)
-                        keys.append({"kid": kid.strip(), "key": key.strip(), "type": "CONTENT"})
-        elif "keys" in data and isinstance(data["keys"], list):
-            for key_data in data["keys"]:
-                keys.append(
-                    {"kid": key_data.get("kid"), "key": key_data.get("key"), "type": key_data.get("type", "CONTENT")}
+    def close(self, session_id: bytes) -> None:
+        # We stub this method to do nothing.
+        pass
+
+    def set_service_certificate(self, session_id: bytes, certificate: Optional[Union[bytes, str]]) -> str:
+        if isinstance(certificate, bytes):
+            certificate = base64.b64encode(certificate).decode()
+
+        # certificate needs to be base64 to be sent off to the API.
+        # it needs to intentionally be kept as base64 encoded SignedMessage.
+
+        self.req_session.signed_device_certificate = certificate
+        self.req_session.privacy_mode = True
+
+        return "success"
+
+    def get_service_certificate(self, session_id: bytes) -> Optional[SignedDrmCertificate]:
+        raise NotImplementedError("This method is not implemented in this CDM")
+
+    def get_license_challenge(
+        self, session_id: bytes, pssh: PSSH, license_type: str = "STREAMING", privacy_mode: bool = True
+    ) -> bytes:
+        self.pssh = pssh
+
+        res = self.session(
+            self.host + "/get-request",
+            {
+                "init_data": self.pssh.dumps(),
+                "service_certificate": self.req_session.signed_device_certificate,
+                "scheme": "widevine" if self.security_level == 3 else "L1", # Using L1 CDM,
+                "service": self.service_name,
+            },
+        )
+
+        self.license_request = res["challenge"]
+        self.api_session_ids[session_id] = res["session_id"]
+
+        return base64.b64decode(self.license_request)
+
+    def parse_license(self, session_id: bytes, license_message: Union[SignedMessage, bytes, str]) -> None:
+        session_id_api = self.api_session_ids[session_id]
+        if session_id not in self.keys:
+            self.keys[session_id] = []
+        session_keys = self.keys[session_id]
+
+        if isinstance(license_message, dict) and "keys" in license_message:
+            session_keys.extend(
+                [
+                    Key(kid=Key.kid_to_uuid(x["kid"]), type_=x.get("type", "CONTENT"), key=bytes.fromhex(x["key"]))
+                    for x in license_message["keys"]
+                ]
+            )
+
+        else:
+            res = self.session(
+                self.host + "/decrypt-response",
+                {
+                    "session_id": session_id_api,
+                    "init_data": self.pssh.dumps(),
+                    "license_request": self.license_request,
+                    "license_response": license_message,
+                    "scheme": "widevine" if self.security_level == 3 else "L1",
+                },
+            )
+
+            original_keys = res["keys"].replace("\n", " ")
+            keys_separated = original_keys.split("--key ")
+            formatted_keys = []
+            for k in keys_separated:
+                if ":" in k:
+                    key = k.strip()
+                    formatted_keys.append(key)
+            for keys in formatted_keys:
+                session_keys.append(
+                    (
+                        Key(
+                            kid=UUID(bytes=bytes.fromhex(keys.split(":")[0])),
+                            type_="CONTENT",
+                            key=bytes.fromhex(keys.split(":")[1]),
+                        )
+                    )
                 )
 
-        return keys
+    def get_keys(self, session_id: bytes, type_: Optional[Union[int, str]] = None) -> list[Key]:
+        return self.keys[session_id]
 
+    def session(self, url, data, retries=3):
+        res = self.req_session.post(url, json=data).json()
 
-__all__ = ["DecryptLabsRemoteCDM"]
+        if res.get("message") != "success":
+            if "License Response Decryption Process Failed at the very beginning" in res.get("Error", ""):
+                if retries > 0:
+                    return self.session(url, data, retries=retries - 1)
+                else:
+                    raise ValueError(f"CDM API returned an error: {res['Error']}")
+            else:
+                raise ValueError(f"CDM API returned an error: {res['Error']}")
+
+        return res

unshackle/core/downloaders/aria2c.py

@@ -137,7 +137,6 @@ def download(
     if len(urls) > 1:
         split = 1
         file_allocation = "none"
-
     arguments = [
         # [Basic Options]
         "--input-file",
@@ -189,19 +188,36 @@ def download(
         p.stdin.close()
 
         while p.poll() is None:
+            # Get global statistics via RPC
             global_stats: dict[str, Any] = (
                 rpc(caller=partial(rpc_session.post, url=rpc_uri), secret=rpc_secret, method="aria2.getGlobalStat")
                 or {}
             )
 
             number_stopped = int(global_stats.get("numStoppedTotal", 0))
-            download_speed = int(global_stats.get("downloadSpeed", -1))
+            global_download_speed = int(global_stats.get("downloadSpeed", 0))
 
-            if number_stopped:
-                yield dict(completed=number_stopped)
-            if download_speed != -1:
-                yield dict(downloaded=f"{filesize.decimal(download_speed)}/s")
+            # Get active downloads via RPC for detailed progress tracking
+            active_downloads: list[dict[str, Any]] = (
+                rpc(
+                    caller=partial(rpc_session.post, url=rpc_uri),
+                    secret=rpc_secret,
+                    method="aria2.tellActive",
+                )
+                or []
+            )
 
+            # Calculate totals from active downloads
+            total_downloaded_size = 0
+            total_content_size = 0
+            active_download_speed = 0
+            
+            for download in active_downloads:
+                total_downloaded_size += int(download.get("completedLength", 0))
+                total_content_size += int(download.get("totalLength", 0))
+                active_download_speed += int(download.get("downloadSpeed", 0))
+
+            # Get stopped downloads via RPC to check for errors and completion
             stopped_downloads: list[dict[str, Any]] = (
                 rpc(
                     caller=partial(rpc_session.post, url=rpc_uri),
@@ -212,22 +228,46 @@ def download(
                 or []
             )
 
-            for dl in stopped_downloads:
-                if dl["status"] == "error":
+            # Add completed downloads to totals and handle errors
+            for download in stopped_downloads:
+                if download["status"] == "complete":
+                    completed_length = int(download.get("completedLength", 0))
+                    total_downloaded_size += completed_length
+                    total_content_size += completed_length
+                elif download["status"] == "error":
                     used_uri = next(
                         uri["uri"]
-                        for file in dl["files"]
+                        for file in download["files"]
                         if file["selected"] == "true"
                         for uri in file["uris"]
                         if uri["status"] == "used"
                     )
-                    error = f"Download Error (#{dl['gid']}): {dl['errorMessage']} ({dl['errorCode']}), {used_uri}"
+                    error = f"Download Error (#{download['gid']}): {download['errorMessage']} ({download['errorCode']}), {used_uri}"
                     error_pretty = "\n          ".join(
                         textwrap.wrap(error, width=console.width - 20, initial_indent="")
                     )
                     console.log(Text.from_ansi("\n[Aria2c]: " + error_pretty))
                     raise ValueError(error)
 
+            # Yield progress information
+            if total_content_size > 0:
+                downloaded = f"{filesize.decimal(total_downloaded_size)}/{filesize.decimal(total_content_size)} {filesize.decimal(active_download_speed)}/s"
+                yield dict(
+                    downloaded=downloaded,
+                    total=total_content_size,
+                    completed=total_downloaded_size
+                )
+            elif global_download_speed > 0:
+                yield dict(
+                    downloaded=f"{filesize.decimal(global_download_speed)}/s",
+                    speed_bytes_per_sec=global_download_speed
+                )
+
+            # Yield completion count
+            if number_stopped:
+                yield dict(completed=number_stopped)
+
+            # Exit when all downloads are complete
             if number_stopped == len(urls):
                 rpc(caller=partial(rpc_session.post, url=rpc_uri), secret=rpc_secret, method="aria2.shutdown")
                 break
@@ -274,11 +314,14 @@ def aria2c(
 
     Yields the following download status updates while chunks are downloading:
 
-    - {total: 100} (100% download total)
-    - {completed: 1} (1% download progress out of 100%)
-    - {downloaded: "10.1 MB/s"} (currently downloading at a rate of 10.1 MB/s)
+    - {total: 100} (total number of URLs to download)
+    - {completed: 1} (number of completed downloads)
+    - {downloaded: "50.2 MB/128.5 MB 10.1 MB/s", total: 134742016, completed: 52428800} (progress data)
+    - {downloaded: "10.1 MB/s", speed_bytes_per_sec: 10485760} (speed fallback data)
 
     The data is in the same format accepted by rich's progress.update() function.
+    However, The `downloaded` and `speed_bytes_per_sec` keys are custom and not natively 
+    accepted by all rich progress bars.
 
     Parameters:
         urls: Web URL(s) to file(s) to download. You can use a dictionary with the key
@@ -318,6 +361,7 @@ def aria2c(
             stdout=subprocess.DEVNULL,
             stderr=subprocess.DEVNULL,
         )
+        time.sleep(1)
 
         try:
             yield from download(urls, output_dir, filename, headers, cookies, local_proxy, max_workers)

unshackle/core/drm/playready.py

@@ -224,59 +224,14 @@ class PlayReady:
     def kids(self) -> list[UUID]:
         return self._kids
 
-    def _extract_keys_from_cdm(self, cdm: PlayReadyCdm, session_id: bytes) -> dict:
-        """Extract keys from CDM session with cross-library compatibility.
-
-        Args:
-            cdm: CDM instance
-            session_id: Session identifier
-
-        Returns:
-            Dictionary mapping KID UUIDs to hex keys
-        """
-        keys = {}
-        for key in cdm.get_keys(session_id):
-            if hasattr(key, "key_id"):
-                kid = key.key_id
-            elif hasattr(key, "kid"):
-                kid = key.kid
-            else:
-                continue
-
-            if hasattr(key, "key") and hasattr(key.key, "hex"):
-                key_hex = key.key.hex()
-            elif hasattr(key, "key") and isinstance(key.key, bytes):
-                key_hex = key.key.hex()
-            elif hasattr(key, "key") and isinstance(key.key, str):
-                key_hex = key.key
-            else:
-                continue
-
-            keys[kid] = key_hex
-        return keys
-
     def get_content_keys(self, cdm: PlayReadyCdm, certificate: Callable, licence: Callable) -> None:
         for kid in self.kids:
             if kid in self.content_keys:
                 continue
-
             session_id = cdm.open()
             try:
-                if hasattr(cdm, "set_pssh_b64") and self.pssh_b64:
-                    cdm.set_pssh_b64(self.pssh_b64)
-
                 challenge = cdm.get_license_challenge(session_id, self.pssh.wrm_headers[0])
-
-                try:
-                    license_res = licence(challenge=challenge)
-                except Exception:
-                    if hasattr(cdm, "use_cached_keys_as_fallback"):
-                        if cdm.use_cached_keys_as_fallback(session_id):
-                            keys = self._extract_keys_from_cdm(cdm, session_id)
-                            self.content_keys.update(keys)
-                            continue
-
-                    raise
+                license_res = licence(challenge=challenge)
 
                 if isinstance(license_res, bytes):
                     license_str = license_res.decode(errors="ignore")
@@ -290,7 +245,7 @@ class PlayReady:
                         pass
 
                 cdm.parse_license(session_id, license_str)
-                keys = self._extract_keys_from_cdm(cdm, session_id)
+                keys = {key.key_id: key.key.hex() for key in cdm.get_keys(session_id)}
                 self.content_keys.update(keys)
             finally:
                 cdm.close(session_id)

unshackle/core/drm/widevine.py

@@ -185,12 +185,7 @@ class Widevine:
                 if cert and hasattr(cdm, "set_service_certificate"):
                     cdm.set_service_certificate(session_id, cert)
 
-                challenge = cdm.get_license_challenge(session_id, self.pssh)
-
-                if hasattr(cdm, "has_cached_keys") and cdm.has_cached_keys(session_id):
-                    pass
-                else:
-                    cdm.parse_license(session_id, licence(challenge=challenge))
+                cdm.parse_license(session_id, licence(challenge=cdm.get_license_challenge(session_id, self.pssh)))
 
                 self.content_keys = {key.kid: key.key.hex() for key in cdm.get_keys(session_id, "CONTENT")}
                 if not self.content_keys:
@@ -218,15 +213,10 @@ class Widevine:
                 if cert and hasattr(cdm, "set_service_certificate"):
                     cdm.set_service_certificate(session_id, cert)
 
-                challenge = cdm.get_license_challenge(session_id, self.pssh)
-
-                if hasattr(cdm, "has_cached_keys") and cdm.has_cached_keys(session_id):
-                    pass
-                else:
-                    cdm.parse_license(
-                        session_id,
-                        licence(session_id=session_id, challenge=challenge),
-                    )
+                cdm.parse_license(
+                    session_id,
+                    licence(session_id=session_id, challenge=cdm.get_license_challenge(session_id, self.pssh)),
+                )
 
                 self.content_keys = {key.kid: key.key.hex() for key in cdm.get_keys(session_id, "CONTENT")}
                 if not self.content_keys:

unshackle/core/titles/episode.py

@@ -92,14 +92,14 @@ class Episode(Title):
         primary_audio_track = next(iter(media_info.audio_tracks), None)
         unique_audio_languages = len({x.language.split("-")[0] for x in media_info.audio_tracks if x.language})
 
-        # Title [Year] SXXEXX Name (or Title [Year] SXX if folder)
+        # Title [Year] SXXEXX Name (or just Title for main folder)
         if folder:
             name = f"{self.title}"
             if self.year and config.series_year:
-                name += f" {self.year}"
-            name += f" S{self.season:02}"
+                name += f" ({self.year})"
+            return name
         else:
-            name = "{title}{year} S{season:02}E{number:02} {name}".format(
+            name = "{title}{year} S{season:02}E{number:02} - {name} -".format(
                 title=self.title.replace("$", "S"),  # e.g., Arli$$
                 year=f" {self.year}" if self.year and config.series_year else "",
                 season=self.season,
@@ -128,19 +128,19 @@ class Episode(Title):
                 name += f" {resolution}p"
 
             # Service
-            if show_service:
-                name += f" {self.service.__name__}"
+            # if show_service:
+            #     name += f" {self.service.__name__}"
 
-            # 'WEB-DL'
-            name += " WEB-DL"
+            # # 'WEB-DL'
+            # name += " WEB-DL"
 
-            # DUAL
-            if unique_audio_languages == 2:
-                name += " DUAL"
+            # # DUAL
+            # if unique_audio_languages == 2:
+            #     name += " DUAL"
 
-            # MULTi
-            if unique_audio_languages > 2:
-                name += " MULTi"
+            # # MULTi
+            # if unique_audio_languages > 2:
+            #     name += " MULTi"
 
             # Audio Codec + Channels (+ feature)
             if primary_audio_track:
@@ -189,6 +189,12 @@ class Episode(Title):
             # Simple naming style without technical details - use spaces instead of dots
             return sanitize_filename(name, " ")
 
+    def get_season_folder(self) -> str:
+        """
+        Get the season folder name in the format 'Season XX'.
+        """
+        return f"Season {self.season:02d}"
+
 
 class Series(SortedKeyList, ABC):
     def __init__(self, iterable: Optional[Iterable] = None):

unshackle/core/titles/movie.py

@@ -56,7 +56,7 @@ class Movie(Title):
         unique_audio_languages = len({x.language.split("-")[0] for x in media_info.audio_tracks if x.language})
 
         # Name (Year)
-        name = str(self).replace("$", "S")  # e.g., Arli$$
+        name = str(self).replace("$", "S") + " -"  # e.g., Arli$$
 
         if config.scene_naming:
             # Resolution
@@ -78,20 +78,20 @@ class Movie(Title):
                     resolution = int(primary_video_track.width * (9 / 16))
                 name += f" {resolution}p"
 
-            # Service
-            if show_service:
-                name += f" {self.service.__name__}"
+            # # Service
+            # if show_service:
+            #     name += f" {self.service.__name__}"
 
-            # 'WEB-DL'
-            name += " WEB-DL"
+            # # 'WEB-DL'
+            # name += " WEB-DL"
 
-            # DUAL
-            if unique_audio_languages == 2:
-                name += " DUAL"
+            # # DUAL
+            # if unique_audio_languages == 2:
+            #     name += " DUAL"
 
-            # MULTi
-            if unique_audio_languages > 2:
-                name += " MULTi"
+            # # MULTi
+            # if unique_audio_languages > 2:
+            #     name += " MULTi"
 
             # Audio Codec + Channels (+ feature)
             if primary_audio_track:
@@ -132,8 +132,8 @@ class Movie(Title):
                     name += " HFR"
                 name += f" {VIDEO_CODEC_MAP.get(codec, codec)}"
 
-            if config.tag:
-                name += f"-{config.tag}"
+            # if config.tag:
+            #     name += f"-{config.tag}"
 
             return sanitize_filename(name)
         else:

unshackle/core/tracks/track.py

@@ -420,15 +420,6 @@ class Track:
             for drm in self.drm:
                 if isinstance(drm, PlayReady):
                     return drm
-        elif hasattr(cdm, 'is_playready'):
-            if cdm.is_playready:
-                for drm in self.drm:
-                    if isinstance(drm, PlayReady):
-                        return drm
-            else:
-                for drm in self.drm:
-                    if isinstance(drm, Widevine):
-                        return drm
 
         return self.drm[0]
 

unshackle/core/utilities.py

@@ -99,9 +99,9 @@ def sanitize_filename(filename: str, spacer: str = ".") -> str:
     # remove or replace further characters as needed
     filename = "".join(c for c in filename if unicodedata.category(c) != "Mn")  # hidden characters
     filename = filename.replace("/", " & ").replace(";", " & ")  # e.g. multi-episode filenames
-    filename = re.sub(r"[:; ]", spacer, filename)  # structural chars to (spacer)
-    filename = re.sub(r"[\\*!?¿,'\"" "()<>|$#~]", "", filename)  # not filename safe chars
-    filename = re.sub(rf"[{spacer}]{{2,}}", spacer, filename)  # remove extra neighbouring (spacer)s
+    filename = re.sub(r"[;]", spacer, filename)  # structural chars to (spacer)
+    filename = re.sub(r"[\\:*!?¿,'\"""<>|$#~]", "", filename)  # not filename safe chars
+    # filename = re.sub(rf"[{spacer}]{{2,}}", spacer, filename)  # remove extra neighbouring (spacer)s
 
     return filename
 

unshackle/core/utils/tags.py

@@ -11,7 +11,6 @@ from typing import Optional, Tuple
 
 import requests
 from requests.adapters import HTTPAdapter, Retry
-from xml.sax.saxutils import escape
 
 from unshackle.core import binaries
 from unshackle.core.config import config
@@ -290,9 +289,9 @@ def _apply_tags(path: Path, tags: dict[str, str]) -> None:
         log.debug("mkvpropedit not found on PATH; skipping tags")
         return
     log.debug("Applying tags to %s: %s", path, tags)
-    xml_lines = ['<?xml version="1.0" encoding="UTF-8"?>', "<Tags>", "  <Tag>", "    <Targets/>"]
+    xml_lines = ["<?xml version='1.0' encoding='UTF-8'?>", "<Tags>", "  <Tag>", "    <Targets/>"]
     for name, value in tags.items():
-        xml_lines.append(f"    <Simple><Name>{escape(name)}</Name><String>{escape(value)}</String></Simple>")
+        xml_lines.append(f"    <Simple><Name>{name}</Name><String>{value}</String></Simple>")
     xml_lines.extend(["  </Tag>", "</Tags>"])
     with tempfile.NamedTemporaryFile("w", suffix=".xml", delete=False) as f:
         f.write("\n".join(xml_lines))
@@ -352,11 +351,11 @@ def tag_file(path: Path, title: Title, tmdb_id: Optional[int] | None = None) ->
 
                 show_ids = simkl_data.get("show", {}).get("ids", {})
                 if show_ids.get("imdb"):
-                    standard_tags["IMDB"] = show_ids["imdb"]
+                    standard_tags["IMDB"] = f"https://www.imdb.com/title/{show_ids['imdb']}"
                 if show_ids.get("tvdb"):
-                    standard_tags["TVDB"] = str(show_ids["tvdb"])
+                    standard_tags["TVDB"] = f"https://thetvdb.com/dereferrer/series/{show_ids['tvdb']}"
                 if show_ids.get("tmdbtv"):
-                    standard_tags["TMDB"] = f"tv/{show_ids['tmdbtv']}"
+                    standard_tags["TMDB"] = f"https://www.themoviedb.org/tv/{show_ids['tmdbtv']}"
 
         # Use TMDB API for additional metadata (either from provided ID or Simkl lookup)
         api_key = _api_key()
@@ -374,8 +373,8 @@ def tag_file(path: Path, title: Title, tmdb_id: Optional[int] | None = None) ->
                 _apply_tags(path, custom_tags)
                 return
 
-        prefix = "movie" if kind == "movie" else "tv"
-        standard_tags["TMDB"] = f"{prefix}/{tmdb_id}"
+        tmdb_url = f"https://www.themoviedb.org/{'movie' if kind == 'movie' else 'tv'}/{tmdb_id}"
+        standard_tags["TMDB"] = tmdb_url
         try:
             ids = external_ids(tmdb_id, kind)
         except requests.RequestException as exc:
@@ -386,10 +385,11 @@ def tag_file(path: Path, title: Title, tmdb_id: Optional[int] | None = None) ->
 
         imdb_id = ids.get("imdb_id")
         if imdb_id:
-            standard_tags["IMDB"] = imdb_id
+            standard_tags["IMDB"] = f"https://www.imdb.com/title/{imdb_id}"
         tvdb_id = ids.get("tvdb_id")
         if tvdb_id:
-            standard_tags["TVDB"] = str(tvdb_id)
+            tvdb_prefix = "movies" if kind == "movie" else "series"
+            standard_tags["TVDB"] = f"https://thetvdb.com/dereferrer/{tvdb_prefix}/{tvdb_id}"
 
     merged_tags = {
         **custom_tags,

unshackle/services/Netflix/MSL/MSLKeys.py

@@ -0,0 +1,10 @@
+from .MSLObject import MSLObject
+
+
+class MSLKeys(MSLObject):
+    def __init__(self, encryption=None, sign=None, rsa=None, mastertoken=None, cdm_session=None):
+        self.encryption = encryption
+        self.sign = sign
+        self.rsa = rsa
+        self.mastertoken = mastertoken
+        self.cdm_session = cdm_session

unshackle/services/Netflix/MSL/MSLObject.py

@@ -0,0 +1,6 @@
+import jsonpickle
+
+
+class MSLObject:
+    def __repr__(self):
+        return "<{} {}>".format(self.__class__.__name__, jsonpickle.encode(self, unpicklable=False))

unshackle/services/Netflix/MSL/__init__.py

@@ -0,0 +1,412 @@
+import base64
+import gzip
+import json
+import logging
+import os
+import random
+import re
+import sys
+import time
+import zlib
+from datetime import datetime
+from io import BytesIO
+from typing import Optional, Any
+
+import jsonpickle
+import requests
+from Cryptodome.Cipher import AES, PKCS1_OAEP
+from Cryptodome.Hash import HMAC, SHA256
+from Cryptodome.PublicKey import RSA
+from Cryptodome.Random import get_random_bytes
+from Cryptodome.Util import Padding
+
+from unshackle.core.cacher import Cacher
+
+from .MSLKeys import MSLKeys
+from .schemes import EntityAuthenticationSchemes  # noqa: F401
+from .schemes import KeyExchangeSchemes
+from .schemes.EntityAuthentication import EntityAuthentication
+from .schemes.KeyExchangeRequest import KeyExchangeRequest
+from pywidevine.cdm import Cdm
+from pywidevine.pssh import PSSH
+
+class MSL:
+    log = logging.getLogger("MSL")
+
+    def __init__(self, session, endpoint, sender, keys, message_id, user_auth=None):
+        self.session = session
+        self.endpoint = endpoint
+        self.sender = sender
+        self.keys = keys
+        self.user_auth = user_auth
+        self.message_id = message_id
+
+    @classmethod
+    def handshake(cls, scheme: KeyExchangeSchemes, session: requests.Session, endpoint: str, sender: str, cache: Cacher, cdm: Optional[Cdm] = None, config: Any = None):
+        cache = cache.get(sender)
+        message_id = random.randint(0, pow(2, 52))
+        msl_keys = MSL.load_cache_data(cache)
+
+        if msl_keys is not None:
+            cls.log.info("Using cached MSL data")
+        else:
+            msl_keys = MSLKeys()
+            if scheme != KeyExchangeSchemes.Widevine:
+                msl_keys.rsa = RSA.generate(2048)
+
+
+            if scheme == KeyExchangeSchemes.Widevine:
+                if not cdm:
+                    raise Exception('Key exchange scheme Widevine but CDM instance is None.')
+                
+                session_id = cdm.open()
+                msl_keys.cdm_session = session_id
+                cdm.set_service_certificate(session_id, config["certificate"])
+                challenge = cdm.get_license_challenge(
+                    session_id=session_id,
+                    pssh=PSSH("AAAANHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABQIARIQAAAAAAPSZ0kAAAAAAAAAAA=="),
+                    license_type="OFFLINE",
+                    privacy_mode=True,
+
+                )
+                keyrequestdata = KeyExchangeRequest.Widevine(challenge)
+                entityauthdata = EntityAuthentication.Widevine("TV", base64.b64encode(challenge).decode())
+            else:
+                entityauthdata = EntityAuthentication.Unauthenticated(sender)
+                keyrequestdata = KeyExchangeRequest.AsymmetricWrapped(
+                    keypairid="superKeyPair",
+                    mechanism="JWK_RSA",
+                    publickey=msl_keys.rsa.publickey().exportKey(format="DER")
+                )
+
+            data = jsonpickle.encode({
+                "entityauthdata": entityauthdata,
+                "headerdata": base64.b64encode(MSL.generate_msg_header(
+                    message_id=message_id,
+                    sender=sender,
+                    is_handshake=True,
+                    keyrequestdata=keyrequestdata
+                ).encode("utf-8")).decode("utf-8"),
+                "signature": ""
+            }, unpicklable=False)
+            data += json.dumps({
+                "payload": base64.b64encode(json.dumps({
+                    "messageid": message_id,
+                    "data": "",
+                    "sequencenumber": 1,
+                    "endofmsg": True
+                }).encode("utf-8")).decode("utf-8"),
+                "signature": ""
+            })
+
+            try:
+                r = session.post(
+                    url=endpoint,
+                    data=data
+                )
+            except requests.HTTPError as e:
+                raise Exception(f"- Key exchange failed, response data is unexpected: {e.response.text}")
+
+            key_exchange = r.json()  # expecting no payloads, so this is fine
+            if "errordata" in key_exchange:
+                raise Exception("- Key exchange failed: " + json.loads(base64.b64decode(
+                    key_exchange["errordata"]
+                ).decode())["errormsg"])
+
+            # parse the crypto keys
+            key_response_data = json.JSONDecoder().decode(base64.b64decode(
+                key_exchange["headerdata"]
+            ).decode("utf-8"))["keyresponsedata"]
+
+            if key_response_data["scheme"] != str(scheme):
+                raise Exception("- Key exchange scheme mismatch occurred")
+
+            key_data = key_response_data["keydata"]
+            # if scheme == KeyExchangeSchemes.Widevine:
+            #     if isinstance(cdm.device, RemoteDevice):
+            #         msl_keys.encryption, msl_keys.sign = cdm.device.exchange(
+            #             cdm.sessions[msl_keys.cdm_session],
+            #             license_res=key_data["cdmkeyresponse"],
+            #             enc_key_id=base64.b64decode(key_data["encryptionkeyid"]),
+            #             hmac_key_id=base64.b64decode(key_data["hmackeyid"])
+            #         )
+            #         cdm.parse_license(msl_keys.cdm_session, key_data["cdmkeyresponse"])
+            #     else:
+            #         cdm.parse_license(msl_keys.cdm_session, key_data["cdmkeyresponse"])
+            #         keys = cdm.get_keys(msl_keys.cdm_session)
+            #         msl_keys.encryption = MSL.get_widevine_key(
+            #             kid=base64.b64decode(key_data["encryptionkeyid"]),
+            #             keys=keys,
+            #             permissions=["AllowEncrypt", "AllowDecrypt"]
+            #         )
+            #         msl_keys.sign = MSL.get_widevine_key(
+            #             kid=base64.b64decode(key_data["hmackeyid"]),
+            #             keys=keys,
+            #             permissions=["AllowSign", "AllowSignatureVerify"]
+            #         )
+            # else:
+            cipher_rsa = PKCS1_OAEP.new(msl_keys.rsa)
+            msl_keys.encryption = MSL.base64key_decode(
+                json.JSONDecoder().decode(cipher_rsa.decrypt(
+                    base64.b64decode(key_data["encryptionkey"])
+                ).decode("utf-8"))["k"]
+            )
+            msl_keys.sign = MSL.base64key_decode(
+                json.JSONDecoder().decode(cipher_rsa.decrypt(
+                    base64.b64decode(key_data["hmackey"])
+                ).decode("utf-8"))["k"]
+            )
+            msl_keys.mastertoken = key_response_data["mastertoken"]
+
+            MSL.cache_keys(msl_keys, cache)
+            cls.log.info("MSL handshake successful")
+        return cls(
+            session=session,
+            endpoint=endpoint,
+            sender=sender,
+            keys=msl_keys,
+            message_id=message_id
+        )
+
+    @staticmethod
+    def load_cache_data(cacher: Cacher):
+        if not cacher or cacher == {}:
+            return None
+        # with open(msl_keys_path, encoding="utf-8") as fd:
+        #     msl_keys = jsonpickle.decode(fd.read())
+        msl_keys = jsonpickle.decode(cacher.data)
+        if msl_keys.rsa:
+            # noinspection PyTypeChecker
+            # expects RsaKey, but is a string, this is because jsonpickle can't pickle RsaKey object
+            # so as a workaround it exports to PEM, and then when reading, it imports that PEM back
+            # to an RsaKey :)
+            msl_keys.rsa = RSA.importKey(msl_keys.rsa)
+        # If it's expired or close to, return None as it's unusable
+        if msl_keys.mastertoken and ((datetime.utcfromtimestamp(int(json.JSONDecoder().decode(
+                base64.b64decode(msl_keys.mastertoken["tokendata"]).decode("utf-8")
+        )["expiration"])) - datetime.now()).total_seconds() / 60 / 60) < 10:
+            return None
+        return msl_keys
+
+    @staticmethod
+    def cache_keys(msl_keys, cache: Cacher):
+        # os.makedirs(os.path.dirname(cache), exist_ok=True)
+        if msl_keys.rsa:
+            # jsonpickle can't pickle RsaKey objects :(
+            msl_keys.rsa = msl_keys.rsa.export_key()
+        # with open(cache, "w", encoding="utf-8") as fd:
+        #     fd.write()
+        cache.set(jsonpickle.encode(msl_keys))
+        if msl_keys.rsa:
+            # re-import now
+            msl_keys.rsa = RSA.importKey(msl_keys.rsa)
+
+    @staticmethod
+    def generate_msg_header(message_id, sender, is_handshake, userauthdata=None, keyrequestdata=None,
+                            compression="GZIP"):
+        """
+        The MSL header carries all MSL data used for entity and user authentication, message encryption
+        and verification, and service tokens. Portions of the MSL header are encrypted.
+        https://github.com/Netflix/msl/wiki/Messages#header-data
+
+        :param message_id: number against which payload chunks are bound to protect against replay.
+        :param sender: ESN
+        :param is_handshake: This flag is set true if the message is a handshake message and will not include any
+        payload chunks. It will include keyrequestdata.
+        :param userauthdata: UserAuthData
+        :param keyrequestdata: KeyRequestData
+        :param compression: Supported compression algorithms.
+
+        :return: The base64 encoded JSON String of the header
+        """
+        header_data = {
+            "messageid": message_id,
+            "renewable": True,  # MUST be True if is_handshake
+            "handshake": is_handshake,
+            "capabilities": {
+                "compressionalgos": [compression] if compression else [],
+                "languages": ["en-US"],  # bcp-47
+                "encoderformats": ["JSON"]
+            },
+            "timestamp": int(time.time()),
+            # undocumented or unused:
+            "sender": sender,
+            "nonreplayable": False,
+            "recipient": "Netflix",
+        }
+        if userauthdata:
+            header_data["userauthdata"] = userauthdata
+        if keyrequestdata:
+            header_data["keyrequestdata"] = [keyrequestdata]
+        return jsonpickle.encode(header_data, unpicklable=False)
+
+    @classmethod
+    def get_widevine_key(cls, kid, keys, permissions):
+        for key in keys:
+            if key.kid != kid:
+                continue
+            if key.type != "OPERATOR_SESSION":
+                cls.log.warning(f"Widevine Key Exchange: Wrong key type (not operator session) key {key}")
+                continue
+            if not set(permissions) <= set(key.permissions):
+                cls.log.warning(f"Widevine Key Exchange: Incorrect permissions, key {key}, needed perms {permissions}")
+                continue
+            return key.key
+        return None
+
+    def send_message(self, endpoint, params, application_data, userauthdata=None):
+        message = self.create_message(application_data, userauthdata)
+        res = self.session.post(url=endpoint, data=message, params=params)
+        header, payload_data = self.parse_message(res.text)
+        if "errordata" in header:
+            raise self.log.exit(
+                "- MSL response message contains an error: {}".format(
+                    json.loads(base64.b64decode(header["errordata"].encode("utf-8")).decode("utf-8"))
+                )
+            )
+        return header, payload_data
+
+    def create_message(self, application_data, userauthdata=None):
+        self.message_id += 1  # new message must ue a new message id
+        headerdata = self.encrypt(self.generate_msg_header(
+            message_id=self.message_id,
+            sender=self.sender,
+            is_handshake=False,
+            userauthdata=userauthdata
+        ))
+
+        header = json.dumps({
+            "headerdata": base64.b64encode(headerdata.encode("utf-8")).decode("utf-8"),
+            "signature": self.sign(headerdata).decode("utf-8"),
+            "mastertoken": self.keys.mastertoken
+        })
+
+        payload_chunks = [self.encrypt(json.dumps({
+            "messageid": self.message_id,
+            "data": self.gzip_compress(json.dumps(application_data).encode("utf-8")).decode("utf-8"),
+            "compressionalgo": "GZIP",
+            "sequencenumber": 1,  # todo ; use sequence_number from master token instead?
+            "endofmsg": True
+        }))]
+
+        message = header
+        for payload_chunk in payload_chunks:
+            message += json.dumps({
+                "payload": base64.b64encode(payload_chunk.encode("utf-8")).decode("utf-8"),
+                "signature": self.sign(payload_chunk).decode("utf-8")
+            })
+
+        return message
+
+    def decrypt_payload_chunks(self, payload_chunks):
+        """
+        Decrypt and extract data from payload chunks
+
+        :param payload_chunks: List of payload chunks
+        :return: json object
+        """
+        raw_data = ""
+
+        for payload_chunk in payload_chunks:
+            # todo ; verify signature of payload_chunk["signature"] against payload_chunk["payload"]
+            # expecting base64-encoded json string
+            payload_chunk = json.loads(base64.b64decode(payload_chunk["payload"]).decode("utf-8"))
+            # decrypt the payload
+            payload_decrypted = AES.new(
+                key=self.keys.encryption,
+                mode=AES.MODE_CBC,
+                iv=base64.b64decode(payload_chunk["iv"])
+            ).decrypt(base64.b64decode(payload_chunk["ciphertext"]))
+            payload_decrypted = Padding.unpad(payload_decrypted, 16)
+            payload_decrypted = json.loads(payload_decrypted.decode("utf-8"))
+            # decode and uncompress data if compressed
+            payload_data = base64.b64decode(payload_decrypted["data"])
+            if payload_decrypted.get("compressionalgo") == "GZIP":
+                payload_data = zlib.decompress(payload_data, 16 + zlib.MAX_WBITS)
+            raw_data += payload_data.decode("utf-8")
+
+        data = json.loads(raw_data)
+        if "error" in data:
+            error = data["error"]
+            error_display = error.get("display")
+            error_detail = re.sub(r" \(E3-[^)]+\)", "", error.get("detail", ""))
+
+            if error_display:
+               self.log.critical(f"- {error_display}")
+            if error_detail:
+               self.log.critical(f"- {error_detail}")
+
+            if not (error_display or error_detail):
+                self.log.critical(f"- {error}")
+
+            # sys.exit(1)
+
+        return data["result"]
+
+    def parse_message(self, message):
+        """
+        Parse an MSL message into a header and list of payload chunks
+
+        :param message: MSL message
+        :returns: a 2-item tuple containing message and list of payload chunks if available
+        """
+        parsed_message = json.loads("[{}]".format(message.replace("}{", "},{")))
+
+        header = parsed_message[0]
+        encrypted_payload_chunks = parsed_message[1:] if len(parsed_message) > 1 else []
+        if encrypted_payload_chunks:
+            payload_chunks = self.decrypt_payload_chunks(encrypted_payload_chunks)
+        else:
+            payload_chunks = {}
+
+        return header, payload_chunks
+
+    @staticmethod
+    def gzip_compress(data):
+        out = BytesIO()
+        with gzip.GzipFile(fileobj=out, mode="w") as fd:
+            fd.write(data)
+        return base64.b64encode(out.getvalue())
+
+    @staticmethod
+    def base64key_decode(payload):
+        length = len(payload) % 4
+        if length == 2:
+            payload += "=="
+        elif length == 3:
+            payload += "="
+        elif length != 0:
+            raise ValueError("Invalid base64 string")
+        return base64.urlsafe_b64decode(payload.encode("utf-8"))
+
+    def encrypt(self, plaintext):
+        """
+        Encrypt the given Plaintext with the encryption key
+        :param plaintext:
+        :return: Serialized JSON String of the encryption Envelope
+        """
+        iv = get_random_bytes(16)
+        return json.dumps({
+            "ciphertext": base64.b64encode(
+                AES.new(
+                    self.keys.encryption,
+                    AES.MODE_CBC,
+                    iv
+                ).encrypt(
+                    Padding.pad(plaintext.encode("utf-8"), 16)
+                )
+            ).decode("utf-8"),
+            "keyid": "{}_{}".format(self.sender, json.loads(
+                base64.b64decode(self.keys.mastertoken["tokendata"]).decode("utf-8")
+            )["sequencenumber"]),
+            "sha256": "AA==",
+            "iv": base64.b64encode(iv).decode("utf-8")
+        })
+
+    def sign(self, text):
+        """
+        Calculates the HMAC signature for the given text with the current sign key and SHA256
+        :param text:
+        :return: Base64 encoded signature
+        """
+        return base64.b64encode(HMAC.new(self.keys.sign, text.encode("utf-8"), SHA256).digest())

unshackle/services/Netflix/MSL/schemes/EntityAuthentication.py

@@ -0,0 +1,59 @@
+from .. import EntityAuthenticationSchemes
+from ..MSLObject import MSLObject
+
+
+# noinspection PyPep8Naming
+class EntityAuthentication(MSLObject):
+    def __init__(self, scheme, authdata):
+        """
+        Data used to identify and authenticate the entity associated with a message.
+        https://github.com/Netflix/msl/wiki/Entity-Authentication-%28Configuration%29
+
+        :param scheme: Entity Authentication Scheme identifier
+        :param authdata: Entity Authentication data
+        """
+        self.scheme = str(scheme)
+        self.authdata = authdata
+
+    @classmethod
+    def Unauthenticated(cls, identity):
+        """
+        The unauthenticated entity authentication scheme does not provide encryption or authentication and only
+        identifies the entity. Therefore entity identities can be harvested and spoofed. The benefit of this
+        authentication scheme is that the entity has control over its identity. This may be useful if the identity is
+        derived from or related to other data, or if retaining the identity is desired across state resets or in the
+        event of MSL errors requiring entity re-authentication.
+        """
+        return cls(
+            scheme=EntityAuthenticationSchemes.Unauthenticated,
+            authdata={"identity": identity}
+        )
+
+    @classmethod
+    def Widevine(cls, devtype, keyrequest):
+        """
+        The Widevine entity authentication scheme is used by devices with the Widevine CDM. It does not provide
+        encryption or authentication and only identifies the entity. Therefore entity identities can be harvested
+        and spoofed. The entity identity is composed from the provided device type and Widevine key request data. The
+        Widevine CDM properties can be extracted from the key request data.
+
+        When coupled with the Widevine key exchange scheme, the entity identity can be cryptographically validated by
+        comparing the entity authentication key request data against the key exchange key request data.
+
+        Note that the local entity will not know its entity identity when using this scheme.
+
+        > Devtype
+
+        An arbitrary value identifying the device type the local entity wishes to assume. The data inside the Widevine
+        key request may be optionally used to validate the claimed device type.
+
+        :param devtype: Local entity device type
+        :param keyrequest: Widevine key request
+        """
+        return cls(
+            scheme=EntityAuthenticationSchemes.Widevine,
+            authdata={
+                "devtype": devtype,
+                "keyrequest": keyrequest
+            }
+        )

unshackle/services/Netflix/MSL/schemes/KeyExchangeRequest.py

@@ -0,0 +1,80 @@
+import base64
+
+from .. import KeyExchangeSchemes
+from ..MSLObject import MSLObject
+
+
+# noinspection PyPep8Naming
+class KeyExchangeRequest(MSLObject):
+    def __init__(self, scheme, keydata):
+        """
+        Session key exchange data from a requesting entity.
+        https://github.com/Netflix/msl/wiki/Key-Exchange-%28Configuration%29
+
+        :param scheme: Key Exchange Scheme identifier
+        :param keydata: Key Request data
+        """
+        self.scheme = str(scheme)
+        self.keydata = keydata
+
+    @classmethod
+    def AsymmetricWrapped(cls, keypairid, mechanism, publickey):
+        """
+        Asymmetric wrapped key exchange uses a generated ephemeral asymmetric key pair for key exchange. It will
+        typically be used when there is no other data or keys from which to base secure key exchange.
+
+        This mechanism provides perfect forward secrecy but does not guarantee that session keys will only be available
+        to the requesting entity if the requesting MSL stack has been modified to perform the operation on behalf of a
+        third party.
+
+        > Key Pair ID
+
+        The key pair ID is included as a sanity check.
+
+        > Mechanism & Public Key
+
+        The following mechanisms are associated public key formats are currently supported.
+
+            Field 	    Public  Key Format 	Description
+            RSA 	    SPKI 	RSA-OAEP    encrypt/decrypt
+            ECC 	    SPKI 	ECIES       encrypt/decrypt
+            JWEJS_RSA 	SPKI 	RSA-OAEP    JSON Web Encryption JSON Serialization
+            JWE_RSA 	SPKI 	RSA-OAEP    JSON Web Encryption Compact Serialization
+            JWK_RSA 	SPKI 	RSA-OAEP    JSON Web Key
+            JWK_RSAES 	SPKI 	RSA PKCS#1  JSON Web Key
+
+        :param keypairid: key pair ID
+        :param mechanism: asymmetric key type
+        :param publickey: public key
+        """
+        return cls(
+            scheme=KeyExchangeSchemes.AsymmetricWrapped,
+            keydata={
+                "keypairid": keypairid,
+                "mechanism": mechanism,
+                "publickey": base64.b64encode(publickey).decode("utf-8")
+            }
+        )
+
+    @classmethod
+    def Widevine(cls, keyrequest):
+        """
+        Google Widevine provides a secure key exchange mechanism. When requested the Widevine component will issue a
+        one-time use key request. The Widevine server library can be used to authenticate the request and return
+        randomly generated symmetric keys in a protected key response bound to the request and Widevine client library.
+        The key response also specifies the key identities, types and their permitted usage.
+
+        The Widevine key request also contains a model identifier and a unique device identifier with an expectation of
+        long-term persistence. These values are available from the Widevine client library and can be retrieved from
+        the key request by the Widevine server library.
+
+        The Widevine client library will protect the returned keys from inspection or misuse.
+
+        :param keyrequest: Base64-encoded Widevine CDM license challenge (PSSH: b'\x0A\x7A\x00\x6C\x38\x2B')
+        """
+        if not isinstance(keyrequest, str):
+            keyrequest = base64.b64encode(keyrequest).decode()
+        return cls(
+            scheme=KeyExchangeSchemes.Widevine,
+            keydata={"keyrequest": keyrequest}
+        )

unshackle/services/Netflix/MSL/schemes/UserAuthentication.py

@@ -0,0 +1,59 @@
+from ..MSLObject import MSLObject
+from . import UserAuthenticationSchemes
+
+
+# noinspection PyPep8Naming
+class UserAuthentication(MSLObject):
+    def __init__(self, scheme, authdata):
+        """
+        Data used to identify and authenticate the user associated with a message.
+        https://github.com/Netflix/msl/wiki/User-Authentication-%28Configuration%29
+
+        :param scheme: User Authentication Scheme identifier
+        :param authdata: User Authentication data
+        """
+        self.scheme = str(scheme)
+        self.authdata = authdata
+
+    @classmethod
+    def EmailPassword(cls, email, password):
+        """
+        Email and password is a standard user authentication scheme in wide use.
+
+        :param email: user email address
+        :param password: user password
+        """
+        return cls(
+            scheme=UserAuthenticationSchemes.EmailPassword,
+            authdata={
+                "email": email,
+                "password": password
+            }
+        )
+
+    @classmethod
+    def NetflixIDCookies(cls, netflixid, securenetflixid):
+        """
+        Netflix ID HTTP cookies are used when the user has previously logged in to a web site. Possession of the
+        cookies serves as proof of user identity, in the same manner as they do when communicating with the web site.
+
+        The Netflix ID cookie and Secure Netflix ID cookie are HTTP cookies issued by the Netflix web site after
+        subscriber login. The Netflix ID cookie is encrypted and identifies the subscriber and analogous to a
+        subscriber’s username. The Secure Netflix ID cookie is tied to a Netflix ID cookie and only sent over HTTPS
+        and analogous to a subscriber’s password.
+
+        In some cases the Netflix ID and Secure Netflix ID cookies will be unavailable to the MSL stack or application.
+        If either or both of the Netflix ID or Secure Netflix ID cookies are absent in the above data structure the
+        HTTP cookie headers will be queried for it; this is only acceptable when HTTPS is used as the underlying
+        transport protocol.
+
+        :param netflixid: Netflix ID cookie
+        :param securenetflixid: Secure Netflix ID cookie
+        """
+        return cls(
+            scheme=UserAuthenticationSchemes.NetflixIDCookies,
+            authdata={
+                "netflixid": netflixid,
+                "securenetflixid": securenetflixid
+            }
+        )

unshackle/services/Netflix/MSL/schemes/__init__.py

@@ -0,0 +1,24 @@
+from enum import Enum
+
+
+class Scheme(Enum):
+    def __str__(self):
+        return str(self.value)
+
+
+class EntityAuthenticationSchemes(Scheme):
+    """https://github.com/Netflix/msl/wiki/Entity-Authentication-%28Configuration%29"""
+    Unauthenticated = "NONE"
+    Widevine = "WIDEVINE"
+
+
+class UserAuthenticationSchemes(Scheme):
+    """https://github.com/Netflix/msl/wiki/User-Authentication-%28Configuration%29"""
+    EmailPassword = "EMAIL_PASSWORD"
+    NetflixIDCookies = "NETFLIXID"
+
+
+class KeyExchangeSchemes(Scheme):
+    """https://github.com/Netflix/msl/wiki/Key-Exchange-%28Configuration%29"""
+    AsymmetricWrapped = "ASYMMETRIC_WRAPPED"
+    Widevine = "WIDEVINE"

unshackle/unshackle-example.yaml

@@ -105,50 +105,6 @@ remote_cdm:
     host: https://domain-2.com/api
     secret: secret_key
 
-  - name: "decrypt_labs_chrome"
-    type: "decrypt_labs"  # Required to identify as DecryptLabs CDM
-    device_name: "ChromeCDM"  # Scheme identifier - must match exactly
-    device_type: CHROME
-    system_id: 4464 # Doesn't matter
-    security_level: 3
-    host: "https://keyxtractor.decryptlabs.com"
-    secret: "your_decrypt_labs_api_key_here"  # Replace with your API key
-  - name: "decrypt_labs_l1"
-    type: "decrypt_labs"
-    device_name: "L1"  # Scheme identifier - must match exactly
-    device_type: ANDROID
-    system_id: 4464 
-    security_level: 1
-    host: "https://keyxtractor.decryptlabs.com"
-    secret: "your_decrypt_labs_api_key_here"
-
-  - name: "decrypt_labs_l2"
-    type: "decrypt_labs"
-    device_name: "L2"  # Scheme identifier - must match exactly
-    device_type: ANDROID
-    system_id: 4464
-    security_level: 2
-    host: "https://keyxtractor.decryptlabs.com"
-    secret: "your_decrypt_labs_api_key_here"
-
-  - name: "decrypt_labs_playready_sl2"
-    type: "decrypt_labs"
-    device_name: "SL2"  # Scheme identifier - must match exactly
-    device_type: PLAYREADY
-    system_id: 0
-    security_level: 2000
-    host: "https://keyxtractor.decryptlabs.com"
-    secret: "your_decrypt_labs_api_key_here"
-
-  - name: "decrypt_labs_playready_sl3"
-    type: "decrypt_labs"
-    device_name: "SL3"  # Scheme identifier - must match exactly
-    device_type: PLAYREADY
-    system_id: 0
-    security_level: 3000
-    host: "https://keyxtractor.decryptlabs.com"
-    secret: "your_decrypt_labs_api_key_here"
-
 # Key Vaults store your obtained Content Encryption Keys (CEKs)
 # Use 'no_push: true' to prevent a vault from receiving pushed keys
 # while still allowing it to provide keys when requested
@@ -215,7 +171,7 @@ chapter_fallback_name: "Chapter {j:02}"
 # Case-Insensitive dictionary of headers for all Services
 headers:
   Accept-Language: "en-US,en;q=0.8"
-  User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"
+  User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.75 Safari/537.36"
 
 # Override default filenames used across unshackle
 filenames:
@@ -257,13 +213,6 @@ services:
     # Global service config
     api_key: "service_api_key"
 
-    # Service certificate for Widevine L1/L2 (base64 encoded)
-    # This certificate is automatically used when L1/L2 schemes are selected
-    # Services obtain this from their DRM provider or license server
-    certificate: |
-      CAUSwwUKvQIIAxIQ5US6QAvBDzfTtjb4tU/7QxiH8c+TBSKOAjCCAQoCggEBAObzvlu2hZRsapAPx4Aa4GUZj4/GjxgXUtBH4THSkM40x63wQeyVxlEEo
-      # ... (full base64 certificate here)
-
     # Profile-specific device configurations
     profiles:
       john_sd:

unshackle/unshackle.yaml

@@ -0,0 +1,250 @@
+# Group or Username to postfix to the end of all download filenames following a dash
+tag: Kenzuya
+
+# Enable/disable tagging with group name (default: true)
+tag_group_name: true
+
+# Enable/disable tagging with IMDB/TMDB/TVDB details (default: true)
+tag_imdb_tmdb: true
+
+# Set terminal background color (custom option not in CONFIG.md)
+set_terminal_bg: false
+
+# Set file naming convention
+#  true for style - Prime.Suspect.S07E01.The.Final.Act.Part.One.1080p.ITV.WEB-DL.AAC2.0.H.264
+#  false for style - Prime Suspect S07E01 The Final Act - Part One
+scene_naming: true
+
+# Whether to include the year in series names for episodes and folders (default: true)
+#  true for style - Show Name (2023) S01E01 Episode Name
+#  false for style - Show Name S01E01 Episode Name
+series_year: false
+
+# Check for updates from GitHub repository on startup (default: true)
+update_checks: true
+
+# How often to check for updates, in hours (default: 24)
+update_check_interval: 24
+
+# Title caching configuration
+# Cache title metadata to reduce redundant API calls
+title_cache_enabled: true # Enable/disable title caching globally (default: true)
+title_cache_time: 1800 # Cache duration in seconds (default: 1800 = 30 minutes)
+title_cache_max_retention: 86400 # Maximum cache retention for fallback when API fails (default: 86400 = 24 hours)
+
+# Muxing configuration
+muxing:
+  set_title: true
+
+# Login credentials for each Service
+credentials:
+  # Direct credentials (no profile support)
+  EXAMPLE: email@example.com:password
+
+  # Per-profile credentials with default fallback
+  SERVICE_NAME:
+    default: default@email.com:password # Used when no -p/--profile is specified
+    profile1: user1@email.com:password1
+    profile2: user2@email.com:password2
+
+  # Per-profile credentials without default (requires -p/--profile)
+  SERVICE_NAME2:
+    john: john@example.com:johnspassword
+    jane: jane@example.com:janespassword
+
+  # You can also use list format for passwords with special characters
+  SERVICE_NAME3:
+    default: ["user@email.com", ":PasswordWith:Colons"]
+
+# Override default directories used across unshackle
+directories:
+  cache: Cache
+  # cookies: Cookies
+  dcsl: DCSL # Device Certificate Status List
+  downloads: Downloads
+  logs: Logs
+  temp: Temp
+  wvds: WVDs
+  prds: PRDs
+  # Additional directories that can be configured:
+  # commands: Commands
+  # services:
+  #   - /path/to/services
+  #   - /other/path/to/services
+  # vaults: Vaults
+  # fonts: Fonts
+
+# Pre-define which Widevine or PlayReady device to use for each Service
+cdm:
+  # Global default CDM device (fallback for all services/profiles)
+  default: chromecdm
+
+  # Direct service-specific CDM
+  DIFFERENT_EXAMPLE: PRD_1
+
+  # Per-profile CDM configuration
+  EXAMPLE:
+    john_sd: chromecdm_903_l3 # Profile 'john_sd' uses Chrome CDM L3
+    jane_uhd: nexus_5_l1 # Profile 'jane_uhd' uses Nexus 5 L1
+    default: generic_android_l3 # Default CDM for this service
+
+# Use pywidevine Serve-compliant Remote CDMs
+remote_cdm:
+  - name: "chromecdm"
+    device_name: widevine
+    device_type: CHROME
+    system_id: 36586
+    security_level: 3
+    type: "decrypt_labs"
+    host: https://keyxtractor.decryptlabs.com
+    secret: 7547150416_41da0a32d6237d83_KeyXtractor_api_ext
+  - name: "android"
+    device_name: andorid
+    device_type: ANDROID
+    system_id: 8131
+    security_level: 1
+    type: "decrypt_labs"
+    host: https://keyxtractor.decryptlabs.com
+    secret: decrypt_labs_special_ultimate
+
+# Key Vaults store your obtained Content Encryption Keys (CEKs)
+# Use 'no_push: true' to prevent a vault from receiving pushed keys
+# while still allowing it to provide keys when requested
+key_vaults:
+  - type: SQLite
+    name: Local
+    path: key_store.db
+  - type: HTTP
+    name: "DRMLab Vault"
+    host: "https://api.drmlab.io/vault/"
+    username: "unshackle"
+    password: "gEX75q7I5YVkvgF5SUkcNd41IbGrDtTT"
+    api_mode: "json"
+  # Additional vault types:
+  # - type: API
+  #   name: "Remote Vault"
+  #   uri: "https://key-vault.example.com"
+  #   token: "secret_token"
+  #   no_push: true  # This vault will only provide keys, not receive them
+  # - type: MySQL
+  #   name: "MySQL Vault"
+  #   host: "127.0.0.1"
+  #   port: 3306
+  #   database: vault
+  #   username: user
+  #   password: pass
+  #   no_push: false  # Default behavior - vault both provides and receives keys
+
+# Choose what software to use to download data
+downloader: aria2c
+# Options: requests | aria2c | curl_impersonate | n_m3u8dl_re
+# Can also be a mapping:
+# downloader:
+#   NF: requests
+#   AMZN: n_m3u8dl_re
+#   DSNP: n_m3u8dl_re
+#   default: requests
+
+# aria2c downloader configuration
+aria2c:
+  max_concurrent_downloads: 4
+  max_connection_per_server: 3
+  split: 5
+  file_allocation: falloc # none | prealloc | falloc | trunc
+
+# N_m3u8DL-RE downloader configuration
+n_m3u8dl_re:
+  thread_count: 16
+  ad_keyword: "advertisement"
+  use_proxy: true
+
+# curl_impersonate downloader configuration
+curl_impersonate:
+  browser: chrome120
+
+# Pre-define default options and switches of the dl command
+dl:
+  sub_format: srt
+  downloads: 4
+  workers: 16
+  lang:
+    - orig
+    - id
+  EXAMPLE:
+    bitrate: CBR
+
+# Chapter Name to use when exporting a Chapter without a Name
+chapter_fallback_name: "Chapter {j:02}"
+
+# Case-Insensitive dictionary of headers for all Services
+headers:
+  Accept-Language: "en-US,en;q=0.8"
+  User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.75 Safari/537.36"
+
+# Override default filenames used across unshackle
+filenames:
+  log: "unshackle_{name}_{time}.log"
+  config: "config.yaml"
+  root_config: "unshackle.yaml"
+  chapters: "Chapters_{title}_{random}.txt"
+  subtitle: "Subtitle_{id}_{language}.srt"
+
+# API key for The Movie Database (TMDB)
+tmdb_api_key: "8f5c14ef648a0abdd262cf809e11fcd4"
+
+# conversion_method:
+# - auto (default): Smart routing - subby for WebVTT/SAMI, standard for others
+# - subby: Always use subby with advanced processing
+# - pycaption: Use only pycaption library (no SubtitleEdit, no subby)
+# - subtitleedit: Prefer SubtitleEdit when available, fall back to pycaption
+subtitle:
+  conversion_method: auto
+  sdh_method: auto
+
+# Configuration for pywidevine's serve functionality
+serve:
+  users:
+    secret_key_for_user:
+      devices:
+        - generic_nexus_4464_l3
+      username: user
+  # devices:
+  #   - '/path/to/device.wvd'
+
+# Configuration data for each Service
+services:
+  # Service-specific configuration goes here
+  # Profile-specific configurations can be nested under service names
+
+  # Example: with profile-specific device configs
+  EXAMPLE:
+    # Global service config
+    api_key: "service_api_key"
+
+    # Profile-specific device configurations
+    profiles:
+      john_sd:
+        device:
+          app_name: "AIV"
+          device_model: "SHIELD Android TV"
+      jane_uhd:
+        device:
+          app_name: "AIV"
+          device_model: "Fire TV Stick 4K"
+
+  # Example: Service with different regions per profile
+  SERVICE_NAME:
+    profiles:
+      us_account:
+        region: "US"
+        api_endpoint: "https://api.us.service.com"
+      uk_account:
+        region: "GB"
+        api_endpoint: "https://api.uk.service.com"
+
+# External proxy provider services
+proxy_providers:
+
+  surfsharkvpn:
+    username: wqKD6vru8vXxUtkXJbvx4HAL  # Service credentials from https://my.surfshark.com/vpn/manual-setup/main/openvpn
+    password: zyFnwsYFMNxqbzpf3asu36m6  # Service credentials (not your login password)

uv.lock

@@ -1499,7 +1499,7 @@ wheels = [
 
 [[package]]
 name = "unshackle"
-version = "1.4.4"
+version = "1.4.3"
 source = { editable = "." }
 dependencies = [
     { name = "appdirs" },