chore: bump version to 1.4.6 and update changelog

Implements dynamic CDM selection based on video track resolution to optimize
CDM usage. Automatically selects appropriate security level (L3/SL2K for ≤1080p, L1/SL3K for >1080p) based on content requirements.

Key Features:
- Quality-based CDM configuration with threshold operators (>=, >, <=, <)
- Pre-selection based on highest quality across all video tracks
- Maintains backward compatibility with existing CDM configurations
- Single CDM per session to avoid inefficient switching

.gitignore

@@ -1,4 +1,5 @@
 # unshackle
+unshackle.yaml
 unshackle.yml
 update_check.json
 *.mkv
@@ -24,6 +25,7 @@ unshackle/certs/
 unshackle/WVDs/
 unshackle/PRDs/
 temp/
+services/
 
 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -233,4 +235,3 @@ cython_debug/
 marimo/_static/
 marimo/_lsp/
 __marimo__/
-Cache

CHANGELOG.md

@@ -5,6 +5,122 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.6] - 2025-09-13
+
+### Added
+
+- **Quality-Based CDM Selection**: Dynamic CDM selection based on video resolution
+  - Automatically selects appropriate CDM (L3/L1) based on video track quality
+  - Supports quality thresholds in configuration (>=, >, <=, <, exact match)
+  - Pre-selects optimal CDM based on highest quality across all video tracks
+  - Maintains backward compatibility with existing CDM configurations
+- **Automatic Audio Language Metadata**: Intelligent embedded audio language detection
+  - Automatically sets audio language metadata when no separate audio tracks exist
+  - Smart video track selection based on title language with fallbacks
+  - Enhanced FFmpeg repackaging with audio stream metadata injection
+- **Lazy DRM Loading**: Deferred DRM loading for multi-track key retrieval optimization
+  - Add deferred DRM loading to M3U8 parser to mark tracks for later processing
+  - Just-in-time DRM loading during download process for better performance
+
+### Changed
+
+- **Enhanced CDM Management**: Improved CDM switching logic for multi-quality downloads
+  - CDM selection now based on highest quality track to avoid inefficient switching
+  - Quality-based selection only within same DRM type (Widevine-to-Widevine, PlayReady-to-PlayReady)
+  - Single CDM used per session for better performance and reliability
+
+### Fixed
+
+- **Vault Caching Issues**: Fixed vault count display and NoneType iteration errors
+  - Fix 'NoneType' object is not iterable error in DecryptLabsRemoteCDM
+  - Fix vault count display showing 0/3 instead of actual successful vault count
+- **Service Name Transmission**: Resolved DecryptLabsRemoteCDM service name issues
+  - Fixed DecryptLabsRemoteCDM sending 'generic' instead of proper service names
+  - Added case-insensitive vault lookups for SQLite/MySQL vaults
+  - Added local vault integration to DecryptLabsRemoteCDM
+- **Import Organization**: Improved import ordering and code formatting
+  - Reorder imports in decrypt_labs_remote_cdm.py for better organization
+  - Clean up trailing whitespace in vault files
+
+### Configuration
+
+- **New CDM Configuration Format**: Extended `cdm:` section supports quality-based selection
+  ```yaml
+  cdm:
+    SERVICE_NAME:
+      "<=1080": l3_cdm_name
+      ">1080": l1_cdm_name
+      default: l3_cdm_name
+  ```
+
+## [1.4.5] - 2025-09-09
+
+### Added
+
+- **Enhanced CDM Key Caching**: Improved key caching and session management for L1/L2 devices
+  - Optimized `get_cached_keys_if_exists` functionality for better performance with L1/L2 devices
+  - Enhanced cached key retrieval logic with improved session handling
+- **Widevine Common Certificate Fallback**: Added fallback to Widevine common certificate for L1 devices
+  - Improved compatibility for L1 devices when service certificates are unavailable
+- **Enhanced Vault Loading**: Improved vault loading and key copying logic
+  - Better error handling and key management in vault operations
+- **PSSH Display Optimization**: Truncated PSSH string display in non-debug mode for cleaner output
+- **CDM Error Messaging**: Added error messages for missing service certificates in CDM sessions
+
+### Changed
+
+- **Dynamic Version Headers**: Updated User-Agent headers to use dynamic version strings
+  - DecryptLabsRemoteCDM now uses dynamic version import instead of hardcoded version
+- **Intelligent CDM Caching**: Implemented intelligent caching system for CDM license requests
+  - Enhanced caching logic reduces redundant license requests and improves performance
+- **Enhanced Tag Handling**: Improved tag handling for TV shows and movies from Simkl data
+  - Better metadata processing and formatting for improved media tagging
+
+### Fixed
+
+- **CDM Session Management**: Clean up session data when retrieving cached keys
+  - Remove decrypt_labs_session_id and challenge from session when cached keys exist but there are missing kids
+  - Ensures clean state for subsequent requests and prevents session conflicts
+- **Tag Formatting**: Fixed formatting issues in tag processing
+- **Import Order**: Fixed import order issues in tags module
+
+## [1.4.4] - 2025-09-02
+
+### Added
+
+- **Enhanced DecryptLabs CDM Support**: Comprehensive remote CDM functionality
+  - Full support for Widevine, PlayReady, and ChromeCDM through DecryptLabsRemoteCDM
+  - Enhanced session management and caching support for remote WV/PR operations
+  - Support for cached keys and improved license handling
+  - New CDM configurations for Chrome and PlayReady devices with updated User-Agent and service certificate
+- **Advanced Configuration Options**: New device and language preferences
+  - Added configuration options for device certificate status list
+  - Enhanced language preference settings
+
+### Changed
+
+- **DRM Decryption Enhancements**: Streamlined decryption process
+  - Simplified decrypt method by removing unused parameter and streamlined logic
+  - Improved DecryptLabs CDM configurations with better device support
+
+### Fixed
+
+- **Matroska Tag Compliance**: Enhanced media container compatibility  
+  - Fixed Matroska tag compliance with official specification
+- **Application Branding**: Cleaned up version display
+  - Removed old devine version reference from banner to avoid developer confusion
+  - Updated branding while maintaining original GNU license compliance
+- **IP Information Handling**: Improved geolocation services
+  - Enhanced get_ip_info functionality with better failover handling
+  - Added support for 429 error handling and multiple API provider fallback
+  - Implemented cached IP info retrieval with fallback tester to avoid rate limiting
+- **Dependencies**: Streamlined package requirements
+  - Removed unnecessary data extra requirement from langcodes
+
+### Removed
+
+- Deprecated version references in application banner for clarity
+
 ## [1.4.3] - 2025-08-20
 
 ### Added

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "unshackle"
-version = "1.4.3"
+version = "1.4.6"
 description = "Modular Movie, TV, and Music Archival Software."
 authors = [{ name = "unshackle team" }]
 requires-python = ">=3.10,<3.13"

unshackle/commands/dl.py

@@ -66,6 +66,18 @@ from unshackle.core.vaults import Vaults
 
 
 class dl:
+    @staticmethod
+    def _truncate_pssh_for_display(pssh_string: str, drm_type: str) -> str:
+        """Truncate PSSH string for display when not in debug mode."""
+        if logging.root.level == logging.DEBUG or not pssh_string:
+            return pssh_string
+
+        max_width = console.width - len(drm_type) - 12
+        if len(pssh_string) <= max_width:
+            return pssh_string
+
+        return pssh_string[: max_width - 3] + "..."
+
     @click.command(
         short_help="Download, Decrypt, and Mux tracks for titles from a Service.",
         cls=Services,
@@ -299,21 +311,6 @@ class dl:
         if getattr(config, "decryption_map", None):
             config.decryption = config.decryption_map.get(self.service, config.decryption)
 
-        with console.status("Loading DRM CDM...", spinner="dots"):
-            try:
-                self.cdm = self.get_cdm(self.service, self.profile)
-            except ValueError as e:
-                self.log.error(f"Failed to load CDM, {e}")
-                sys.exit(1)
-
-            if self.cdm:
-                if hasattr(self.cdm, "device_type") and self.cdm.device_type.name in ["ANDROID", "CHROME"]:
-                    self.log.info(f"Loaded Widevine CDM: {self.cdm.system_id} (L{self.cdm.security_level})")
-                else:
-                    self.log.info(
-                        f"Loaded PlayReady CDM: {self.cdm.certificate_chain.get_name()} (L{self.cdm.security_level})"
-                    )
-
         with console.status("Loading Key Vaults...", spinner="dots"):
             self.vaults = Vaults(self.service)
             total_vaults = len(config.key_vaults)
@@ -352,6 +349,24 @@ class dl:
             else:
                 self.log.debug("No vaults are currently active")
 
+        with console.status("Loading DRM CDM...", spinner="dots"):
+            try:
+                self.cdm = self.get_cdm(self.service, self.profile)
+            except ValueError as e:
+                self.log.error(f"Failed to load CDM, {e}")
+                sys.exit(1)
+
+            if self.cdm:
+                if isinstance(self.cdm, DecryptLabsRemoteCDM):
+                    drm_type = "PlayReady" if self.cdm.is_playready else "Widevine"
+                    self.log.info(f"Loaded {drm_type} Remote CDM: DecryptLabs (L{self.cdm.security_level})")
+                elif hasattr(self.cdm, "device_type") and self.cdm.device_type.name in ["ANDROID", "CHROME"]:
+                    self.log.info(f"Loaded Widevine CDM: {self.cdm.system_id} (L{self.cdm.security_level})")
+                else:
+                    self.log.info(
+                        f"Loaded PlayReady CDM: {self.cdm.certificate_chain.get_name()} (L{self.cdm.security_level})"
+                    )
+
         self.proxy_providers = []
         if no_proxy:
             ctx.params["proxy"] = None
@@ -847,9 +862,40 @@ class dl:
 
             selected_tracks, tracks_progress_callables = title.tracks.tree(add_progress=True)
 
+            for track in title.tracks:
+                if hasattr(track, "needs_drm_loading") and track.needs_drm_loading:
+                    track.load_drm_if_needed(service)
+
             download_table = Table.grid()
             download_table.add_row(selected_tracks)
 
+            video_tracks = title.tracks.videos
+            if video_tracks:
+                highest_quality = max((track.height for track in video_tracks if track.height), default=0)
+                if highest_quality > 0:
+                    if isinstance(self.cdm, (WidevineCdm, DecryptLabsRemoteCDM)) and not (
+                        isinstance(self.cdm, DecryptLabsRemoteCDM) and self.cdm.is_playready
+                    ):
+                        quality_based_cdm = self.get_cdm(
+                            self.service, self.profile, drm="widevine", quality=highest_quality
+                        )
+                        if quality_based_cdm and quality_based_cdm != self.cdm:
+                            self.log.info(
+                                f"Pre-selecting Widevine CDM based on highest quality {highest_quality}p across all video tracks"
+                            )
+                            self.cdm = quality_based_cdm
+                    elif isinstance(self.cdm, (PlayReadyCdm, DecryptLabsRemoteCDM)) and (
+                        isinstance(self.cdm, DecryptLabsRemoteCDM) and self.cdm.is_playready
+                    ):
+                        quality_based_cdm = self.get_cdm(
+                            self.service, self.profile, drm="playready", quality=highest_quality
+                        )
+                        if quality_based_cdm and quality_based_cdm != self.cdm:
+                            self.log.info(
+                                f"Pre-selecting PlayReady CDM based on highest quality {highest_quality}p across all video tracks"
+                            )
+                            self.cdm = quality_based_cdm
+
             dl_start_time = time.time()
 
             if skip_dl:
@@ -874,7 +920,12 @@ class dl:
                                         ),
                                         licence=partial(
                                             service.get_playready_license
-                                            if isinstance(self.cdm, PlayReadyCdm)
+                                            if (
+                                                isinstance(self.cdm, PlayReadyCdm)
+                                                or (
+                                                    isinstance(self.cdm, DecryptLabsRemoteCDM) and self.cdm.is_playready
+                                                )
+                                            )
                                             and hasattr(service, "get_playready_license")
                                             else service.get_widevine_license,
                                             title=title,
@@ -1127,8 +1178,13 @@ class dl:
                     with Live(Padding(progress, (0, 5, 1, 5)), console=console):
                         for task_id, task_tracks in multiplex_tasks:
                             progress.start_task(task_id)  # TODO: Needed?
+                            audio_expected = not video_only and not no_audio
                             muxed_path, return_code, errors = task_tracks.mux(
-                                str(title), progress=partial(progress.update, task_id=task_id), delete=False
+                                str(title),
+                                progress=partial(progress.update, task_id=task_id),
+                                delete=False,
+                                audio_expected=audio_expected,
+                                title_language=title.language,
                             )
                             muxed_paths.append(muxed_path)
                             if return_code >= 2:
@@ -1159,12 +1215,6 @@ class dl:
                     final_filename = title.get_filename(media_info, show_service=not no_source)
 
                     if not no_folder and isinstance(title, (Episode, Song)):
-                        if isinstance(title, Episode):
-                            # Create nested structure: {title}/Season {season:02}/{filename}
-                            final_dir /= title.get_filename(media_info, show_service=not no_source, folder=True)
-                            final_dir /= title.get_season_folder()
-                        else:
-                            # For Song, use existing logic
                         final_dir /= title.get_filename(media_info, show_service=not no_source, folder=True)
 
                     final_dir.mkdir(parents=True, exist_ok=True)
@@ -1207,21 +1257,43 @@ class dl:
         if not drm:
             return
 
-        if isinstance(drm, Widevine) and not isinstance(self.cdm, WidevineCdm):
-            self.cdm = self.get_cdm(self.service, self.profile, drm="widevine")
-        elif isinstance(drm, PlayReady) and not isinstance(self.cdm, PlayReadyCdm):
-            self.cdm = self.get_cdm(self.service, self.profile, drm="playready")
+        if isinstance(track, Video) and track.height:
+            pass
+
+        if isinstance(drm, Widevine):
+            if not isinstance(self.cdm, (WidevineCdm, DecryptLabsRemoteCDM)) or (
+                isinstance(self.cdm, DecryptLabsRemoteCDM) and self.cdm.is_playready
+            ):
+                widevine_cdm = self.get_cdm(self.service, self.profile, drm="widevine")
+                if widevine_cdm:
+                    self.log.info("Switching to Widevine CDM for Widevine content")
+                    self.cdm = widevine_cdm
+
+        elif isinstance(drm, PlayReady):
+            if not isinstance(self.cdm, (PlayReadyCdm, DecryptLabsRemoteCDM)) or (
+                isinstance(self.cdm, DecryptLabsRemoteCDM) and not self.cdm.is_playready
+            ):
+                playready_cdm = self.get_cdm(self.service, self.profile, drm="playready")
+                if playready_cdm:
+                    self.log.info("Switching to PlayReady CDM for PlayReady content")
+                    self.cdm = playready_cdm
 
         if isinstance(drm, Widevine):
             with self.DRM_TABLE_LOCK:
-                cek_tree = Tree(Text.assemble(("Widevine", "cyan"), (f"({drm.pssh.dumps()})", "text"), overflow="fold"))
+                pssh_display = self._truncate_pssh_for_display(drm.pssh.dumps(), "Widevine")
+                cek_tree = Tree(Text.assemble(("Widevine", "cyan"), (f"({pssh_display})", "text"), overflow="fold"))
                 pre_existing_tree = next(
                     (x for x in table.columns[0].cells if isinstance(x, Tree) and x.label == cek_tree.label), None
                 )
                 if pre_existing_tree:
                     cek_tree = pre_existing_tree
 
-                for kid in drm.kids:
+                need_license = False
+                all_kids = list(drm.kids)
+                if track_kid and track_kid not in all_kids:
+                    all_kids.append(track_kid)
+
+                for kid in all_kids:
                     if kid in drm.content_keys:
                         continue
 
@@ -1241,8 +1313,13 @@ class dl:
                             if not pre_existing_tree:
                                 table.add_row(cek_tree)
                             raise Widevine.Exceptions.CEKNotFound(msg)
+                        else:
+                            need_license = True
 
-                    if kid not in drm.content_keys and not vaults_only:
+                    if kid not in drm.content_keys and cdm_only:
+                        need_license = True
+
+                if need_license and not vaults_only:
                     from_vaults = drm.content_keys.copy()
 
                     try:
@@ -1263,7 +1340,8 @@ class dl:
                     for kid_, key in drm.content_keys.items():
                         if key == "0" * 32:
                             key = f"[red]{key}[/]"
-                            label = f"[text2]{kid_.hex}:{key}{is_track_kid}"
+                        is_track_kid_marker = ["", "*"][kid_ == track_kid]
+                        label = f"[text2]{kid_.hex}:{key}{is_track_kid_marker}"
                         if not any(f"{kid_.hex}:{key}" in x.label for x in cek_tree.children):
                             cek_tree.add(label)
 
@@ -1280,7 +1358,6 @@ class dl:
                         f"Cached {len(drm.content_keys)} Key{'' if len(drm.content_keys) == 1 else 's'} to "
                         f"{successful_caches}/{len(self.vaults)} Vaults"
                     )
-                        break  # licensing twice will be unnecessary
 
                 if track_kid and track_kid not in drm.content_keys:
                     msg = f"No Content Key for KID {track_kid.hex} was returned in the License"
@@ -1306,10 +1383,11 @@ class dl:
 
         elif isinstance(drm, PlayReady):
             with self.DRM_TABLE_LOCK:
+                pssh_display = self._truncate_pssh_for_display(drm.pssh_b64 or "", "PlayReady")
                 cek_tree = Tree(
                     Text.assemble(
                         ("PlayReady", "cyan"),
-                        (f"({drm.pssh_b64 or ''})", "text"),
+                        (f"({pssh_display})", "text"),
                         overflow="fold",
                     )
                 )
@@ -1319,7 +1397,12 @@ class dl:
                 if pre_existing_tree:
                     cek_tree = pre_existing_tree
 
-                for kid in drm.kids:
+                need_license = False
+                all_kids = list(drm.kids)
+                if track_kid and track_kid not in all_kids:
+                    all_kids.append(track_kid)
+
+                for kid in all_kids:
                     if kid in drm.content_keys:
                         continue
 
@@ -1339,8 +1422,13 @@ class dl:
                             if not pre_existing_tree:
                                 table.add_row(cek_tree)
                             raise PlayReady.Exceptions.CEKNotFound(msg)
+                        else:
+                            need_license = True
 
-                    if kid not in drm.content_keys and not vaults_only:
+                    if kid not in drm.content_keys and cdm_only:
+                        need_license = True
+
+                if need_license and not vaults_only:
                     from_vaults = drm.content_keys.copy()
 
                     try:
@@ -1356,7 +1444,8 @@ class dl:
                         raise e
 
                     for kid_, key in drm.content_keys.items():
-                            label = f"[text2]{kid_.hex}:{key}{is_track_kid}"
+                        is_track_kid_marker = ["", "*"][kid_ == track_kid]
+                        label = f"[text2]{kid_.hex}:{key}{is_track_kid_marker}"
                         if not any(f"{kid_.hex}:{key}" in x.label for x in cek_tree.children):
                             cek_tree.add(label)
 
@@ -1367,7 +1456,6 @@ class dl:
                         f"Cached {len(drm.content_keys)} Key{'' if len(drm.content_keys) == 1 else 's'} to "
                         f"{successful_caches}/{len(self.vaults)} Vaults"
                     )
-                        break
 
                 if track_kid and track_kid not in drm.content_keys:
                     msg = f"No Content Key for KID {track_kid.hex} was returned in the License"
@@ -1448,20 +1536,83 @@ class dl:
                     return Credential(*credentials)
                 return Credential.loads(credentials)  # type: ignore
 
-    @staticmethod
     def get_cdm(
+        self,
         service: str,
         profile: Optional[str] = None,
         drm: Optional[str] = None,
+        quality: Optional[int] = None,
     ) -> Optional[object]:
         """
         Get CDM for a specified service (either Local or Remote CDM).
+        Now supports quality-based selection when quality is provided.
         Raises a ValueError if there's a problem getting a CDM.
         """
         cdm_name = config.cdm.get(service) or config.cdm.get("default")
         if not cdm_name:
             return None
 
+        if isinstance(cdm_name, dict):
+            if quality:
+                quality_match = None
+                quality_keys = []
+
+                for key in cdm_name.keys():
+                    if (
+                        isinstance(key, str)
+                        and any(op in key for op in [">=", ">", "<=", "<"])
+                        or (isinstance(key, str) and key.isdigit())
+                    ):
+                        quality_keys.append(key)
+
+                def sort_quality_key(key):
+                    if key.isdigit():
+                        return (0, int(key))  # Exact matches first
+                    elif key.startswith(">="):
+                        return (1, -int(key[2:]))  # >= descending
+                    elif key.startswith(">"):
+                        return (1, -int(key[1:]))  # > descending
+                    elif key.startswith("<="):
+                        return (2, int(key[2:]))  # <= ascending
+                    elif key.startswith("<"):
+                        return (2, int(key[1:]))  # < ascending
+                    return (3, 0)  # Other keys last
+
+                quality_keys.sort(key=sort_quality_key)
+
+                for key in quality_keys:
+                    if key.isdigit() and quality == int(key):
+                        quality_match = cdm_name[key]
+                        self.log.info(f"Selected CDM based on exact quality match {quality}p: {quality_match}")
+                        break
+                    elif key.startswith(">="):
+                        threshold = int(key[2:])
+                        if quality >= threshold:
+                            quality_match = cdm_name[key]
+                            self.log.info(f"Selected CDM based on quality {quality}p >= {threshold}p: {quality_match}")
+                            break
+                    elif key.startswith(">"):
+                        threshold = int(key[1:])
+                        if quality > threshold:
+                            quality_match = cdm_name[key]
+                            self.log.info(f"Selected CDM based on quality {quality}p > {threshold}p: {quality_match}")
+                            break
+                    elif key.startswith("<="):
+                        threshold = int(key[2:])
+                        if quality <= threshold:
+                            quality_match = cdm_name[key]
+                            self.log.info(f"Selected CDM based on quality {quality}p <= {threshold}p: {quality_match}")
+                            break
+                    elif key.startswith("<"):
+                        threshold = int(key[1:])
+                        if quality < threshold:
+                            quality_match = cdm_name[key]
+                            self.log.info(f"Selected CDM based on quality {quality}p < {threshold}p: {quality_match}")
+                            break
+
+                if quality_match:
+                    cdm_name = quality_match
+
             if isinstance(cdm_name, dict):
                 lower_keys = {k.lower(): v for k, v in cdm_name.items()}
                 if {"widevine", "playready"} & lower_keys.keys():
@@ -1475,18 +1626,24 @@ class dl:
                         }.get(drm.lower())
                     cdm_name = lower_keys.get(drm_key or "widevine") or lower_keys.get("playready")
                 else:
-                if not profile:
-                    return None
-                cdm_name = cdm_name.get(profile) or config.cdm.get("default")
+                    cdm_name = cdm_name.get(profile) or cdm_name.get("default") or config.cdm.get("default")
                 if not cdm_name:
                     return None
 
         cdm_api = next(iter(x for x in config.remote_cdm if x["name"] == cdm_name), None)
         if cdm_api:
-            is_decrypt_lab = True if cdm_api["type"] == "decrypt_labs" else False
+            is_decrypt_lab = True if cdm_api.get("type") == "decrypt_labs" else False
+            if is_decrypt_lab:
                 del cdm_api["name"]
                 del cdm_api["type"]
-            return DecryptLabsRemoteCDM(service_name=service, **cdm_api) if is_decrypt_lab else RemoteCdm(**cdm_api)
+
+                # All DecryptLabs CDMs use DecryptLabsRemoteCDM
+                return DecryptLabsRemoteCDM(service_name=service, vaults=self.vaults, **cdm_api)
+            else:
+                del cdm_api["name"]
+                if "type" in cdm_api:
+                    del cdm_api["type"]
+                return RemoteCdm(**cdm_api)
 
         prd_path = config.directories.prds / f"{cdm_name}.prd"
         if not prd_path.is_file():

unshackle/commands/kv.py

@@ -12,84 +12,113 @@ from unshackle.core.vault import Vault
 from unshackle.core.vaults import Vaults
 
 
+def _load_vaults(vault_names: list[str]) -> Vaults:
+    """Load and validate vaults by name."""
+    vaults = Vaults()
+    for vault_name in vault_names:
+        vault_config = next((x for x in config.key_vaults if x["name"] == vault_name), None)
+        if not vault_config:
+            raise click.ClickException(f"Vault ({vault_name}) is not defined in the config.")
+
+        vault_type = vault_config["type"]
+        vault_args = vault_config.copy()
+        del vault_args["type"]
+
+        if not vaults.load(vault_type, **vault_args):
+            raise click.ClickException(f"Failed to load vault ({vault_name}).")
+
+    return vaults
+
+
+def _process_service_keys(from_vault: Vault, service: str, log: logging.Logger) -> dict[str, str]:
+    """Get and validate keys from a vault for a specific service."""
+    content_keys = list(from_vault.get_keys(service))
+
+    bad_keys = {kid: key for kid, key in content_keys if not key or key.count("0") == len(key)}
+    for kid, key in bad_keys.items():
+        log.warning(f"Skipping NULL key: {kid}:{key}")
+
+    return {kid: key for kid, key in content_keys if kid not in bad_keys}
+
+
+def _copy_service_data(to_vault: Vault, from_vault: Vault, service: str, log: logging.Logger) -> int:
+    """Copy data for a single service between vaults."""
+    content_keys = _process_service_keys(from_vault, service, log)
+    total_count = len(content_keys)
+
+    if total_count == 0:
+        log.info(f"{service}: No keys found in {from_vault}")
+        return 0
+
+    try:
+        added = to_vault.add_keys(service, content_keys)
+    except PermissionError:
+        log.warning(f"{service}: No permission to create table in {to_vault}, skipped")
+        return 0
+
+    existed = total_count - added
+
+    if added > 0 and existed > 0:
+        log.info(f"{service}: {added} added, {existed} skipped ({total_count} total)")
+    elif added > 0:
+        log.info(f"{service}: {added} added ({total_count} total)")
+    else:
+        log.info(f"{service}: {existed} skipped (all existed)")
+
+    return added
+
+
 @click.group(short_help="Manage and configure Key Vaults.", context_settings=context_settings)
 def kv() -> None:
     """Manage and configure Key Vaults."""
 
 
 @kv.command()
-@click.argument("to_vault", type=str)
-@click.argument("from_vaults", nargs=-1, type=click.UNPROCESSED)
+@click.argument("to_vault_name", type=str)
+@click.argument("from_vault_names", nargs=-1, type=click.UNPROCESSED)
 @click.option("-s", "--service", type=str, default=None, help="Only copy data to and from a specific service.")
-def copy(to_vault: str, from_vaults: list[str], service: Optional[str] = None) -> None:
+def copy(to_vault_name: str, from_vault_names: list[str], service: Optional[str] = None) -> None:
     """
     Copy data from multiple Key Vaults into a single Key Vault.
     Rows with matching KIDs are skipped unless there's no KEY set.
     Existing data is not deleted or altered.
 
-    The `to_vault` argument is the key vault you wish to copy data to.
+    The `to_vault_name` argument is the key vault you wish to copy data to.
     It should be the name of a Key Vault defined in the config.
 
-    The `from_vaults` argument is the key vault(s) you wish to take
+    The `from_vault_names` argument is the key vault(s) you wish to take
     data from. You may supply multiple key vaults.
     """
-    if not from_vaults:
+    if not from_vault_names:
         raise click.ClickException("No Vaults were specified to copy data from.")
 
     log = logging.getLogger("kv")
 
-    vaults = Vaults()
-    for vault_name in [to_vault] + list(from_vaults):
-        vault = next((x for x in config.key_vaults if x["name"] == vault_name), None)
-        if not vault:
-            raise click.ClickException(f"Vault ({vault_name}) is not defined in the config.")
-        vault_type = vault["type"]
-        vault_args = vault.copy()
-        del vault_args["type"]
-        if not vaults.load(vault_type, **vault_args):
-            raise click.ClickException(f"Failed to load vault ({vault_name}).")
+    all_vault_names = [to_vault_name] + list(from_vault_names)
+    vaults = _load_vaults(all_vault_names)
 
-    to_vault: Vault = vaults.vaults[0]
-    from_vaults: list[Vault] = vaults.vaults[1:]
+    to_vault = vaults.vaults[0]
+    from_vaults = vaults.vaults[1:]
+
+    vault_names = ", ".join([v.name for v in from_vaults])
+    log.info(f"Copying data from {vault_names} → {to_vault.name}")
 
-    log.info(f"Copying data from {', '.join([x.name for x in from_vaults])}, into {to_vault.name}")
     if service:
         service = Services.get_tag(service)
-        log.info(f"Only copying data for service {service}")
+        log.info(f"Filtering by service: {service}")
 
     total_added = 0
     for from_vault in from_vaults:
-        if service:
-            services = [service]
-        else:
-            services = from_vault.get_services()
-
-        for service_ in services:
-            log.info(f"Getting data from {from_vault} for {service_}")
-            content_keys = list(from_vault.get_keys(service_))  # important as it's a generator we iterate twice
-
-            bad_keys = {kid: key for kid, key in content_keys if not key or key.count("0") == len(key)}
-
-            for kid, key in bad_keys.items():
-                log.warning(f"Cannot add a NULL Content Key to a Vault, skipping: {kid}:{key}")
-
-            content_keys = {kid: key for kid, key in content_keys if kid not in bad_keys}
-
-            total_count = len(content_keys)
-            log.info(f"Adding {total_count} Content Keys to {to_vault} for {service_}")
-
-            try:
-                added = to_vault.add_keys(service_, content_keys)
-            except PermissionError:
-                log.warning(f" - No permission to create table ({service_}) in {to_vault}, skipping...")
-                continue
+        services_to_copy = [service] if service else from_vault.get_services()
 
+        for service_tag in services_to_copy:
+            added = _copy_service_data(to_vault, from_vault, service_tag, log)
             total_added += added
-            existed = total_count - added
 
-            log.info(f"{to_vault} ({service_}): {added} newly added, {existed} already existed (skipped)")
-
-    log.info(f"{to_vault}: {total_added} total newly added")
+    if total_added > 0:
+        log.info(f"Successfully added {total_added} new keys to {to_vault}")
+    else:
+        log.info("Copy completed - no new keys to add")
 
 
 @kv.command()
@@ -106,9 +135,9 @@ def sync(ctx: click.Context, vaults: list[str], service: Optional[str] = None) -
     if not len(vaults) > 1:
         raise click.ClickException("You must provide more than one Vault to sync.")
 
-    ctx.invoke(copy, to_vault=vaults[0], from_vaults=vaults[1:], service=service)
+    ctx.invoke(copy, to_vault_name=vaults[0], from_vault_names=vaults[1:], service=service)
     for i in range(1, len(vaults)):
-        ctx.invoke(copy, to_vault=vaults[i], from_vaults=[vaults[i - 1]], service=service)
+        ctx.invoke(copy, to_vault_name=vaults[i], from_vault_names=[vaults[i - 1]], service=service)
 
 
 @kv.command()
@@ -135,15 +164,7 @@ def add(file: Path, service: str, vaults: list[str]) -> None:
     log = logging.getLogger("kv")
     service = Services.get_tag(service)
 
-    vaults_ = Vaults()
-    for vault_name in vaults:
-        vault = next((x for x in config.key_vaults if x["name"] == vault_name), None)
-        if not vault:
-            raise click.ClickException(f"Vault ({vault_name}) is not defined in the config.")
-        vault_type = vault["type"]
-        vault_args = vault.copy()
-        del vault_args["type"]
-        vaults_.load(vault_type, **vault_args)
+    vaults_ = _load_vaults(list(vaults))
 
     data = file.read_text(encoding="utf8")
     kid_keys: dict[str, str] = {}
@@ -173,15 +194,7 @@ def prepare(vaults: list[str]) -> None:
     """Create Service Tables on Vaults if not yet created."""
     log = logging.getLogger("kv")
 
-    vaults_ = Vaults()
-    for vault_name in vaults:
-        vault = next((x for x in config.key_vaults if x["name"] == vault_name), None)
-        if not vault:
-            raise click.ClickException(f"Vault ({vault_name}) is not defined in the config.")
-        vault_type = vault["type"]
-        vault_args = vault.copy()
-        del vault_args["type"]
-        vaults_.load(vault_type, **vault_args)
+    vaults_ = _load_vaults(vaults)
 
     for vault in vaults_:
         if hasattr(vault, "has_table") and hasattr(vault, "create_table"):

unshackle/core/__init__.py

@@ -1 +1 @@
-__version__ = "1.4.3"
+__version__ = "1.4.6"

unshackle/core/__main__.py

@@ -69,7 +69,7 @@ def main(version: bool, debug: bool, log_path: Path) -> None:
                     r" ▀▀▀ ▀▀ █▪ ▀▀▀▀ ▀▀▀ · ▀  ▀ ·▀▀▀ ·▀  ▀.▀▀▀  ▀▀▀ ",
                     style="ascii.art",
                 ),
-                "v 3.3.3 Copyright © 2019-2025 rlaphoenix" + f"\nv [repr.number]{__version__}[/] - unshackle",
+                f"v [repr.number]{__version__}[/] - © 2025 - github.com/unshackle-dl/unshackle",
             ),
             (1, 11, 1, 10),
             expand=True,

unshackle/core/cdm/decrypt_labs_remote_cdm.py

@@ -1,143 +1,747 @@
+from __future__ import annotations
+
 import base64
 import secrets
-from typing import Optional, Type, Union
+from typing import Any, Dict, List, Optional, Union
 from uuid import UUID
 
 import requests
-from pywidevine import PSSH, Device, DeviceTypes, Key, RemoteCdm
-from pywidevine.license_protocol_pb2 import SignedDrmCertificate, SignedMessage
+from pywidevine.cdm import Cdm as WidevineCdm
+from pywidevine.device import DeviceTypes
+from requests import Session
 
-# Copyright 2024 by DevYukine.
+from unshackle.core import __version__
+from unshackle.core.vaults import Vaults
 
 
-class DecryptLabsRemoteCDM(RemoteCdm):
+class MockCertificateChain:
+    """Mock certificate chain for PlayReady compatibility."""
+
+    def __init__(self, name: str):
+        self._name = name
+
+    def get_name(self) -> str:
+        return self._name
+
+
+class Key:
+    """Key object compatible with pywidevine."""
+
+    def __init__(self, kid: str, key: str, type_: str = "CONTENT"):
+        if isinstance(kid, str):
+            clean_kid = kid.replace("-", "")
+            if len(clean_kid) == 32:
+                self.kid = UUID(hex=clean_kid)
+            else:
+                self.kid = UUID(hex=clean_kid.ljust(32, "0"))
+        else:
+            self.kid = kid
+
+        if isinstance(key, str):
+            self.key = bytes.fromhex(key)
+        else:
+            self.key = key
+
+        self.type = type_
+
+
+class DecryptLabsRemoteCDMExceptions:
+    """Exception classes for compatibility with pywidevine CDM."""
+
+    class InvalidSession(Exception):
+        """Raised when session ID is invalid."""
+
+    class TooManySessions(Exception):
+        """Raised when session limit is reached."""
+
+    class InvalidInitData(Exception):
+        """Raised when PSSH/init data is invalid."""
+
+    class InvalidLicenseType(Exception):
+        """Raised when license type is invalid."""
+
+    class InvalidLicenseMessage(Exception):
+        """Raised when license message is invalid."""
+
+    class InvalidContext(Exception):
+        """Raised when session has no context data."""
+
+    class SignatureMismatch(Exception):
+        """Raised when signature verification fails."""
+
+
+class DecryptLabsRemoteCDM:
+    """
+    Decrypt Labs Remote CDM implementation with intelligent caching system.
+
+    This class provides a drop-in replacement for pywidevine's local CDM using
+    Decrypt Labs' KeyXtractor API service, enhanced with smart caching logic
+    that minimizes unnecessary license requests.
+
+    Key Features:
+    - Compatible with both Widevine and PlayReady DRM schemes
+    - Intelligent caching that compares required vs. available keys
+    - Optimized caching for L1/L2 devices (leverages API auto-optimization)
+    - Automatic key combination for mixed cache/license scenarios
+    - Seamless fallback to license requests when keys are missing
+
+    Intelligent Caching System:
+    1. DRM classes (PlayReady/Widevine) provide required KIDs via set_required_kids()
+    2. get_license_challenge() first checks for cached keys
+    3. For L1/L2 devices, always attempts cached keys first (API optimized)
+    4. If cached keys satisfy requirements, returns empty challenge (no license needed)
+    5. If keys are missing, makes targeted license request for remaining keys
+    6. parse_license() combines cached and license keys intelligently
+    """
+
+    service_certificate_challenge = b"\x08\x04"
+
     def __init__(
         self,
-        device_type: Union[DeviceTypes, str],
-        system_id: int,
-        security_level: int,
-        host: str,
         secret: str,
-        device_name: str,
-        service_name: str,
+        host: str = "https://keyxtractor.decryptlabs.com",
+        device_name: str = "ChromeCDM",
+        service_name: Optional[str] = None,
+        vaults: Optional[Vaults] = None,
+        device_type: Optional[str] = None,
+        system_id: Optional[int] = None,
+        security_level: Optional[int] = None,
+        **kwargs,
     ):
-        self.response_counter = 0
-        self.pssh = None
-        self.api_session_ids = {}
-        self.license_request = None
-        self.service_name = service_name
-        self.keys = {}
-        try:
-            super().__init__(device_type, system_id, security_level, host, secret, device_name)
-        except Exception:
-            pass
-        self.req_session = requests.Session()
-        self.req_session.headers.update({"decrypt-labs-api-key": secret})
+        """
+        Initialize Decrypt Labs Remote CDM for Widevine and PlayReady schemes.
 
-    @classmethod
-    def from_device(cls, device: Device) -> Type["DecryptLabsRemoteCDM"]:
-        raise NotImplementedError("You cannot load a DecryptLabsRemoteCDM from a local Device file.")
+        Args:
+            secret: Decrypt Labs API key (matches config format)
+            host: Decrypt Labs API host URL (matches config format)
+            device_name: DRM scheme (ChromeCDM, L1, L2 for Widevine; SL2, SL3 for PlayReady)
+            service_name: Service name for key caching and vault operations
+            vaults: Vaults instance for local key caching
+            device_type: Device type (CHROME, ANDROID, PLAYREADY) - for compatibility
+            system_id: System ID - for compatibility
+            security_level: Security level - for compatibility
+        """
+        _ = kwargs
+
+        self.secret = secret
+        self.host = host.rstrip("/")
+        self.device_name = device_name
+        self.service_name = service_name or ""
+        self.vaults = vaults
+        self.uch = self.host != "https://keyxtractor.decryptlabs.com"
+
+        self._device_type_str = device_type
+        if device_type:
+            self.device_type = self._get_device_type_enum(device_type)
+
+        self._is_playready = (device_type and device_type.upper() == "PLAYREADY") or (device_name in ["SL2", "SL3"])
+
+        if self._is_playready:
+            self.system_id = system_id or 0
+            self.security_level = security_level or (2000 if device_name == "SL2" else 3000)
+        else:
+            self.system_id = system_id or 26830
+            self.security_level = security_level or 3
+
+        self._sessions: Dict[bytes, Dict[str, Any]] = {}
+        self._pssh_b64 = None
+        self._required_kids: Optional[List[str]] = None
+        self._http_session = Session()
+        self._http_session.headers.update(
+            {
+                "decrypt-labs-api-key": self.secret,
+                "Content-Type": "application/json",
+                "User-Agent": f"unshackle-decrypt-labs-cdm/{__version__}",
+            }
+        )
+
+    def _get_device_type_enum(self, device_type: str):
+        """Convert device type string to enum for compatibility."""
+        device_type_upper = device_type.upper()
+        if device_type_upper == "ANDROID":
+            return DeviceTypes.ANDROID
+        elif device_type_upper == "CHROME":
+            return DeviceTypes.CHROME
+        else:
+            return DeviceTypes.CHROME
+
+    @property
+    def is_playready(self) -> bool:
+        """Check if this CDM is in PlayReady mode."""
+        return self._is_playready
+
+    @property
+    def certificate_chain(self) -> MockCertificateChain:
+        """Mock certificate chain for PlayReady compatibility."""
+        return MockCertificateChain(f"{self.device_name}_Remote")
+
+    def set_pssh_b64(self, pssh_b64: str) -> None:
+        """Store base64-encoded PSSH data for PlayReady compatibility."""
+        self._pssh_b64 = pssh_b64
+
+    def set_required_kids(self, kids: List[Union[str, UUID]]) -> None:
+        """
+        Set the required Key IDs for intelligent caching decisions.
+
+        This method enables the CDM to make smart decisions about when to request
+        additional keys via license challenges. When cached keys are available,
+        the CDM will compare them against the required KIDs to determine if a
+        license request is still needed for missing keys.
+
+        Args:
+            kids: List of required Key IDs as UUIDs or hex strings
+
+        Note:
+            Should be called by DRM classes (PlayReady/Widevine) before making
+            license challenge requests to enable optimal caching behavior.
+        """
+        self._required_kids = []
+        for kid in kids:
+            if isinstance(kid, UUID):
+                self._required_kids.append(str(kid).replace("-", "").lower())
+            else:
+                self._required_kids.append(str(kid).replace("-", "").lower())
+
+    def _generate_session_id(self) -> bytes:
+        """Generate a unique session ID."""
+        return secrets.token_bytes(16)
+
+    def _get_init_data_from_pssh(self, pssh: Any) -> str:
+        """Extract init data from various PSSH formats."""
+        if self.is_playready and self._pssh_b64:
+            return self._pssh_b64
+
+        if hasattr(pssh, "dumps"):
+            dumps_result = pssh.dumps()
+
+            if isinstance(dumps_result, str):
+                try:
+                    base64.b64decode(dumps_result)
+                    return dumps_result
+                except Exception:
+                    return base64.b64encode(dumps_result.encode("utf-8")).decode("utf-8")
+            else:
+                return base64.b64encode(dumps_result).decode("utf-8")
+        elif hasattr(pssh, "raw"):
+            raw_data = pssh.raw
+            if isinstance(raw_data, str):
+                raw_data = raw_data.encode("utf-8")
+            return base64.b64encode(raw_data).decode("utf-8")
+        elif hasattr(pssh, "__class__") and "WrmHeader" in pssh.__class__.__name__:
+            if self.is_playready:
+                raise ValueError("PlayReady WRM header received but no PSSH B64 was set via set_pssh_b64()")
+
+            if hasattr(pssh, "raw_bytes"):
+                return base64.b64encode(pssh.raw_bytes).decode("utf-8")
+            elif hasattr(pssh, "bytes"):
+                return base64.b64encode(pssh.bytes).decode("utf-8")
+            else:
+                raise ValueError(f"Cannot extract PSSH data from WRM header type: {type(pssh)}")
+        else:
+            raise ValueError(f"Unsupported PSSH type: {type(pssh)}")
 
     def open(self) -> bytes:
-        # We stub this method to return a random session ID for now, later we save the api session id and resolve by our random generated one.
-        return bytes.fromhex(secrets.token_hex(16))
+        """
+        Open a new CDM session.
+
+        Returns:
+            Session identifier as bytes
+        """
+        session_id = self._generate_session_id()
+        self._sessions[session_id] = {
+            "service_certificate": None,
+            "keys": [],
+            "pssh": None,
+            "challenge": None,
+            "decrypt_labs_session_id": None,
+            "tried_cache": False,
+            "cached_keys": None,
+        }
+        return session_id
 
     def close(self, session_id: bytes) -> None:
-        # We stub this method to do nothing.
-        pass
+        """
+        Close a CDM session and perform comprehensive cleanup.
+
+        Args:
+            session_id: Session identifier
+
+        Raises:
+            ValueError: If session ID is invalid
+        """
+        if session_id not in self._sessions:
+            raise DecryptLabsRemoteCDMExceptions.InvalidSession(f"Invalid session ID: {session_id.hex()}")
+
+        session = self._sessions[session_id]
+        session.clear()
+        del self._sessions[session_id]
+
+    def get_service_certificate(self, session_id: bytes) -> Optional[bytes]:
+        """
+        Get the service certificate for a session.
+
+        Args:
+            session_id: Session identifier
+
+        Returns:
+            Service certificate if set, None otherwise
+
+        Raises:
+            ValueError: If session ID is invalid
+        """
+        if session_id not in self._sessions:
+            raise DecryptLabsRemoteCDMExceptions.InvalidSession(f"Invalid session ID: {session_id.hex()}")
+
+        return self._sessions[session_id]["service_certificate"]
 
     def set_service_certificate(self, session_id: bytes, certificate: Optional[Union[bytes, str]]) -> str:
-        if isinstance(certificate, bytes):
-            certificate = base64.b64encode(certificate).decode()
+        """
+        Set the service certificate for a session.
 
-        # certificate needs to be base64 to be sent off to the API.
-        # it needs to intentionally be kept as base64 encoded SignedMessage.
+        Args:
+            session_id: Session identifier
+            certificate: Service certificate (bytes or base64 string)
 
-        self.req_session.signed_device_certificate = certificate
-        self.req_session.privacy_mode = True
+        Returns:
+            Certificate status message
 
-        return "success"
+        Raises:
+            ValueError: If session ID is invalid
+        """
+        if session_id not in self._sessions:
+            raise DecryptLabsRemoteCDMExceptions.InvalidSession(f"Invalid session ID: {session_id.hex()}")
 
-    def get_service_certificate(self, session_id: bytes) -> Optional[SignedDrmCertificate]:
-        raise NotImplementedError("This method is not implemented in this CDM")
+        if certificate is None:
+            if not self._is_playready and self.device_name == "L1":
+                certificate = WidevineCdm.common_privacy_cert
+                self._sessions[session_id]["service_certificate"] = base64.b64decode(certificate)
+                return "Using default Widevine common privacy certificate for L1"
+            else:
+                self._sessions[session_id]["service_certificate"] = None
+                return "No certificate set (not required for this device type)"
+
+        if isinstance(certificate, str):
+            certificate = base64.b64decode(certificate)
+
+        self._sessions[session_id]["service_certificate"] = certificate
+        return "Successfully set Service Certificate"
+
+    def has_cached_keys(self, session_id: bytes) -> bool:
+        """
+        Check if cached keys are available for the session.
+
+        Args:
+            session_id: Session identifier
+
+        Returns:
+            True if cached keys are available
+
+        Raises:
+            ValueError: If session ID is invalid
+        """
+        if session_id not in self._sessions:
+            raise DecryptLabsRemoteCDMExceptions.InvalidSession(f"Invalid session ID: {session_id.hex()}")
+
+        session = self._sessions[session_id]
+        session_keys = session.get("keys", [])
+        return len(session_keys) > 0
 
     def get_license_challenge(
-        self, session_id: bytes, pssh: PSSH, license_type: str = "STREAMING", privacy_mode: bool = True
+        self, session_id: bytes, pssh_or_wrm: Any, license_type: str = "STREAMING", privacy_mode: bool = True
     ) -> bytes:
-        self.pssh = pssh
+        """
+        Generate a license challenge using Decrypt Labs API with intelligent caching.
 
-        res = self.session(
-            self.host + "/get-request",
-            {
-                "init_data": self.pssh.dumps(),
-                "service_certificate": self.req_session.signed_device_certificate,
-                "scheme": "widevine" if self.security_level == 3 else "L1", # Using L1 CDM,
-                "service": self.service_name,
-            },
-        )
+        This method implements smart caching logic that:
+        1. First checks local vaults for required keys
+        2. Attempts to retrieve cached keys from the API
+        3. If required KIDs are set, compares available keys (vault + cached) against requirements
+        4. Only makes a license request if keys are missing
+        5. Returns empty challenge if all required keys are available
 
-        self.license_request = res["challenge"]
-        self.api_session_ids[session_id] = res["session_id"]
+        The intelligent caching works as follows:
+        - Local vaults: Always checked first if available
+        - For L1/L2 devices: Always prioritizes cached keys (API automatically optimizes)
+        - For other devices: Uses cache retry logic based on session state
+        - With required KIDs set: Only requests license for missing keys
+        - Without required KIDs: Returns any available cached keys
+        - For PlayReady: Combines vault, cached, and license keys seamlessly
 
-        return base64.b64decode(self.license_request)
+        Args:
+            session_id: Session identifier
+            pssh_or_wrm: PSSH object or WRM header (for PlayReady compatibility)
+            license_type: Type of license (STREAMING, OFFLINE, AUTOMATIC) - for compatibility only
+            privacy_mode: Whether to use privacy mode - for compatibility only
 
-    def parse_license(self, session_id: bytes, license_message: Union[SignedMessage, bytes, str]) -> None:
-        session_id_api = self.api_session_ids[session_id]
-        if session_id not in self.keys:
-            self.keys[session_id] = []
-        session_keys = self.keys[session_id]
+        Returns:
+            License challenge as bytes, or empty bytes if available keys satisfy requirements
 
-        if isinstance(license_message, dict) and "keys" in license_message:
-            session_keys.extend(
-                [
-                    Key(kid=Key.kid_to_uuid(x["kid"]), type_=x.get("type", "CONTENT"), key=bytes.fromhex(x["key"]))
-                    for x in license_message["keys"]
-                ]
-            )
+        Raises:
+            InvalidSession: If session ID is invalid
+            requests.RequestException: If API request fails
 
+        Note:
+            Call set_required_kids() before this method for optimal caching behavior.
+            L1/L2 devices automatically use cached keys when available per API design.
+            Local vault keys are always checked first when vaults are available.
+        """
+        _ = license_type, privacy_mode
+
+        if session_id not in self._sessions:
+            raise DecryptLabsRemoteCDMExceptions.InvalidSession(f"Invalid session ID: {session_id.hex()}")
+
+        session = self._sessions[session_id]
+
+        session["pssh"] = pssh_or_wrm
+        init_data = self._get_init_data_from_pssh(pssh_or_wrm)
+        already_tried_cache = session.get("tried_cache", False)
+
+        if self.vaults and self._required_kids:
+            vault_keys = []
+            for kid_str in self._required_kids:
+                try:
+                    clean_kid = kid_str.replace("-", "")
+                    if len(clean_kid) == 32:
+                        kid_uuid = UUID(hex=clean_kid)
                     else:
-            res = self.session(
-                self.host + "/decrypt-response",
-                {
-                    "session_id": session_id_api,
-                    "init_data": self.pssh.dumps(),
-                    "license_request": self.license_request,
-                    "license_response": license_message,
-                    "scheme": "widevine" if self.security_level == 3 else "L1",
-                },
-            )
+                        kid_uuid = UUID(hex=clean_kid.ljust(32, "0"))
+                    key, _ = self.vaults.get_key(kid_uuid)
+                    if key and key.count("0") != len(key):
+                        vault_keys.append({"kid": kid_str, "key": key, "type": "CONTENT"})
+                except (ValueError, TypeError):
+                    continue
 
-            original_keys = res["keys"].replace("\n", " ")
-            keys_separated = original_keys.split("--key ")
-            formatted_keys = []
-            for k in keys_separated:
-                if ":" in k:
-                    key = k.strip()
-                    formatted_keys.append(key)
-            for keys in formatted_keys:
-                session_keys.append(
-                    (
-                        Key(
-                            kid=UUID(bytes=bytes.fromhex(keys.split(":")[0])),
-                            type_="CONTENT",
-                            key=bytes.fromhex(keys.split(":")[1]),
-                        )
-                    )
-                )
+            if vault_keys:
+                vault_kids = set(k["kid"] for k in vault_keys)
+                required_kids = set(self._required_kids)
 
-    def get_keys(self, session_id: bytes, type_: Optional[Union[int, str]] = None) -> list[Key]:
-        return self.keys[session_id]
-
-    def session(self, url, data, retries=3):
-        res = self.req_session.post(url, json=data).json()
-
-        if res.get("message") != "success":
-            if "License Response Decryption Process Failed at the very beginning" in res.get("Error", ""):
-                if retries > 0:
-                    return self.session(url, data, retries=retries - 1)
+                if required_kids.issubset(vault_kids):
+                    session["keys"] = vault_keys
+                    return b""
                 else:
-                    raise ValueError(f"CDM API returned an error: {res['Error']}")
-            else:
-                raise ValueError(f"CDM API returned an error: {res['Error']}")
+                    session["vault_keys"] = vault_keys
 
-        return res
+        if self.device_name in ["L1", "L2"]:
+            get_cached_keys = True
+        else:
+            get_cached_keys = not already_tried_cache
+
+        request_data = {
+            "scheme": self.device_name,
+            "init_data": init_data,
+            "get_cached_keys_if_exists": get_cached_keys,
+        }
+
+        if self.service_name:
+            request_data["service"] = self.service_name
+
+        if session["service_certificate"]:
+            request_data["service_certificate"] = base64.b64encode(session["service_certificate"]).decode("utf-8")
+
+        response = self._http_session.post(f"{self.host}/get-request", json=request_data, timeout=30)
+
+        if response.status_code != 200:
+            raise requests.RequestException(f"API request failed: {response.status_code} {response.text}")
+
+        data = response.json()
+
+        if data.get("message") != "success":
+            error_msg = data.get("message", "Unknown error")
+            if "details" in data:
+                error_msg += f" - Details: {data['details']}"
+            if "error" in data:
+                error_msg += f" - Error: {data['error']}"
+
+            if "service_certificate is required" in str(data) and not session["service_certificate"]:
+                error_msg += " (No service certificate was provided to the CDM session)"
+
+            raise requests.RequestException(f"API error: {error_msg}")
+
+        message_type = data.get("message_type")
+
+        if message_type == "cached-keys" or "cached_keys" in data:
+            """
+            Handle cached keys response from API.
+
+            When the API returns cached keys, we need to determine if they satisfy
+            our requirements or if we need to make an additional license request
+            for missing keys.
+            """
+            cached_keys = data.get("cached_keys", [])
+            parsed_keys = self._parse_cached_keys(cached_keys)
+
+            all_available_keys = list(parsed_keys)
+            if "vault_keys" in session:
+                all_available_keys.extend(session["vault_keys"])
+
+            session["keys"] = all_available_keys
+            session["tried_cache"] = True
+
+            if self._required_kids:
+                available_kids = set()
+                for key in all_available_keys:
+                    if isinstance(key, dict) and "kid" in key:
+                        available_kids.add(key["kid"].replace("-", "").lower())
+
+                required_kids = set(self._required_kids)
+                missing_kids = required_kids - available_kids
+
+                if missing_kids:
+                    session["cached_keys"] = parsed_keys
+
+                    if self.device_name in ["L1", "L2"]:
+                        license_request_data = {
+                            "scheme": self.device_name,
+                            "init_data": init_data,
+                            "get_cached_keys_if_exists": False,
+                        }
+                        if self.service_name:
+                            license_request_data["service"] = self.service_name
+                        if session["service_certificate"]:
+                            license_request_data["service_certificate"] = base64.b64encode(
+                                session["service_certificate"]
+                            ).decode("utf-8")
+                    else:
+                        license_request_data = request_data.copy()
+                        license_request_data["get_cached_keys_if_exists"] = False
+
+                    session["decrypt_labs_session_id"] = None
+                    session["challenge"] = None
+                    session["tried_cache"] = False
+
+                    response = self._http_session.post(
+                        f"{self.host}/get-request", json=license_request_data, timeout=30
+                    )
+                    if response.status_code == 200:
+                        data = response.json()
+                        if data.get("message") == "success" and "challenge" in data:
+                            challenge = base64.b64decode(data["challenge"])
+                            session["challenge"] = challenge
+                            session["decrypt_labs_session_id"] = data["session_id"]
+                            return challenge
+
+                    return b""
+                else:
+                    return b""
+            else:
+                return b""
+
+        if message_type == "license-request" or "challenge" in data:
+            challenge = base64.b64decode(data["challenge"])
+            session["challenge"] = challenge
+            session["decrypt_labs_session_id"] = data["session_id"]
+            return challenge
+
+        error_msg = f"Unexpected API response format. message_type={message_type}, available_fields={list(data.keys())}"
+        if data.get("message"):
+            error_msg = f"API response: {data['message']} - {error_msg}"
+        if "details" in data:
+            error_msg += f" - Details: {data['details']}"
+        if "error" in data:
+            error_msg += f" - Error: {data['error']}"
+
+        if already_tried_cache and data.get("message") == "success":
+            return b""
+
+        raise requests.RequestException(error_msg)
+
+    def parse_license(self, session_id: bytes, license_message: Union[bytes, str]) -> None:
+        """
+        Parse license response using Decrypt Labs API with intelligent key combination.
+
+        For PlayReady content with partial cached keys, this method intelligently
+        combines the cached keys with newly obtained license keys, avoiding
+        duplicates while ensuring all required keys are available.
+
+        The key combination process:
+        1. Extracts keys from the license response
+        2. If cached keys exist (PlayReady), combines them with license keys
+        3. Removes duplicate keys by comparing normalized KIDs
+        4. Updates the session with the complete key set
+
+        Args:
+            session_id: Session identifier
+            license_message: License response from license server
+
+        Raises:
+            ValueError: If session ID is invalid or no challenge available
+            requests.RequestException: If API request fails
+        """
+        if session_id not in self._sessions:
+            raise DecryptLabsRemoteCDMExceptions.InvalidSession(f"Invalid session ID: {session_id.hex()}")
+
+        session = self._sessions[session_id]
+
+        if session["keys"] and not (self.is_playready and "cached_keys" in session):
+            return
+
+        if not session.get("challenge") or not session.get("decrypt_labs_session_id"):
+            raise ValueError("No challenge available - call get_license_challenge first")
+
+        if isinstance(license_message, str):
+            if self.is_playready and license_message.strip().startswith("<?xml"):
+                license_message = license_message.encode("utf-8")
+            else:
+                try:
+                    license_message = base64.b64decode(license_message)
+                except Exception:
+                    license_message = license_message.encode("utf-8")
+
+        pssh = session["pssh"]
+        init_data = self._get_init_data_from_pssh(pssh)
+
+        license_request_b64 = base64.b64encode(session["challenge"]).decode("utf-8")
+        license_response_b64 = base64.b64encode(license_message).decode("utf-8")
+
+        request_data = {
+            "scheme": self.device_name,
+            "session_id": session["decrypt_labs_session_id"],
+            "init_data": init_data,
+            "license_request": license_request_b64,
+            "license_response": license_response_b64,
+        }
+
+        response = self._http_session.post(f"{self.host}/decrypt-response", json=request_data, timeout=30)
+
+        if response.status_code != 200:
+            raise requests.RequestException(f"License decrypt failed: {response.status_code} {response.text}")
+
+        data = response.json()
+
+        if data.get("message") != "success":
+            error_msg = data.get("message", "Unknown error")
+            if "error" in data:
+                error_msg += f" - Error: {data['error']}"
+            if "details" in data:
+                error_msg += f" - Details: {data['details']}"
+            raise requests.RequestException(f"License decrypt error: {error_msg}")
+
+        license_keys = self._parse_keys_response(data)
+
+        all_keys = []
+
+        if "vault_keys" in session:
+            all_keys.extend(session["vault_keys"])
+
+        if "cached_keys" in session:
+            cached_keys = session.get("cached_keys", [])
+            if cached_keys:
+                for cached_key in cached_keys:
+                    all_keys.append(cached_key)
+
+        for license_key in license_keys:
+            already_exists = False
+            license_kid = None
+            if isinstance(license_key, dict) and "kid" in license_key:
+                license_kid = license_key["kid"].replace("-", "").lower()
+            elif hasattr(license_key, "kid"):
+                license_kid = str(license_key.kid).replace("-", "").lower()
+            elif hasattr(license_key, "key_id"):
+                license_kid = str(license_key.key_id).replace("-", "").lower()
+
+            if license_kid:
+                for existing_key in all_keys:
+                    existing_kid = None
+                    if isinstance(existing_key, dict) and "kid" in existing_key:
+                        existing_kid = existing_key["kid"].replace("-", "").lower()
+                    elif hasattr(existing_key, "kid"):
+                        existing_kid = str(existing_key.kid).replace("-", "").lower()
+                    elif hasattr(existing_key, "key_id"):
+                        existing_kid = str(existing_key.key_id).replace("-", "").lower()
+
+                    if existing_kid == license_kid:
+                        already_exists = True
+                        break
+
+            if not already_exists:
+                all_keys.append(license_key)
+
+        session["keys"] = all_keys
+        session.pop("cached_keys", None)
+        session.pop("vault_keys", None)
+
+        if self.vaults and session["keys"]:
+            key_dict = {}
+            for key in session["keys"]:
+                if key["type"] == "CONTENT":
+                    try:
+                        clean_kid = key["kid"].replace("-", "")
+                        if len(clean_kid) == 32:
+                            kid_uuid = UUID(hex=clean_kid)
+                        else:
+                            kid_uuid = UUID(hex=clean_kid.ljust(32, "0"))
+                        key_dict[kid_uuid] = key["key"]
+                    except (ValueError, TypeError):
+                        continue
+            if key_dict:
+                self.vaults.add_keys(key_dict)
+
+    def get_keys(self, session_id: bytes, type_: Optional[str] = None) -> List[Key]:
+        """
+        Get keys from the session.
+
+        Args:
+            session_id: Session identifier
+            type_: Optional key type filter (CONTENT, SIGNING, etc.)
+
+        Returns:
+            List of Key objects
+
+        Raises:
+            InvalidSession: If session ID is invalid
+        """
+        if session_id not in self._sessions:
+            raise DecryptLabsRemoteCDMExceptions.InvalidSession(f"Invalid session ID: {session_id.hex()}")
+
+        key_dicts = self._sessions[session_id]["keys"]
+        keys = [Key(kid=k["kid"], key=k["key"], type_=k["type"]) for k in key_dicts]
+
+        if type_:
+            keys = [key for key in keys if key.type == type_]
+
+        return keys
+
+    def _parse_cached_keys(self, cached_keys_data: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
+        """Parse cached keys from API response.
+
+        Args:
+            cached_keys_data: List of cached key objects from API
+
+        Returns:
+            List of key dictionaries
+        """
+        keys = []
+
+        try:
+            if cached_keys_data and isinstance(cached_keys_data, list):
+                for key_data in cached_keys_data:
+                    if "kid" in key_data and "key" in key_data:
+                        keys.append({"kid": key_data["kid"], "key": key_data["key"], "type": "CONTENT"})
+        except Exception:
+            pass
+        return keys
+
+    def _parse_keys_response(self, data: Dict[str, Any]) -> List[Dict[str, Any]]:
+        """Parse keys from decrypt response."""
+        keys = []
+
+        if "keys" in data and isinstance(data["keys"], str):
+            keys_string = data["keys"]
+
+            for line in keys_string.split("\n"):
+                line = line.strip()
+                if line.startswith("--key "):
+                    key_part = line[6:]
+                    if ":" in key_part:
+                        kid, key = key_part.split(":", 1)
+                        keys.append({"kid": kid.strip(), "key": key.strip(), "type": "CONTENT"})
+        elif "keys" in data and isinstance(data["keys"], list):
+            for key_data in data["keys"]:
+                keys.append(
+                    {"kid": key_data.get("kid"), "key": key_data.get("key"), "type": key_data.get("type", "CONTENT")}
+                )
+
+        return keys
+
+
+__all__ = ["DecryptLabsRemoteCDM"]

unshackle/core/downloaders/aria2c.py

@@ -137,6 +137,7 @@ def download(
     if len(urls) > 1:
         split = 1
         file_allocation = "none"
+
     arguments = [
         # [Basic Options]
         "--input-file",
@@ -188,36 +189,19 @@ def download(
         p.stdin.close()
 
         while p.poll() is None:
-            # Get global statistics via RPC
             global_stats: dict[str, Any] = (
                 rpc(caller=partial(rpc_session.post, url=rpc_uri), secret=rpc_secret, method="aria2.getGlobalStat")
                 or {}
             )
 
             number_stopped = int(global_stats.get("numStoppedTotal", 0))
-            global_download_speed = int(global_stats.get("downloadSpeed", 0))
+            download_speed = int(global_stats.get("downloadSpeed", -1))
 
-            # Get active downloads via RPC for detailed progress tracking
-            active_downloads: list[dict[str, Any]] = (
-                rpc(
-                    caller=partial(rpc_session.post, url=rpc_uri),
-                    secret=rpc_secret,
-                    method="aria2.tellActive",
-                )
-                or []
-            )
+            if number_stopped:
+                yield dict(completed=number_stopped)
+            if download_speed != -1:
+                yield dict(downloaded=f"{filesize.decimal(download_speed)}/s")
 
-            # Calculate totals from active downloads
-            total_downloaded_size = 0
-            total_content_size = 0
-            active_download_speed = 0
-            
-            for download in active_downloads:
-                total_downloaded_size += int(download.get("completedLength", 0))
-                total_content_size += int(download.get("totalLength", 0))
-                active_download_speed += int(download.get("downloadSpeed", 0))
-
-            # Get stopped downloads via RPC to check for errors and completion
             stopped_downloads: list[dict[str, Any]] = (
                 rpc(
                     caller=partial(rpc_session.post, url=rpc_uri),
@@ -228,46 +212,22 @@ def download(
                 or []
             )
 
-            # Add completed downloads to totals and handle errors
-            for download in stopped_downloads:
-                if download["status"] == "complete":
-                    completed_length = int(download.get("completedLength", 0))
-                    total_downloaded_size += completed_length
-                    total_content_size += completed_length
-                elif download["status"] == "error":
+            for dl in stopped_downloads:
+                if dl["status"] == "error":
                     used_uri = next(
                         uri["uri"]
-                        for file in download["files"]
+                        for file in dl["files"]
                         if file["selected"] == "true"
                         for uri in file["uris"]
                         if uri["status"] == "used"
                     )
-                    error = f"Download Error (#{download['gid']}): {download['errorMessage']} ({download['errorCode']}), {used_uri}"
+                    error = f"Download Error (#{dl['gid']}): {dl['errorMessage']} ({dl['errorCode']}), {used_uri}"
                     error_pretty = "\n          ".join(
                         textwrap.wrap(error, width=console.width - 20, initial_indent="")
                     )
                     console.log(Text.from_ansi("\n[Aria2c]: " + error_pretty))
                     raise ValueError(error)
 
-            # Yield progress information
-            if total_content_size > 0:
-                downloaded = f"{filesize.decimal(total_downloaded_size)}/{filesize.decimal(total_content_size)} {filesize.decimal(active_download_speed)}/s"
-                yield dict(
-                    downloaded=downloaded,
-                    total=total_content_size,
-                    completed=total_downloaded_size
-                )
-            elif global_download_speed > 0:
-                yield dict(
-                    downloaded=f"{filesize.decimal(global_download_speed)}/s",
-                    speed_bytes_per_sec=global_download_speed
-                )
-
-            # Yield completion count
-            if number_stopped:
-                yield dict(completed=number_stopped)
-
-            # Exit when all downloads are complete
             if number_stopped == len(urls):
                 rpc(caller=partial(rpc_session.post, url=rpc_uri), secret=rpc_secret, method="aria2.shutdown")
                 break
@@ -314,14 +274,11 @@ def aria2c(
 
     Yields the following download status updates while chunks are downloading:
 
-    - {total: 100} (total number of URLs to download)
-    - {completed: 1} (number of completed downloads)
-    - {downloaded: "50.2 MB/128.5 MB 10.1 MB/s", total: 134742016, completed: 52428800} (progress data)
-    - {downloaded: "10.1 MB/s", speed_bytes_per_sec: 10485760} (speed fallback data)
+    - {total: 100} (100% download total)
+    - {completed: 1} (1% download progress out of 100%)
+    - {downloaded: "10.1 MB/s"} (currently downloading at a rate of 10.1 MB/s)
 
     The data is in the same format accepted by rich's progress.update() function.
-    However, The `downloaded` and `speed_bytes_per_sec` keys are custom and not natively 
-    accepted by all rich progress bars.
 
     Parameters:
         urls: Web URL(s) to file(s) to download. You can use a dictionary with the key
@@ -361,7 +318,6 @@ def aria2c(
             stdout=subprocess.DEVNULL,
             stderr=subprocess.DEVNULL,
         )
-        time.sleep(1)
 
         try:
             yield from download(urls, output_dir, filename, headers, cookies, local_proxy, max_workers)

unshackle/core/drm/playready.py

@@ -224,15 +224,51 @@ class PlayReady:
     def kids(self) -> list[UUID]:
         return self._kids
 
-    def get_content_keys(self, cdm: PlayReadyCdm, certificate: Callable, licence: Callable) -> None:
-        for kid in self.kids:
-            if kid in self.content_keys:
+    def _extract_keys_from_cdm(self, cdm: PlayReadyCdm, session_id: bytes) -> dict:
+        """Extract keys from CDM session with cross-library compatibility.
+
+        Args:
+            cdm: CDM instance
+            session_id: Session identifier
+
+        Returns:
+            Dictionary mapping KID UUIDs to hex keys
+        """
+        keys = {}
+        for key in cdm.get_keys(session_id):
+            if hasattr(key, "key_id"):
+                kid = key.key_id
+            elif hasattr(key, "kid"):
+                kid = key.kid
+            else:
                 continue
+
+            if hasattr(key, "key") and hasattr(key.key, "hex"):
+                key_hex = key.key.hex()
+            elif hasattr(key, "key") and isinstance(key.key, bytes):
+                key_hex = key.key.hex()
+            elif hasattr(key, "key") and isinstance(key.key, str):
+                key_hex = key.key
+            else:
+                continue
+
+            keys[kid] = key_hex
+        return keys
+
+    def get_content_keys(self, cdm: PlayReadyCdm, certificate: Callable, licence: Callable) -> None:
         session_id = cdm.open()
         try:
-                challenge = cdm.get_license_challenge(session_id, self.pssh.wrm_headers[0])
-                license_res = licence(challenge=challenge)
+            if hasattr(cdm, "set_pssh_b64") and self.pssh_b64:
+                cdm.set_pssh_b64(self.pssh_b64)
 
+            if hasattr(cdm, "set_required_kids"):
+                cdm.set_required_kids(self.kids)
+
+            challenge = cdm.get_license_challenge(session_id, self.pssh.wrm_headers[0])
+
+            if challenge:
+                try:
+                    license_res = licence(challenge=challenge)
                     if isinstance(license_res, bytes):
                         license_str = license_res.decode(errors="ignore")
                     else:
@@ -245,7 +281,10 @@ class PlayReady:
                             pass
 
                     cdm.parse_license(session_id, license_str)
-                keys = {key.key_id: key.key.hex() for key in cdm.get_keys(session_id)}
+                except Exception:
+                    raise
+
+            keys = self._extract_keys_from_cdm(cdm, session_id)
             self.content_keys.update(keys)
         finally:
             cdm.close(session_id)

unshackle/core/drm/widevine.py

@@ -185,7 +185,15 @@ class Widevine:
                 if cert and hasattr(cdm, "set_service_certificate"):
                     cdm.set_service_certificate(session_id, cert)
 
-                cdm.parse_license(session_id, licence(challenge=cdm.get_license_challenge(session_id, self.pssh)))
+                if hasattr(cdm, "set_required_kids"):
+                    cdm.set_required_kids(self.kids)
+
+                challenge = cdm.get_license_challenge(session_id, self.pssh)
+
+                if hasattr(cdm, "has_cached_keys") and cdm.has_cached_keys(session_id):
+                    pass
+                else:
+                    cdm.parse_license(session_id, licence(challenge=challenge))
 
                 self.content_keys = {key.kid: key.key.hex() for key in cdm.get_keys(session_id, "CONTENT")}
                 if not self.content_keys:
@@ -213,9 +221,17 @@ class Widevine:
                 if cert and hasattr(cdm, "set_service_certificate"):
                     cdm.set_service_certificate(session_id, cert)
 
+                if hasattr(cdm, "set_required_kids"):
+                    cdm.set_required_kids(self.kids)
+
+                challenge = cdm.get_license_challenge(session_id, self.pssh)
+
+                if hasattr(cdm, "has_cached_keys") and cdm.has_cached_keys(session_id):
+                    pass
+                else:
                     cdm.parse_license(
                         session_id,
-                    licence(session_id=session_id, challenge=cdm.get_license_challenge(session_id, self.pssh)),
+                        licence(session_id=session_id, challenge=challenge),
                     )
 
                 self.content_keys = {key.kid: key.key.hex() for key in cdm.get_keys(session_id, "CONTENT")}

unshackle/core/manifests/m3u8.py

@@ -2,17 +2,11 @@
 
 from __future__ import annotations
 
-from typing import Optional, Union
+from typing import Optional
 
-import httpx
 import m3u8
-from pyplayready.cdm import Cdm as PlayReadyCdm
-from pyplayready.system.pssh import PSSH as PR_PSSH
-from pywidevine.cdm import Cdm as WidevineCdm
-from pywidevine.pssh import PSSH as WV_PSSH
 from requests import Session
 
-from unshackle.core.drm import PlayReady, Widevine
 from unshackle.core.manifests.hls import HLS
 from unshackle.core.tracks import Tracks
 
@@ -21,54 +15,17 @@ def parse(
     master: m3u8.M3U8,
     language: str,
     *,
-    session: Optional[Union[Session, httpx.Client]] = None,
+    session: Optional[Session] = None,
 ) -> Tracks:
-    """Parse a variant playlist to ``Tracks`` with DRM information."""
+    """Parse a variant playlist to ``Tracks`` with basic information, defer DRM loading."""
     tracks = HLS(master, session=session).to_tracks(language)
 
-    need_wv = not any(isinstance(d, Widevine) for t in tracks for d in (t.drm or []))
-    need_pr = not any(isinstance(d, PlayReady) for t in tracks for d in (t.drm or []))
+    bool(master.session_keys or HLS.parse_session_data_keys(master, session or Session()))
 
-    if (need_wv or need_pr) and tracks.videos:
-        if not session:
-            session = Session()
-
-        session_keys = list(master.session_keys or [])
-        session_keys.extend(HLS.parse_session_data_keys(master, session))
-
-        for drm_obj in HLS.get_all_drm(session_keys):
-            if need_wv and isinstance(drm_obj, Widevine):
+    if True:
         for t in tracks.videos + tracks.audio:
-                    t.drm = [d for d in (t.drm or []) if not isinstance(d, Widevine)] + [drm_obj]
-                need_wv = False
-            elif need_pr and isinstance(drm_obj, PlayReady):
-                for t in tracks.videos + tracks.audio:
-                    t.drm = [d for d in (t.drm or []) if not isinstance(d, PlayReady)] + [drm_obj]
-                need_pr = False
-            if not need_wv and not need_pr:
-                break
-
-    if (need_wv or need_pr) and tracks.videos:
-        first_video = tracks.videos[0]
-        playlist = m3u8.load(first_video.url)
-        for key in playlist.keys or []:
-            if not key or not key.keyformat:
-                continue
-            fmt = key.keyformat.lower()
-            if need_wv and fmt == WidevineCdm.urn:
-                pssh_b64 = key.uri.split(",")[-1]
-                drm = Widevine(pssh=WV_PSSH(pssh_b64))
-                for t in tracks.videos + tracks.audio:
-                    t.drm = [d for d in (t.drm or []) if not isinstance(d, Widevine)] + [drm]
-                need_wv = False
-            elif need_pr and (fmt == PlayReadyCdm or "com.microsoft.playready" in fmt):
-                pssh_b64 = key.uri.split(",")[-1]
-                drm = PlayReady(pssh=PR_PSSH(pssh_b64), pssh_b64=pssh_b64)
-                for t in tracks.videos + tracks.audio:
-                    t.drm = [d for d in (t.drm or []) if not isinstance(d, PlayReady)] + [drm]
-                need_pr = False
-            if not need_wv and not need_pr:
-                break
+            t.needs_drm_loading = True
+            t.session = session
 
     return tracks
 

unshackle/core/titles/episode.py

@@ -92,14 +92,14 @@ class Episode(Title):
         primary_audio_track = next(iter(media_info.audio_tracks), None)
         unique_audio_languages = len({x.language.split("-")[0] for x in media_info.audio_tracks if x.language})
 
-        # Title [Year] SXXEXX Name (or just Title for main folder)
+        # Title [Year] SXXEXX Name (or Title [Year] SXX if folder)
         if folder:
             name = f"{self.title}"
             if self.year and config.series_year:
-                name += f" ({self.year})"
-            return name
+                name += f" {self.year}"
+            name += f" S{self.season:02}"
         else:
-            name = "{title}{year} S{season:02}E{number:02} - {name} -".format(
+            name = "{title}{year} S{season:02}E{number:02} {name}".format(
                 title=self.title.replace("$", "S"),  # e.g., Arli$$
                 year=f" {self.year}" if self.year and config.series_year else "",
                 season=self.season,
@@ -128,19 +128,19 @@ class Episode(Title):
                 name += f" {resolution}p"
 
             # Service
-            # if show_service:
-            #     name += f" {self.service.__name__}"
+            if show_service:
+                name += f" {self.service.__name__}"
 
-            # # 'WEB-DL'
-            # name += " WEB-DL"
+            # 'WEB-DL'
+            name += " WEB-DL"
 
-            # # DUAL
-            # if unique_audio_languages == 2:
-            #     name += " DUAL"
+            # DUAL
+            if unique_audio_languages == 2:
+                name += " DUAL"
 
-            # # MULTi
-            # if unique_audio_languages > 2:
-            #     name += " MULTi"
+            # MULTi
+            if unique_audio_languages > 2:
+                name += " MULTi"
 
             # Audio Codec + Channels (+ feature)
             if primary_audio_track:
@@ -189,12 +189,6 @@ class Episode(Title):
             # Simple naming style without technical details - use spaces instead of dots
             return sanitize_filename(name, " ")
 
-    def get_season_folder(self) -> str:
-        """
-        Get the season folder name in the format 'Season XX'.
-        """
-        return f"Season {self.season:02d}"
-
 
 class Series(SortedKeyList, ABC):
     def __init__(self, iterable: Optional[Iterable] = None):

unshackle/core/titles/movie.py

@@ -56,7 +56,7 @@ class Movie(Title):
         unique_audio_languages = len({x.language.split("-")[0] for x in media_info.audio_tracks if x.language})
 
         # Name (Year)
-        name = str(self).replace("$", "S") + " -"  # e.g., Arli$$
+        name = str(self).replace("$", "S")  # e.g., Arli$$
 
         if config.scene_naming:
             # Resolution
@@ -78,20 +78,20 @@ class Movie(Title):
                     resolution = int(primary_video_track.width * (9 / 16))
                 name += f" {resolution}p"
 
-            # # Service
-            # if show_service:
-            #     name += f" {self.service.__name__}"
+            # Service
+            if show_service:
+                name += f" {self.service.__name__}"
 
-            # # 'WEB-DL'
-            # name += " WEB-DL"
+            # 'WEB-DL'
+            name += " WEB-DL"
 
-            # # DUAL
-            # if unique_audio_languages == 2:
-            #     name += " DUAL"
+            # DUAL
+            if unique_audio_languages == 2:
+                name += " DUAL"
 
-            # # MULTi
-            # if unique_audio_languages > 2:
-            #     name += " MULTi"
+            # MULTi
+            if unique_audio_languages > 2:
+                name += " MULTi"
 
             # Audio Codec + Channels (+ feature)
             if primary_audio_track:
@@ -132,8 +132,8 @@ class Movie(Title):
                     name += " HFR"
                 name += f" {VIDEO_CODEC_MAP.get(codec, codec)}"
 
-            # if config.tag:
-            #     name += f"-{config.tag}"
+            if config.tag:
+                name += f"-{config.tag}"
 
             return sanitize_filename(name)
         else:

unshackle/core/tracks/track.py

@@ -420,6 +420,15 @@ class Track:
             for drm in self.drm:
                 if isinstance(drm, PlayReady):
                     return drm
+        elif hasattr(cdm, "is_playready"):
+            if cdm.is_playready:
+                for drm in self.drm:
+                    if isinstance(drm, PlayReady):
+                        return drm
+            else:
+                for drm in self.drm:
+                    if isinstance(drm, Widevine):
+                        return drm
 
         return self.drm[0]
 
@@ -464,6 +473,83 @@ class Track:
                 if tenc.key_ID.int != 0:
                     return tenc.key_ID
 
+    def load_drm_if_needed(self, service=None) -> bool:
+        """
+        Load DRM information for this track if it was deferred during parsing.
+
+        Args:
+            service: Service instance that can fetch track-specific DRM info
+
+        Returns:
+            True if DRM was loaded or already present, False if failed
+        """
+        if not getattr(self, "needs_drm_loading", False):
+            return bool(self.drm)
+
+        if self.drm:
+            self.needs_drm_loading = False
+            return True
+
+        if not service or not hasattr(service, "get_track_drm"):
+            return self.load_drm_from_playlist()
+
+        try:
+            track_drm = service.get_track_drm(self)
+            if track_drm:
+                self.drm = track_drm if isinstance(track_drm, list) else [track_drm]
+                self.needs_drm_loading = False
+                return True
+        except Exception as e:
+            raise ValueError(f"Failed to load DRM from service for track {self.id}: {e}")
+
+        return self.load_drm_from_playlist()
+
+    def load_drm_from_playlist(self) -> bool:
+        """
+        Fallback method to load DRM by fetching this track's individual playlist.
+        """
+        if self.drm:
+            self.needs_drm_loading = False
+            return True
+
+        try:
+            import m3u8
+            from pyplayready.cdm import Cdm as PlayReadyCdm
+            from pyplayready.system.pssh import PSSH as PR_PSSH
+            from pywidevine.cdm import Cdm as WidevineCdm
+            from pywidevine.pssh import PSSH as WV_PSSH
+
+            session = getattr(self, "session", None) or Session()
+
+            response = session.get(self.url)
+            playlist = m3u8.loads(response.text, self.url)
+
+            drm_list = []
+
+            for key in playlist.keys or []:
+                if not key or not key.keyformat:
+                    continue
+
+                fmt = key.keyformat.lower()
+                if fmt == WidevineCdm.urn:
+                    pssh_b64 = key.uri.split(",")[-1]
+                    drm = Widevine(pssh=WV_PSSH(pssh_b64))
+                    drm_list.append(drm)
+                elif fmt == PlayReadyCdm or "com.microsoft.playready" in fmt:
+                    pssh_b64 = key.uri.split(",")[-1]
+                    drm = PlayReady(pssh=PR_PSSH(pssh_b64), pssh_b64=pssh_b64)
+                    drm_list.append(drm)
+
+            if drm_list:
+                self.drm = drm_list
+                self.needs_drm_loading = False
+                return True
+
+        except Exception as e:
+            raise ValueError(f"Failed to load DRM from playlist for track {self.id}: {e}")
+
+        return False
+
     def get_init_segment(
         self,
         maximum_size: int = 20000,
@@ -558,8 +644,7 @@ class Track:
         output_path = original_path.with_stem(f"{original_path.stem}_repack")
 
         def _ffmpeg(extra_args: list[str] = None):
-            subprocess.run(
-                [
+            args = [
                 binaries.FFMPEG,
                 "-hide_banner",
                 "-loglevel",
@@ -567,6 +652,24 @@ class Track:
                 "-i",
                 original_path,
                 *(extra_args or []),
+            ]
+
+            if hasattr(self, "data") and self.data.get("audio_language"):
+                audio_lang = self.data["audio_language"]
+                audio_name = self.data.get("audio_language_name", audio_lang)
+                args.extend(
+                    [
+                        "-metadata:s:a:0",
+                        f"language={audio_lang}",
+                        "-metadata:s:a:0",
+                        f"title={audio_name}",
+                        "-metadata:s:a:0",
+                        f"handler_name={audio_name}",
+                    ]
+                )
+
+            args.extend(
+                [
                     # Following are very important!
                     "-map_metadata",
                     "-1",  # don't transfer metadata to output file
@@ -575,7 +678,11 @@ class Track:
                     "-codec",
                     "copy",
                     str(output_path),
-                ],
+                ]
+            )
+
+            subprocess.run(
+                args,
                 check=True,
                 stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,

unshackle/core/tracks/tracks.py

@@ -305,7 +305,14 @@ class Tracks:
             )
         return selected
 
-    def mux(self, title: str, delete: bool = True, progress: Optional[partial] = None) -> tuple[Path, int, list[str]]:
+    def mux(
+        self,
+        title: str,
+        delete: bool = True,
+        progress: Optional[partial] = None,
+        audio_expected: bool = True,
+        title_language: Optional[Language] = None,
+    ) -> tuple[Path, int, list[str]]:
         """
         Multiplex all the Tracks into a Matroska Container file.
 
@@ -315,7 +322,28 @@ class Tracks:
             delete: Delete all track files after multiplexing.
             progress: Update a rich progress bar via `completed=...`. This must be the
                 progress object's update() func, pre-set with task id via functools.partial.
+            audio_expected: Whether audio is expected in the output. Used to determine
+                if embedded audio metadata should be added.
+            title_language: The title's intended language. Used to select the best video track
+                for audio metadata when multiple video tracks exist.
         """
+        if self.videos and not self.audio and audio_expected:
+            video_track = None
+            if title_language:
+                video_track = next((v for v in self.videos if v.language == title_language), None)
+                if not video_track:
+                    video_track = next((v for v in self.videos if v.is_original_lang), None)
+
+            video_track = video_track or self.videos[0]
+            if video_track.language.is_valid():
+                lang_code = str(video_track.language)
+                lang_name = video_track.language.display_name()
+
+                for video in self.videos:
+                    video.needs_repack = True
+                    video.data["audio_language"] = lang_code
+                    video.data["audio_language_name"] = lang_name
+
         if not binaries.MKVToolNix:
             raise RuntimeError("MKVToolNix (mkvmerge) is required for muxing but was not found")
 
@@ -332,12 +360,20 @@ class Tracks:
                 raise ValueError("Video Track must be downloaded before muxing...")
             events.emit(events.Types.TRACK_MULTIPLEX, track=vt)
 
+            is_default = False
+            if title_language:
+                is_default = vt.language == title_language
+                if not any(v.language == title_language for v in self.videos):
+                    is_default = vt.is_original_lang or i == 0
+            else:
+                is_default = i == 0
+
             # Prepare base arguments
             video_args = [
                 "--language",
                 f"0:{vt.language}",
                 "--default-track",
-                f"0:{i == 0}",
+                f"0:{is_default}",
                 "--original-flag",
                 f"0:{vt.is_original_lang}",
                 "--compression",
@@ -363,6 +399,18 @@ class Tracks:
                     ]
                 )
 
+            if hasattr(vt, "data") and vt.data.get("audio_language"):
+                audio_lang = vt.data["audio_language"]
+                audio_name = vt.data.get("audio_language_name", audio_lang)
+                video_args.extend(
+                    [
+                        "--language",
+                        f"1:{audio_lang}",
+                        "--track-name",
+                        f"1:{audio_name}",
+                    ]
+                )
+
             cl.extend(video_args + ["(", str(vt.path), ")"])
 
         for i, at in enumerate(self.audio):

unshackle/core/utilities.py

@@ -99,9 +99,9 @@ def sanitize_filename(filename: str, spacer: str = ".") -> str:
     # remove or replace further characters as needed
     filename = "".join(c for c in filename if unicodedata.category(c) != "Mn")  # hidden characters
     filename = filename.replace("/", " & ").replace(";", " & ")  # e.g. multi-episode filenames
-    filename = re.sub(r"[;]", spacer, filename)  # structural chars to (spacer)
-    filename = re.sub(r"[\\:*!?¿,'\"""<>|$#~]", "", filename)  # not filename safe chars
-    # filename = re.sub(rf"[{spacer}]{{2,}}", spacer, filename)  # remove extra neighbouring (spacer)s
+    filename = re.sub(r"[:; ]", spacer, filename)  # structural chars to (spacer)
+    filename = re.sub(r"[\\*!?¿,'\"" "()<>|$#~]", "", filename)  # not filename safe chars
+    filename = re.sub(rf"[{spacer}]{{2,}}", spacer, filename)  # remove extra neighbouring (spacer)s
 
     return filename
 

unshackle/core/utils/tags.py

@@ -8,6 +8,7 @@ import tempfile
 from difflib import SequenceMatcher
 from pathlib import Path
 from typing import Optional, Tuple
+from xml.sax.saxutils import escape
 
 import requests
 from requests.adapters import HTTPAdapter, Retry
@@ -289,9 +290,9 @@ def _apply_tags(path: Path, tags: dict[str, str]) -> None:
         log.debug("mkvpropedit not found on PATH; skipping tags")
         return
     log.debug("Applying tags to %s: %s", path, tags)
-    xml_lines = ["<?xml version='1.0' encoding='UTF-8'?>", "<Tags>", "  <Tag>", "    <Targets/>"]
+    xml_lines = ['<?xml version="1.0" encoding="UTF-8"?>', "<Tags>", "  <Tag>", "    <Targets/>"]
     for name, value in tags.items():
-        xml_lines.append(f"    <Simple><Name>{name}</Name><String>{value}</String></Simple>")
+        xml_lines.append(f"    <Simple><Name>{escape(name)}</Name><String>{escape(value)}</String></Simple>")
     xml_lines.extend(["  </Tag>", "</Tags>"])
     with tempfile.NamedTemporaryFile("w", suffix=".xml", delete=False) as f:
         f.write("\n".join(xml_lines))
@@ -349,13 +350,25 @@ def tag_file(path: Path, title: Title, tmdb_id: Optional[int] | None = None) ->
                 if simkl_tmdb_id:
                     tmdb_id = simkl_tmdb_id
 
+                # Handle TV show data from Simkl
+                if simkl_data.get("type") == "episode" and "show" in simkl_data:
                     show_ids = simkl_data.get("show", {}).get("ids", {})
                     if show_ids.get("imdb"):
-                    standard_tags["IMDB"] = f"https://www.imdb.com/title/{show_ids['imdb']}"
+                        standard_tags["IMDB"] = show_ids["imdb"]
                     if show_ids.get("tvdb"):
-                    standard_tags["TVDB"] = f"https://thetvdb.com/dereferrer/series/{show_ids['tvdb']}"
+                        standard_tags["TVDB2"] = f"series/{show_ids['tvdb']}"
                     if show_ids.get("tmdbtv"):
-                    standard_tags["TMDB"] = f"https://www.themoviedb.org/tv/{show_ids['tmdbtv']}"
+                        standard_tags["TMDB"] = f"tv/{show_ids['tmdbtv']}"
+
+                # Handle movie data from Simkl
+                elif simkl_data.get("type") == "movie" and "movie" in simkl_data:
+                    movie_ids = simkl_data.get("movie", {}).get("ids", {})
+                    if movie_ids.get("imdb"):
+                        standard_tags["IMDB"] = movie_ids["imdb"]
+                    if movie_ids.get("tvdb"):
+                        standard_tags["TVDB2"] = f"movies/{movie_ids['tvdb']}"
+                    if movie_ids.get("tmdb"):
+                        standard_tags["TMDB"] = f"movie/{movie_ids['tmdb']}"
 
         # Use TMDB API for additional metadata (either from provided ID or Simkl lookup)
         api_key = _api_key()
@@ -373,8 +386,8 @@ def tag_file(path: Path, title: Title, tmdb_id: Optional[int] | None = None) ->
                 _apply_tags(path, custom_tags)
                 return
 
-        tmdb_url = f"https://www.themoviedb.org/{'movie' if kind == 'movie' else 'tv'}/{tmdb_id}"
-        standard_tags["TMDB"] = tmdb_url
+        prefix = "movie" if kind == "movie" else "tv"
+        standard_tags["TMDB"] = f"{prefix}/{tmdb_id}"
         try:
             ids = external_ids(tmdb_id, kind)
         except requests.RequestException as exc:
@@ -385,11 +398,13 @@ def tag_file(path: Path, title: Title, tmdb_id: Optional[int] | None = None) ->
 
         imdb_id = ids.get("imdb_id")
         if imdb_id:
-            standard_tags["IMDB"] = f"https://www.imdb.com/title/{imdb_id}"
+            standard_tags["IMDB"] = imdb_id
         tvdb_id = ids.get("tvdb_id")
         if tvdb_id:
-            tvdb_prefix = "movies" if kind == "movie" else "series"
-            standard_tags["TVDB"] = f"https://thetvdb.com/dereferrer/{tvdb_prefix}/{tvdb_id}"
+            if kind == "movie":
+                standard_tags["TVDB2"] = f"movies/{tvdb_id}"
+            else:
+                standard_tags["TVDB2"] = f"series/{tvdb_id}"
 
     merged_tags = {
         **custom_tags,

unshackle/core/vaults.py

@@ -74,7 +74,9 @@ class Vaults:
         for vault in self.vaults:
             if not vault.no_push:
                 try:
-                    success += bool(vault.add_keys(self.service, kid_keys))
+                    # Count each vault that successfully processes the keys (whether new or existing)
+                    vault.add_keys(self.service, kid_keys)
+                    success += 1
                 except (PermissionError, NotImplementedError):
                     pass
         return success

unshackle/services/EXAMPLE/__init__.py

@@ -282,6 +282,10 @@ class EXAMPLE(Service):
 
         return chapters
 
+    def get_widevine_service_certificate(self, **_: any) -> str:
+        """Return the Widevine service certificate from config, if available."""
+        return self.config.get("certificate")
+
     def get_playready_license(self, *, challenge: bytes, title: Title_T, track: AnyTrack) -> Optional[bytes]:
         """Retrieve a PlayReady license for a given track."""
 

unshackle/services/Netflix/MSL/MSLKeys.py

@@ -1,10 +0,0 @@
-from .MSLObject import MSLObject
-
-
-class MSLKeys(MSLObject):
-    def __init__(self, encryption=None, sign=None, rsa=None, mastertoken=None, cdm_session=None):
-        self.encryption = encryption
-        self.sign = sign
-        self.rsa = rsa
-        self.mastertoken = mastertoken
-        self.cdm_session = cdm_session

unshackle/services/Netflix/MSL/MSLObject.py

@@ -1,6 +0,0 @@
-import jsonpickle
-
-
-class MSLObject:
-    def __repr__(self):
-        return "<{} {}>".format(self.__class__.__name__, jsonpickle.encode(self, unpicklable=False))

unshackle/services/Netflix/MSL/__init__.py

@@ -1,408 +0,0 @@
-import base64
-import gzip
-import json
-import logging
-import os
-import random
-import re
-import sys
-import time
-import zlib
-from datetime import datetime
-from io import BytesIO
-
-import jsonpickle
-import requests
-from Cryptodome.Cipher import AES, PKCS1_OAEP
-from Cryptodome.Hash import HMAC, SHA256
-from Cryptodome.PublicKey import RSA
-from Cryptodome.Random import get_random_bytes
-from Cryptodome.Util import Padding
-
-from unshackle.core.cacher import Cacher
-
-from .MSLKeys import MSLKeys
-from .schemes import EntityAuthenticationSchemes  # noqa: F401
-from .schemes import KeyExchangeSchemes
-from .schemes.EntityAuthentication import EntityAuthentication
-from .schemes.KeyExchangeRequest import KeyExchangeRequest
-# from vinetrimmer.utils.widevine.device import RemoteDevice
-
-class MSL:
-    log = logging.getLogger("MSL")
-
-    def __init__(self, session, endpoint, sender, keys, message_id, user_auth=None):
-        self.session = session
-        self.endpoint = endpoint
-        self.sender = sender
-        self.keys = keys
-        self.user_auth = user_auth
-        self.message_id = message_id
-
-    @classmethod
-    def handshake(cls, scheme: KeyExchangeSchemes, session: requests.Session, endpoint: str, sender: str, cache: Cacher):
-        cache = cache.get(sender)
-        message_id = random.randint(0, pow(2, 52))
-        msl_keys = MSL.load_cache_data(cache)
-
-        if msl_keys is not None:
-            cls.log.info("Using cached MSL data")
-        else:
-            msl_keys = MSLKeys()
-            if scheme != KeyExchangeSchemes.Widevine:
-                msl_keys.rsa = RSA.generate(2048)
-
-            # if not cdm:
-            #     raise cls.log.exit("- No cached data and no CDM specified")
-
-            # if not msl_keys_path:
-            #     raise cls.log.exit("- No cached data and no MSL key path specified")
-
-            # Key Exchange Scheme Widevine currently not implemented
-            # if scheme == KeyExchangeSchemes.Widevine:
-            #     msl_keys.cdm_session = cdm.open(
-            #         pssh=b"\x0A\x7A\x00\x6C\x38\x2B",
-            #         raw=True,
-            #         offline=True
-            #     )
-            #     keyrequestdata = KeyExchangeRequest.Widevine(
-            #         keyrequest=cdm.get_license_challenge(msl_keys.cdm_session)
-            #     )
-            # else:
-            keyrequestdata = KeyExchangeRequest.AsymmetricWrapped(
-                keypairid="superKeyPair",
-                mechanism="JWK_RSA",
-                publickey=msl_keys.rsa.publickey().exportKey(format="DER")
-            )
-
-            data = jsonpickle.encode({
-                "entityauthdata": EntityAuthentication.Unauthenticated(sender),
-                "headerdata": base64.b64encode(MSL.generate_msg_header(
-                    message_id=message_id,
-                    sender=sender,
-                    is_handshake=True,
-                    keyrequestdata=keyrequestdata
-                ).encode("utf-8")).decode("utf-8"),
-                "signature": ""
-            }, unpicklable=False)
-            data += json.dumps({
-                "payload": base64.b64encode(json.dumps({
-                    "messageid": message_id,
-                    "data": "",
-                    "sequencenumber": 1,
-                    "endofmsg": True
-                }).encode("utf-8")).decode("utf-8"),
-                "signature": ""
-            })
-
-            try:
-                r = session.post(
-                    url=endpoint,
-                    data=data
-                )
-            except requests.HTTPError as e:
-                raise cls.log.exit(f"- Key exchange failed, response data is unexpected: {e.response.text}")
-
-            key_exchange = r.json()  # expecting no payloads, so this is fine
-            if "errordata" in key_exchange:
-                raise cls.log.exit("- Key exchange failed: " + json.loads(base64.b64decode(
-                    key_exchange["errordata"]
-                ).decode())["errormsg"])
-
-            # parse the crypto keys
-            key_response_data = json.JSONDecoder().decode(base64.b64decode(
-                key_exchange["headerdata"]
-            ).decode("utf-8"))["keyresponsedata"]
-
-            if key_response_data["scheme"] != str(scheme):
-                raise cls.log.exit("- Key exchange scheme mismatch occurred")
-
-            key_data = key_response_data["keydata"]
-            # if scheme == KeyExchangeSchemes.Widevine:
-            #     if isinstance(cdm.device, RemoteDevice):
-            #         msl_keys.encryption, msl_keys.sign = cdm.device.exchange(
-            #             cdm.sessions[msl_keys.cdm_session],
-            #             license_res=key_data["cdmkeyresponse"],
-            #             enc_key_id=base64.b64decode(key_data["encryptionkeyid"]),
-            #             hmac_key_id=base64.b64decode(key_data["hmackeyid"])
-            #         )
-            #         cdm.parse_license(msl_keys.cdm_session, key_data["cdmkeyresponse"])
-            #     else:
-            #         cdm.parse_license(msl_keys.cdm_session, key_data["cdmkeyresponse"])
-            #         keys = cdm.get_keys(msl_keys.cdm_session)
-            #         msl_keys.encryption = MSL.get_widevine_key(
-            #             kid=base64.b64decode(key_data["encryptionkeyid"]),
-            #             keys=keys,
-            #             permissions=["AllowEncrypt", "AllowDecrypt"]
-            #         )
-            #         msl_keys.sign = MSL.get_widevine_key(
-            #             kid=base64.b64decode(key_data["hmackeyid"]),
-            #             keys=keys,
-            #             permissions=["AllowSign", "AllowSignatureVerify"]
-            #         )
-            # else:
-            cipher_rsa = PKCS1_OAEP.new(msl_keys.rsa)
-            msl_keys.encryption = MSL.base64key_decode(
-                json.JSONDecoder().decode(cipher_rsa.decrypt(
-                    base64.b64decode(key_data["encryptionkey"])
-                ).decode("utf-8"))["k"]
-            )
-            msl_keys.sign = MSL.base64key_decode(
-                json.JSONDecoder().decode(cipher_rsa.decrypt(
-                    base64.b64decode(key_data["hmackey"])
-                ).decode("utf-8"))["k"]
-            )
-            msl_keys.mastertoken = key_response_data["mastertoken"]
-
-            MSL.cache_keys(msl_keys, cache)
-            cls.log.info("MSL handshake successful")
-        return cls(
-            session=session,
-            endpoint=endpoint,
-            sender=sender,
-            keys=msl_keys,
-            message_id=message_id
-        )
-
-    @staticmethod
-    def load_cache_data(cacher: Cacher):
-        if not cacher or cacher == {}:
-            return None
-        # with open(msl_keys_path, encoding="utf-8") as fd:
-        #     msl_keys = jsonpickle.decode(fd.read())
-        msl_keys = jsonpickle.decode(cacher.data)
-        if msl_keys.rsa:
-            # noinspection PyTypeChecker
-            # expects RsaKey, but is a string, this is because jsonpickle can't pickle RsaKey object
-            # so as a workaround it exports to PEM, and then when reading, it imports that PEM back
-            # to an RsaKey :)
-            msl_keys.rsa = RSA.importKey(msl_keys.rsa)
-        # If it's expired or close to, return None as it's unusable
-        if msl_keys.mastertoken and ((datetime.utcfromtimestamp(int(json.JSONDecoder().decode(
-                base64.b64decode(msl_keys.mastertoken["tokendata"]).decode("utf-8")
-        )["expiration"])) - datetime.now()).total_seconds() / 60 / 60) < 10:
-            return None
-        return msl_keys
-
-    @staticmethod
-    def cache_keys(msl_keys, cache: Cacher):
-        # os.makedirs(os.path.dirname(cache), exist_ok=True)
-        if msl_keys.rsa:
-            # jsonpickle can't pickle RsaKey objects :(
-            msl_keys.rsa = msl_keys.rsa.export_key()
-        # with open(cache, "w", encoding="utf-8") as fd:
-        #     fd.write()
-        cache.set(jsonpickle.encode(msl_keys))
-        if msl_keys.rsa:
-            # re-import now
-            msl_keys.rsa = RSA.importKey(msl_keys.rsa)
-
-    @staticmethod
-    def generate_msg_header(message_id, sender, is_handshake, userauthdata=None, keyrequestdata=None,
-                            compression="GZIP"):
-        """
-        The MSL header carries all MSL data used for entity and user authentication, message encryption
-        and verification, and service tokens. Portions of the MSL header are encrypted.
-        https://github.com/Netflix/msl/wiki/Messages#header-data
-
-        :param message_id: number against which payload chunks are bound to protect against replay.
-        :param sender: ESN
-        :param is_handshake: This flag is set true if the message is a handshake message and will not include any
-        payload chunks. It will include keyrequestdata.
-        :param userauthdata: UserAuthData
-        :param keyrequestdata: KeyRequestData
-        :param compression: Supported compression algorithms.
-
-        :return: The base64 encoded JSON String of the header
-        """
-        header_data = {
-            "messageid": message_id,
-            "renewable": True,  # MUST be True if is_handshake
-            "handshake": is_handshake,
-            "capabilities": {
-                "compressionalgos": [compression] if compression else [],
-                "languages": ["en-US"],  # bcp-47
-                "encoderformats": ["JSON"]
-            },
-            "timestamp": int(time.time()),
-            # undocumented or unused:
-            "sender": sender,
-            "nonreplayable": False,
-            "recipient": "Netflix",
-        }
-        if userauthdata:
-            header_data["userauthdata"] = userauthdata
-        if keyrequestdata:
-            header_data["keyrequestdata"] = [keyrequestdata]
-        return jsonpickle.encode(header_data, unpicklable=False)
-
-    @classmethod
-    def get_widevine_key(cls, kid, keys, permissions):
-        for key in keys:
-            if key.kid != kid:
-                continue
-            if key.type != "OPERATOR_SESSION":
-                cls.log.warning(f"Widevine Key Exchange: Wrong key type (not operator session) key {key}")
-                continue
-            if not set(permissions) <= set(key.permissions):
-                cls.log.warning(f"Widevine Key Exchange: Incorrect permissions, key {key}, needed perms {permissions}")
-                continue
-            return key.key
-        return None
-
-    def send_message(self, endpoint, params, application_data, userauthdata=None):
-        message = self.create_message(application_data, userauthdata)
-        res = self.session.post(url=endpoint, data=message, params=params)
-        header, payload_data = self.parse_message(res.text)
-        if "errordata" in header:
-            raise self.log.exit(
-                "- MSL response message contains an error: {}".format(
-                    json.loads(base64.b64decode(header["errordata"].encode("utf-8")).decode("utf-8"))
-                )
-            )
-        return header, payload_data
-
-    def create_message(self, application_data, userauthdata=None):
-        self.message_id += 1  # new message must ue a new message id
-        headerdata = self.encrypt(self.generate_msg_header(
-            message_id=self.message_id,
-            sender=self.sender,
-            is_handshake=False,
-            userauthdata=userauthdata
-        ))
-
-        header = json.dumps({
-            "headerdata": base64.b64encode(headerdata.encode("utf-8")).decode("utf-8"),
-            "signature": self.sign(headerdata).decode("utf-8"),
-            "mastertoken": self.keys.mastertoken
-        })
-
-        payload_chunks = [self.encrypt(json.dumps({
-            "messageid": self.message_id,
-            "data": self.gzip_compress(json.dumps(application_data).encode("utf-8")).decode("utf-8"),
-            "compressionalgo": "GZIP",
-            "sequencenumber": 1,  # todo ; use sequence_number from master token instead?
-            "endofmsg": True
-        }))]
-
-        message = header
-        for payload_chunk in payload_chunks:
-            message += json.dumps({
-                "payload": base64.b64encode(payload_chunk.encode("utf-8")).decode("utf-8"),
-                "signature": self.sign(payload_chunk).decode("utf-8")
-            })
-
-        return message
-
-    def decrypt_payload_chunks(self, payload_chunks):
-        """
-        Decrypt and extract data from payload chunks
-
-        :param payload_chunks: List of payload chunks
-        :return: json object
-        """
-        raw_data = ""
-
-        for payload_chunk in payload_chunks:
-            # todo ; verify signature of payload_chunk["signature"] against payload_chunk["payload"]
-            # expecting base64-encoded json string
-            payload_chunk = json.loads(base64.b64decode(payload_chunk["payload"]).decode("utf-8"))
-            # decrypt the payload
-            payload_decrypted = AES.new(
-                key=self.keys.encryption,
-                mode=AES.MODE_CBC,
-                iv=base64.b64decode(payload_chunk["iv"])
-            ).decrypt(base64.b64decode(payload_chunk["ciphertext"]))
-            payload_decrypted = Padding.unpad(payload_decrypted, 16)
-            payload_decrypted = json.loads(payload_decrypted.decode("utf-8"))
-            # decode and uncompress data if compressed
-            payload_data = base64.b64decode(payload_decrypted["data"])
-            if payload_decrypted.get("compressionalgo") == "GZIP":
-                payload_data = zlib.decompress(payload_data, 16 + zlib.MAX_WBITS)
-            raw_data += payload_data.decode("utf-8")
-
-        data = json.loads(raw_data)
-        if "error" in data:
-            error = data["error"]
-            error_display = error.get("display")
-            error_detail = re.sub(r" \(E3-[^)]+\)", "", error.get("detail", ""))
-
-            if error_display:
-               self.log.critical(f"- {error_display}")
-            if error_detail:
-               self.log.critical(f"- {error_detail}")
-
-            if not (error_display or error_detail):
-                self.log.critical(f"- {error}")
-
-            # sys.exit(1)
-
-        return data["result"]
-
-    def parse_message(self, message):
-        """
-        Parse an MSL message into a header and list of payload chunks
-
-        :param message: MSL message
-        :returns: a 2-item tuple containing message and list of payload chunks if available
-        """
-        parsed_message = json.loads("[{}]".format(message.replace("}{", "},{")))
-
-        header = parsed_message[0]
-        encrypted_payload_chunks = parsed_message[1:] if len(parsed_message) > 1 else []
-        if encrypted_payload_chunks:
-            payload_chunks = self.decrypt_payload_chunks(encrypted_payload_chunks)
-        else:
-            payload_chunks = {}
-
-        return header, payload_chunks
-
-    @staticmethod
-    def gzip_compress(data):
-        out = BytesIO()
-        with gzip.GzipFile(fileobj=out, mode="w") as fd:
-            fd.write(data)
-        return base64.b64encode(out.getvalue())
-
-    @staticmethod
-    def base64key_decode(payload):
-        length = len(payload) % 4
-        if length == 2:
-            payload += "=="
-        elif length == 3:
-            payload += "="
-        elif length != 0:
-            raise ValueError("Invalid base64 string")
-        return base64.urlsafe_b64decode(payload.encode("utf-8"))
-
-    def encrypt(self, plaintext):
-        """
-        Encrypt the given Plaintext with the encryption key
-        :param plaintext:
-        :return: Serialized JSON String of the encryption Envelope
-        """
-        iv = get_random_bytes(16)
-        return json.dumps({
-            "ciphertext": base64.b64encode(
-                AES.new(
-                    self.keys.encryption,
-                    AES.MODE_CBC,
-                    iv
-                ).encrypt(
-                    Padding.pad(plaintext.encode("utf-8"), 16)
-                )
-            ).decode("utf-8"),
-            "keyid": "{}_{}".format(self.sender, json.loads(
-                base64.b64decode(self.keys.mastertoken["tokendata"]).decode("utf-8")
-            )["sequencenumber"]),
-            "sha256": "AA==",
-            "iv": base64.b64encode(iv).decode("utf-8")
-        })
-
-    def sign(self, text):
-        """
-        Calculates the HMAC signature for the given text with the current sign key and SHA256
-        :param text:
-        :return: Base64 encoded signature
-        """
-        return base64.b64encode(HMAC.new(self.keys.sign, text.encode("utf-8"), SHA256).digest())

unshackle/services/Netflix/MSL/schemes/EntityAuthentication.py

@@ -1,59 +0,0 @@
-from .. import EntityAuthenticationSchemes
-from ..MSLObject import MSLObject
-
-
-# noinspection PyPep8Naming
-class EntityAuthentication(MSLObject):
-    def __init__(self, scheme, authdata):
-        """
-        Data used to identify and authenticate the entity associated with a message.
-        https://github.com/Netflix/msl/wiki/Entity-Authentication-%28Configuration%29
-
-        :param scheme: Entity Authentication Scheme identifier
-        :param authdata: Entity Authentication data
-        """
-        self.scheme = str(scheme)
-        self.authdata = authdata
-
-    @classmethod
-    def Unauthenticated(cls, identity):
-        """
-        The unauthenticated entity authentication scheme does not provide encryption or authentication and only
-        identifies the entity. Therefore entity identities can be harvested and spoofed. The benefit of this
-        authentication scheme is that the entity has control over its identity. This may be useful if the identity is
-        derived from or related to other data, or if retaining the identity is desired across state resets or in the
-        event of MSL errors requiring entity re-authentication.
-        """
-        return cls(
-            scheme=EntityAuthenticationSchemes.Unauthenticated,
-            authdata={"identity": identity}
-        )
-
-    @classmethod
-    def Widevine(cls, devtype, keyrequest):
-        """
-        The Widevine entity authentication scheme is used by devices with the Widevine CDM. It does not provide
-        encryption or authentication and only identifies the entity. Therefore entity identities can be harvested
-        and spoofed. The entity identity is composed from the provided device type and Widevine key request data. The
-        Widevine CDM properties can be extracted from the key request data.
-
-        When coupled with the Widevine key exchange scheme, the entity identity can be cryptographically validated by
-        comparing the entity authentication key request data against the key exchange key request data.
-
-        Note that the local entity will not know its entity identity when using this scheme.
-
-        > Devtype
-
-        An arbitrary value identifying the device type the local entity wishes to assume. The data inside the Widevine
-        key request may be optionally used to validate the claimed device type.
-
-        :param devtype: Local entity device type
-        :param keyrequest: Widevine key request
-        """
-        return cls(
-            scheme=EntityAuthenticationSchemes.Widevine,
-            authdata={
-                "devtype": devtype,
-                "keyrequest": keyrequest
-            }
-        )

unshackle/services/Netflix/MSL/schemes/KeyExchangeRequest.py

@@ -1,80 +0,0 @@
-import base64
-
-from .. import KeyExchangeSchemes
-from ..MSLObject import MSLObject
-
-
-# noinspection PyPep8Naming
-class KeyExchangeRequest(MSLObject):
-    def __init__(self, scheme, keydata):
-        """
-        Session key exchange data from a requesting entity.
-        https://github.com/Netflix/msl/wiki/Key-Exchange-%28Configuration%29
-
-        :param scheme: Key Exchange Scheme identifier
-        :param keydata: Key Request data
-        """
-        self.scheme = str(scheme)
-        self.keydata = keydata
-
-    @classmethod
-    def AsymmetricWrapped(cls, keypairid, mechanism, publickey):
-        """
-        Asymmetric wrapped key exchange uses a generated ephemeral asymmetric key pair for key exchange. It will
-        typically be used when there is no other data or keys from which to base secure key exchange.
-
-        This mechanism provides perfect forward secrecy but does not guarantee that session keys will only be available
-        to the requesting entity if the requesting MSL stack has been modified to perform the operation on behalf of a
-        third party.
-
-        > Key Pair ID
-
-        The key pair ID is included as a sanity check.
-
-        > Mechanism & Public Key
-
-        The following mechanisms are associated public key formats are currently supported.
-
-            Field 	    Public  Key Format 	Description
-            RSA 	    SPKI 	RSA-OAEP    encrypt/decrypt
-            ECC 	    SPKI 	ECIES       encrypt/decrypt
-            JWEJS_RSA 	SPKI 	RSA-OAEP    JSON Web Encryption JSON Serialization
-            JWE_RSA 	SPKI 	RSA-OAEP    JSON Web Encryption Compact Serialization
-            JWK_RSA 	SPKI 	RSA-OAEP    JSON Web Key
-            JWK_RSAES 	SPKI 	RSA PKCS#1  JSON Web Key
-
-        :param keypairid: key pair ID
-        :param mechanism: asymmetric key type
-        :param publickey: public key
-        """
-        return cls(
-            scheme=KeyExchangeSchemes.AsymmetricWrapped,
-            keydata={
-                "keypairid": keypairid,
-                "mechanism": mechanism,
-                "publickey": base64.b64encode(publickey).decode("utf-8")
-            }
-        )
-
-    @classmethod
-    def Widevine(cls, keyrequest):
-        """
-        Google Widevine provides a secure key exchange mechanism. When requested the Widevine component will issue a
-        one-time use key request. The Widevine server library can be used to authenticate the request and return
-        randomly generated symmetric keys in a protected key response bound to the request and Widevine client library.
-        The key response also specifies the key identities, types and their permitted usage.
-
-        The Widevine key request also contains a model identifier and a unique device identifier with an expectation of
-        long-term persistence. These values are available from the Widevine client library and can be retrieved from
-        the key request by the Widevine server library.
-
-        The Widevine client library will protect the returned keys from inspection or misuse.
-
-        :param keyrequest: Base64-encoded Widevine CDM license challenge (PSSH: b'\x0A\x7A\x00\x6C\x38\x2B')
-        """
-        if not isinstance(keyrequest, str):
-            keyrequest = base64.b64encode(keyrequest).decode()
-        return cls(
-            scheme=KeyExchangeSchemes.Widevine,
-            keydata={"keyrequest": keyrequest}
-        )

unshackle/services/Netflix/MSL/schemes/UserAuthentication.py

@@ -1,59 +0,0 @@
-from ..MSLObject import MSLObject
-from . import UserAuthenticationSchemes
-
-
-# noinspection PyPep8Naming
-class UserAuthentication(MSLObject):
-    def __init__(self, scheme, authdata):
-        """
-        Data used to identify and authenticate the user associated with a message.
-        https://github.com/Netflix/msl/wiki/User-Authentication-%28Configuration%29
-
-        :param scheme: User Authentication Scheme identifier
-        :param authdata: User Authentication data
-        """
-        self.scheme = str(scheme)
-        self.authdata = authdata
-
-    @classmethod
-    def EmailPassword(cls, email, password):
-        """
-        Email and password is a standard user authentication scheme in wide use.
-
-        :param email: user email address
-        :param password: user password
-        """
-        return cls(
-            scheme=UserAuthenticationSchemes.EmailPassword,
-            authdata={
-                "email": email,
-                "password": password
-            }
-        )
-
-    @classmethod
-    def NetflixIDCookies(cls, netflixid, securenetflixid):
-        """
-        Netflix ID HTTP cookies are used when the user has previously logged in to a web site. Possession of the
-        cookies serves as proof of user identity, in the same manner as they do when communicating with the web site.
-
-        The Netflix ID cookie and Secure Netflix ID cookie are HTTP cookies issued by the Netflix web site after
-        subscriber login. The Netflix ID cookie is encrypted and identifies the subscriber and analogous to a
-        subscriber’s username. The Secure Netflix ID cookie is tied to a Netflix ID cookie and only sent over HTTPS
-        and analogous to a subscriber’s password.
-
-        In some cases the Netflix ID and Secure Netflix ID cookies will be unavailable to the MSL stack or application.
-        If either or both of the Netflix ID or Secure Netflix ID cookies are absent in the above data structure the
-        HTTP cookie headers will be queried for it; this is only acceptable when HTTPS is used as the underlying
-        transport protocol.
-
-        :param netflixid: Netflix ID cookie
-        :param securenetflixid: Secure Netflix ID cookie
-        """
-        return cls(
-            scheme=UserAuthenticationSchemes.NetflixIDCookies,
-            authdata={
-                "netflixid": netflixid,
-                "securenetflixid": securenetflixid
-            }
-        )

unshackle/services/Netflix/MSL/schemes/__init__.py

@@ -1,24 +0,0 @@
-from enum import Enum
-
-
-class Scheme(Enum):
-    def __str__(self):
-        return str(self.value)
-
-
-class EntityAuthenticationSchemes(Scheme):
-    """https://github.com/Netflix/msl/wiki/Entity-Authentication-%28Configuration%29"""
-    Unauthenticated = "NONE"
-    Widevine = "WIDEVINE"
-
-
-class UserAuthenticationSchemes(Scheme):
-    """https://github.com/Netflix/msl/wiki/User-Authentication-%28Configuration%29"""
-    EmailPassword = "EMAIL_PASSWORD"
-    NetflixIDCookies = "NETFLIXID"
-
-
-class KeyExchangeSchemes(Scheme):
-    """https://github.com/Netflix/msl/wiki/Key-Exchange-%28Configuration%29"""
-    AsymmetricWrapped = "ASYMMETRIC_WRAPPED"
-    Widevine = "WIDEVINE"

unshackle/services/Netflix/__init__.py

@@ -1,978 +0,0 @@
-import base64
-from datetime import datetime
-import json
-from math import e
-
-import random
-import sys
-import time
-import typing
-from uuid import UUID
-import click
-import re
-from typing import List, Literal, Optional, Set, Union, Tuple
-from http.cookiejar import CookieJar
-from itertools import zip_longest
-from Crypto.Random import get_random_bytes
-
-import jsonpickle
-from pymp4.parser import Box
-from pywidevine import PSSH, Cdm
-import requests
-from langcodes import Language
-
-from unshackle.core.constants import AnyTrack
-from unshackle.core.credential import Credential
-from unshackle.core.drm.widevine import Widevine
-from unshackle.core.service import Service
-from unshackle.core.titles import Titles_T, Title_T
-from unshackle.core.titles.episode import Episode, Series
-from unshackle.core.titles.movie import Movie, Movies
-from unshackle.core.titles.title import Title
-from unshackle.core.tracks import Tracks, Chapters
-from unshackle.core.tracks.audio import Audio
-from unshackle.core.tracks.chapter import Chapter
-from unshackle.core.tracks.subtitle import Subtitle
-from unshackle.core.tracks.track import Track
-from unshackle.core.tracks.video import Video
-from unshackle.core.utils.collections import flatten, as_list
-
-from unshackle.core.tracks.attachment import Attachment
-from unshackle.core.drm.playready import PlayReady
-from unshackle.core.titles.song import Song
-from unshackle.utils.base62 import decode
-from .MSL import MSL, KeyExchangeSchemes
-from .MSL.schemes.UserAuthentication import UserAuthentication
-
-class Netflix(Service):
-    """
-    Service for https://netflix.com
-    Version: 1.0.0
-
-    Authorization: Cookies
-    Security: UHD@SL3000/L1 FHD@SL3000/L1
-    """
-    TITLE_RE = [
-        r"^(?:https?://(?:www\.)?netflix\.com(?:/[a-z0-9]{2})?/(?:title/|watch/|.+jbv=))?(?P<id>\d+)",
-        r"^https?://(?:www\.)?unogs\.com/title/(?P<id>\d+)",
-    ]
-    ALIASES= ("NF", "Netflix")
-    NF_LANG_MAP = {
-        "es": "es-419",
-        "pt": "pt-PT",
-    }
-
-    @staticmethod
-    @click.command(name="Netflix", short_help="https://netflix.com")
-    @click.argument("title", type=str)
-    @click.option("-drm", "--drm-system", type=click.Choice(["widevine", "playready"], case_sensitive=False),
-                  default="widevine",
-                  help="which drm system to use")
-    @click.option("-p", "--profile", type=click.Choice(["MPL", "HPL", "QC", "MPL+HPL", "MPL+HPL+QC", "MPL+QC"], case_sensitive=False),
-                  default=None,
-                  help="H.264 profile to use. Default is best available.")
-    @click.option("--meta-lang", type=str, help="Language to use for metadata")
-    @click.option("-ht","--hydrate-track", is_flag=True, default=False, help="Hydrate missing audio and subtitle.")
-    @click.option("-hb", "--high-bitrate", is_flag=True, default=False, help="Get more video bitrate")
-    @click.pass_context
-    def cli(ctx, **kwargs):
-        return Netflix(ctx, **kwargs)
-
-    def __init__(self, ctx: click.Context, title: str, drm_system: Literal["widevine", "playready"], profile: str, meta_lang: str, hydrate_track: bool, high_bitrate: bool):
-        super().__init__(ctx)
-        # General
-        self.title = title
-        self.profile = profile
-        self.meta_lang = meta_lang
-        self.hydrate_track = hydrate_track
-        self.drm_system = drm_system
-        self.profiles: List[str] = []
-        self.requested_profiles: List[str] = []
-        self.high_bitrate = high_bitrate
-        
-        # MSL
-        self.esn = self.cache.get("ESN")
-        self.msl: Optional[MSL] = None
-        self.userauthdata = None
-
-        # Download options
-        self.range = ctx.parent.params.get("range_") or [Video.Range.SDR]
-        self.vcodec = ctx.parent.params.get("vcodec") or Video.Codec.AVC # Defaults to H264
-        self.acodec : Audio.Codec = ctx.parent.params.get("acodec") or Audio.Codec.EC3
-        self.quality: List[int] = ctx.parent.params.get("quality")
-        self.audio_only = ctx.parent.params.get("audio_only")
-        self.subs_only = ctx.parent.params.get("subs_only")
-        self.chapters_only = ctx.parent.params.get("chapters_only")
-
-
-    def authenticate(self, cookies: Optional[CookieJar] = None, credential: Optional[Credential] = None) -> None:
-        # Configure first before download
-        self.log.debug("Authenticating Netflix service")
-        auth = super().authenticate(cookies, credential)
-        if not cookies:
-            raise EnvironmentError("Service requires Cookies for Authentication.")
-        self.configure()
-        return auth
-
-    def get_titles(self) -> Titles_T:
-        metadata = self.get_metadata(self.title)
-        if "video" not in metadata:
-            self.log.error(f"Failed to get metadata: {metadata}")
-            sys.exit(1)
-        titles: Titles_T | None = None
-        if metadata["video"]["type"] == "movie":
-            movie = Movie(
-                id_=self.title,
-                name=metadata["video"]["title"],
-                year=metadata["video"]["year"],
-                # language=self.get_original_language(self.get_manifest()),
-                service=self.__class__,
-                data=metadata["video"],
-                description=metadata["video"]["synopsis"]
-            )
-            movie.language = self.get_original_language(self.get_manifest(movie, self.profiles))
-            titles = Movies([
-                movie
-            ])
-        else:
-            # self.log.warning(f"Metadata: {jsonpickle.encode(metadata, indent=2)}")
-            # print(metadata)
-            episode_list: List[Episode] = []
-            for season in metadata["video"]["seasons"]:
-                for episodes in season["episodes"]:
-                    episode = Episode(
-                        id_=self.title,
-                        title=metadata["video"]["title"],
-                        year=season["year"],
-                        service=self.__class__,
-                        season=season["seq"],
-                        number=episodes["seq"],
-                        name=episodes["title"],
-                        data=episodes,
-                        description=episodes["synopsis"],
-                    )
-                    try:
-                        episode.language = self.get_original_language(self.get_manifest(episode, self.profiles))
-                        self.log.debug(f"Episode S{episode.season:02d}E{episode.number:02d}: {episode.language}")
-                    except Exception as e:
-                        self.log.warning(f"Failed to get original language for episode S{season['seq']:02d}E{episodes['seq']:02d}: {e}")
-                        # Fallback: try to get the original language from the first episode that worked
-                        # or default to English if none worked
-                        if episode_list and hasattr(episode_list[0], 'language') and episode_list[0].language:
-                            episode.language = episode_list[0].language
-                        else:
-                            episode.language = Language.get("en")
-                        self.log.info(f"Using fallback language for episode: {episode.language}")
-                    
-                    episode_list.append(
-                        episode
-                    )
-
-
-            titles = Series(episode_list)
-
-
-
-        return titles
-
-
-
-    def get_tracks(self, title: Title_T) -> Tracks:
-       
-        tracks = Tracks()
-        
-        # If Video Codec is H.264 is selected but `self.profile is none` profile QC has to be requested seperately
-        if self.vcodec == Video.Codec.AVC:
-            # self.log.info(f"Profile: {self.profile}")
-            try:
-                manifest = self.get_manifest(title, self.profiles)
-                movie_track = self.manifest_as_tracks(manifest, title, self.hydrate_track)
-                tracks.add(movie_track)
-
-                if self.profile is not None:
-                    self.log.info(f"Requested profiles: {self.profile}")
-                else:
-                    qc_720_profile = [x for x in self.config["profiles"]["video"][self.vcodec.extension.upper()]["QC"] if "l40" not in x and 720 in self.quality]
-                    qc_manifest = self.get_manifest(title, qc_720_profile if 720 in self.quality else self.config["profiles"]["video"][self.vcodec.extension.upper()]["QC"])
-                    qc_tracks = self.manifest_as_tracks(qc_manifest, title, False)
-                    tracks.add(qc_tracks.videos)
-
-                    mpl_manifest = self.get_manifest(title, [x for x in self.config["profiles"]["video"][self.vcodec.extension.upper()]["MPL"] if "l40" not in x])
-                    mpl_tracks = self.manifest_as_tracks(mpl_manifest, title, False)
-                    tracks.add(mpl_tracks.videos)
-            except Exception as e:
-                self.log.error(e)
-        else:
-            if self.high_bitrate:
-                splitted_profiles = self.split_profiles(self.profiles)
-                for index, profile_list in enumerate(splitted_profiles):
-                    try:
-                        self.log.debug(f"Index: {index}. Getting profiles: {profile_list}")
-                        manifest = self.get_manifest(title, profile_list)
-                        manifest_tracks = self.manifest_as_tracks(manifest, title, self.hydrate_track if index == 0 else False)
-                        tracks.add(manifest_tracks if index == 0 else manifest_tracks.videos)
-                    except Exception:
-                        self.log.error(f"Error getting profile: {profile_list}. Skipping")
-                        continue
-            else:
-                try:
-                    manifest = self.get_manifest(title, self.profiles)
-                    manifest_tracks = self.manifest_as_tracks(manifest, title, self.hydrate_track)
-                    tracks.add(manifest_tracks)
-                except Exception as e:
-                    self.log.error(e)
-
-
-            
-        # Add Attachments for profile picture
-        if isinstance(title, Movie):
-            if title.data and "boxart" in title.data and title.data["boxart"]:
-                tracks.add(
-                    Attachment.from_url(
-                        url=title.data["boxart"][0]["url"]
-                    )
-                )
-        else:
-            if title.data and "stills" in title.data and title.data["stills"]:
-                tracks.add(
-                    Attachment.from_url(title.data["stills"][0]["url"])
-                )
-        
-        return tracks
-        
-    def split_profiles(self, profiles: List[str]) -> List[List[str]]:
-        """
-        Split profiles with names containing specific patterns based on video codec
-        For H264: uses patterns "l30", "l31", "l40" (lowercase)
-        For non-H264: uses patterns "L30", "L31", "L40", "L41", "L50", "L51" (uppercase)
-        Returns List[List[str]] type with profiles grouped by pattern
-        """
-        # Define the profile patterns to match based on video codec
-        if self.vcodec == Video.Codec.AVC:  # H264
-            patterns = ["l30", "l31", "l40"]
-        else:
-            patterns = ["L30", "L31", "L40", "L41", "L50", "L51"]
-        
-        # Group profiles by pattern
-        result: List[List[str]] = []
-        for pattern in patterns:
-            pattern_group = []
-            for profile in profiles:
-                if pattern in profile:
-                    pattern_group.append(profile)
-            if pattern_group:  # Only add non-empty groups
-                result.append(pattern_group)
-        
-        return result
-        
-        
-    def get_chapters(self, title: Title_T) -> Chapters:
-        chapters: Chapters = Chapters()
-        
-        if not title.data:
-            return chapters
-            
-        try:
-            # self.log.info(f"Title data: {title.data}")
-            if "skipMarkers" in title.data and "credit" in title.data["skipMarkers"]:
-                credits = title.data["skipMarkers"]["credit"]
-                if credits.get("start", 0) > 0 and credits.get("end", 0) > 0:
-                    chapters.add(Chapter(
-                        timestamp=credits["start"], # Milliseconds
-                        name="Intro"
-                    ))
-                    chapters.add(
-                        Chapter(
-                            timestamp=credits["end"], # Milliseconds
-                        )
-                    )
-
-            if "creditsOffset" in title.data and title.data["creditsOffset"] is not None:
-                chapters.add(Chapter(
-                    timestamp=float(title.data["creditsOffset"]), # this is seconds, needed to assign to float
-                    name="Credits"
-                ))
-        except Exception as e:
-            self.log.warning(f"Failed to process chapters: {e}")
-
-        return chapters
-
-    def get_widevine_license(self, *, challenge: bytes, title: Movie | Episode | Song, track: AnyTrack) -> bytes | str | None:
-        if not self.msl:
-            self.log.error(f"MSL Client is not intialized!")
-            sys.exit(1)
-        application_data = {
-                "version": 2,
-                "url": track.data["license_url"],
-                "id": int(time.time() * 10000),
-                "esn": self.esn.data,
-                "languages": ["en-US"],
-                # "uiVersion": "shakti-v9dddfde5",
-                "clientVersion": "6.0026.291.011",
-                "params": [{
-                    "sessionId": base64.b64encode(get_random_bytes(16)).decode("utf-8"),
-                    "clientTime": int(time.time()),
-                    "challengeBase64": base64.b64encode(challenge).decode("utf-8"),
-                    "xid": str(int((int(time.time()) + 0.1612) * 1000)),
-                }],
-                "echo": "sessionId"
-            }
-        header, payload_data = self.msl.send_message(
-            endpoint=self.config["endpoints"]["license"],
-            params={
-                "reqAttempt": 1,
-                "reqName": "license",
-            },
-            application_data=application_data,
-            userauthdata=self.userauthdata
-        )
-        if not payload_data:
-            self.log.error(f" - Failed to get license: {header['message']} [{header['code']}]")
-            sys.exit(1)
-        if "error" in payload_data[0]:
-            error = payload_data[0]["error"]
-            error_display = error.get("display")
-            error_detail = re.sub(r" \(E3-[^)]+\)", "", error.get("detail", ""))
-
-            if error_display:
-                self.log.critical(f" - {error_display}")
-            if error_detail:
-                self.log.critical(f" - {error_detail}")
-
-            if not (error_display or error_detail):
-                self.log.critical(f" - {error}")
-
-            sys.exit(1)
-        return payload_data[0]["licenseResponseBase64"]
-    
-    def get_playready_license(self, *, challenge: bytes, title: Movie | Episode | Song, track: AnyTrack) -> bytes | str | None:
-        return None
-        # return super().get_widevine_license(challenge=challenge, title=title, track=track)
-
-    def configure(self):
-        # self.log.info(ctx)
-        # if profile is none from argument let's use them all profile in video codec scope
-        # self.log.info(f"Requested profiles: {self.profile}")
-        if self.profile is None:
-            self.profiles = self.config["profiles"]["video"][self.vcodec.extension.upper()]
-
-
-        if self.profile is not None:
-            self.requested_profiles = self.profile.split('+')
-            self.log.info(f"Requested profile: {self.requested_profiles}")
-        else:
-            # self.log.info(f"Video Range: {self.range}")
-            self.requested_profiles = self.config["profiles"]["video"][self.vcodec.extension.upper()]
-        # Make sure video codec is supported by Netflix
-        if self.vcodec.extension.upper() not in self.config["profiles"]["video"]:
-            raise ValueError(f"Video Codec {self.vcodec} is not supported by Netflix")
-
-        if self.range[0].name not in list(self.config["profiles"]["video"][self.vcodec.extension.upper()].keys()) and self.vcodec != Video.Codec.AVC and self.vcodec != Video.Codec.VP9:
-            self.log.error(f"Video range {self.range[0].name} is not supported by Video Codec: {self.vcodec}")
-            sys.exit(1)
-
-        if len(self.range) > 1:
-            self.log.error(f"Multiple video range is not supported right now.")
-            sys.exit(1)
-        
-        if self.vcodec == Video.Codec.AVC and self.range[0] != Video.Range.SDR:
-            self.log.error(f"H.264 Video Codec only supports SDR")
-            sys.exit(1)
-
-        self.profiles = self.get_profiles()
-        self.log.info("Intializing a MSL client")
-        self.get_esn()
-        scheme = KeyExchangeSchemes.AsymmetricWrapped
-        self.log.info(f"Scheme: {scheme}")
-
-
-        self.msl = MSL.handshake(
-            scheme=scheme,
-            session=self.session,
-            endpoint=self.config["endpoints"]["manifest"],
-            sender=self.esn.data,
-            cache=self.cache.get("MSL")
-        )
-        cookie = self.session.cookies.get_dict()
-        self.userauthdata = UserAuthentication.NetflixIDCookies(
-            netflixid=cookie["NetflixId"],
-            securenetflixid=cookie["SecureNetflixId"]
-        )
-
-
-    def get_profiles(self):
-        result_profiles = []
-
-        if self.vcodec == Video.Codec.AVC:
-            if self.requested_profiles is not None:
-                for requested_profiles in self.requested_profiles:
-                    result_profiles.extend(flatten(list(self.config["profiles"]["video"][self.vcodec.extension.upper()][requested_profiles])))
-                return result_profiles
-                
-            result_profiles.extend(flatten(list(self.config["profiles"]["video"][self.vcodec.extension.upper()].values())))
-            return result_profiles
-
-        # Handle case for codec VP9
-        if self.vcodec == Video.Codec.VP9 and self.range[0] != Video.Range.HDR10:
-            result_profiles.extend(self.config["profiles"]["video"][self.vcodec.extension.upper()].values())
-            return result_profiles
-        for profiles in self.config["profiles"]["video"][self.vcodec.extension.upper()]:
-            for range in self.range:
-                if range in profiles:
-                    result_profiles.extend(self.config["profiles"]["video"][self.vcodec.extension.upper()][range.name])
-                    # sys.exit(1)
-        self.log.debug(f"Result_profiles: {result_profiles}")
-        return result_profiles
-        
-    def get_esn(self):
-        ESN_GEN = "".join(random.choice("0123456789ABCDEF") for _ in range(30))
-        esn_value = f"NFCDIE-03-{ESN_GEN}"
-        # Check if ESN is expired or doesn't exist
-        if self.esn.data is None or self.esn.data == {} or (hasattr(self.esn, 'expired') and self.esn.expired):
-            # Set new ESN with 6-hour expiration
-            self.esn.set(esn_value, 1 * 60 * 60)  # 6 hours in seconds
-            self.log.info(f"Generated new ESN with 1-hour expiration")
-        else:
-            self.log.info(f"Using cached ESN.")
-        self.log.info(f"ESN: {self.esn.data}")
-
-
-    def get_metadata(self, title_id: str):
-        """
-        Obtain Metadata information about a title by it's ID.
-        :param title_id: Title's ID.
-        :returns: Title Metadata.
-        """
-
-        try:
-            metadata = self.session.get(
-                self.config["endpoints"]["metadata"].format(build_id="release"),
-                params={
-                    "movieid": title_id,
-                    "drmSystem": self.config["configuration"]["drm_system"],
-                    "isWatchlistEnabled": False,
-                    "isShortformEnabled": False,
-                    "languages": self.meta_lang
-                }
-            ).json()
-        except requests.HTTPError as e:
-            if e.response.status_code == 500:
-                self.log.warning(
-                    " - Recieved a HTTP 500 error while getting metadata, deleting cached reactContext data"
-                )
-                # self.cache.
-                # os.unlink(self.get_cache("web_data.json"))
-                # return self.get_metadata(self, title_id)
-            raise Exception(f"Error getting metadata: {e}")
-        except json.JSONDecodeError:
-            self.log.error(" - Failed to get metadata, title might not be available in your region.")
-            sys.exit(1)
-        else:
-            if "status" in metadata and metadata["status"] == "error":
-                self.log.error(
-                    f" - Failed to get metadata, cookies might be expired. ({metadata['message']})"
-                )
-                sys.exit(1)
-            return metadata
-
-    def _get_empty_manifest(self):
-        """Return an empty manifest structure to prevent crashes when manifest retrieval fails"""
-        return {
-            "video_tracks": [{
-                "streams": [],
-                "drmHeader": {"bytes": b""}
-            }],
-            "audio_tracks": [],
-            "timedtexttracks": [],
-            "links": {
-                "license": {"href": ""}
-            }
-        }
-
-    def get_manifest(self, title: Title_T, video_profiles: List[str], required_text_track_id: Optional[str] = None, required_audio_track_id: Optional[str] = None):
-        try:
-            # Log context information for debugging
-            title_id = title.data.get('episodeId', title.data.get('id', 'unknown')) if title.data else 'unknown'
-            self.log.debug(f"Getting manifest for title_id: {title_id}, video_profiles_count: {len(video_profiles)}, required_audio_track_id: {required_audio_track_id}, required_text_track_id: {required_text_track_id}")
-            
-            audio_profiles = self.config["profiles"]["audio"].values()
-            video_profiles = sorted(set(flatten(as_list(
-                    video_profiles,
-                    audio_profiles,
-                    self.config["profiles"]["video"]["H264"]["BPL"] if self.vcodec == Video.Codec.AVC else [],
-                    self.config["profiles"]["subtitles"],
-            ))))
-            
-
-                
-            self.log.debug("Profiles:\n\t" + "\n\t".join(video_profiles))
-
-            if not self.msl:
-                self.log.error(f"MSL Client is not initialized for title_id: {title_id}")
-                return self._get_empty_manifest()
-
-            params = {
-                "reqAttempt": 1,
-                "reqPriority": 10,
-                "reqName": "manifest",
-            }
-            _, payload_chunks = self.msl.send_message(
-                endpoint=self.config["endpoints"]["manifest"],
-                params=params,
-                application_data={
-                    "version": 2,
-                    "url": "manifest",
-                    "id": int(time.time()),
-                    "esn": self.esn.data,
-                    "languages": ["en-US"],
-                    "clientVersion": "6.0026.291.011",
-                    "params": {
-                        "clientVersion": "6.0051.090.911",
-                        "challenge": self.config["payload_challenge_pr"] if self.drm_system == 'playready' else self.config["payload_challenge"],
-                        "challanges": {
-                            "default": self.config["payload_challenge_pr"] if self.drm_system == 'playready' else self.config["payload_challenge"]
-                        },
-                        "contentPlaygraph": ["v2"],
-                        "deviceSecurityLevel": "3000",
-                        "drmVersion": 25,
-                        "desiredVmaf": "plus_lts",
-                        "desiredSegmentVmaf": "plus_lts",
-                        "flavor": "STANDARD",  # ? PRE_FETCH, SUPPLEMENTAL
-                        "drmType": self.drm_system,
-                        "imageSubtitleHeight": 1080,
-                        "isBranching": False,
-                        "isNonMember": False,
-                        "isUIAutoPlay": False,
-                        "licenseType": "standard",
-                        "liveAdsCapability": "replace",
-                        "liveMetadataFormat": "INDEXED_SEGMENT_TEMPLATE",
-                        "manifestVersion": "v2",
-                        "osName": "windows",
-                        "osVersion": "10.0",
-                        "platform": "138.0.0.0",
-                        "profilesGroups": [{
-                            "name": "default",
-                            "profiles": video_profiles
-                        }],
-                        "profiles": video_profiles,
-                        "preferAssistiveAudio": False,
-                        "requestSegmentVmaf": False,
-                        "requiredAudioTrackId": required_audio_track_id, # This is for getting missing audio tracks (value get from `new_track_id``)
-                        "requiredTextTrackId": required_text_track_id, # This is for getting missing subtitle. (value get from `new_track_id``)
-                        "supportsAdBreakHydration": False,
-                        "supportsNetflixMediaEvents": True,
-                        "supportsPartialHydration": True, # This is important if you want get available all tracks. but you must fetch each missing url tracks with "requiredAudioTracksId" or "requiredTextTrackId"
-                        "supportsPreReleasePin": True,
-                        "supportsUnequalizedDownloadables": True,
-                        "supportsWatermark": True,
-                        "titleSpecificData": {
-                            (title.data.get("episodeId") if title.data else None) or (title.data.get("id") if title.data else "unknown"): {"unletterboxed": False}
-                        },
-                        "type": "standard",  # ? PREPARE
-                        "uiPlatform": "SHAKTI",
-                        "uiVersion": "shakti-v49577320",
-                        "useBetterTextUrls": True,
-                        "useHttpsStreams": True,
-                        "usePsshBox": True,
-                        "videoOutputInfo": [{
-                            # todo ; make this return valid, but "secure" values, maybe it helps
-                            "type": "DigitalVideoOutputDescriptor",
-                            "outputType": "unknown",
-                            "supportedHdcpVersions": self.config["configuration"]["supported_hdcp_versions"],
-                            "isHdcpEngaged": self.config["configuration"]["is_hdcp_engaged"]
-                        }],
-                        "viewableId": (title.data.get("episodeId") if title.data else None) or (title.data.get("id") if title.data else "unknown"),
-                        "xid": str(int((int(time.time()) + 0.1612) * 1000)),
-                        "showAllSubDubTracks": True,
-                    }
-                },
-                userauthdata=self.userauthdata
-            )
-            if "errorDetails" in payload_chunks:
-                self.log.error(f"Manifest call failed for title_id: {title_id}, required_audio_track_id: {required_audio_track_id}, required_text_track_id: {required_text_track_id}, error: {payload_chunks['errorDetails']}")
-                return self._get_empty_manifest()
-            # with open(f"./manifest_{"+".join(video_profiles)}.json", mode='w') as r:
-            #     r.write(jsonpickle.encode(payload_chunks, indent=4))
-            return payload_chunks
-        except Exception as e:
-            title_id = title.data.get('episodeId', title.data.get('id', 'unknown')) if title.data else 'unknown'
-            profile_count = len(video_profiles) if 'video_profiles' in locals() else 0
-            self.log.error(f"Exception in get_manifest: {e}")
-            self.log.error(f"Context - title_id: {title_id}, video_profiles_count: {profile_count}, required_audio_track_id: {required_audio_track_id or 'None'}, required_text_track_id: {required_text_track_id or 'None'}")
-            if 'video_profiles' in locals() and video_profiles:
-                self.log.error(f"Video profiles being processed: {', '.join(video_profiles[:5])}{'...' if len(video_profiles) > 5 else ''}")
-            return self._get_empty_manifest()
-        
-    @staticmethod
-    def get_original_language(manifest) -> Language:
-        try:
-            # First, try to find the original language from audio tracks
-            if "audio_tracks" in manifest and manifest["audio_tracks"]:
-                for language in manifest["audio_tracks"]:
-                    if "languageDescription" in language and language["languageDescription"].endswith(" [Original]"):
-                        return Language.get(language["language"])
-            
-            # Fallback 1: Try to parse from defaultTrackOrderList
-            if "defaultTrackOrderList" in manifest and manifest["defaultTrackOrderList"]:
-                try:
-                    media_id = manifest["defaultTrackOrderList"][0]["mediaId"]
-                    lang_code = media_id.split(";")[2]
-                    if lang_code:
-                        return Language.get(lang_code)
-                except (IndexError, KeyError, AttributeError):
-                    pass
-            
-            # Fallback 2: Try to get the first available audio track language
-            if "audio_tracks" in manifest and manifest["audio_tracks"]:
-                for audio_track in manifest["audio_tracks"]:
-                    if "language" in audio_track and audio_track["language"]:
-                        return Language.get(audio_track["language"])
-            
-            # Fallback 3: Default to English if all else fails
-            return Language.get("en")
-            
-        except Exception as e:
-            # If anything goes wrong, default to English
-            return Language.get("en")
-
-    def get_widevine_service_certificate(self, *, challenge: bytes, title: Movie | Episode | Song, track: AnyTrack) -> bytes | str:
-        return self.config["certificate"]
-
-    def manifest_as_tracks(self, manifest, title: Title_T, hydrate_tracks = False) -> Tracks:
-        
-        tracks = Tracks()
-        
-        try:
-            # Handle empty or invalid manifest
-            if not manifest or not isinstance(manifest, dict):
-                self.log.warning("Empty or invalid manifest received, returning empty tracks")
-                return tracks
-            
-            # Check if manifest has required structure
-            if "video_tracks" not in manifest or not manifest["video_tracks"]:
-                self.log.warning("No video tracks in manifest, returning empty tracks")
-                return tracks
-                
-            if "links" not in manifest or "license" not in manifest["links"]:
-                self.log.warning("No license URL in manifest, cannot process tracks")
-                return tracks
-            
-            original_language = self.get_original_language(manifest)
-            self.log.debug(f"Original language: {original_language}")
-            license_url = manifest["links"]["license"]["href"]
-            
-            # Process video tracks
-            if "streams" in manifest["video_tracks"][0] and manifest["video_tracks"][0]["streams"]:
-                # self.log.info(f"Video: {jsonpickle.encode(manifest["video_tracks"], indent=2)}")
-                # self.log.info()
-                for video_index, video in enumerate(reversed(manifest["video_tracks"][0]["streams"])):
-                    try:
-                        # self.log.info(video)
-                        id = video["downloadable_id"]
-                        # self.log.info(f"Adding video {video["res_w"]}x{video["res_h"]}, bitrate: {(float(video["framerate_value"]) / video["framerate_scale"]) if "framerate_value" in video else None} with profile {video["content_profile"]}. kid: {video["drmHeaderId"]}")
-                        tracks.add(
-                            Video(
-                                id_=video["downloadable_id"],
-                                url=video["urls"][0]["url"],
-                                codec=Video.Codec.from_netflix_profile(video["content_profile"]),
-                                bitrate=video["bitrate"] * 1000,
-                                width=video["res_w"],
-                                height=video["res_h"],
-                                fps=(float(video["framerate_value"]) / video["framerate_scale"]) if "framerate_value" in video else None,
-                                language=Language.get(original_language),
-                                edition=video["content_profile"],
-                                range_=self.parse_video_range_from_profile(video["content_profile"]),
-                                is_original_lang=True,
-                                drm=[Widevine(
-                                    pssh=PSSH(
-                                        manifest["video_tracks"][0]["drmHeader"]["bytes"]
-                                    ),
-                                    kid=video["drmHeaderId"]
-                                )] if manifest["video_tracks"][0].get("drmHeader", {}).get("bytes") else [],
-                                data={
-                                    'license_url': license_url
-                                }
-                            )
-                        )
-                    except Exception as e:
-                        video_id = video.get("downloadable_id", "unknown") if isinstance(video, dict) else "unknown"
-                        self.log.warning(f"Failed to process video track at index {video_index}, video_id: {video_id}, error: {e}")
-                        continue
-            
-            # Process audio tracks
-            unavailable_audio_tracks: List[Tuple[str, str]] = []
-            if "audio_tracks" in manifest:
-                for audio_index, audio in enumerate(manifest["audio_tracks"]):
-                    try:
-                        audio_id = audio.get("id", "unknown")
-                        audio_lang = audio.get("language", "unknown")
-                        if len(audio.get("streams", [])) < 1:
-                            # This 
-                            # self.log.debug(f"Audio lang {audio["languageDescription"]} is available but no stream available.")
-                            if "new_track_id" in audio and "id" in audio:
-                                unavailable_audio_tracks.append((audio["new_track_id"], audio["id"])) # Assign to `unavailable_subtitle` for request missing audio tracks later
-                            self.log.debug(f"Audio track at index {audio_index}, audio_id: {audio_id}, language: {audio_lang} has no streams available")
-                            continue
-                        # self.log.debug(f"Adding audio lang: {audio["language"]} with profile: {audio["content_profile"]}")
-                        is_original_lang = audio.get("language") == original_language.language
-                        # self.log.info(f"is audio {audio["languageDescription"]} original language: {is_original_lang}")
-                        for stream_index, stream in enumerate(audio["streams"]):
-                            try:
-                                stream_id = stream.get("downloadable_id", "unknown")
-                                tracks.add(
-                                    Audio(
-                                        id_=stream["downloadable_id"],
-                                        url=stream["urls"][0]["url"],
-                                        codec=Audio.Codec.from_netflix_profile(stream["content_profile"]),
-                                        language=Language.get(self.NF_LANG_MAP.get(audio["language"]) or audio["language"]),
-                                        is_original_lang=is_original_lang,
-                                        bitrate=stream["bitrate"] * 1000,
-                                        channels=stream["channels"],
-                                        descriptive=audio.get("rawTrackType", "").lower() == "assistive",
-                                        name="[Original]" if Language.get(audio["language"]).language == original_language.language else None,
-                                        joc=6 if "atmos" in stream["content_profile"] else None
-                                    )
-                                )
-                            except Exception as e:
-                                stream_id = stream.get("downloadable_id", "unknown") if isinstance(stream, dict) else "unknown"
-                                self.log.warning(f"Failed to process audio stream at audio_index {audio_index}, stream_index {stream_index}, audio_id: {audio_id}, stream_id: {stream_id}, language: {audio_lang}, error: {e}")
-                                continue
-                    except Exception as e:
-                        audio_id = audio.get("id", "unknown") if isinstance(audio, dict) else "unknown"
-                        audio_lang = audio.get("language", "unknown") if isinstance(audio, dict) else "unknown"
-                        self.log.warning(f"Failed to process audio track at index {audio_index}, audio_id: {audio_id}, language: {audio_lang}, error: {e}")
-                        continue
-
-        
-
-
-            # Process subtitle tracks
-            unavailable_subtitle: List[Tuple[str, str]] = []
-            if "timedtexttracks" in manifest:
-                for subtitle_index, subtitle in enumerate(manifest["timedtexttracks"]):
-                    try:
-                        subtitle_id = subtitle.get("id", "unknown")
-                        subtitle_lang = subtitle.get("language", "unknown")
-                        if "isNoneTrack" in subtitle and subtitle["isNoneTrack"] == True:
-                            continue
-                        if subtitle.get("hydrated") == False:
-                            # This subtitles is there but has to request stream first
-                            if "new_track_id" in subtitle and "id" in subtitle:
-                                unavailable_subtitle.append((subtitle["new_track_id"], subtitle["id"])) # Assign to `unavailable_subtitle` for request missing subtitles later
-                            # self.log.debug(f"Audio language: {subtitle["languageDescription"]} id: {subtitle["new_track_id"]} is not hydrated.")
-                            self.log.debug(f"Subtitle track at index {subtitle_index}, subtitle_id: {subtitle_id}, language: {subtitle_lang} is not hydrated")
-                            continue
-                        
-                        if subtitle.get("languageDescription") == 'Off':
-                            # I don't why this subtitles is requested, i consider for skip these subtitles for now
-                            continue
-                            # pass
-
-                        if "downloadableIds" not in subtitle or not subtitle["downloadableIds"]:
-                            self.log.debug(f"Subtitle track at index {subtitle_index}, subtitle_id: {subtitle_id}, language: {subtitle_lang} has no downloadableIds")
-                            continue
-                            
-                        id = list(subtitle["downloadableIds"].values())
-                        if not id:
-                            self.log.debug(f"Subtitle track at index {subtitle_index}, subtitle_id: {subtitle_id}, language: {subtitle_lang} has empty downloadableIds")
-                            continue
-                            
-                        language = Language.get(subtitle["language"])
-                        
-                        if "ttDownloadables" not in subtitle or not subtitle["ttDownloadables"]:
-                            self.log.debug(f"Subtitle track at index {subtitle_index}, subtitle_id: {subtitle_id}, language: {subtitle_lang} has no ttDownloadables")
-                            continue
-                            
-                        profile = next(iter(subtitle["ttDownloadables"].keys()))
-                        tt_downloadables = next(iter(subtitle["ttDownloadables"].values()))
-                        is_original_lang = subtitle.get("language") == original_language.language
-                        # self.log.info(f"is subtitle {subtitle["languageDescription"]} original language {is_original_lang}")   
-                        # self.log.info(f"ddd")
-                        tracks.add(
-                            Subtitle(
-                                id_=id[0],
-                                url=tt_downloadables["urls"][0]["url"],
-                                codec=Subtitle.Codec.from_netflix_profile(profile),
-                                language=language,
-                                forced=subtitle.get("isForcedNarrative", False),
-                                cc=subtitle.get("rawTrackType") == "closedcaptions",
-                                sdh=subtitle.get("trackVariant") == 'STRIPPED_SDH' if "trackVariant" in subtitle else False,
-                                is_original_lang=is_original_lang,
-                                name=("[Original]" if language.language == original_language.language else None or "[Dubbing]" if "trackVariant" in subtitle and subtitle["trackVariant"] == "DUBTITLE" else None),
-                            )
-                        )
-                    except Exception as e:
-                        subtitle_id = subtitle.get("id", "unknown") if isinstance(subtitle, dict) else "unknown"
-                        subtitle_lang = subtitle.get("language", "unknown") if isinstance(subtitle, dict) else "unknown"
-                        self.log.warning(f"Failed to process subtitle track at index {subtitle_index}, subtitle_id: {subtitle_id}, language: {subtitle_lang}, error: {e}")
-                        continue
-                        
-            if hydrate_tracks == False:
-                return tracks
-                
-            # Hydrate missing tracks
-            self.log.info(f"Getting all missing audio and subtitle tracks")
-            
-            # Handle mismatched lengths - use last successful subtitle track when needed
-            last_successful_subtitle = ("N/A", "N/A") if not unavailable_subtitle else unavailable_subtitle[-1]
-            
-            # Process audio tracks first, then handle subtitles separately if needed
-            max_length = max(len(unavailable_audio_tracks), len(unavailable_subtitle))
-            
-            for hydration_index in range(max_length):
-                # Get audio track info for this index
-                audio_hydration = unavailable_audio_tracks[hydration_index] if hydration_index < len(unavailable_audio_tracks) else ("N/A", "N/A")
-                
-                # Get subtitle track info for this index, or use last successful one if available
-                if hydration_index < len(unavailable_subtitle):
-                    subtitle_hydration = unavailable_subtitle[hydration_index]
-                    is_real_subtitle_request = True  # This is a real subtitle to be added to tracks
-                elif unavailable_subtitle:  # Use last successful subtitle track for context only
-                    subtitle_hydration = last_successful_subtitle
-                    is_real_subtitle_request = False  # This is just for context, don't add to tracks
-                else:
-                    subtitle_hydration = ("N/A", "N/A")
-                    is_real_subtitle_request = False
-                
-                try:
-                    # Log what we're trying to hydrate
-                    self.log.debug(f"Hydrating tracks at index {hydration_index}, audio_track_id: {audio_hydration[1] if audio_hydration[1] != 'N/A' else 'N/A'}, subtitle_track_id: {subtitle_hydration[1] if subtitle_hydration[1] != 'N/A' else 'N/A'}, is_real_subtitle: {is_real_subtitle_request}")
-                    
-                    # Only call get_manifest if we have audio to hydrate
-                    should_hydrate_audio = audio_hydration[0] != 'N/A' and audio_hydration[1] != 'N/A'
-                    
-                    if not should_hydrate_audio:
-                        self.log.debug(f"Skipping hydration at index {hydration_index} - no audio tracks to hydrate")
-                        continue
-                        
-                    # Always use a valid subtitle track ID for the manifest request to avoid API errors
-                    # Use the subtitle track (real or reused) if available, otherwise use N/A
-                    subtitle_track_for_request = subtitle_hydration[0] if subtitle_hydration[0] != 'N/A' else None
-                    
-                    # If we still don't have a subtitle track ID, skip this hydration to avoid API error
-                    if subtitle_track_for_request is None:
-                        self.log.warning(f"Skipping hydration at index {hydration_index} - no subtitle track available for API request context")
-                        continue
-                        
-                    hydrated_manifest = self.get_manifest(title, self.profiles, subtitle_track_for_request, audio_hydration[0])
-                    
-                    # Handle hydrated audio tracks
-                    if should_hydrate_audio and "audio_tracks" in hydrated_manifest:
-                        try:
-                            audios = next((item for item in hydrated_manifest["audio_tracks"] if 'id' in item and item["id"] == audio_hydration[1]), None)
-                            if audios and "streams" in audios:
-                                audio_lang = audios.get("language", "unknown")
-                                self.log.debug(f"Processing hydrated audio track_id: {audio_hydration[1]}, language: {audio_lang}, streams_count: {len(audios['streams'])}")
-                                for stream_index, stream in enumerate(audios["streams"]):
-                                    try:
-                                        stream_id = stream.get("downloadable_id", "unknown")
-                                        tracks.add(
-                                            Audio(
-                                                id_=stream["downloadable_id"],
-                                                url=stream["urls"][0]["url"],
-                                                codec=Audio.Codec.from_netflix_profile(stream["content_profile"]),
-                                                language=Language.get(self.NF_LANG_MAP.get(audios["language"]) or audios["language"]),
-                                                is_original_lang=audios["language"] == original_language.language,
-                                                bitrate=stream["bitrate"] * 1000,
-                                                channels=stream["channels"],
-                                                descriptive=audios.get("rawTrackType", "").lower() == "assistive",
-                                                name="[Original]" if Language.get(audios["language"]).language == original_language.language else None,
-                                                joc=16 if "atmos" in stream["content_profile"] else None
-                                            )
-                                        )
-                                    except Exception as e:
-                                        stream_id = stream.get("downloadable_id", "unknown") if isinstance(stream, dict) else "unknown"
-                                        self.log.warning(f"Failed to process hydrated audio stream at hydration_index {hydration_index}, stream_index {stream_index}, audio_track_id: {audio_hydration[1]}, stream_id: {stream_id}, error: {e}")
-                                        continue
-                            else:
-                                self.log.warning(f"No audio streams found for hydrated audio_track_id: {audio_hydration[1]} at hydration_index {hydration_index}")
-                        except Exception as e:
-                            self.log.warning(f"Failed to find hydrated audio track at hydration_index {hydration_index}, audio_track_id: {audio_hydration[1]}, error: {e}")
-                    
-                    # Handle hydrated subtitle tracks (only if it's a real subtitle request, not reused)
-                    if is_real_subtitle_request and subtitle_hydration[0] != 'N/A' and subtitle_hydration[1] != 'N/A' and "timedtexttracks" in hydrated_manifest:
-                        try:
-                            subtitles = next((item for item in hydrated_manifest["timedtexttracks"] if 'id' in item and item["id"] == subtitle_hydration[1]), None)
-                            if subtitles and "downloadableIds" in subtitles and "ttDownloadables" in subtitles:
-                                subtitle_lang = subtitles.get("language", "unknown")
-                                self.log.debug(f"Processing hydrated subtitle track_id: {subtitle_hydration[1]}, language: {subtitle_lang}")
-                                # self.log.info(jsonpickle.encode(subtitles, indent=2))
-                                # sel
-                                
-                                id = list(subtitles["downloadableIds"].values())
-                                if id:
-                                    language = Language.get(subtitles["language"])
-                                    profile = next(iter(subtitles["ttDownloadables"].keys()))
-                                    tt_downloadables = next(iter(subtitles["ttDownloadables"].values()))
-                                    tracks.add(
-                                        Subtitle(
-                                            id_=id[0],
-                                            url=tt_downloadables["urls"][0]["url"],
-                                            codec=Subtitle.Codec.from_netflix_profile(profile),
-                                            language=language,
-                                            forced=subtitles.get("isForcedNarrative", False),
-                                            cc=subtitles.get("rawTrackType") == "closedcaptions",
-                                            sdh=subtitles.get("trackVariant") == 'STRIPPED_SDH' if "trackVariant" in subtitles else False,
-                                            is_original_lang=subtitles.get("language") == original_language.language,
-                                            name=("[Original]" if language.language == original_language.language else None or "[Dubbing]" if "trackVariant" in subtitles and subtitles["trackVariant"] == "DUBTITLE" else None),
-                                        )
-                                    )
-                                else:
-                                    self.log.warning(f"No downloadable IDs found for hydrated subtitle_track_id: {subtitle_hydration[1]} at hydration_index {hydration_index}")
-                            else:
-                                self.log.warning(f"No subtitle data found for hydrated subtitle_track_id: {subtitle_hydration[1]} at hydration_index {hydration_index}")
-                        except Exception as e:
-                            self.log.warning(f"Failed to process hydrated subtitle track at hydration_index {hydration_index}, subtitle_track_id: {subtitle_hydration[1]}, error: {e}")
-                    elif not is_real_subtitle_request and subtitle_hydration[1] != 'N/A':
-                        self.log.debug(f"Used subtitle track context for API request at hydration_index {hydration_index}, subtitle_track_id: {subtitle_hydration[1]} (not adding to tracks)")
-                        
-                except Exception as e:
-                    self.log.warning(f"Failed to hydrate tracks at hydration_index {hydration_index}, audio_track_id: {audio_hydration[1] if audio_hydration[1] != 'N/A' else 'N/A'}, subtitle_track_id: {subtitle_hydration[1] if subtitle_hydration[1] != 'N/A' else 'N/A'}, error: {e}")
-                    continue
-                    
-        except Exception as e:
-            self.log.error(f"Exception in manifest_as_tracks: {e}")
-            self.log.debug(f"Failed to process manifest for title: {title.data.get('episodeId', title.data.get('id', 'unknown')) if title.data else 'unknown'}")
-            # Return empty tracks on any critical error
-                
-        return tracks
-
-    
-    def parse_video_range_from_profile(self, profile: str) -> Video.Range:
-        """
-        Parse the video range from a Netflix profile string.
-        
-        Args:
-            profile (str): The Netflix profile string (e.g., "hevc-main10-L30-dash-cenc")
-            
-        Returns:
-            Video.Range: The corresponding Video.Range enum value
-            
-        Examples:
-            >>> parse_video_range_from_profile("hevc-main10-L30-dash-cenc")
-            <Video.Range.SDR: 'SDR'>
-            >>> parse_video_range_from_profile("hevc-dv5-main10-L30-dash-cenc")
-            <Video.Range.DV: 'DV'>
-        """
-        
-        # Get video profiles from config
-        video_profiles = self.config.get("profiles", {}).get("video", {})
-        
-        # Search through all codecs and ranges to find the profile
-        for codec, ranges in video_profiles.items():
-            # if codec == 'H264':
-            #     return Video.Range.SDR # for H264 video always return SDR
-            for range_name, profiles in ranges.items():
-                # self.log.info(f"Checking range {range_name}")
-                if profile in profiles:
-                    # Return the corresponding Video.Range enum value
-                    try:
-                        # self.log.info(f"Found {range_name}")
-                        return Video.Range(range_name)
-                    except ValueError:
-                        # If range_name is not a valid Video.Range, return SDR as default
-                        self.log.debug(f"Video range is not valid {range_name}")
-                        return Video.Range.SDR
-        
-        # If profile not found, return SDR as default
-        return Video.Range.SDR

unshackle/unshackle-example.yaml

@@ -88,6 +88,26 @@ cdm:
     jane_uhd: nexus_5_l1 # Profile 'jane_uhd' uses Nexus 5 L1
     default: generic_android_l3 # Default CDM for this service
 
+  # NEW: Quality-based CDM selection
+  # Use different CDMs based on video resolution
+  # Supports operators: >=, >, <=, <, or exact match
+  EXAMPLE_QUALITY:
+    "<=1080": generic_android_l3 # Use L3 for 1080p and below
+    ">1080": nexus_5_l1 # Use L1 for above 1080p (1440p, 2160p)
+    default: generic_android_l3 # Optional: fallback if no quality match
+
+  # You can mix profiles and quality thresholds in the same service
+  NETFLIX:
+    # Profile-based selection (existing functionality)
+    john: netflix_l3_profile
+    jane: netflix_l1_profile
+    # Quality-based selection (new functionality)
+    "<=720": netflix_mobile_l3
+    "1080": netflix_standard_l3
+    ">=1440": netflix_premium_l1
+    # Fallback
+    default: netflix_standard_l3
+
 # Use pywidevine Serve-compliant Remote CDMs
 remote_cdm:
   - name: "chrome"
@@ -105,6 +125,50 @@ remote_cdm:
     host: https://domain-2.com/api
     secret: secret_key
 
+  - name: "decrypt_labs_chrome"
+    type: "decrypt_labs" # Required to identify as DecryptLabs CDM
+    device_name: "ChromeCDM" # Scheme identifier - must match exactly
+    device_type: CHROME
+    system_id: 4464 # Doesn't matter
+    security_level: 3
+    host: "https://keyxtractor.decryptlabs.com"
+    secret: "your_decrypt_labs_api_key_here" # Replace with your API key
+  - name: "decrypt_labs_l1"
+    type: "decrypt_labs"
+    device_name: "L1" # Scheme identifier - must match exactly
+    device_type: ANDROID
+    system_id: 4464
+    security_level: 1
+    host: "https://keyxtractor.decryptlabs.com"
+    secret: "your_decrypt_labs_api_key_here"
+
+  - name: "decrypt_labs_l2"
+    type: "decrypt_labs"
+    device_name: "L2" # Scheme identifier - must match exactly
+    device_type: ANDROID
+    system_id: 4464
+    security_level: 2
+    host: "https://keyxtractor.decryptlabs.com"
+    secret: "your_decrypt_labs_api_key_here"
+
+  - name: "decrypt_labs_playready_sl2"
+    type: "decrypt_labs"
+    device_name: "SL2" # Scheme identifier - must match exactly
+    device_type: PLAYREADY
+    system_id: 0
+    security_level: 2000
+    host: "https://keyxtractor.decryptlabs.com"
+    secret: "your_decrypt_labs_api_key_here"
+
+  - name: "decrypt_labs_playready_sl3"
+    type: "decrypt_labs"
+    device_name: "SL3" # Scheme identifier - must match exactly
+    device_type: PLAYREADY
+    system_id: 0
+    security_level: 3000
+    host: "https://keyxtractor.decryptlabs.com"
+    secret: "your_decrypt_labs_api_key_here"
+
 # Key Vaults store your obtained Content Encryption Keys (CEKs)
 # Use 'no_push: true' to prevent a vault from receiving pushed keys
 # while still allowing it to provide keys when requested
@@ -171,7 +235,7 @@ chapter_fallback_name: "Chapter {j:02}"
 # Case-Insensitive dictionary of headers for all Services
 headers:
   Accept-Language: "en-US,en;q=0.8"
-  User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.75 Safari/537.36"
+  User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"
 
 # Override default filenames used across unshackle
 filenames:
@@ -213,6 +277,13 @@ services:
     # Global service config
     api_key: "service_api_key"
 
+    # Service certificate for Widevine L1/L2 (base64 encoded)
+    # This certificate is automatically used when L1/L2 schemes are selected
+    # Services obtain this from their DRM provider or license server
+    certificate: |
+      CAUSwwUKvQIIAxIQ5US6QAvBDzfTtjb4tU/7QxiH8c+TBSKOAjCCAQoCggEBAObzvlu2hZRsapAPx4Aa4GUZj4/GjxgXUtBH4THSkM40x63wQeyVxlEEo
+      # ... (full base64 certificate here)
+
     # Profile-specific device configurations
     profiles:
       john_sd:

unshackle/unshackle.yaml

@@ -1,250 +0,0 @@
-# Group or Username to postfix to the end of all download filenames following a dash
-tag: Kenzuya
-
-# Enable/disable tagging with group name (default: true)
-tag_group_name: true
-
-# Enable/disable tagging with IMDB/TMDB/TVDB details (default: true)
-tag_imdb_tmdb: true
-
-# Set terminal background color (custom option not in CONFIG.md)
-set_terminal_bg: false
-
-# Set file naming convention
-#  true for style - Prime.Suspect.S07E01.The.Final.Act.Part.One.1080p.ITV.WEB-DL.AAC2.0.H.264
-#  false for style - Prime Suspect S07E01 The Final Act - Part One
-scene_naming: true
-
-# Whether to include the year in series names for episodes and folders (default: true)
-#  true for style - Show Name (2023) S01E01 Episode Name
-#  false for style - Show Name S01E01 Episode Name
-series_year: false
-
-# Check for updates from GitHub repository on startup (default: true)
-update_checks: true
-
-# How often to check for updates, in hours (default: 24)
-update_check_interval: 24
-
-# Title caching configuration
-# Cache title metadata to reduce redundant API calls
-title_cache_enabled: true # Enable/disable title caching globally (default: true)
-title_cache_time: 1800 # Cache duration in seconds (default: 1800 = 30 minutes)
-title_cache_max_retention: 86400 # Maximum cache retention for fallback when API fails (default: 86400 = 24 hours)
-
-# Muxing configuration
-muxing:
-  set_title: true
-
-# Login credentials for each Service
-credentials:
-  # Direct credentials (no profile support)
-  EXAMPLE: email@example.com:password
-
-  # Per-profile credentials with default fallback
-  SERVICE_NAME:
-    default: default@email.com:password # Used when no -p/--profile is specified
-    profile1: user1@email.com:password1
-    profile2: user2@email.com:password2
-
-  # Per-profile credentials without default (requires -p/--profile)
-  SERVICE_NAME2:
-    john: john@example.com:johnspassword
-    jane: jane@example.com:janespassword
-
-  # You can also use list format for passwords with special characters
-  SERVICE_NAME3:
-    default: ["user@email.com", ":PasswordWith:Colons"]
-
-# Override default directories used across unshackle
-directories:
-  cache: Cache
-  # cookies: Cookies
-  dcsl: DCSL # Device Certificate Status List
-  downloads: Downloads
-  logs: Logs
-  temp: Temp
-  wvds: WVDs
-  prds: PRDs
-  # Additional directories that can be configured:
-  # commands: Commands
-  # services:
-  #   - /path/to/services
-  #   - /other/path/to/services
-  # vaults: Vaults
-  # fonts: Fonts
-
-# Pre-define which Widevine or PlayReady device to use for each Service
-cdm:
-  # Global default CDM device (fallback for all services/profiles)
-  default: chromecdm
-
-  # Direct service-specific CDM
-  DIFFERENT_EXAMPLE: PRD_1
-
-  # Per-profile CDM configuration
-  EXAMPLE:
-    john_sd: chromecdm_903_l3 # Profile 'john_sd' uses Chrome CDM L3
-    jane_uhd: nexus_5_l1 # Profile 'jane_uhd' uses Nexus 5 L1
-    default: generic_android_l3 # Default CDM for this service
-
-# Use pywidevine Serve-compliant Remote CDMs
-remote_cdm:
-  - name: "chromecdm"
-    device_name: widevine
-    device_type: CHROME
-    system_id: 36586
-    security_level: 3
-    type: "decrypt_labs"
-    host: https://keyxtractor.decryptlabs.com
-    secret: 7547150416_41da0a32d6237d83_KeyXtractor_api_ext
-  - name: "android"
-    device_name: andorid
-    device_type: ANDROID
-    system_id: 8131
-    security_level: 1
-    type: "decrypt_labs"
-    host: https://keyxtractor.decryptlabs.com
-    secret: decrypt_labs_special_ultimate
-
-# Key Vaults store your obtained Content Encryption Keys (CEKs)
-# Use 'no_push: true' to prevent a vault from receiving pushed keys
-# while still allowing it to provide keys when requested
-key_vaults:
-  - type: SQLite
-    name: Local
-    path: key_store.db
-  - type: HTTP
-    name: "DRMLab Vault"
-    host: "https://api.drmlab.io/vault/"
-    username: "unshackle"
-    password: "gEX75q7I5YVkvgF5SUkcNd41IbGrDtTT"
-    api_mode: "json"
-  # Additional vault types:
-  # - type: API
-  #   name: "Remote Vault"
-  #   uri: "https://key-vault.example.com"
-  #   token: "secret_token"
-  #   no_push: true  # This vault will only provide keys, not receive them
-  # - type: MySQL
-  #   name: "MySQL Vault"
-  #   host: "127.0.0.1"
-  #   port: 3306
-  #   database: vault
-  #   username: user
-  #   password: pass
-  #   no_push: false  # Default behavior - vault both provides and receives keys
-
-# Choose what software to use to download data
-downloader: aria2c
-# Options: requests | aria2c | curl_impersonate | n_m3u8dl_re
-# Can also be a mapping:
-# downloader:
-#   NF: requests
-#   AMZN: n_m3u8dl_re
-#   DSNP: n_m3u8dl_re
-#   default: requests
-
-# aria2c downloader configuration
-aria2c:
-  max_concurrent_downloads: 4
-  max_connection_per_server: 3
-  split: 5
-  file_allocation: falloc # none | prealloc | falloc | trunc
-
-# N_m3u8DL-RE downloader configuration
-n_m3u8dl_re:
-  thread_count: 16
-  ad_keyword: "advertisement"
-  use_proxy: true
-
-# curl_impersonate downloader configuration
-curl_impersonate:
-  browser: chrome120
-
-# Pre-define default options and switches of the dl command
-dl:
-  sub_format: srt
-  downloads: 4
-  workers: 16
-  lang:
-    - orig
-    - id
-  EXAMPLE:
-    bitrate: CBR
-
-# Chapter Name to use when exporting a Chapter without a Name
-chapter_fallback_name: "Chapter {j:02}"
-
-# Case-Insensitive dictionary of headers for all Services
-headers:
-  Accept-Language: "en-US,en;q=0.8"
-  User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.75 Safari/537.36"
-
-# Override default filenames used across unshackle
-filenames:
-  log: "unshackle_{name}_{time}.log"
-  config: "config.yaml"
-  root_config: "unshackle.yaml"
-  chapters: "Chapters_{title}_{random}.txt"
-  subtitle: "Subtitle_{id}_{language}.srt"
-
-# API key for The Movie Database (TMDB)
-tmdb_api_key: "8f5c14ef648a0abdd262cf809e11fcd4"
-
-# conversion_method:
-# - auto (default): Smart routing - subby for WebVTT/SAMI, standard for others
-# - subby: Always use subby with advanced processing
-# - pycaption: Use only pycaption library (no SubtitleEdit, no subby)
-# - subtitleedit: Prefer SubtitleEdit when available, fall back to pycaption
-subtitle:
-  conversion_method: auto
-  sdh_method: auto
-
-# Configuration for pywidevine's serve functionality
-serve:
-  users:
-    secret_key_for_user:
-      devices:
-        - generic_nexus_4464_l3
-      username: user
-  # devices:
-  #   - '/path/to/device.wvd'
-
-# Configuration data for each Service
-services:
-  # Service-specific configuration goes here
-  # Profile-specific configurations can be nested under service names
-
-  # Example: with profile-specific device configs
-  EXAMPLE:
-    # Global service config
-    api_key: "service_api_key"
-
-    # Profile-specific device configurations
-    profiles:
-      john_sd:
-        device:
-          app_name: "AIV"
-          device_model: "SHIELD Android TV"
-      jane_uhd:
-        device:
-          app_name: "AIV"
-          device_model: "Fire TV Stick 4K"
-
-  # Example: Service with different regions per profile
-  SERVICE_NAME:
-    profiles:
-      us_account:
-        region: "US"
-        api_endpoint: "https://api.us.service.com"
-      uk_account:
-        region: "GB"
-        api_endpoint: "https://api.uk.service.com"
-
-# External proxy provider services
-proxy_providers:
-
-  surfsharkvpn:
-    username: wqKD6vru8vXxUtkXJbvx4HAL  # Service credentials from https://my.surfshark.com/vpn/manual-setup/main/openvpn
-    password: zyFnwsYFMNxqbzpf3asu36m6  # Service credentials (not your login password)

unshackle/vaults/MySQL.py

@@ -28,26 +28,33 @@ class MySQL(Vault):
             raise PermissionError(f"MySQL vault {self.slug} has no SELECT permission.")
 
     def get_key(self, kid: Union[UUID, str], service: str) -> Optional[str]:
-        if not self.has_table(service):
-            # no table, no key, simple
-            return None
-
         if isinstance(kid, UUID):
             kid = kid.hex
 
+        service_variants = [service]
+        if service != service.lower():
+            service_variants.append(service.lower())
+        if service != service.upper():
+            service_variants.append(service.upper())
+
         conn = self.conn_factory.get()
         cursor = conn.cursor()
 
         try:
+            for service_name in service_variants:
+                if not self.has_table(service_name):
+                    continue
+
                 cursor.execute(
                     # TODO: SQL injection risk
-                f"SELECT `id`, `key_` FROM `{service}` WHERE `kid`=%s AND `key_`!=%s",
+                    f"SELECT `id`, `key_` FROM `{service_name}` WHERE `kid`=%s AND `key_`!=%s",
                     (kid, "0" * 32),
                 )
                 cek = cursor.fetchone()
-            if not cek:
-                return None
+                if cek:
                     return cek["key_"]
+
+            return None
         finally:
             cursor.close()
 
@@ -131,16 +138,27 @@ class MySQL(Vault):
         if any(isinstance(kid, UUID) for kid, key_ in kid_keys.items()):
             kid_keys = {kid.hex if isinstance(kid, UUID) else kid: key_ for kid, key_ in kid_keys.items()}
 
+        if not kid_keys:
+            return 0
+
         conn = self.conn_factory.get()
         cursor = conn.cursor()
 
         try:
+            placeholders = ",".join(["%s"] * len(kid_keys))
+            cursor.execute(f"SELECT kid FROM `{service}` WHERE kid IN ({placeholders})", list(kid_keys.keys()))
+            existing_kids = {row["kid"] for row in cursor.fetchall()}
+
+            new_keys = {kid: key for kid, key in kid_keys.items() if kid not in existing_kids}
+
+            if not new_keys:
+                return 0
+
             cursor.executemany(
-                # TODO: SQL injection risk
-                f"INSERT IGNORE INTO `{service}` (kid, key_) VALUES (%s, %s)",
-                kid_keys.items(),
+                f"INSERT INTO `{service}` (kid, key_) VALUES (%s, %s)",
+                new_keys.items(),
             )
-            return cursor.rowcount
+            return len(new_keys)
         finally:
             conn.commit()
             cursor.close()

unshackle/vaults/SQLite.py

@@ -19,22 +19,30 @@ class SQLite(Vault):
         self.conn_factory = ConnectionFactory(self.path)
 
     def get_key(self, kid: Union[UUID, str], service: str) -> Optional[str]:
-        if not self.has_table(service):
-            # no table, no key, simple
-            return None
-
         if isinstance(kid, UUID):
             kid = kid.hex
 
         conn = self.conn_factory.get()
         cursor = conn.cursor()
 
+        # Try both the original service name and lowercase version to handle case sensitivity issues
+        service_variants = [service]
+        if service != service.lower():
+            service_variants.append(service.lower())
+        if service != service.upper():
+            service_variants.append(service.upper())
+
         try:
-            cursor.execute(f"SELECT `id`, `key_` FROM `{service}` WHERE `kid`=? AND `key_`!=?", (kid, "0" * 32))
+            for service_name in service_variants:
+                if not self.has_table(service_name):
+                    continue
+
+                cursor.execute(f"SELECT `id`, `key_` FROM `{service_name}` WHERE `kid`=? AND `key_`!=?", (kid, "0" * 32))
                 cek = cursor.fetchone()
-            if not cek:
-                return None
+                if cek:
                     return cek[1]
+
+            return None
         finally:
             cursor.close()
 
@@ -102,16 +110,27 @@ class SQLite(Vault):
         if any(isinstance(kid, UUID) for kid, key_ in kid_keys.items()):
             kid_keys = {kid.hex if isinstance(kid, UUID) else kid: key_ for kid, key_ in kid_keys.items()}
 
+        if not kid_keys:
+            return 0
+
         conn = self.conn_factory.get()
         cursor = conn.cursor()
 
         try:
+            placeholders = ",".join(["?"] * len(kid_keys))
+            cursor.execute(f"SELECT kid FROM `{service}` WHERE kid IN ({placeholders})", list(kid_keys.keys()))
+            existing_kids = {row[0] for row in cursor.fetchall()}
+
+            new_keys = {kid: key for kid, key in kid_keys.items() if kid not in existing_kids}
+
+            if not new_keys:
+                return 0
+
             cursor.executemany(
-                # TODO: SQL injection risk
-                f"INSERT OR IGNORE INTO `{service}` (kid, key_) VALUES (?, ?)",
-                kid_keys.items(),
+                f"INSERT INTO `{service}` (kid, key_) VALUES (?, ?)",
+                new_keys.items(),
             )
-            return cursor.rowcount
+            return len(new_keys)
         finally:
             conn.commit()
             cursor.close()

uv.lock

@@ -1499,7 +1499,7 @@ wheels = [
 
 [[package]]
 name = "unshackle"
-version = "1.4.3"
+version = "1.4.6"
 source = { editable = "." }
 dependencies = [
     { name = "appdirs" },