- Pass ML-Worker key via env/stdin instead of argv to reduce exposure in process listings/logs.
- Add a hard timeout to the ML-Worker subprocess call and convert timeouts into DecryptionFailed errors.
- Make ticket bytes decoding defensive: try UTF-8, fall back to ASCII (base64), otherwise raise a descriptive ValueError.
- Add MonaLisaCDM class wrapping wasmtime for key extraction
- Add MonaLisa DRM class with decrypt_segment() for per-segment decryption
- Display Content ID and keys in download output (matching Widevine/PlayReady)
- Add wasmtime dependency for WASM module execution