It even adds VMP data to the Client ID blob directly (instead of storing possibly duplicated). It will warn you if the Client ID already had VMP data there.
The filename is generated from client id information and has a crc32 checksum to help avoid with conflicts.
The output directory is the current working directory. You can set the directory with -o/--output.
Sessions are technically implemented in a non-singleton approach, and the issue that provoked this comment has since been fixed (context data <-> license mismatch).
We are using a trick with the request_id to be able to add an identifier between get_license_challenge() and parse_license() without any middleman data needing to be passed by the user.
Otherwise the user would need to either create the context data themselves after get_license_challenge() and pass it to get_license(), or something that is similar at its core to that.
Please note that this CDM implementation isn't inherently secure. For more information see the README about Key and Output Security.
Also adds a utility to get an absolute path to something in the environment PATH, by multiple names, if found.