harden manifest detection and downloader failure coverage

cmd/rip/main.go

@@ -13,6 +13,7 @@ import (
 	"net/url"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"regexp"
 	"runtime"
 	"strconv"
@@ -551,6 +552,7 @@ func main() {
 			os.Exit(1)
 		}
 		defer func() { _ = mainApp.Close() }()
+		mainApp.IgnoreDB = gopts.noDB
 
 		title, tracks, err := fetchLastFMPlaylist(ctx, cfg.Session.Downloads.VerifySSL, opts.PlaylistURL)
 		if err != nil {
@@ -1421,9 +1423,10 @@ type resolvedLastFMTrack struct {
 }
 
 var (
-	lastFMTitleTagsRe      = regexp.MustCompile(`<a\s+href="[^"]+"\s+title="([^"]+)"`)
+	lastFMTitleTagsRe       = regexp.MustCompile(`<a\b[^>]*\btitle=(?:"([^"]+)"|'([^']+)')`)
+	lastFMDataTrackArtistRe = regexp.MustCompile(`data-track-name=(?:"([^"]+)"|'([^']+)')[^>]*data-artist-name=(?:"([^"]+)"|'([^']+)')`)
 	lastFMTotalTracksRe     = regexp.MustCompile(`data-playlisting-entry-count="(\d+)"`)
-	lastFMPlaylistTitleRe  = regexp.MustCompile(`<h1 class="playlisting-playlist-header-title">([^<]+)</h1>`)
+	lastFMPlaylistTitleRe   = regexp.MustCompile(`<h1[^>]*class="[^"]*playlisting-playlist-header-title[^"]*"[^>]*>([^<]+)</h1>`)
 	lastFMMirrorTitleRe     = regexp.MustCompile(`^Title:\s*(.+?)\s+\|`)
 	lastFMMirrorLinkTextRe  = regexp.MustCompile(`\[([^\]]+)\]\(`)
 	errLastFMInvalidSource  = "unsupported source"
@@ -1639,6 +1642,9 @@ func parseLastFMArgs(args []string, defaultSource, defaultFallback string) (last
 	if opts.PlaylistURL == "" {
 		return lastFMOptions{}, fmt.Errorf("missing playlist url")
 	}
+	if !isValidLastFMPlaylistURL(opts.PlaylistURL) {
+		return lastFMOptions{}, fmt.Errorf("playlist url must be a last.fm url")
+	}
 	if !isAllowedSearchSource(opts.Source) {
 		return lastFMOptions{}, fmt.Errorf("%s %q", errLastFMInvalidSource, opts.Source)
 	}
@@ -1648,11 +1654,31 @@ func parseLastFMArgs(args []string, defaultSource, defaultFallback string) (last
 	return opts, nil
 }
 
+func isValidLastFMPlaylistURL(raw string) bool {
+	u, err := url.Parse(strings.TrimSpace(raw))
+	if err != nil || u == nil || u.Host == "" {
+		return false
+	}
+	s := strings.ToLower(strings.TrimSpace(u.Scheme))
+	if s != "http" && s != "https" {
+		return false
+	}
+	h := strings.ToLower(strings.TrimPrefix(strings.TrimSpace(u.Host), "www."))
+	if h != "last.fm" && !strings.HasSuffix(h, ".last.fm") {
+		return false
+	}
+	p := strings.ToLower(strings.TrimSpace(u.Path))
+	return strings.Contains(p, "/playlists/")
+}
+
 func fetchLastFMPlaylist(ctx context.Context, verifySSL bool, playlistURL string) (string, []lastFMTrack, error) {
 	parsed, err := url.Parse(playlistURL)
 	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
 		return "", nil, fmt.Errorf("invalid playlist url")
 	}
+	if !isValidLastFMPlaylistURL(playlistURL) {
+		return "", nil, fmt.Errorf("invalid playlist url")
+	}
 	client := netutil.NewHTTPClient(30*time.Second, verifySSL)
 
 	page1, err := fetchLastFMPlaylistPage(ctx, client, parsed, 1)
@@ -1710,7 +1736,7 @@ func fetchLastFMPlaylistViaMirror(ctx context.Context, verifySSL bool, playlistU
 			break
 		}
 		all = append(all, tracks...)
-		if !strings.Contains(body, "Show more") {
+		if !strings.Contains(strings.ToLower(body), "show more") {
 			break
 		}
 	}
@@ -1804,11 +1830,32 @@ func extractLastFMPlaylistInfo(page string) (string, int, error) {
 }
 
 func extractLastFMTitleArtistPairs(page string) []lastFMTrack {
+	dataPairs := lastFMDataTrackArtistRe.FindAllStringSubmatch(page, -1)
+	if len(dataPairs) > 0 {
+		out := make([]lastFMTrack, 0, len(dataPairs))
+		for _, m := range dataPairs {
+			title := html.UnescapeString(strings.TrimSpace(firstNonEmpty(m[1], m[2])))
+			artist := html.UnescapeString(strings.TrimSpace(firstNonEmpty(m[3], m[4])))
+			if title == "" || artist == "" {
+				continue
+			}
+			out = append(out, lastFMTrack{Title: title, Artist: artist})
+		}
+		if len(out) > 0 {
+			return out
+		}
+	}
+
 	titles := lastFMTitleTagsRe.FindAllStringSubmatch(page, -1)
 	out := make([]lastFMTrack, 0, len(titles)/2)
 	for i := 0; i+1 < len(titles); i += 2 {
-		title := html.UnescapeString(strings.TrimSpace(titles[i][1]))
+		titleRaw := strings.TrimSpace(firstNonEmpty(titles[i][1], titles[i][2]))
-		artist := html.UnescapeString(strings.TrimSpace(titles[i+1][1]))
+		artistRaw := strings.TrimSpace(firstNonEmpty(titles[i+1][1], titles[i+1][2]))
+		if strings.EqualFold(titleRaw, "Play on YouTube") || strings.EqualFold(artistRaw, "Play on YouTube") {
+			continue
+		}
+		title := html.UnescapeString(titleRaw)
+		artist := html.UnescapeString(artistRaw)
 		if title == "" || artist == "" {
 			continue
 		}
@@ -1817,6 +1864,15 @@ func extractLastFMTitleArtistPairs(page string) []lastFMTrack {
 	return out
 }
 
+func firstNonEmpty(items ...string) string {
+	for _, item := range items {
+		if strings.TrimSpace(item) != "" {
+			return strings.TrimSpace(item)
+		}
+	}
+	return ""
+}
+
 func extractLastFMTracksFromMirrorMarkdown(md string) (string, []lastFMTrack) {
 	lines := strings.Split(strings.ReplaceAll(md, "\r\n", "\n"), "\n")
 	title := ""
@@ -1828,7 +1884,7 @@ func extractLastFMTracksFromMirrorMarkdown(md string) (string, []lastFMTrack) {
 				title = strings.TrimSpace(html.UnescapeString(m[1]))
 			}
 		}
-		if !strings.HasPrefix(line, "|") || !strings.Contains(line, "Play track") {
+		if !strings.HasPrefix(line, "|") || !strings.Contains(strings.ToLower(line), "play track") {
 			continue
 		}
 		cols := splitMarkdownTableRow(line)
@@ -1995,6 +2051,12 @@ func parseSearchArgs(args []string, defaultLimit int) (searchOptions, error) {
 	first := false
 	outputFile := ""
 	for i := 0; i < len(args); i++ {
+		if args[i] == "--" {
+			if i+1 < len(args) {
+				parts = append(parts, args[i+1:]...)
+			}
+			break
+		}
 		switch args[i] {
 		case "--force", "--ignore-db":
 			ignoreDB = true
@@ -2010,6 +2072,9 @@ func parseSearchArgs(args []string, defaultLimit int) (searchOptions, error) {
 				return searchOptions{}, fmt.Errorf("--output-file requires a path")
 			}
 			outputFile = strings.TrimSpace(args[i+1])
+			if outputFile == "" {
+				return searchOptions{}, fmt.Errorf("--output-file requires a non-empty path")
+			}
 			i++
 			continue
 		case "--num-results":
@@ -2036,6 +2101,9 @@ func parseSearchArgs(args []string, defaultLimit int) (searchOptions, error) {
 			i++
 			continue
 		}
+		if strings.HasPrefix(args[i], "-") {
+			return searchOptions{}, fmt.Errorf("unknown option %q", args[i])
+		}
 		parts = append(parts, args[i])
 	}
 	return searchOptions{
@@ -2196,6 +2264,12 @@ func writeSearchResultsToFile(source, mediaType string, results []searchResult,
 	if err != nil {
 		return err
 	}
+	dir := filepath.Dir(path)
+	if dir != "" && dir != "." {
+		if err = os.MkdirAll(dir, 0o755); err != nil {
+			return err
+		}
+	}
 	return os.WriteFile(path, b, 0o644)
 }
 
@@ -2278,6 +2352,18 @@ func promptSearchInteractive(defaultLimit int) (string, string, searchOptions, e
 
 func normalizeSearchResults(source, mediaType string, pages []map[string]any) []searchResult {
 	results := make([]searchResult, 0)
+	seen := map[string]struct{}{}
+	appendUnique := func(r searchResult) {
+		if strings.TrimSpace(r.ID) == "" || strings.TrimSpace(r.Title) == "" {
+			return
+		}
+		key := r.ID
+		if _, ok := seen[key]; ok {
+			return
+		}
+		seen[key] = struct{}{}
+		results = append(results, r)
+	}
 	for _, page := range pages {
 		switch source {
 		case "qobuz":
@@ -2313,9 +2399,7 @@ func normalizeSearchResults(source, mediaType string, pages []map[string]any) []
 					trackCount = searchInt(itm["track_count"])
 				}
 				explicit := searchBool(itm["parental_warning"])
-				if id != "" && title != "" {
+				appendUnique(searchResult{ID: id, Title: title, Artist: artist, Album: album, TrackCount: trackCount, Explicit: explicit})
-					results = append(results, searchResult{ID: id, Title: title, Artist: artist, Album: album, TrackCount: trackCount, Explicit: explicit})
-				}
 			}
 		case "tidal":
 			items, ok := page["items"].([]any)
@@ -2349,9 +2433,7 @@ func normalizeSearchResults(source, mediaType string, pages []map[string]any) []
 					trackCount = searchInt(itm["tracks_count"])
 				}
 				explicit := searchBool(itm["explicit"])
-				if id != "" && title != "" {
+				appendUnique(searchResult{ID: id, Title: title, Artist: artist, Album: album, TrackCount: trackCount, Explicit: explicit})
-					results = append(results, searchResult{ID: id, Title: title, Artist: artist, Album: album, TrackCount: trackCount, Explicit: explicit})
-				}
 			}
 		case "deezer":
 			key := mediaType + "s"
@@ -2377,9 +2459,7 @@ func normalizeSearchResults(source, mediaType string, pages []map[string]any) []
 				album := nestedSearchString(itm, "album", "title")
 				trackCount := searchInt(itm["nb_tracks"])
 				explicit := searchBool(itm["explicit_lyrics"])
-				if id != "" && title != "" {
+				appendUnique(searchResult{ID: id, Title: title, Artist: artist, Album: album, TrackCount: trackCount, Explicit: explicit})
-					results = append(results, searchResult{ID: id, Title: title, Artist: artist, Album: album, TrackCount: trackCount, Explicit: explicit})
-				}
 			}
 		case "soundcloud":
 			items, ok := page["items"].([]any)
@@ -2395,9 +2475,7 @@ func normalizeSearchResults(source, mediaType string, pages []map[string]any) []
 				title := asString(itm["title"])
 				artist := nestedSearchString(itm, "artist", "name")
 				trackCount := searchInt(itm["tracks_count"])
-				if id != "" && title != "" {
+				appendUnique(searchResult{ID: id, Title: title, Artist: artist, TrackCount: trackCount})
-					results = append(results, searchResult{ID: id, Title: title, Artist: artist, TrackCount: trackCount})
-				}
 			}
 		}
 	}

cmd/rip/main_test.go

@@ -2,6 +2,9 @@ package main
 
 import (
 	"errors"
+	"os"
+	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -91,6 +94,31 @@ func TestParseLastFMArgsOptions(t *testing.T) {
 	}
 }
 
+func TestParseLastFMArgsRejectsNonLastFMURL(t *testing.T) {
+	_, err := parseLastFMArgs([]string{"https://example.com/user/x/playlists/123"}, "qobuz", "")
+	if err == nil || !strings.Contains(strings.ToLower(err.Error()), "last.fm") {
+		t.Fatalf("expected last.fm url validation error, got %v", err)
+	}
+}
+
+func TestIsValidLastFMPlaylistURL(t *testing.T) {
+	if !isValidLastFMPlaylistURL("https://www.last.fm/user/x/playlists/123") {
+		t.Fatalf("expected canonical last.fm playlist url to be valid")
+	}
+	if !isValidLastFMPlaylistURL("http://last.fm/user/x/playlists/123") {
+		t.Fatalf("expected http last.fm playlist url to be valid")
+	}
+	if isValidLastFMPlaylistURL("ftp://last.fm/user/x/playlists/123") {
+		t.Fatalf("expected non-http scheme to be invalid")
+	}
+	if isValidLastFMPlaylistURL("https://example.com/user/x/playlists/123") {
+		t.Fatalf("expected non-last.fm host to be invalid")
+	}
+	if isValidLastFMPlaylistURL("https://www.last.fm/user/x/library") {
+		t.Fatalf("expected non-playlist last.fm url to be invalid")
+	}
+}
+
 func TestExtractLastFMPlaylistInfoAndPairs(t *testing.T) {
 	html := `<h1 class="playlisting-playlist-header-title">Road &amp; Rain</h1>
 <div data-playlisting-entry-count="2"></div>
@@ -119,6 +147,49 @@ func TestExtractLastFMPlaylistInfoAndPairs(t *testing.T) {
 	}
 }
 
+func TestExtractLastFMPlaylistInfoFlexibleClass(t *testing.T) {
+	html := `<h1 id="x" class="foo playlisting-playlist-header-title bar">Road &amp; Rain</h1>
+<div data-playlisting-entry-count="1"></div>`
+	title, total, err := extractLastFMPlaylistInfo(html)
+	if err != nil {
+		t.Fatalf("extractLastFMPlaylistInfo() error = %v", err)
+	}
+	if title != "Road & Rain" || total != 1 {
+		t.Fatalf("unexpected parsed values: title=%q total=%d", title, total)
+	}
+}
+
+func TestExtractLastFMTitleArtistPairsSingleQuotes(t *testing.T) {
+	html := `<a href='/music/a' title='Dreams'></a>
+<a href='/music/b' title='Fleetwood Mac'></a>`
+	pairs := extractLastFMTitleArtistPairs(html)
+	if len(pairs) != 1 {
+		t.Fatalf("pairs len = %d, want 1", len(pairs))
+	}
+	if pairs[0].Title != "Dreams" || pairs[0].Artist != "Fleetwood Mac" {
+		t.Fatalf("unexpected pair: %+v", pairs[0])
+	}
+}
+
+func TestExtractLastFMTitleArtistPairsSkipsPlayOnYouTubeNoise(t *testing.T) {
+	html := `<a href="https://www.youtube.com/watch?v=1" data-track-name="Won&#39;t Forget You" data-artist-name="Shouse" title="Play on YouTube">Play track</a>
+<a href="/music/Shouse/_/Won%27t+Forget+You" title="Won&#39;t Forget You"></a>
+<a href="/music/Shouse" title="Shouse"></a>
+<a href="https://www.youtube.com/watch?v=2" data-track-name="EYES" data-artist-name="The Blaze" title="Play on YouTube">Play track</a>
+<a href="/music/The+Blaze/_/EYES" title="EYES"></a>
+<a href="/music/The+Blaze" title="The Blaze"></a>`
+	pairs := extractLastFMTitleArtistPairs(html)
+	if len(pairs) != 2 {
+		t.Fatalf("pairs len = %d, want 2", len(pairs))
+	}
+	if pairs[0].Title != "Won't Forget You" || pairs[0].Artist != "Shouse" {
+		t.Fatalf("unexpected first pair: %+v", pairs[0])
+	}
+	if pairs[1].Title != "EYES" || pairs[1].Artist != "The Blaze" {
+		t.Fatalf("unexpected second pair: %+v", pairs[1])
+	}
+}
+
 func TestParseGlobalArgsNoDBBeforeCommand(t *testing.T) {
 	opts, err := parseGlobalArgs([]string{"-ndb", "url", "https://play.qobuz.com/album/0004228000522"})
 	if err != nil {
@@ -188,6 +259,17 @@ func TestExtractLastFMTracksFromMirrorMarkdown(t *testing.T) {
 	}
 }
 
+func TestExtractLastFMTracksFromMirrorMarkdownLowercasePlayTrack(t *testing.T) {
+	md := `Title: My Playlist | user playlists | Last.fm
+| Play | Image | Loved | Name | Artist name | Buy | Options | Duration |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| [play track](https://x) | [img](https://i) | x | [Song A](https://a) | [Artist A](https://aa) | | | 3:00 |`
+	_, tracks := extractLastFMTracksFromMirrorMarkdown(md)
+	if len(tracks) != 1 {
+		t.Fatalf("tracks len = %d, want 1", len(tracks))
+	}
+}
+
 func TestParseSearchArgsAllowsFirstAndOutputFileButCallerCanReject(t *testing.T) {
 	opts, err := parseSearchArgs([]string{"q", "--first", "--output-file", "/tmp/out.json"}, 20)
 	if err != nil {
@@ -198,6 +280,58 @@ func TestParseSearchArgsAllowsFirstAndOutputFileButCallerCanReject(t *testing.T)
 	}
 }
 
+func TestParseSearchArgsRejectsUnknownOption(t *testing.T) {
+	_, err := parseSearchArgs([]string{"query", "--bogus"}, 20)
+	if err == nil || !strings.Contains(err.Error(), "unknown option") {
+		t.Fatalf("expected unknown option error, got %v", err)
+	}
+}
+
+func TestParseSearchArgsSupportsDoubleDashTerminator(t *testing.T) {
+	opts, err := parseSearchArgs([]string{"--limit", "10", "--", "--weird", "track"}, 20)
+	if err != nil {
+		t.Fatalf("parseSearchArgs() error = %v", err)
+	}
+	if opts.limit != 10 {
+		t.Fatalf("limit = %d, want 10", opts.limit)
+	}
+	if opts.query != "--weird track" {
+		t.Fatalf("query = %q, want %q", opts.query, "--weird track")
+	}
+}
+
+func TestWriteSearchResultsToFileCreatesParentDirectory(t *testing.T) {
+	tmp := t.TempDir()
+	out := filepath.Join(tmp, "nested", "search", "results.json")
+	results := []searchResult{{ID: "1", Title: "Dreams"}}
+	if err := writeSearchResultsToFile("qobuz", "track", results, out); err != nil {
+		t.Fatalf("writeSearchResultsToFile() error = %v", err)
+	}
+	if _, err := os.Stat(out); err != nil {
+		t.Fatalf("expected output file, stat error = %v", err)
+	}
+}
+
+func TestNormalizeSearchResultsDedupesByID(t *testing.T) {
+	pages := []map[string]any{
+		{"tracks": map[string]any{"items": []any{
+			map[string]any{"id": "1", "title": "Dreams", "artist": map[string]any{"name": "Fleetwood Mac"}},
+			map[string]any{"id": "1", "title": "Dreams", "artist": map[string]any{"name": "Fleetwood Mac"}},
+		}}},
+		{"tracks": map[string]any{"items": []any{
+			map[string]any{"id": "2", "title": "Go Your Own Way", "artist": map[string]any{"name": "Fleetwood Mac"}},
+			map[string]any{"id": "1", "title": "Dreams", "artist": map[string]any{"name": "Fleetwood Mac"}},
+		}}},
+	}
+	results := normalizeSearchResults("qobuz", "track", pages)
+	if len(results) != 2 {
+		t.Fatalf("len(results)=%d want 2", len(results))
+	}
+	if results[0].ID != "1" || results[1].ID != "2" {
+		t.Fatalf("unexpected IDs order: %+v", results)
+	}
+}
+
 func TestErrorWithActionableHintForSSL(t *testing.T) {
 	err := errors.New("x509: certificate signed by unknown authority")
 	msg := errorWithActionableHint(err, globalOptions{})

config.toml.example

@@ -0,0 +1,161 @@
+[downloads]
+# Folder where tracks are downloaded to
+folder = "/path/to/StreamripDownloads"
+# Put Qobuz albums in a 'Qobuz' folder, Tidal albums in 'Tidal', etc.
+source_subdirectories = false
+# Put tracks in albums with 2+ discs into subfolders named `Disc N`
+disc_subdirectories = true
+# Download (and convert) tracks concurrently instead of sequentially
+concurrency = true
+# The maximum number of tracks to download at once
+# Set to -1 for no limit
+max_connections = 6
+# Max number of API requests per source per minute
+# Set to -1 for no limit
+requests_per_minute = 60
+# Verify SSL certificates for API connections
+# Set to false only if certificate verification fails (not recommended)
+verify_ssl = true
+
+[qobuz]
+# 1: 320kbps MP3, 2: 16/44.1, 3: 24/<=96, 4: 24/>96
+quality = 3
+# Download booklet PDFs when available
+download_booklets = true
+
+# Authenticate using Qobuz auth token instead of email/password hash
+use_auth_token = false
+# If use_auth_token=true, set your user id. Otherwise set your email.
+email_or_userid = ""
+# If use_auth_token=true, set your auth token. Otherwise set md5(password).
+password_or_token = ""
+# Managed automatically by streamrip-go
+app_id = ""
+# Managed automatically by streamrip-go
+secrets = []
+
+[tidal]
+# 0: AAC 256, 1: AAC 320, 2: FLAC 16/44.1, 3: FLAC hi-res when available
+quality = 3
+# Prefer Dolby Atmos/immersive stream variants when available
+# Disabled by default because stereo FLAC is usually preferred
+prefer_atmos = false
+# Download videos included in supported Tidal media
+download_videos = true
+
+# Session values are managed automatically. Do not modify manually.
+user_id = ""
+country_code = ""
+access_token = ""
+refresh_token = ""
+# Unix timestamp when access_token expires
+token_expiry = 0
+
+[deezer]
+# 0: MP3_128, 1: MP3_320, 2: FLAC
+quality = 2
+# If target quality is unavailable, fallback down quality ladder
+lower_quality_if_not_available = true
+# Deezer ARL cookie (recommended auth method)
+arl = ""
+# Optional login alternative when ARL is not provided
+email = ""
+password = ""
+# Optional cached Deezer refresh token. Managed automatically when available.
+refresh_token = ""
+
+[soundcloud]
+# Only 0 is currently supported
+quality = 0
+# Managed automatically when available
+client_id = ""
+app_version = ""
+
+[youtube]
+# Only 0 is currently supported
+quality = 0
+# Download video streams together with audio when supported
+download_videos = false
+# Folder used for video outputs
+video_downloads_folder = "/path/to/StreamripDownloads/YouTubeVideos"
+
+[database]
+# Track IDs already downloaded are stored here and skipped next time
+downloads_enabled = true
+downloads_path = "/path/to/.config/streamrip/downloads.db"
+# Failed item IDs are stored here for retry/repair workflows
+failed_downloads_enabled = true
+failed_downloads_path = "/path/to/.config/streamrip/failed_downloads.db"
+
+[conversion]
+# Convert tracks after download
+enabled = false
+# ALAC, FLAC, OGG, MP3, or AAC
+codec = "ALAC"
+# In Hz. Audio is downsampled when above this rate.
+sampling_rate = 48000
+# Applied only when source bit depth is higher than this value
+bit_depth = 24
+# Used for lossy codecs
+lossy_bitrate = 320
+
+[qobuz_filters]
+# Filter a Qobuz artist discography (best-effort for other sources)
+extras = false
+repeats = false
+non_albums = false
+features = false
+non_studio_albums = false
+non_remaster = false
+
+[artwork]
+# Embed artwork in the audio file
+embed = true
+# thumbnail, small, large, or original
+embed_size = "large"
+# If > 0, embedded image max(width, height) in pixels
+embed_max_width = -1
+# Save artwork as separate jpg file
+save_artwork = true
+# If > 0, saved image max(width, height) in pixels
+saved_max_width = -1
+
+[metadata]
+# Set ALBUM metadata to playlist name for playlist items
+set_playlist_to_album = true
+# Use playlist position as tracknumber for playlist items
+renumber_playlist_tracks = true
+# Metadata fields to exclude from tagging
+exclude = []
+
+[filepaths]
+# Create folders for single tracks using folder_format template
+add_singles_to_folder = false
+# Available keys: albumartist, title, year, bit_depth, sampling_rate, id, albumcomposer
+folder_format = "{albumartist} - {title} ({year}) [{container}] [{bit_depth}B-{sampling_rate}kHz]"
+# Available keys: id, tracknumber, artist, albumartist, composer, title, albumcomposer, explicit
+track_format = "{tracknumber:02}. {artist} - {title}{explicit}"
+# Restrict filenames to printable ASCII
+restrict_characters = false
+# Truncate filenames longer than this value
+truncate_to = 120
+
+[lastfm]
+# Primary source used to resolve Last.fm playlist tracks
+source = "qobuz"
+# Fallback source when primary lookup fails
+fallback_source = ""
+
+[cli]
+# Print informational output like "Downloading <album>"
+text_output = true
+# Show resolve and download progress bars
+progress_bars = true
+# Max interactive search results displayed
+max_search_results = 100
+
+[misc]
+# Metadata used for config compatibility checks
+version = "2.2.0"
+# Notify when a new version is available
+check_for_updates = true

internal/app/app.go

@@ -510,6 +510,10 @@ func (m *Main) Rip(ctx context.Context) error {
 }
 
 func (m *Main) ripAlbum(ctx context.Context, p provider.Client, source, albumID string, albumMeta map[string]any) error {
+	if err := m.requireSourceDownloadAuth(source); err != nil {
+		return err
+	}
+
 	albumTitle := titleFromMetadata(albumMeta, albumID)
 	albumArtist := nestedString(albumMeta, "artist", "name")
 	if albumArtist == "" {
@@ -620,11 +624,19 @@ func (m *Main) ripAlbum(ctx context.Context, p provider.Client, source, albumID
 }
 
 func (m *Main) ripPlaylist(ctx context.Context, p provider.Client, source, playlistID string, playlistMeta map[string]any) error {
+	if err := m.requireSourceDownloadAuth(source); err != nil {
+		return err
+	}
+
 	name := titleFromMetadata(playlistMeta, playlistID)
 	if n := stringFromAny(playlistMeta["name"]); n != "" {
 		name = n
 	}
-	folder := filepath.Join(m.Config.Session.Downloads.Folder, naming.CleanName(name, naming.Config{
+	base := m.Config.Session.Downloads.Folder
+	if m.Config.Session.Downloads.SourceSubdirectories {
+		base = filepath.Join(base, strings.Title(source))
+	}
+	folder := filepath.Join(base, naming.CleanName(name, naming.Config{
 		RestrictCharacters: m.Config.Session.Filepaths.RestrictCharacters,
 		TruncateTo:         m.Config.Session.Filepaths.TruncateTo,
 	}))
@@ -716,6 +728,20 @@ func (m *Main) ripPlaylist(ctx context.Context, p provider.Client, source, playl
 }
 
 func (m *Main) ripPlaylistMixed(ctx context.Context, playlistID, name string, refs []PlaylistTrackRef) error {
+	requiredSources := map[string]struct{}{}
+	for _, ref := range refs {
+		s := strings.TrimSpace(ref.Source)
+		if s == "" {
+			continue
+		}
+		requiredSources[s] = struct{}{}
+	}
+	for source := range requiredSources {
+		if err := m.requireSourceDownloadAuth(source); err != nil {
+			return err
+		}
+	}
+
 	folder := filepath.Join(m.Config.Session.Downloads.Folder, naming.CleanName(name, naming.Config{
 		RestrictCharacters: m.Config.Session.Filepaths.RestrictCharacters,
 		TruncateTo:         m.Config.Session.Filepaths.TruncateTo,
@@ -765,6 +791,18 @@ func (m *Main) ripPlaylistMixed(ctx context.Context, playlistID, name string, re
 	return nil
 }
 
+func (m *Main) requireSourceDownloadAuth(source string) error {
+	if source == "deezer" {
+		hasARL := strings.TrimSpace(m.Config.Session.Deezer.ARL) != ""
+		hasCreds := strings.TrimSpace(m.Config.Session.Deezer.Email) != "" && strings.TrimSpace(m.Config.Session.Deezer.Password) != ""
+		hasRefresh := strings.TrimSpace(m.Config.Session.Deezer.RefreshToken) != ""
+		if !hasARL && !hasCreds && !hasRefresh {
+			return fmt.Errorf("deezer native download requires deezer.arl, deezer.email+deezer.password, or deezer.refresh_token")
+		}
+	}
+	return nil
+}
+
 func (m *Main) ripTrack(ctx context.Context, p provider.Client, source, id, fallbackTitle string, opts ripTrackOptions) error {
 	alreadyDownloaded, err := m.Store.IsDownloaded(ctx, source, id)
 	if err == nil && alreadyDownloaded {
@@ -1217,10 +1255,16 @@ func buildTagMetadata(trackMeta map[string]any, title, source, trackID string, o
 	comment := stringFromAny(trackMeta["comment"])
 	description := stringFromAny(trackMeta["description"])
 	lyrics := stringFromAny(trackMeta["lyrics"])
+	if lrc := stringFromAny(trackMeta["lyrics_synced"]); lrc != "" {
+		lyrics = lrc
+	}
 	trackGain := replaygainGainFromAny(trackMeta["replaygain_track_gain"])
 	if trackGain == "" {
 		trackGain = replaygainGainFromAny(trackMeta["replayGain"])
 	}
+	if trackGain == "" {
+		trackGain = replaygainGainFromAny(trackMeta["gain"])
+	}
 	albumGain := replaygainGainFromAny(trackMeta["replaygain_album_gain"])
 	if albumGain == "" {
 		albumGain = replaygainGainFromAny(nestedAny(trackMeta, "album", "replaygain_album_gain"))

internal/app/app_test.go

@@ -464,6 +464,87 @@ func TestPlaylistRipPipeline(t *testing.T) {
 	}
 }
 
+func TestPlaylistRipUsesSourceSubdirectory(t *testing.T) {
+	tmp := t.TempDir()
+
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte("audio-bytes"))
+	}))
+	defer ts.Close()
+
+	d := config.DefaultConfigData()
+	d.Downloads.Folder = tmp
+	d.Downloads.Concurrency = false
+	d.Downloads.SourceSubdirectories = true
+	d.Filepaths.RestrictCharacters = false
+	cfg := &config.Config{File: d, Session: d}
+
+	sqlite, err := store.NewSQLite(filepath.Join(tmp, "db.sqlite"))
+	if err != nil {
+		t.Fatalf("NewSQLite() error = %v", err)
+	}
+	defer func() { _ = sqlite.Close() }()
+
+	m := &Main{
+		Config: cfg,
+		Providers: map[string]provider.Client{
+			"qobuz": &fakePlaylistProvider{url: ts.URL},
+		},
+		Store:  sqlite,
+		DL:     download.NewWithOptions(true, false),
+		Tagger: noopTagger{},
+	}
+
+	ctx := context.Background()
+	if err = m.AddByID(ctx, "qobuz", "playlist", "pl1"); err != nil {
+		t.Fatalf("AddByID() error = %v", err)
+	}
+	if err = m.Resolve(ctx); err != nil {
+		t.Fatalf("Resolve() error = %v", err)
+	}
+	if err = m.Rip(ctx); err != nil {
+		t.Fatalf("Rip() error = %v", err)
+	}
+
+	folder := filepath.Join(tmp, "Qobuz", "Road Trip")
+	if _, err = os.Stat(filepath.Join(folder, "01. Artist - Track One.flac")); err != nil {
+		t.Fatalf("missing first playlist track in source subdir: %v", err)
+	}
+}
+
+func TestRipPlaylistRequiresDeezerARL(t *testing.T) {
+	d := config.DefaultConfigData()
+	m := &Main{Config: &config.Config{File: d, Session: d}}
+
+	err := m.ripPlaylist(context.Background(), nil, "deezer", "pl1", map[string]any{
+		"name":   "Road Trip",
+		"tracks": map[string]any{"items": []any{map[string]any{"id": "p1"}}},
+	})
+	if err == nil || !strings.Contains(err.Error(), "deezer") {
+		t.Fatalf("expected deezer arl error, got %v", err)
+	}
+}
+
+func TestRipAlbumRequiresDeezerARL(t *testing.T) {
+	d := config.DefaultConfigData()
+	m := &Main{Config: &config.Config{File: d, Session: d}}
+
+	err := m.ripAlbum(context.Background(), nil, "deezer", "alb1", map[string]any{})
+	if err == nil || !strings.Contains(err.Error(), "deezer") {
+		t.Fatalf("expected deezer arl error, got %v", err)
+	}
+}
+
+func TestRipPlaylistMixedRequiresDeezerAuth(t *testing.T) {
+	d := config.DefaultConfigData()
+	m := &Main{Config: &config.Config{File: d, Session: d}}
+
+	err := m.ripPlaylistMixed(context.Background(), "mix1", "Mix", []PlaylistTrackRef{{Source: "deezer", ID: "1"}})
+	if err == nil || !strings.Contains(err.Error(), "deezer") {
+		t.Fatalf("expected deezer auth error, got %v", err)
+	}
+}
+
 func TestApplyQobuzArtistFiltersRepeats(t *testing.T) {
 	albums := []collectionAlbum{
 		{ID: "a1", Title: "Album X", BitDepth: 16, Sampling: 44.1, Explicit: false},
@@ -550,3 +631,16 @@ func TestBuildTagMetadataReplayGainFallbacks(t *testing.T) {
 		t.Fatalf("album replaygain peak=%q", tags.ReplaygainAlbumPeak)
 	}
 }
+
+func TestBuildTagMetadataReplayGainFallsBackToDeezerGain(t *testing.T) {
+	meta := map[string]any{
+		"gain":      float64(-10),
+		"performer": map[string]any{"name": "Artist"},
+		"album":     map[string]any{"title": "Album"},
+	}
+
+	tags := buildTagMetadata(meta, "Song", "deezer", "2675762392", ripTrackOptions{})
+	if tags.ReplaygainTrackGain != "-10 dB" {
+		t.Fatalf("track replaygain gain=%q", tags.ReplaygainTrackGain)
+	}
+}

internal/audio/convert/convert.go

@@ -72,6 +72,17 @@ func buildFFmpegArgs(inputPath, outputPath string, p profile, cfg config.Convers
 		"-c:a", p.codecLib,
 	}
 
+	if supportsAttachedPicture(p.ext) {
+		args = append(args,
+			"-map", "0:v:0?",
+			"-c:v", "mjpeg",
+			"-disposition:v:0", "attached_pic",
+		)
+		if p.ext == "mp3" {
+			args = append(args, "-id3v2_version", "3")
+		}
+	}
+
 	if p.lossless {
 		filter := buildLosslessFilter(cfg)
 		if filter != "" {
@@ -87,6 +98,15 @@ func buildFFmpegArgs(inputPath, outputPath string, p profile, cfg config.Convers
 	return args
 }
 
+func supportsAttachedPicture(ext string) bool {
+	switch strings.TrimPrefix(strings.ToLower(ext), ".") {
+	case "flac", "mp3", "m4a", "mp4":
+		return true
+	default:
+		return false
+	}
+}
+
 func buildLosslessFilter(cfg config.ConversionConfig) string {
 	parts := make([]string, 0, 2)
 	if cfg.SamplingRate > 0 {

internal/audio/convert/convert_test.go

@@ -28,6 +28,12 @@ func TestBuildFFmpegArgsLossless(t *testing.T) {
 	if !strings.Contains(joined, "sample_fmts=s16p|s16") {
 		t.Fatalf("missing bit depth filter args=%s", joined)
 	}
+	if !strings.Contains(joined, "-map 0:v:0?") {
+		t.Fatalf("missing optional cover map args=%s", joined)
+	}
+	if !strings.Contains(joined, "-disposition:v:0 attached_pic") {
+		t.Fatalf("missing attached_pic disposition args=%s", joined)
+	}
 }
 
 func TestBuildFFmpegArgsLossy(t *testing.T) {
@@ -40,4 +46,16 @@ func TestBuildFFmpegArgsLossy(t *testing.T) {
 	if !strings.Contains(joined, "-b:a 320k") {
 		t.Fatalf("missing bitrate args=%s", joined)
 	}
+	if !strings.Contains(joined, "-id3v2_version 3") {
+		t.Fatalf("missing id3v2 args=%s", joined)
+	}
+}
+
+func TestBuildFFmpegArgsNoCoverForOpus(t *testing.T) {
+	cfg := config.ConversionConfig{Enabled: true, Codec: "OPUS", LossyBitrate: 192}
+	args := buildFFmpegArgs("in.flac", "out.opus", profiles["OPUS"], cfg)
+	joined := strings.Join(args, " ")
+	if strings.Contains(joined, "-map 0:v:0?") {
+		t.Fatalf("unexpected cover map args=%s", joined)
+	}
 }

internal/config/config.go

@@ -60,6 +60,7 @@ type QobuzConfig struct {
 type TidalConfig struct {
 	Quality        int    `toml:"quality"`
 	DownloadVideos bool   `toml:"download_videos"`
+	PreferAtmos    bool   `toml:"prefer_atmos"`
 	UserID         string `toml:"user_id"`
 	CountryCode    string `toml:"country_code"`
 	AccessToken    string `toml:"access_token"`
@@ -71,8 +72,9 @@ type DeezerConfig struct {
 	Quality                    int    `toml:"quality"`
 	LowerQualityIfNotAvailable bool   `toml:"lower_quality_if_not_available"`
 	ARL                        string `toml:"arl"`
-	UseDeezloader              bool   `toml:"use_deezloader"`
+	Email                      string `toml:"email"`
-	DeezloaderWarnings         bool   `toml:"deezloader_warnings"`
+	Password                   string `toml:"password"`
+	RefreshToken               string `toml:"refresh_token"`
 }
 
 type SoundcloudConfig struct {
@@ -232,12 +234,11 @@ func DefaultConfigData() ConfigData {
 		Tidal: TidalConfig{
 			Quality:        3,
 			DownloadVideos: true,
+			PreferAtmos:    false,
 		},
 		Deezer: DeezerConfig{
 			Quality:                    2,
 			LowerQualityIfNotAvailable: true,
-			UseDeezloader:              true,
-			DeezloaderWarnings:         true,
 		},
 		Soundcloud: SoundcloudConfig{
 			Quality: 0,

internal/download/downloader.go

@@ -14,6 +14,7 @@ import (
 	"strconv"
 	"strings"
 	"sync/atomic"
+	"time"
 
 	"github.com/vbauerster/mpb/v8"
 	"github.com/vbauerster/mpb/v8/decor"
@@ -77,15 +78,97 @@ func (d *Downloader) FileDeezerEncrypted(ctx context.Context, sourceURL, outputP
 	if resp.StatusCode != http.StatusOK {
 		return fmt.Errorf("download failed: status=%d", resp.StatusCode)
 	}
-	encrypted, err := io.ReadAll(resp.Body)
+	out, err := os.Create(outputPath)
 	if err != nil {
 		return err
 	}
-	plain, err := decryptDeezerBFCBCStripe(encrypted, trackID)
+	success := false
+	defer func() {
+		_ = out.Close()
+		if !success {
+			_ = os.Remove(outputPath)
+		}
+	}()
+
+	var bar *mpb.Bar
+	if d.ProgressEnabled() {
+		d.barStarted.Store(1)
+		desc := shortenName(filepath.Base(outputPath), 54)
+		if resp.ContentLength > 0 {
+			bar = d.progress.AddBar(
+				resp.ContentLength,
+				mpb.PrependDecorators(
+					decor.Name(desc+" ", decor.WC{W: 56, C: decor.DSyncWidth | decor.DindentRight}),
+					decor.Percentage(decor.WCSyncWidthR),
+				),
+				mpb.AppendDecorators(
+					decor.CountersKibiByte("% .1f / % .1f", decor.WCSyncWidthR),
+					decor.Name(" | ", decor.WCSyncWidth),
+					decor.AverageSpeed(decor.SizeB1024(0), "% .1f", decor.WCSyncWidthR),
+					decor.Name(" | ETA ", decor.WCSyncWidth),
+					decor.AverageETA(decor.ET_STYLE_GO, decor.WCSyncWidthR),
+				),
+				mpb.BarRemoveOnComplete(),
+			)
+		} else {
+			bar = d.progress.AddSpinner(
+				0,
+				mpb.PrependDecorators(
+					decor.Name(desc+" ", decor.WC{W: 56, C: decor.DSyncWidth | decor.DindentRight}),
+				),
+				mpb.AppendDecorators(
+					decor.CurrentKibiByte("% .1f", decor.WCSyncWidthR),
+					decor.Name(" | ", decor.WCSyncWidth),
+					decor.Elapsed(decor.ET_STYLE_GO, decor.WCSyncWidthR),
+				),
+				mpb.BarRemoveOnComplete(),
+			)
+			defer bar.SetTotal(-1, true)
+		}
+	}
+
+	block, err := blowfish.NewCipher(deriveDeezerBlowfishKey(trackID))
 	if err != nil {
 		return err
 	}
-	return os.WriteFile(outputPath, plain, 0o644)
+	buf := make([]byte, deezerBFChunkSize)
+	dec := make([]byte, deezerBFChunkSize)
+	chunkIndex := 0
+	totalRead := int64(0)
+	for {
+		n, readErr := io.ReadFull(resp.Body, buf)
+		if readErr == io.EOF {
+			break
+		}
+		if readErr != nil && readErr != io.ErrUnexpectedEOF {
+			return readErr
+		}
+		chunk := buf[:n]
+		if chunkIndex%3 == 0 && n == deezerBFChunkSize {
+			mode := cipher.NewCBCDecrypter(block, deezerBFIV)
+			mode.CryptBlocks(dec[:n], chunk)
+			chunk = dec[:n]
+		}
+		if _, err = out.Write(chunk); err != nil {
+			return err
+		}
+		totalRead += int64(n)
+		if bar != nil {
+			bar.IncrBy(n)
+		}
+		chunkIndex++
+		if readErr == io.ErrUnexpectedEOF {
+			break
+		}
+	}
+	if resp.ContentLength > 0 && totalRead != resp.ContentLength {
+		return io.ErrUnexpectedEOF
+	}
+	if err = out.Sync(); err != nil {
+		return err
+	}
+	success = true
+	return nil
 }
 
 func (d *Downloader) file(ctx context.Context, sourceURL, outputPath string, allowProgress bool, includeVideo bool) error {
@@ -119,12 +202,20 @@ func (d *Downloader) file(ctx context.Context, sourceURL, outputPath string, all
 	if err != nil {
 		return err
 	}
-	defer func() { _ = out.Close() }()
+	success := false
+	defer func() {
+		_ = out.Close()
+		if !success {
+			_ = os.Remove(outputPath)
+		}
+	}()
 
-	if d.ProgressEnabled() && allowProgress && resp.ContentLength > 0 {
+	if d.ProgressEnabled() && allowProgress {
 		d.barStarted.Store(1)
 		desc := shortenName(filepath.Base(outputPath), 54)
-		bar := d.progress.AddBar(
+		var bar *mpb.Bar
+		if resp.ContentLength > 0 {
+			bar = d.progress.AddBar(
 				resp.ContentLength,
 				mpb.PrependDecorators(
 					decor.Name(desc+" ", decor.WC{W: 56, C: decor.DSyncWidth | decor.DindentRight}),
@@ -139,13 +230,30 @@ func (d *Downloader) file(ctx context.Context, sourceURL, outputPath string, all
 				),
 				mpb.BarRemoveOnComplete(),
 			)
+		} else {
+			bar = d.progress.AddSpinner(
+				0,
+				mpb.PrependDecorators(
+					decor.Name(desc+" ", decor.WC{W: 56, C: decor.DSyncWidth | decor.DindentRight}),
+				),
+				mpb.AppendDecorators(
+					decor.CurrentKibiByte("% .1f", decor.WCSyncWidthR),
+					decor.Name(" | ", decor.WCSyncWidth),
+					decor.Elapsed(decor.ET_STYLE_GO, decor.WCSyncWidthR),
+				),
+				mpb.BarRemoveOnComplete(),
+			)
+			defer bar.SetTotal(-1, true)
+		}
 		buf := make([]byte, 256*1024)
+		totalWritten := int64(0)
 		for {
 			n, readErr := reader.Read(buf)
 			if n > 0 {
 				if _, writeErr := out.Write(buf[:n]); writeErr != nil {
 					return writeErr
 				}
+				totalWritten += int64(n)
 				bar.IncrBy(n)
 			}
 			if readErr != nil {
@@ -155,12 +263,26 @@ func (d *Downloader) file(ctx context.Context, sourceURL, outputPath string, all
 				return readErr
 			}
 		}
+		if resp.ContentLength > 0 && totalWritten != resp.ContentLength {
+			return io.ErrUnexpectedEOF
+		}
+		if err = out.Sync(); err != nil {
+			return err
+		}
 	} else {
-		if _, err = io.Copy(out, reader); err != nil {
+		written, copyErr := io.Copy(out, reader)
+		if copyErr != nil {
+			return copyErr
+		}
+		if resp.ContentLength > 0 && written != resp.ContentLength {
+			return io.ErrUnexpectedEOF
+		}
+		if err = out.Sync(); err != nil {
 			return err
 		}
 	}
 
+	success = true
 	return nil
 }
 
@@ -198,6 +320,41 @@ func shortenName(name string, max int) string {
 }
 
 func (d *Downloader) streamManifestWithFFmpeg(ctx context.Context, sourceURL, outputPath string, includeVideo bool) error {
+	stopSpinner := func() {}
+	if d.ProgressEnabled() {
+		d.barStarted.Store(1)
+		desc := shortenName(filepath.Base(outputPath), 54)
+		spin := d.progress.AddSpinner(
+			0,
+			mpb.PrependDecorators(
+				decor.Name(desc+" ", decor.WC{W: 56, C: decor.DSyncWidth | decor.DindentRight}),
+			),
+			mpb.AppendDecorators(
+				decor.Elapsed(decor.ET_STYLE_GO, decor.WCSyncWidthR),
+				decor.Name(" | ffmpeg stream", decor.WCSyncWidth),
+			),
+			mpb.BarRemoveOnComplete(),
+		)
+		done := make(chan struct{})
+		go func() {
+			ticker := time.NewTicker(120 * time.Millisecond)
+			defer ticker.Stop()
+			for {
+				select {
+				case <-ticker.C:
+					spin.IncrBy(1)
+				case <-done:
+					return
+				}
+			}
+		}()
+		stopSpinner = func() {
+			close(done)
+			spin.SetTotal(-1, true)
+		}
+	}
+	defer stopSpinner()
+
 	if _, err := exec.LookPath("ffmpeg"); err != nil {
 		return fmt.Errorf("ffmpeg not found for manifest stream: %w", err)
 	}
@@ -217,6 +374,7 @@ func (d *Downloader) streamManifestWithFFmpeg(ctx context.Context, sourceURL, ou
 	cmd := exec.CommandContext(ctx, "ffmpeg", args...)
 	output, err := cmd.CombinedOutput()
 	if err != nil {
+		_ = os.Remove(outputPath)
 		return fmt.Errorf("ffmpeg stream copy failed: %w: %s", err, string(output))
 	}
 	return nil
@@ -228,7 +386,7 @@ func isManifestResponse(contentType string, peek []byte) bool {
 		return true
 	}
 	s := strings.TrimSpace(strings.ToLower(string(peek)))
-	if strings.HasPrefix(s, "<?xml") && strings.Contains(s, "<mpd") {
+	if (strings.HasPrefix(s, "<?xml") && strings.Contains(s, "<mpd")) || strings.HasPrefix(s, "<mpd") {
 		return true
 	}
 	if strings.HasPrefix(s, "#extm3u") {

internal/download/downloader_test.go

@@ -3,11 +3,16 @@ package download
 import (
 	"context"
 	"crypto/cipher"
+	"errors"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"strings"
 	"testing"
+	"time"
 
 	"golang.org/x/crypto/blowfish"
 )
@@ -44,9 +49,15 @@ func TestManifestDetection(t *testing.T) {
 	if !isManifestResponse("application/dash+xml", []byte("x")) {
 		t.Fatalf("expected dash content-type to be manifest")
 	}
+	if !isManifestResponse("application/vnd.apple.mpegurl", []byte("x")) {
+		t.Fatalf("expected mpegurl content-type to be manifest")
+	}
 	if !isManifestResponse("application/octet-stream", []byte("<?xml version='1.0'?><MPD></MPD>")) {
 		t.Fatalf("expected MPD XML body to be manifest")
 	}
+	if !isManifestResponse("application/octet-stream", []byte("<MPD type='static'></MPD>")) {
+		t.Fatalf("expected MPD body without xml prolog to be manifest")
+	}
 	if !isManifestResponse("text/plain", []byte("#EXTM3U\n#EXT-X-VERSION:3")) {
 		t.Fatalf("expected HLS body to be manifest")
 	}
@@ -84,3 +95,139 @@ func TestDecryptDeezerBFCBCStripe(t *testing.T) {
 		t.Fatalf("decrypted data mismatch")
 	}
 }
+
+func TestFileDeezerEncrypted(t *testing.T) {
+	trackID := "3135556"
+	plain := make([]byte, deezerBFChunkSize+777)
+	for i := range plain {
+		plain[i] = byte((i * 7) % 251)
+	}
+	enc := make([]byte, len(plain))
+	copy(enc, plain)
+
+	block, err := blowfish.NewCipher(deriveDeezerBlowfishKey(trackID))
+	if err != nil {
+		t.Fatalf("cipher error: %v", err)
+	}
+	cbc := cipher.NewCBCEncrypter(block, deezerBFIV)
+	cbc.CryptBlocks(enc[:deezerBFChunkSize], enc[:deezerBFChunkSize])
+
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write(enc)
+	}))
+	defer ts.Close()
+
+	d := NewWithOptions(true, false)
+	out := filepath.Join(t.TempDir(), "x", "a.flac")
+	if err = d.FileDeezerEncrypted(context.Background(), ts.URL, out, trackID); err != nil {
+		t.Fatalf("FileDeezerEncrypted() error = %v", err)
+	}
+
+	got, err := os.ReadFile(out)
+	if err != nil {
+		t.Fatalf("ReadFile() error = %v", err)
+	}
+	if string(got) != string(plain) {
+		t.Fatalf("decrypted file mismatch")
+	}
+}
+
+func TestDownloaderFileTruncatedResponseRemovesPartialFile(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Length", "10")
+		_, _ = w.Write([]byte("abc"))
+	}))
+	defer ts.Close()
+
+	d := NewWithOptions(true, false)
+	out := filepath.Join(t.TempDir(), "x", "a.bin")
+	err := d.File(context.Background(), ts.URL, out)
+	if err == nil || !errors.Is(err, io.ErrUnexpectedEOF) {
+		t.Fatalf("expected unexpected EOF, got %v", err)
+	}
+	if _, statErr := os.Stat(out); !errors.Is(statErr, os.ErrNotExist) {
+		t.Fatalf("expected no partial file, stat err=%v", statErr)
+	}
+}
+
+func TestFileDeezerEncryptedTruncatedResponseRemovesPartialFile(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Length", "4096")
+		_, _ = w.Write([]byte("short"))
+	}))
+	defer ts.Close()
+
+	d := NewWithOptions(true, false)
+	out := filepath.Join(t.TempDir(), "x", "a.flac")
+	err := d.FileDeezerEncrypted(context.Background(), ts.URL, out, "3135556")
+	if err == nil || !errors.Is(err, io.ErrUnexpectedEOF) {
+		t.Fatalf("expected unexpected EOF, got %v", err)
+	}
+	if _, statErr := os.Stat(out); !errors.Is(statErr, os.ErrNotExist) {
+		t.Fatalf("expected no partial file, stat err=%v", statErr)
+	}
+}
+
+func TestFileDeezerEncryptedBadStatus(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusForbidden)
+	}))
+	defer ts.Close()
+
+	d := NewWithOptions(true, false)
+	out := filepath.Join(t.TempDir(), "x", "a.flac")
+	err := d.FileDeezerEncrypted(context.Background(), ts.URL, out, "3135556")
+	if err == nil || !strings.Contains(err.Error(), "status=403") {
+		t.Fatalf("expected status error, got %v", err)
+	}
+}
+
+func TestDownloaderFileContextCancellationRemovesPartialFile(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/octet-stream")
+		_, _ = w.Write([]byte("partial-data"))
+		if f, ok := w.(http.Flusher); ok {
+			f.Flush()
+		}
+		<-r.Context().Done()
+	}))
+	defer ts.Close()
+
+	d := NewWithOptions(true, false)
+	out := filepath.Join(t.TempDir(), "x", "cancel.bin")
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Millisecond)
+	defer cancel()
+	err := d.File(ctx, ts.URL, out)
+	if err == nil {
+		t.Fatalf("expected context cancellation error")
+	}
+	if _, statErr := os.Stat(out); !errors.Is(statErr, os.ErrNotExist) {
+		t.Fatalf("expected no partial file, stat err=%v", statErr)
+	}
+}
+
+func TestStreamManifestWithFFmpegMissing(t *testing.T) {
+	d := NewWithOptions(true, false)
+	t.Setenv("PATH", "")
+	err := d.streamManifestWithFFmpeg(context.Background(), "https://example.com/live.m3u8", filepath.Join(t.TempDir(), "out.m4a"), false)
+	if err == nil || !strings.Contains(strings.ToLower(err.Error()), "ffmpeg not found") {
+		t.Fatalf("expected ffmpeg missing error, got %v", err)
+	}
+}
+
+func TestStreamManifestWithFFmpegFailureRemovesPartialFile(t *testing.T) {
+	if _, err := exec.LookPath("ffmpeg"); err != nil {
+		t.Skip("ffmpeg not installed")
+	}
+	d := NewWithOptions(true, false)
+	out := filepath.Join(t.TempDir(), "out.m4a")
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	err := d.streamManifestWithFFmpeg(ctx, "https://127.0.0.1:1/unreachable.m3u8", out, false)
+	if err == nil || !strings.Contains(err.Error(), "ffmpeg stream copy failed") {
+		t.Fatalf("expected ffmpeg failure error, got %v", err)
+	}
+	if _, statErr := os.Stat(out); !errors.Is(statErr, os.ErrNotExist) {
+		t.Fatalf("expected no partial file after ffmpeg failure, stat err=%v", statErr)
+	}
+}

internal/provider/deezer/client.go

@@ -1,7 +1,11 @@
 package deezer
 
 import (
+	"bytes"
 	"context"
+	"crypto/aes"
+	"crypto/rand"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -21,8 +25,18 @@ import (
 var (
 	baseURL      = "https://api.deezer.com"
 	webGWLight   = "https://www.deezer.com/ajax/gw-light.php"
+	gatewayURL   = "https://api.deezer.com/1.0/gateway.php"
 	mediaURL     = "https://media.deezer.com/v1/get_url"
-	deezerUA   = "Deezer/9.0.11.4 (Android; 14; Mobile; us) Xiaomi Redmi Note 7"
+	pipeURL      = "https://pipe.deezer.com/api"
+	authURL      = "https://auth.deezer.com/login/renew"
+	apiKey       = "4VCYIJUCDLOUELGD1V8WBVYBNVDYOXEWSLLZDONGBBDFVXTZJRXPR29JRLQFO6ZE"
+	gatewayDec   = "VBK1FSUEXHTSDBJJ"
+	deezerUAPool = []string{
+		"Deezer/9.0.11.4 (Android; 14; Mobile; us) Xiaomi Redmi Note 7",
+		"Deezer/9.0.11.4 (Android; 14; Mobile; us) Samsung SM-G991B",
+		"Deezer/9.0.11.4 (Android; 13; Mobile; us) Google Pixel 6",
+		"Deezer/9.0.11.4 (Android; 14; Mobile; us) OnePlus IN2023",
+	}
 )
 
 type Client struct {
@@ -30,6 +44,8 @@ type Client struct {
 	http     *http.Client
 	limiter  *ratelimit.Limiter
 	loggedIn bool
+	ua       string
+	deviceID string
 	sid      string
 	arl      string
 	jwt      string
@@ -43,7 +59,10 @@ func New(cfg *config.Config) *Client {
 		cfg:      cfg,
 		http:     netutil.NewHTTPClient(30*time.Second, cfg.Session.Downloads.VerifySSL),
 		limiter:  ratelimit.New(cfg.Session.Downloads.RequestsPerMinute),
+		ua:       randomDeezerUA(),
+		deviceID: randomHexN(16),
 		arl:      strings.TrimSpace(cfg.Session.Deezer.ARL),
+		refresh:  strings.TrimSpace(cfg.Session.Deezer.RefreshToken),
 	}
 }
 
@@ -53,10 +72,32 @@ func (c *Client) Source() string {
 
 func (c *Client) Login(ctx context.Context) error {
 	c.arl = strings.TrimSpace(c.cfg.Session.Deezer.ARL)
+	c.sid = ""
+	c.jwt = ""
+	c.refresh = strings.TrimSpace(c.cfg.Session.Deezer.RefreshToken)
+	c.license = ""
+	c.userID = ""
+	email := strings.TrimSpace(c.cfg.Session.Deezer.Email)
+	password := strings.TrimSpace(c.cfg.Session.Deezer.Password)
+	if c.refresh != "" {
+		if err := c.refreshJWT(ctx); err == nil {
+			_ = c.refreshLicenseFromPipe(ctx)
+			if c.license != "" {
+				c.loggedIn = true
+				return nil
+			}
+		}
+	}
 	if c.arl != "" {
 		if err := c.refreshSessionFromARL(ctx); err != nil {
 			return err
 		}
+	} else if email != "" && password != "" {
+		if err := c.loginWithCredentials(ctx, email, password); err != nil {
+			return err
+		}
+	} else {
+		return errors.New("deezer login requires deezer.arl, deezer.email+deezer.password, or deezer.refresh_token")
 	}
 	c.loggedIn = true
 	return nil
@@ -111,6 +152,14 @@ func (c *Client) GetMetadata(ctx context.Context, item, mediaType string) (map[s
 			return nil, err
 		}
 		enrichTrack(resp)
+		if lyr, lyrErr := c.fetchLyricsFromPipe(ctx, strings.TrimSpace(stringFromAny(resp["id"]))); lyrErr == nil {
+			if strings.TrimSpace(lyr.Text) != "" {
+				resp["lyrics"] = lyr.Text
+			}
+			if strings.TrimSpace(lyr.SyncedLRC) != "" {
+				resp["lyrics_synced"] = lyr.SyncedLRC
+			}
+		}
 		return resp, nil
 	case "album":
 		resp, err := c.apiGet(ctx, "/album/"+item, nil)
@@ -154,7 +203,13 @@ func (c *Client) GetMetadata(ctx context.Context, item, mediaType string) (map[s
 		resp["tracks"] = map[string]any{"items": items}
 		return resp, nil
 	case "artist":
-		resp, err := c.apiGet(ctx, "/artist/"+item+"/albums", nil)
+		name := strings.TrimSpace(item)
+		if artistMeta, artistErr := c.apiGet(ctx, "/artist/"+item, nil); artistErr == nil {
+			if n := strings.TrimSpace(stringFromAny(artistMeta["name"])); n != "" {
+				name = n
+			}
+		}
+		resp, err := c.getArtistAlbums(ctx, item)
 		if err != nil {
 			return nil, err
 		}
@@ -169,20 +224,65 @@ func (c *Client) GetMetadata(ctx context.Context, item, mediaType string) (map[s
 				albums = append(albums, itm)
 			}
 		}
-		return map[string]any{"name": "", "albums": map[string]any{"items": albums}}, nil
+		return map[string]any{"name": name, "albums": map[string]any{"items": albums}}, nil
 	default:
 		return nil, fmt.Errorf("unsupported deezer media type: %s", mediaType)
 	}
 }
 
-func (c *Client) GetDownloadable(ctx context.Context, item string, _ int) (*provider.Downloadable, error) {
+func (c *Client) getArtistAlbums(ctx context.Context, artistID string) (map[string]any, error) {
-	if strings.TrimSpace(c.arl) == "" {
+	const pageSize = 100
-		return nil, errors.New("deezer native download requires deezer.arl in config")
+	index := 0
+	total := -1
+	all := make([]any, 0)
+	for {
+		params := url.Values{}
+		params.Set("limit", strconv.Itoa(pageSize))
+		params.Set("index", strconv.Itoa(index))
+		resp, err := c.apiGet(ctx, "/artist/"+strings.TrimSpace(artistID)+"/albums", params)
+		if err != nil {
+			return nil, err
 		}
+		data, _ := resp["data"].([]any)
+		all = append(all, data...)
+		if total < 0 {
+			total = intFromAny(resp["total"])
+		}
+		if len(data) < pageSize {
+			break
+		}
+		index += len(data)
+		if total > 0 && index >= total {
+			break
+		}
+	}
+	return map[string]any{"data": all, "total": total}, nil
+}
+
+func (c *Client) GetDownloadable(ctx context.Context, item string, _ int) (*provider.Downloadable, error) {
 	if strings.TrimSpace(c.license) == "" {
+		if strings.TrimSpace(c.arl) != "" {
 			if err := c.refreshSessionFromARL(ctx); err != nil {
 				return nil, err
 			}
+		} else {
+			if strings.TrimSpace(c.refresh) != "" {
+				_ = c.refreshJWT(ctx)
+				if strings.TrimSpace(c.jwt) != "" {
+					_ = c.refreshLicenseFromPipe(ctx)
+				}
+			}
+			email := strings.TrimSpace(c.cfg.Session.Deezer.Email)
+			password := strings.TrimSpace(c.cfg.Session.Deezer.Password)
+			if strings.TrimSpace(c.license) == "" && email != "" && password != "" {
+				if err := c.loginWithCredentials(ctx, email, password); err != nil {
+					return nil, err
+				}
+			}
+		}
+	}
+	if strings.TrimSpace(c.license) == "" {
+		return nil, errors.New("deezer native download requires deezer.arl, deezer.email+deezer.password, or deezer.refresh_token")
 	}
 	meta, err := c.GetMetadata(ctx, item, "track")
 	if err != nil {
@@ -273,7 +373,7 @@ func (c *Client) refreshSessionFromARL(ctx context.Context) error {
 	if err != nil {
 		return err
 	}
-	req.Header.Set("User-Agent", deezerUA)
+	req.Header.Set("User-Agent", c.ua)
 	req.Header.Set("Accept", "application/json")
 	req.Header.Set("Cookie", "arl="+strings.TrimSpace(c.arl))
 
@@ -300,11 +400,156 @@ func (c *Client) refreshSessionFromARL(ctx context.Context) error {
 	if len(results) == 0 {
 		return errors.New("deezer getUserData returned empty results")
 	}
+	c.sid = firstNonEmpty(c.sid, sidFromCookies(c.http, webGWLight))
 	c.license = findStringByKey(results, "license_token")
 	c.userID = findStringByKey(results, "USER_ID")
+	c.jwt = firstNonEmpty(c.jwt, findStringByKey(results, "JWT"))
+	c.refresh = firstNonEmpty(c.refresh, findStringByKey(results, "refresh_token"))
+	if c.sid == "" {
+		if sid, sidErr := c.bootstrapSID(ctx); sidErr == nil {
+			c.sid = sid
+		}
+	}
+	if c.sid != "" && c.userID != "" {
+		_ = c.mobileUserAutolog(ctx)
+	}
+	if c.jwt == "" && c.refresh != "" {
+		_ = c.refreshJWT(ctx)
+	}
+	if c.license == "" && c.jwt != "" {
+		_ = c.refreshLicenseFromPipe(ctx)
+	}
 	if c.license == "" {
 		return errors.New("deezer getUserData missing license_token")
 	}
+	c.persistRefreshToken()
+	return nil
+}
+
+func (c *Client) persistRefreshToken() {
+	if c.cfg == nil {
+		return
+	}
+	rt := strings.TrimSpace(c.refresh)
+	if rt == "" {
+		return
+	}
+	c.cfg.Session.Deezer.RefreshToken = rt
+	c.cfg.File.Deezer.RefreshToken = rt
+	if strings.TrimSpace(c.cfg.Path) != "" {
+		_ = c.cfg.SaveFile()
+	}
+}
+
+func (c *Client) loginWithCredentials(ctx context.Context, email, password string) error {
+	email = strings.TrimSpace(email)
+	password = strings.TrimSpace(password)
+	if email == "" || password == "" {
+		return errors.New("missing deezer credentials")
+	}
+
+	mobileToken, err := c.mobileAuth(ctx)
+	if err != nil {
+		return err
+	}
+	authToken, err := deriveGatewayAuthToken(mobileToken)
+	if err != nil {
+		return err
+	}
+	sid, err := c.apiCheckToken(ctx, authToken)
+	if err != nil {
+		return err
+	}
+	c.sid = firstNonEmpty(c.sid, sid)
+
+	encryptedPassword, err := encryptPassword(mobileToken, password)
+	if err != nil {
+		return err
+	}
+
+	payload := map[string]any{
+		"platform":                          "Xiaomi_lavender_14",
+		"custo_version_id":                  "",
+		"custo_partner":                     nil,
+		"model":                             "Redmi Note 7",
+		"device_name":                       "Redmi Note 7",
+		"device_os":                         "Android",
+		"device_type":                       "phone",
+		"google_play_services_availability": "1",
+		"device_serial":                     c.deviceID,
+		"mail":                              email,
+		"password":                          encryptedPassword,
+	}
+	params := url.Values{}
+	params.Set("api_key", apiKey)
+	params.Set("sid", c.sid)
+	params.Set("method", "mobile_userAuth")
+	params.Set("output", "3")
+	params.Set("input", "3")
+	params.Set("network", randomHexN(32))
+
+	b, _ := json.Marshal(payload)
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, gatewayURL+"?"+params.Encode(), bytes.NewReader(b))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("User-Agent", c.ua)
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Content-Type", "application/json; charset=utf-8")
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	raw, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return err
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("deezer mobile_userAuth failed: status=%d body=%s", resp.StatusCode, string(raw))
+	}
+
+	out := map[string]any{}
+	if err = json.Unmarshal(raw, &out); err != nil {
+		return err
+	}
+	if errObj, ok := out["error"].(map[string]any); ok && len(errObj) > 0 {
+		msg := firstNonEmpty(stringFromAny(errObj["message"]), stringFromAny(errObj["type"]))
+		if msg == "" {
+			msg = "unknown mobile_userAuth error"
+		}
+		return errors.New(msg)
+	}
+	results := nestedMap(out, "results")
+	if len(results) == 0 {
+		return errors.New("mobile_userAuth returned empty results")
+	}
+
+	c.arl = firstNonEmpty(c.arl, findStringByKey(results, "ARL"))
+	c.jwt = firstNonEmpty(c.jwt, findStringByKey(results, "JWT"))
+	c.refresh = firstNonEmpty(c.refresh, findStringByKey(results, "refresh_token"))
+	c.license = firstNonEmpty(c.license, findStringByKey(results, "license_token"))
+	c.userID = firstNonEmpty(c.userID, findStringByKey(results, "USER_ID"))
+
+	if c.arl == "" {
+		return errors.New("mobile_userAuth missing arl")
+	}
+	if c.license == "" {
+		if c.jwt == "" && c.refresh != "" {
+			_ = c.refreshJWT(ctx)
+		}
+		if c.jwt != "" {
+			_ = c.refreshLicenseFromPipe(ctx)
+		}
+		if c.license == "" {
+			_ = c.refreshSessionFromARL(ctx)
+		}
+	}
+	if c.license == "" {
+		return errors.New("mobile_userAuth missing license_token")
+	}
+	c.persistRefreshToken()
 	return nil
 }
 
@@ -320,6 +565,530 @@ func (c *Client) getTrackToken(ctx context.Context, trackID string) (string, err
 	return token, nil
 }
 
+type lyricsResult struct {
+	Text      string
+	SyncedLRC string
+}
+
+var errDeezerJWTExpired = errors.New("deezer jwt expired")
+
+func (c *Client) fetchLyricsFromPipe(ctx context.Context, trackID string) (*lyricsResult, error) {
+	fetchOnce := func(jwt string) (*lyricsResult, error) {
+		query := `query GetLyrics($trackId: String!) { track(trackId: $trackId) { id lyrics { text synchronizedLines { line lineTranslated milliseconds } } } }`
+		body := map[string]any{
+			"operationName": "GetLyrics",
+			"variables":     map[string]any{"trackId": strings.TrimSpace(trackID)},
+			"query":         query,
+		}
+		encoded, err := json.Marshal(body)
+		if err != nil {
+			return nil, err
+		}
+		req, err := http.NewRequestWithContext(ctx, http.MethodPost, pipeURL, bytes.NewReader(encoded))
+		if err != nil {
+			return nil, err
+		}
+		req.Header.Set("User-Agent", c.ua)
+		req.Header.Set("Accept", "application/json")
+		req.Header.Set("Content-Type", "application/json")
+		req.Header.Set("Authorization", "Bearer "+strings.TrimSpace(jwt))
+
+		resp, err := c.http.Do(req)
+		if err != nil {
+			return nil, err
+		}
+		defer func() { _ = resp.Body.Close() }()
+		raw, err := io.ReadAll(resp.Body)
+		if err != nil {
+			return nil, err
+		}
+		if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+			return nil, fmt.Errorf("deezer lyrics query failed: status=%d", resp.StatusCode)
+		}
+		out := map[string]any{}
+		if err = json.Unmarshal(raw, &out); err != nil {
+			return nil, err
+		}
+		if errs, ok := out["errors"].([]any); ok && len(errs) > 0 {
+			msg := ""
+			typ := ""
+			if em, ok := errs[0].(map[string]any); ok {
+				msg = strings.TrimSpace(stringFromAny(em["message"]))
+				typ = strings.TrimSpace(stringFromAny(em["type"]))
+			}
+			if strings.EqualFold(typ, "JwtTokenExpiredError") || strings.Contains(strings.ToLower(msg), "not valid anymore") || strings.Contains(strings.ToLower(msg), "jwt") && strings.Contains(strings.ToLower(msg), "expired") {
+				return nil, errDeezerJWTExpired
+			}
+			if msg == "" {
+				msg = "unknown graphql error"
+			}
+			return nil, errors.New(msg)
+		}
+		lyrics := nestedMap(nestedMap(nestedMap(out, "data"), "track"), "lyrics")
+		text := strings.TrimSpace(stringFromAny(lyrics["text"]))
+		synced := buildSyncedLRC(lyrics["synchronizedLines"])
+		if text != "" || synced != "" {
+			return &lyricsResult{Text: text, SyncedLRC: synced}, nil
+		}
+		lines, _ := lyrics["synchronizedLines"].([]any)
+		parts := make([]string, 0, len(lines))
+		for _, rawLine := range lines {
+			m, ok := rawLine.(map[string]any)
+			if !ok {
+				continue
+			}
+			line := strings.TrimSpace(stringFromAny(m["line"]))
+			if line == "" {
+				line = strings.TrimSpace(stringFromAny(m["lineTranslated"]))
+			}
+			if line != "" {
+				parts = append(parts, line)
+			}
+		}
+		return &lyricsResult{Text: strings.Join(parts, "\n")}, nil
+	}
+
+	if strings.TrimSpace(c.jwt) == "" {
+		if err := c.refreshSessionFromARL(ctx); err != nil {
+			return nil, err
+		}
+	}
+	if strings.TrimSpace(c.jwt) == "" {
+		return nil, errors.New("deezer jwt unavailable for lyrics query")
+	}
+	res, err := fetchOnce(c.jwt)
+	if errors.Is(err, errDeezerJWTExpired) {
+		if strings.TrimSpace(c.refresh) != "" {
+			_ = c.refreshJWT(ctx)
+		}
+		if strings.TrimSpace(c.jwt) == "" && strings.TrimSpace(c.arl) != "" {
+			_ = c.refreshSessionFromARL(ctx)
+		}
+		if strings.TrimSpace(c.jwt) != "" {
+			return fetchOnce(c.jwt)
+		}
+	}
+	return res, err
+}
+
+func buildSyncedLRC(v any) string {
+	lines, _ := v.([]any)
+	if len(lines) == 0 {
+		return ""
+	}
+	out := make([]string, 0, len(lines))
+	for _, rawLine := range lines {
+		m, ok := rawLine.(map[string]any)
+		if !ok {
+			continue
+		}
+		line := strings.TrimSpace(stringFromAny(m["line"]))
+		if line == "" {
+			line = strings.TrimSpace(stringFromAny(m["lineTranslated"]))
+		}
+		if line == "" {
+			continue
+		}
+		ms := intFromAny(m["milliseconds"])
+		out = append(out, fmt.Sprintf("[%02d:%05.2f]%s", ms/60000, float64(ms%60000)/1000.0, line))
+	}
+	return strings.Join(out, "\n")
+}
+
+func (c *Client) bootstrapSID(ctx context.Context) (string, error) {
+	mobileToken, err := c.mobileAuth(ctx)
+	if err != nil {
+		return "", err
+	}
+	authToken, err := deriveGatewayAuthToken(mobileToken)
+	if err != nil {
+		return "", err
+	}
+	return c.apiCheckToken(ctx, authToken)
+}
+
+func (c *Client) mobileAuth(ctx context.Context) (string, error) {
+	if err := c.limiter.Wait(ctx); err != nil {
+		return "", err
+	}
+	params := url.Values{}
+	params.Set("api_key", apiKey)
+	params.Set("output", "3")
+	params.Set("method", "mobile_auth")
+	params.Set("network", randomHexN(32))
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, gatewayURL+"?"+params.Encode(), nil)
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("User-Agent", c.ua)
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	raw, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", err
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return "", fmt.Errorf("mobile_auth failed: status=%d body=%s", resp.StatusCode, string(raw))
+	}
+	out := map[string]any{}
+	if err = json.Unmarshal(raw, &out); err != nil {
+		return "", err
+	}
+	if errObj, ok := out["error"].(map[string]any); ok && len(errObj) > 0 {
+		msg := firstNonEmpty(stringFromAny(errObj["message"]), stringFromAny(errObj["type"]))
+		if msg == "" {
+			msg = "mobile_auth returned an error"
+		}
+		return "", errors.New(msg)
+	}
+	token := findStringByKey(nestedMap(out, "results"), "TOKEN")
+	if token == "" {
+		return "", errors.New("mobile_auth returned empty token")
+	}
+	return token, nil
+}
+
+func (c *Client) apiCheckToken(ctx context.Context, authToken string) (string, error) {
+	if err := c.limiter.Wait(ctx); err != nil {
+		return "", err
+	}
+	params := url.Values{}
+	params.Set("api_key", apiKey)
+	params.Set("method", "api_checkToken")
+	params.Set("auth_token", authToken)
+	params.Set("output", "3")
+	params.Set("network", randomHexN(32))
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, gatewayURL+"?"+params.Encode(), nil)
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("User-Agent", c.ua)
+	req.Header.Set("Accept", "application/json")
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	raw, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", err
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return "", fmt.Errorf("api_checkToken failed: status=%d body=%s", resp.StatusCode, string(raw))
+	}
+	out := map[string]any{}
+	if err = json.Unmarshal(raw, &out); err != nil {
+		return "", err
+	}
+	if errObj, ok := out["error"].(map[string]any); ok && len(errObj) > 0 {
+		msg := firstNonEmpty(stringFromAny(errObj["message"]), stringFromAny(errObj["type"]))
+		if msg == "" {
+			msg = "api_checkToken returned an error"
+		}
+		return "", errors.New(msg)
+	}
+	sid := strings.TrimSpace(stringFromAny(out["results"]))
+	if sid == "" {
+		return "", errors.New("api_checkToken returned empty sid")
+	}
+	return sid, nil
+}
+
+func (c *Client) mobileUserAutolog(ctx context.Context) error {
+	if c.sid == "" || c.userID == "" || c.arl == "" {
+		return errors.New("mobile_userAutolog requires sid, user id, and arl")
+	}
+	payload := map[string]any{
+		"platform":                          "Xiaomi_lavender_14",
+		"custo_version_id":                  "",
+		"custo_partner":                     nil,
+		"model":                             "Redmi Note 7",
+		"device_name":                       "Redmi Note 7",
+		"device_os":                         "Android",
+		"device_type":                       "phone",
+		"google_play_services_availability": "1",
+		"device_serial":                     c.deviceID,
+		"ACCOUNT_ID":                        c.userID,
+		"arl":                               c.arl,
+	}
+	params := url.Values{}
+	params.Set("api_key", apiKey)
+	params.Set("sid", c.sid)
+	params.Set("output", "3")
+	params.Set("input", "3")
+	params.Set("network", randomHexN(32))
+	params.Set("arl", c.arl)
+
+	for _, method := range []string{"mobile_userAutolog", "mobile_userAutoLog"} {
+		if err := c.limiter.Wait(ctx); err != nil {
+			return err
+		}
+		params.Set("method", method)
+		b, _ := json.Marshal(payload)
+		req, err := http.NewRequestWithContext(ctx, http.MethodPost, gatewayURL+"?"+params.Encode(), bytes.NewReader(b))
+		if err != nil {
+			return err
+		}
+		req.Header.Set("User-Agent", c.ua)
+		req.Header.Set("Accept", "application/json")
+		req.Header.Set("Content-Type", "application/json; charset=utf-8")
+		resp, err := c.http.Do(req)
+		if err != nil {
+			continue
+		}
+		raw, _ := io.ReadAll(resp.Body)
+		_ = resp.Body.Close()
+		out := map[string]any{}
+		if json.Unmarshal(raw, &out) != nil {
+			continue
+		}
+		if errObj, ok := out["error"].(map[string]any); ok && len(errObj) > 0 {
+			continue
+		}
+		results := nestedMap(out, "results")
+		if len(results) == 0 {
+			continue
+		}
+		c.jwt = firstNonEmpty(c.jwt, findStringByKey(results, "JWT"))
+		c.refresh = firstNonEmpty(c.refresh, findStringByKey(results, "refresh_token"))
+		c.license = firstNonEmpty(c.license, findStringByKey(results, "license_token"))
+		if c.jwt != "" || c.license != "" {
+			return nil
+		}
+	}
+	return errors.New("mobile_userAutolog failed to produce jwt/license")
+}
+
+func (c *Client) refreshJWT(ctx context.Context) error {
+	if strings.TrimSpace(c.refresh) == "" {
+		return errors.New("missing deezer refresh token")
+	}
+	if err := c.limiter.Wait(ctx); err != nil {
+		return err
+	}
+	body := map[string]string{"refresh_token": c.refresh}
+	b, _ := json.Marshal(body)
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, authURL+"?i=p&jo=p&rto=p", bytes.NewReader(b))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("User-Agent", c.ua)
+	req.Header.Set("Content-Type", "application/json; charset=utf-8")
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	raw, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("jwt refresh failed: status=%d body=%s", resp.StatusCode, string(raw))
+	}
+	out := map[string]any{}
+	if json.Unmarshal(raw, &out) != nil {
+		return errors.New("invalid jwt refresh response")
+	}
+	if errObj, ok := out["error"].(map[string]any); ok && len(errObj) > 0 {
+		msg := firstNonEmpty(stringFromAny(errObj["message"]), stringFromAny(errObj["type"]))
+		if msg == "" {
+			msg = "jwt refresh returned an error"
+		}
+		return errors.New(msg)
+	}
+	if jwt := strings.TrimSpace(stringFromAny(out["jwt"])); jwt != "" {
+		c.jwt = jwt
+	}
+	if rt := strings.TrimSpace(stringFromAny(out["refresh_token"])); rt != "" {
+		c.refresh = rt
+	}
+	if c.jwt == "" {
+		return errors.New("jwt refresh returned empty jwt")
+	}
+	c.persistRefreshToken()
+	return nil
+}
+
+func (c *Client) refreshLicenseFromPipe(ctx context.Context) error {
+	if strings.TrimSpace(c.jwt) == "" {
+		return errors.New("missing deezer jwt")
+	}
+	if err := c.limiter.Wait(ctx); err != nil {
+		return err
+	}
+	body := map[string]any{
+		"operationName": "KmpMpMediaServiceLicenseToken",
+		"query":         "query KmpMpMediaServiceLicenseToken { tokens { mediaServiceLicenseToken { token expirationDate } } }",
+		"variables":     map[string]any{},
+	}
+	b, _ := json.Marshal(body)
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, pipeURL, bytes.NewReader(b))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("User-Agent", c.ua)
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+strings.TrimSpace(c.jwt))
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	raw, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("pipe license refresh failed: status=%d body=%s", resp.StatusCode, string(raw))
+	}
+	out := map[string]any{}
+	if json.Unmarshal(raw, &out) != nil {
+		return errors.New("invalid pipe response")
+	}
+	if errs, ok := out["errors"].([]any); ok && len(errs) > 0 {
+		msg := ""
+		if em, ok := errs[0].(map[string]any); ok {
+			msg = strings.TrimSpace(stringFromAny(em["message"]))
+		}
+		if msg == "" {
+			msg = "pipe response returned graphql error"
+		}
+		return errors.New(msg)
+	}
+	token := findStringByKey(out, "token")
+	if token == "" {
+		return errors.New("pipe response missing license token")
+	}
+	c.license = token
+	return nil
+}
+
+func deriveGatewayAuthToken(mobileToken string) (string, error) {
+	dec, err := decryptMobileToken(mobileToken)
+	if err != nil {
+		return "", err
+	}
+	if len(dec) < 80 {
+		return "", errors.New("decrypted mobile token too short")
+	}
+	decryptKey := []byte(string(dec[:64]))
+	encryptKey := []byte(string(dec[64:80]))
+	enc, err := aesECBEncrypt(encryptKey, decryptKey)
+	if err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(enc), nil
+}
+
+func decryptMobileToken(mobileToken string) ([]byte, error) {
+	b, err := hex.DecodeString(strings.TrimSpace(mobileToken))
+	if err != nil {
+		return nil, err
+	}
+	return aesECBDecrypt([]byte(gatewayDec), b)
+}
+
+func encryptPassword(mobileToken, password string) (string, error) {
+	if strings.TrimSpace(password) == "" {
+		return "", errors.New("missing deezer password")
+	}
+	dec, err := decryptMobileToken(mobileToken)
+	if err != nil {
+		return "", err
+	}
+	if len(dec) < 96 {
+		return "", errors.New("decrypted mobile token too short for password encryption")
+	}
+	key := []byte(string(dec[80:96]))
+	padded := zeroPad([]byte(password), aes.BlockSize)
+	enc, err := aesECBEncrypt(key, padded)
+	if err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(enc), nil
+}
+
+func zeroPad(data []byte, blockSize int) []byte {
+	if blockSize <= 0 {
+		return data
+	}
+	rem := len(data) % blockSize
+	if rem == 0 {
+		return data
+	}
+	out := make([]byte, len(data)+(blockSize-rem))
+	copy(out, data)
+	return out
+}
+
+func aesECBDecrypt(key []byte, data []byte) ([]byte, error) {
+	if len(data)%aes.BlockSize != 0 {
+		return nil, errors.New("ecb decrypt input not multiple of block size")
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]byte, len(data))
+	for i := 0; i < len(data); i += aes.BlockSize {
+		block.Decrypt(out[i:i+aes.BlockSize], data[i:i+aes.BlockSize])
+	}
+	return out, nil
+}
+
+func aesECBEncrypt(key []byte, data []byte) ([]byte, error) {
+	if len(data)%aes.BlockSize != 0 {
+		return nil, errors.New("ecb encrypt input not multiple of block size")
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]byte, len(data))
+	for i := 0; i < len(data); i += aes.BlockSize {
+		block.Encrypt(out[i:i+aes.BlockSize], data[i:i+aes.BlockSize])
+	}
+	return out, nil
+}
+
+func sidFromCookies(client *http.Client, rawURL string) string {
+	if client == nil || client.Jar == nil {
+		return ""
+	}
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return ""
+	}
+	for _, ck := range client.Jar.Cookies(u) {
+		if strings.EqualFold(strings.TrimSpace(ck.Name), "sid") {
+			return strings.TrimSpace(ck.Value)
+		}
+	}
+	return ""
+}
+
+func randomHexN(n int) string {
+	b := make([]byte, n)
+	if _, err := rand.Read(b); err != nil {
+		return fmt.Sprintf("%d", time.Now().UnixNano())
+	}
+	return hex.EncodeToString(b)
+}
+
+func randomDeezerUA() string {
+	if len(deezerUAPool) == 0 {
+		return "Deezer/9.0.11.4 (Android; 14; Mobile; us)"
+	}
+	b := make([]byte, 1)
+	if _, err := rand.Read(b); err != nil {
+		return deezerUAPool[0]
+	}
+	return deezerUAPool[int(b[0])%len(deezerUAPool)]
+}
+
 type mediaResult struct {
 	URL    string
 	Format string
@@ -369,7 +1138,7 @@ func (c *Client) getMediaURLForFormat(ctx context.Context, trackToken, format st
 	if err != nil {
 		return nil, err
 	}
-	req.Header.Set("User-Agent", deezerUA)
+	req.Header.Set("User-Agent", c.ua)
 	req.Header.Set("Accept", "*/*")
 	req.Header.Set("Content-Type", "text/plain; charset=UTF-8")
 
@@ -477,6 +1246,14 @@ func findStringByKey(v any, wantedKey string) string {
 	return ""
 }
 
+func nestedMap(m map[string]any, key string) map[string]any {
+	v, ok := m[key].(map[string]any)
+	if !ok {
+		return map[string]any{}
+	}
+	return v
+}
+
 func enrichTrack(track map[string]any) {
 	if artist, ok := track["artist"].(map[string]any); ok {
 		track["performer"] = map[string]any{"name": stringFromAny(artist["name"]), "id": stringFromAny(artist["id"])}

internal/provider/deezer/client_test.go

@@ -2,6 +2,7 @@ package deezer
 
 import (
 	"context"
+	"encoding/hex"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -38,6 +39,64 @@ func TestSearchTrack(t *testing.T) {
 	}
 }
 
+func TestGetMetadataArtistPaginatesAlbums(t *testing.T) {
+	callCount := 0
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/artist/9":
+			_ = json.NewEncoder(w).Encode(map[string]any{"id": 9, "name": "Lost Frequencies"})
+		case "/artist/9/albums":
+			callCount++
+			index := r.URL.Query().Get("index")
+			limit := r.URL.Query().Get("limit")
+			if limit != "100" {
+				w.WriteHeader(http.StatusBadRequest)
+				_ = json.NewEncoder(w).Encode(map[string]any{"error": map[string]any{"message": "bad limit"}})
+				return
+			}
+			switch index {
+			case "0":
+				items := make([]any, 0, 100)
+				for i := 0; i < 100; i++ {
+					items = append(items, map[string]any{"id": i + 1, "title": "Album"})
+				}
+				_ = json.NewEncoder(w).Encode(map[string]any{"data": items, "total": 101})
+			case "100":
+				_ = json.NewEncoder(w).Encode(map[string]any{"data": []any{map[string]any{"id": 101, "title": "Album 101"}}, "total": 101})
+			default:
+				w.WriteHeader(http.StatusBadRequest)
+			}
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer ts.Close()
+
+	cfgData := config.DefaultConfigData()
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+	c.loggedIn = true
+
+	origBase := baseURL
+	baseURL = ts.URL
+	defer func() { baseURL = origBase }()
+
+	meta, err := c.GetMetadata(context.Background(), "9", "artist")
+	if err != nil {
+		t.Fatalf("GetMetadata() error = %v", err)
+	}
+	albumsObj, _ := meta["albums"].(map[string]any)
+	items, _ := albumsObj["items"].([]any)
+	if len(items) != 101 {
+		t.Fatalf("albums len = %d, want 101", len(items))
+	}
+	if got := strings.TrimSpace(stringFromAny(meta["name"])); got != "Lost Frequencies" {
+		t.Fatalf("artist name = %q, want Lost Frequencies", got)
+	}
+	if callCount != 2 {
+		t.Fatalf("call count = %d, want 2", callCount)
+	}
+}
+
 func TestGetDownloadableNativeCipher(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
@@ -57,14 +116,18 @@ func TestGetDownloadableNativeCipher(t *testing.T) {
 	c.loggedIn = true
 	c.arl = "arl"
 	c.license = "license"
+	c.jwt = "jwt"
 
 	origBase := baseURL
 	origMedia := mediaURL
+	origPipe := pipeURL
 	baseURL = ts.URL
 	mediaURL = ts.URL + "/media"
+	pipeURL = ts.URL + "/pipe"
 	defer func() {
 		baseURL = origBase
 		mediaURL = origMedia
+		pipeURL = origPipe
 	}()
 
 	d, err := c.GetDownloadable(context.Background(), "42", 2)
@@ -106,14 +169,18 @@ func TestGetDownloadableDRMError(t *testing.T) {
 	c.loggedIn = true
 	c.arl = "arl"
 	c.license = "license"
+	c.jwt = "jwt"
 
 	origBase := baseURL
 	origMedia := mediaURL
+	origPipe := pipeURL
 	baseURL = ts.URL
 	mediaURL = ts.URL + "/media"
+	pipeURL = ts.URL + "/pipe"
 	defer func() {
 		baseURL = origBase
 		mediaURL = origMedia
+		pipeURL = origPipe
 	}()
 
 	_, err := c.GetDownloadable(context.Background(), "42", 2)
@@ -121,3 +188,195 @@ func TestGetDownloadableDRMError(t *testing.T) {
 		t.Fatalf("expected drm error, got %v", err)
 	}
 }
+
+func TestGetMetadataAddsLyricsFromPipe(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/track/1141668":
+			_ = json.NewEncoder(w).Encode(map[string]any{"id": 1141668, "title": "In Da Club", "artist": map[string]any{"name": "50 Cent"}})
+		case "/pipe":
+			_ = json.NewEncoder(w).Encode(map[string]any{"data": map[string]any{"track": map[string]any{"lyrics": map[string]any{"text": "Go, go, go\nGo shawty", "synchronizedLines": []any{map[string]any{"line": "Go, go, go", "milliseconds": 0}, map[string]any{"line": "Go shawty", "milliseconds": 4280}}}}}})
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer ts.Close()
+
+	cfgData := config.DefaultConfigData()
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+	c.loggedIn = true
+	c.jwt = "jwt"
+
+	origBase := baseURL
+	origPipe := pipeURL
+	baseURL = ts.URL
+	pipeURL = ts.URL + "/pipe"
+	defer func() {
+		baseURL = origBase
+		pipeURL = origPipe
+	}()
+
+	meta, err := c.GetMetadata(context.Background(), "1141668", "track")
+	if err != nil {
+		t.Fatalf("GetMetadata() error = %v", err)
+	}
+	if !strings.Contains(stringFromAny(meta["lyrics"]), "Go shawty") {
+		t.Fatalf("expected lyrics text, got %q", stringFromAny(meta["lyrics"]))
+	}
+	if !strings.Contains(stringFromAny(meta["lyrics_synced"]), "[00:00.00]Go, go, go") {
+		t.Fatalf("expected synced lyrics, got %q", stringFromAny(meta["lyrics_synced"]))
+	}
+}
+
+func TestLoginWithCredentials(t *testing.T) {
+	mobileToken := testMobileToken(t)
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/gateway" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		switch r.URL.Query().Get("method") {
+		case "mobile_auth":
+			_ = json.NewEncoder(w).Encode(map[string]any{"results": map[string]any{"TOKEN": mobileToken}})
+		case "api_checkToken":
+			_ = json.NewEncoder(w).Encode(map[string]any{"results": "sid123"})
+		case "mobile_userAuth":
+			var payload map[string]any
+			_ = json.NewDecoder(r.Body).Decode(&payload)
+			if strings.TrimSpace(stringFromAny(payload["mail"])) == "" || strings.TrimSpace(stringFromAny(payload["password"])) == "" {
+				w.WriteHeader(http.StatusBadRequest)
+				_ = json.NewEncoder(w).Encode(map[string]any{"error": map[string]any{"message": "missing creds"}})
+				return
+			}
+			_ = json.NewEncoder(w).Encode(map[string]any{"results": map[string]any{"ARL": "arl-token", "JWT": "jwt-token", "refresh_token": "refresh-token", "license_token": "license-token", "USER_ID": "42"}})
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer ts.Close()
+
+	cfgData := config.DefaultConfigData()
+	cfgData.Deezer.Email = "tidal1@alpin.sbs"
+	cfgData.Deezer.Password = "tidal1@alpin.sbs"
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+
+	origGateway := gatewayURL
+	gatewayURL = ts.URL + "/gateway"
+	defer func() { gatewayURL = origGateway }()
+
+	if err := c.Login(context.Background()); err != nil {
+		t.Fatalf("Login() error = %v", err)
+	}
+	if !c.loggedIn {
+		t.Fatalf("expected logged in client")
+	}
+	if c.arl != "arl-token" {
+		t.Fatalf("arl = %q, want arl-token", c.arl)
+	}
+	if c.jwt != "jwt-token" {
+		t.Fatalf("jwt = %q, want jwt-token", c.jwt)
+	}
+	if c.refresh != "refresh-token" {
+		t.Fatalf("refresh = %q, want refresh-token", c.refresh)
+	}
+	if c.license != "license-token" {
+		t.Fatalf("license = %q, want license-token", c.license)
+	}
+	if c.cfg.Session.Deezer.RefreshToken != "refresh-token" {
+		t.Fatalf("session refresh token = %q", c.cfg.Session.Deezer.RefreshToken)
+	}
+	if c.cfg.File.Deezer.RefreshToken != "refresh-token" {
+		t.Fatalf("file refresh token = %q", c.cfg.File.Deezer.RefreshToken)
+	}
+}
+
+func testMobileToken(t *testing.T) string {
+	t.Helper()
+	plain := []byte(strings.Repeat("A", 64) + strings.Repeat("B", 16) + strings.Repeat("C", 16))
+	enc, err := aesECBEncrypt([]byte(gatewayDec), plain)
+	if err != nil {
+		t.Fatalf("aesECBEncrypt() error = %v", err)
+	}
+	return hex.EncodeToString(enc)
+}
+
+func TestLoginWithRefreshToken(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/renew":
+			_ = json.NewEncoder(w).Encode(map[string]any{"jwt": "jwt-token", "refresh_token": "refresh-token-2"})
+		case "/pipe":
+			_ = json.NewEncoder(w).Encode(map[string]any{"data": map[string]any{"tokens": map[string]any{"mediaServiceLicenseToken": map[string]any{"token": "license-token"}}}})
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer ts.Close()
+
+	cfgData := config.DefaultConfigData()
+	cfgData.Deezer.RefreshToken = "refresh-token"
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+
+	origAuth := authURL
+	origPipe := pipeURL
+	authURL = ts.URL + "/renew"
+	pipeURL = ts.URL + "/pipe"
+	defer func() {
+		authURL = origAuth
+		pipeURL = origPipe
+	}()
+
+	if err := c.Login(context.Background()); err != nil {
+		t.Fatalf("Login() error = %v", err)
+	}
+	if !c.loggedIn {
+		t.Fatalf("expected logged in client")
+	}
+	if c.jwt != "jwt-token" || c.license != "license-token" {
+		t.Fatalf("unexpected jwt/license: jwt=%q license=%q", c.jwt, c.license)
+	}
+	if c.cfg.Session.Deezer.RefreshToken != "refresh-token-2" {
+		t.Fatalf("session refresh token = %q", c.cfg.Session.Deezer.RefreshToken)
+	}
+}
+
+func TestRefreshJWTHTTPError(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusUnauthorized)
+		_ = json.NewEncoder(w).Encode(map[string]any{"error": map[string]any{"message": "bad refresh"}})
+	}))
+	defer ts.Close()
+
+	cfgData := config.DefaultConfigData()
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+	c.refresh = "refresh-token"
+
+	origAuth := authURL
+	authURL = ts.URL
+	defer func() { authURL = origAuth }()
+
+	err := c.refreshJWT(context.Background())
+	if err == nil || !strings.Contains(strings.ToLower(err.Error()), "status=401") {
+		t.Fatalf("expected http status error, got %v", err)
+	}
+}
+
+func TestRefreshLicenseFromPipeGraphQLError(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_ = json.NewEncoder(w).Encode(map[string]any{"errors": []any{map[string]any{"message": "token expired"}}})
+	}))
+	defer ts.Close()
+
+	cfgData := config.DefaultConfigData()
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+	c.jwt = "jwt-token"
+
+	origPipe := pipeURL
+	pipeURL = ts.URL
+	defer func() { pipeURL = origPipe }()
+
+	err := c.refreshLicenseFromPipe(context.Background())
+	if err == nil || !strings.Contains(strings.ToLower(err.Error()), "token expired") {
+		t.Fatalf("expected graphql error, got %v", err)
+	}
+}

internal/provider/qobuz/client.go

@@ -35,6 +35,7 @@ type Client struct {
 	http     *http.Client
 	limiter  *ratelimit.Limiter
 	baseURL  string
+	fetchCfg func(ctx context.Context) (string, []string, error)
 	loggedIn bool
 	secret   string
 	uat      string
@@ -46,6 +47,7 @@ func New(cfg *config.Config) *Client {
 		http:     netutil.NewHTTPClient(30*time.Second, cfg.Session.Downloads.VerifySSL),
 		limiter:  ratelimit.New(cfg.Session.Downloads.RequestsPerMinute),
 		baseURL:  baseURL,
+		fetchCfg: nil,
 	}
 }
 
@@ -59,22 +61,18 @@ func (c *Client) LoggedIn() bool {
 
 func (c *Client) Login(ctx context.Context) error {
 	q := &c.cfg.Session.Qobuz
+	q.EmailOrUserID = strings.TrimSpace(q.EmailOrUserID)
+	q.PasswordOrToken = strings.TrimSpace(q.PasswordOrToken)
 	if q.EmailOrUserID == "" || q.PasswordOrToken == "" {
 		return errMissingCredentials
 	}
 
-	if q.AppID == "" || len(q.Secrets) == 0 {
+	refreshed := false
-		appID, secrets, err := c.fetchAppIDAndSecrets(ctx)
+	if err := c.ensureAppCredentials(ctx, q); err != nil {
-		if err != nil {
 		return err
 	}
-		q.AppID = appID
-		q.Secrets = secrets
-		c.cfg.File.Qobuz.AppID = appID
-		c.cfg.File.Qobuz.Secrets = append([]string(nil), secrets...)
-		_ = c.cfg.SaveFile()
-	}
 
+	loginOnce := func() (map[string]any, int, error) {
 		headers := map[string]string{"X-App-Id": q.AppID}
 		params := url.Values{}
 		params.Set("app_id", q.AppID)
@@ -85,11 +83,22 @@ func (c *Client) Login(ctx context.Context) error {
 			params.Set("email", q.EmailOrUserID)
 			params.Set("password", q.PasswordOrToken)
 		}
+		return c.apiRequest(ctx, "user/login", params, headers)
+	}
 
-	resp, status, err := c.apiRequest(ctx, "user/login", params, headers)
+	resp, status, err := loginOnce()
 	if err != nil {
 		return err
 	}
+	if status != http.StatusOK && !refreshed {
+		if refreshErr := c.refreshAppCredentials(ctx, q); refreshErr == nil {
+			refreshed = true
+			resp, status, err = loginOnce()
+			if err != nil {
+				return err
+			}
+		}
+	}
 	if status != http.StatusOK {
 		return fmt.Errorf("qobuz login failed: status=%d body=%v", status, resp)
 	}
@@ -99,8 +108,15 @@ func (c *Client) Login(ctx context.Context) error {
 		return fmt.Errorf("qobuz login missing user_auth_token")
 	}
 
-	headers["X-User-Auth-Token"] = uat
+	headers := map[string]string{"X-App-Id": q.AppID, "X-User-Auth-Token": uat}
 	validSecret, err := c.getValidSecret(ctx, q.Secrets, headers)
+	if err != nil && !refreshed {
+		if refreshErr := c.refreshAppCredentials(ctx, q); refreshErr == nil {
+			refreshed = true
+			headers["X-App-Id"] = q.AppID
+			validSecret, err = c.getValidSecret(ctx, q.Secrets, headers)
+		}
+	}
 	if err != nil {
 		return err
 	}
@@ -112,6 +128,43 @@ func (c *Client) Login(ctx context.Context) error {
 	return nil
 }
 
+func (c *Client) ensureAppCredentials(ctx context.Context, q *config.QobuzConfig) error {
+	q.AppID = strings.TrimSpace(q.AppID)
+	if q.AppID != "" && len(q.Secrets) > 0 {
+		return nil
+	}
+	return c.refreshAppCredentials(ctx, q)
+}
+
+func (c *Client) refreshAppCredentials(ctx context.Context, q *config.QobuzConfig) error {
+	fetch := c.fetchCfg
+	if fetch == nil {
+		fetch = c.fetchAppIDAndSecrets
+	}
+	appID, secrets, err := fetch(ctx)
+	if err != nil {
+		return err
+	}
+	q.AppID = strings.TrimSpace(appID)
+	if q.AppID == "" {
+		return errors.New("qobuz app credential refresh returned empty app_id")
+	}
+	clean := make([]string, 0, len(secrets))
+	for _, s := range secrets {
+		if v := strings.TrimSpace(s); v != "" {
+			clean = append(clean, v)
+		}
+	}
+	if len(clean) == 0 {
+		return errors.New("qobuz app credential refresh returned no secrets")
+	}
+	q.Secrets = append([]string(nil), clean...)
+	c.cfg.File.Qobuz.AppID = q.AppID
+	c.cfg.File.Qobuz.Secrets = append([]string(nil), clean...)
+	_ = c.cfg.SaveFile()
+	return nil
+}
+
 func (c *Client) GetMetadata(ctx context.Context, item, mediaType string) (map[string]any, error) {
 	if !c.loggedIn {
 		return nil, errNotLoggedIn
@@ -122,6 +175,9 @@ func (c *Client) GetMetadata(ctx context.Context, item, mediaType string) (map[s
 	if mediaType == "label" {
 		return c.getLabel(ctx, item)
 	}
+	if mediaType == "artist" {
+		return c.getArtist(ctx, item)
+	}
 
 	params := url.Values{}
 	params.Set("app_id", c.cfg.Session.Qobuz.AppID)
@@ -130,8 +186,6 @@ func (c *Client) GetMetadata(ctx context.Context, item, mediaType string) (map[s
 	params.Set("offset", "0")
 
 	switch mediaType {
-	case "artist":
-		params.Set("extra", "albums")
 	case "playlist":
 		params.Set("extra", "tracks")
 	case "label":
@@ -214,14 +268,12 @@ func (c *Client) GetDownloadable(ctx context.Context, item string, quality int)
 	}
 
 	streamURL, _ := resp["url"].(string)
+	streamURL = strings.TrimSpace(streamURL)
 	if streamURL == "" {
 		return nil, fmt.Errorf("track is not streamable")
 	}
 
-	ext := "mp3"
+	ext := qobuzDownloadExtension(resp, quality, streamURL)
-	if quality > 1 {
-		ext = "flac"
-	}
 
 	return &provider.Downloadable{
 		URL:       streamURL,
@@ -230,6 +282,41 @@ func (c *Client) GetDownloadable(ctx context.Context, item string, quality int)
 	}, nil
 }
 
+func qobuzDownloadExtension(resp map[string]any, quality int, streamURL string) string {
+	if parsed, err := url.Parse(strings.TrimSpace(streamURL)); err == nil {
+		p := strings.ToLower(parsed.Path)
+		if strings.HasSuffix(p, ".flac") {
+			return "flac"
+		}
+		if strings.HasSuffix(p, ".mp3") {
+			return "mp3"
+		}
+	}
+
+	mimeType, _ := resp["mime_type"].(string)
+	mimeType = strings.ToLower(strings.TrimSpace(mimeType))
+	if strings.Contains(mimeType, "flac") {
+		return "flac"
+	}
+	if strings.Contains(mimeType, "mpeg") || strings.Contains(mimeType, "mp3") {
+		return "mp3"
+	}
+
+	if formatID, ok := intValue(resp["format_id"]); ok {
+		if formatID == 5 {
+			return "mp3"
+		}
+		if formatID > 5 {
+			return "flac"
+		}
+	}
+
+	if quality > 1 {
+		return "flac"
+	}
+	return "mp3"
+}
+
 func (c *Client) Close() error {
 	return nil
 }
@@ -358,6 +445,77 @@ func (c *Client) getLabel(ctx context.Context, labelID string) (map[string]any,
 	return resp, nil
 }
 
+func (c *Client) getArtist(ctx context.Context, artistID string) (map[string]any, error) {
+	pageLimit := 500
+	params := url.Values{}
+	params.Set("app_id", c.cfg.Session.Qobuz.AppID)
+	params.Set("artist_id", artistID)
+	params.Set("limit", strconv.Itoa(pageLimit))
+	params.Set("offset", "0")
+	params.Set("extra", "albums")
+
+	resp, status, err := c.apiRequest(ctx, "artist/get", params, c.authHeaders())
+	if err != nil {
+		return nil, err
+	}
+	if status != http.StatusOK {
+		return nil, fmt.Errorf("artist/get failed: status=%d", status)
+	}
+
+	albumsObj, ok := mapValue(resp["albums"])
+	if !ok {
+		return resp, nil
+	}
+	items, ok := albumsObj["items"].([]any)
+	if !ok {
+		return resp, nil
+	}
+
+	total, _ := intValue(resp["albums_count"])
+	if total <= 0 {
+		total, _ = intValue(albumsObj["total"])
+	}
+	if total <= pageLimit && len(items) < pageLimit {
+		return resp, nil
+	}
+
+	for offset := pageLimit; ; offset += pageLimit {
+		if total > 0 && offset >= total {
+			break
+		}
+		pageParams := url.Values{}
+		pageParams.Set("app_id", c.cfg.Session.Qobuz.AppID)
+		pageParams.Set("artist_id", artistID)
+		pageParams.Set("limit", strconv.Itoa(pageLimit))
+		pageParams.Set("offset", strconv.Itoa(offset))
+		pageParams.Set("extra", "albums")
+
+		pageResp, pageStatus, pageErr := c.apiRequest(ctx, "artist/get", pageParams, c.authHeaders())
+		if pageErr != nil {
+			return nil, pageErr
+		}
+		if pageStatus != http.StatusOK {
+			return nil, fmt.Errorf("artist/get pagination failed: status=%d offset=%d", pageStatus, offset)
+		}
+		pageAlbums, ok := mapValue(pageResp["albums"])
+		if !ok {
+			break
+		}
+		pageItems, ok := pageAlbums["items"].([]any)
+		if !ok || len(pageItems) == 0 {
+			break
+		}
+		items = append(items, pageItems...)
+		if len(pageItems) < pageLimit {
+			break
+		}
+	}
+
+	albumsObj["items"] = items
+	resp["albums"] = albumsObj
+	return resp, nil
+}
+
 func (c *Client) authHeaders() map[string]string {
 	headers := map[string]string{"X-App-Id": c.cfg.Session.Qobuz.AppID}
 	if c.uat != "" {

internal/provider/qobuz/client_test.go

@@ -2,6 +2,8 @@ package qobuz
 
 import (
 	"context"
+	"crypto/md5"
+	"encoding/hex"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -157,6 +159,53 @@ func TestGetLabelPagination(t *testing.T) {
 	}
 }
 
+func TestGetArtistPagination(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		offset := r.URL.Query().Get("offset")
+		if offset == "" {
+			offset = "0"
+		}
+
+		resp := map[string]any{}
+		switch offset {
+		case "0":
+			resp = map[string]any{
+				"albums_count": 620,
+				"albums":       map[string]any{"items": makeItems(0, 500)},
+			}
+		case "500":
+			resp = map[string]any{"albums": map[string]any{"items": makeItems(500, 620)}}
+		default:
+			w.WriteHeader(http.StatusNotFound)
+			_ = json.NewEncoder(w).Encode(map[string]any{"message": "not found"})
+			return
+		}
+
+		_ = json.NewEncoder(w).Encode(resp)
+	}))
+	defer ts.Close()
+
+	c := newTestClient(t)
+	c.loggedIn = true
+	c.baseURL = ts.URL
+
+	raw, err := c.GetMetadata(context.Background(), "artist-id", "artist")
+	if err != nil {
+		t.Fatalf("GetMetadata() error = %v", err)
+	}
+	albums, ok := mapValue(raw["albums"])
+	if !ok {
+		t.Fatalf("albums missing")
+	}
+	items, ok := albums["items"].([]any)
+	if !ok {
+		t.Fatalf("items missing")
+	}
+	if len(items) != 620 {
+		t.Fatalf("len(items) = %d, want 620", len(items))
+	}
+}
+
 func newTestClient(t *testing.T) *Client {
 	t.Helper()
 	d := config.DefaultConfigData()
@@ -172,3 +221,167 @@ func makeItems(start, end int) []map[string]any {
 	}
 	return items
 }
+
+func TestLoginRefreshesAppCredentialsWhenSecretInvalid(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/user/login":
+			_ = json.NewEncoder(w).Encode(map[string]any{"user_auth_token": "uat-token"})
+		case "/track/getFileUrl":
+			if r.Header.Get("X-App-Id") != "new-app" {
+				w.WriteHeader(http.StatusBadRequest)
+				_ = json.NewEncoder(w).Encode(map[string]any{"message": "bad app"})
+				return
+			}
+			tsValue := r.URL.Query().Get("request_ts")
+			sig := r.URL.Query().Get("request_sig")
+			if sig != qobuzSecretSig(tsValue, "good-secret") {
+				w.WriteHeader(http.StatusBadRequest)
+				_ = json.NewEncoder(w).Encode(map[string]any{"message": "bad secret"})
+				return
+			}
+			w.WriteHeader(http.StatusUnauthorized)
+			_ = json.NewEncoder(w).Encode(map[string]any{"message": "ok secret"})
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer ts.Close()
+
+	d := config.DefaultConfigData()
+	d.Qobuz.EmailOrUserID = "user@example.com"
+	d.Qobuz.PasswordOrToken = "hash"
+	d.Qobuz.AppID = "old-app"
+	d.Qobuz.Secrets = []string{"bad-secret"}
+	cfg := &config.Config{File: d, Session: d}
+	c := New(cfg)
+	c.baseURL = ts.URL
+	c.fetchCfg = func(context.Context) (string, []string, error) {
+		return "new-app", []string{"good-secret"}, nil
+	}
+
+	if err := c.Login(context.Background()); err != nil {
+		t.Fatalf("Login() error = %v", err)
+	}
+	if !c.loggedIn {
+		t.Fatalf("expected logged-in client")
+	}
+	if c.secret != "good-secret" {
+		t.Fatalf("secret = %q, want good-secret", c.secret)
+	}
+	if c.cfg.Session.Qobuz.AppID != "new-app" {
+		t.Fatalf("session app id = %q", c.cfg.Session.Qobuz.AppID)
+	}
+}
+
+func TestLoginRetriesAfterRefreshingAppCredentials(t *testing.T) {
+	loginCalls := 0
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/user/login":
+			loginCalls++
+			if r.URL.Query().Get("app_id") != "new-app" {
+				w.WriteHeader(http.StatusUnauthorized)
+				_ = json.NewEncoder(w).Encode(map[string]any{"message": "expired app id"})
+				return
+			}
+			_ = json.NewEncoder(w).Encode(map[string]any{"user_auth_token": "uat-token"})
+		case "/track/getFileUrl":
+			tsValue := r.URL.Query().Get("request_ts")
+			sig := r.URL.Query().Get("request_sig")
+			if r.Header.Get("X-App-Id") == "new-app" && sig == qobuzSecretSig(tsValue, "good-secret") {
+				w.WriteHeader(http.StatusUnauthorized)
+				_ = json.NewEncoder(w).Encode(map[string]any{"message": "ok secret"})
+				return
+			}
+			w.WriteHeader(http.StatusBadRequest)
+			_ = json.NewEncoder(w).Encode(map[string]any{"message": "bad secret"})
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer ts.Close()
+
+	d := config.DefaultConfigData()
+	d.Qobuz.EmailOrUserID = "user@example.com"
+	d.Qobuz.PasswordOrToken = "hash"
+	d.Qobuz.AppID = "old-app"
+	d.Qobuz.Secrets = []string{"old-secret"}
+	cfg := &config.Config{File: d, Session: d}
+	c := New(cfg)
+	c.baseURL = ts.URL
+	c.fetchCfg = func(context.Context) (string, []string, error) {
+		return "new-app", []string{"good-secret"}, nil
+	}
+
+	if err := c.Login(context.Background()); err != nil {
+		t.Fatalf("Login() error = %v", err)
+	}
+	if loginCalls < 2 {
+		t.Fatalf("expected login retry after refresh, calls=%d", loginCalls)
+	}
+}
+
+func TestQobuzDownloadExtension(t *testing.T) {
+	tests := []struct {
+		name    string
+		resp    map[string]any
+		quality int
+		url     string
+		want    string
+	}{
+		{name: "from url flac", resp: map[string]any{}, quality: 1, url: "https://cdn.example/a.flac?token=1", want: "flac"},
+		{name: "from url mp3", resp: map[string]any{}, quality: 4, url: "https://cdn.example/a.mp3", want: "mp3"},
+		{name: "from mime type", resp: map[string]any{"mime_type": "audio/flac"}, quality: 1, url: "https://cdn.example/stream", want: "flac"},
+		{name: "from format id", resp: map[string]any{"format_id": float64(5)}, quality: 4, url: "https://cdn.example/stream", want: "mp3"},
+		{name: "fallback quality", resp: map[string]any{}, quality: 3, url: "https://cdn.example/stream", want: "flac"},
+	}
+
+	for _, tt := range tests {
+		if got := qobuzDownloadExtension(tt.resp, tt.quality, tt.url); got != tt.want {
+			t.Fatalf("%s: qobuzDownloadExtension()=%q want %q", tt.name, got, tt.want)
+		}
+	}
+}
+
+func TestGetDownloadableUsesReturnedURLExtension(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/track/getFileUrl" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{"url": "https://cdn.example/track.mp3?token=abc"})
+	}))
+	defer ts.Close()
+
+	c := newTestClient(t)
+	c.loggedIn = true
+	c.secret = "secret"
+	c.baseURL = ts.URL
+
+	d, err := c.GetDownloadable(context.Background(), "19512574", 4)
+	if err != nil {
+		t.Fatalf("GetDownloadable() error = %v", err)
+	}
+	if d.Extension != "mp3" {
+		t.Fatalf("extension = %q, want mp3", d.Extension)
+	}
+}
+
+func qobuzSecretSig(requestTS, secret string) string {
+	raw := "trackgetFileUrlformat_id27intentstreamtrack_id19512574" + requestTS + secret
+	hash := md5.Sum([]byte(raw))
+	return hex.EncodeToString(hash[:])
+}
+
+func TestRefreshAppCredentialsRejectsEmptyData(t *testing.T) {
+	d := config.DefaultConfigData()
+	c := New(&config.Config{File: d, Session: d})
+	c.fetchCfg = func(context.Context) (string, []string, error) {
+		return "", []string{" "}, nil
+	}
+	err := c.refreshAppCredentials(context.Background(), &c.cfg.Session.Qobuz)
+	if err == nil {
+		t.Fatalf("expected error for empty refreshed app credentials")
+	}
+}

internal/provider/soundcloud/client.go

@@ -146,7 +146,7 @@ func (c *Client) searchPlaylists(ctx context.Context, query string, limit int) (
 		return nil, err
 	}
 
-	re := regexp.MustCompile(`/[A-Za-z0-9_-]+/sets/[A-Za-z0-9_-]+`)
+	re := regexp.MustCompile(`/(?:[A-Za-z0-9._-]+)/sets/(?:[A-Za-z0-9._%~-]+)`)
 	paths := re.FindAllString(string(body), -1)
 	if len(paths) == 0 {
 		return []map[string]any{}, nil
@@ -435,10 +435,11 @@ func canonicalSoundcloudURL(info map[string]any) string {
 			continue
 		}
 		host := strings.ToLower(strings.TrimPrefix(u.Host, "www."))
-		if host != "soundcloud.com" {
+		if host != "soundcloud.com" && !strings.HasSuffix(host, ".soundcloud.com") {
 			continue
 		}
 		u.Scheme = "https"
+		u.Host = "soundcloud.com"
 		u.RawQuery = ""
 		u.Fragment = ""
 		u.Path = strings.TrimSuffix(u.Path, "/")

internal/provider/soundcloud/client_test.go

@@ -152,6 +152,51 @@ func TestSearchPlaylist(t *testing.T) {
 	}
 }
 
+func TestSearchPlaylistAcceptsDotsInPath(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/search/sets" {
+			_, _ = w.Write([]byte(`<html><body><a href="/artist.name/sets/road.trip">x</a></body></html>`))
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer ts.Close()
+
+	cfgData := config.DefaultConfigData()
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+	c.loggedIn = true
+	c.http = ts.Client()
+	origBase := soundcloudSearchBaseURL
+	soundcloudSearchBaseURL = ts.URL
+	defer func() { soundcloudSearchBaseURL = origBase }()
+	c.run = func(_ context.Context, _ string, args ...string) ([]byte, error) {
+		joined := strings.Join(args, " ")
+		if strings.Contains(joined, "https://soundcloud.com/artist.name/sets/road.trip") {
+			return []byte(`{"title":"Road Trip","uploader":"User","entries":[{"webpage_url":"https://soundcloud.com/a/t1"}]}`), nil
+		}
+		return nil, fmt.Errorf("unexpected args: %v", args)
+	}
+
+	pages, err := c.Search(context.Background(), "playlist", "road trip", 5)
+	if err != nil {
+		t.Fatalf("Search() error = %v", err)
+	}
+	if len(pages) != 1 {
+		t.Fatalf("pages len = %d, want 1", len(pages))
+	}
+	items := asAnySlice(pages[0]["items"])
+	if len(items) != 1 {
+		t.Fatalf("items len = %d, want 1", len(items))
+	}
+	item0, ok := items[0].(map[string]any)
+	if !ok {
+		t.Fatalf("expected first item map")
+	}
+	if stringFromAny(item0["id"]) != "https://soundcloud.com/artist.name/sets/road.trip" {
+		t.Fatalf("playlist search id not canonical: %q", stringFromAny(item0["id"]))
+	}
+}
+
 func TestLoginShowsYtDlpHint(t *testing.T) {
 	cfgData := config.DefaultConfigData()
 	c := New(&config.Config{File: cfgData, Session: cfgData})
@@ -197,3 +242,10 @@ func TestCanonicalSoundcloudURL(t *testing.T) {
 		t.Fatalf("canonical url = %q, want %q", got, "https://soundcloud.com/a/b")
 	}
 }
+
+func TestCanonicalSoundcloudURLAcceptsSubdomain(t *testing.T) {
+	got := canonicalSoundcloudURL(map[string]any{"webpage_url": "https://m.soundcloud.com/a/b/?si=x#frag"})
+	if got != "https://soundcloud.com/a/b" {
+		t.Fatalf("canonical url = %q, want %q", got, "https://soundcloud.com/a/b")
+	}
+}

internal/provider/tidal/client.go

@@ -44,6 +44,8 @@ var qualityToFormat = map[int]string{
 	4: "FLAC_HIRES",
 }
 
+var atmosAudioQualities = []string{"HI_RES_LOSSLESS", "HI_RES", "LOSSLESS", "HIGH"}
+
 var ErrMissingTidalToken = errors.New("missing tidal access_token")
 
 type Client struct {
@@ -241,6 +243,14 @@ func (c *Client) GetDownloadable(ctx context.Context, trackID string, quality in
 		quality = c.cfg.Session.Tidal.Quality
 	}
 
+	if c.cfg.Session.Tidal.PreferAtmos {
+		if c.trackSupportsAtmos(ctx, trackID) {
+			if d, _ := c.getAtmosDownloadable(ctx, trackID); d != nil {
+				return d, nil
+			}
+		}
+	}
+
 	params := url.Values{}
 	params.Set("audioquality", qualityMap[quality])
 	params.Set("playbackmode", "STREAM")
@@ -259,6 +269,111 @@ func (c *Client) GetDownloadable(ctx context.Context, trackID string, quality in
 	return c.getDownloadableFromTrackManifest(ctx, trackID, quality)
 }
 
+func (c *Client) trackSupportsAtmos(ctx context.Context, trackID string) bool {
+	resp, status, err := c.apiRequest(ctx, "tracks/"+trackID, url.Values{}, c.baseURL)
+	if err != nil || status != http.StatusOK {
+		return false
+	}
+	if modes, ok := resp["audioModes"].([]any); ok {
+		for _, mode := range modes {
+			if strings.Contains(strings.ToUpper(stringify(mode)), "ATMOS") {
+				return true
+			}
+		}
+	}
+	if mm, ok := resp["mediaMetadata"].(map[string]any); ok {
+		if tags, ok := mm["tags"].([]any); ok {
+			for _, tag := range tags {
+				if strings.Contains(strings.ToUpper(stringify(tag)), "ATMOS") {
+					return true
+				}
+			}
+		}
+	}
+	return false
+}
+
+func (c *Client) getAtmosDownloadable(ctx context.Context, trackID string) (*provider.Downloadable, error) {
+	var lastErr error
+	for _, aq := range atmosAudioQualities {
+		params := url.Values{}
+		params.Set("audioquality", aq)
+		params.Set("playbackmode", "STREAM")
+		params.Set("assetpresentation", "FULL")
+		params.Set("immersiveaudio", "true")
+
+		resp, status, err := c.apiRequest(ctx, "tracks/"+trackID+"/playbackinfopostpaywall", params, c.baseURL)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		if status != http.StatusOK {
+			lastErr = fmt.Errorf("tidal atmos playbackinfo failed: status=%d", status)
+			continue
+		}
+		if !playbackLooksAtmos(resp) {
+			continue
+		}
+		if d := downloadableFromPlaybackManifest(resp); d != nil {
+			return d, nil
+		}
+	}
+	if d, err := c.getDownloadableFromTrackManifestForFormat(ctx, trackID, "EAC3_JOC"); err == nil {
+		return d, nil
+	} else if err != nil {
+		lastErr = err
+	}
+	if d, err := c.getDownloadableFromTrackManifestForFormat(ctx, trackID, "DOLBY_ATMOS"); err == nil {
+		return d, nil
+	} else if err != nil {
+		lastErr = err
+	}
+	if d, err := c.getDownloadableFromTrackManifestForFormat(ctx, trackID, "SONY_360RA"); err == nil {
+		return d, nil
+	} else if err != nil {
+		lastErr = err
+	}
+	return nil, lastErr
+}
+
+func playbackLooksAtmos(resp map[string]any) bool {
+	if strings.Contains(strings.ToUpper(stringify(resp["audioMode"])), "ATMOS") {
+		return true
+	}
+	if modes, ok := resp["audioModes"].([]any); ok {
+		for _, raw := range modes {
+			if strings.Contains(strings.ToUpper(stringify(raw)), "ATMOS") {
+				return true
+			}
+		}
+	}
+
+	manifestB64 := stringify(resp["manifest"])
+	if manifestB64 == "" {
+		return false
+	}
+	b, err := base64.StdEncoding.DecodeString(manifestB64)
+	if err != nil {
+		return false
+	}
+	manifest := map[string]any{}
+	if err = json.Unmarshal(b, &manifest); err != nil {
+		return false
+	}
+	if strings.Contains(strings.ToUpper(stringify(manifest["audioMode"])), "ATMOS") {
+		return true
+	}
+	if modes, ok := manifest["audioModes"].([]any); ok {
+		for _, raw := range modes {
+			if strings.Contains(strings.ToUpper(stringify(raw)), "ATMOS") {
+				return true
+			}
+		}
+	}
+	codec := strings.ToLower(stringify(manifest["codecs"]))
+	return strings.Contains(codec, "ec-3") || strings.Contains(codec, "eac3") || strings.Contains(codec, "joc") || strings.Contains(codec, "atmos")
+}
+
 func (c *Client) Close() error {
 	return nil
 }
@@ -310,14 +425,27 @@ func (c *Client) fetchArtistAlbums(ctx context.Context, artistID string) ([]map[
 	out := make([]map[string]any, 0)
 	seen := map[string]struct{}{}
 	for _, p := range paths {
-		resp, status, err := c.apiRequest(ctx, p.path, p.params, c.baseURL)
+		offset := 0
+		for {
+			params := url.Values{}
+			for k, values := range p.params {
+				for _, v := range values {
+					params.Add(k, v)
+				}
+			}
+			params.Set("offset", strconv.Itoa(offset))
+
+			resp, status, err := c.apiRequest(ctx, p.path, params, c.baseURL)
 			if err != nil {
 				return nil, err
 			}
 			if status != http.StatusOK {
-			return nil, fmt.Errorf("tidal artist albums failed: status=%d", status)
+				return nil, fmt.Errorf("tidal artist albums failed: status=%d offset=%d", status, offset)
 			}
 			items, _ := resp["items"].([]any)
+			if len(items) == 0 {
+				break
+			}
 			for _, raw := range items {
 				itm, ok := raw.(map[string]any)
 				if !ok {
@@ -336,12 +464,21 @@ func (c *Client) fetchArtistAlbums(ctx context.Context, artistID string) ([]map[
 				seen[id] = struct{}{}
 				out = append(out, itm)
 			}
+			if len(items) < 100 {
+				break
+			}
+			offset += 100
+		}
 	}
 	return out, nil
 }
 
 func (c *Client) getDownloadableFromTrackManifest(ctx context.Context, trackID string, quality int) (*provider.Downloadable, error) {
 	format := qualityToFormat[quality]
+	return c.getDownloadableFromTrackManifestForFormat(ctx, trackID, format)
+}
+
+func (c *Client) getDownloadableFromTrackManifestForFormat(ctx context.Context, trackID, format string) (*provider.Downloadable, error) {
 	params := url.Values{}
 	params.Set("manifestType", "MPEG_DASH")
 	params.Set("formats", format)
@@ -372,10 +509,14 @@ func (c *Client) getDownloadableFromTrackManifest(ctx context.Context, trackID s
 	formats, _ := attrs["formats"].([]any)
 	ext := "m4a"
 	for _, f := range formats {
-		if strings.Contains(strings.ToUpper(stringify(f)), "FLAC") {
+		fv := strings.ToUpper(stringify(f))
+		if strings.Contains(fv, "FLAC") {
 			ext = "flac"
 			break
 		}
+		if strings.Contains(fv, "EAC3") || strings.Contains(fv, "ATMOS") || strings.Contains(fv, "JOC") {
+			ext = "mka"
+		}
 	}
 
 	return &provider.Downloadable{URL: uri, Extension: ext, Source: "tidal"}, nil
@@ -470,6 +611,8 @@ func downloadableFromPlaybackManifest(resp map[string]any) *provider.Downloadabl
 	ext := "m4a"
 	if strings.Contains(codec, "flac") {
 		ext = "flac"
+	} else if strings.Contains(codec, "ec-3") || strings.Contains(codec, "eac3") || strings.Contains(codec, "joc") || strings.Contains(codec, "atmos") {
+		ext = "mka"
 	}
 	return &provider.Downloadable{URL: streamURL, Extension: ext, Source: "tidal"}
 }

internal/provider/tidal/client_test.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"strconv"
 	"testing"
 
 	"streamrip-go/internal/config"
@@ -98,3 +99,147 @@ func TestBestHLSVariantURLFallsBackToMaster(t *testing.T) {
 		t.Fatalf("url = %q, want %q", got, master)
 	}
 }
+
+func TestGetMetadataArtistPaginatesAlbums(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/v1/sessions":
+			_ = json.NewEncoder(w).Encode(map[string]any{"countryCode": "US", "userId": 123})
+		case "/v1/artists/9":
+			_ = json.NewEncoder(w).Encode(map[string]any{"id": 9, "name": "Artist X"})
+		case "/v1/artists/9/albums":
+			offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
+			filter := r.URL.Query().Get("filter")
+			if filter == "" {
+				if offset == 0 {
+					items := make([]any, 0, 100)
+					for i := 0; i < 100; i++ {
+						items = append(items, map[string]any{"id": i + 1})
+					}
+					_ = json.NewEncoder(w).Encode(map[string]any{"items": items})
+					return
+				}
+				if offset == 100 {
+					_ = json.NewEncoder(w).Encode(map[string]any{"items": []any{map[string]any{"id": 101}}})
+					return
+				}
+				_ = json.NewEncoder(w).Encode(map[string]any{"items": []any{}})
+				return
+			}
+			if filter == "EPSANDSINGLES" {
+				if offset == 0 {
+					_ = json.NewEncoder(w).Encode(map[string]any{"items": []any{map[string]any{"id": 101}, map[string]any{"id": 102}}})
+					return
+				}
+				_ = json.NewEncoder(w).Encode(map[string]any{"items": []any{}})
+				return
+			}
+			w.WriteHeader(http.StatusBadRequest)
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer ts.Close()
+
+	cfgData := config.DefaultConfigData()
+	cfgData.Tidal.AccessToken = "token"
+	cfgData.Tidal.CountryCode = "US"
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+	c.baseURL = ts.URL + "/v1"
+
+	if err := c.Login(context.Background()); err != nil {
+		t.Fatalf("login err = %v", err)
+	}
+	meta, err := c.GetMetadata(context.Background(), "9", "artist")
+	if err != nil {
+		t.Fatalf("GetMetadata() err = %v", err)
+	}
+	albumsObj, _ := meta["albums"].(map[string]any)
+	items, _ := albumsObj["items"].([]map[string]any)
+	if len(items) != 102 {
+		t.Fatalf("albums len = %d, want 102", len(items))
+	}
+}
+
+func TestGetDownloadablePrefersAtmosWhenEnabled(t *testing.T) {
+	var calls []string
+	allImmersive := true
+	var ts *httptest.Server
+	ts = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/v1/tracks/42":
+			_ = json.NewEncoder(w).Encode(map[string]any{"id": 42, "audioModes": []any{"DOLBY_ATMOS", "STEREO"}, "mediaMetadata": map[string]any{"tags": []any{"LOSSLESS", "DOLBY_ATMOS"}}})
+		case "/v1/tracks/42/playbackinfopostpaywall":
+			if r.URL.Query().Get("immersiveaudio") != "true" {
+				allImmersive = false
+			}
+			aq := r.URL.Query().Get("audioquality")
+			calls = append(calls, aq)
+			manifest := map[string]any{"urls": []string{ts.URL + "/stereo.m3u8"}, "codecs": "flac"}
+			if aq == "HI_RES" {
+				manifest = map[string]any{"urls": []string{ts.URL + "/atmos.m3u8"}, "codecs": "ec-3", "audioMode": "DOLBY_ATMOS"}
+			}
+			b, _ := json.Marshal(manifest)
+			_ = json.NewEncoder(w).Encode(map[string]any{"manifest": base64.StdEncoding.EncodeToString(b), "audioMode": manifest["audioMode"]})
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer ts.Close()
+
+	cfgData := config.DefaultConfigData()
+	cfgData.Tidal.AccessToken = "token"
+	cfgData.Tidal.CountryCode = "US"
+	cfgData.Tidal.PreferAtmos = true
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+	c.loggedIn = true
+	c.baseURL = ts.URL + "/v1"
+
+	d, err := c.GetDownloadable(context.Background(), "42", 3)
+	if err != nil {
+		t.Fatalf("GetDownloadable() err = %v", err)
+	}
+	if d.URL != ts.URL+"/atmos.m3u8" {
+		t.Fatalf("url = %q, want %q", d.URL, ts.URL+"/atmos.m3u8")
+	}
+	if d.Extension != "mka" {
+		t.Fatalf("extension = %q, want mka", d.Extension)
+	}
+	if len(calls) < 2 || calls[0] != "HI_RES_LOSSLESS" || calls[1] != "HI_RES" {
+		t.Fatalf("unexpected audioquality call order: %+v", calls)
+	}
+	if !allImmersive {
+		t.Fatalf("expected immersiveaudio=true on Atmos probing calls")
+	}
+}
+
+func TestPlaybackLooksAtmosFromManifest(t *testing.T) {
+	manifest := map[string]any{"urls": []string{"https://cdn.example/stream.m3u8"}, "codecs": "ec-3"}
+	b, _ := json.Marshal(manifest)
+	resp := map[string]any{"manifest": base64.StdEncoding.EncodeToString(b)}
+	if !playbackLooksAtmos(resp) {
+		t.Fatalf("expected atmos detection from manifest codec")
+	}
+}
+
+func TestTrackSupportsAtmosFromTags(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/tracks/42" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{"id": 42, "audioModes": []any{"STEREO"}, "mediaMetadata": map[string]any{"tags": []any{"LOSSLESS", "DOLBY_ATMOS"}}})
+	}))
+	defer ts.Close()
+
+	cfgData := config.DefaultConfigData()
+	cfgData.Tidal.AccessToken = "token"
+	cfgData.Tidal.CountryCode = "US"
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+	c.loggedIn = true
+	c.baseURL = ts.URL + "/v1"
+
+	if !c.trackSupportsAtmos(context.Background(), "42") {
+		t.Fatalf("expected atmos support from mediaMetadata tags")
+	}
+}

internal/urlparse/parse.go

@@ -50,7 +50,7 @@ func Parse(raw string) *ParsedURL {
 	case isDeezerHost(host):
 		return parseDeezer(raw, parts)
 	case isSoundcloudHost(host):
-		return parseSoundcloud(raw, parts)
+		return parseSoundcloud(raw, host, parts)
 	default:
 		return nil
 	}
@@ -85,6 +85,13 @@ func parseTidal(raw string, parts []string) *ParsedURL {
 		return nil
 	}
 
+	if isLangToken(parts[0]) {
+		parts = parts[1:]
+	}
+	if len(parts) < 2 {
+		return nil
+	}
+
 	if parts[0] == "browse" {
 		parts = parts[1:]
 	}
@@ -128,14 +135,20 @@ func parseDeezer(raw string, parts []string) *ParsedURL {
 	return &ParsedURL{OriginalURL: raw, Source: "deezer", MediaType: mediaType, ID: id, Kind: KindGeneric}
 }
 
-func parseSoundcloud(raw string, parts []string) *ParsedURL {
+func parseSoundcloud(raw, host string, parts []string) *ParsedURL {
 	if len(parts) < 1 {
 		return nil
 	}
 
+	if host == "on.soundcloud.com" {
+		return &ParsedURL{OriginalURL: raw, Source: "soundcloud", MediaType: "track", ID: raw, Kind: KindSoundcloud}
+	}
+
 	mediaType := "track"
 	if len(parts) >= 3 && parts[1] == "sets" {
 		mediaType = "playlist"
+	} else if len(parts) < 2 || parts[1] == "sets" {
+		return nil
 	}
 
 	return &ParsedURL{OriginalURL: raw, Source: "soundcloud", MediaType: mediaType, ID: raw, Kind: KindSoundcloud}
@@ -169,7 +182,7 @@ func isTidalHost(host string) bool {
 }
 
 func isDeezerHost(host string) bool {
-	return host == "deezer.com"
+	return host == "deezer.com" || strings.HasSuffix(host, ".deezer.com")
 }
 
 func isSoundcloudHost(host string) bool {

internal/urlparse/parse_test.go

@@ -28,13 +28,19 @@ func TestQobuzAlbumURL(t *testing.T) {
 }
 
 func TestTidalTrackURL(t *testing.T) {
-	url := "https://tidal.com/browse/track/3083287"
+	inputs := []string{
+		"https://tidal.com/browse/track/3083287",
+		"https://tidal.com/us/browse/track/3083287",
+		"https://tidal.com/us/track/3083287",
+	}
+	for _, url := range inputs {
 		result := Parse(url)
 		if result == nil {
-		t.Fatalf("expected parsed url")
+			t.Fatalf("expected parsed url for %q", url)
 		}
 		if result.Source != "tidal" || result.MediaType != "track" || result.ID != "3083287" {
-		t.Fatalf("unexpected parse result: %+v", result)
+			t.Fatalf("unexpected parse result for %q: %+v", url, result)
+		}
 	}
 }
 
@@ -93,6 +99,7 @@ func TestURLWithLanguageCode(t *testing.T) {
 		"https://www.qobuz.com/gb-en/album/name/id123456",
 		"https://www.deezer.com/en/track/4195713",
 		"https://www.deezer.com/fr/track/4195713",
+		"https://m.deezer.com/en/track/4195713",
 	}
 	for _, input := range inputs {
 		if result := Parse(input); result == nil {
@@ -101,6 +108,17 @@ func TestURLWithLanguageCode(t *testing.T) {
 	}
 }
 
+func TestDeezerMobileHostURL(t *testing.T) {
+	url := "https://m.deezer.com/track/4195713"
+	result := Parse(url)
+	if result == nil {
+		t.Fatalf("expected parsed url")
+	}
+	if result.Source != "deezer" || result.MediaType != "track" || result.ID != "4195713" {
+		t.Fatalf("unexpected parse result: %+v", result)
+	}
+}
+
 func TestSoundcloudURL(t *testing.T) {
 	inputs := []string{
 		"https://soundcloud.com/artist-name/track-name",
@@ -118,3 +136,15 @@ func TestSoundcloudURL(t *testing.T) {
 		}
 	}
 }
+
+func TestSoundcloudProfileURLIsNotTrack(t *testing.T) {
+	if result := Parse("https://soundcloud.com/artist-name"); result != nil {
+		t.Fatalf("expected nil for profile url, got %+v", result)
+	}
+}
+
+func TestSoundcloudSetsRootWithoutPlaylistSlugInvalid(t *testing.T) {
+	if result := Parse("https://soundcloud.com/artist-name/sets"); result != nil {
+		t.Fatalf("expected nil for sets root url, got %+v", result)
+	}
+}