feat yandex desktop downloads

cmd/rip/args.go

@@ -24,7 +24,7 @@ type globalOptions struct {
 	codec       string
 	noProgress  bool
 	noSSLVerify bool
-	verbose     bool
+	verbose     int
 	command     string
 	commandArgs []string
 }
@@ -52,7 +52,13 @@ func parseGlobalArgs(args []string) (globalOptions, error) {
 		case arg == "--no-ssl-verify":
 			opts.noSSLVerify = true
 		case arg == "-v" || arg == "--verbose":
-			opts.verbose = true
+			if opts.verbose < 2 {
+				opts.verbose++
+			}
+		case arg == "-vv":
+			if opts.verbose < 2 {
+				opts.verbose = 2
+			}
 		case arg == "-f" || arg == "--folder":
 			if i+1 >= len(args) {
 				return globalOptions{}, fmt.Errorf("%s requires a value", arg)

cmd/rip/helpers.go

@@ -65,7 +65,7 @@ func addURLToQueue(ctx context.Context, mainApp *app.Main, raw string) bool {
 		fmt.Printf("not yet supported: %s (kind=%s)\n", raw, parsed.Kind)
 		return false
 	}
-	if parsed.Source != "qobuz" && parsed.Source != "tidal" && parsed.Source != "deezer" && parsed.Source != "soundcloud" {
+	if parsed.Source != "qobuz" && parsed.Source != "tidal" && parsed.Source != "deezer" && parsed.Source != "yandex" && parsed.Source != "soundcloud" {
 		fmt.Printf("provider not yet implemented: source=%s url=%s\n", parsed.Source, raw)
 		return false
 	}

cmd/rip/lastfm.go

@@ -86,7 +86,7 @@ func fetchLastFMPlaylist(ctx context.Context, verifySSL bool, playlistURL string
 	if !isValidLastFMPlaylistURL(playlistURL) {
 		return "", nil, fmt.Errorf("invalid playlist url")
 	}
-	client := netutil.NewHTTPClient(30*time.Second, verifySSL)
+	client := netutil.NewHTTPClient(30*time.Second, verifySSL, 0)
 
 	page1, err := fetchLastFMPlaylistPage(ctx, client, parsed, 1)
 	if err != nil {
@@ -123,7 +123,7 @@ func fetchLastFMPlaylist(ctx context.Context, verifySSL bool, playlistURL string
 }
 
 func fetchLastFMPlaylistViaMirror(ctx context.Context, verifySSL bool, playlistURL string) (string, []lastFMTrack, error) {
-	client := netutil.NewHTTPClient(30*time.Second, verifySSL)
+	client := netutil.NewHTTPClient(30*time.Second, verifySSL, 0)
 	all := make([]lastFMTrack, 0, 200)
 	title := ""
 
@@ -376,7 +376,7 @@ func fetchSoundcloudOEmbed(ctx context.Context, verifySSL bool, trackURL string)
 	q.Set("url", trackURL)
 	endpoint := "https://soundcloud.com/oembed?" + q.Encode()
 
-	client := netutil.NewHTTPClient(20*time.Second, verifySSL)
+	client := netutil.NewHTTPClient(20*time.Second, verifySSL, 0)
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
 	if err != nil {
 		return nil, err

cmd/rip/main.go

@@ -14,6 +14,7 @@ import (
 	"streamrip-go/internal/app"
 	"streamrip-go/internal/config"
 	"streamrip-go/internal/provider"
+	"streamrip-go/internal/verbose"
 
 	_ "modernc.org/sqlite"
 )
@@ -49,8 +50,11 @@ func main() {
 		os.Exit(1)
 	}
 	applyGlobalConfigOverrides(cfg, gopts)
-	if gopts.verbose {
-		fmt.Fprintln(os.Stderr, "verbose mode enabled")
+	verbose.SetLevel(gopts.verbose)
+	if gopts.verbose >= 2 {
+		fmt.Fprintln(os.Stderr, "verbose mode enabled (level 2: downloads + http)")
+	} else if gopts.verbose >= 1 {
+		fmt.Fprintln(os.Stderr, "verbose mode enabled (level 1: downloads)")
 	}
 
 	os.Args = append([]string{os.Args[0], gopts.command}, gopts.commandArgs...)
@@ -313,6 +317,8 @@ func main() {
 				cfg.Session.Qobuz.Quality = opts.quality
 			case "tidal":
 				cfg.Session.Tidal.Quality = opts.quality
+			case "yandex":
+				cfg.Session.Yandex.Quality = opts.quality
 			}
 		}
 
@@ -342,7 +348,7 @@ func main() {
 		var sopts searchOptions
 		if len(os.Args) < 5 {
 			if !term.IsTerminal(int(os.Stdin.Fd())) {
-				fmt.Println("usage: rip search <qobuz|tidal|deezer|soundcloud> <track|album|playlist|artist|label|video> <query...> [--limit N] [--force|--ignore-db] [--no-download]")
+				fmt.Println("usage: rip search <qobuz|tidal|deezer|yandex|soundcloud> <track|album|playlist|artist|label|video> <query...> [--limit N] [--force|--ignore-db] [--no-download]")
 				os.Exit(2)
 			}
 			source, mediaType, sopts, err = promptSearchInteractive(cfg.Session.CLI.MaxSearchResults)
@@ -376,6 +382,10 @@ func main() {
 			fmt.Fprintln(os.Stderr, "soundcloud search currently supports media types track and playlist")
 			os.Exit(2)
 		}
+		if source == "yandex" && mediaType != "track" && mediaType != "album" && mediaType != "playlist" && mediaType != "artist" {
+			fmt.Fprintln(os.Stderr, "yandex search currently supports media types track, album, playlist, and artist")
+			os.Exit(2)
+		}
 		if sopts.query == "" {
 			fmt.Fprintln(os.Stderr, "search query cannot be empty")
 			os.Exit(2)

cmd/rip/main_test.go

@@ -227,7 +227,7 @@ func TestParseGlobalArgsAllOfficialFlags(t *testing.T) {
 	if !opts.noDB || !opts.qualitySet || opts.quality != 3 || !opts.codecSet || opts.codec != "VORBIS" {
 		t.Fatalf("unexpected quality/codec/db opts: %+v", opts)
 	}
-	if !opts.noProgress || !opts.noSSLVerify || !opts.verbose {
+	if !opts.noProgress || !opts.noSSLVerify || opts.verbose != 1 {
 		t.Fatalf("unexpected boolean opts: %+v", opts)
 	}
 	if opts.command != "search" {

cmd/rip/search.go

@@ -293,7 +293,7 @@ func writeSearchResultsToFile(source, mediaType string, results []searchResult,
 }
 
 func isAllowedSearchSource(source string) bool {
-	return source == "qobuz" || source == "tidal" || source == "deezer" || source == "soundcloud"
+	return source == "qobuz" || source == "tidal" || source == "deezer" || source == "yandex" || source == "soundcloud"
 }
 
 func isAllowedMediaType(mediaType string) bool {
@@ -318,7 +318,7 @@ func promptSearchInteractive(defaultLimit int) (string, string, searchOptions, e
 	}
 
 	for {
-		source, err := read("Source [qobuz/tidal/deezer/soundcloud]: ")
+		source, err := read("Source [qobuz/tidal/deezer/yandex/soundcloud]: ")
 		if err != nil {
 			return "", "", searchOptions{}, err
 		}
@@ -341,6 +341,10 @@ func promptSearchInteractive(defaultLimit int) (string, string, searchOptions, e
 			fmt.Println("SoundCloud search supports track and playlist only.")
 			continue
 		}
+		if source == "yandex" && mediaType != "track" && mediaType != "album" && mediaType != "playlist" && mediaType != "artist" {
+			fmt.Println("Yandex search supports track, album, playlist, and artist only.")
+			continue
+		}
 
 		query, err := read("Query: ")
 		if err != nil {
@@ -544,6 +548,48 @@ func normalizeSearchResults(source, mediaType string, pages []map[string]any) []
 				)
 				appendUnique(searchResult{ID: id, Title: title, Artist: artist, Date: date, TrackCount: trackCount})
 			}
+		case "yandex":
+			items, ok := page["items"].([]any)
+			if !ok {
+				continue
+			}
+			for _, raw := range items {
+				itm, ok := raw.(map[string]any)
+				if !ok {
+					continue
+				}
+				id := asString(itm["id"])
+				title := asString(itm["title"])
+				if title == "" {
+					title = asString(itm["name"])
+				}
+				artist := nestedSearchString(itm, "artist", "name")
+				if artist == "" {
+					artist = nestedSearchString(itm, "performer", "name")
+				}
+				album := nestedSearchString(itm, "album", "title")
+				trackCount := firstPositiveInt(
+					searchInt(itm["trackCount"]),
+					searchInt(itm["track_count"]),
+					searchInt(itm["tracks_count"]),
+				)
+				explicit := searchBool(itm["explicit"])
+				date := firstNonEmpty(
+					asString(itm["release_date"]),
+					asString(itm["releaseDate"]),
+					nestedSearchString(itm, "album", "release_date"),
+					nestedSearchString(itm, "album", "releaseDate"),
+				)
+				releases := 0
+				if mediaType == "artist" {
+					releases = firstPositiveInt(
+						searchInt(itm["albums_count"]),
+						searchInt(itm["numberOfAlbums"]),
+						nestedSearchInt(itm, "albums", "total"),
+					)
+				}
+				appendUnique(searchResult{ID: id, Title: title, Artist: artist, Album: album, Date: date, Releases: releases, TrackCount: trackCount, Explicit: explicit})
+			}
 		}
 	}
 	return results

config.toml.example

@@ -68,6 +68,15 @@ password = ""
 # Optional cached Deezer refresh token. Managed automatically when available.
 refresh_token = ""
 
+[yandex]
+# Quality ladder:
+# 0 = LOW (HE-AAC/AAC when available), 1 = HIGH (AAC/MP3 192), 2/3/4 = LOSSLESS when available
+quality = 2
+# OAuth access token for api.music.yandex.net
+access_token = ""
+# Cached current account uid. Managed automatically when available.
+user_id = ""
+
 [soundcloud]
 # Quality is currently provider-defined (keep 0)
 quality = 0

internal/app/app.go

@@ -25,7 +25,9 @@ import (
 	qobuzprovider "streamrip-go/internal/provider/qobuz"
 	soundcloudprovider "streamrip-go/internal/provider/soundcloud"
 	tidalprovider "streamrip-go/internal/provider/tidal"
+	yandexprovider "streamrip-go/internal/provider/yandex"
 	"streamrip-go/internal/store"
+	"streamrip-go/internal/verbose"
 )
 
 type Main struct {
@@ -91,6 +93,10 @@ type videoDownloadableProvider interface {
 	GetVideoDownloadable(ctx context.Context, videoID string) (*provider.Downloadable, error)
 }
 
+type trackFallbackDownloader interface {
+	DownloadTrackFallback(ctx context.Context, trackID string, quality int, outputPath string) error
+}
+
 func New(cfg *config.Config) (*Main, error) {
 	var db store.Database
 	if cfg.Session.Database.DownloadsEnabled || cfg.Session.Database.FailedDownloadsEnabled {
@@ -107,21 +113,36 @@ func New(cfg *config.Config) (*Main, error) {
 		"qobuz":      qobuzprovider.New(cfg),
 		"tidal":      tidalprovider.New(cfg),
 		"deezer":     deezerprovider.New(cfg),
+		"yandex":     yandexprovider.New(cfg),
 		"soundcloud": soundcloudprovider.New(cfg),
 	}
 
-	return &Main{
+	m := &Main{
 		Config:    cfg,
 		Providers: providers,
 		Store:     db,
-		DL:        download.NewWithOptions(cfg.Session.Downloads.VerifySSL, cfg.Session.CLI.ProgressBars),
+		DL:        download.NewWithOptions(cfg.Session.Downloads.VerifySSL, cfg.Session.CLI.ProgressBars, downloaderMaxConnsPerHost(cfg.Session.Downloads.MaxConnections)),
 		Tagger:    tag.New(),
 		Pending:   []media.Pending{},
 		Media:     []media.Media{},
-	}, nil
+	}
+	verbose.SetSink(func(msg string) { m.DL.Logf("%s", msg) })
+	return m, nil
+}
+
+// downloaderMaxConnsPerHost picks the per-host idle connection cap for the
+// shared download client. We floor at 16 so artwork/manifest fetches and
+// concurrent track downloads to the same CDN host can reuse keep-alive
+// sockets even when the user configured a tiny max_connections.
+func downloaderMaxConnsPerHost(maxConnections int) int {
+	if maxConnections > 16 {
+		return maxConnections
+	}
+	return 16
 }
 
 func (m *Main) Close() error {
+	verbose.SetSink(nil)
 	m.DL.Close()
 	artwork.CleanupTempDirs()
 	for _, p := range m.Providers {
@@ -869,16 +890,29 @@ func (m *Main) ripTrack(ctx context.Context, p provider.Client, source, id, fall
 			}
 			return m.DL.FileDeezerEncrypted(ctx, d.URL, outPath, trackID)
 		}
+		if d.Source == "yandex" && strings.EqualFold(strings.TrimSpace(d.Cipher), "AES_CTR") {
+			return m.DL.FileYandexEncrypted(ctx, d.URL, outPath, d.Key)
+		}
 		return m.DL.File(ctx, d.URL, outPath)
 	}
 	if err = downloadOnce(); err != nil {
 		m.logf("retry: %s (%v)\n", filepath.Base(outPath), err)
 		if err = downloadOnce(); err != nil {
+			if fallbackProvider, ok := p.(trackFallbackDownloader); ok {
+				m.logf("fallback: %s via provider backup flow\n", filepath.Base(outPath))
+				if fbErr := fallbackProvider.DownloadTrackFallback(ctx, id, m.qualityForSource(source), outPath); fbErr == nil {
+					goto downloaded
+				} else {
+					m.logf("fallback failed: %s (%v)\n", filepath.Base(outPath), fbErr)
+				}
+			}
 			_ = m.Store.MarkFailed(ctx, source, "track", id)
 			return fmt.Errorf("id=%s title=%q download: %w", id, title, err)
 		}
 	}
 
+downloaded:
+
 	embedCoverPath := opts.albumEmbedCover
 	if opts.forPlaylist {
 		parent := opts.albumFolder
@@ -935,6 +969,8 @@ func (m *Main) qualityForSource(source string) int {
 		return m.Config.Session.Tidal.Quality
 	case "deezer":
 		return m.Config.Session.Deezer.Quality
+	case "yandex":
+		return m.Config.Session.Yandex.Quality
 	case "soundcloud":
 		return m.Config.Session.Soundcloud.Quality
 	default:
@@ -965,6 +1001,8 @@ func (m *Main) qualityProfileForSource(source string) (int, string) {
 		default:
 			return 16, "44.1"
 		}
+	case "yandex":
+		return 16, "44.1"
 	default:
 		return 16, "44.1"
 	}
@@ -1260,11 +1298,12 @@ func buildTagMetadata(trackMeta map[string]any, title, source, trackID string, o
 	if discTotal == 0 {
 		discTotal = jsonutil.IntFromAny(trackMeta["numberOfVolumes"])
 	}
-	if discTotal == 0 && opts.albumDiscTotal > 0 {
+	if !opts.forPlaylist && discTotal == 0 && opts.albumDiscTotal > 0 {
 		discTotal = opts.albumDiscTotal
 	}
 	if opts.forPlaylist {
-		discTotal = 1
+		discNumber = 0
+		discTotal = 0
 	}
 	if !opts.forPlaylist && discNumber == 0 {
 		discNumber = 1

internal/app/app_test.go

@@ -309,7 +309,7 @@ func TestTrackRipFailsWhenTaggerReportsMissingFFmpeg(t *testing.T) {
 			"qobuz": &fakeProvider{url: ts.URL},
 		},
 		Store:  sqlite,
-		DL:     download.NewWithOptions(true, false),
+		DL:     download.NewWithOptions(true, false, 0),
 		Tagger: failingTagger{err: fmt.Errorf("ffmpeg not found: %w", exec.ErrNotFound)},
 	}
 
@@ -490,6 +490,43 @@ func TestBuildTagMetadataUsesAlbumArtistOverride(t *testing.T) {
 	}
 }
 
+func TestBuildTagMetadataPlaylistOmitsDiscTags(t *testing.T) {
+	meta := map[string]any{
+		"title":                 "One Step Too Far",
+		"track_number":          float64(15),
+		"media_number":          float64(2),
+		"numberOfVolumes":       float64(2),
+		"numberOfTracks":        float64(18),
+		"performer":             map[string]any{"name": "Faithless"},
+		"artist":                map[string]any{"name": "Faithless"},
+		"release_date":          "2005-01-01",
+		"release_date_original": "2005-01-01",
+		"album": map[string]any{
+			"id":     "23324600",
+			"title":  "Greatest Hits (Deluxe)",
+			"artist": map[string]any{"name": "Faithless"},
+		},
+	}
+	playlistCfg := config.DefaultConfigData().Metadata
+	applyPlaylistMetadataOverrides(meta, playlistCfg, "Road Trip", 3)
+	tags := buildTagMetadata(meta, "One Step Too Far", "tidal", "23324615", ripTrackOptions{forPlaylist: true, playlistName: "Road Trip", playlistPos: 3, total: 20})
+	if tags.Album != "Road Trip" {
+		t.Fatalf("album = %q, want Road Trip", tags.Album)
+	}
+	if tags.TrackNumber != 3 {
+		t.Fatalf("track number = %d, want 3", tags.TrackNumber)
+	}
+	if tags.TrackTotal != 20 {
+		t.Fatalf("track total = %d, want 20", tags.TrackTotal)
+	}
+	if tags.DiscNumber != 0 {
+		t.Fatalf("disc number = %d, want 0", tags.DiscNumber)
+	}
+	if tags.DiscTotal != 0 {
+		t.Fatalf("disc total = %d, want 0", tags.DiscTotal)
+	}
+}
+
 func TestTrackOutputPathFallsBackToDisc1(t *testing.T) {
 	tmp := t.TempDir()
 	d := config.DefaultConfigData()
@@ -537,7 +574,7 @@ func TestPlaylistRipPipeline(t *testing.T) {
 			"qobuz": &fakePlaylistProvider{url: ts.URL},
 		},
 		Store:  sqlite,
-		DL:     download.NewWithOptions(true, false),
+		DL:     download.NewWithOptions(true, false, 0),
 		Tagger: noopTagger{},
 	}
 
@@ -588,7 +625,7 @@ func TestPlaylistRipUsesSourceSubdirectory(t *testing.T) {
 			"qobuz": &fakePlaylistProvider{url: ts.URL},
 		},
 		Store:  sqlite,
-		DL:     download.NewWithOptions(true, false),
+		DL:     download.NewWithOptions(true, false, 0),
 		Tagger: noopTagger{},
 	}
 
@@ -773,7 +810,7 @@ func TestRipAlbumUsesResolvedAudioProfileForFolderName(t *testing.T) {
 			"qobuz": fake,
 		},
 		Store:  sqlite,
-		DL:     download.NewWithOptions(true, false),
+		DL:     download.NewWithOptions(true, false, 0),
 		Tagger: noopTagger{},
 	}
 

internal/audio/tag/tagger.go

@@ -47,9 +47,10 @@ func (t *Tagger) TagFLAC(path string, meta Metadata, coverPath string) error {
 	}
 
 	ext := strings.TrimPrefix(strings.ToLower(filepath.Ext(path)), ".")
+	forceMP4Muxer := shouldForceMP4Muxer(path, ext)
 	tmpPath := taggedTempPath(path)
 	runTag := func(cover string) ([]byte, error) {
-		args := buildFFmpegArgs(path, tmpPath, meta, cover, ext)
+		args := buildFFmpegArgs(path, tmpPath, meta, cover, ext, forceMP4Muxer)
 		cmd := exec.Command("ffmpeg", args...)
 		return cmd.CombinedOutput()
 	}
@@ -72,7 +73,7 @@ func (t *Tagger) TagFLAC(path string, meta Metadata, coverPath string) error {
 	return nil
 }
 
-func buildFFmpegArgs(inputPath, outputPath string, meta Metadata, coverPath, ext string) []string {
+func buildFFmpegArgs(inputPath, outputPath string, meta Metadata, coverPath, ext string, forceMP4Muxer bool) []string {
 	args := []string{"-y", "-i", inputPath}
 	withCover := coverPath != "" && fileExists(coverPath) && supportsAttachedPicture(ext)
 	if withCover {
@@ -101,11 +102,30 @@ func buildFFmpegArgs(inputPath, outputPath string, meta Metadata, coverPath, ext
 		}
 		args = append(args, "-metadata", k+"="+v)
 	}
+	if forceMP4Muxer {
+		args = append(args, "-f", "mp4")
+	}
 
 	args = append(args, outputPath)
 	return args
 }
 
+func shouldForceMP4Muxer(path, ext string) bool {
+	switch strings.TrimPrefix(strings.ToLower(ext), ".") {
+	case "m4a", "mp4":
+	default:
+		return false
+	}
+	if _, err := exec.LookPath("ffprobe"); err != nil {
+		return false
+	}
+	out, err := exec.Command("ffprobe", "-v", "error", "-select_streams", "a:0", "-show_entries", "stream=codec_name", "-of", "default=nokey=1:noprint_wrappers=1", path).Output()
+	if err != nil {
+		return false
+	}
+	return strings.EqualFold(strings.TrimSpace(string(out)), "flac")
+}
+
 func taggedTempPath(path string) string {
 	ext := filepath.Ext(path)
 	if ext == "" {

internal/audio/tag/tagger_test.go

@@ -66,7 +66,7 @@ func TestBuildFFmpegArgsWithCover(t *testing.T) {
 	if err := os.WriteFile(cover, []byte("x"), 0o644); err != nil {
 		t.Fatalf("write cover: %v", err)
 	}
-	args := buildFFmpegArgs("in.flac", "out.flac", Metadata{Title: "x"}, cover, "flac")
+	args := buildFFmpegArgs("in.flac", "out.flac", Metadata{Title: "x"}, cover, "flac", false)
 	foundInput2 := false
 	foundAttach := false
 	for i := 0; i < len(args)-1; i++ {
@@ -88,7 +88,7 @@ func TestBuildFFmpegArgsSkipsCoverForUnsupportedContainer(t *testing.T) {
 	if err := os.WriteFile(cover, []byte("x"), 0o644); err != nil {
 		t.Fatalf("write cover: %v", err)
 	}
-	args := buildFFmpegArgs("in.opus", "out.opus", Metadata{Title: "x"}, cover, "opus")
+	args := buildFFmpegArgs("in.opus", "out.opus", Metadata{Title: "x"}, cover, "opus", false)
 	for i := 0; i < len(args)-1; i++ {
 		if args[i] == "-i" && args[i+1] == cover {
 			t.Fatalf("unexpected cover input for opus: %v", args)
@@ -96,6 +96,16 @@ func TestBuildFFmpegArgsSkipsCoverForUnsupportedContainer(t *testing.T) {
 	}
 }
 
+func TestBuildFFmpegArgsForcesMP4Muxer(t *testing.T) {
+	args := buildFFmpegArgs("in.m4a", "out.m4a", Metadata{Title: "x"}, "", "m4a", true)
+	for i := 0; i < len(args)-1; i++ {
+		if args[i] == "-f" && args[i+1] == "mp4" {
+			return
+		}
+	}
+	t.Fatalf("missing forced mp4 muxer args: %v", args)
+}
+
 func TestTaggedTempPathPreservesExtension(t *testing.T) {
 	if got := taggedTempPath("/tmp/song.flac"); got != "/tmp/song.tmp.flac" {
 		t.Fatalf("taggedTempPath(flac)=%q", got)

internal/config/config.go

@@ -24,6 +24,7 @@ type ConfigData struct {
 	Qobuz        QobuzConfig                  `toml:"qobuz"`
 	Tidal        TidalConfig                  `toml:"tidal"`
 	Deezer       DeezerConfig                 `toml:"deezer"`
+	Yandex       YandexConfig                 `toml:"yandex"`
 	Soundcloud   SoundcloudConfig             `toml:"soundcloud"`
 	Youtube      YoutubeConfig                `toml:"youtube"`
 	Database     DatabaseConfig               `toml:"database"`
@@ -77,6 +78,12 @@ type DeezerConfig struct {
 	RefreshToken               string `toml:"refresh_token"`
 }
 
+type YandexConfig struct {
+	Quality     int    `toml:"quality"`
+	AccessToken string `toml:"access_token"`
+	UserID      string `toml:"user_id"`
+}
+
 type SoundcloudConfig struct {
 	Quality    int    `toml:"quality"`
 	ClientID   string `toml:"client_id"`
@@ -240,6 +247,9 @@ func DefaultConfigData() ConfigData {
 			Quality:                    2,
 			LowerQualityIfNotAvailable: true,
 		},
+		Yandex: YandexConfig{
+			Quality: 2,
+		},
 		Soundcloud: SoundcloudConfig{
 			Quality: 0,
 		},

internal/download/downloader.go

@@ -3,8 +3,10 @@ package download
 import (
 	"bufio"
 	"context"
+	"crypto/aes"
 	"crypto/cipher"
 	"crypto/md5"
+	"encoding/hex"
 	"fmt"
 	"io"
 	"net/http"
@@ -20,6 +22,7 @@ import (
 	"golang.org/x/term"
 
 	"streamrip-go/internal/netutil"
+	"streamrip-go/internal/verbose"
 
 	"golang.org/x/crypto/blowfish"
 )
@@ -31,18 +34,23 @@ type Downloader struct {
 	barStarted   atomic.Int32
 }
 
+// downloadBufferSize sizes HTTP-to-disk copies. 1 MiB cuts read/write syscalls
+// ~32x vs Go's default 32 KiB io.Copy buffer, which matters for multi-MB FLAC
+// streams off CDNs that can sustain high per-connection throughput.
+const downloadBufferSize = 1 << 20
+
 func New() *Downloader {
-	return NewWithOptions(true, true)
+	return NewWithOptions(true, true, 0)
 }
 
 func NewWithVerifySSL(verifySSL bool) *Downloader {
-	return NewWithOptions(verifySSL, true)
+	return NewWithOptions(verifySSL, true, 0)
 }
 
-func NewWithOptions(verifySSL bool, showProgress bool) *Downloader {
+func NewWithOptions(verifySSL bool, showProgress bool, maxConnsPerHost int) *Downloader {
 	forceProgress := strings.EqualFold(os.Getenv("STREAMRIP_GO_FORCE_PROGRESS"), "1") || strings.EqualFold(os.Getenv("STREAMRIP_GO_FORCE_PROGRESS"), "true")
 	interactive := showProgress && (forceProgress || (term.IsTerminal(int(os.Stderr.Fd())) && strings.ToLower(os.Getenv("TERM")) != "dumb"))
-	d := &Downloader{http: netutil.NewHTTPClient(0, verifySSL), showProgress: interactive}
+	d := &Downloader{http: netutil.NewHTTPClient(0, verifySSL, maxConnsPerHost), showProgress: interactive}
 	if interactive {
 		d.progress = mpb.New(mpb.WithWidth(40), mpb.WithOutput(os.Stderr))
 	}
@@ -62,6 +70,7 @@ func (d *Downloader) FileVideo(ctx context.Context, sourceURL, outputPath string
 }
 
 func (d *Downloader) FileDeezerEncrypted(ctx context.Context, sourceURL, outputPath, trackID string) error {
+	logDownloadStart(sourceURL, outputPath)
 	if err := os.MkdirAll(filepath.Dir(outputPath), 0o755); err != nil {
 		return err
 	}
@@ -124,6 +133,11 @@ func (d *Downloader) FileDeezerEncrypted(ctx context.Context, sourceURL, outputP
 			)
 			defer bar.SetTotal(-1, true)
 		}
+		defer func() {
+			if !success && bar != nil {
+				bar.Abort(true)
+			}
+		}()
 	}
 
 	block, err := blowfish.NewCipher(deriveDeezerBlowfishKey(trackID))
@@ -170,7 +184,122 @@ func (d *Downloader) FileDeezerEncrypted(ctx context.Context, sourceURL, outputP
 	return nil
 }
 
+func (d *Downloader) FileYandexEncrypted(ctx context.Context, sourceURL, outputPath, key string) error {
+	logDownloadStart(sourceURL, outputPath)
+	if err := os.MkdirAll(filepath.Dir(outputPath), 0o755); err != nil {
+		return err
+	}
+	keyBytes, err := hex.DecodeString(strings.TrimSpace(key))
+	if err != nil {
+		return fmt.Errorf("invalid yandex key: %w", err)
+	}
+	if len(keyBytes) != 16 {
+		return fmt.Errorf("invalid yandex key length: %d", len(keyBytes))
+	}
+	block, err := aes.NewCipher(keyBytes)
+	if err != nil {
+		return err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, sourceURL, nil)
+	if err != nil {
+		return err
+	}
+	resp, err := d.http.Do(req)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("download failed: status=%d", resp.StatusCode)
+	}
+	out, err := os.Create(outputPath)
+	if err != nil {
+		return err
+	}
+	success := false
+	defer func() {
+		_ = out.Close()
+		if !success {
+			_ = os.Remove(outputPath)
+		}
+	}()
+
+	var bar *mpb.Bar
+	if d.ProgressEnabled() {
+		d.barStarted.Store(1)
+		desc := shortenName(filepath.Base(outputPath), 54)
+		if resp.ContentLength > 0 {
+			bar = d.progress.AddBar(
+				resp.ContentLength,
+				mpb.PrependDecorators(
+					decor.Name(desc+" ", decor.WC{W: 56, C: decor.DSyncWidth | decor.DindentRight}),
+					decor.Percentage(decor.WCSyncWidthR),
+				),
+				mpb.AppendDecorators(
+					decor.CountersKibiByte("% .1f / % .1f", decor.WCSyncWidthR),
+					decor.Name(" | ", decor.WCSyncWidth),
+					decor.AverageSpeed(decor.SizeB1024(0), "% .1f", decor.WCSyncWidthR),
+					decor.Name(" | ETA ", decor.WCSyncWidth),
+					decor.AverageETA(decor.ET_STYLE_GO, decor.WCSyncWidthR),
+				),
+				mpb.BarRemoveOnComplete(),
+			)
+		} else {
+			bar = d.progress.AddSpinner(
+				0,
+				mpb.PrependDecorators(
+					decor.Name(desc+" ", decor.WC{W: 56, C: decor.DSyncWidth | decor.DindentRight}),
+				),
+				mpb.AppendDecorators(
+					decor.CurrentKibiByte("% .1f", decor.WCSyncWidthR),
+					decor.Name(" | ", decor.WCSyncWidth),
+					decor.Elapsed(decor.ET_STYLE_GO, decor.WCSyncWidthR),
+				),
+				mpb.BarRemoveOnComplete(),
+			)
+			defer bar.SetTotal(-1, true)
+		}
+		defer func() {
+			if !success && bar != nil {
+				bar.Abort(true)
+			}
+		}()
+	}
+
+	stream := cipher.NewCTR(block, make([]byte, aes.BlockSize))
+	reader := &cipher.StreamReader{S: stream, R: resp.Body}
+	buf := make([]byte, downloadBufferSize)
+	totalWritten := int64(0)
+	for {
+		n, readErr := reader.Read(buf)
+		if n > 0 {
+			if _, writeErr := out.Write(buf[:n]); writeErr != nil {
+				return writeErr
+			}
+			totalWritten += int64(n)
+			if bar != nil {
+				bar.IncrBy(n)
+			}
+		}
+		if readErr != nil {
+			if readErr == io.EOF {
+				break
+			}
+			return readErr
+		}
+	}
+	if resp.ContentLength > 0 && totalWritten != resp.ContentLength {
+		return io.ErrUnexpectedEOF
+	}
+	if err = out.Sync(); err != nil {
+		return err
+	}
+	success = true
+	return nil
+}
+
 func (d *Downloader) file(ctx context.Context, sourceURL, outputPath string, allowProgress bool, includeVideo bool) error {
+	logDownloadStart(sourceURL, outputPath)
 	if err := os.MkdirAll(filepath.Dir(outputPath), 0o755); err != nil {
 		return err
 	}
@@ -244,7 +373,12 @@ func (d *Downloader) file(ctx context.Context, sourceURL, outputPath string, all
 			)
 			defer bar.SetTotal(-1, true)
 		}
-		buf := make([]byte, 256*1024)
+		defer func() {
+			if !success && bar != nil {
+				bar.Abort(true)
+			}
+		}()
+		buf := make([]byte, downloadBufferSize)
 		totalWritten := int64(0)
 		for {
 			n, readErr := reader.Read(buf)
@@ -269,7 +403,7 @@ func (d *Downloader) file(ctx context.Context, sourceURL, outputPath string, all
 			return err
 		}
 	} else {
-		written, copyErr := io.Copy(out, reader)
+		written, copyErr := io.CopyBuffer(out, reader, make([]byte, downloadBufferSize))
 		if copyErr != nil {
 			return copyErr
 		}
@@ -304,6 +438,16 @@ func (d *Downloader) Logf(format string, args ...any) {
 	fmt.Print(msg)
 }
 
+// logDownloadStart emits the source URL and destination filename when the
+// user passed -v or higher. The transport-level logger covers the same
+// requests at -vv, but this line gives a friendlier per-track summary.
+func logDownloadStart(sourceURL, outputPath string) {
+	if !verbose.Enabled(verbose.V) {
+		return
+	}
+	verbose.Printf(verbose.V, "download %s -> %s\n", sourceURL, filepath.Base(outputPath))
+}
+
 func shortenName(name string, max int) string {
 	if max <= 0 {
 		return name

internal/download/downloader_test.go

@@ -2,8 +2,10 @@ package download
 
 import (
 	"context"
+	"crypto/aes"
 	"crypto/cipher"
 	"errors"
+	"encoding/hex"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -18,7 +20,7 @@ import (
 )
 
 func TestDownloaderHasNoClientTimeout(t *testing.T) {
-	d := NewWithOptions(true, false)
+	d := NewWithOptions(true, false, 0)
 	if d.http.Timeout != 0 {
 		t.Fatalf("http timeout = %v, want 0 (no global timeout)", d.http.Timeout)
 	}
@@ -95,7 +97,7 @@ func TestFileDeezerEncrypted(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	d := NewWithOptions(true, false)
+	d := NewWithOptions(true, false, 0)
 	out := filepath.Join(t.TempDir(), "x", "a.flac")
 	if err = d.FileDeezerEncrypted(context.Background(), ts.URL, out, trackID); err != nil {
 		t.Fatalf("FileDeezerEncrypted() error = %v", err)
@@ -110,6 +112,45 @@ func TestFileDeezerEncrypted(t *testing.T) {
 	}
 }
 
+func TestFileYandexEncrypted(t *testing.T) {
+	plain := make([]byte, 8192+333)
+	for i := range plain {
+		plain[i] = byte((i * 11) % 251)
+	}
+	keyHex := "00112233445566778899aabbccddeeff"
+	key, err := hex.DecodeString(keyHex)
+	if err != nil {
+		t.Fatalf("DecodeString() error = %v", err)
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		t.Fatalf("NewCipher() error = %v", err)
+	}
+	enc := make([]byte, len(plain))
+	copy(enc, plain)
+	stream := cipher.NewCTR(block, make([]byte, aes.BlockSize))
+	stream.XORKeyStream(enc, enc)
+
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write(enc)
+	}))
+	defer ts.Close()
+
+	d := NewWithOptions(true, false, 0)
+	out := filepath.Join(t.TempDir(), "x", "a.m4a")
+	if err = d.FileYandexEncrypted(context.Background(), ts.URL, out, keyHex); err != nil {
+		t.Fatalf("FileYandexEncrypted() error = %v", err)
+	}
+
+	got, err := os.ReadFile(out)
+	if err != nil {
+		t.Fatalf("ReadFile() error = %v", err)
+	}
+	if string(got) != string(plain) {
+		t.Fatalf("decrypted file mismatch")
+	}
+}
+
 func TestDownloaderFileTruncatedResponseRemovesPartialFile(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set("Content-Length", "10")
@@ -117,7 +158,7 @@ func TestDownloaderFileTruncatedResponseRemovesPartialFile(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	d := NewWithOptions(true, false)
+	d := NewWithOptions(true, false, 0)
 	out := filepath.Join(t.TempDir(), "x", "a.bin")
 	err := d.File(context.Background(), ts.URL, out)
 	if err == nil || !errors.Is(err, io.ErrUnexpectedEOF) {
@@ -135,7 +176,7 @@ func TestFileDeezerEncryptedTruncatedResponseRemovesPartialFile(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	d := NewWithOptions(true, false)
+	d := NewWithOptions(true, false, 0)
 	out := filepath.Join(t.TempDir(), "x", "a.flac")
 	err := d.FileDeezerEncrypted(context.Background(), ts.URL, out, "3135556")
 	if err == nil || !errors.Is(err, io.ErrUnexpectedEOF) {
@@ -152,7 +193,7 @@ func TestFileDeezerEncryptedBadStatus(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	d := NewWithOptions(true, false)
+	d := NewWithOptions(true, false, 0)
 	out := filepath.Join(t.TempDir(), "x", "a.flac")
 	err := d.FileDeezerEncrypted(context.Background(), ts.URL, out, "3135556")
 	if err == nil || !strings.Contains(err.Error(), "status=403") {
@@ -160,6 +201,15 @@ func TestFileDeezerEncryptedBadStatus(t *testing.T) {
 	}
 }
 
+func TestFileYandexEncryptedBadKey(t *testing.T) {
+	d := NewWithOptions(true, false, 0)
+	out := filepath.Join(t.TempDir(), "x", "a.m4a")
+	err := d.FileYandexEncrypted(context.Background(), "https://example.com/file", out, "abcd")
+	if err == nil || !strings.Contains(err.Error(), "invalid yandex key length") {
+		t.Fatalf("expected key length error, got %v", err)
+	}
+}
+
 func TestDownloaderFileContextCancellationRemovesPartialFile(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/octet-stream")
@@ -171,7 +221,7 @@ func TestDownloaderFileContextCancellationRemovesPartialFile(t *testing.T) {
 	}))
 	defer ts.Close()
 
-	d := NewWithOptions(true, false)
+	d := NewWithOptions(true, false, 0)
 	out := filepath.Join(t.TempDir(), "x", "cancel.bin")
 	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Millisecond)
 	defer cancel()
@@ -185,7 +235,7 @@ func TestDownloaderFileContextCancellationRemovesPartialFile(t *testing.T) {
 }
 
 func TestStreamManifestWithFFmpegMissing(t *testing.T) {
-	d := NewWithOptions(true, false)
+	d := NewWithOptions(true, false, 0)
 	t.Setenv("PATH", "")
 	err := d.streamManifestWithFFmpeg(context.Background(), "https://example.com/live.m3u8", filepath.Join(t.TempDir(), "out.m4a"), false)
 	if err == nil || !strings.Contains(strings.ToLower(err.Error()), "ffmpeg not found") {
@@ -197,7 +247,7 @@ func TestStreamManifestWithFFmpegFailureRemovesPartialFile(t *testing.T) {
 	if _, err := exec.LookPath("ffmpeg"); err != nil {
 		t.Skip("ffmpeg not installed")
 	}
-	d := NewWithOptions(true, false)
+	d := NewWithOptions(true, false, 0)
 	out := filepath.Join(t.TempDir(), "out.m4a")
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()

internal/netutil/http.go

@@ -3,18 +3,103 @@ package netutil
 import (
 	"crypto/tls"
 	"net/http"
+	"net/url"
 	"time"
+
+	"streamrip-go/internal/verbose"
 )
 
-func NewHTTPClient(timeout time.Duration, verifySSL bool) *http.Client {
+const defaultMaxConnsPerHost = 16
+
+// NewHTTPClient builds an *http.Client whose transport is tuned for the
+// concurrent download workloads this app issues against single CDN hosts.
+//
+// maxConnsPerHost caps idle keep-alive sockets per host; pass <= 0 to use a
+// sensible default. The downloader and provider clients should pass the
+// configured concurrency so keep-alive sockets aren't evicted between workers.
+func NewHTTPClient(timeout time.Duration, verifySSL bool, maxConnsPerHost int) *http.Client {
+	if maxConnsPerHost <= 0 {
+		maxConnsPerHost = defaultMaxConnsPerHost
+	}
+
 	transport := http.DefaultTransport.(*http.Transport).Clone()
 	if transport.TLSClientConfig == nil {
 		transport.TLSClientConfig = &tls.Config{}
 	}
 	transport.TLSClientConfig.InsecureSkipVerify = !verifySSL
 
+	transport.MaxIdleConnsPerHost = maxConnsPerHost
+	if maxIdle := maxConnsPerHost * 4; maxIdle > transport.MaxIdleConns {
+		transport.MaxIdleConns = maxIdle
+	}
+	if transport.MaxIdleConns < 100 {
+		transport.MaxIdleConns = 100
+	}
+	transport.MaxConnsPerHost = 0
+	transport.IdleConnTimeout = 90 * time.Second
+	transport.WriteBufferSize = 64 * 1024
+	transport.ReadBufferSize = 64 * 1024
+	transport.ForceAttemptHTTP2 = true
+
 	return &http.Client{
 		Timeout:   timeout,
-		Transport: transport,
+		Transport: &loggingTransport{base: transport},
 	}
 }
+
+// loggingTransport emits one verbose line per HTTP request when verbose
+// level >= VV. The check is per-call so toggling the level at runtime
+// affects subsequent requests without rebuilding clients.
+type loggingTransport struct {
+	base http.RoundTripper
+}
+
+func (t *loggingTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	if !verbose.Enabled(verbose.VV) {
+		return t.base.RoundTrip(req)
+	}
+	start := time.Now()
+	resp, err := t.base.RoundTrip(req)
+	elapsed := time.Since(start).Round(time.Millisecond)
+	target := redactURL(req.URL)
+	if err != nil {
+		verbose.Printf(verbose.VV, "http %s %s -> error %v (%s)\n", req.Method, target, err, elapsed)
+		return resp, err
+	}
+	verbose.Printf(verbose.VV, "http %s %s -> %d (%s)\n", req.Method, target, resp.StatusCode, elapsed)
+	return resp, err
+}
+
+// redactURL hides values for query parameters that commonly carry
+// credentials so -vv output is safe to paste in an issue.
+func redactURL(u *url.URL) string {
+	if u == nil {
+		return ""
+	}
+	if u.RawQuery == "" {
+		return u.String()
+	}
+	q := u.Query()
+	redacted := false
+	for k := range q {
+		if isSensitiveParam(k) {
+			q.Set(k, "REDACTED")
+			redacted = true
+		}
+	}
+	if !redacted {
+		return u.String()
+	}
+	cp := *u
+	cp.RawQuery = q.Encode()
+	return cp.String()
+}
+
+func isSensitiveParam(name string) bool {
+	switch name {
+	case "user_auth_token", "api_token", "access_token", "refresh_token",
+		"request_sig", "signature", "password", "secret", "token", "code", "auth", "key":
+		return true
+	}
+	return false
+}

internal/provider/deezer/client.go

@@ -62,7 +62,7 @@ type Client struct {
 }
 
 func New(cfg *config.Config) *Client {
-	httpClient := netutil.NewHTTPClient(30*time.Second, cfg.Session.Downloads.VerifySSL)
+	httpClient := netutil.NewHTTPClient(30*time.Second, cfg.Session.Downloads.VerifySSL, cfg.Session.Downloads.MaxConnections)
 	if jar, err := cookiejar.New(nil); err == nil {
 		httpClient.Jar = jar
 	}
@@ -176,6 +176,9 @@ func (c *Client) GetMetadata(ctx context.Context, item, mediaType string) (map[s
 		if err != nil {
 			return nil, err
 		}
+		if tracks, pageErr := c.getCollectionPageItems(ctx, "/album/"+strings.TrimSpace(item)+"/tracks"); pageErr == nil {
+			resp["tracks"] = map[string]any{"data": tracks}
+		}
 		items := make([]any, 0)
 		if tracks, ok := resp["tracks"].(map[string]any); ok {
 			if data, ok := tracks["data"].([]any); ok {
@@ -197,6 +200,9 @@ func (c *Client) GetMetadata(ctx context.Context, item, mediaType string) (map[s
 		if err != nil {
 			return nil, err
 		}
+		if tracks, pageErr := c.getCollectionPageItems(ctx, "/playlist/"+strings.TrimSpace(item)+"/tracks"); pageErr == nil {
+			resp["tracks"] = map[string]any{"data": tracks}
+		}
 		items := make([]any, 0)
 		if tracks, ok := resp["tracks"].(map[string]any); ok {
 			if data, ok := tracks["data"].([]any); ok {
@@ -269,6 +275,35 @@ func (c *Client) getArtistAlbums(ctx context.Context, artistID string) (map[stri
 	return map[string]any{"data": all, "total": total}, nil
 }
 
+func (c *Client) getCollectionPageItems(ctx context.Context, path string) ([]any, error) {
+	const pageSize = 100
+	index := 0
+	total := -1
+	all := make([]any, 0)
+	for {
+		params := url.Values{}
+		params.Set("limit", strconv.Itoa(pageSize))
+		params.Set("index", strconv.Itoa(index))
+		resp, err := c.apiGet(ctx, path, params)
+		if err != nil {
+			return nil, err
+		}
+		data, _ := resp["data"].([]any)
+		all = append(all, data...)
+		if total < 0 {
+			total = jsonutil.IntFromAny(resp["total"])
+		}
+		if len(data) < pageSize {
+			break
+		}
+		index += len(data)
+		if total > 0 && index >= total {
+			break
+		}
+	}
+	return all, nil
+}
+
 func (c *Client) GetDownloadable(ctx context.Context, item string, _ int) (*provider.Downloadable, error) {
 	if strings.TrimSpace(c.license) == "" {
 		if err := c.ensureLaunchSession(ctx); err != nil {
@@ -282,7 +317,7 @@ func (c *Client) GetDownloadable(ctx context.Context, item string, _ int) (*prov
 	if err != nil {
 		return nil, err
 	}
-	trackToken, err := c.getTrackToken(ctx, item)
+	trackToken, mediaTrackID, err := c.getTrackToken(ctx, item)
 	if err != nil {
 		return nil, err
 	}
@@ -294,7 +329,13 @@ func (c *Client) GetDownloadable(ctx context.Context, item string, _ int) (*prov
 	if ext == "" {
 		ext = "mp3"
 	}
-	trackID := strings.TrimSpace(jsonutil.StringFromAny(meta["id"]))
+	trackID := strings.TrimSpace(media.TrackID)
+	if trackID == "" {
+		trackID = strings.TrimSpace(mediaTrackID)
+	}
+	if trackID == "" {
+		trackID = strings.TrimSpace(jsonutil.StringFromAny(meta["id"]))
+	}
 	if trackID == "" {
 		trackID = strings.TrimSpace(item)
 	}
@@ -549,32 +590,33 @@ func (c *Client) loginWithCredentials(ctx context.Context, email, password strin
 	return nil
 }
 
-func (c *Client) getTrackToken(ctx context.Context, trackID string) (string, error) {
-	if token, err := c.getTrackTokenFromPipe(ctx, trackID); err == nil && strings.TrimSpace(token) != "" {
-		return token, nil
+func (c *Client) getTrackToken(ctx context.Context, trackID string) (string, string, error) {
+	if token, mediaID, err := c.getTrackTokenFromPipe(ctx, trackID); err == nil && strings.TrimSpace(token) != "" {
+		return token, mediaID, nil
 	} else if errors.Is(err, errDeezerJWTExpired) {
 		c.refreshJWTFromAvailableState(ctx)
-		if token, retryErr := c.getTrackTokenFromPipe(ctx, trackID); retryErr == nil && strings.TrimSpace(token) != "" {
-			return token, nil
+		if token, mediaID, retryErr := c.getTrackTokenFromPipe(ctx, trackID); retryErr == nil && strings.TrimSpace(token) != "" {
+			return token, mediaID, nil
 		}
 	}
 	if err := c.ensureJWT(ctx, "deezer jwt unavailable for track media token"); err == nil {
-		if token, retryErr := c.getTrackTokenFromPipe(ctx, trackID); retryErr == nil && strings.TrimSpace(token) != "" {
-			return token, nil
+		if token, mediaID, retryErr := c.getTrackTokenFromPipe(ctx, trackID); retryErr == nil && strings.TrimSpace(token) != "" {
+			return token, mediaID, nil
 		}
 	}
 	resp, err := c.apiGet(ctx, "/track/"+url.PathEscape(strings.TrimSpace(trackID)), nil)
 	if err != nil {
-		return "", err
+		return "", "", err
 	}
 	token := strings.TrimSpace(jsonutil.StringFromAny(resp["track_token"]))
 	if token == "" {
-		return "", errors.New("deezer track metadata missing track_token")
+		return "", "", errors.New("deezer track metadata missing track_token")
 	}
-	return token, nil
+	mediaID := strings.TrimSpace(jsonutil.StringFromAny(resp["id"]))
+	return token, mediaID, nil
 }
 
-func (c *Client) getTrackTokenFromPipe(ctx context.Context, trackID string) (string, error) {
+func (c *Client) getTrackTokenFromPipe(ctx context.Context, trackID string) (string, string, error) {
 	query := `query KmpMpTrackMedia($trackId: String!) { track(trackId: $trackId) { media { __typename ...TrackMediaFields } } }  fragment TrackMediaFields on TrackMedia { id version token { payload expiresAt version } estimatedSizes { flac: FLAC mp3_320: MP3_320 mp3_128: MP3_128 mp3_misc: MP3_MISC opus_std: OPUS_STD opus_high: OPUS_HIGH sbc_256: SBC_256 aac_96: AAC_96 aac_64: AAC_64 ac4_ims: AC4_IMS dd_joc: DD_JOC mp4_ra1: MP4_RA1 mp4_ra2: MP4_RA2 mp4_ra3: MP4_RA3 } gain rights { sub { available } ads { available } } }`
 	body := map[string]any{
 		"operationName": "KmpMpTrackMedia",
@@ -589,13 +631,15 @@ func (c *Client) getTrackTokenFromPipe(ctx context.Context, trackID string) (str
 	}
 	out, err := c.pipeGraphQL(ctx, body, "deezer track media query")
 	if err != nil {
-		return "", err
+		return "", "", err
 	}
-	payload := strings.TrimSpace(jsonutil.StringFromAny(jsonutil.NestedMap(jsonutil.NestedMap(jsonutil.NestedMap(jsonutil.NestedMap(out, "data"), "track"), "media"), "token")["payload"]))
+	media := jsonutil.NestedMap(jsonutil.NestedMap(jsonutil.NestedMap(out, "data"), "track"), "media")
+	payload := strings.TrimSpace(jsonutil.StringFromAny(jsonutil.NestedMap(media, "token")["payload"]))
 	if payload == "" {
-		return "", errors.New("deezer track media response missing token payload")
+		return "", "", errors.New("deezer track media response missing token payload")
 	}
-	return payload, nil
+	mediaID := strings.TrimSpace(jsonutil.StringFromAny(media["id"]))
+	return payload, mediaID, nil
 }
 
 type lyricsResult struct {
@@ -1148,6 +1192,7 @@ type mediaResult struct {
 	URL     string
 	Format  string
 	Cipher  string
+	TrackID string
 }
 
 type deezerMediaError struct {
@@ -1270,19 +1315,50 @@ func (c *Client) getMediaURLWithRequest(ctx context.Context, trackToken string,
 		return nil, &deezerMediaError{Code: e.Code, Message: e.Message}
 	}
 	for _, want := range requestedFormats {
+		for _, preferredCipher := range []string{"NONE", "BF_CBC_STRIPE"} {
 			for _, m := range parsed.Data[0].Media {
 				if !strings.EqualFold(strings.TrimSpace(m.Format), want) {
 					continue
 				}
+				if !strings.EqualFold(strings.TrimSpace(m.Cipher.Type), preferredCipher) {
+					continue
+				}
 				if len(m.Sources) == 0 || strings.TrimSpace(m.Sources[0].URL) == "" {
 					continue
 				}
-			return &mediaResult{URL: m.Sources[0].URL, Format: m.Format, Cipher: m.Cipher.Type}, nil
+				sourceURL := strings.TrimSpace(m.Sources[0].URL)
+				return &mediaResult{URL: sourceURL, Format: m.Format, Cipher: m.Cipher.Type, TrackID: extractTrackIDFromMediaURL(sourceURL)}, nil
+			}
 		}
 	}
 	return nil, errors.New("deezer media response contains no sources")
 }
 
+func extractTrackIDFromMediaURL(rawURL string) string {
+	u, err := url.Parse(strings.TrimSpace(rawURL))
+	if err != nil {
+		return ""
+	}
+	parts := strings.Split(strings.TrimSpace(strings.Trim(u.Path, "/")), "/")
+	for i := len(parts) - 1; i >= 0; i-- {
+		p := strings.TrimSpace(parts[i])
+		if p == "" {
+			continue
+		}
+		digitsOnly := true
+		for _, r := range p {
+			if r < '0' || r > '9' {
+				digitsOnly = false
+				break
+			}
+		}
+		if digitsOnly {
+			return p
+		}
+	}
+	return ""
+}
+
 func buildFormatPriority(quality int, allowFallback bool) []string {
 	want := "FLAC"
 	if quality <= 0 {

internal/provider/deezer/client_test.go

@@ -99,6 +99,118 @@ func TestGetMetadataArtistPaginatesAlbums(t *testing.T) {
 	}
 }
 
+func TestGetMetadataAlbumPaginatesTracks(t *testing.T) {
+	callCount := 0
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/album/46514392":
+			_ = json.NewEncoder(w).Encode(map[string]any{"id": 46514392, "title": "Clouseau30", "tracks": map[string]any{"data": []any{}}})
+		case "/album/46514392/tracks":
+			callCount++
+			index := r.URL.Query().Get("index")
+			limit := r.URL.Query().Get("limit")
+			if limit != "100" {
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			switch index {
+			case "0":
+				items := make([]any, 0, 100)
+				for i := 0; i < 100; i++ {
+					items = append(items, map[string]any{"id": i + 1, "title": "T"})
+				}
+				_ = json.NewEncoder(w).Encode(map[string]any{"data": items, "total": 105})
+			case "100":
+				items := make([]any, 0, 5)
+				for i := 0; i < 5; i++ {
+					items = append(items, map[string]any{"id": 101 + i, "title": "T"})
+				}
+				_ = json.NewEncoder(w).Encode(map[string]any{"data": items, "total": 105})
+			default:
+				w.WriteHeader(http.StatusBadRequest)
+			}
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer ts.Close()
+
+	cfgData := config.DefaultConfigData()
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+	c.loggedIn = true
+
+	origBase := baseURL
+	baseURL = ts.URL
+	defer func() { baseURL = origBase }()
+
+	meta, err := c.GetMetadata(context.Background(), "46514392", "album")
+	if err != nil {
+		t.Fatalf("GetMetadata() error = %v", err)
+	}
+	tracksObj, _ := meta["tracks"].(map[string]any)
+	items, _ := tracksObj["items"].([]any)
+	if len(items) != 105 {
+		t.Fatalf("tracks len = %d, want 105", len(items))
+	}
+	if callCount != 2 {
+		t.Fatalf("track page call count = %d, want 2", callCount)
+	}
+}
+
+func TestGetMetadataPlaylistPaginatesTracks(t *testing.T) {
+	callCount := 0
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/playlist/123":
+			_ = json.NewEncoder(w).Encode(map[string]any{"id": 123, "title": "Mix", "tracks": map[string]any{"data": []any{}}})
+		case "/playlist/123/tracks":
+			callCount++
+			index := r.URL.Query().Get("index")
+			limit := r.URL.Query().Get("limit")
+			if limit != "100" {
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			switch index {
+			case "0":
+				items := make([]any, 0, 100)
+				for i := 0; i < 100; i++ {
+					items = append(items, map[string]any{"id": i + 1, "title": "T"})
+				}
+				_ = json.NewEncoder(w).Encode(map[string]any{"data": items, "total": 101})
+			case "100":
+				_ = json.NewEncoder(w).Encode(map[string]any{"data": []any{map[string]any{"id": 101, "title": "T"}}, "total": 101})
+			default:
+				w.WriteHeader(http.StatusBadRequest)
+			}
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer ts.Close()
+
+	cfgData := config.DefaultConfigData()
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+	c.loggedIn = true
+
+	origBase := baseURL
+	baseURL = ts.URL
+	defer func() { baseURL = origBase }()
+
+	meta, err := c.GetMetadata(context.Background(), "123", "playlist")
+	if err != nil {
+		t.Fatalf("GetMetadata() error = %v", err)
+	}
+	tracksObj, _ := meta["tracks"].(map[string]any)
+	items, _ := tracksObj["items"].([]any)
+	if len(items) != 101 {
+		t.Fatalf("tracks len = %d, want 101", len(items))
+	}
+	if callCount != 2 {
+		t.Fatalf("track page call count = %d, want 2", callCount)
+	}
+}
+
 func TestGetDownloadableNativeCipher(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
@@ -161,6 +273,58 @@ func TestGetDownloadableNativeCipher(t *testing.T) {
 	}
 }
 
+func TestGetDownloadablePrefersNoneCipherWhenAvailable(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/track/42":
+			_ = json.NewEncoder(w).Encode(map[string]any{"id": 42, "title": "X", "track_token": "tt"})
+		case "/media":
+			_ = json.NewEncoder(w).Encode(map[string]any{"data": []any{map[string]any{"errors": []any{}, "media": []any{
+				map[string]any{"cipher": map[string]any{"type": "BF_CBC_STRIPE"}, "format": "FLAC", "sources": []any{map[string]any{"url": "https://cdn.example/bf"}}},
+				map[string]any{"cipher": map[string]any{"type": "NONE"}, "format": "FLAC", "sources": []any{map[string]any{"url": "https://cdn.example/plain"}}},
+			}}}})
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer ts.Close()
+
+	cfgData := config.DefaultConfigData()
+	cfgData.Deezer.ARL = "arl"
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+	c.loggedIn = true
+	c.arl = "arl"
+	c.license = "license"
+	c.jwt = "jwt"
+
+	origBase := baseURL
+	origMedia := mediaURL
+	origPipe := pipeURL
+	baseURL = ts.URL
+	mediaURL = ts.URL + "/media"
+	pipeURL = ts.URL + "/pipe"
+	defer func() {
+		baseURL = origBase
+		mediaURL = origMedia
+		pipeURL = origPipe
+	}()
+
+	d, err := c.GetDownloadable(context.Background(), "42", 2)
+	if err != nil {
+		t.Fatalf("GetDownloadable() error = %v", err)
+	}
+	if d.Cipher != "NONE" || d.URL != "https://cdn.example/plain" {
+		t.Fatalf("expected NONE cipher source, got %+v", d)
+	}
+}
+
+func TestExtractTrackIDFromMediaURL(t *testing.T) {
+	url := "https://f-cdnt-stream.dzcdn.net/media/1/9/6/4/8/2552667002/64821d6a2007e90768fa0300b508fcf4.flac?hdnea=x"
+	if got := extractTrackIDFromMediaURL(url); got != "2552667002" {
+		t.Fatalf("extractTrackIDFromMediaURL() = %q, want 2552667002", got)
+	}
+}
+
 func TestLoginPrefersARLFlowOverRefreshShortcut(t *testing.T) {
 	mobileToken := testMobileToken(t)
 	refreshCalled := false
@@ -298,13 +462,16 @@ func TestGetTrackTokenPrefersPipeToken(t *testing.T) {
 		pipeURL = origPipe
 	}()
 
-	token, err := c.getTrackToken(context.Background(), "42")
+	token, mediaID, err := c.getTrackToken(context.Background(), "42")
 	if err != nil {
 		t.Fatalf("getTrackToken() error = %v", err)
 	}
 	if token != "pipe-track-token" {
 		t.Fatalf("token = %q, want pipe-track-token", token)
 	}
+	if mediaID != "" {
+		t.Fatalf("mediaID = %q, want empty when pipe media id missing", mediaID)
+	}
 }
 
 func TestGetDownloadableUsesPipeTrackToken(t *testing.T) {

internal/provider/provider.go

@@ -7,6 +7,7 @@ type Downloadable struct {
 	Extension string
 	Source    string
 	Cipher    string
+	Key       string
 	TrackID   string
 	Audio     AudioProfile
 }

internal/provider/qobuz/client.go

@@ -1,20 +1,28 @@
 package qobuz
 
 import (
+	"bytes"
 	"context"
+	"crypto/aes"
+	"crypto/cipher"
 	"crypto/md5"
+	"crypto/sha256"
 	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"hash"
 	"io"
 	"net/http"
 	"net/url"
+	"os"
+	"path/filepath"
 	"regexp"
 	"sort"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"streamrip-go/internal/config"
@@ -22,10 +30,28 @@ import (
 	"streamrip-go/internal/netutil"
 	"streamrip-go/internal/provider"
 	"streamrip-go/internal/ratelimit"
+
+	"github.com/vbauerster/mpb/v8"
+	"github.com/vbauerster/mpb/v8/decor"
+	"golang.org/x/crypto/hkdf"
 )
 
 const baseURL = "https://www.qobuz.com/api.json/0.2"
 
+const (
+	mobileAppID        = "312369995"
+	mobileAppSecret    = "e79f8b9be485692b0e5f9dd895826368"
+	mobileUserAgent    = "Dalvik/2.1.0 (Linux; U; Android 9; Nexus 6P Build/PQ3A.190801.002) QobuzMobileAndroid/9.7.0.3-b26022717"
+	mobileAppVersion   = "9.7.0.3"
+	mobileSessionProf  = "qbz-1"
+	mobileSegmentTries = 3
+)
+
+var qobuzUUIDBytes = []byte{
+	0x3b, 0x42, 0x12, 0x92, 0x56, 0xf3, 0x5f, 0x75,
+	0x92, 0x36, 0x63, 0xb6, 0x9a, 0x1f, 0x52, 0xb2,
+}
+
 var (
 	errMissingCredentials = errors.New("missing qobuz credentials")
 	errNotLoggedIn        = errors.New("qobuz client not logged in")
@@ -40,12 +66,29 @@ type Client struct {
 	loggedIn bool
 	secret   string
 	uat      string
+
+	mobileMu          sync.Mutex
+	mobileAccessToken string
+	mobileSessionID   string
+	mobileSessionInfo string
+	mobileKEK         []byte
+}
+
+type mobileFileURL struct {
+	URL         string  `json:"url"`
+	URLTemplate string  `json:"url_template"`
+	NSegments   int     `json:"n_segments"`
+	FormatID    int     `json:"format_id"`
+	MimeType    string  `json:"mime_type"`
+	Sampling    float64 `json:"sampling_rate"`
+	BitDepth    int     `json:"bits_depth"`
+	Key         string  `json:"key"`
 }
 
 func New(cfg *config.Config) *Client {
 	return &Client{
 		cfg:      cfg,
-		http:     netutil.NewHTTPClient(30*time.Second, cfg.Session.Downloads.VerifySSL),
+		http:     netutil.NewHTTPClient(30*time.Second, cfg.Session.Downloads.VerifySSL, cfg.Session.Downloads.MaxConnections),
 		limiter:  ratelimit.New(cfg.Session.Downloads.RequestsPerMinute),
 		baseURL:  baseURL,
 		fetchCfg: nil,
@@ -399,6 +442,122 @@ func (c *Client) Close() error {
 	return nil
 }
 
+func (c *Client) DownloadTrackFallback(ctx context.Context, trackID string, quality int, outputPath string) error {
+	q := &c.cfg.Session.Qobuz
+	if strings.TrimSpace(q.EmailOrUserID) == "" || strings.TrimSpace(q.PasswordOrToken) == "" || q.UseAuthToken {
+		return errors.New("qobuz mobile fallback requires email/password credentials")
+	}
+	if quality < 1 || quality > 4 {
+		quality = q.Quality
+	}
+	formatID := qualityMap(quality)
+
+	if err := c.ensureMobileSession(ctx); err != nil {
+		return err
+	}
+	fileURL, err := c.mobileGetFileURL(ctx, trackID, formatID)
+	if err != nil {
+		return err
+	}
+
+	if err = os.MkdirAll(filepath.Dir(outputPath), 0o755); err != nil {
+		return err
+	}
+	out, err := os.Create(outputPath)
+	if err != nil {
+		return err
+	}
+	success := false
+	defer func() {
+		_ = out.Close()
+		if !success {
+			_ = os.Remove(outputPath)
+		}
+	}()
+
+	progress := mpb.New(mpb.WithWidth(40), mpb.WithOutput(os.Stderr))
+	defer progress.Wait()
+	desc := shortenName(filepath.Base(outputPath), 54)
+	bar := progress.AddSpinner(
+		0,
+		mpb.PrependDecorators(
+			decor.Name(desc+" ", decor.WC{W: 56, C: decor.DSyncWidth | decor.DindentRight}),
+		),
+		mpb.AppendDecorators(
+			decor.CurrentKibiByte("% .1f", decor.WCSyncWidthR),
+			decor.Name(" | ", decor.WCSyncWidth),
+			decor.Elapsed(decor.ET_STYLE_GO, decor.WCSyncWidthR),
+		),
+		mpb.BarRemoveOnComplete(),
+	)
+	defer func() {
+		if !success {
+			bar.Abort(true)
+		}
+		bar.SetTotal(-1, true)
+	}()
+
+	if strings.TrimSpace(fileURL.URL) != "" && fileURL.NSegments == 0 {
+		err = c.mobileCopyURLToWriter(ctx, strings.TrimSpace(fileURL.URL), out, bar)
+		if err != nil {
+			return err
+		}
+		success = true
+		return nil
+	}
+	if strings.TrimSpace(fileURL.URLTemplate) == "" {
+		return errors.New("qobuz mobile fallback: no download URL available")
+	}
+
+	var trackKey []byte
+	if strings.TrimSpace(fileURL.Key) != "" {
+		trackKey, err = c.mobileDeriveTrackKey(fileURL.Key)
+		if err != nil {
+			return fmt.Errorf("derive mobile track key: %w", err)
+		}
+	}
+
+	nSegs := fileURL.NSegments
+	if nSegs == 0 {
+		nSegs = 1
+	}
+	initURL := strings.Replace(fileURL.URLTemplate, "$SEGMENT$", "0", 1)
+	initData, err := c.mobileDownloadSegment(ctx, initURL)
+	if err != nil {
+		return fmt.Errorf("download init segment: %w", err)
+	}
+
+	if hdr := extractFLACHeader(initData); hdr != nil {
+		if _, err = out.Write(hdr); err != nil {
+			return err
+		}
+		bar.IncrBy(len(hdr))
+	} else {
+		if _, err = out.Write(initData); err != nil {
+			return err
+		}
+		bar.IncrBy(len(initData))
+	}
+
+	for seg := 1; seg <= nSegs; seg++ {
+		segURL := strings.Replace(fileURL.URLTemplate, "$SEGMENT$", strconv.Itoa(seg), 1)
+		data, dlErr := c.mobileDownloadSegment(ctx, segURL)
+		if dlErr != nil {
+			return fmt.Errorf("download segment %d: %w", seg, dlErr)
+		}
+		frames := extractFrames(data, trackKey)
+		if _, err = out.Write(frames); err != nil {
+			return err
+		}
+		bar.IncrBy(len(frames))
+	}
+	if err = out.Sync(); err != nil {
+		return err
+	}
+	success = true
+	return nil
+}
+
 func (c *Client) getPlaylist(ctx context.Context, playlistID string) (map[string]any, error) {
 	pageLimit := 500
 	params := url.Values{}
@@ -820,3 +979,460 @@ func sortedKeys(m map[string][]string) []string {
 	sort.Strings(keys)
 	return keys
 }
+
+func (c *Client) ensureMobileSession(ctx context.Context) error {
+	c.mobileMu.Lock()
+	defer c.mobileMu.Unlock()
+	if c.mobileAccessToken != "" && c.mobileSessionID != "" && c.mobileSessionInfo != "" {
+		return nil
+	}
+	q := &c.cfg.Session.Qobuz
+	if err := c.mobileLogin(ctx, q.EmailOrUserID, q.PasswordOrToken); err != nil {
+		return err
+	}
+	if err := c.mobileStartSession(ctx); err != nil {
+		c.mobileAccessToken = ""
+		return err
+	}
+	return nil
+}
+
+func (c *Client) mobileLogin(ctx context.Context, username, password string) error {
+	ts := time.Now().Unix()
+	params := url.Values{}
+	params.Set("app_id", mobileAppID)
+	params.Set("username", username)
+	params.Set("password", password)
+	params.Set("request_ts", strconv.FormatInt(ts, 10))
+	params.Set("request_sig", mobileSignRequest("oauth2/login", []kv{{"password", password}, {"username", username}}, ts))
+
+	reqURL := baseURL + "/oauth2/login?" + params.Encode()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, reqURL, nil)
+	if err != nil {
+		return err
+	}
+	c.setMobileHeaders(req)
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return fmt.Errorf("mobile login request failed: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return err
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("mobile login failed: status=%d body=%s", resp.StatusCode, string(body))
+	}
+	var parsed struct {
+		OAuth2 struct {
+			AccessToken string `json:"access_token"`
+		} `json:"oauth2"`
+	}
+	if err = json.Unmarshal(body, &parsed); err != nil {
+		return fmt.Errorf("mobile login parse failed: %w", err)
+	}
+	if strings.TrimSpace(parsed.OAuth2.AccessToken) == "" {
+		return errors.New("mobile login returned empty token")
+	}
+	c.mobileAccessToken = strings.TrimSpace(parsed.OAuth2.AccessToken)
+	return nil
+}
+
+func (c *Client) mobileStartSession(ctx context.Context) error {
+	ts := time.Now().Unix()
+	params := url.Values{}
+	params.Set("app_id", mobileAppID)
+	params.Set("request_ts", strconv.FormatInt(ts, 10))
+	params.Set("request_sig", mobileSignRequest("session/start", []kv{{"profile", mobileSessionProf}}, ts))
+
+	reqURL := baseURL + "/session/start?" + params.Encode()
+	form := url.Values{}
+	form.Set("profile", mobileSessionProf)
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, reqURL, strings.NewReader(form.Encode()))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	c.setMobileHeaders(req)
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return fmt.Errorf("mobile session request failed: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return err
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("mobile session start failed: status=%d body=%s", resp.StatusCode, string(body))
+	}
+	var parsed struct {
+		SessionID string `json:"session_id"`
+		Infos     string `json:"infos"`
+	}
+	if err = json.Unmarshal(body, &parsed); err != nil {
+		return fmt.Errorf("mobile session parse failed: %w", err)
+	}
+	if strings.TrimSpace(parsed.SessionID) == "" || strings.TrimSpace(parsed.Infos) == "" {
+		return errors.New("mobile session start returned incomplete session data")
+	}
+	c.mobileSessionID = strings.TrimSpace(parsed.SessionID)
+	c.mobileSessionInfo = strings.TrimSpace(parsed.Infos)
+	c.mobileKEK = nil
+	return nil
+}
+
+func (c *Client) mobileGetFileURL(ctx context.Context, trackID string, formatID int) (*mobileFileURL, error) {
+	ts := time.Now().Unix()
+	params := url.Values{}
+	params.Set("app_id", mobileAppID)
+	params.Set("track_id", trackID)
+	params.Set("format_id", strconv.Itoa(formatID))
+	params.Set("intent", "stream")
+	params.Set("request_ts", strconv.FormatInt(ts, 10))
+	params.Set("request_sig", mobileSignRequest("file/url", []kv{{"format_id", strconv.Itoa(formatID)}, {"intent", "stream"}, {"track_id", trackID}}, ts))
+	reqURL := baseURL + "/file/url?" + params.Encode()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, reqURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	c.setMobileHeaders(req)
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("mobile file url failed: status=%d body=%s", resp.StatusCode, string(body))
+	}
+	var parsed mobileFileURL
+	if err = json.Unmarshal(body, &parsed); err != nil {
+		return nil, fmt.Errorf("mobile file url parse failed: %w", err)
+	}
+	return &parsed, nil
+}
+
+func (c *Client) mobileCopyURLToWriter(ctx context.Context, sourceURL string, out io.Writer, bar *mpb.Bar) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, sourceURL, nil)
+	if err != nil {
+		return err
+	}
+	c.setMobileHeaders(req)
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("mobile fallback download failed: status=%d", resp.StatusCode)
+	}
+	written, err := io.Copy(out, &countingReader{r: resp.Body, onRead: func(n int) {
+		if bar != nil && n > 0 {
+			bar.IncrBy(n)
+		}
+	}})
+	if err != nil {
+		return err
+	}
+	if resp.ContentLength > 0 && written != resp.ContentLength {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+
+type countingReader struct {
+	r      io.Reader
+	onRead func(int)
+}
+
+func (c *countingReader) Read(p []byte) (int, error) {
+	n, err := c.r.Read(p)
+	if n > 0 && c.onRead != nil {
+		c.onRead(n)
+	}
+	return n, err
+}
+
+func shortenName(name string, max int) string {
+	if max <= 0 {
+		return name
+	}
+	r := []rune(name)
+	if len(r) <= max {
+		return name
+	}
+	if max <= 3 {
+		return string(r[:max])
+	}
+	return string(r[:max-3]) + "..."
+}
+
+func (c *Client) mobileDownloadSegment(ctx context.Context, sourceURL string) ([]byte, error) {
+	var lastErr error
+	for attempt := 0; attempt < mobileSegmentTries; attempt++ {
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, sourceURL, nil)
+		if err != nil {
+			return nil, err
+		}
+		c.setMobileHeaders(req)
+		resp, err := c.http.Do(req)
+		if err != nil {
+			lastErr = err
+			time.Sleep(time.Duration(500*(attempt+1)) * time.Millisecond)
+			continue
+		}
+		if resp.StatusCode != http.StatusOK {
+			lastErr = fmt.Errorf("status=%d", resp.StatusCode)
+			_ = resp.Body.Close()
+			time.Sleep(time.Duration(500*(attempt+1)) * time.Millisecond)
+			continue
+		}
+		data, readErr := io.ReadAll(resp.Body)
+		_ = resp.Body.Close()
+		if readErr != nil {
+			lastErr = readErr
+			time.Sleep(time.Duration(500*(attempt+1)) * time.Millisecond)
+			continue
+		}
+		return data, nil
+	}
+	if lastErr == nil {
+		lastErr = errors.New("unknown segment error")
+	}
+	return nil, fmt.Errorf("mobile segment download failed after retries: %w", lastErr)
+}
+
+func (c *Client) setMobileHeaders(req *http.Request) {
+	req.Header.Set("User-Agent", mobileUserAgent)
+	req.Header.Set("X-App-Id", mobileAppID)
+	req.Header.Set("X-App-Version", mobileAppVersion)
+	req.Header.Set("X-Device-Platform", "android")
+	req.Header.Set("X-Device-Model", "Nexus 6P")
+	req.Header.Set("X-Device-Os-Version", "9")
+	if c.mobileAccessToken != "" {
+		req.Header.Set("Authorization", "Bearer "+c.mobileAccessToken)
+	}
+	if c.mobileSessionID != "" {
+		req.Header.Set("X-Session-Id", c.mobileSessionID)
+	}
+}
+
+func mobileSignRequest(endpoint string, params []kv, ts int64) string {
+	method := strings.ReplaceAll(endpoint, "/", "")
+	sortKVs(params)
+	var sb strings.Builder
+	sb.WriteString(method)
+	for _, p := range params {
+		sb.WriteString(p.Key)
+		sb.WriteString(p.Value)
+	}
+	sb.WriteString(strconv.FormatInt(ts, 10))
+	sb.WriteString(mobileAppSecret)
+	h := md5.Sum([]byte(sb.String()))
+	return hex.EncodeToString(h[:])
+}
+
+type kv struct {
+	Key   string
+	Value string
+}
+
+func sortKVs(s []kv) {
+	for i := 0; i < len(s); i++ {
+		for j := i + 1; j < len(s); j++ {
+			if s[j].Key < s[i].Key {
+				s[i], s[j] = s[j], s[i]
+			}
+		}
+	}
+}
+
+func (c *Client) mobileDeriveTrackKey(encryptedKey string) ([]byte, error) {
+	if len(c.mobileKEK) == 16 {
+		return unwrapQobuzTrackKey(encryptedKey, c.mobileKEK)
+	}
+	parts := strings.SplitN(c.mobileSessionInfo, ".", 2)
+	if len(parts) != 2 {
+		return nil, errors.New("invalid mobile session infos format")
+	}
+	salt, err := base64.RawURLEncoding.DecodeString(parts[0])
+	if err != nil {
+		return nil, fmt.Errorf("decode mobile salt: %w", err)
+	}
+	info, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return nil, fmt.Errorf("decode mobile info: %w", err)
+	}
+	reader := hkdf.New(func() hash.Hash { return sha256.New() }, hexDecodeOrNil(mobileAppSecret), salt, info)
+	kek := make([]byte, 16)
+	if _, err = io.ReadFull(reader, kek); err != nil {
+		return nil, fmt.Errorf("mobile hkdf derive failed: %w", err)
+	}
+	c.mobileKEK = kek
+	return unwrapQobuzTrackKey(encryptedKey, kek)
+}
+
+func hexDecodeOrNil(s string) []byte {
+	b, _ := hex.DecodeString(s)
+	return b
+}
+
+func unwrapQobuzTrackKey(encryptedKey string, kek []byte) ([]byte, error) {
+	parts := strings.SplitN(encryptedKey, ".", 3)
+	if len(parts) != 3 || parts[0] != mobileSessionProf {
+		return nil, errors.New("invalid qobuz track key format")
+	}
+	encKey, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return nil, fmt.Errorf("decode encrypted key failed: %w", err)
+	}
+	iv, err := base64.RawURLEncoding.DecodeString(parts[2])
+	if err != nil {
+		return nil, fmt.Errorf("decode key iv failed: %w", err)
+	}
+	block, err := aes.NewCipher(kek)
+	if err != nil {
+		return nil, err
+	}
+	decrypted := make([]byte, len(encKey))
+	mode := cipher.NewCBCDecrypter(block, iv)
+	mode.CryptBlocks(decrypted, encKey)
+	if len(decrypted) < 16 {
+		return nil, errors.New("decrypted key too short")
+	}
+	return decrypted[:16], nil
+}
+
+func extractFLACHeader(data []byte) []byte {
+	blocks := findDFLABlocks(data)
+	if blocks == nil {
+		return nil
+	}
+	out := make([]byte, 4+len(blocks))
+	copy(out, "fLaC")
+	copy(out[4:], blocks)
+	return out
+}
+
+func findDFLABlocks(data []byte) []byte {
+	pos := 0
+	for pos+8 <= len(data) {
+		size := int(uint32(data[pos])<<24 | uint32(data[pos+1])<<16 | uint32(data[pos+2])<<8 | uint32(data[pos+3]))
+		if size < 8 || pos+size > len(data) {
+			break
+		}
+		t := data[pos+4 : pos+8]
+		if string(t) == "dfLa" {
+			body := data[pos+8 : pos+size]
+			if len(body) > 4 {
+				return body[4:]
+			}
+		}
+		var inner []byte
+		switch string(t) {
+		case "moov", "trak", "mdia", "minf", "stbl":
+			inner = data[pos+8 : pos+size]
+		case "stsd":
+			if pos+16 <= pos+size {
+				inner = data[pos+16 : pos+size]
+			}
+		case "fLaC":
+			if pos+36 <= pos+size {
+				inner = data[pos+36 : pos+size]
+			}
+		}
+		if inner != nil {
+			if result := findDFLABlocks(inner); result != nil {
+				return result
+			}
+		}
+		pos += size
+	}
+	return nil
+}
+
+func extractFrames(data []byte, key []byte) []byte {
+	var frames []byte
+	pos := 0
+	for pos+8 <= len(data) {
+		boxSize := int(uint32(data[pos])<<24 | uint32(data[pos+1])<<16 | uint32(data[pos+2])<<8 | uint32(data[pos+3]))
+		if boxSize < 8 || pos+boxSize > len(data) {
+			break
+		}
+		if string(data[pos+4:pos+8]) == "uuid" && boxSize >= 36 {
+			if pos+24 > len(data) {
+				pos += boxSize
+				continue
+			}
+			if bytes.Equal(data[pos+8:pos+24], qobuzUUIDBytes) {
+				f := parseUUIDBox(data, pos, boxSize, key)
+				frames = append(frames, f...)
+			}
+		}
+		pos += boxSize
+	}
+	return frames
+}
+
+func parseUUIDBox(data []byte, boxStart, boxSize int, key []byte) []byte {
+	bodyOff := boxStart + 24
+	if bodyOff+12 > len(data) {
+		return nil
+	}
+	rawOffset := readU32BE(data, bodyOff+4)
+	numSamples := int(readU24BE(data, bodyOff+9))
+	if numSamples == 0 || numSamples > 10000 {
+		return nil
+	}
+	tableOff := bodyOff + 12
+	sampleDataOff := boxStart + int(rawOffset)
+	var frames []byte
+	offset := sampleDataOff
+	for i := 0; i < numSamples; i++ {
+		et := tableOff + i*16
+		if et+16 > len(data) || offset >= len(data) {
+			break
+		}
+		size := readU32BE(data, et)
+		encFlag := data[et+6] != 0 || data[et+7] != 0
+		end := offset + int(size)
+		if end > len(data) {
+			break
+		}
+		if encFlag && len(key) == 16 {
+			iv := make([]byte, 16)
+			copy(iv[:8], data[et+8:et+16])
+			block, err := aes.NewCipher(key)
+			if err != nil {
+				return frames
+			}
+			stream := cipher.NewCTR(block, iv)
+			decrypted := make([]byte, end-offset)
+			stream.XORKeyStream(decrypted, data[offset:end])
+			frames = append(frames, decrypted...)
+		} else {
+			frames = append(frames, data[offset:end]...)
+		}
+		offset = end
+	}
+	return frames
+}
+
+func readU32BE(data []byte, off int) uint32 {
+	if off+4 > len(data) {
+		return 0
+	}
+	return uint32(data[off])<<24 | uint32(data[off+1])<<16 | uint32(data[off+2])<<8 | uint32(data[off+3])
+}
+
+func readU24BE(data []byte, off int) uint32 {
+	if off+3 > len(data) {
+		return 0
+	}
+	return uint32(data[off])<<16 | uint32(data[off+1])<<8 | uint32(data[off+2])
+}

internal/provider/tidal/client.go

@@ -23,10 +23,12 @@ import (
 
 const (
 	baseURL              = "https://api.tidalhifi.com/v1"
+	lyricsAPIv1          = "https://api.tidal.com/v1"
 	openAPIV2            = "https://openapi.tidal.com/v2"
 	authURL              = "https://auth.tidal.com/v1/oauth2"
 	clientID             = "fX2JxdmntZWK0ixT"
 	clientSec            = "1Nm5AfDAjxrgJFJbKNWLeAyKGVGmINuXPPLHVXAvxAg="
+	tidalRequestAttempts = 3
 )
 
 var qualityMap = map[int]string{
@@ -54,6 +56,7 @@ type Client struct {
 	http      *http.Client
 	limiter   *ratelimit.Limiter
 	baseURL   string
+	lyricsAPI string
 	openAPI   string
 	loggedIn  bool
 }
@@ -61,9 +64,10 @@ type Client struct {
 func New(cfg *config.Config) *Client {
 	return &Client{
 		cfg:       cfg,
-		http:    netutil.NewHTTPClient(30*time.Second, cfg.Session.Downloads.VerifySSL),
+		http:      netutil.NewHTTPClient(30*time.Second, cfg.Session.Downloads.VerifySSL, cfg.Session.Downloads.MaxConnections),
 		limiter:   ratelimit.New(cfg.Session.Downloads.RequestsPerMinute),
 		baseURL:   baseURL,
+		lyricsAPI: lyricsAPIv1,
 		openAPI:   openAPIV2,
 	}
 }
@@ -206,11 +210,52 @@ func (c *Client) GetMetadata(ctx context.Context, item, mediaType string) (map[s
 		if album, ok := resp["album"].(map[string]any); ok {
 			enrichTidalImage(album)
 		}
+		// Lyrics live on a separate endpoint, so fetching them costs an extra
+		// rate-limited roundtrip per track. Users who don't embed lyrics can
+		// opt out via metadata.exclude = ["lyrics"].
+		if !c.lyricsExcluded() {
+			if lyrics, lrc := c.fetchTrackLyrics(ctx, item); lyrics != "" || lrc != "" {
+				if lyrics != "" {
+					resp["lyrics"] = lyrics
+				}
+				if lrc != "" {
+					resp["lyrics_synced"] = lrc
+				}
+			}
+		}
 	}
 
 	return resp, nil
 }
 
+func (c *Client) lyricsExcluded() bool {
+	for _, k := range c.cfg.Session.Metadata.Exclude {
+		if strings.EqualFold(strings.TrimSpace(k), "lyrics") {
+			return true
+		}
+	}
+	return false
+}
+
+func (c *Client) fetchTrackLyrics(ctx context.Context, trackID string) (string, string) {
+	params := url.Values{}
+	params.Set("deviceType", "PHONE")
+	params.Set("locale", "en_US")
+	params.Set("platform", "ANDROID")
+
+	resp, status, err := c.apiRequest(ctx, "tracks/"+url.PathEscape(strings.TrimSpace(trackID))+"/lyrics", params, c.lyricsAPI)
+	if err != nil {
+		return "", ""
+	}
+	if status != http.StatusOK {
+		return "", ""
+	}
+
+	lyrics := strings.TrimSpace(stringify(resp["lyrics"]))
+	lrc := strings.TrimSpace(stringify(resp["subtitles"]))
+	return lyrics, lrc
+}
+
 func (c *Client) Search(ctx context.Context, mediaType, query string, limit int) ([]map[string]any, error) {
 	if !c.loggedIn {
 		return nil, errors.New("tidal client not logged in")
@@ -247,12 +292,13 @@ func (c *Client) GetDownloadable(ctx context.Context, trackID string, quality in
 	}
 
 	if c.cfg.Session.Tidal.PreferAtmos {
-		if c.trackSupportsAtmos(ctx, trackID) {
+		// No tracks/{id} pre-check: getAtmosDownloadable already validates
+		// each candidate response via playbackLooksAtmos and falls back
+		// through the format-specific trackManifests paths.
 		if d, _ := c.getAtmosDownloadable(ctx, trackID); d != nil {
 			return d, nil
 		}
 	}
-	}
 
 	params := url.Values{}
 	params.Set("audioquality", qualityMap[quality])
@@ -265,6 +311,10 @@ func (c *Client) GetDownloadable(ctx context.Context, trackID string, quality in
 	}
 	if status == http.StatusOK {
 		if d := downloadableFromPlaybackManifest(resp); d != nil {
+			// Tidal's playbackinfo sometimes returns an m4a (HIGH/AAC)
+			// stream even when LOSSLESS+ was requested. There is no
+			// lossless m4a tier, so retry via the openAPI v2 manifest
+			// before settling for the downgrade.
 			if quality >= 2 && d.Extension == "m4a" {
 				if strict, strictErr := c.getDownloadableFromTrackManifest(ctx, trackID, quality); strictErr == nil && strict != nil {
 					return strict, nil
@@ -794,11 +844,111 @@ func resolvePlaylistURL(baseRaw, refRaw string) string {
 	return baseURL.ResolveReference(refURL).String()
 }
 
-func (c *Client) apiRequest(ctx context.Context, path string, params url.Values, base string) (map[string]any, int, error) {
+func shouldRetryStatus(status int) bool {
+	return status == http.StatusTooManyRequests || status >= http.StatusInternalServerError
+}
+
+func retryDelay(retryAfter string, attempt int) time.Duration {
+	retryAfter = strings.TrimSpace(retryAfter)
+	if retryAfter != "" {
+		if seconds, err := strconv.Atoi(retryAfter); err == nil && seconds >= 0 {
+			return time.Duration(seconds) * time.Second
+		}
+		if when, err := http.ParseTime(retryAfter); err == nil {
+			if delay := time.Until(when); delay > 0 {
+				return delay
+			}
+			return 0
+		}
+	}
+	return time.Duration(attempt+1) * 500 * time.Millisecond
+}
+
+func waitRetry(ctx context.Context, delay time.Duration) error {
+	if delay <= 0 {
+		return nil
+	}
+	timer := time.NewTimer(delay)
+	defer timer.Stop()
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-timer.C:
+		return nil
+	}
+}
+
+func parseAPIResponseBody(body []byte, status int) (map[string]any, error) {
+	out := map[string]any{}
+	if len(body) == 0 {
+		return out, nil
+	}
+	if err := json.Unmarshal(body, &out); err != nil {
+		if status < http.StatusOK || status >= http.StatusMultipleChoices {
+			if raw := strings.TrimSpace(string(body)); raw != "" {
+				out["raw"] = raw
+			}
+			return out, nil
+		}
+		return nil, err
+	}
+	return out, nil
+}
+
+func readAPIResponse(resp *http.Response) (map[string]any, int, string, error) {
+	defer func() { _ = resp.Body.Close() }()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, resp.StatusCode, resp.Header.Get("Retry-After"), err
+	}
+	parsed, err := parseAPIResponseBody(body, resp.StatusCode)
+	return parsed, resp.StatusCode, resp.Header.Get("Retry-After"), err
+}
+
+func (c *Client) doJSONWithRetry(ctx context.Context, newRequest func() (*http.Request, error)) (map[string]any, int, error) {
+	var lastStatus int
+	for attempt := 0; attempt < tidalRequestAttempts; attempt++ {
 		if err := c.limiter.Wait(ctx); err != nil {
 			return nil, 0, err
 		}
+		req, err := newRequest()
+		if err != nil {
+			return nil, 0, err
+		}
+		resp, err := c.http.Do(req)
+		if err != nil {
+			if attempt+1 < tidalRequestAttempts {
+				if waitErr := waitRetry(ctx, retryDelay("", attempt)); waitErr != nil {
+					return nil, 0, waitErr
+				}
+				continue
+			}
+			return nil, 0, err
+		}
 
+		parsed, status, retryAfter, err := readAPIResponse(resp)
+		lastStatus = status
+		if err != nil {
+			if attempt+1 < tidalRequestAttempts {
+				if waitErr := waitRetry(ctx, retryDelay(retryAfter, attempt)); waitErr != nil {
+					return nil, 0, waitErr
+				}
+				continue
+			}
+			return nil, status, err
+		}
+		if shouldRetryStatus(status) && attempt+1 < tidalRequestAttempts {
+			if waitErr := waitRetry(ctx, retryDelay(retryAfter, attempt)); waitErr != nil {
+				return nil, 0, waitErr
+			}
+			continue
+		}
+		return parsed, status, nil
+	}
+	return map[string]any{}, lastStatus, nil
+}
+
+func (c *Client) apiRequest(ctx context.Context, path string, params url.Values, base string) (map[string]any, int, error) {
 	if params == nil {
 		params = url.Values{}
 	}
@@ -814,41 +964,22 @@ func (c *Client) apiRequest(ctx context.Context, path string, params url.Values,
 		reqURL += "?" + params.Encode()
 	}
 
+	return c.doJSONWithRetry(ctx, func() (*http.Request, error) {
 		req, err := http.NewRequestWithContext(ctx, http.MethodGet, reqURL, nil)
 		if err != nil {
-		return nil, 0, err
+			return nil, err
 		}
 		req.Header.Set("Authorization", "Bearer "+c.cfg.Session.Tidal.AccessToken)
 		req.Header.Set("User-Agent", "streamrip-go/0.1")
-
-	resp, err := c.http.Do(req)
-	if err != nil {
-		return nil, 0, err
-	}
-	defer func() { _ = resp.Body.Close() }()
-
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, resp.StatusCode, err
-	}
-	parsed := map[string]any{}
-	if len(body) > 0 {
-		if err = json.Unmarshal(body, &parsed); err != nil {
-			return nil, resp.StatusCode, err
-		}
-	}
-
-	return parsed, resp.StatusCode, nil
+		return req, nil
+	})
 }
 
 func (c *Client) apiPost(ctx context.Context, endpoint string, form url.Values, basicAuth bool) (map[string]any, int, error) {
-	if err := c.limiter.Wait(ctx); err != nil {
-		return nil, 0, err
-	}
-
+	return c.doJSONWithRetry(ctx, func() (*http.Request, error) {
 		req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewBufferString(form.Encode()))
 		if err != nil {
-		return nil, 0, err
+			return nil, err
 		}
 		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		req.Header.Set("User-Agent", "streamrip-go/0.1")
@@ -856,23 +987,8 @@ func (c *Client) apiPost(ctx context.Context, endpoint string, form url.Values,
 			auth := base64.StdEncoding.EncodeToString([]byte(clientID + ":" + clientSec))
 			req.Header.Set("Authorization", "Basic "+auth)
 		}
-
-	resp, err := c.http.Do(req)
-	if err != nil {
-		return nil, 0, err
-	}
-	defer func() { _ = resp.Body.Close() }()
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, resp.StatusCode, err
-	}
-	out := map[string]any{}
-	if len(body) > 0 {
-		if err = json.Unmarshal(body, &out); err != nil {
-			return nil, resp.StatusCode, err
-		}
-	}
-	return out, resp.StatusCode, nil
+		return req, nil
+	})
 }
 
 func stringify(v any) string {

internal/provider/tidal/client_test.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"reflect"
 	"strconv"
 	"testing"
@@ -162,6 +163,159 @@ func TestGetMetadataArtistPaginatesAlbums(t *testing.T) {
 	}
 }
 
+func TestGetMetadataTrackAddsLyricsAndSyncedLyrics(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/v1/tracks/42":
+			_ = json.NewEncoder(w).Encode(map[string]any{"id": 42, "title": "Song", "album": map[string]any{"id": 10, "title": "Album"}})
+		case "/v1/tracks/42/lyrics":
+			q := r.URL.Query()
+			if q.Get("deviceType") != "PHONE" || q.Get("locale") != "en_US" || q.Get("platform") != "ANDROID" || q.Get("countryCode") != "MY" {
+				w.WriteHeader(http.StatusBadRequest)
+				_ = json.NewEncoder(w).Encode(map[string]any{"error": "bad query"})
+				return
+			}
+			_ = json.NewEncoder(w).Encode(map[string]any{
+				"lyrics":    "plain lyrics line",
+				"subtitles": "[00:00.00]plain lyrics line",
+			})
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer ts.Close()
+
+	cfgData := config.DefaultConfigData()
+	cfgData.Tidal.AccessToken = "token"
+	cfgData.Tidal.CountryCode = "MY"
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+	c.loggedIn = true
+	c.baseURL = ts.URL + "/v1"
+	c.lyricsAPI = ts.URL + "/v1"
+
+	meta, err := c.GetMetadata(context.Background(), "42", "track")
+	if err != nil {
+		t.Fatalf("GetMetadata() err = %v", err)
+	}
+	if got := stringify(meta["lyrics"]); got != "plain lyrics line" {
+		t.Fatalf("lyrics = %q, want plain lyrics line", got)
+	}
+	if got := stringify(meta["lyrics_synced"]); got != "[00:00.00]plain lyrics line" {
+		t.Fatalf("lyrics_synced = %q, want synced lrc", got)
+	}
+}
+
+func TestGetMetadataTrackIgnoresLyricsEndpointFailure(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/v1/tracks/42":
+			_ = json.NewEncoder(w).Encode(map[string]any{"id": 42, "title": "Song"})
+		case "/v1/tracks/42/lyrics":
+			w.WriteHeader(http.StatusNotFound)
+			_ = json.NewEncoder(w).Encode(map[string]any{"error": "not found"})
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer ts.Close()
+
+	cfgData := config.DefaultConfigData()
+	cfgData.Tidal.AccessToken = "token"
+	cfgData.Tidal.CountryCode = "US"
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+	c.loggedIn = true
+	c.baseURL = ts.URL + "/v1"
+	c.lyricsAPI = ts.URL + "/v1"
+
+	meta, err := c.GetMetadata(context.Background(), "42", "track")
+	if err != nil {
+		t.Fatalf("GetMetadata() err = %v", err)
+	}
+	if _, ok := meta["lyrics"]; ok {
+		t.Fatalf("did not expect lyrics when endpoint fails")
+	}
+	if _, ok := meta["lyrics_synced"]; ok {
+		t.Fatalf("did not expect lyrics_synced when endpoint fails")
+	}
+}
+
+func TestAPIRequestRetriesTooManyRequests(t *testing.T) {
+	calls := 0
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/tracks/42" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		calls++
+		if calls == 1 {
+			w.Header().Set("Retry-After", "0")
+			w.WriteHeader(http.StatusTooManyRequests)
+			_, _ = w.Write([]byte("slow down"))
+			return
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{"id": 42, "title": "Song"})
+	}))
+	defer ts.Close()
+
+	cfgData := config.DefaultConfigData()
+	cfgData.Downloads.RequestsPerMinute = 0
+	cfgData.Tidal.AccessToken = "token"
+	cfgData.Tidal.CountryCode = "US"
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+	c.baseURL = ts.URL + "/v1"
+
+	resp, status, err := c.apiRequest(context.Background(), "tracks/42", nil, c.baseURL)
+	if err != nil {
+		t.Fatalf("apiRequest() err = %v", err)
+	}
+	if status != http.StatusOK {
+		t.Fatalf("status = %d, want %d", status, http.StatusOK)
+	}
+	if calls != 2 {
+		t.Fatalf("calls = %d, want 2", calls)
+	}
+	if stringify(resp["title"]) != "Song" {
+		t.Fatalf("title = %q, want Song", stringify(resp["title"]))
+	}
+}
+
+func TestAPIPostRetriesTooManyRequests(t *testing.T) {
+	calls := 0
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/token" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		calls++
+		if calls == 1 {
+			w.Header().Set("Retry-After", "0")
+			w.WriteHeader(http.StatusTooManyRequests)
+			_, _ = w.Write([]byte("slow down"))
+			return
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{"access_token": "fresh-token"})
+	}))
+	defer ts.Close()
+
+	cfgData := config.DefaultConfigData()
+	cfgData.Downloads.RequestsPerMinute = 0
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+
+	resp, status, err := c.apiPost(context.Background(), ts.URL+"/token", url.Values{"grant_type": []string{"refresh_token"}}, false)
+	if err != nil {
+		t.Fatalf("apiPost() err = %v", err)
+	}
+	if status != http.StatusOK {
+		t.Fatalf("status = %d, want %d", status, http.StatusOK)
+	}
+	if calls != 2 {
+		t.Fatalf("calls = %d, want 2", calls)
+	}
+	if stringify(resp["access_token"]) != "fresh-token" {
+		t.Fatalf("access_token = %q, want fresh-token", stringify(resp["access_token"]))
+	}
+}
+
 func TestGetDownloadablePrefersAtmosWhenEnabled(t *testing.T) {
 	var calls []string
 	allImmersive := true

internal/provider/yandex/client_test.go

@@ -0,0 +1,174 @@
+package yandex
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+
+	"streamrip-go/internal/config"
+	"streamrip-go/internal/jsonutil"
+)
+
+func TestYandexDownloadSignMatchesCapturedFormat(t *testing.T) {
+	sign, ts := yandexDownloadSign("32038184", "lossless", []string{"flac", "aac", "he-aac", "mp3", "flac-mp4", "aac-mp4", "he-aac-mp4"}, "raw")
+	if ts <= 0 {
+		t.Fatalf("timestamp = %d", ts)
+	}
+	if strings.TrimSpace(sign) == "" {
+		t.Fatalf("decoded sign is empty")
+	}
+	if strings.Contains(sign, "=") {
+		t.Fatalf("sign unexpectedly contains base64 padding: %q", sign)
+	}
+	if strings.Contains(sign, " ") {
+		t.Fatalf("sign unexpectedly contains space: %q", sign)
+	}
+}
+
+func TestGetDownloadableUsesModernGetFileInfo(t *testing.T) {
+	var gotPath string
+	var gotQuery url.Values
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		gotQuery = r.URL.Query()
+		if r.URL.Path == "/account/about" {
+			_ = json.NewEncoder(w).Encode(map[string]any{"result": map[string]any{"uid": "123"}})
+			return
+		}
+		if r.URL.Path != "/get-file-info" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"result": map[string]any{
+				"downloadInfo": map[string]any{
+					"trackId": "32038184",
+					"quality": "lossless",
+					"codec":   "flac-mp4",
+					"transport": "encraw",
+					"key": "00112233445566778899aabbccddeeff",
+					"bitrate": 0,
+					"url":     "https://strm.example/music-v2/crypt/x/flac-mp4",
+				},
+			},
+		})
+	}))
+	defer ts.Close()
+
+	d := config.DefaultConfigData()
+	d.Downloads.RequestsPerMinute = 0
+	d.Yandex.AccessToken = "token"
+	c := New(&config.Config{File: d, Session: d})
+	c.baseURL = ts.URL
+	c.loggedIn = true
+
+	dl, err := c.GetDownloadable(context.Background(), "32038184:1683700", 2)
+	if err != nil {
+		t.Fatalf("GetDownloadable() error = %v", err)
+	}
+	if gotPath != "/get-file-info" {
+		t.Fatalf("path = %q, want /get-file-info", gotPath)
+	}
+	if gotQuery.Get("trackId") != "32038184" {
+		t.Fatalf("trackId = %q, want 32038184", gotQuery.Get("trackId"))
+	}
+	if gotQuery.Get("quality") != "lossless" {
+		t.Fatalf("quality = %q, want lossless", gotQuery.Get("quality"))
+	}
+	if gotQuery.Get("transports") != "encraw" {
+		t.Fatalf("transports = %q, want encraw", gotQuery.Get("transports"))
+	}
+	if dl.Extension != "m4a" {
+		t.Fatalf("extension = %q, want m4a", dl.Extension)
+	}
+	if dl.Audio.Codec != "FLAC" || dl.Audio.Quality != "LOSSLESS" {
+		t.Fatalf("unexpected audio profile: %+v", dl.Audio)
+	}
+	if dl.TrackID != "32038184" {
+		t.Fatalf("track id = %q, want 32038184", dl.TrackID)
+	}
+	if dl.Cipher != "AES_CTR" || dl.Key == "" {
+		t.Fatalf("expected yandex cipher metadata, got cipher=%q key=%q", dl.Cipher, dl.Key)
+	}
+}
+
+func TestGetMetadataTrackUsesModernTracksEndpoint(t *testing.T) {
+	var gotMethod string
+	var gotPath string
+	var gotBody string
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		gotPath = r.URL.Path
+		if r.URL.Path != "/tracks" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		body, _ := io.ReadAll(r.Body)
+		gotBody = string(body)
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"result": []map[string]any{{
+				"id":      "9442712",
+				"realId":  "9442712",
+				"title":   "Nightcall",
+				"artists": []map[string]any{{"id": "1433871", "name": "Kavinsky"}},
+				"albums": []map[string]any{{
+					"id":          "1000856",
+					"title":       "OutRun",
+					"releaseDate": "2013-02-25T00:00:00+04:00",
+					"trackCount":  13,
+					"artists":     []map[string]any{{"id": "1433871", "name": "Kavinsky"}},
+					"trackPosition": map[string]any{
+						"index":  0,
+						"volume": 1,
+					},
+				}},
+			}},
+		})
+	}))
+	defer ts.Close()
+
+	d := config.DefaultConfigData()
+	d.Downloads.RequestsPerMinute = 0
+	d.Yandex.AccessToken = "token"
+	c := New(&config.Config{File: d, Session: d})
+	c.baseURL = ts.URL
+	c.loggedIn = true
+
+	meta, err := c.GetMetadata(context.Background(), "9442712:1000856", "track")
+	if err != nil {
+		t.Fatalf("GetMetadata() error = %v", err)
+	}
+	if gotMethod != http.MethodPost || gotPath != "/tracks" {
+		t.Fatalf("unexpected request: %s %s", gotMethod, gotPath)
+	}
+	if !strings.Contains(gotBody, "trackIds=9442712%3A1000856") {
+		t.Fatalf("body = %q", gotBody)
+	}
+	if meta["id"] != "9442712:1000856" {
+		t.Fatalf("id = %v", meta["id"])
+	}
+	if album, _ := meta["album"].(map[string]any); jsonutil.StringFromAny(album["title"]) != "OutRun" {
+		t.Fatalf("unexpected album: %+v", album)
+	}
+}
+
+func TestLegacyDirectURLBuildsPlayableMP3URL(t *testing.T) {
+	url, err := legacyDirectURL(&legacyDownloadInfoXML{
+		Host: "example.test",
+		Path: "/abc123",
+		TS:   "1234567890",
+		S:    "tailxyz",
+	})
+	if err != nil {
+		t.Fatalf("legacyDirectURL() error = %v", err)
+	}
+	want := "https://example.test/get-mp3/248c1c6ff5daf481560d3bd9f24e8058/1234567890/abc123"
+	if url != want {
+		t.Fatalf("legacyDirectURL() = %q, want %q", url, want)
+	}
+}

internal/urlparse/parse.go

@@ -45,6 +45,8 @@ func Parse(raw string) *ParsedURL {
 	switch {
 	case isQobuzHost(host):
 		return parseQobuz(raw, parts)
+	case isYandexHost(host):
+		return parseYandex(raw, parts)
 	case isTidalHost(host):
 		return parseTidal(raw, parts)
 	case isDeezerHost(host):
@@ -80,6 +82,42 @@ func parseQobuz(raw string, parts []string) *ParsedURL {
 	return &ParsedURL{OriginalURL: raw, Source: "qobuz", MediaType: mediaType, ID: id, Kind: KindGeneric}
 }
 
+func parseYandex(raw string, parts []string) *ParsedURL {
+	if len(parts) < 2 {
+		return nil
+	}
+
+	switch parts[0] {
+	case "track":
+		if len(parts) != 2 || strings.TrimSpace(parts[1]) == "" {
+			return nil
+		}
+		return &ParsedURL{OriginalURL: raw, Source: "yandex", MediaType: "track", ID: parts[1], Kind: KindGeneric}
+	case "album":
+		if len(parts) == 2 && strings.TrimSpace(parts[1]) != "" {
+			return &ParsedURL{OriginalURL: raw, Source: "yandex", MediaType: "album", ID: parts[1], Kind: KindGeneric}
+		}
+		if len(parts) == 4 && parts[2] == "track" && strings.TrimSpace(parts[1]) != "" && strings.TrimSpace(parts[3]) != "" {
+			return &ParsedURL{OriginalURL: raw, Source: "yandex", MediaType: "track", ID: parts[3] + ":" + parts[1], Kind: KindGeneric}
+		}
+	case "artist":
+		if len(parts) != 2 || strings.TrimSpace(parts[1]) == "" {
+			return nil
+		}
+		return &ParsedURL{OriginalURL: raw, Source: "yandex", MediaType: "artist", ID: parts[1], Kind: KindGeneric}
+	case "users":
+		if len(parts) == 4 && parts[2] == "playlists" && strings.TrimSpace(parts[1]) != "" && strings.TrimSpace(parts[3]) != "" {
+			return &ParsedURL{OriginalURL: raw, Source: "yandex", MediaType: "playlist", ID: parts[1] + ":" + parts[3], Kind: KindGeneric}
+		}
+	case "playlists":
+		if len(parts) == 2 && strings.TrimSpace(parts[1]) != "" {
+			return &ParsedURL{OriginalURL: raw, Source: "yandex", MediaType: "playlist", ID: parts[1], Kind: KindGeneric}
+		}
+	}
+
+	return nil
+}
+
 func parseTidal(raw string, parts []string) *ParsedURL {
 	if len(parts) < 2 {
 		return nil
@@ -177,6 +215,10 @@ func isQobuzHost(host string) bool {
 	return host == "qobuz.com" || host == "open.qobuz.com" || host == "play.qobuz.com"
 }
 
+func isYandexHost(host string) bool {
+	return host == "music.yandex.ru" || host == "music.yandex.com" || host == "music.yandex.kz" || host == "music.yandex.by"
+}
+
 func isTidalHost(host string) bool {
 	return host == "tidal.com" || host == "open.tidal.com" || host == "listen.tidal.com"
 }

internal/urlparse/parse_test.go

@@ -27,6 +27,30 @@ func TestQobuzAlbumURL(t *testing.T) {
 	}
 }
 
+func TestYandexURLs(t *testing.T) {
+	tests := []struct {
+		url       string
+		mediaType string
+		id        string
+	}{
+		{url: "https://music.yandex.ru/track/9442712", mediaType: "track", id: "9442712"},
+		{url: "https://music.yandex.ru/album/1000856", mediaType: "album", id: "1000856"},
+		{url: "https://music.yandex.ru/album/1000856/track/9442712", mediaType: "track", id: "9442712:1000856"},
+		{url: "https://music.yandex.ru/artist/1433871", mediaType: "artist", id: "1433871"},
+		{url: "https://music.yandex.ru/users/yandexmusic/playlists/1635", mediaType: "playlist", id: "yandexmusic:1635"},
+		{url: "https://music.yandex.ru/playlists/4ae45ac1-0972-734f-8537-769490399170", mediaType: "playlist", id: "4ae45ac1-0972-734f-8537-769490399170"},
+	}
+	for _, tc := range tests {
+		result := Parse(tc.url)
+		if result == nil {
+			t.Fatalf("expected parse for %q", tc.url)
+		}
+		if result.Source != "yandex" || result.MediaType != tc.mediaType || result.ID != tc.id {
+			t.Fatalf("unexpected parse result for %q: %+v", tc.url, result)
+		}
+	}
+}
+
 func TestTidalTrackURL(t *testing.T) {
 	inputs := []string{
 		"https://tidal.com/browse/track/3083287",

internal/verbose/verbose.go

@@ -0,0 +1,68 @@
+// Package verbose provides a process-wide verbosity level and a pluggable
+// log sink so verbose output integrates with the downloader's progress bars.
+//
+// Level meaning:
+//
+//	0 (Off) - no extra output
+//	1 (V)   - log per-track CDN URLs from the downloader
+//	2 (VV)  - additionally log every outbound HTTP request via the
+//	          netutil-wrapped transport (covers all provider API calls
+//	          and downloads)
+package verbose
+
+import (
+	"fmt"
+	"os"
+	"sync/atomic"
+)
+
+const (
+	Off byte = 0
+	V   byte = 1
+	VV  byte = 2
+)
+
+var (
+	level atomic.Uint32
+	sink  atomic.Pointer[func(string)]
+)
+
+// SetLevel clamps and stores the verbosity level. Pass 0 to disable.
+func SetLevel(l int) {
+	if l < 0 {
+		l = 0
+	}
+	if l > int(VV) {
+		l = int(VV)
+	}
+	level.Store(uint32(l))
+}
+
+func Level() byte { return byte(level.Load()) }
+
+func Enabled(l byte) bool { return Level() >= l }
+
+// SetSink installs a writer for verbose output. Use this to route logs
+// through the downloader so they don't tear progress bars. Pass nil to
+// fall back to stderr.
+func SetSink(fn func(string)) {
+	if fn == nil {
+		sink.Store(nil)
+		return
+	}
+	sink.Store(&fn)
+}
+
+// Printf emits a line at the given level if verbosity is enabled. The
+// caller is responsible for including a trailing newline.
+func Printf(l byte, format string, args ...any) {
+	if !Enabled(l) {
+		return
+	}
+	msg := fmt.Sprintf(format, args...)
+	if p := sink.Load(); p != nil {
+		(*p)(msg)
+		return
+	}
+	_, _ = fmt.Fprint(os.Stderr, msg)
+}