gerdur-core 2.3.0 → 2.5.0

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## 2.5.0 - 2026-08-31
+
+Phase 3.1 — streaming download primitives. Additive.
+
+### Added
+
+- **`streamTrackDownload(track, quality, options?)`** — download a track as a
+  stream of decrypted audio (`get_url` → CDN fetch → stripe-decrypt `Transform`
+  → your sink). Peak memory is ~one 2048-byte stripe regardless of file size or
+  concurrency. `options.onProgress(received, total)`; `options.resumeFrom`
+  (bytes, 2048-aligned) sends a `Range` header and resumes stripe decryption
+  in phase. Verified byte-identical to the buffered `decryptDownload` path,
+  resume included.
+- **`createDecryptStream(sngId, startChunk?)`** — a Node `Transform` wrapping the
+  stripe cipher, for composing your own pipelines. `TrackDecryptStream` gained a
+  `startChunk` constructor arg.
+- **`getStream(url, {rangeStart?})`** — a content-decoded response stream from
+  the internal HTTP client (`gunzip` / `brotli` / `inflate` handled), following
+  redirects, rejecting `HttpStatusError` on non-2xx.
+
+Streaming the tag write (in-place FLAC metadata-block rewrite) is still open.
+
+## 2.4.0 - 2026-08-31
+
+Phase 3.3 — deterministic retries and typed errors.
+
+### Fixed
+
+- **The gateway retry loop had no cap** on `error.code === 4`,
+  `NEED_API_AUTH_REQUIRED`, or `GATEWAY_ERROR` — a failing endpoint could spin
+  forever. `requestWithRetry` is now a bounded loop: per-class attempt caps
+  (`code 4` ×6, re-auth ×3, token refresh ×15), full-jittered exponential
+  backoff, and a 30 s wall-clock deadline. On exhaustion it throws.
+
+### Added
+
+- **`DeezerError`** (`extends Error`) — thrown for gateway / media-API failures
+  instead of `new Error(Object.entries(error).join(', '))`. Carries `code`,
+  `keys`, `retryable`, and the raw `payload`. `message` stays human-readable.
+- **`RETRY_POLICY`** — the exported, inspectable retry configuration.
+
+### Changed
+
+- Gateway helpers (`request`, `requestLight`, `requestGet`, `requestPublicApi`)
+  and `resolveDownloadUrls` now throw `DeezerError`. `message` text changed shape
+  (`"KEY: value"` rather than `"KEY,value"`); read `err.code` / `err.keys`
+  instead of matching the string.
+
 ## 2.3.0 - 2026-08-31
 
 Phase 2.1 — all the formats, and previews. Additive; the `1 / 3 / 9` path is

package/README.md

@@ -82,7 +82,20 @@ if (model.lyricsSynced) fs.writeFileSync(track.SNG_TITLE + '.lrc', model.lyricsS
 
 ## Methods
 
-All method returns `Object` or throws `Error`. Make sure to catch error on your side.
+Every method returns an `Object` or throws. Gateway / media-API failures throw a
+**`DeezerError`** (`extends Error`) with:
+
+| Field | |
+| :--- | :--- |
+| `code` | Deezer's numeric error code, when it sent one (e.g. `4`, `800`) |
+| `keys` | the gateway error keys, e.g. `['VALID_TOKEN_REQUIRED']`, `['DATA_ERROR']` |
+| `retryable` | whether a retry could plausibly succeed |
+| `payload` | the raw error object |
+
+Retries are bounded — `RETRY_POLICY` (exported) sets per-class attempt caps and a
+30 s wall-clock deadline, so a persistently failing endpoint surfaces a
+`DeezerError` instead of spinning. `GeoBlocked`, `WrongLicense` and
+`ExpiredTrackToken` are still thrown as their own types from the download path.
 
 ### `.initDeezerApi(arl_cookie);`
 
@@ -276,6 +289,34 @@ Useful for "audition before download" and for CI that shouldn't pull full tracks
 | `data`     |   Yes    | `buffer` | downloaded song buffer |
 | `song_id`  |   Yes    | `string` |               track id |
 
+### Streaming download
+
+For large files / high concurrency — peak memory is ~one 2048-byte stripe
+instead of 2× the file.
+
+- **`streamTrackDownload(track, quality, options?)`** → `{stream, size, startedAt, isEncrypted}`.
+  `stream` is decrypted audio bytes (`get_url` → CDN fetch → stripe-decrypt
+  `Transform` → your sink). `options.onProgress(received, total)`;
+  `options.resumeFrom` (bytes, rounded down to a 2048 boundary) sends a `Range`
+  header and resumes stripe-decryption in phase.
+- **`createDecryptStream(sngId, startChunk?)`** → a `Transform` for your own `pipeline`.
+- **`getStream(url, {rangeStart?})`** → `{stream, headers, status}` — a raw,
+  content-decoded response stream.
+
+```js
+import {pipeline} from 'stream/promises';
+import {createWriteStream} from 'fs';
+
+const {stream} = await streamTrackDownload(track, 9, {
+  onProgress: (got, total) => process.stdout.write(`\r${((got / total) * 100) | 0}%`),
+});
+await pipeline(stream, createWriteStream('track.flac'));
+```
+
+Streaming the **tag write** (rewriting the FLAC metadata block in place, no
+full-file `Buffer.concat`) is not done yet — buffer the result and call
+`addTrackTags`, or tag the file afterward.
+
 ### `.addTrackTags(data, track, options?)`
 
 Resolves album info, credits, lyrics and artwork from Deezer and writes them into

package/dist/api/request.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requestPublicApi = exports.requestGet = exports.requestLight = exports.request = void 0;
 const request_1 = __importDefault(require("../lib/request"));
+const errors_1 = require("../lib/errors");
 const cache_1 = __importDefault(require("./cache"));
 /**
  * In-flight request coalescing (single-flight).
@@ -47,11 +48,11 @@ const request = async (body, method) => {
     const cacheKey = method + ':' + Object.entries(body).join(':');
     return coalesce(cacheKey, async () => {
         const { data: { error, results }, } = await request_1.default.post('/gateway.php', body, { params: { method } });
-        if (Object.keys(results).length > 0) {
+        if (results && Object.keys(results).length > 0) {
             cache_1.default.set(cacheKey, results);
             return results;
         }
-        throw new Error(Object.entries(error).join(', '));
+        throw new errors_1.DeezerError(error);
     });
 };
 exports.request = request;
@@ -66,11 +67,11 @@ const requestLight = async (body, method) => {
         const { data: { error, results }, } = await request_1.default.post('https://www.deezer.com/ajax/gw-light.php', body, {
             params: { method, api_version: '1.0' },
         });
-        if (Object.keys(results).length > 0) {
+        if (results && Object.keys(results).length > 0) {
             cache_1.default.set(cacheKey, results);
             return results;
         }
-        throw new Error(Object.entries(error).join(', '));
+        throw new errors_1.DeezerError(error);
     });
 };
 exports.requestLight = requestLight;
@@ -83,11 +84,11 @@ const requestGet = async (method, params = {}, key = 'get_request') => {
     const cacheKey = method + key;
     return coalesce(cacheKey, async () => {
         const { data: { error, results }, } = await request_1.default.get('/gateway.php', { params: { method, ...params } });
-        if (Object.keys(results).length > 0) {
+        if (results && Object.keys(results).length > 0) {
             cache_1.default.set(cacheKey, results);
             return results;
         }
-        throw new Error(Object.entries(error).join(', '));
+        throw new errors_1.DeezerError(error);
     });
 };
 exports.requestGet = requestGet;
@@ -99,8 +100,7 @@ const requestPublicApi = async (slug) => {
     return coalesce(slug, async () => {
         const { data } = await request_1.default.get('https://api.deezer.com' + slug);
         if (data.error) {
-            const errorMessage = Object.entries(data.error).join(', ');
-            throw new Error(errorMessage);
+            throw new errors_1.DeezerError(data.error);
         }
         cache_1.default.set(slug, data);
         return data;

package/dist/index.d.ts

@@ -1,7 +1,11 @@
-export { initDeezerApi } from './lib/request';
+export { initDeezerApi, RETRY_POLICY } from './lib/request';
+export { DeezerError } from './lib/errors';
+export type { DeezerErrorPayload } from './lib/errors';
 export * from './api';
 export * from './converter';
 export * from './lib/decrypt';
 export * from './lib/get-url';
-export { httpAgent, httpsAgent, getBuffer, getJson, getText } from './lib/http';
+export * from './lib/stream-download';
+export { httpAgent, httpsAgent, getBuffer, getJson, getText, getStream } from './lib/http';
+export type { StreamResponse } from './lib/http';
 export * from './metadata-writer';

package/dist/index.js

@@ -14,17 +14,22 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getText = exports.getJson = exports.getBuffer = exports.httpsAgent = exports.httpAgent = exports.initDeezerApi = void 0;
+exports.getStream = exports.getText = exports.getJson = exports.getBuffer = exports.httpsAgent = exports.httpAgent = exports.DeezerError = exports.RETRY_POLICY = exports.initDeezerApi = void 0;
 var request_1 = require("./lib/request");
 Object.defineProperty(exports, "initDeezerApi", { enumerable: true, get: function () { return request_1.initDeezerApi; } });
+Object.defineProperty(exports, "RETRY_POLICY", { enumerable: true, get: function () { return request_1.RETRY_POLICY; } });
+var errors_1 = require("./lib/errors");
+Object.defineProperty(exports, "DeezerError", { enumerable: true, get: function () { return errors_1.DeezerError; } });
 __exportStar(require("./api"), exports);
 __exportStar(require("./converter"), exports);
 __exportStar(require("./lib/decrypt"), exports);
 __exportStar(require("./lib/get-url"), exports);
+__exportStar(require("./lib/stream-download"), exports);
 var http_1 = require("./lib/http");
 Object.defineProperty(exports, "httpAgent", { enumerable: true, get: function () { return http_1.httpAgent; } });
 Object.defineProperty(exports, "httpsAgent", { enumerable: true, get: function () { return http_1.httpsAgent; } });
 Object.defineProperty(exports, "getBuffer", { enumerable: true, get: function () { return http_1.getBuffer; } });
 Object.defineProperty(exports, "getJson", { enumerable: true, get: function () { return http_1.getJson; } });
 Object.defineProperty(exports, "getText", { enumerable: true, get: function () { return http_1.getText; } });
+Object.defineProperty(exports, "getStream", { enumerable: true, get: function () { return http_1.getStream; } });
 __exportStar(require("./metadata-writer"), exports);

package/dist/lib/decrypt.d.ts

@@ -1,4 +1,5 @@
 /// <reference types="node" />
+import { Transform } from 'stream';
 import type { trackType } from '../types';
 export declare const getSongFileName: ({ MD5_ORIGIN, SNG_ID, MEDIA_VERSION }: trackType, quality: number) => string;
 /**
@@ -19,9 +20,21 @@ export declare class TrackDecryptStream {
     private readonly bf;
     private carry;
     private chunkIndex;
-    constructor(trackId: string);
+    /**
+     * @param trackId    `SNG_ID`
+     * @param startChunk the 2048-byte chunk index the first byte you'll `write()`
+     *                   corresponds to — non-zero when resuming a `Range` download
+     *                   (`resumeFromByte / 2048`). Per-chunk IVs make this exact.
+     */
+    constructor(trackId: string, startChunk?: number);
     /** Returns the decrypted bytes for every complete 2048-byte stripe now available. */
     write(part: Buffer): Buffer;
     /** The trailing partial chunk (always plaintext). */
     final(): Buffer;
 }
+/**
+ * A Node `Transform` that decrypts a Deezer download stripe-by-stripe as bytes
+ * flow through it — `fetch(url) → createDecryptStream(sngId) → sink`, constant
+ * memory. `startChunk` (`resumeFromByte / 2048`) supports resumed `Range` fetches.
+ */
+export declare const createDecryptStream: (trackId: string, startChunk?: number) => Transform;

package/dist/lib/decrypt.js

@@ -3,8 +3,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TrackDecryptStream = exports.decryptDownload = exports.getSongFileName = void 0;
+exports.createDecryptStream = exports.TrackDecryptStream = exports.decryptDownload = exports.getSongFileName = void 0;
 const crypto_1 = __importDefault(require("crypto"));
+const stream_1 = require("stream");
 const blowfish_1 = require("./blowfish");
 const md5 = (data, type = 'ascii') => {
     const md5sum = crypto_1.default.createHash('md5');
@@ -66,10 +67,16 @@ exports.decryptDownload = decryptDownload;
  * and the CPU work hides behind the (slower) network read.
  */
 class TrackDecryptStream {
-    constructor(trackId) {
+    /**
+     * @param trackId    `SNG_ID`
+     * @param startChunk the 2048-byte chunk index the first byte you'll `write()`
+     *                   corresponds to — non-zero when resuming a `Range` download
+     *                   (`resumeFromByte / 2048`). Per-chunk IVs make this exact.
+     */
+    constructor(trackId, startChunk = 0) {
         this.carry = Buffer.alloc(0);
-        this.chunkIndex = 0;
         this.bf = new blowfish_1.Blowfish(getBlowfishKey(trackId));
+        this.chunkIndex = startChunk;
     }
     /** Returns the decrypted bytes for every complete 2048-byte stripe now available. */
     write(part) {
@@ -100,3 +107,25 @@ class TrackDecryptStream {
     }
 }
 exports.TrackDecryptStream = TrackDecryptStream;
+/**
+ * A Node `Transform` that decrypts a Deezer download stripe-by-stripe as bytes
+ * flow through it — `fetch(url) → createDecryptStream(sngId) → sink`, constant
+ * memory. `startChunk` (`resumeFromByte / 2048`) supports resumed `Range` fetches.
+ */
+const createDecryptStream = (trackId, startChunk = 0) => {
+    const engine = new TrackDecryptStream(trackId, startChunk);
+    return new stream_1.Transform({
+        transform(chunk, _enc, cb) {
+            try {
+                cb(null, engine.write(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));
+            }
+            catch (err) {
+                cb(err);
+            }
+        },
+        flush(cb) {
+            cb(null, engine.final());
+        },
+    });
+};
+exports.createDecryptStream = createDecryptStream;

package/dist/lib/errors.d.ts

@@ -0,0 +1,27 @@
+/** The raw `error` object a Deezer gateway response carries. */
+export type DeezerErrorPayload = Record<string, unknown>;
+/**
+ * A structured error from the Deezer gateway or media API — replaces the old
+ * `new Error(Object.entries(error).join(', '))`. Carries the numeric `code`, the
+ * gateway error `keys`, a `retryable` hint, and the raw `payload`.
+ *
+ * The `message` is still human-readable (`"VALID_TOKEN_REQUIRED: …"`), so code
+ * that only reads `err.message` keeps working — but prefer `err.code` /
+ * `err.keys` / `err.retryable`.
+ */
+export declare class DeezerError extends Error {
+    /** `error.code` when Deezer sent a numeric one */
+    readonly code?: number;
+    /** the gateway error keys, e.g. `['VALID_TOKEN_REQUIRED']`, `['DATA_ERROR']` */
+    readonly keys: string[];
+    /** whether a retry could plausibly succeed */
+    readonly retryable: boolean;
+    /** the raw error payload */
+    readonly payload: DeezerErrorPayload;
+    constructor(payload: DeezerErrorPayload | null | undefined, opts?: {
+        retryable?: boolean;
+        message?: string;
+    });
+    /** Whether a `code` / key set is worth retrying. */
+    static retryable(code: number | undefined, keys: string[]): boolean;
+}

package/dist/lib/errors.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeezerError = void 0;
+/** Gateway error keys where retrying (after a token refresh / re-auth) can help. */
+const RETRYABLE_KEYS = new Set(['NEED_API_AUTH_REQUIRED', 'GATEWAY_ERROR', 'VALID_TOKEN_REQUIRED']);
+/**
+ * A structured error from the Deezer gateway or media API — replaces the old
+ * `new Error(Object.entries(error).join(', '))`. Carries the numeric `code`, the
+ * gateway error `keys`, a `retryable` hint, and the raw `payload`.
+ *
+ * The `message` is still human-readable (`"VALID_TOKEN_REQUIRED: …"`), so code
+ * that only reads `err.message` keeps working — but prefer `err.code` /
+ * `err.keys` / `err.retryable`.
+ */
+class DeezerError extends Error {
+    constructor(payload, opts = {}) {
+        var _a, _b;
+        const p = payload && typeof payload === 'object' ? payload : {};
+        const keys = Object.keys(p);
+        const rawCode = p.code;
+        const code = typeof rawCode === 'number' ? rawCode : undefined;
+        super((_a = opts.message) !== null && _a !== void 0 ? _a : describe(p, keys));
+        this.name = 'DeezerError';
+        this.code = code;
+        this.keys = keys;
+        this.payload = p;
+        this.retryable = (_b = opts.retryable) !== null && _b !== void 0 ? _b : isRetryable(code, keys);
+    }
+    /** Whether a `code` / key set is worth retrying. */
+    static retryable(code, keys) {
+        return isRetryable(code, keys);
+    }
+}
+exports.DeezerError = DeezerError;
+const describe = (payload, keys) => {
+    if (!keys.length)
+        return 'Deezer request failed';
+    return keys.map((k) => `${k}: ${String(payload[k])}`).join(', ');
+};
+const isRetryable = (code, keys) => {
+    if (code === 4)
+        return true; // Deezer's transient "quota exceeded"
+    return keys.some((k) => RETRYABLE_KEYS.has(k));
+};

package/dist/lib/get-url.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveDownloadUrls = exports.getTrackDownloadUrl = exports.formatName = exports.toFormat = exports.DEEZER_FORMATS = exports.ExpiredTrackToken = exports.GeoBlocked = exports.WrongLicense = void 0;
 const delay_1 = __importDefault(require("delay"));
 const decrypt_1 = require("../lib/decrypt");
+const errors_1 = require("../lib/errors");
 const http_1 = require("../lib/http");
 const request_1 = __importDefault(require("../lib/request"));
 class WrongLicense extends Error {
@@ -137,7 +138,7 @@ const parseMediaEntry = (entry, token, country) => {
             throw new GeoBlocked(country);
         if (code === 2000 || code === 2001)
             throw new ExpiredTrackToken(token);
-        throw new Error(Object.entries(entry.errors[0]).join(', '));
+        throw new errors_1.DeezerError(entry.errors[0]);
     }
     const media = (_a = entry === null || entry === void 0 ? void 0 : entry.media) === null || _a === void 0 ? void 0 : _a[0];
     if (!((_b = media === null || media === void 0 ? void 0 : media.sources) === null || _b === void 0 ? void 0 : _b.length))

package/dist/lib/http.d.ts

@@ -1,8 +1,10 @@
 /// <reference types="node" />
 /// <reference types="node" />
 /// <reference types="node" />
+/// <reference types="node" />
 import { Agent as HttpAgent, IncomingHttpHeaders } from 'http';
 import { Agent as HttpsAgent } from 'https';
+import { Readable } from 'stream';
 type HttpMethod = 'GET' | 'POST' | 'HEAD';
 type ResponseType = 'buffer' | 'json' | 'text';
 type QueryValue = string | number | boolean | null | undefined;
@@ -63,6 +65,21 @@ export declare class HttpClient {
     head(url: string, config?: Omit<HttpRequestConfig, 'responseType'>): Promise<HttpResponse<Buffer>>;
     private request;
 }
+export interface StreamResponse {
+    /** the response body as a Readable — content-decoded (gzip/br/deflate unwrapped) */
+    stream: Readable;
+    headers: IncomingHttpHeaders;
+    status: number;
+    /** the final URL after redirects */
+    url: string;
+}
+/**
+ * Stream a URL's body (for large downloads — constant memory). Optionally send a
+ * `Range` header to resume from `rangeStart` bytes.
+ */
+export declare const getStream: (url: string, config?: HttpRequestConfig & {
+    rangeStart?: number;
+}) => Promise<StreamResponse>;
 export declare const getBuffer: (url: string, config?: HttpRequestConfig) => Promise<Buffer>;
 export declare const getJson: <T = unknown>(url: string, config?: HttpRequestConfig) => Promise<T>;
 export declare const getText: (url: string, config?: HttpRequestConfig) => Promise<string>;

package/dist/lib/http.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.headRequest = exports.getText = exports.getJson = exports.getBuffer = exports.HttpClient = exports.HttpStatusError = exports.httpsAgent = exports.httpAgent = void 0;
+exports.headRequest = exports.getText = exports.getJson = exports.getBuffer = exports.getStream = exports.HttpClient = exports.HttpStatusError = exports.httpsAgent = exports.httpAgent = void 0;
 const http_1 = require("http");
 const https_1 = require("https");
 const zlib_1 = require("zlib");
@@ -172,6 +172,80 @@ const requestRaw = async (config, redirectCount = 0) => {
         req.end();
     });
 };
+/**
+ * Like a GET, but resolves with the response **stream** instead of a buffered
+ * body — for large downloads that should not sit in memory. Follows redirects;
+ * rejects with `HttpStatusError` on a non-2xx (buffering only the small error
+ * body). The caller owns the returned stream and must consume or destroy it.
+ */
+const streamRaw = async (config, redirectCount = 0) => {
+    const requestUrl = buildUrl(config.url, config.baseURL, config.params);
+    const headers = normalizeHeaders(config.headers);
+    return await new Promise((resolve, reject) => {
+        var _a;
+        const isHttps = requestUrl.protocol === 'https:';
+        const requestFn = isHttps ? https_1.request : http_1.request;
+        const req = requestFn({
+            agent: isHttps ? exports.httpsAgent : exports.httpAgent,
+            headers,
+            hostname: requestUrl.hostname,
+            method: 'GET',
+            path: requestUrl.pathname + requestUrl.search,
+            port: requestUrl.port,
+            protocol: requestUrl.protocol,
+        }, (response) => {
+            var _a, _b, _c;
+            const status = (_a = response.statusCode) !== null && _a !== void 0 ? _a : 0;
+            const locationHeader = response.headers.location;
+            const location = Array.isArray(locationHeader) ? locationHeader[0] : locationHeader;
+            if (location && isRedirectStatus(status) && redirectCount < ((_b = config.maxRedirects) !== null && _b !== void 0 ? _b : 5)) {
+                response.resume();
+                streamRaw({ ...config, baseURL: undefined, url: new URL(location, requestUrl).toString() }, redirectCount + 1)
+                    .then(resolve)
+                    .catch(reject);
+                return;
+            }
+            if (status < 200 || status >= 300) {
+                const chunks = [];
+                response.on('data', (c) => chunks.push(Buffer.isBuffer(c) ? c : Buffer.from(c)));
+                response.on('end', () => reject(new HttpStatusError(status, response.headers, Buffer.concat(chunks))));
+                response.on('error', reject);
+                return;
+            }
+            const encoding = String((_c = response.headers['content-encoding']) !== null && _c !== void 0 ? _c : '').toLowerCase();
+            let stream = response;
+            if (encoding === 'gzip') {
+                stream = response.pipe((0, zlib_1.createGunzip)());
+            }
+            else if (encoding === 'br') {
+                stream = response.pipe((0, zlib_1.createBrotliDecompress)());
+            }
+            else if (encoding === 'deflate') {
+                stream = response.pipe((0, zlib_1.createInflate)());
+            }
+            response.on('error', (err) => stream.destroy(err));
+            resolve({ stream, headers: response.headers, status, url: requestUrl.toString() });
+        });
+        req.on('error', reject);
+        req.setTimeout((_a = config.timeout) !== null && _a !== void 0 ? _a : 30000, () => {
+            var _a;
+            req.destroy(new Error(`Request timed out after ${(_a = config.timeout) !== null && _a !== void 0 ? _a : 30000}ms`));
+        });
+        req.end();
+    });
+};
+/**
+ * Stream a URL's body (for large downloads — constant memory). Optionally send a
+ * `Range` header to resume from `rangeStart` bytes.
+ */
+const getStream = async (url, config = {}) => {
+    const headers = { ...config.headers };
+    if (config.rangeStart && config.rangeStart > 0) {
+        headers.Range = `bytes=${config.rangeStart}-`;
+    }
+    return streamRaw({ url, headers, params: config.params, timeout: config.timeout });
+};
+exports.getStream = getStream;
 const buildUrl = (url, baseURL, params) => {
     const parsedUrl = new URL(resolveUrl(url, baseURL));
     if (params) {

package/dist/lib/request.d.ts

@@ -3,6 +3,26 @@ type DeezerRequestConfig = {
     headers?: Record<string, string>;
     params?: HttpQuery;
 };
+/**
+ * Bounded-retry policy for the gateway. Every retry class has its own attempt
+ * cap **and** there is a wall-clock deadline, so a persistently failing endpoint
+ * can no longer spin forever (the old code had no cap on `code === 4`,
+ * `NEED_API_AUTH_REQUIRED` or `GATEWAY_ERROR`).
+ */
+export declare const RETRY_POLICY: {
+    /** total attempts for the transient `code === 4` class */
+    code4Attempts: number;
+    /** re-inits allowed for `NEED_API_AUTH_REQUIRED` */
+    authReinits: number;
+    /** token refreshes allowed for `GATEWAY_ERROR` / `VALID_TOKEN_REQUIRED` */
+    tokenRefreshes: number;
+    /** base backoff (ms) — grows exponentially, full-jittered */
+    baseMs: number;
+    /** cap on a single backoff wait */
+    maxDelayMs: number;
+    /** overall wall-clock budget from the first attempt */
+    deadlineMs: number;
+};
 export declare const initDeezerApi: (arl: string) => Promise<string>;
 declare const _default: {
     defaults: {

package/dist/lib/request.js

@@ -3,10 +3,36 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.initDeezerApi = void 0;
+exports.initDeezerApi = exports.RETRY_POLICY = void 0;
 const delay_1 = __importDefault(require("delay"));
 const http_1 = require("./http");
+const errors_1 = require("./errors");
 let user_arl = 'c973964816688562722418b5200c1515dffaad15a42643ebf87cc72824a54612ec51c2ad42d566743f9e424c774e98ccae7737770acff59251328e6cd598c7bcac38ca269adf78bfb88ec5bbad6cd800db3c0b88b2af645bb22b99e71de26416';
+/**
+ * Bounded-retry policy for the gateway. Every retry class has its own attempt
+ * cap **and** there is a wall-clock deadline, so a persistently failing endpoint
+ * can no longer spin forever (the old code had no cap on `code === 4`,
+ * `NEED_API_AUTH_REQUIRED` or `GATEWAY_ERROR`).
+ */
+exports.RETRY_POLICY = {
+    /** total attempts for the transient `code === 4` class */
+    code4Attempts: 6,
+    /** re-inits allowed for `NEED_API_AUTH_REQUIRED` */
+    authReinits: 3,
+    /** token refreshes allowed for `GATEWAY_ERROR` / `VALID_TOKEN_REQUIRED` */
+    tokenRefreshes: 15,
+    /** base backoff (ms) — grows exponentially, full-jittered */
+    baseMs: 800,
+    /** cap on a single backoff wait */
+    maxDelayMs: 8000,
+    /** overall wall-clock budget from the first attempt */
+    deadlineMs: 30000,
+};
+/** Exponential backoff (ms) with full jitter on the top half of the window. */
+const backoffDelay = (attempt) => {
+    const windowMs = Math.min(exports.RETRY_POLICY.baseMs * 2 ** attempt, exports.RETRY_POLICY.maxDelayMs);
+    return windowMs / 2 + Math.random() * (windowMs / 2);
+};
 const instance = new http_1.HttpClient({
     baseURL: 'https://api.deezer.com/1.0',
     timeout: 15000,
@@ -54,30 +80,41 @@ const initDeezerApi = async (arl) => {
     return data.results.SESSION;
 };
 exports.initDeezerApi = initDeezerApi;
-let token_retry = 0;
 const requestWithRetry = async (method, url, body, config = {}) => {
     var _a;
-    const response = method === 'POST' ? await instance.post(url, body, config) : await instance.get(url, config);
-    const error = (_a = response.data) === null || _a === void 0 ? void 0 : _a.error;
-    if (!error || Object.keys(error).length === 0) {
-        token_retry = 0;
-        return response;
-    }
-    if (error.NEED_API_AUTH_REQUIRED) {
-        await (0, exports.initDeezerApi)(user_arl);
-        return await requestWithRetry(method, url, body, config);
-    }
-    if (error.code === 4) {
-        await delay_1.default.range(1000, 1500);
-        return await requestWithRetry(method, url, body, config);
-    }
-    if (error.GATEWAY_ERROR || (error.VALID_TOKEN_REQUIRED && token_retry < 15)) {
-        token_retry += 1;
-        await getApiToken();
-        return await requestWithRetry(method, url, body, config);
+    const startedAt = Date.now();
+    let authReinits = 0;
+    let tokenRefreshes = 0;
+    let code4Attempts = 0;
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+        const response = method === 'POST' ? await instance.post(url, body, config) : await instance.get(url, config);
+        const error = (_a = response.data) === null || _a === void 0 ? void 0 : _a.error;
+        if (!error || Object.keys(error).length === 0) {
+            return response;
+        }
+        const overDeadline = Date.now() - startedAt > exports.RETRY_POLICY.deadlineMs;
+        if (error.NEED_API_AUTH_REQUIRED && authReinits < exports.RETRY_POLICY.authReinits && !overDeadline) {
+            authReinits += 1;
+            await (0, exports.initDeezerApi)(user_arl);
+            continue;
+        }
+        if ((error.GATEWAY_ERROR || error.VALID_TOKEN_REQUIRED) &&
+            tokenRefreshes < exports.RETRY_POLICY.tokenRefreshes &&
+            !overDeadline) {
+            tokenRefreshes += 1;
+            await getApiToken();
+            await (0, delay_1.default)(backoffDelay(tokenRefreshes - 1));
+            continue;
+        }
+        if (error.code === 4 && code4Attempts < exports.RETRY_POLICY.code4Attempts && !overDeadline) {
+            await (0, delay_1.default)(backoffDelay(code4Attempts));
+            code4Attempts += 1;
+            continue;
+        }
+        // Unhandled error, or a retry class ran out of attempts / hit the deadline.
+        throw new errors_1.DeezerError(error);
     }
-    token_retry = 0;
-    return response;
 };
 exports.default = {
     defaults: instance.defaults,

package/dist/lib/stream-download.d.ts

@@ -0,0 +1,37 @@
+/// <reference types="node" />
+import { Readable } from 'stream';
+import type { trackType } from '../types';
+export interface StreamTrackOptions {
+    /**
+     * Resume from this many bytes already on disk. Rounded **down** to a 2048-byte
+     * boundary so stripe decryption stays aligned; the returned `startedAt` tells
+     * you where the stream actually begins.
+     */
+    resumeFrom?: number;
+    /** progress callback — `(bytesReceived, totalBytes)`; `total` is 0 when unknown */
+    onProgress?: (received: number, total: number) => void;
+}
+export interface TrackStream {
+    /** decrypted audio bytes, ready to pipe to a file or a tag muxer */
+    stream: Readable;
+    /** total size of the (decrypted) file in bytes, or 0 if Deezer didn't say */
+    size: number;
+    /** byte offset the stream starts at (0, or the aligned `resumeFrom`) */
+    startedAt: number;
+    /** `false` for `cipher: NONE` content — the stream is the raw file */
+    isEncrypted: boolean;
+}
+/**
+ * Download a track as a **stream** of decrypted audio — `get_url` → CDN fetch →
+ * stripe-decrypt transform → your sink. Peak memory is ~one 2048-byte stripe
+ * regardless of file size or how many run concurrently.
+ *
+ * Buffer-and-tag still works: `pipeline(ts.stream, fs.createWriteStream(tmp))`,
+ * then read the temp file back for `addTrackTags`. Streaming the tag write
+ * itself (especially FLAC) is not done yet.
+ *
+ * @throws the same `WrongLicense` / `GeoBlocked` / `ExpiredTrackToken` /
+ *   `DeezerError` as `getTrackDownloadUrl`, plus `Error('unavailable')` when the
+ *   track+quality can't be resolved at all.
+ */
+export declare const streamTrackDownload: (track: trackType, quality: number, options?: StreamTrackOptions) => Promise<TrackStream>;

package/dist/lib/stream-download.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.streamTrackDownload = void 0;
+const stream_1 = require("stream");
+const decrypt_1 = require("./decrypt");
+const http_1 = require("./http");
+const get_url_1 = require("./get-url");
+const CHUNK = 2048;
+/**
+ * Download a track as a **stream** of decrypted audio — `get_url` → CDN fetch →
+ * stripe-decrypt transform → your sink. Peak memory is ~one 2048-byte stripe
+ * regardless of file size or how many run concurrently.
+ *
+ * Buffer-and-tag still works: `pipeline(ts.stream, fs.createWriteStream(tmp))`,
+ * then read the temp file back for `addTrackTags`. Streaming the tag write
+ * itself (especially FLAC) is not done yet.
+ *
+ * @throws the same `WrongLicense` / `GeoBlocked` / `ExpiredTrackToken` /
+ *   `DeezerError` as `getTrackDownloadUrl`, plus `Error('unavailable')` when the
+ *   track+quality can't be resolved at all.
+ */
+const streamTrackDownload = async (track, quality, options = {}) => {
+    const resolved = await (0, get_url_1.getTrackDownloadUrl)(track, quality);
+    if (!resolved) {
+        throw new Error(`Track ${track.SNG_ID} is unavailable at quality ${quality}`);
+    }
+    const startedAt = options.resumeFrom ? Math.floor(options.resumeFrom / CHUNK) * CHUNK : 0;
+    const { stream: raw, headers } = await (0, http_1.getStream)(resolved.trackUrl, { rangeStart: startedAt });
+    const contentLength = Number(headers['content-length']) || 0;
+    const size = resolved.fileSize || (contentLength ? contentLength + startedAt : 0);
+    let received = startedAt;
+    if (options.onProgress) {
+        const meter = new stream_1.PassThrough();
+        raw.on('data', (c) => {
+            var _a;
+            received += c.length;
+            (_a = options.onProgress) === null || _a === void 0 ? void 0 : _a.call(options, received, size);
+        });
+        raw.pipe(meter);
+        return {
+            stream: resolved.isEncrypted ? meter.pipe((0, decrypt_1.createDecryptStream)(track.SNG_ID, startedAt / CHUNK)) : meter,
+            size,
+            startedAt,
+            isEncrypted: resolved.isEncrypted,
+        };
+    }
+    return {
+        stream: resolved.isEncrypted ? raw.pipe((0, decrypt_1.createDecryptStream)(track.SNG_ID, startedAt / CHUNK)) : raw,
+        size,
+        startedAt,
+        isEncrypted: resolved.isEncrypted,
+    };
+};
+exports.streamTrackDownload = streamTrackDownload;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gerdur-core",
-  "version": "2.3.0",
+  "version": "2.5.0",
   "description": "Core module for gerdur.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",