gerdur 2.15.0 → 2.17.0

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # Changelog
 
+## 2.17.0 - 2026-08-31
+
+### Fixed
+
+- **`DEEZER_EMAIL` / `DEEZER_PASSWORD` are now read** as aliases for
+  `GERDUR_EMAIL` / `GERDUR_PASSWORD`. Those spellings are what people tend to put
+  in a `.env` alongside their other Deezer settings, and until now they were
+  silently ignored — the login just looked unconfigured.
+
+### Changed
+
+- **A refused login no longer blames your password.** It used to report
+  `wrong-credentials` with "check your email and password". That is not something
+  this code can know: Deezer's `user_auth.php` returns an identical error
+  (code 160) for a real account, a wrong password, **and** an address that does
+  not exist. The reason is now `rejected`, and the message says so.
+
+  Probed against the live endpoints while making this change, and every
+  documented password-to-`arl` path is currently refused:
+
+  | path | result |
+  | :--- | :--- |
+  | `connect.deezer.com/oauth/user_auth.php` | `authenticate user failed`, code 160 |
+  | `www.deezer.com/ajax/action.php` | `error` |
+  | `auth.deezer.com/login/arl` | 400 — needs a session the first two can't provide |
+
+  A deliberately malformed request returns a *different* error (code 150, "wrong
+  hash !"), which is how we know the request itself is still well formed and the
+  refusal is about authentication. **Paste an `arl` instead.** The code is kept
+  in case the flow returns, and `reason: 'rejected'` now carries an explanation
+  rather than a misdiagnosis.
+
+### Breaking (programmatic API, minor)
+
+- `LoginResult`'s `wrong-credentials` reason is renamed **`rejected`**. Anything
+  switching exhaustively on `reason` needs updating; `LoginError.reason` carries
+  the new value.
+
+## 2.16.0 - 2026-08-31
+
+### Changed
+
+- **The CLI starts about twice as fast: ~249 ms → 120 ms** (min of 10 runs;
+  mean 137 ms). Two things were being loaded before they could possibly be
+  needed:
+  - `gerdur-core@^2.20.0` now defers the Spotify SDK and the HTML parser, so
+    `require('gerdur-core')` costs 43 ms instead of 160 ms.
+  - `got` (~53 ms to require) is now loaded on first use rather than at import.
+    Every call site was already inside a function, so this is a pure deferral —
+    but it means `--help`, `gerdur setup`, `--set-arl` and the interactive prompt
+    no longer pay for an HTTP client before you have typed anything.
+
+  Verified against live downloads: a full 320 kbps track (9.19 MB, 226 s,
+  decodes clean under ffmpeg) and a `--preview` clip (480 KB, 30 s).
+
 ## 2.15.0 - 2026-08-31
 
 ### Changed

package/README.md

@@ -89,11 +89,20 @@ gerdur --set-arl <your_arl>
 To copy it manually: open <https://www.deezer.com> logged in → DevTools (`F12`) →
 Application → Cookies → `deezer.com` → copy the `arl` value (192 hex chars).
 
-**Log in with email &amp; password** — the guided setup can fetch the `arl` for you
-via Deezer's mobile OAuth flow, so you never open DevTools. Only the resulting
-`arl` is stored; your password is never written to disk unless you explicitly opt
-in when prompted. Deezer bot-protects scripted logins, so this is best-effort and
-falls back to pasting an `arl`.
+**Log in with email &amp; password** — the guided setup can try to fetch the `arl`
+from your credentials, so you never open DevTools. Only the resulting `arl` is
+stored; your password is never written to disk unless you explicitly opt in when
+prompted. Credentials are also read from `GERDUR_EMAIL` / `GERDUR_PASSWORD`, or
+`DEEZER_EMAIL` / `DEEZER_PASSWORD`.
+
+> **This currently does not work.** Every documented password-to-`arl` path is
+> refused: `connect.deezer.com/oauth/user_auth.php` answers `authenticate user
+> failed` (code 160), the web `action.php` login answers `error`, and
+> `auth.deezer.com/login/arl` needs a session you cannot get without the first
+> two. Deezer returns *the same* code 160 for a real account, a wrong password
+> and an address that does not exist, so a failure here says nothing about your
+> credentials. **Paste an `arl` instead** — `gerdur --set-arl <arl>` or
+> `GERDUR_ARL=<arl>`. The code is kept because the flow may come back.
 
 **Zero-config / CI** — set `GERDUR_ARL` (or `GERDUR_EMAIL` + `GERDUR_PASSWORD`)
 and skip the config file entirely. `GERDUR_ARL` takes precedence over the config
@@ -434,7 +443,7 @@ import {loginWithEmail, LoginError, Config, globalConfigPath} from 'gerdur';
 
 const result = await loginWithEmail('you@example.com', 'password');
 if (result.ok) console.log(result.arl);
-else console.error(result.reason, result.message); // 'wrong-credentials' | 'no-arl' | 'network' | 'unknown'
+else console.error(result.reason, result.message); // 'rejected' | 'no-arl' | 'network' | 'unknown'
 
 const conf = new Config();          // the same config the CLI uses
 conf.set('cookies.arl', 'xxx…');

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "gerdur",
-    "version": "2.15.0",
+    "version": "2.17.0",
     "description": "Command-line music downloader for Deezer (Spotify/Tidal links resolved via ISRC matching) with automatic MP3/FLAC tagging, synced lyrics and a side-effect-free programmatic API.",
     "keywords": [
         "deezer",
@@ -63,7 +63,7 @@
         "adm-zip": "^0.5.16",
         "chalk": "^4.1.2",
         "commander": "^9.5.0",
-        "gerdur-core": "^2.19.0",
+        "gerdur-core": "^2.20.0",
         "dot-prop": "^6.0.1",
         "got": "^11.8.6",
         "gradient-string": "^2.0.2",

package/dist/src/gerdur.js

@@ -9,7 +9,10 @@ const fs_1 = require("fs");
 const path_1 = require("path");
 const commander_1 = require("commander");
 const gradient_string_1 = __importDefault(require("gradient-string"));
-const got_1 = __importDefault(require("got"));
+/* eslint-disable @typescript-eslint/no-var-requires */
+// `got` costs ~53 ms to require and is only needed once a transfer actually
+// starts — deferring it keeps `--help`, setup and the interactive prompt snappy.
+const got = () => require('got');
 const gerdur_core_1 = require("gerdur-core");
 const prompts_1 = __importDefault(require("prompts"));
 const log_update_1 = __importDefault(require("log-update"));
@@ -369,7 +372,7 @@ const startDownload = async (saveLayout, url, skipPrompt) => {
             console.log(signale_1.default.info(`Downloading episode: ${episode.EPISODE_TITLE}`));
             if (options.overwrite || !(0, fs_1.existsSync)(dest)) {
                 (0, fs_1.mkdirSync)(dir, { recursive: true });
-                const { body } = await (0, got_1.default)(episode.EPISODE_DIRECT_STREAM_URL, { responseType: 'buffer' });
+                const { body } = await got()(episode.EPISODE_DIRECT_STREAM_URL, { responseType: 'buffer' });
                 (0, fs_1.writeFileSync)(dest, body);
             }
             console.log(signale_1.default.success(`Saved ${dest}`));

package/dist/src/lib/api-download.js

@@ -1,12 +1,12 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.downloadTrackToFile = exports.getTaggedTrack = exports.getTrackBuffer = void 0;
 const fs_1 = require("fs");
 const path_1 = require("path");
-const got_1 = __importDefault(require("got"));
+/* eslint-disable @typescript-eslint/no-var-requires */
+// `got` costs ~53 ms to require and is only needed once a transfer actually
+// starts — deferring it keeps `--help`, setup and the interactive prompt snappy.
+const got = () => require('got');
 const gerdur_core_1 = require("gerdur-core");
 const decrypt_1 = require("./decrypt");
 const util_1 = require("./util");
@@ -48,7 +48,10 @@ const fetchDecryptTag = async (track, quality, options) => {
         if (!trackData) {
             continue;
         }
-        const { body } = await (0, got_1.default)(trackData.trackUrl, { responseType: 'buffer', agent: { http: gerdur_core_1.httpAgent, https: gerdur_core_1.httpsAgent } });
+        const { body } = await got()(trackData.trackUrl, {
+            responseType: 'buffer',
+            agent: { http: gerdur_core_1.httpAgent, https: gerdur_core_1.httpsAgent },
+        });
         const decrypted = trackData.isEncrypted ? (0, decrypt_1.decryptDownload)(body, track.SNG_ID) : body;
         return (0, gerdur_core_1.addTrackTags)(decrypted, track, tagOptions(options));
     }

package/dist/src/lib/arl-setup.d.ts

@@ -17,8 +17,13 @@ export declare const printArlInstructions: () => void;
 export declare const promptForArl: (conf: Config) => Promise<string | null>;
 /**
  * Resolve email/password credentials from (in order): explicit config, then the
- * `GERDUR_EMAIL` / `GERDUR_PASSWORD` environment variables. Used for non-interactive
- * login attempts. Returns `null` if either half is missing.
+ * `GERDUR_EMAIL` / `GERDUR_PASSWORD` environment variables, then `DEEZER_EMAIL` /
+ * `DEEZER_PASSWORD`. Used for non-interactive login attempts. Returns `null` if
+ * either half is missing.
+ *
+ * The `DEEZER_*` spellings are accepted because that is what people tend to put
+ * in a `.env` next to their other Deezer settings; before, those were silently
+ * ignored and the login simply looked unconfigured.
  */
 export declare const resolveCredentials: (conf: Config) => {
     email: string;

package/dist/src/lib/arl-setup.js

@@ -68,12 +68,23 @@ const promptForArl = async (conf) => {
 exports.promptForArl = promptForArl;
 /**
  * Resolve email/password credentials from (in order): explicit config, then the
- * `GERDUR_EMAIL` / `GERDUR_PASSWORD` environment variables. Used for non-interactive
- * login attempts. Returns `null` if either half is missing.
+ * `GERDUR_EMAIL` / `GERDUR_PASSWORD` environment variables, then `DEEZER_EMAIL` /
+ * `DEEZER_PASSWORD`. Used for non-interactive login attempts. Returns `null` if
+ * either half is missing.
+ *
+ * The `DEEZER_*` spellings are accepted because that is what people tend to put
+ * in a `.env` next to their other Deezer settings; before, those were silently
+ * ignored and the login simply looked unconfigured.
  */
 const resolveCredentials = (conf) => {
-    const email = (conf.get('cookies.email') || process.env.GERDUR_EMAIL || '').trim();
-    const password = (conf.get('cookies.password') || process.env.GERDUR_PASSWORD || '').trim();
+    const email = (conf.get('cookies.email') ||
+        process.env.GERDUR_EMAIL ||
+        process.env.DEEZER_EMAIL ||
+        '').trim();
+    const password = (conf.get('cookies.password') ||
+        process.env.GERDUR_PASSWORD ||
+        process.env.DEEZER_PASSWORD ||
+        '').trim();
     if (email && password) {
         return { email, password };
     }

package/dist/src/lib/auto-updater.js

@@ -4,7 +4,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = require("fs");
-const got_1 = __importDefault(require("got"));
+/* eslint-disable @typescript-eslint/no-var-requires */
+// `got` costs ~53 ms to require and is only needed once a transfer actually
+// starts — deferring it keeps `--help`, setup and the interactive prompt snappy.
+const got = () => require('got');
 const adm_zip_1 = __importDefault(require("adm-zip"));
 const chalk_1 = __importDefault(require("chalk"));
 const log_update_1 = __importDefault(require("log-update"));
@@ -12,7 +15,7 @@ const signale_1 = __importDefault(require("./signale"));
 const util_1 = require("./util");
 const updateCheck = async (pkg) => {
     const beta = pkg.version.includes('beta');
-    const releases = await (0, got_1.default)('https://api.github.com/repos/soulwax/gerdur/releases').json();
+    const releases = await got()('https://api.github.com/repos/soulwax/gerdur/releases').json();
     const data = releases.filter((r) => r.prerelease === beta)[0];
     if (data.tag_name > pkg.version) {
         return data;
@@ -51,7 +54,7 @@ const updateBinary = async (pkg) => {
             console.log(`  Downloading ${asset.browser_download_url}`);
             const bar = (0, util_1.progressBar)(asset.size, 40);
             const humanSizeTotal = (asset.size / 1024 / 1024).toFixed(2);
-            const { body } = await (0, got_1.default)(asset.browser_download_url, { responseType: 'buffer' }).on('downloadProgress', ({ transferred }) => {
+            const { body } = await got()(asset.browser_download_url, { responseType: 'buffer' }).on('downloadProgress', ({ transferred }) => {
                 (0, log_update_1.default)(`  ${bar(transferred)} | ${humanSizeTotal}MiB`);
             });
             log_update_1.default.done();

package/dist/src/lib/download-track.js

@@ -3,7 +3,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const got_1 = __importDefault(require("got"));
+/* eslint-disable @typescript-eslint/no-var-requires */
+// `got` costs ~53 ms to require and is only needed once a transfer actually
+// starts — deferring it keeps `--help`, setup and the interactive prompt snappy.
+const got = () => require('got');
 const stream_1 = __importDefault(require("stream"));
 const fs_1 = require("fs");
 const util_1 = require("util");
@@ -127,7 +130,7 @@ const downloadTrack = async ({ track, quality, info, coverSizes, path, totalTrac
         const bar = (0, util_2.progressBar)(fileSize, 40);
         const humanSizeTotal = (fileSize / 1024 / 1024).toFixed(2);
         let transferredLast = downloaded;
-        await pipeline(got_1.default
+        await pipeline(got()
             .stream(trackData.trackUrl, {
             responseType: 'buffer',
             headers,

package/dist/src/lib/email-login.d.ts

@@ -2,9 +2,16 @@
 export type LoginResult = {
     ok: true;
     arl: string;
-} | {
+}
+/**
+ * `rejected` means Deezer refused the login. It deliberately does **not** say
+ * "wrong password": the endpoint returns an identical error (code 160) for a
+ * real account, a wrong password and an address that does not exist, so the
+ * cause genuinely cannot be told apart from here.
+ */
+ | {
     ok: false;
-    reason: 'wrong-credentials' | 'no-arl' | 'network' | 'unknown';
+    reason: 'rejected' | 'no-arl' | 'network' | 'unknown';
     message: string;
 };
 /**

package/dist/src/lib/email-login.js

@@ -1,11 +1,11 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loginWithEmail = void 0;
 const crypto_1 = require("crypto");
-const got_1 = __importDefault(require("got"));
+/* eslint-disable @typescript-eslint/no-var-requires */
+// `got` costs ~53 ms to require and is only needed once a transfer actually
+// starts — deferring it keeps `--help`, setup and the interactive prompt snappy.
+const got = () => require('got');
 /**
  * Email/password -> arl login for Deezer.
  *
@@ -23,6 +23,13 @@ const got_1 = __importDefault(require("got"));
 const CLIENT_ID = '447462';
 const CLIENT_SECRET = 'a83bf7f38ad2f137e444727cfc3775cf';
 const UA = 'Mozilla/5.0 (X11; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0';
+/**
+ * Deezer's `user_auth.php` error codes, as far as they can be told apart.
+ * `150` proves the request itself was well formed, which is how we know a `160`
+ * is about the account rather than the app hash.
+ */
+const AUTH_WRONG_HASH = 150;
+const AUTH_FAILED = 160;
 const md5 = (data) => (0, crypto_1.createHash)('md5').update(Buffer.from(data, 'utf8')).digest('hex');
 /**
  * Merge `set-cookie` response headers into a cookie map (last value wins),
@@ -55,7 +62,7 @@ const loginWithEmail = async (email, password) => {
     const jar = new Map();
     try {
         // 1. Bootstrap a session so Deezer sets an initial sid cookie.
-        const boot = await (0, got_1.default)('https://www.deezer.com', {
+        const boot = await got()('https://www.deezer.com', {
             method: 'POST',
             headers: { 'User-Agent': UA },
             timeout: { request: 15000 },
@@ -67,7 +74,7 @@ const loginWithEmail = async (email, password) => {
         const passwordHash = md5(password);
         const hash = md5([CLIENT_ID, email, passwordHash, CLIENT_SECRET].join(''));
         let accessToken = null;
-        const auth = await (0, got_1.default)('https://connect.deezer.com/oauth/user_auth.php', {
+        const auth = await got()('https://connect.deezer.com/oauth/user_auth.php', {
             searchParams: { app_id: CLIENT_ID, login: email, password: passwordHash, hash },
             headers: { 'User-Agent': UA, cookie: cookieHeader(jar) },
             responseType: 'json',
@@ -80,10 +87,26 @@ const loginWithEmail = async (email, password) => {
             accessToken = authBody.access_token;
         }
         if (!accessToken && !jar.has('arl') && (authBody.error || auth.statusCode >= 400)) {
-            return { ok: false, reason: 'wrong-credentials', message: 'Login failed — check your email and password.' };
+            const code = authBody?.error?.code;
+            if (code === AUTH_WRONG_HASH) {
+                return {
+                    ok: false,
+                    reason: 'unknown',
+                    message: 'Deezer rejected the request signature — the login flow has changed. Please paste an arl instead.',
+                };
+            }
+            return {
+                ok: false,
+                reason: 'rejected',
+                message: code === AUTH_FAILED
+                    ? 'Deezer refused the login. It returns this same response for a wrong password and for an address ' +
+                        'that does not exist, and it currently refuses valid credentials too, so this is most likely the ' +
+                        'flow being closed rather than anything wrong with your details. Paste an arl instead.'
+                    : 'Deezer refused the login. Paste an arl instead.',
+            };
         }
         // 3. Read the arl for the now-authenticated session.
-        const arlResp = await (0, got_1.default)('https://www.deezer.com/ajax/gw-light.php', {
+        const arlResp = await got()('https://www.deezer.com/ajax/gw-light.php', {
             searchParams: { method: 'user.getArl', input: 3, api_version: '1.0', api_token: 'null' },
             headers: { 'User-Agent': UA, cookie: cookieHeader(jar) },
             responseType: 'json',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gerdur",
-  "version": "2.15.0",
+  "version": "2.17.0",
   "description": "Command-line music downloader for Deezer (Spotify/Tidal links resolved via ISRC matching) with automatic MP3/FLAC tagging, synced lyrics and a side-effect-free programmatic API.",
   "keywords": [
     "deezer",
@@ -63,7 +63,7 @@
     "adm-zip": "^0.5.16",
     "chalk": "^4.1.2",
     "commander": "^9.5.0",
-    "gerdur-core": "^2.19.0",
+    "gerdur-core": "^2.20.0",
     "dot-prop": "^6.0.1",
     "got": "^11.8.6",
     "gradient-string": "^2.0.2",