plx-converter 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Native Muttaqien
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,60 @@
+# plx
+
+Spotify ⇄ Deezer playlist converter CLI.
+
+Converts playlists in both directions — reads Spotify **without an account, Premium, or OAuth**; writes via your session cookies.
+
+> ⚠️ **Personal, non-commercial use.** Uses unofficial web endpoints that can change or break without notice. Not affiliated with Spotify or Deezer.
+
+## Install
+
+```bash
+npm install -g plx
+```
+
+Requires Node.js ≥ 22.
+
+## Usage
+
+```bash
+plx                                              # interactive menu (both directions)
+plx --url "https://open.spotify.com/playlist/ID" # Spotify → Deezer
+plx --url "<URL>" --dry-run                      # preview matches without writing
+```
+
+```text
+Options:
+  -u, --url <URL|ID>      playlist URL/URI/ID (repeatable)
+  -o, --output <file>     CSV report path (default: conversion_report.csv)
+  -d, --dry-run           match only, don't write
+  -h, --help              show help
+```
+
+## Credentials
+
+| Cookie | Env var | Needed for |
+|---|---|---|
+| Deezer `arl` | `DEEZER_ARL` | writing to Deezer |
+| Spotify `sp_dc` | `SPOTIFY_DC` | writing to Spotify (reverse flow) |
+
+Set in `.env`, or paste when prompted. Reading a Spotify playlist needs **no credentials**. Full setup: [`docs/CONFIG.md`](docs/CONFIG.md).
+
+## Development
+
+```bash
+npm install
+npm run typecheck
+npm test
+npm run lint
+npm run build
+```
+
+## Documentation
+
+- [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) — design, endpoint contracts, invariants.
+- [`docs/CONFIG.md`](docs/CONFIG.md) — setup, env vars, config directory.
+- [`docs/CONTINUATION.md`](docs/CONTINUATION.md) — handoff log.
+
+## License
+
+MIT

package/dist/args.js

@@ -0,0 +1,52 @@
+export const HELP_TEXT = `plx — Spotify → Deezer playlist converter
+
+Usage:
+  plx                              interactive menu
+  plx --url <URL|ID> [--url ...]   convert specific playlist(s) — no Spotify account or OAuth needed
+
+Options:
+  -u, --url <URL|ID>      Spotify playlist URL, URI, or ID (repeatable)
+  -o, --output <file>     CSV report path (default: conversion_report.csv)
+  -d, --dry-run           match only; do not create Deezer playlists
+  -h, --help              show this help
+
+Examples:
+  plx --url https://open.spotify.com/playlist/37i9dQZF1DXcBWIGoYBM5M --dry-run
+  plx
+`;
+export function parseArgs(argv) {
+    const options = { urls: [], dryRun: false, output: 'conversion_report.csv', help: false };
+    const takeValue = (flag, i, inline) => inline !== undefined ? { value: inline, next: i + 1 } : { value: argv[i + 1], next: i + 2 };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === '--help' || arg === '-h') {
+            options.help = true;
+            continue;
+        }
+        if (arg === '--dry-run' || arg === '-d') {
+            options.dryRun = true;
+            continue;
+        }
+        const flagMatch = arg.match(/^(--\w+|\w)=(.+)$/);
+        const flag = flagMatch ? flagMatch[1] : arg;
+        const inline = flagMatch ? flagMatch[2] : undefined;
+        if (flag === '--url' || flag === '-u') {
+            const { value, next } = takeValue('--url', i, inline);
+            if (value)
+                options.urls.push(value);
+            i = next - 1;
+            continue;
+        }
+        if (flag === '--output' || flag === '-o') {
+            const { value, next } = takeValue('--output', i, inline);
+            if (value)
+                options.output = value;
+            i = next - 1;
+            continue;
+        }
+        if (arg.startsWith('-'))
+            throw new Error(`Unknown flag: ${arg}`);
+        throw new Error(`Unexpected argument: ${arg}`);
+    }
+    return options;
+}

package/dist/browser.js

@@ -0,0 +1,161 @@
+import { createDecipheriv, pbkdf2Sync } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir, platform } from 'node:os';
+import { join } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+const CHROMIUM_BROWSERS = [
+    { dir: 'BraveSoftware/Brave-Browser', keychain: 'Brave Safe Storage' },
+    { dir: 'Google/Chrome', keychain: 'Chrome Safe Storage' },
+    { dir: 'Microsoft Edge', keychain: 'Microsoft Edge Safe Storage' },
+    { dir: 'Chromium', keychain: 'Chromium Safe Storage' },
+    { dir: 'Vivaldi', keychain: 'Vivaldi Safe Storage' },
+    { dir: 'com.operasoftware.Opera', keychain: 'Opera Safe Storage' },
+];
+// Chromium v10 blob: 3-byte "v10" prefix + AES-128-CBC (IV = 16 × 0x20, PKCS7).
+// Key = PBKDF2-HMAC-SHA1(keychain pw string, "saltysalt", 1003, 16 bytes).
+// DB version ≥ 24 prepends a 32-byte SHA256 domain hash to the plaintext.
+const PBKDF2_SALT = 'saltysalt';
+const PBKDF2_ITER = 1003;
+const PBKDF2_KEYLEN = 16;
+export function decryptCookie(blob, key, stripDomainHash = false) {
+    if (blob.length < 3 || blob.subarray(0, 3).toString('latin1') !== 'v10')
+        return null;
+    try {
+        const decipher = createDecipheriv('aes-128-cbc', key, Buffer.alloc(16, 0x20));
+        let plain = Buffer.concat([decipher.update(blob.subarray(3)), decipher.final()]);
+        if (stripDomainHash)
+            plain = plain.subarray(32);
+        const value = plain.toString('utf8');
+        // arl is hex, sp_dc is base64 — both printable ASCII. Reject key-mismatch garbage.
+        return /^[\x20-\x7e]*$/.test(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function keychainPassword(service) {
+    if (platform() !== 'darwin')
+        return null;
+    try {
+        // This call pops the macOS Keychain "Allow" permission dialog on first use.
+        return execFileSync('security', ['find-generic-password', '-w', '-s', service], { encoding: 'utf8', timeout: 60_000 }).replace(/\n$/, '');
+    }
+    catch {
+        return null; // keychain denied / no such item — skip this browser
+    }
+}
+const COOKIE_QUERY = `SELECT name, host_key, encrypted_value FROM cookies WHERE (name = 'arl' AND host_key = '.deezer.com') OR (name = 'sp_dc' AND host_key = '.spotify.com')`;
+function readChromium(browser) {
+    const dbPath = join(homedir(), 'Library', 'Application Support', browser.dir, 'Default', 'Cookies');
+    if (!existsSync(dbPath))
+        return {};
+    const pw = keychainPassword(browser.keychain);
+    if (pw == null)
+        return {};
+    const key = pbkdf2Sync(pw, PBKDF2_SALT, PBKDF2_ITER, PBKDF2_KEYLEN, 'sha1');
+    const db = new DatabaseSync(dbPath, { readOnly: true });
+    try {
+        const meta = db.prepare("SELECT value FROM meta WHERE key = 'version'").get();
+        const dbVersion = meta?.value ? Number(meta.value) : 0;
+        const out = {};
+        const rows = db.prepare(COOKIE_QUERY).all();
+        for (const row of rows) {
+            const value = decryptCookie(Buffer.from(row.encrypted_value), key, dbVersion >= 24);
+            if (value) {
+                if (row.name === 'arl')
+                    out.arl = value;
+                else if (row.name === 'sp_dc')
+                    out.spDc = value;
+            }
+        }
+        return out;
+    }
+    catch {
+        return {}; // locked DB / changed schema — skip this browser
+    }
+    finally {
+        db.close();
+    }
+}
+// Safari `Cookies.binarycookies` layout (mirrors browser_cookie3):
+// "cook" magic + big-endian page table, then little-endian cookie records with
+// null-terminated host/name/value strings at cookie-relative offsets.
+const SAFARI_PATHS = [
+    join(homedir(), 'Library', 'Containers', 'com.apple.Safari', 'Data', 'Library', 'Cookies', 'Cookies.binarycookies'),
+    join(homedir(), 'Library', 'Cookies', 'Cookies.binarycookies'),
+];
+function readCStr(buf, start) {
+    let end = start;
+    while (end < buf.length && buf[end] !== 0)
+        end++;
+    return buf.subarray(start, end).toString('utf8');
+}
+export function parseSafariCookies(buf) {
+    if (buf.length < 8 || buf.subarray(0, 4).toString('latin1') !== 'cook')
+        return {};
+    const totalPages = buf.readUInt32BE(4);
+    const pageSizes = [];
+    for (let i = 0; i < totalPages; i++)
+        pageSizes.push(buf.readUInt32BE(8 + i * 4));
+    const out = {};
+    let base = 8 + totalPages * 4;
+    for (let p = 0; p < totalPages; p++) {
+        const page = buf.subarray(base, base + pageSizes[p]);
+        base += pageSizes[p];
+        if (page.length < 8 || page.readUInt32BE(0) !== 0x00000100)
+            continue;
+        const nCookies = page.readUInt32LE(4);
+        for (let i = 0; i < nCookies; i++) {
+            const cookieOffset = page.readUInt32LE(8 + i * 4);
+            const host = readCStr(page, cookieOffset + page.readUInt32LE(cookieOffset + 16));
+            const name = readCStr(page, cookieOffset + page.readUInt32LE(cookieOffset + 20));
+            const value = readCStr(page, cookieOffset + page.readUInt32LE(cookieOffset + 28));
+            if (!out.arl && name === 'arl' && host.includes('deezer.com'))
+                out.arl = value;
+            else if (!out.spDc && name === 'sp_dc' && host.includes('spotify.com'))
+                out.spDc = value;
+            if (out.arl && out.spDc)
+                return out;
+        }
+    }
+    return out;
+}
+function readSafari() {
+    for (const path of SAFARI_PATHS) {
+        if (!existsSync(path))
+            continue;
+        try {
+            return parseSafariCookies(readFileSync(path));
+        }
+        catch {
+            return {}; // TCC-denied or unreadable — skip
+        }
+    }
+    return {};
+}
+// Auto-retrieve credentials from the first logged-in browser that has them.
+// Never throws — a missing browser, locked DB, denied keychain, or TCC block
+// just yields {}. Callers persist what's found; manual paste stays the fallback.
+export function fetchBrowserCredentials() {
+    if (platform() !== 'darwin')
+        return {};
+    const result = {};
+    for (const browser of CHROMIUM_BROWSERS) {
+        const found = readChromium(browser);
+        if (found.arl && !result.arl)
+            result.arl = found.arl;
+        if (found.spDc && !result.spDc)
+            result.spDc = found.spDc;
+        if (result.arl && result.spDc)
+            break;
+    }
+    if (!result.arl || !result.spDc) {
+        const safari = readSafari();
+        if (safari.arl && !result.arl)
+            result.arl = safari.arl;
+        if (safari.spDc && !result.spDc)
+            result.spDc = safari.spDc;
+    }
+    return result;
+}

package/dist/cli.js

@@ -0,0 +1,312 @@
+#!/usr/bin/env node
+import { confirm, intro, isCancel, outro, password, select, text } from '@clack/prompts';
+import { loadConfig, saveCredentials, saveRecentUrl, tryAutoFillCredentials } from './config.js';
+import { DeezerClient, resolveDeezerPlaylistId } from './deezer.js';
+import { Converter } from './converter.js';
+import { anonymousToken, authenticatedToken, parsePlaylistId, playlistName } from './spotify.js';
+import { reverseConvert, reverseWriteToExisting } from './reverse.js';
+import { listPlaylists } from './spotify.js';
+import { HELP_TEXT, parseArgs } from './args.js';
+function args() { return process.argv.slice(2); }
+// Build a validated Deezer client. If no ARL is set, prompt for it and persist.
+// Returns null when the user cancels or the ARL is rejected.
+async function ensureDeezer(cfg) {
+    if (!cfg.deezerArl) {
+        const filled = await tryAutoFillCredentials(cfg);
+        if (!filled.includes('deezerArl')) {
+            const arl = await password({ message: `Deezer ARL (${ARL_HINT})` });
+            if (isCancel(arl) || !arl)
+                return null;
+            cfg.deezerArl = String(arl);
+            await saveCredentials({ deezerArl: cfg.deezerArl });
+        }
+    }
+    const deezer = new DeezerClient(cfg.deezerArl);
+    try {
+        await deezer.getMe();
+    }
+    catch (error) {
+        console.log(`⚠️ ARL Deezer tidak valid (${error instanceof Error ? error.message : 'error'}). Isi ulang lewat Pengaturan.`);
+        return null;
+    }
+    return deezer;
+}
+// Pick a Spotify source: recent URLs, paste new, or (with sp_dc) pick from the account.
+// Returns the ref plus an authenticated read token when picked from the account
+// (covers private playlists); token is null on the anonymous paste/recent paths.
+async function chooseSource(cfg) {
+    const options = [
+        ...cfg.recentUrls.map((u) => ({ value: u, label: u })),
+        { value: '__new__', label: 'Tempel URL/ID baru' },
+    ];
+    if (cfg.spotifyDc)
+        options.push({ value: '__lib__', label: 'Pilih dari akun Spotify saya' });
+    const pick = await select({ message: 'Playlist asal (Spotify)', options });
+    if (isCancel(pick))
+        return null;
+    if (pick === '__new__') {
+        const ref = await text({ message: 'Tempel URL/ID playlist (q untuk kembali)', initialValue: '' });
+        if (isCancel(ref) || !ref || String(ref).toLowerCase() === 'q')
+            return null;
+        return { ref: String(ref), token: null };
+    }
+    if (pick === '__lib__') {
+        const token = await ensureSpotify(cfg);
+        if (!token)
+            return null;
+        const uri = await pickSpotifyPlaylist(token, 'asal');
+        return uri ? { ref: uri, token } : null;
+    }
+    return { ref: String(pick), token: null };
+}
+// Pick an existing Deezer playlist (as target or source). Returns { id, title } or null.
+async function chooseTarget(deezer, role = 'target') {
+    const method = await select({
+        message: `Pilih playlist ${role === 'source' ? 'asal' : 'target'} (Deezer)`,
+        options: [
+            { value: 'list', label: 'Daftar dari akun Deezer' },
+            { value: 'paste', label: 'Tempel URL/ID Deezer' },
+        ],
+    });
+    if (isCancel(method))
+        return null;
+    if (method === 'list') {
+        let playlists;
+        try {
+            playlists = await deezer.listPlaylists();
+        }
+        catch (error) {
+            console.log(`⚠️ Gagal baca daftar playlist (${error instanceof Error ? error.message : 'error'}).`);
+            return null;
+        }
+        if (!playlists.length) {
+            console.log('Tidak ada playlist Deezer ditemukan di akun ini.');
+            return null;
+        }
+        const pick = await select({ message: 'Pilih playlist', options: playlists.map((p) => ({ value: p.id, label: p.title })) });
+        if (isCancel(pick))
+            return null;
+        return playlists.find((p) => p.id === pick) ?? null;
+    }
+    const ref = await text({ message: 'Tempel URL/ID playlist Deezer', initialValue: '' });
+    if (isCancel(ref) || !ref)
+        return null;
+    const id = await resolveDeezerPlaylistId(String(ref));
+    return { id, title: id };
+}
+// Pick how to write the target: a new playlist or an existing one.
+async function chooseTargetKind() {
+    const kind = await select({
+        message: 'Target tujuan',
+        options: [
+            { value: 'new', label: 'Playlist baru' },
+            { value: 'existing', label: 'Playlist yang sudah ada' },
+        ],
+    });
+    if (isCancel(kind))
+        return null;
+    return kind;
+}
+// Core convert: read source, match, then write to a new playlist or an existing target.
+async function convert(cfg, options) {
+    const source = await chooseSource(cfg);
+    if (!source)
+        return;
+    const deezer = await ensureDeezer(cfg);
+    if (!deezer)
+        return;
+    const id = parsePlaylistId(source.ref);
+    const name = await playlistName(id);
+    const converter = new Converter(deezer, source.token ?? await anonymousToken(), options.output);
+    const result = await converter.matchPlaylist({ name, uri: id }, options.dryRun);
+    if (!options.dryRun && result.matchedIds.length) {
+        const kind = await chooseTargetKind();
+        if (kind === 'existing') {
+            const target = await chooseTarget(deezer);
+            if (target)
+                await converter.writeToExisting(name, target.id, result.matchedIds);
+        }
+        else if (kind === 'new') {
+            await maybeWrite(converter, name, result);
+        }
+    }
+    await converter.writeReport();
+    await saveRecentUrl(source.ref);
+}
+async function maybeWrite(converter, name, result) {
+    if (!result.matchedIds.length)
+        return;
+    if (result.truncated) {
+        const proceed = await confirm({ message: `Playlist terpotong di 100 lagu. Lanjut dengan ${result.matchedIds.length} lagu?`, initialValue: false });
+        if (isCancel(proceed) || !proceed)
+            return;
+    }
+    const ok = await confirm({ message: `Buat '[plx] ${name}' (${result.matchedIds.length} lagu)?`, initialValue: false });
+    if (isCancel(ok) || !ok)
+        return;
+    await converter.writePlaylist(name, result.matchedIds);
+}
+// Build a validated Spotify session (sp_dc cookie → authenticated token). Returns token or null.
+async function ensureSpotify(cfg) {
+    if (!cfg.spotifyDc) {
+        const filled = await tryAutoFillCredentials(cfg);
+        if (!filled.includes('spotifyDc')) {
+            const dc = await password({ message: `Spotify sp_dc (${SPDC_HINT})` });
+            if (isCancel(dc) || !dc)
+                return null;
+            cfg.spotifyDc = String(dc);
+            await saveCredentials({ spotifyDc: cfg.spotifyDc });
+        }
+    }
+    try {
+        return await authenticatedToken(cfg.spotifyDc);
+    }
+    catch (error) {
+        console.log(`⚠️ sp_dc Spotify tidak valid (${error instanceof Error ? error.message : 'error'}). Isi ulang lewat Pengaturan.`);
+        return null;
+    }
+}
+// Pick a Spotify playlist by URI from the user's account (role 'asal' | 'target').
+async function pickSpotifyPlaylist(token, role) {
+    let playlists;
+    try {
+        playlists = await listPlaylists(token);
+    }
+    catch (error) {
+        console.log(`⚠️ Gagal baca daftar playlist Spotify (${error instanceof Error ? error.message : 'error'}).`);
+        return null;
+    }
+    if (!playlists.length) {
+        console.log('Tidak ada playlist Spotify (yang bisa diubah) ditemukan.');
+        return null;
+    }
+    const pick = await select({ message: `Pilih playlist ${role} (Spotify)`, options: playlists.map((p) => ({ value: p.uri, label: p.name })) });
+    if (isCancel(pick))
+        return null;
+    return String(pick);
+}
+// Pick an existing Spotify playlist (writable) as reverse target. Returns uri or null.
+async function chooseSpotifyTarget(token) {
+    return pickSpotifyPlaylist(token, 'target');
+}
+// Reverse flow: Deezer playlist (source) → new or existing Spotify playlist (target).
+async function reverseConvertFlow(cfg, options) {
+    const deezer = await ensureDeezer(cfg);
+    if (!deezer)
+        return;
+    const source = await chooseTarget(deezer, 'source');
+    if (!source)
+        return;
+    const token = await ensureSpotify(cfg);
+    if (!token)
+        return;
+    const kind = await chooseTargetKind();
+    if (kind === 'existing') {
+        const target = await chooseSpotifyTarget(token);
+        if (target)
+            await reverseWriteToExisting(deezer, token, source.id, source.title, target, options.output);
+    }
+    else if (kind === 'new') {
+        await reverseConvert(deezer, token, source.id, source.title, options.output);
+    }
+}
+function warnLogin(sites) {
+    console.log(`⚠️ Pastikan sudah login di ${sites} di browser, lalu ambil kredensialnya.`);
+}
+const ARL_HINT = 'login deezer.com → F12 → Application → Cookies → arl → salin value';
+const SPDC_HINT = 'login open.spotify.com → F12 → Application → Cookies → sp_dc → salin value';
+async function runInteractive(options) {
+    intro('plx — Spotify ⇄ Deezer');
+    const cfg = await loadConfig(false); // no requirement at menu entry
+    for (;;) {
+        const choice = await select({
+            message: 'Pilih aksi',
+            options: [
+                { value: 'forward', label: 'Spotify → Deezer' },
+                { value: 'reverse', label: 'Deezer → Spotify' },
+                { value: 'arl', label: `Deezer ARL: ${cfg.deezerArl ? '✓ tersimpan' : '(belum diisi)'}` },
+                { value: 'spdc', label: `Spotify sp_dc: ${cfg.spotifyDc ? '✓ tersimpan' : '(belum diisi)'}` },
+                { value: 'autofetch', label: 'Ambil kredensial otomatis (dari browser)' },
+                { value: 'output', label: `Laporan: ${options.output}` },
+                { value: 'quit', label: 'Keluar' },
+            ],
+        });
+        if (isCancel(choice) || choice === 'quit')
+            break;
+        if (choice === 'forward') {
+            await convert(cfg, options);
+            continue;
+        }
+        if (choice === 'reverse') {
+            await reverseConvertFlow(cfg, options);
+            continue;
+        }
+        if (choice === 'arl') {
+            warnLogin('Deezer (deezer.com)');
+            const filled = await tryAutoFillCredentials(cfg);
+            if (!filled.includes('deezerArl')) {
+                const arl = await password({ message: `Deezer ARL (${ARL_HINT})` });
+                if (isCancel(arl) || !arl)
+                    continue;
+                cfg.deezerArl = String(arl);
+                await saveCredentials({ deezerArl: cfg.deezerArl });
+            }
+            console.log('✓ Deezer ARL tersimpan.');
+            continue;
+        }
+        if (choice === 'spdc') {
+            warnLogin('Spotify (open.spotify.com)');
+            const filled = await tryAutoFillCredentials(cfg);
+            if (!filled.includes('spotifyDc')) {
+                const dc = await password({ message: `Spotify sp_dc (${SPDC_HINT})` });
+                if (isCancel(dc) || !dc)
+                    continue;
+                cfg.spotifyDc = String(dc);
+                await saveCredentials({ spotifyDc: cfg.spotifyDc });
+            }
+            console.log('✓ Spotify sp_dc tersimpan.');
+            continue;
+        }
+        if (choice === 'autofetch') {
+            warnLogin('Deezer & Spotify');
+            const filled = await tryAutoFillCredentials(cfg, true);
+            console.log(filled.length
+                ? `✓ Terambil dari browser: ${filled.join(', ')}.`
+                : '✗ Tidak ada kredensial yang bisa diambil (browser belum login / keychain ditolak).');
+            continue;
+        }
+        if (choice === 'output') {
+            const output = await text({ message: 'Path file laporan', initialValue: options.output });
+            if (isCancel(output) || !output)
+                continue;
+            options.output = String(output);
+            continue;
+        }
+    }
+    outro(`Selesai. Laporan: ${options.output}`);
+}
+async function main() {
+    const options = parseArgs(args());
+    if (options.help) {
+        console.log(HELP_TEXT);
+        return;
+    }
+    if (!options.urls.length) {
+        await runInteractive(options);
+        return;
+    }
+    const cfg = await loadConfig(true);
+    const deezer = new DeezerClient(cfg.deezerArl);
+    await deezer.getMe();
+    const converter = new Converter(deezer, await anonymousToken(), options.output);
+    for (const raw of options.urls) {
+        const id = parsePlaylistId(raw);
+        const name = await playlistName(id);
+        const result = await converter.matchPlaylist({ name, uri: id }, options.dryRun);
+        if (!options.dryRun && result.matchedIds.length)
+            await converter.writePlaylist(name, result.matchedIds);
+    }
+    await converter.writeReport();
+    outro(`Report saved to ${options.output}`);
+}
+main().catch((error) => { console.error(`Error: ${error instanceof Error ? error.message : error}`); process.exitCode = 1; });

package/dist/config.js

@@ -0,0 +1,67 @@
+import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { homedir, platform } from 'node:os';
+import { join } from 'node:path';
+import 'dotenv/config';
+import { fetchBrowserCredentials } from './browser.js';
+export function configDir() {
+    if (platform() === 'win32')
+        return join(process.env.APPDATA ?? join(homedir(), 'AppData', 'Roaming'), 'plx');
+    return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), '.config'), 'plx');
+}
+const file = () => join(configDir(), 'credentials.json');
+export async function loadConfig(requireDeezer = true) {
+    let stored = {};
+    try {
+        stored = JSON.parse(await readFile(file(), 'utf8'));
+    }
+    catch { /* first run */ }
+    const cfg = { deezerArl: process.env.DEEZER_ARL ?? stored.deezerArl ?? '', spotifyDc: process.env.SPOTIFY_DC ?? stored.spotifyDc ?? '', recentUrls: stored.recentUrls ?? [] };
+    if (requireDeezer && !cfg.deezerArl)
+        throw new Error('Konfigurasi kurang: DEEZER_ARL');
+    return cfg;
+}
+export async function saveRecentUrl(url) {
+    const stored = await loadStored();
+    const list = Array.isArray(stored.recentUrls) ? stored.recentUrls : [];
+    const next = [url, ...list.filter((u) => u !== url)].slice(0, 10);
+    await saveCredentials({ recentUrls: next });
+}
+export async function saveCredentials(values) {
+    await mkdir(configDir(), { recursive: true, mode: 0o700 });
+    const current = await loadStored();
+    await writeFile(file(), JSON.stringify({ ...current, ...values }, null, 2), { mode: 0o600 });
+    try {
+        await chmod(file(), 0o600);
+    }
+    catch { /* Windows */ }
+}
+async function loadStored() { try {
+    return JSON.parse(await readFile(file(), 'utf8'));
+}
+catch {
+    return {};
+} }
+// Semi-auto: fill credentials from a logged-in browser (pops the macOS Keychain
+// "Allow" dialog on first use), persist what's found, and return the field names
+// filled. By default only fills *missing* fields (env vars and stored credentials
+// win); pass overwrite=true to refetch and replace whatever the browser has. Never
+// throws — a denied keychain / TCC block just fills nothing, and the caller falls
+// back to the manual paste prompt.
+export async function tryAutoFillCredentials(cfg, overwrite = false) {
+    const filled = [];
+    const want = overwrite || !cfg.deezerArl || !cfg.spotifyDc;
+    if (!want)
+        return filled;
+    const found = fetchBrowserCredentials();
+    if ((overwrite || !cfg.deezerArl) && found.arl) {
+        cfg.deezerArl = found.arl;
+        filled.push('deezerArl');
+    }
+    if ((overwrite || !cfg.spotifyDc) && found.spDc) {
+        cfg.spotifyDc = found.spDc;
+        filled.push('spotifyDc');
+    }
+    if (filled.length)
+        await saveCredentials({ deezerArl: cfg.deezerArl, spotifyDc: cfg.spotifyDc });
+    return filled;
+}