docs: fix #108 reference in changelog - MP3 403 error fix

- Add ProGuard rules for Flutter plugins (path_provider, local_notifications, receive_sharing_intent, etc.)
- Upgrade Go to 1.25.6 for 16KB page alignment support
- Expand ProGuard rules for Go backend and Kotlin coroutines
- Fix R8 stripping plugin implementations in release builds

.github/FUNDING.yml

@@ -0,0 +1,4 @@
+github: zarzet
+ko_fi: zarzet
+buy_me_a_coffee: zarzet
+

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -16,7 +16,7 @@ body:
       options:
         - label: I have searched existing issues and this bug hasn't been reported yet
           required: true
-        - label: I am using the latest version of SpotiFLAC
+        - label: I am using the latest version of SpotiFLAC (Stable Version)
           required: true
 
   - type: textarea

.github/ISSUE_TEMPLATE/config.yml

@@ -3,3 +3,6 @@ contact_links:
   - name: README
     url: https://github.com/zarzet/SpotiFLAC-Mobile#readme
     about: Check the README for setup instructions and FAQ
+  - name: Extension Development Guide
+    url: https://zarz.moe/docs
+    about: Documentation for building SpotiFLAC extensions

.github/ISSUE_TEMPLATE/download_issue.yml

@@ -16,7 +16,7 @@ body:
       options:
         - label: I have tried downloading with a different service (Tidal/Qobuz/Amazon)
           required: true
-        - label: I am using the latest version of SpotiFLAC
+        - label: I am using the latest version of SpotiFLAC (Stable Version)
           required: true
 
   - type: dropdown

.github/ISSUE_TEMPLATE/extension_feature_request.yml

@@ -0,0 +1,117 @@
+name: Extension API Feature Request
+description: Request new API features or capabilities for extension development
+title: "[Extension API]: "
+labels: ["enhancement", "extension-api"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for helping improve the SpotiFLAC Extension API! 
+        This form is for extension developers who need new features or capabilities that don't exist yet.
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      description: Please confirm the following before submitting
+      options:
+        - label: I have read the [Extension Development Guide](https://github.com/zarzet/SpotiFLAC-Mobile/blob/main/docs/EXTENSION_DEVELOPMENT.md)
+          required: true
+        - label: I have searched existing issues and this API feature hasn't been requested yet
+          required: true
+
+  - type: textarea
+    id: extension_goal
+    attributes:
+      label: What are you trying to build?
+      description: Describe the extension or feature you're developing
+      placeholder: "I'm building an extension that downloads from [service name] / provides metadata from [source]..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: current_limitation
+    attributes:
+      label: Current API Limitation
+      description: What's missing or limiting in the current extension API?
+      placeholder: |
+        The current API doesn't support:
+        - [missing feature 1]
+        - [missing feature 2]
+        
+        This prevents me from...
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposed_api
+    attributes:
+      label: Proposed API / Feature
+      description: Describe the API or feature you'd like to see added
+      placeholder: |
+        I would like to have:
+        - A new function `api.newFeature()` that does X
+        - A new manifest field `newOption` that enables Y
+        - Access to Z capability...
+    validations:
+      required: true
+
+  - type: textarea
+    id: use_case
+    attributes:
+      label: Use Case Example
+      description: Provide a code example of how you would use this feature
+      placeholder: |
+        ```javascript
+        // Example usage in extension code
+        function download(request, progressCallback) {
+          const result = api.proposedFeature(params);
+          // ...
+        }
+        ```
+    validations:
+      required: false
+
+  - type: dropdown
+    id: api_category
+    attributes:
+      label: API Category
+      description: What category does this feature fall under?
+      options:
+        - HTTP/Network API
+        - File System API
+        - Storage API
+        - FFmpeg/Audio Processing
+        - Manifest Options
+        - Runtime Functions
+        - UI Integration
+        - Authentication
+        - Other
+    validations:
+      required: true
+
+  - type: dropdown
+    id: priority
+    attributes:
+      label: How critical is this for your extension?
+      options:
+        - Blocker - Cannot build my extension without this
+        - High - Major functionality depends on this
+        - Medium - Would significantly improve my extension
+        - Low - Nice to have
+    validations:
+      required: true
+
+  - type: textarea
+    id: workaround
+    attributes:
+      label: Current Workaround
+      description: Are you using any workaround currently? If so, describe it.
+      placeholder: "Currently I'm working around this by..."
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional Context
+      description: Add any other context, links to similar APIs, or examples from other platforms
+      placeholder: "Similar feature in other platforms: ..."

.github/workflows/release.yml

@@ -71,7 +71,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.21"
+          go-version: "1.25"
           cache-dependency-path: go_backend/go.sum
 
       # Cache Gradle for faster builds
@@ -174,7 +174,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.21"
+          go-version: "1.25"
           cache-dependency-path: go_backend/go.sum
 
       # Cache CocoaPods
@@ -194,7 +194,7 @@ jobs:
         working-directory: go_backend
         run: |
           mkdir -p ../ios/Frameworks
-          gomobile bind -target=ios -o ../ios/Frameworks/Gobackend.xcframework .
+          gomobile bind -target=ios -tags ios -o ../ios/Frameworks/Gobackend.xcframework .
         env:
           CGO_ENABLED: 1
 
@@ -249,23 +249,6 @@ jobs:
           channel: "stable"
           cache: true
 
-      # Swap pubspec for iOS build (includes ffmpeg_kit_flutter)
-      - name: Use iOS pubspec with FFmpeg plugin
-        run: |
-          cp pubspec.yaml pubspec_android_backup.yaml
-          cp pubspec_ios.yaml pubspec.yaml
-          echo "Swapped to iOS pubspec with ffmpeg_kit_flutter"
-
-      # Swap FFmpeg service for iOS
-      - name: Use iOS FFmpeg service
-        run: |
-          cp lib/services/ffmpeg_service.dart lib/services/ffmpeg_service_android.dart
-          cp build_assets/ffmpeg_service_ios.dart lib/services/ffmpeg_service.dart
-          # Update class name in the swapped file
-          sed -i '' 's/FFmpegServiceIOS/FFmpegService/g' lib/services/ffmpeg_service.dart
-          sed -i '' 's/FFmpegResultIOS/FFmpegResult/g' lib/services/ffmpeg_service.dart
-          echo "Swapped to iOS FFmpeg service"
-
       - name: Get Flutter dependencies
         run: flutter pub get
 
@@ -345,6 +328,8 @@ jobs:
             CHANGELOG="See CHANGELOG.md for details."
           else
             echo "Found changelog content"
+            # Remove trailing --- separator if present (CHANGELOG uses --- between versions)
+            CHANGELOG=$(echo "$CHANGELOG" | sed '/^---$/d')
           fi
 
           # Save to file for multiline support
@@ -410,3 +395,135 @@ jobs:
           prerelease: ${{ needs.get-version.outputs.is_prerelease == 'true' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  notify-telegram:
+    runs-on: ubuntu-latest
+    needs: [get-version, create-release]
+    if: ${{ needs.get-version.outputs.is_prerelease != 'true' }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Download Android APK
+        uses: actions/download-artifact@v4
+        with:
+          name: android-apk
+          path: ./release
+
+      - name: Download iOS IPA
+        uses: actions/download-artifact@v4
+        with:
+          name: ios-ipa
+          path: ./release
+
+      - name: Extract changelog for version
+        id: changelog
+        run: |
+          VERSION=${{ needs.get-version.outputs.version }}
+          VERSION_NUM=${VERSION#v}
+
+          # Extract changelog, limit to ~2500 chars for Telegram (4096 limit minus message overhead)
+          # Use tr -d '\r' to handle CRLF line endings from Windows
+          FULL_CHANGELOG=$(cat CHANGELOG.md | tr -d '\r' | sed -n "/^## \[$VERSION_NUM\]/,/^## \[/{ /^## \[$VERSION_NUM\]/d; /^## \[/d; p; }" | sed '/^---$/d')
+          
+          echo "DEBUG: Extracted changelog length: ${#FULL_CHANGELOG}"
+          echo "DEBUG: First 200 chars: ${FULL_CHANGELOG:0:200}"
+          
+          if [ -z "$FULL_CHANGELOG" ]; then
+            CHANGELOG="See release notes on GitHub for details."
+          else
+            # Convert GitHub Markdown to Telegram HTML:
+            # - **text** → <b>text</b>
+            # - `code` → <code>code</code>
+            # - ### Header → <b>Header</b>
+            # - Escape HTML special chars first
+            # - Remove > blockquote prefix
+            CHANGELOG=$(echo "$FULL_CHANGELOG" | \
+              sed 's/^> //' | \
+              sed 's/&/\&amp;/g' | \
+              sed 's/</\&lt;/g' | \
+              sed 's/>/\&gt;/g' | \
+              sed 's/`\([^`]*\)`/<code>\1<\/code>/g' | \
+              sed 's/\*\*\([^*]*\)\*\*/<b>\1<\/b>/g' | \
+              sed 's/^### \(.*\)$/<b>\1<\/b>/g' | \
+              sed 's/^## \(.*\)$/<b>\1<\/b>/g' | \
+              sed 's/^- /• /g' | \
+              sed 's/^  - /  ◦ /g')
+            
+            # Take first 2500 characters, then cut at last complete line
+            CHANGELOG=$(echo "$CHANGELOG" | head -c 2500 | sed '$d')
+            
+            # Check if truncated
+            FULL_LEN=${#FULL_CHANGELOG}
+            if [ $FULL_LEN -gt 2500 ]; then
+              CHANGELOG="${CHANGELOG}"$'\n\n... (see full changelog on GitHub)'
+            fi
+          fi
+
+          echo "$CHANGELOG" > /tmp/changelog.txt
+          echo "DEBUG: Final changelog:"
+          cat /tmp/changelog.txt
+
+      - name: Send to Telegram Channel
+        env:
+          TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+          TELEGRAM_CHANNEL_ID: ${{ secrets.TELEGRAM_CHANNEL_ID }}
+        run: |
+          VERSION=${{ needs.get-version.outputs.version }}
+          CHANGELOG=$(cat /tmp/changelog.txt)
+          
+          # Find APK files
+          ARM64_APK=$(find ./release -name "*arm64*.apk" | head -1)
+          ARM32_APK=$(find ./release -name "*arm32*.apk" | head -1)
+          
+          # Prepare message with changelog (HTML format)
+          printf '%s\n' \
+            "<b>SpotiFLAC Mobile ${VERSION} Released!</b>" \
+            "" \
+            "<b>What's New:</b>" \
+            "${CHANGELOG}" \
+            "" \
+            "<a href=\"https://github.com/${{ github.repository }}/releases/tag/${VERSION}\">View Release Notes</a>" \
+            > /tmp/telegram_message.txt
+
+          MESSAGE=$(cat /tmp/telegram_message.txt)
+
+          # Send message first (using HTML parse mode)
+          # Use --data-urlencode for proper encoding of special chars (+, &, etc.)
+          # Use || true to ensure file uploads continue even if message fails
+          curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
+            --data-urlencode "chat_id=${TELEGRAM_CHANNEL_ID}" \
+            --data-urlencode "text=${MESSAGE}" \
+            --data-urlencode "parse_mode=HTML" \
+            --data-urlencode "disable_web_page_preview=true" || true
+
+          # Upload arm64 APK to channel
+          if [ -f "$ARM64_APK" ]; then
+            echo "Uploading arm64 APK to Telegram..."
+            curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendDocument" \
+              -F chat_id="${TELEGRAM_CHANNEL_ID}" \
+              -F document=@"${ARM64_APK}" \
+              -F caption="SpotiFLAC ${VERSION} - arm64 (recommended)"
+          fi
+
+          # Upload arm32 APK to channel
+          if [ -f "$ARM32_APK" ]; then
+            echo "Uploading arm32 APK to Telegram..."
+            curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendDocument" \
+              -F chat_id="${TELEGRAM_CHANNEL_ID}" \
+              -F document=@"${ARM32_APK}" \
+              -F caption="SpotiFLAC ${VERSION} - arm32"
+          fi
+
+          # Upload iOS IPA to channel
+          IOS_IPA=$(find ./release -name "*ios*.ipa" | head -1)
+          if [ -f "$IOS_IPA" ]; then
+            echo "Uploading iOS IPA to Telegram..."
+            curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendDocument" \
+              -F chat_id="${TELEGRAM_CHANNEL_ID}" \
+              -F document=@"${IOS_IPA}" \
+              -F caption="SpotiFLAC ${VERSION} - iOS (unsigned, sideload required)"
+          fi
+
+          echo "Telegram notification sent!"

.gitignore

@@ -6,6 +6,8 @@ Thumbs.db
 .idea/
 .vscode/
 *.iml
+.cursorignore
+.cursorrules
 
 # Kiro specs (development only)
 .kiro/
@@ -13,6 +15,9 @@ Thumbs.db
 # Reference folder (development only)
 referensi/
 
+# Documentation (development only, published separately)
+docs/
+
 # Old spotiflac_android folder (moved to root)
 spotiflac_android/
 
@@ -50,3 +55,21 @@ ios/.symlinks/
 ios/Flutter/Flutter.framework/
 ios/Flutter/Flutter.podspec
 android/app/libs/gobackend-sources.jar
+
+# Extension folder
+extension/
+
+# Agent instructions
+AGENTS.md
+
+# Temp/misc
+nul
+
+# Log files
+*.log
+hs_err_*.log
+flutter_*.log
+
+# Development tools
+tool/
+.claude/settings.local.json

CODE_OF_CONDUCT.md

@@ -0,0 +1,133 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official email address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+**[zarzet](https://github.com/zarzet)**.
+
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
+[https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations

CONTRIBUTING.md

@@ -0,0 +1,268 @@
+# Contributing to SpotiFLAC
+
+First off, thank you for considering contributing to SpotiFLAC! 🎉
+
+This document provides guidelines and steps for contributing. Following these guidelines helps maintain code quality and ensures a smooth collaboration process.
+
+## Table of Contents
+
+- [Code of Conduct](#code-of-conduct)
+- [How Can I Contribute?](#how-can-i-contribute)
+  - [Reporting Bugs](#reporting-bugs)
+  - [Suggesting Features](#suggesting-features)
+  - [Code Contributions](#code-contributions)
+  - [Translations](#translations)
+- [Development Setup](#development-setup)
+- [Project Structure](#project-structure)
+- [Coding Guidelines](#coding-guidelines)
+- [Commit Guidelines](#commit-guidelines)
+- [Pull Request Process](#pull-request-process)
+
+## Code of Conduct
+
+This project and everyone participating in it is governed by our [Code of Conduct](CODE_OF_CONDUCT.md). By participating, you are expected to uphold this code. Please report unacceptable behavior to the project maintainers.
+
+## How Can I Contribute?
+
+### Reporting Bugs
+
+Before creating bug reports, please check the [existing issues](https://github.com/zarzet/SpotiFLAC-Mobile/issues) to avoid duplicates.
+
+When creating a bug report, please use the bug report template and include:
+
+- **Clear and descriptive title**
+- **Steps to reproduce** the issue
+- **Expected behavior** vs **actual behavior**
+- **Screenshots or screen recordings** if applicable
+- **Device information** (model, OS version)
+- **App version**
+- **Logs** from Settings > About > View Logs
+
+### Suggesting Features
+
+Feature requests are welcome! Please use the feature request template and:
+
+- **Check existing issues** to avoid duplicates
+- **Describe the feature** clearly
+- **Explain the use case** - why would this be useful?
+- **Consider the scope** - is this a small enhancement or a major feature?
+
+### Code Contributions
+
+1. **Fork the repository** and create your branch from `dev`
+2. **Make your changes** following our coding guidelines
+3. **Test your changes** thoroughly
+4. **Submit a pull request** to the `dev` branch
+
+### Translations
+
+We use [Crowdin](https://crowdin.com/project/spotiflac-mobile) for translations. To contribute:
+
+1. Visit our [Crowdin project](https://crowdin.com/project/spotiflac-mobile)
+2. Select your language or request a new one
+3. Start translating!
+
+Translation files are located in `lib/l10n/arb/`.
+
+## Development Setup
+
+### Prerequisites
+
+- **Flutter SDK** 3.10.0 or higher
+- **Dart SDK** 3.10.0 or higher
+- **Android Studio** or **VS Code** with Flutter extensions
+- **Git**
+
+### Getting Started
+
+1. **Clone your fork**
+   ```bash
+   git clone https://github.com/YOUR_USERNAME/SpotiFLAC-Mobile.git
+   cd SpotiFLAC-Mobile
+   ```
+
+2. **Add upstream remote**
+   ```bash
+   git remote add upstream https://github.com/zarzet/SpotiFLAC-Mobile.git
+   ```
+
+3. **Install dependencies**
+   ```bash
+   flutter pub get
+   ```
+
+4. **Generate code** (for Riverpod, JSON serialization, etc.)
+   ```bash
+   dart run build_runner build --delete-conflicting-outputs
+   ```
+
+5. **Run the app**
+   ```bash
+   flutter run
+   ```
+
+### Building
+
+```bash
+# Debug build
+flutter build apk --debug
+
+# Release build
+flutter build apk --release
+```
+
+## Project Structure
+
+```
+lib/
+├── l10n/               # Localization files
+│   └── arb/            # ARB translation files
+├── models/             # Data models
+├── providers/          # Riverpod providers
+├── screens/            # UI screens
+│   └── settings/       # Settings sub-screens
+├── services/           # Business logic services
+├── theme/              # App theming
+├── utils/              # Utility functions
+├── widgets/            # Reusable widgets
+├── app.dart            # App configuration
+└── main.dart           # Entry point
+```
+
+## Coding Guidelines
+
+### General
+
+- Follow [Effective Dart](https://dart.dev/effective-dart) guidelines
+- Use meaningful variable and function names
+- Keep functions small and focused
+- Add comments for complex logic
+
+### Formatting
+
+- Use `dart format` before committing
+- Maximum line length: 80 characters
+- Use trailing commas for better formatting
+
+```bash
+dart format .
+```
+
+### Linting
+
+Ensure your code passes all lints:
+
+```bash
+flutter analyze
+```
+
+### State Management
+
+We use **Riverpod** for state management. Follow these patterns:
+
+```dart
+// Use code generation with riverpod_annotation
+@riverpod
+class MyNotifier extends _$MyNotifier {
+  @override
+  MyState build() => MyState();
+  
+  // Methods to update state
+}
+```
+
+### Localization
+
+All user-facing strings should be localized:
+
+```dart
+// Good
+Text(AppLocalizations.of(context)!.downloadComplete)
+
+// Bad
+Text('Download Complete')
+```
+
+To add new strings:
+1. Add the key to `lib/l10n/arb/app_en.arb`
+2. Run `flutter gen-l10n`
+
+## Commit Guidelines
+
+We follow [Conventional Commits](https://www.conventionalcommits.org/):
+
+```
+<type>(<scope>): <description>
+
+[optional body]
+
+[optional footer(s)]
+```
+
+### Types
+
+- `feat`: New feature
+- `fix`: Bug fix
+- `docs`: Documentation changes
+- `style`: Code style changes (formatting, etc.)
+- `refactor`: Code refactoring
+- `perf`: Performance improvements
+- `test`: Adding or updating tests
+- `chore`: Maintenance tasks
+
+### Examples
+
+```
+feat(download): add batch download support
+fix(ui): resolve overflow on small screens
+docs: update contributing guidelines
+chore(deps): update flutter_riverpod to 3.1.0
+```
+
+## Pull Request Process
+
+1. **Update your fork**
+   ```bash
+   git fetch upstream
+   git rebase upstream/dev
+   ```
+
+2. **Create a feature branch**
+   ```bash
+   git checkout -b feat/my-new-feature
+   ```
+
+3. **Make your changes** and commit following our guidelines
+
+4. **Push to your fork**
+   ```bash
+   git push origin feat/my-new-feature
+   ```
+
+5. **Create a Pull Request**
+   - Target the `dev` branch
+   - Fill in the PR template
+   - Link related issues
+
+6. **Address review feedback**
+   - Make requested changes
+   - Push additional commits
+   - Request re-review when ready
+
+### PR Requirements
+
+- [ ] Code follows project conventions
+- [ ] All tests pass
+- [ ] No new linting errors
+- [ ] Documentation updated (if needed)
+- [ ] Commit messages follow guidelines
+- [ ] PR description is clear and complete
+
+## Questions?
+
+If you have questions, feel free to:
+
+- Open a [Discussion](https://github.com/zarzet/SpotiFLAC-Mobile/discussions)
+- Check existing [Issues](https://github.com/zarzet/SpotiFLAC-Mobile/issues)
+
+Thank you for contributing! 💚

README.md

@@ -1,11 +1,12 @@
-[![GitHub All Releases](https://img.shields.io/github/downloads/zarzet/SpotiFLAC-Mobile/total?style=for-the-badge)](https://github.com/zarzet/SpotiFLAC-Mobile/releases)
-[![VirusTotal](https://img.shields.io/badge/VirusTotal-Safe-brightgreen?style=for-the-badge&logo=virustotal)](https://www.virustotal.com/gui/file/09c6260e9ebaf2ff0d15f30deda939642f41887f11aad602ac697cb37fa0308c/)
+[![GitHub All Releases](https://img.shields.io/github/downloads/zarzet/SpotiFLAC-Mobile/total?style=for-the-badge&refresh=1)](https://github.com/zarzet/SpotiFLAC-Mobile/releases)
+[![VirusTotal](https://img.shields.io/badge/VirusTotal-Safe-brightgreen?style=for-the-badge&logo=virustotal)](https://www.virustotal.com/gui/file/516142f029a4f3642a899832a6f600acf07040170a98c106cd03222cf584d9a3)
+[![Crowdin](https://img.shields.io/badge/HELP%20TRANSLATE%20ON-CROWDIN-%2321252b?style=for-the-badge&logo=crowdin)](https://crowdin.com/project/spotiflac-mobile)
 
 <div align="center">
 
 <img src="icon.png" width="128" />
 
-Get Spotify tracks in true FLAC from Tidal, Qobuz & Amazon Music — no account required.
+Download music in true lossless FLAC from Tidal, Qobuz & Amazon Music — no account required.
 
 ![Android](https://img.shields.io/badge/Android-7.0%2B-3DDC84?style=for-the-badge&logo=android&logoColor=white)
 ![iOS](https://img.shields.io/badge/iOS-14.0%2B-000000?style=for-the-badge&logo=apple&logoColor=white)
@@ -23,37 +24,81 @@ Get Spotify tracks in true FLAC from Tidal, Qobuz & Amazon Music — no account
   <img src="assets/images/4.jpg?v=2" width="200" />
 </p>
 
-## Metadata Source
+## Search Source
 
-SpotiFLAC supports two metadata sources for searching tracks:
+SpotiFLAC supports multiple search sources for finding music metadata:
 
-| Source | Pros | Cons |
-|--------|------|------|
-| **Deezer** (Default) | No developer account needed, rate limit per user IP | Slightly less comprehensive catalog |
-| **Spotify** | More comprehensive catalog, better search results | Requires developer API credentials to avoid rate limiting |
+| Source | Setup |
+|--------|-------|
+| **Deezer** (Default) | No setup required |
+| **Extensions** | Install additional search providers from the Store |
 
-### Using Spotify
-To use Spotify as your search source without hitting rate limits:
-1. Create a Spotify Developer account at [developer.spotify.com](https://developer.spotify.com)
-2. Create an app to get your Client ID and Client Secret
-3. Go to **Settings > Options > Spotify API > Change from Deezer to Spotify > Input Custom Credentials**
-4. Enter your Client ID and Secret
-5. Change **Search Source** to Spotify
+## Extensions
+
+Extensions allow the community to add new music sources and features without waiting for app updates. When a streaming service API changes or a new source becomes available, extensions can be updated independently.
+
+### Installing Extensions
+1. Go to **Store** tab in the app
+2. Browse and install extensions with one tap
+3. Or download a `.spotiflac-ext` file and install manually via **Settings > Extensions**
+4. Configure extension settings if needed
+5. Set provider priority in **Settings > Extensions > Provider Priority**
+
+### Developing Extensions
+Want to create your own extension? Check out the [Extension Development Guide](https://zarz.moe/docs) for complete documentation.
 
 ## Other project
 
 ### [SpotiFLAC (Desktop)](https://github.com/afkarxyz/SpotiFLAC)
-Get Spotify tracks in true FLAC from Tidal, Qobuz & Amazon Music for Windows, macOS & Linux
+Download music in true lossless FLAC from Tidal, Qobuz & Amazon Music for Windows, macOS & Linux
+
+## Telegram
+
+<p align="center">
+  <a href="https://t.me/spotiflac">
+    <img src="https://img.shields.io/badge/Telegram-Channel-2CA5E0?style=for-the-badge&logo=telegram&logoColor=white" alt="Telegram Channel">
+  </a>
+
+  <a href="https://t.me/spotiflac_chat">
+    <img src="https://img.shields.io/badge/Telegram-Community-2CA5E0?style=for-the-badge&logo=telegram&logoColor=white" alt="Telegram Community">
+  </a>
+</p>
+
+## FAQ
+
+**Q: Why is my download failing with "Song not found"?**  
+A: The track may not be available on Tidal, Qobuz, or Amazon Music. Try enabling more download services in Settings > Download > Provider Priority, or install additional extensions from the Store.
+
+**Q: Why are some tracks downloading in lower quality?**  
+A: Quality depends on what's available from the streaming service. Tidal offers up to 24-bit/192kHz, Qobuz up to 24-bit/192kHz, and Amazon up to 24-bit/48kHz. The app automatically selects the best available quality.
+
+**Q: Can I download playlists?**  
+A: Yes! Just paste the playlist URL in the search bar. The app will fetch all tracks and queue them for download.
+
+**Q: Why do I need to grant storage permission?**  
+A: The app needs permission to save downloaded files to your device. On Android 13+, you may need to grant "All files access" in Settings > Apps > SpotiFLAC > Permissions.
+
+**Q: Is this app safe?**  
+A: Yes, the app is open source and you can verify the code yourself. Each release is scanned with VirusTotal (see badge at top of README).
+
+**Q: Why is download not working in my country?**  
+A: Some countries have restricted access to certain streaming service APIs. If downloads are failing, try using a VPN to connect through a different region.
+
+
+### Want to support SpotiFLAC-Mobile?
+
+_If this software is useful and brings you value, consider supporting the project by buying me a coffee. Your support helps keep development going._
+
+[![Ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/zarzet) <a href="https://www.buymeacoffee.com/zarzet" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png" alt="Buy Me A Coffee" style="height: 40px !important;width: 150px !important;" ></a>
 
-[![Ko-fi](https://img.shields.io/badge/Ko--fi-Support%20Me-FF5E5B?style=for-the-badge&logo=ko-fi&logoColor=white)](https://ko-fi.com/zarzet)
 
 ## Disclaimer
 
-> **iOS Support**: This app is primarily tested on Android. iOS support is experimental and may have bugs — the developer is too poor to afford an iPhone for proper testing. If you encounter issues on iOS, please report them!
-
 This project is for **educational and private use only**. The developer does not condone or encourage copyright infringement.
 
-**SpotiFLAC** is a third-party tool and is not affiliated with, endorsed by, or connected to Spotify, Tidal, Qobuz, Amazon Music, or any other streaming service.
+**SpotiFLAC** is a third-party tool and is not affiliated with, endorsed by, or connected to Tidal, Qobuz, Amazon Music, Deezer, or any other streaming service.
+
+The application is purely a user interface that facilitates communication between your device and existing third-party services.
 
 You are solely responsible for:
 1. Ensuring your use of this software complies with your local laws.
@@ -61,3 +106,8 @@ You are solely responsible for:
 3. Any legal consequences resulting from the misuse of this tool.
 
 The software is provided "as is", without warranty of any kind. The author assumes no liability for any bans, damages, or legal issues arising from its use.
+
+
+> [!TIP]
+>
+> **Star Us**, You will receive all release notifications from GitHub without any delay ~

android/app/proguard-rules.pro

@@ -5,6 +5,7 @@
 -keep class io.flutter.view.** { *; }
 -keep class io.flutter.** { *; }
 -keep class io.flutter.plugins.** { *; }
+-keep class io.flutter.embedding.** { *; }
 
 # Ignore missing Play Core classes (not used, but referenced by Flutter)
 -dontwarn com.google.android.play.core.splitcompat.**
@@ -14,9 +15,15 @@
 # Ignore missing javax.xml.stream (not used on Android)
 -dontwarn javax.xml.stream.**
 
-# Go backend (gobackend.aar)
+# Go backend (gobackend.aar) - CRITICAL for release builds
 -keep class gobackend.** { *; }
 -keep class go.** { *; }
+-keep interface gobackend.** { *; }
+-keepclassmembers class gobackend.** { *; }
+
+# Go mobile binding internals
+-keep class org.golang.** { *; }
+-dontwarn org.golang.**
 
 # FFmpeg Kit
 -keep class com.arthenica.ffmpegkit.** { *; }
@@ -30,15 +37,77 @@
     native <methods>;
 }
 
-# Kotlin coroutines
+# Kotlin coroutines - expanded rules
 -keepnames class kotlinx.coroutines.internal.MainDispatcherFactory {}
 -keepnames class kotlinx.coroutines.CoroutineExceptionHandler {}
 -keepclassmembers class kotlinx.coroutines.** {
     volatile <fields>;
 }
+-keepclassmembernames class kotlinx.** {
+    volatile <fields>;
+}
+-dontwarn kotlinx.coroutines.**
+
+# Kotlin serialization
+-keepattributes RuntimeVisibleAnnotations,AnnotationDefault
+-dontwarn kotlin.**
+-keep class kotlin.** { *; }
+-keep class kotlin.Metadata { *; }
+
+# Keep MainActivity and related classes
+-keep class com.zarz.spotiflac.** { *; }
 
 # Prevent R8 from removing metadata
 -keepattributes *Annotation*
 -keepattributes SourceFile,LineNumberTable
 -keepattributes Signature
 -keepattributes Exceptions
+-keepattributes InnerClasses
+-keepattributes EnclosingMethod
+
+# JSON parsing (used by Go backend responses)
+-keep class org.json.** { *; }
+
+# Shared Preferences
+-keep class androidx.datastore.** { *; }
+-dontwarn androidx.datastore.**
+
+# Flutter Plugins - CRITICAL: Prevent R8 from removing plugin implementations
+# Path Provider
+-keep class io.flutter.plugins.pathprovider.** { *; }
+-keep class dev.flutter.pigeon.** { *; }
+
+# Local Notifications
+-keep class com.dexterous.** { *; }
+-keep class com.dexterous.flutterlocalnotifications.** { *; }
+
+# Receive Sharing Intent
+-keep class com.kasem.receive_sharing_intent.** { *; }
+
+# Permission Handler
+-keep class com.baseflow.permissionhandler.** { *; }
+
+# File Picker
+-keep class com.mr.flutter.plugin.filepicker.** { *; }
+
+# URL Launcher
+-keep class io.flutter.plugins.urllauncher.** { *; }
+
+# Share Plus
+-keep class dev.fluttercommunity.plus.share.** { *; }
+
+# Device Info Plus
+-keep class dev.fluttercommunity.plus.device_info.** { *; }
+
+# Open File
+-keep class com.crazecoder.openfile.** { *; }
+
+# Sqflite
+-keep class com.tekartik.sqflite.** { *; }
+
+# Dynamic Color
+-keep class io.material.** { *; }
+
+# Keep all Flutter plugin registrants
+-keep class io.flutter.plugins.GeneratedPluginRegistrant { *; }
+-keep class ** extends io.flutter.embedding.engine.plugins.FlutterPlugin { *; }

android/app/src/main/kotlin/com/zarz/spotiflac/MainActivity.kt

@@ -1,23 +1,155 @@
 package com.zarz.spotiflac
 
 import android.content.Intent
+import android.os.Build
 import io.flutter.embedding.android.FlutterActivity
 import io.flutter.embedding.engine.FlutterEngine
+import io.flutter.embedding.engine.FlutterShellArgs
 import io.flutter.plugin.common.MethodChannel
+import io.flutter.plugins.GeneratedPluginRegistrant
 import gobackend.Gobackend
-import com.arthenica.ffmpegkit.FFmpegKit
-import com.arthenica.ffmpegkit.ReturnCode
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
+import java.util.Locale
 
 class MainActivity: FlutterActivity() {
     private val CHANNEL = "com.zarz.spotiflac/backend"
-    private val FFMPEG_CHANNEL = "com.zarz.spotiflac/ffmpeg"
     private val scope = CoroutineScope(SupervisorJob() + Dispatchers.Main)
 
+    companion object {
+        // Minimum API level we consider "safe" for Impeller (Android 10+)
+        private const val SAFE_API_FOR_IMPELLER = 29
+        
+        // Known problematic GPU patterns (lowercase)
+        private val PROBLEMATIC_GPU_PATTERNS = listOf(
+            "adreno (tm) 3",   // Adreno 300 series (305, 320, 330, etc.) - old Qualcomm
+            "adreno (tm) 4",   // Adreno 400 series - some have issues
+            "mali-4",          // Mali-400 series - old ARM GPUs
+            "mali-t6",         // Mali-T600 series
+            "mali-t7",         // Mali-T700 series (some)
+            "powervr sgx",     // PowerVR SGX series - old Imagination GPUs
+            "powervr ge8320",  // PowerVR GE8320 - known issues
+            "gc1000",          // Vivante GC1000
+            "gc2000",          // Vivante GC2000
+        )
+        
+        // Known problematic chipsets/hardware (lowercase)
+        private val PROBLEMATIC_CHIPSETS = listOf(
+            "mt6762",   // MediaTek Helio P22 with PowerVR GE8320
+            "mt6765",   // MediaTek Helio P35 with PowerVR GE8320
+            "mt8768",   // MediaTek tablet chip
+            "mp0873",   // MediaTek variant
+            "msm8974",  // Snapdragon 800/801 with Adreno 330
+            "msm8226",  // Snapdragon 400 with Adreno 305
+            "msm8926",  // Snapdragon 400 with Adreno 305
+            "apq8084",  // Snapdragon 805 (some issues)
+        )
+        
+        // Known problematic device models (lowercase)
+        private val PROBLEMATIC_MODELS = listOf(
+            "sm-t220",      // Samsung Tab A7 Lite
+            "sm-t225",      // Samsung Tab A7 Lite LTE
+            "hammerhead",   // Nexus 5 (Adreno 330)
+        )
+    }
+
+    /**
+     * Override Flutter shell args to disable Impeller on problematic devices.
+     * This is called before the Flutter engine starts.
+     */
+    override fun getFlutterShellArgs(): FlutterShellArgs {
+        val args = super.getFlutterShellArgs()
+        
+        if (shouldDisableImpeller()) {
+            // Log for debugging
+            android.util.Log.i("SpotiFLAC", "Legacy/problematic GPU detected: Disabling Impeller for ${Build.MODEL}")
+            android.util.Log.i("SpotiFLAC", "Device: ${Build.MANUFACTURER} ${Build.MODEL}, SDK: ${Build.VERSION.SDK_INT}")
+            android.util.Log.i("SpotiFLAC", "Hardware: ${Build.HARDWARE}, Board: ${Build.BOARD}")
+            
+            // Disable Impeller, forcing Skia renderer
+            args.add("--enable-impeller=false")
+        } else {
+            android.util.Log.i("SpotiFLAC", "Using Impeller renderer for ${Build.MODEL}")
+        }
+        
+        return args
+    }
+
+    /**
+     * Check if device should use Skia instead of Impeller.
+     * Returns true for devices with old/problematic GPUs or old Android versions.
+     */
+    private fun shouldDisableImpeller(): Boolean {
+        val hardware = Build.HARDWARE.lowercase(Locale.ROOT)
+        val board = Build.BOARD.lowercase(Locale.ROOT)
+        val model = Build.MODEL.lowercase(Locale.ROOT)
+        val device = Build.DEVICE.lowercase(Locale.ROOT)
+        
+        // 1. Check for explicitly problematic device models
+        for (problematicModel in PROBLEMATIC_MODELS) {
+            if (model.contains(problematicModel) || device.contains(problematicModel)) {
+                android.util.Log.i("SpotiFLAC", "Matched problematic model: $problematicModel")
+                return true
+            }
+        }
+        
+        // 2. Check for problematic chipsets
+        for (chipset in PROBLEMATIC_CHIPSETS) {
+            if (hardware.contains(chipset) || board.contains(chipset)) {
+                android.util.Log.i("SpotiFLAC", "Matched problematic chipset: $chipset")
+                return true
+            }
+        }
+        
+        // 3. For Android < 10 (API 29), be more aggressive about disabling Impeller
+        if (Build.VERSION.SDK_INT < SAFE_API_FOR_IMPELLER) {
+            // For older Android, check GPU renderer if available
+            val gpuRenderer = getGpuRenderer().lowercase(Locale.ROOT)
+            
+            // Check for known problematic GPUs
+            for (pattern in PROBLEMATIC_GPU_PATTERNS) {
+                if (gpuRenderer.contains(pattern)) {
+                    android.util.Log.i("SpotiFLAC", "Matched problematic GPU on old Android: $pattern")
+                    return true
+                }
+            }
+            
+            // For very old Android (< 8.0), always use Skia as Vulkan support is spotty
+            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) {
+                android.util.Log.i("SpotiFLAC", "Android < 8.0, using Skia for safety")
+                return true
+            }
+        }
+        
+        // 4. For Android 10+, still check for known problematic GPUs
+        val gpuRenderer = getGpuRenderer().lowercase(Locale.ROOT)
+        for (pattern in PROBLEMATIC_GPU_PATTERNS) {
+            if (gpuRenderer.contains(pattern)) {
+                android.util.Log.i("SpotiFLAC", "Matched problematic GPU: $pattern")
+                return true
+            }
+        }
+        
+        return false
+    }
+    
+    /**
+     * Try to get GPU renderer string.
+     * Note: This may return empty on some devices before OpenGL context is created.
+     */
+    private fun getGpuRenderer(): String {
+        return try {
+            // This might not work before GL context is created,
+            // but worth trying for additional detection
+            android.opengl.GLES20.glGetString(android.opengl.GLES20.GL_RENDERER) ?: ""
+        } catch (e: Exception) {
+            ""
+        }
+    }
+
     override fun onNewIntent(intent: Intent) {
         super.onNewIntent(intent)
         // Update the intent so receive_sharing_intent can access the new data
@@ -26,6 +158,7 @@ class MainActivity: FlutterActivity() {
 
     override fun configureFlutterEngine(flutterEngine: FlutterEngine) {
         super.configureFlutterEngine(flutterEngine)
+        GeneratedPluginRegistrant.registerWith(flutterEngine)
         
         MethodChannel(flutterEngine.dartExecutor.binaryMessenger, CHANNEL).setMethodCallHandler { call, result ->
             scope.launch {
@@ -117,6 +250,13 @@ class MainActivity: FlutterActivity() {
                             }
                             result.success(null)
                         }
+                        "cancelDownload" -> {
+                            val itemId = call.argument<String>("item_id") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.cancelDownload(itemId)
+                            }
+                            result.success(null)
+                        }
                         "setDownloadDirectory" -> {
                             val path = call.argument<String>("path") ?: ""
                             withContext(Dispatchers.IO) {
@@ -132,6 +272,28 @@ class MainActivity: FlutterActivity() {
                             }
                             result.success(response)
                         }
+                        "checkDuplicatesBatch" -> {
+                            val outputDir = call.argument<String>("output_dir") ?: ""
+                            val tracksJson = call.argument<String>("tracks") ?: "[]"
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.checkDuplicatesBatch(outputDir, tracksJson)
+                            }
+                            result.success(response)
+                        }
+                        "preBuildDuplicateIndex" -> {
+                            val outputDir = call.argument<String>("output_dir") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.preBuildDuplicateIndex(outputDir)
+                            }
+                            result.success(null)
+                        }
+                        "invalidateDuplicateIndex" -> {
+                            val outputDir = call.argument<String>("output_dir") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.invalidateDuplicateIndex(outputDir)
+                            }
+                            result.success(null)
+                        }
                         "buildFilename" -> {
                             val template = call.argument<String>("template") ?: ""
                             val metadata = call.argument<String>("metadata") ?: "{}"
@@ -151,8 +313,9 @@ class MainActivity: FlutterActivity() {
                             val spotifyId = call.argument<String>("spotify_id") ?: ""
                             val trackName = call.argument<String>("track_name") ?: ""
                             val artistName = call.argument<String>("artist_name") ?: ""
+                            val durationMs = call.argument<Int>("duration_ms")?.toLong() ?: 0L
                             val response = withContext(Dispatchers.IO) {
-                                Gobackend.fetchLyrics(spotifyId, trackName, artistName)
+                                Gobackend.fetchLyrics(spotifyId, trackName, artistName, durationMs)
                             }
                             result.success(response)
                         }
@@ -161,8 +324,9 @@ class MainActivity: FlutterActivity() {
                             val trackName = call.argument<String>("track_name") ?: ""
                             val artistName = call.argument<String>("artist_name") ?: ""
                             val filePath = call.argument<String>("file_path") ?: ""
+                            val durationMs = call.argument<Int>("duration_ms")?.toLong() ?: 0L
                             val response = withContext(Dispatchers.IO) {
-                                Gobackend.getLyricsLRC(spotifyId, trackName, artistName, filePath)
+                                Gobackend.getLyricsLRC(spotifyId, trackName, artistName, filePath, durationMs)
                             }
                             result.success(response)
                         }
@@ -218,6 +382,12 @@ class MainActivity: FlutterActivity() {
                             }
                             result.success(null)
                         }
+                        "hasSpotifyCredentials" -> {
+                            val hasCredentials = withContext(Dispatchers.IO) {
+                                Gobackend.checkSpotifyCredentials()
+                            }
+                            result.success(hasCredentials)
+                        }
                         "preWarmTrackCache" -> {
                             val tracksJson = call.argument<String>("tracks") ?: "[]"
                             withContext(Dispatchers.IO) {
@@ -241,9 +411,10 @@ class MainActivity: FlutterActivity() {
                         "searchDeezerAll" -> {
                             val query = call.argument<String>("query") ?: ""
                             val trackLimit = call.argument<Int>("track_limit") ?: 15
-                            val artistLimit = call.argument<Int>("artist_limit") ?: 3
+                            val artistLimit = call.argument<Int>("artist_limit") ?: 2
+                            val filter = call.argument<String>("filter") ?: ""
                             val response = withContext(Dispatchers.IO) {
-                                Gobackend.searchDeezerAll(query, trackLimit.toLong(), artistLimit.toLong())
+                                Gobackend.searchDeezerAll(query, trackLimit.toLong(), artistLimit.toLong(), filter)
                             }
                             result.success(response)
                         }
@@ -269,6 +440,13 @@ class MainActivity: FlutterActivity() {
                             }
                             result.success(response)
                         }
+                        "getDeezerExtendedMetadata" -> {
+                            val trackId = call.argument<String>("track_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getDeezerExtendedMetadata(trackId)
+                            }
+                            result.success(response)
+                        }
                         "convertSpotifyToDeezer" -> {
                             val resourceType = call.argument<String>("resource_type") ?: ""
                             val spotifyId = call.argument<String>("spotify_id") ?: ""
@@ -284,6 +462,43 @@ class MainActivity: FlutterActivity() {
                             }
                             result.success(response)
                         }
+                        "checkAvailabilityFromDeezerID" -> {
+                            val deezerTrackId = call.argument<String>("deezer_track_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.checkAvailabilityFromDeezerID(deezerTrackId)
+                            }
+                            result.success(response)
+                        }
+                        "checkAvailabilityByPlatformID" -> {
+                            val platform = call.argument<String>("platform") ?: ""
+                            val entityType = call.argument<String>("entity_type") ?: ""
+                            val entityId = call.argument<String>("entity_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.checkAvailabilityByPlatformID(platform, entityType, entityId)
+                            }
+                            result.success(response)
+                        }
+                        "getSpotifyIDFromDeezerTrack" -> {
+                            val deezerTrackId = call.argument<String>("deezer_track_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getSpotifyIDFromDeezerTrack(deezerTrackId)
+                            }
+                            result.success(response)
+                        }
+                        "getTidalURLFromDeezerTrack" -> {
+                            val deezerTrackId = call.argument<String>("deezer_track_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getTidalURLFromDeezerTrack(deezerTrackId)
+                            }
+                            result.success(response)
+                        }
+                        "getAmazonURLFromDeezerTrack" -> {
+                            val deezerTrackId = call.argument<String>("deezer_track_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getAmazonURLFromDeezerTrack(deezerTrackId)
+                            }
+                            result.success(response)
+                        }
                         // Log methods
                         "getLogs" -> {
                             val response = withContext(Dispatchers.IO) {
@@ -317,6 +532,368 @@ class MainActivity: FlutterActivity() {
                             }
                             result.success(null)
                         }
+                        // Extension System methods
+                        "initExtensionSystem" -> {
+                            val extensionsDir = call.argument<String>("extensions_dir") ?: ""
+                            val dataDir = call.argument<String>("data_dir") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.initExtensionSystem(extensionsDir, dataDir)
+                            }
+                            result.success(null)
+                        }
+                        "loadExtensionsFromDir" -> {
+                            val dirPath = call.argument<String>("dir_path") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.loadExtensionsFromDir(dirPath)
+                            }
+                            result.success(response)
+                        }
+                        "loadExtensionFromPath" -> {
+                            val filePath = call.argument<String>("file_path") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.loadExtensionFromPath(filePath)
+                            }
+                            result.success(response)
+                        }
+                        "unloadExtension" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.unloadExtensionByID(extensionId)
+                            }
+                            result.success(null)
+                        }
+                        "removeExtension" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.removeExtensionByID(extensionId)
+                            }
+                            result.success(null)
+                        }
+                        "upgradeExtension" -> {
+                            val filePath = call.argument<String>("file_path") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.upgradeExtensionFromPath(filePath)
+                            }
+                            result.success(response)
+                        }
+                        "checkExtensionUpgrade" -> {
+                            val filePath = call.argument<String>("file_path") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.checkExtensionUpgradeFromPath(filePath)
+                            }
+                            result.success(response)
+                        }
+                        "getInstalledExtensions" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getInstalledExtensions()
+                            }
+                            result.success(response)
+                        }
+                        "setExtensionEnabled" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val enabled = call.argument<Boolean>("enabled") ?: false
+                            withContext(Dispatchers.IO) {
+                                Gobackend.setExtensionEnabledByID(extensionId, enabled)
+                            }
+                            result.success(null)
+                        }
+                        "setProviderPriority" -> {
+                            val priorityJson = call.argument<String>("priority") ?: "[]"
+                            withContext(Dispatchers.IO) {
+                                Gobackend.setProviderPriorityJSON(priorityJson)
+                            }
+                            result.success(null)
+                        }
+                        "getProviderPriority" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getProviderPriorityJSON()
+                            }
+                            result.success(response)
+                        }
+                        "setMetadataProviderPriority" -> {
+                            val priorityJson = call.argument<String>("priority") ?: "[]"
+                            withContext(Dispatchers.IO) {
+                                Gobackend.setMetadataProviderPriorityJSON(priorityJson)
+                            }
+                            result.success(null)
+                        }
+                        "getMetadataProviderPriority" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getMetadataProviderPriorityJSON()
+                            }
+                            result.success(response)
+                        }
+                        "getExtensionSettings" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getExtensionSettingsJSON(extensionId)
+                            }
+                            result.success(response)
+                        }
+                        "setExtensionSettings" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val settingsJson = call.argument<String>("settings") ?: "{}"
+                            withContext(Dispatchers.IO) {
+                                Gobackend.setExtensionSettingsJSON(extensionId, settingsJson)
+                            }
+                            result.success(null)
+                        }
+                        "invokeExtensionAction" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val actionName = call.argument<String>("action") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.invokeExtensionActionJSON(extensionId, actionName)
+                            }
+                            result.success(response)
+                        }
+                        "searchTracksWithExtensions" -> {
+                            val query = call.argument<String>("query") ?: ""
+                            val limit = call.argument<Int>("limit") ?: 20
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.searchTracksWithExtensionsJSON(query, limit.toLong())
+                            }
+                            result.success(response)
+                        }
+                        "downloadWithExtensions" -> {
+                            val requestJson = call.arguments as String
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.downloadWithExtensionsJSON(requestJson)
+                            }
+                            result.success(response)
+                        }
+                        "enrichTrackWithExtension" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val trackJson = call.argument<String>("track") ?: "{}"
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.enrichTrackWithExtensionJSON(extensionId, trackJson)
+                            }
+                            result.success(response)
+                        }
+                        "removeExtension" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.removeExtensionByID(extensionId)
+                            }
+                            result.success(null)
+                        }
+                        "cleanupExtensions" -> {
+                            withContext(Dispatchers.IO) {
+                                Gobackend.cleanupExtensions()
+                            }
+                            result.success(null)
+                        }
+                        // Extension Auth API methods
+                        "getExtensionPendingAuth" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getExtensionPendingAuthJSON(extensionId)
+                            }
+                            if (response.isNullOrEmpty()) {
+                                result.success(null)
+                            } else {
+                                result.success(response)
+                            }
+                        }
+                        "setExtensionAuthCode" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val authCode = call.argument<String>("auth_code") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.setExtensionAuthCodeByID(extensionId, authCode)
+                            }
+                            result.success(null)
+                        }
+                        "setExtensionTokens" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val accessToken = call.argument<String>("access_token") ?: ""
+                            val refreshToken = call.argument<String>("refresh_token") ?: ""
+                            val expiresIn = call.argument<Int>("expires_in") ?: 0
+                            withContext(Dispatchers.IO) {
+                                Gobackend.setExtensionTokensByID(extensionId, accessToken, refreshToken, expiresIn.toLong())
+                            }
+                            result.success(null)
+                        }
+                        "clearExtensionPendingAuth" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.clearExtensionPendingAuthByID(extensionId)
+                            }
+                            result.success(null)
+                        }
+                        "isExtensionAuthenticated" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val isAuth = withContext(Dispatchers.IO) {
+                                Gobackend.isExtensionAuthenticatedByID(extensionId)
+                            }
+                            result.success(isAuth)
+                        }
+                        "getAllPendingAuthRequests" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getAllPendingAuthRequestsJSON()
+                            }
+                            result.success(response)
+                        }
+                        // Extension FFmpeg API
+                        "getPendingFFmpegCommand" -> {
+                            val commandId = call.argument<String>("command_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getPendingFFmpegCommandJSON(commandId)
+                            }
+                            if (response.isNullOrEmpty()) {
+                                result.success(null)
+                            } else {
+                                result.success(response)
+                            }
+                        }
+                        "setFFmpegCommandResult" -> {
+                            val commandId = call.argument<String>("command_id") ?: ""
+                            val success = call.argument<Boolean>("success") ?: false
+                            val output = call.argument<String>("output") ?: ""
+                            val error = call.argument<String>("error") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.setFFmpegCommandResultByID(commandId, success, output, error)
+                            }
+                            result.success(null)
+                        }
+                        "getAllPendingFFmpegCommands" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getAllPendingFFmpegCommandsJSON()
+                            }
+                            result.success(response)
+                        }
+                        // Extension Custom Search API
+                        "customSearchWithExtension" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val query = call.argument<String>("query") ?: ""
+                            val optionsJson = call.argument<String>("options") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.customSearchWithExtensionJSON(extensionId, query, optionsJson)
+                            }
+                            result.success(response)
+                        }
+                        "getSearchProviders" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getSearchProvidersJSON()
+                            }
+                            result.success(response)
+                        }
+                        // Extension URL Handler API
+                        "handleURLWithExtension" -> {
+                            val url = call.argument<String>("url") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.handleURLWithExtensionJSON(url)
+                            }
+                            result.success(response)
+                        }
+                        "findURLHandler" -> {
+                            val url = call.argument<String>("url") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.findURLHandlerJSON(url)
+                            }
+                            result.success(response)
+                        }
+                        "getURLHandlers" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getURLHandlersJSON()
+                            }
+                            result.success(response)
+                        }
+                        "getAlbumWithExtension" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val albumId = call.argument<String>("album_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getAlbumWithExtensionJSON(extensionId, albumId)
+                            }
+                            result.success(response)
+                        }
+                        "getPlaylistWithExtension" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val playlistId = call.argument<String>("playlist_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getPlaylistWithExtensionJSON(extensionId, playlistId)
+                            }
+                            result.success(response)
+                        }
+                        "getArtistWithExtension" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val artistId = call.argument<String>("artist_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getArtistWithExtensionJSON(extensionId, artistId)
+                            }
+                            result.success(response)
+                        }
+                        // Extension Post-Processing API
+                        "runPostProcessing" -> {
+                            val filePath = call.argument<String>("file_path") ?: ""
+                            val metadataJson = call.argument<String>("metadata") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.runPostProcessingJSON(filePath, metadataJson)
+                            }
+                            result.success(response)
+                        }
+                        "getPostProcessingProviders" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getPostProcessingProvidersJSON()
+                            }
+                            result.success(response)
+                        }
+                        // Extension Store
+                        "initExtensionStore" -> {
+                            val cacheDir = call.argument<String>("cache_dir") ?: ""
+                            withContext(Dispatchers.IO) {
+                                Gobackend.initExtensionStoreJSON(cacheDir)
+                            }
+                            result.success(null)
+                        }
+                        "getStoreExtensions" -> {
+                            val forceRefresh = call.argument<Boolean>("force_refresh") ?: false
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getStoreExtensionsJSON(forceRefresh)
+                            }
+                            result.success(response)
+                        }
+                        "searchStoreExtensions" -> {
+                            val query = call.argument<String>("query") ?: ""
+                            val category = call.argument<String>("category") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.searchStoreExtensionsJSON(query, category)
+                            }
+                            result.success(response)
+                        }
+                        "getStoreCategories" -> {
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getStoreCategoriesJSON()
+                            }
+                            result.success(response)
+                        }
+                        "downloadStoreExtension" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val destDir = call.argument<String>("dest_dir") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.downloadStoreExtensionJSON(extensionId, destDir)
+                            }
+                            result.success(response)
+                        }
+                        "clearStoreCache" -> {
+                            withContext(Dispatchers.IO) {
+                                Gobackend.clearStoreCacheJSON()
+                            }
+                            result.success(null)
+                        }
+                        // Extension Home Feed (Explore)
+                        "getExtensionHomeFeed" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getExtensionHomeFeedJSON(extensionId)
+                            }
+                            result.success(response)
+                        }
+                        "getExtensionBrowseCategories" -> {
+                            val extensionId = call.argument<String>("extension_id") ?: ""
+                            val response = withContext(Dispatchers.IO) {
+                                Gobackend.getExtensionBrowseCategoriesJSON(extensionId)
+                            }
+                            result.success(response)
+                        }
                         else -> result.notImplemented()
                     }
                 } catch (e: Exception) {
@@ -324,37 +901,5 @@ class MainActivity: FlutterActivity() {
                 }
             }
         }
-        
-        // FFmpeg method channel
-        MethodChannel(flutterEngine.dartExecutor.binaryMessenger, FFMPEG_CHANNEL).setMethodCallHandler { call, result ->
-            scope.launch {
-                try {
-                    when (call.method) {
-                        "execute" -> {
-                            val command = call.argument<String>("command") ?: ""
-                            val session = withContext(Dispatchers.IO) {
-                                FFmpegKit.execute(command)
-                            }
-                            val returnCode = session.returnCode
-                            val output = session.output ?: ""
-                            result.success(mapOf(
-                                "success" to ReturnCode.isSuccess(returnCode),
-                                "returnCode" to (returnCode?.value ?: -1),
-                                "output" to output
-                            ))
-                        }
-                        "getVersion" -> {
-                            val session = withContext(Dispatchers.IO) {
-                                FFmpegKit.execute("-version")
-                            }
-                            result.success(session.output ?: "unknown")
-                        }
-                        else -> result.notImplemented()
-                    }
-                } catch (e: Exception) {
-                    result.error("FFMPEG_ERROR", e.message, null)
-                }
-            }
-        }
     }
 }

build_assets/ffmpeg_service_ios.dart

@@ -1,208 +0,0 @@
-import 'dart:io';
-import 'package:ffmpeg_kit_flutter_new_audio/ffmpeg_kit.dart';
-import 'package:ffmpeg_kit_flutter_new_audio/return_code.dart';
-import 'package:spotiflac_android/utils/logger.dart';
-
-final _log = AppLogger('FFmpeg');
-
-/// FFmpeg service for iOS using ffmpeg_kit_flutter plugin
-class FFmpegServiceIOS {
-  /// Execute FFmpeg command and return result
-  static Future<FFmpegResultIOS> _execute(String command) async {
-    try {
-      final session = await FFmpegKit.execute(command);
-      final returnCode = await session.getReturnCode();
-      final output = await session.getOutput() ?? '';
-      return FFmpegResultIOS(
-        success: ReturnCode.isSuccess(returnCode),
-        returnCode: returnCode?.getValue() ?? -1,
-        output: output,
-      );
-    } catch (e) {
-      _log.e('FFmpeg execute error: $e');
-      return FFmpegResultIOS(success: false, returnCode: -1, output: e.toString());
-    }
-  }
-
-  /// Convert M4A (DASH segments) to FLAC
-  static Future<String?> convertM4aToFlac(String inputPath) async {
-    final outputPath = inputPath.replaceAll('.m4a', '.flac');
-    final command = '-i "$inputPath" -c:a flac -compression_level 8 "$outputPath" -y';
-    final result = await _execute(command);
-
-    if (result.success) {
-      try {
-        await File(inputPath).delete();
-      } catch (_) {}
-      return outputPath;
-    }
-
-    _log.e('M4A to FLAC conversion failed: ${result.output}');
-    return null;
-  }
-
-  /// Convert FLAC to MP3
-  static Future<String?> convertFlacToMp3(String inputPath, {String bitrate = '320k'}) async {
-    final dir = File(inputPath).parent.path;
-    final baseName = inputPath.split(Platform.pathSeparator).last.replaceAll('.flac', '');
-    final outputDir = '$dir${Platform.pathSeparator}MP3';
-    await Directory(outputDir).create(recursive: true);
-    final outputPath = '$outputDir${Platform.pathSeparator}$baseName.mp3';
-
-    final command = '-i "$inputPath" -codec:a libmp3lame -b:a $bitrate -map 0:a -map_metadata 0 -id3v2_version 3 "$outputPath" -y';
-    final result = await _execute(command);
-
-    if (result.success) return outputPath;
-    _log.e('FLAC to MP3 conversion failed: ${result.output}');
-    return null;
-  }
-
-  /// Convert FLAC to M4A
-  static Future<String?> convertFlacToM4a(String inputPath, {String codec = 'aac', String bitrate = '256k'}) async {
-    final dir = File(inputPath).parent.path;
-    final baseName = inputPath.split(Platform.pathSeparator).last.replaceAll('.flac', '');
-    final outputDir = '$dir${Platform.pathSeparator}M4A';
-    await Directory(outputDir).create(recursive: true);
-    final outputPath = '$outputDir${Platform.pathSeparator}$baseName.m4a';
-
-    String command;
-    if (codec == 'alac') {
-      command = '-i "$inputPath" -codec:a alac -map 0:a -map_metadata 0 "$outputPath" -y';
-    } else {
-      command = '-i "$inputPath" -codec:a aac -b:a $bitrate -map 0:a -map_metadata 0 "$outputPath" -y';
-    }
-
-    final result = await _execute(command);
-    if (result.success) return outputPath;
-    _log.e('FLAC to M4A conversion failed: ${result.output}');
-    return null;
-  }
-
-  /// Embed cover art to FLAC file
-  static Future<String?> embedCover(String flacPath, String coverPath) async {
-    final tempOutput = '$flacPath.tmp';
-    final command = '-i "$flacPath" -i "$coverPath" -map 0:a -map 1:0 -c copy -metadata:s:v title="Album cover" -metadata:s:v comment="Cover (front)" -disposition:v attached_pic "$tempOutput" -y';
-
-    final result = await _execute(command);
-
-    if (result.success) {
-      try {
-        await File(flacPath).delete();
-        await File(tempOutput).rename(flacPath);
-        return flacPath;
-      } catch (e) {
-        _log.e('Failed to replace file after cover embed: $e');
-        return null;
-      }
-    }
-
-    try {
-      final tempFile = File(tempOutput);
-      if (await tempFile.exists()) await tempFile.delete();
-    } catch (_) {}
-
-    _log.e('Cover embed failed: ${result.output}');
-    return null;
-  }
-
-  /// Embed metadata and cover art to FLAC file
-  /// Returns the file path on success, null on failure
-  static Future<String?> embedMetadata({
-    required String flacPath,
-    String? coverPath,
-    Map<String, String>? metadata,
-  }) async {
-    final tempOutput = '$flacPath.tmp';
-    
-    // Construct command
-    final StringBuffer cmdBuffer = StringBuffer();
-    cmdBuffer.write('-i "$flacPath" ');
-    
-    // Add cover input if available
-    if (coverPath != null) {
-      cmdBuffer.write('-i "$coverPath" ');
-    }
-    
-    // Map audio stream
-    cmdBuffer.write('-map 0:a ');
-    
-    // Map cover stream if available
-    if (coverPath != null) {
-      cmdBuffer.write('-map 1:0 ');
-      cmdBuffer.write('-c:v copy ');
-      cmdBuffer.write('-disposition:v attached_pic ');
-      cmdBuffer.write('-metadata:s:v title="Album cover" ');
-      cmdBuffer.write('-metadata:s:v comment="Cover (front)" ');
-    }
-    
-    // Copy audio codec (don't re-encode)
-    cmdBuffer.write('-c:a copy ');
-    
-    // Add text metadata
-    if (metadata != null) {
-      metadata.forEach((key, value) {
-        // Sanitize value: escape double quotes
-        final sanitizedValue = value.replaceAll('"', '\\"');
-        cmdBuffer.write('-metadata $key="$sanitizedValue" ');
-      });
-    }
-    
-    cmdBuffer.write('"$tempOutput" -y');
-    
-    final command = cmdBuffer.toString();
-    _log.d('Executing FFmpeg command: $command');
-
-    final result = await _execute(command);
-
-    if (result.success) {
-      try {
-        await File(flacPath).delete();
-        await File(tempOutput).rename(flacPath);
-        return flacPath;
-      } catch (e) {
-        _log.e('Failed to replace file after metadata embed: $e');
-        return null;
-      }
-    }
-
-    // Clean up temp file if exists
-    try {
-      final tempFile = File(tempOutput);
-      if (await tempFile.exists()) {
-        await tempFile.delete();
-      }
-    } catch (_) {}
-
-    _log.e('Metadata/Cover embed failed: ${result.output}');
-    return null;
-  }
-
-  /// Check if FFmpeg is available
-  static Future<bool> isAvailable() async {
-    try {
-      final session = await FFmpegKit.execute('-version');
-      final returnCode = await session.getReturnCode();
-      return ReturnCode.isSuccess(returnCode);
-    } catch (e) {
-      return false;
-    }
-  }
-
-  /// Get FFmpeg version info
-  static Future<String?> getVersion() async {
-    try {
-      final session = await FFmpegKit.execute('-version');
-      return await session.getOutput();
-    } catch (e) {
-      return null;
-    }
-  }
-}
-
-class FFmpegResultIOS {
-  final bool success;
-  final int returnCode;
-  final String output;
-
-  FFmpegResultIOS({required this.success, required this.returnCode, required this.output});
-}

crowdin.yml

@@ -0,0 +1,19 @@
+files:
+  - source: /lib/l10n/arb/app_en.arb
+    translation: /lib/l10n/arb/app_%locale%.arb
+    languages_mapping:
+      locale:
+        # Short codes for single-variant languages
+        de: de
+        es: es
+        fr: fr
+        hi: hi
+        id: id
+        ja: ja
+        ko: ko
+        nl: nl
+        pt: pt
+        ru: ru
+        # Full codes for Chinese variants
+        zh-CN: zh_CN
+        zh-TW: zh_TW

go_backend/amazon.go

@@ -2,100 +2,40 @@ package gobackend
 
 import (
 	"bufio"
-	"encoding/base64"
+	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
 	"os"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"sync"
 	"time"
 )
 
-// AmazonDownloader handles Amazon Music downloads using DoubleDouble service (same as PC)
 type AmazonDownloader struct {
-	client           *http.Client
-	regions          []string  // us, eu regions for DoubleDouble service
-	lastAPICallTime  time.Time // Rate limiting: track last API call
-	apiCallCount     int       // Rate limiting: counter per minute
-	apiCallResetTime time.Time // Rate limiting: reset time
+	client *http.Client
 }
 
 var (
-	// Global Amazon downloader instance for connection reuse
 	globalAmazonDownloader *AmazonDownloader
 	amazonDownloaderOnce   sync.Once
-	amazonRateLimitMu      sync.Mutex // Mutex for rate limiting
 )
 
-// DoubleDoubleSubmitResponse is the response from DoubleDouble submit endpoint
-type DoubleDoubleSubmitResponse struct {
-	Success bool   `json:"success"`
-	ID      string `json:"id"`
+// AfkarXYZResponse is the response from AfkarXYZ API
+type AfkarXYZResponse struct {
+	Success bool `json:"success"`
+	Data    struct {
+		DirectLink string `json:"direct_link"`
+		FileName   string `json:"file_name"`
+		FileSize   int64  `json:"file_size"`
+	} `json:"data"`
 }
 
-// DoubleDoubleStatusResponse is the response from DoubleDouble status endpoint
-type DoubleDoubleStatusResponse struct {
-	Status         string `json:"status"`
-	FriendlyStatus string `json:"friendlyStatus"`
-	URL            string `json:"url"`
-	Current        struct {
-		Name   string `json:"name"`
-		Artist string `json:"artist"`
-	} `json:"current"`
-}
-
-// amazonArtistsMatch checks if the artist names are similar enough
-func amazonArtistsMatch(expectedArtist, foundArtist string) bool {
-	normExpected := strings.ToLower(strings.TrimSpace(expectedArtist))
-	normFound := strings.ToLower(strings.TrimSpace(foundArtist))
-
-	// Exact match
-	if normExpected == normFound {
-		return true
-	}
-
-	// Check if one contains the other
-	if strings.Contains(normExpected, normFound) || strings.Contains(normFound, normExpected) {
-		return true
-	}
-
-	// Check first artist (before comma or feat)
-	expectedFirst := strings.Split(normExpected, ",")[0]
-	expectedFirst = strings.Split(expectedFirst, " feat")[0]
-	expectedFirst = strings.Split(expectedFirst, " ft.")[0]
-	expectedFirst = strings.TrimSpace(expectedFirst)
-
-	foundFirst := strings.Split(normFound, ",")[0]
-	foundFirst = strings.Split(foundFirst, " feat")[0]
-	foundFirst = strings.Split(foundFirst, " ft.")[0]
-	foundFirst = strings.TrimSpace(foundFirst)
-
-	if expectedFirst == foundFirst {
-		return true
-	}
-
-	// Check if first artist is contained in the other
-	if strings.Contains(expectedFirst, foundFirst) || strings.Contains(foundFirst, expectedFirst) {
-		return true
-	}
-
-	// If scripts are different (one is ASCII, one is non-ASCII like Japanese/Chinese/Korean),
-	// assume they're the same artist with different transliteration
-	expectedASCII := amazonIsASCIIString(expectedArtist)
-	foundASCII := amazonIsASCIIString(foundArtist)
-	if expectedASCII != foundASCII {
-		GoLog("[Amazon] Artist names in different scripts, assuming match: '%s' vs '%s'\n", expectedArtist, foundArtist)
-		return true
-	}
-
-	return false
-}
-
-// amazonIsASCIIString checks if a string contains only ASCII characters
 func amazonIsASCIIString(s string) bool {
 	for _, r := range s {
 		if r > 127 {
@@ -105,254 +45,84 @@ func amazonIsASCIIString(s string) bool {
 	return true
 }
 
-// NewAmazonDownloader creates a new Amazon downloader (returns singleton for connection reuse)
 func NewAmazonDownloader() *AmazonDownloader {
 	amazonDownloaderOnce.Do(func() {
 		globalAmazonDownloader = &AmazonDownloader{
-			client:           NewHTTPClientWithTimeout(120 * time.Second), // 120s timeout like PC
-			regions:          []string{"us", "eu"},                        // Same regions as PC
-			apiCallResetTime: time.Now(),
+			client: NewHTTPClientWithTimeout(120 * time.Second),
 		}
 	})
 	return globalAmazonDownloader
 }
 
-// waitForRateLimit implements rate limiting similar to PC version
-// Max 9 requests per minute with 7 second delay between requests
-func (a *AmazonDownloader) waitForRateLimit() {
-	amazonRateLimitMu.Lock()
-	defer amazonRateLimitMu.Unlock()
+// downloadFromAfkarXYZ downloads a track using AfkarXYZ API
+// Returns: downloadURL, fileName, error
+func (a *AmazonDownloader) downloadFromAfkarXYZ(amazonURL string) (string, string, error) {
+	// AfkarXYZ API endpoint
+	apiURL := "https://amazon.afkarxyz.fun/convert?url=" + url.QueryEscape(amazonURL)
 
-	now := time.Now()
+	GoLog("[Amazon] Fetching from AfkarXYZ API...\n")
 
-	// Reset counter every minute
-	if now.Sub(a.apiCallResetTime) >= time.Minute {
-		a.apiCallCount = 0
-		a.apiCallResetTime = now
+	req, err := http.NewRequest("GET", apiURL, nil)
+	if err != nil {
+		return "", "", fmt.Errorf("failed to create request: %w", err)
 	}
 
-	// If we've hit the limit (9 requests per minute), wait until next minute
-	if a.apiCallCount >= 9 {
-		waitTime := time.Minute - now.Sub(a.apiCallResetTime)
-		if waitTime > 0 {
-			GoLog("[Amazon] Rate limit reached, waiting %v...\n", waitTime.Round(time.Second))
-			time.Sleep(waitTime)
-			a.apiCallCount = 0
-			a.apiCallResetTime = time.Now()
-		}
+	req.Header.Set("User-Agent", getRandomUserAgent())
+
+	resp, err := a.client.Do(req)
+	if err != nil {
+		return "", "", fmt.Errorf("failed to call AfkarXYZ API: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != 200 {
+		return "", "", fmt.Errorf("AfkarXYZ API returned status %d", resp.StatusCode)
 	}
 
-	// Add delay between requests (7 seconds like PC version)
-	if !a.lastAPICallTime.IsZero() {
-		timeSinceLastCall := now.Sub(a.lastAPICallTime)
-		minDelay := 7 * time.Second
-		if timeSinceLastCall < minDelay {
-			waitTime := minDelay - timeSinceLastCall
-			GoLog("[Amazon] Rate limiting: waiting %v...\n", waitTime.Round(time.Second))
-			time.Sleep(waitTime)
-		}
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", "", fmt.Errorf("failed to read response: %w", err)
 	}
 
-	// Update tracking
-	a.lastAPICallTime = time.Now()
-	a.apiCallCount++
+	var apiResp AfkarXYZResponse
+	if err := json.Unmarshal(body, &apiResp); err != nil {
+		return "", "", fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	if !apiResp.Success || apiResp.Data.DirectLink == "" {
+		return "", "", fmt.Errorf("AfkarXYZ API failed or no download link found")
+	}
+
+	fileName := apiResp.Data.FileName
+	if fileName == "" {
+		fileName = "track.flac"
+	}
+
+	// Sanitize filename
+	reg := regexp.MustCompile(`[<>:"/\\|?*]`)
+	fileName = reg.ReplaceAllString(fileName, "")
+
+	GoLog("[Amazon] AfkarXYZ returned: %s (%.2f MB)\n", fileName, float64(apiResp.Data.FileSize)/(1024*1024))
+
+	return apiResp.Data.DirectLink, fileName, nil
 }
 
-// GetAvailableAPIs returns list of available DoubleDouble regions
-// Uses same service as PC version (doubledouble.top)
-func (a *AmazonDownloader) GetAvailableAPIs() []string {
-	// DoubleDouble service regions (same as PC)
-	// Format: https://{region}.doubledouble.top
-	var apis []string
-	for _, region := range a.regions {
-		apis = append(apis, fmt.Sprintf("https://%s.doubledouble.top", region))
-	}
-	return apis
-}
-
-// downloadFromDoubleDoubleService downloads a track using DoubleDouble service (same as PC)
-// This uses submit → poll → download mechanism
-// Internal function - not exported to gomobile
-func (a *AmazonDownloader) downloadFromDoubleDoubleService(amazonURL, outputDir string) (string, string, string, error) {
-	var lastError error
-
-	for _, region := range a.regions {
-		GoLog("[Amazon] Trying region: %s...\n", region)
-
-		// Build base URL for DoubleDouble service
-		// Decode base64 service URL (same as PC)
-		serviceBase, _ := base64.StdEncoding.DecodeString("aHR0cHM6Ly8=")               // https://
-		serviceDomain, _ := base64.StdEncoding.DecodeString("LmRvdWJsZWRvdWJsZS50b3A=") // .doubledouble.top
-		baseURL := fmt.Sprintf("%s%s%s", string(serviceBase), region, string(serviceDomain))
-
-		// Step 1: Submit download request with rate limiting
-		encodedURL := url.QueryEscape(amazonURL)
-		submitURL := fmt.Sprintf("%s/dl?url=%s", baseURL, encodedURL)
-
-		// Apply rate limiting before request (like PC version)
-		a.waitForRateLimit()
-
-		req, err := http.NewRequest("GET", submitURL, nil)
-		if err != nil {
-			lastError = fmt.Errorf("failed to create request: %w", err)
-			continue
-		}
-
-		req.Header.Set("User-Agent", getRandomUserAgent())
-
-		fmt.Println("[Amazon] Submitting download request...")
-
-		// Retry logic for 429 errors (like PC version: 3 retries with 15s wait)
-		var resp *http.Response
-		maxRetries := 3
-		for retry := 0; retry < maxRetries; retry++ {
-			resp, err = a.client.Do(req)
-			if err != nil {
-				lastError = fmt.Errorf("failed to submit request: %w", err)
-				break
-			}
-
-			if resp.StatusCode == 429 { // Too Many Requests
-				resp.Body.Close()
-				if retry < maxRetries-1 {
-					waitTime := 15 * time.Second
-					GoLog("[Amazon] Rate limited (429), waiting %v before retry %d/%d...\n", waitTime, retry+2, maxRetries)
-					time.Sleep(waitTime)
-					continue
-				}
-				lastError = fmt.Errorf("API rate limit exceeded after %d retries", maxRetries)
-				break
-			}
-
-			if resp.StatusCode != 200 {
-				resp.Body.Close()
-				lastError = fmt.Errorf("submit failed with status %d", resp.StatusCode)
-				break
-			}
-
-			// Success - break retry loop
-			break
-		}
-
-		if err != nil || lastError != nil {
-			if resp != nil {
-				resp.Body.Close()
-			}
-			continue
-		}
-
-		var submitResp DoubleDoubleSubmitResponse
-		if err := json.NewDecoder(resp.Body).Decode(&submitResp); err != nil {
-			resp.Body.Close()
-			lastError = fmt.Errorf("failed to decode submit response: %w", err)
-			continue
-		}
-		resp.Body.Close()
-
-		if !submitResp.Success || submitResp.ID == "" {
-			lastError = fmt.Errorf("submit request failed")
-			continue
-		}
-
-		downloadID := submitResp.ID
-		GoLog("[Amazon] Download ID: %s\n", downloadID)
-
-		// Step 2: Poll for completion
-		statusURL := fmt.Sprintf("%s/dl/%s", baseURL, downloadID)
-		fmt.Println("[Amazon] Waiting for download to complete...")
-
-		maxWait := 300 * time.Second // 5 minutes max wait
-		elapsed := time.Duration(0)
-		pollInterval := 3 * time.Second
-
-		for elapsed < maxWait {
-			time.Sleep(pollInterval)
-			elapsed += pollInterval
-
-			statusReq, err := http.NewRequest("GET", statusURL, nil)
-			if err != nil {
-				continue
-			}
-
-			statusReq.Header.Set("User-Agent", getRandomUserAgent())
-
-			statusResp, err := a.client.Do(statusReq)
-			if err != nil {
-				fmt.Printf("\r[Amazon] Status check failed, retrying...")
-				continue
-			}
-
-			if statusResp.StatusCode != 200 {
-				statusResp.Body.Close()
-				fmt.Printf("\r[Amazon] Status check failed (status %d), retrying...", statusResp.StatusCode)
-				continue
-			}
-
-			var status DoubleDoubleStatusResponse
-			if err := json.NewDecoder(statusResp.Body).Decode(&status); err != nil {
-				statusResp.Body.Close()
-				fmt.Printf("\r[Amazon] Invalid JSON response, retrying...")
-				continue
-			}
-			statusResp.Body.Close()
-
-			if status.Status == "done" {
-				fmt.Println("\n[Amazon] Download ready!")
-
-				// Build download URL
-				fileURL := status.URL
-				if strings.HasPrefix(fileURL, "./") {
-					fileURL = fmt.Sprintf("%s/%s", baseURL, fileURL[2:])
-				} else if strings.HasPrefix(fileURL, "/") {
-					fileURL = fmt.Sprintf("%s%s", baseURL, fileURL)
-				}
-
-				trackName := status.Current.Name
-				artist := status.Current.Artist
-
-				GoLog("[Amazon] Downloading: %s - %s\n", artist, trackName)
-				return fileURL, trackName, artist, nil
-
-			} else if status.Status == "error" {
-				errorMsg := status.FriendlyStatus
-				if errorMsg == "" {
-					errorMsg = "Unknown error"
-				}
-				lastError = fmt.Errorf("processing failed: %s", errorMsg)
-				break
-			} else {
-				// Still processing
-				friendlyStatus := status.FriendlyStatus
-				if friendlyStatus == "" {
-					friendlyStatus = status.Status
-				}
-				fmt.Printf("\r[Amazon] %s...", friendlyStatus)
-			}
-		}
-
-		if elapsed >= maxWait {
-			lastError = fmt.Errorf("download timeout")
-			fmt.Printf("\n[Amazon] Error with %s region: %v\n", region, lastError)
-			continue
-		}
-
-		if lastError != nil {
-			fmt.Printf("\n[Amazon] Error with %s region: %v\n", region, lastError)
-		}
-	}
-
-	return "", "", "", fmt.Errorf("all regions failed. Last error: %v", lastError)
-}
-
-// DownloadFile downloads a file from URL with User-Agent and progress tracking
 func (a *AmazonDownloader) DownloadFile(downloadURL, outputPath, itemID string) error {
+	ctx := context.Background()
+
 	// Initialize item progress (required for all downloads)
 	if itemID != "" {
 		StartItemProgress(itemID)
 		defer CompleteItemProgress(itemID)
+		ctx = initDownloadCancel(itemID)
+		defer clearDownloadCancel(itemID)
 	}
 
-	req, err := http.NewRequest("GET", downloadURL, nil)
+	if isDownloadCancelled(itemID) {
+		return ErrDownloadCancelled
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "GET", downloadURL, nil)
 	if err != nil {
 		return fmt.Errorf("failed to create request: %w", err)
 	}
@@ -361,6 +131,9 @@ func (a *AmazonDownloader) DownloadFile(downloadURL, outputPath, itemID string)
 
 	resp, err := a.client.Do(req)
 	if err != nil {
+		if isDownloadCancelled(itemID) {
+			return ErrDownloadCancelled
+		}
 		return err
 	}
 	defer resp.Body.Close()
@@ -370,7 +143,6 @@ func (a *AmazonDownloader) DownloadFile(downloadURL, outputPath, itemID string)
 	}
 
 	expectedSize := resp.ContentLength
-	// Set total bytes if available
 	if expectedSize > 0 && itemID != "" {
 		SetItemBytesTotal(itemID, expectedSize)
 	}
@@ -380,16 +152,13 @@ func (a *AmazonDownloader) DownloadFile(downloadURL, outputPath, itemID string)
 		return err
 	}
 
-	// Use buffered writer for better performance (256KB buffer)
 	bufWriter := bufio.NewWriterSize(out, 256*1024)
 
-	// Use item progress writer with buffered output
 	var written int64
 	if itemID != "" {
 		pw := NewItemProgressWriter(bufWriter, itemID)
 		written, err = io.Copy(pw, resp.Body)
 	} else {
-		// Fallback: direct copy without progress tracking
 		written, err = io.Copy(bufWriter, resp.Body)
 	}
 
@@ -397,9 +166,11 @@ func (a *AmazonDownloader) DownloadFile(downloadURL, outputPath, itemID string)
 	flushErr := bufWriter.Flush()
 	closeErr := out.Close()
 
-	// Check for any errors
 	if err != nil {
 		os.Remove(outputPath)
+		if isDownloadCancelled(itemID) {
+			return ErrDownloadCancelled
+		}
 		return fmt.Errorf("download interrupted: %w", err)
 	}
 	if flushErr != nil {
@@ -417,7 +188,7 @@ func (a *AmazonDownloader) DownloadFile(downloadURL, outputPath, itemID string)
 		return fmt.Errorf("incomplete download: expected %d bytes, got %d bytes", expectedSize, written)
 	}
 
-	fmt.Printf("\r[Amazon] Downloaded: %.2f MB (Complete)\n", float64(written)/(1024*1024))
+	GoLog("[Amazon] Downloaded: %.2f MB (Complete)\n", float64(written)/(1024*1024))
 	return nil
 }
 
@@ -435,29 +206,22 @@ type AmazonDownloadResult struct {
 	ISRC        string
 }
 
-// downloadFromAmazon downloads a track using the request parameters
-// Uses DoubleDouble service (same as PC version)
+// downloadFromAmazon uses AfkarXYZ API to download from Amazon Music
 func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 	downloader := NewAmazonDownloader()
 
-	// Check for existing file first
 	if existingFile, exists := checkISRCExistsInternal(req.OutputDir, req.ISRC); exists {
 		return AmazonDownloadResult{FilePath: "EXISTS:" + existingFile}, nil
 	}
 
-	// Get Amazon URL from SongLink
 	songlink := NewSongLinkClient()
 	var availability *TrackAvailability
 	var err error
 
-	// Check if SpotifyID is actually a Deezer ID (format: "deezer:xxxxx")
-	if strings.HasPrefix(req.SpotifyID, "deezer:") {
-		// Extract Deezer ID and use Deezer-based lookup
-		deezerID := strings.TrimPrefix(req.SpotifyID, "deezer:")
+	if deezerID, found := strings.CutPrefix(req.SpotifyID, "deezer:"); found {
 		GoLog("[Amazon] Using Deezer ID for SongLink lookup: %s\n", deezerID)
 		availability, err = songlink.CheckAvailabilityFromDeezer(deezerID)
 	} else if req.SpotifyID != "" {
-		// Use Spotify ID
 		availability, err = songlink.CheckTrackAvailability(req.SpotifyID, req.ISRC)
 	} else {
 		return AmazonDownloadResult{}, fmt.Errorf("no valid Spotify or Deezer ID provided for Amazon lookup")
@@ -471,30 +235,21 @@ func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 		return AmazonDownloadResult{}, fmt.Errorf("track not available on Amazon Music (SongLink returned no Amazon URL)")
 	}
 
-	// Create output directory if needed
 	if req.OutputDir != "." {
 		if err := os.MkdirAll(req.OutputDir, 0755); err != nil {
 			return AmazonDownloadResult{}, fmt.Errorf("failed to create output directory: %w", err)
 		}
 	}
 
-	// Download using DoubleDouble service (same as PC)
-	downloadURL, trackName, artistName, err := downloader.downloadFromDoubleDoubleService(availability.AmazonURL, req.OutputDir)
+	// Download using AfkarXYZ API
+	downloadURL, _, err := downloader.downloadFromAfkarXYZ(availability.AmazonURL)
 	if err != nil {
-		return AmazonDownloadResult{}, fmt.Errorf("failed to get download URL: %w", err)
+		return AmazonDownloadResult{}, fmt.Errorf("failed to get download URL from AfkarXYZ: %w", err)
 	}
 
-	// Verify artist matches
-	if artistName != "" && !amazonArtistsMatch(req.ArtistName, artistName) {
-		GoLog("[Amazon] Artist mismatch: expected '%s', got '%s'. Rejecting.\n", req.ArtistName, artistName)
-		return AmazonDownloadResult{}, fmt.Errorf("artist mismatch: expected '%s', got '%s'", req.ArtistName, artistName)
-	}
+	GoLog("[Amazon] Match found: '%s' by '%s'\n", req.TrackName, req.ArtistName)
 
-	// Log match found
-	GoLog("[Amazon] Match found: '%s' by '%s'\n", trackName, artistName)
-
-	// Build filename using Spotify metadata (more accurate)
-	filename := buildFilenameFromTemplate(req.FilenameFormat, map[string]interface{}{
+	filename := buildFilenameFromTemplate(req.FilenameFormat, map[string]any{
 		"title":  req.TrackName,
 		"artist": req.ArtistName,
 		"album":  req.AlbumName,
@@ -505,7 +260,6 @@ func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 	filename = sanitizeFilename(filename) + ".flac"
 	outputPath := filepath.Join(req.OutputDir, filename)
 
-	// Check if file already exists
 	if fileInfo, statErr := os.Stat(outputPath); statErr == nil && fileInfo.Size() > 0 {
 		return AmazonDownloadResult{FilePath: "EXISTS:" + outputPath}, nil
 	}
@@ -522,37 +276,31 @@ func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 			req.TrackName,
 			req.ArtistName,
 			req.EmbedLyrics,
+			int64(req.DurationMS),
 		)
 	}()
 
 	// Download audio file with item ID for progress tracking
 	if err := downloader.DownloadFile(downloadURL, outputPath, req.ItemID); err != nil {
+		if errors.Is(err, ErrDownloadCancelled) {
+			return AmazonDownloadResult{}, ErrDownloadCancelled
+		}
 		return AmazonDownloadResult{}, fmt.Errorf("download failed: %w", err)
 	}
 
 	// Wait for parallel operations to complete
 	<-parallelDone
 
-	// Set progress to 100% and status to finalizing (before embedding)
-	// This makes the UI show "Finalizing..." while embedding happens
 	if req.ItemID != "" {
 		SetItemProgress(req.ItemID, 1.0, 0, 0)
 		SetItemFinalizing(req.ItemID)
 	}
 
-	// Log track info from DoubleDouble (for debugging)
-	if trackName != "" && artistName != "" {
-		GoLog("[Amazon] DoubleDouble returned: %s - %s\n", artistName, trackName)
-	}
-
-	// Read existing metadata from downloaded file BEFORE embedding
-	// Amazon/DoubleDouble files often have correct track/disc numbers that we should preserve
 	existingMeta, metaErr := ReadMetadata(outputPath)
 	actualTrackNum := req.TrackNumber
 	actualDiscNum := req.DiscNumber
 
 	if metaErr == nil && existingMeta != nil {
-		// Use file metadata if it has valid track/disc numbers and request doesn't have them
 		if existingMeta.TrackNumber > 0 && (req.TrackNumber == 0 || req.TrackNumber == 1) {
 			actualTrackNum = existingMeta.TrackNumber
 			GoLog("[Amazon] Using track number from file: %d (request had: %d)\n", actualTrackNum, req.TrackNumber)
@@ -563,8 +311,7 @@ func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 		}
 	}
 
-	// Embed metadata using Spotify data (more accurate than DoubleDouble)
-	// But preserve track/disc numbers from file if they were better
+	// Embed metadata using Spotify data
 	metadata := Metadata{
 		Title:       req.TrackName,
 		Artist:      req.ArtistName,
@@ -575,6 +322,9 @@ func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 		TotalTracks: req.TotalTracks,
 		DiscNumber:  actualDiscNum,
 		ISRC:        req.ISRC,
+		Genre:       req.Genre,
+		Label:       req.Label,
+		Copyright:   req.Copyright,
 	}
 
 	// Use cover data from parallel fetch
@@ -585,25 +335,38 @@ func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 	}
 
 	if err := EmbedMetadataWithCoverData(outputPath, metadata, coverData); err != nil {
-		fmt.Printf("Warning: failed to embed metadata: %v\n", err)
+		GoLog("[Amazon] Warning: failed to embed metadata: %v\n", err)
 	}
 
-	// Embed lyrics from parallel fetch
 	if req.EmbedLyrics && parallelResult != nil && parallelResult.LyricsLRC != "" {
-		GoLog("[Amazon] Embedding parallel-fetched lyrics (%d lines)...\n", len(parallelResult.LyricsData.Lines))
-		if embedErr := EmbedLyrics(outputPath, parallelResult.LyricsLRC); embedErr != nil {
-			GoLog("[Amazon] Warning: failed to embed lyrics: %v\n", embedErr)
-		} else {
-			fmt.Println("[Amazon] Lyrics embedded successfully")
+		lyricsMode := req.LyricsMode
+		if lyricsMode == "" {
+			lyricsMode = "embed" // default
+		}
+
+		if lyricsMode == "external" || lyricsMode == "both" {
+			GoLog("[Amazon] Saving external LRC file...\n")
+			if lrcPath, lrcErr := SaveLRCFile(outputPath, parallelResult.LyricsLRC); lrcErr != nil {
+				GoLog("[Amazon] Warning: failed to save LRC file: %v\n", lrcErr)
+			} else {
+				GoLog("[Amazon] LRC file saved: %s\n", lrcPath)
+			}
+		}
+
+		if lyricsMode == "embed" || lyricsMode == "both" {
+			GoLog("[Amazon] Embedding parallel-fetched lyrics (%d lines)...\n", len(parallelResult.LyricsData.Lines))
+			if embedErr := EmbedLyrics(outputPath, parallelResult.LyricsLRC); embedErr != nil {
+				GoLog("[Amazon] Warning: failed to embed lyrics: %v\n", embedErr)
+			} else {
+				GoLog("[Amazon] Lyrics embedded successfully\n")
+			}
 		}
 	} else if req.EmbedLyrics {
-		fmt.Println("[Amazon] No lyrics available from parallel fetch")
+		GoLog("[Amazon] No lyrics available from parallel fetch\n")
 	}
 
-	fmt.Println("[Amazon] ✓ Downloaded successfully from Amazon Music")
+	GoLog("[Amazon] Downloaded successfully from Amazon Music\n")
 
-	// Read actual quality from the downloaded FLAC file
-	// Amazon API doesn't provide quality info, but we can read it from the file itself
 	quality, err := GetAudioQuality(outputPath)
 	if err != nil {
 		GoLog("[Amazon] Warning: couldn't read quality from file: %v\n", err)
@@ -611,8 +374,6 @@ func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 		GoLog("[Amazon] Actual quality: %d-bit/%dHz\n", quality.BitDepth, quality.SampleRate)
 	}
 
-	// Read metadata from file AFTER embedding to get accurate values
-	// This ensures we return what's actually in the file
 	finalMeta, metaReadErr := ReadMetadata(outputPath)
 	if metaReadErr == nil && finalMeta != nil {
 		GoLog("[Amazon] Final metadata from file - Track: %d, Disc: %d, Date: %s\n",
@@ -620,7 +381,6 @@ func downloadFromAmazon(req DownloadRequest) (AmazonDownloadResult, error) {
 		actualTrackNum = finalMeta.TrackNumber
 		actualDiscNum = finalMeta.DiscNumber
 		if finalMeta.Date != "" {
-			// Use date from file if available
 			req.ReleaseDate = finalMeta.Date
 		}
 	}

go_backend/cancel.go

@@ -0,0 +1,78 @@
+package gobackend
+
+import (
+	"context"
+	"errors"
+	"sync"
+)
+
+// ErrDownloadCancelled is returned when a download is cancelled by the user.
+var ErrDownloadCancelled = errors.New("download cancelled")
+
+type cancelEntry struct {
+	cancel   context.CancelFunc
+	canceled bool
+}
+
+var (
+	cancelMu  sync.Mutex
+	cancelMap = make(map[string]*cancelEntry)
+)
+
+func initDownloadCancel(itemID string) context.Context {
+	if itemID == "" {
+		return context.Background()
+	}
+
+	cancelMu.Lock()
+	defer cancelMu.Unlock()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancelMap[itemID] = &cancelEntry{
+		cancel:   cancel,
+		canceled: false,
+	}
+	return ctx
+}
+
+func cancelDownload(itemID string) {
+	if itemID == "" {
+		return
+	}
+
+	cancelMu.Lock()
+	entry, ok := cancelMap[itemID]
+	if ok {
+		entry.canceled = true
+		if entry.cancel != nil {
+			entry.cancel()
+		}
+	} else {
+		cancelMap[itemID] = &cancelEntry{canceled: true}
+	}
+	cancelMu.Unlock()
+
+	RemoveItemProgress(itemID)
+}
+
+func isDownloadCancelled(itemID string) bool {
+	if itemID == "" {
+		return false
+	}
+
+	cancelMu.Lock()
+	entry, ok := cancelMap[itemID]
+	canceled := ok && entry.canceled
+	cancelMu.Unlock()
+	return canceled
+}
+
+func clearDownloadCancel(itemID string) {
+	if itemID == "" {
+		return
+	}
+
+	cancelMu.Lock()
+	delete(cancelMap, itemID)
+	cancelMu.Unlock()
+}

go_backend/cover.go

@@ -4,36 +4,53 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"regexp"
 	"strings"
 )
 
-// Spotify image size codes (same as PC version)
 const (
-	spotifySize640 = "ab67616d0000b273" // 640x640
-	spotifySizeMax = "ab67616d000082c1" // Max resolution (~2000x2000)
+	spotifySize300 = "ab67616d00001e02"
+	spotifySize640 = "ab67616d0000b273"
+	spotifySizeMax = "ab67616d000082c1"
 )
 
-// downloadCoverToMemory downloads cover art and returns as bytes (no file creation)
-// This avoids file permission issues on Android
+// Deezer CDN supports these sizes: 56, 250, 500, 1000, 1400, 1800
+var deezerSizeRegex = regexp.MustCompile(`/(\d+)x(\d+)-\d+-\d+-\d+-\d+\.jpg$`)
+
+func convertSmallToMedium(imageURL string) string {
+	if strings.Contains(imageURL, spotifySize300) {
+		return strings.Replace(imageURL, spotifySize300, spotifySize640, 1)
+	}
+	return imageURL
+}
+
 func downloadCoverToMemory(coverURL string, maxQuality bool) ([]byte, error) {
 	if coverURL == "" {
 		return nil, fmt.Errorf("no cover URL provided")
 	}
 
-	fmt.Printf("[Cover] Downloading cover from: %s\n", coverURL)
+	GoLog("[Cover] Original URL: %s", coverURL)
+
+	downloadURL := convertSmallToMedium(coverURL)
+	if downloadURL != coverURL {
+		GoLog("[Cover] Upgraded 300x300 → 640x640")
+	}
 
-	// Upgrade to max quality if requested
-	downloadURL := coverURL
 	if maxQuality {
-		downloadURL = upgradeToMaxQuality(coverURL)
-		if downloadURL != coverURL {
-			fmt.Printf("[Cover] Upgraded to max quality URL: %s\n", downloadURL)
+		maxURL := upgradeToMaxQuality(downloadURL)
+		if maxURL != downloadURL {
+			downloadURL = maxURL
+			// Log already printed by upgradeToMaxQuality for Deezer
+			if strings.Contains(coverURL, "scdn.co") || strings.Contains(coverURL, "spotifycdn") {
+				GoLog("[Cover] Spotify: upgraded to max resolution (~2000x2000)")
+			}
 		}
 	}
 
+	GoLog("[Cover] Final URL: %s", downloadURL)
+
 	client := NewHTTPClientWithTimeout(DefaultTimeout)
 
-	// Create request with User-Agent (required by Spotify CDN)
 	req, err := http.NewRequest("GET", downloadURL, nil)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create request: %w", err)
@@ -54,48 +71,58 @@ func downloadCoverToMemory(coverURL string, maxQuality bool) ([]byte, error) {
 		return nil, fmt.Errorf("failed to read cover data: %w", err)
 	}
 
-	fmt.Printf("[Cover] Downloaded %d bytes\n", len(data))
+	sizeKB := len(data) / 1024
+	var resolution string
+	if sizeKB > 200 {
+		resolution = "~2000x2000 (hi-res)"
+	} else if sizeKB > 50 {
+		resolution = "~640x640"
+	} else {
+		resolution = "~300x300"
+	}
+	GoLog("[Cover] Downloaded %d KB (%s)", sizeKB, resolution)
+
 	return data, nil
 }
 
-// upgradeToMaxQuality upgrades Spotify cover URL to maximum quality
-// Uses same logic as PC version - replaces 640x640 size code with max resolution
 func upgradeToMaxQuality(coverURL string) string {
-	// Spotify image URLs can be upgraded by changing the size parameter
-	// Format: https://i.scdn.co/image/ab67616d0000b273...
-	// ab67616d0000b273 = 640x640
-	// ab67616d000082c1 = Max resolution (~2000x2000)
-
+	// Spotify CDN upgrade
 	if strings.Contains(coverURL, spotifySize640) {
-		// Try max resolution first
-		maxURL := strings.Replace(coverURL, spotifySize640, spotifySizeMax, 1)
+		return strings.Replace(coverURL, spotifySize640, spotifySizeMax, 1)
+	}
 
-		// Verify max resolution URL is available
-		client := NewHTTPClientWithTimeout(DefaultTimeout)
-		req, err := http.NewRequest("HEAD", maxURL, nil)
-		if err == nil {
-			resp, err := DoRequestWithUserAgent(client, req)
-			if err == nil {
-				resp.Body.Close()
-				if resp.StatusCode == http.StatusOK {
-					return maxURL
-				}
-			}
-		}
+	// Deezer CDN upgrade
+	if strings.Contains(coverURL, "cdn-images.dzcdn.net") {
+		return upgradeDeezerCover(coverURL)
 	}
 
 	return coverURL
 }
 
-// GetCoverFromSpotify gets cover URL from Spotify metadata
+func upgradeDeezerCover(coverURL string) string {
+	if !strings.Contains(coverURL, "cdn-images.dzcdn.net") {
+		return coverURL
+	}
+
+	// Replace any size pattern with 1800x1800
+	upgraded := deezerSizeRegex.ReplaceAllString(coverURL, "/1800x1800-000000-80-0-0.jpg")
+	if upgraded != coverURL {
+		GoLog("[Cover] Deezer: upgraded to 1800x1800")
+	}
+	return upgraded
+}
+
 func GetCoverFromSpotify(imageURL string, maxQuality bool) string {
 	if imageURL == "" {
 		return ""
 	}
 
+	// Always upgrade small to medium first
+	result := convertSmallToMedium(imageURL)
+
 	if maxQuality {
-		return upgradeToMaxQuality(imageURL)
+		result = upgradeToMaxQuality(result)
 	}
 
-	return imageURL
+	return result
 }

go_backend/deezer.go

@@ -22,27 +22,23 @@ const (
 
 	deezerCacheTTL = 10 * time.Minute
 
-	// Parallel ISRC fetching settings
-	deezerMaxParallelISRC = 10 // Max concurrent ISRC fetches
+	deezerMaxParallelISRC = 10
 )
 
-// DeezerClient handles Deezer API interactions (no auth required)
 type DeezerClient struct {
 	httpClient  *http.Client
 	searchCache map[string]*cacheEntry
 	albumCache  map[string]*cacheEntry
 	artistCache map[string]*cacheEntry
-	isrcCache   map[string]string // trackID -> ISRC cache
+	isrcCache   map[string]string
 	cacheMu     sync.RWMutex
 }
 
-// Singleton instance
 var (
 	deezerClient     *DeezerClient
 	deezerClientOnce sync.Once
 )
 
-// GetDeezerClient returns singleton Deezer client
 func GetDeezerClient() *DeezerClient {
 	deezerClientOnce.Do(func() {
 		deezerClient = &DeezerClient{
@@ -56,7 +52,6 @@ func GetDeezerClient() *DeezerClient {
 	return deezerClient
 }
 
-// Deezer API response types
 type deezerTrack struct {
 	ID            int64             `json:"id"`
 	Title         string            `json:"title"`
@@ -65,7 +60,7 @@ type deezerTrack struct {
 	DiskNumber    int               `json:"disk_number"`
 	ISRC          string            `json:"isrc"`
 	Link          string            `json:"link"`
-	ReleaseDate   string            `json:"release_date"` // Sometimes at track level
+	ReleaseDate   string            `json:"release_date"`
 	Artist        deezerArtist      `json:"artist"`
 	Album         deezerAlbumSimple `json:"album"`
 	Contributors  []deezerArtist    `json:"contributors"`
@@ -88,12 +83,10 @@ type deezerAlbumSimple struct {
 	CoverMedium string `json:"cover_medium"`
 	CoverBig    string `json:"cover_big"`
 	CoverXL     string `json:"cover_xl"`
-	ReleaseDate string `json:"release_date"` // Sometimes at album level
+	ReleaseDate string `json:"release_date"`
+	RecordType  string `json:"record_type"`
 }
 
-// ... (skip other structs as they are fine/unchanged) ...
-
-// ... (in convertTrack) ...
 func (c *DeezerClient) convertTrack(track deezerTrack) TrackMetadata {
 	artistName := track.Artist.Name
 	if len(track.Contributors) > 0 {
@@ -115,7 +108,6 @@ func (c *DeezerClient) convertTrack(track deezerTrack) TrackMetadata {
 		albumImage = track.Album.Cover
 	}
 
-	// Try to find release date
 	releaseDate := track.ReleaseDate
 	if releaseDate == "" {
 		releaseDate = track.Album.ReleaseDate
@@ -137,15 +129,25 @@ func (c *DeezerClient) convertTrack(track deezerTrack) TrackMetadata {
 	}
 }
 
+type deezerGenre struct {
+	ID   int    `json:"id"`
+	Name string `json:"name"`
+}
+
 type deezerAlbumFull struct {
-	ID           int64          `json:"id"`
-	Title        string         `json:"title"`
-	Cover        string         `json:"cover"`
-	CoverMedium  string         `json:"cover_medium"`
-	CoverBig     string         `json:"cover_big"`
-	CoverXL      string         `json:"cover_xl"`
-	ReleaseDate  string         `json:"release_date"`
-	NbTracks     int            `json:"nb_tracks"`
+	ID          int64  `json:"id"`
+	Title       string `json:"title"`
+	Cover       string `json:"cover"`
+	CoverMedium string `json:"cover_medium"`
+	CoverBig    string `json:"cover_big"`
+	CoverXL     string `json:"cover_xl"`
+	ReleaseDate string `json:"release_date"`
+	NbTracks    int    `json:"nb_tracks"`
+	RecordType  string `json:"record_type"`
+	Label       string `json:"label"`
+	Genres      struct {
+		Data []deezerGenre `json:"data"`
+	} `json:"genres"`
 	Artist       deezerArtist   `json:"artist"`
 	Contributors []deezerArtist `json:"contributors"`
 	Tracks       struct {
@@ -180,12 +182,41 @@ type deezerPlaylistFull struct {
 	} `json:"tracks"`
 }
 
-// SearchAll searches for tracks and artists on Deezer
 // NOTE: ISRC is NOT fetched during search for performance - use GetTrackISRC when needed for download
-func (c *DeezerClient) SearchAll(ctx context.Context, query string, trackLimit, artistLimit int) (*SearchAllResult, error) {
-	GoLog("[Deezer] SearchAll: query=%q, trackLimit=%d, artistLimit=%d\n", query, trackLimit, artistLimit)
+// filter can be: "" (all), "track", "artist", "album", "playlist"
+func (c *DeezerClient) SearchAll(ctx context.Context, query string, trackLimit, artistLimit int, filter string) (*SearchAllResult, error) {
+	GoLog("[Deezer] SearchAll: query=%q, trackLimit=%d, artistLimit=%d, filter=%q\n", query, trackLimit, artistLimit, filter)
 
-	cacheKey := fmt.Sprintf("deezer:all:%s:%d:%d", query, trackLimit, artistLimit)
+	albumLimit := 5 // Same as artistLimit for consistency
+	playlistLimit := 5
+
+	// When filter is specified, increase limits for that type only
+	if filter != "" {
+		switch filter {
+		case "track":
+			trackLimit = 50
+			artistLimit = 0
+			albumLimit = 0
+			playlistLimit = 0
+		case "artist":
+			trackLimit = 0
+			artistLimit = 20
+			albumLimit = 0
+			playlistLimit = 0
+		case "album":
+			trackLimit = 0
+			artistLimit = 0
+			albumLimit = 20
+			playlistLimit = 0
+		case "playlist":
+			trackLimit = 0
+			artistLimit = 0
+			albumLimit = 0
+			playlistLimit = 20
+		}
+	}
+
+	cacheKey := fmt.Sprintf("deezer:all:%s:%d:%d:%d:%d:%s", query, trackLimit, artistLimit, albumLimit, playlistLimit, filter)
 
 	c.cacheMu.RLock()
 	if entry, ok := c.searchCache[cacheKey]; ok && !entry.isExpired() {
@@ -196,73 +227,194 @@ func (c *DeezerClient) SearchAll(ctx context.Context, query string, trackLimit,
 	c.cacheMu.RUnlock()
 
 	result := &SearchAllResult{
-		Tracks:  make([]TrackMetadata, 0),
-		Artists: make([]SearchArtistResult, 0),
+		Tracks:    make([]TrackMetadata, 0, trackLimit),
+		Artists:   make([]SearchArtistResult, 0, artistLimit),
+		Albums:    make([]SearchAlbumResult, 0, albumLimit),
+		Playlists: make([]SearchPlaylistResult, 0, playlistLimit),
 	}
 
 	// Search tracks - NO ISRC fetch for performance
-	trackURL := fmt.Sprintf("%s/track?q=%s&limit=%d", deezerSearchURL, url.QueryEscape(query), trackLimit)
-	GoLog("[Deezer] Fetching tracks from: %s\n", trackURL)
+	if trackLimit > 0 {
+		trackURL := fmt.Sprintf("%s/track?q=%s&limit=%d", deezerSearchURL, url.QueryEscape(query), trackLimit)
+		GoLog("[Deezer] Fetching tracks from: %s\n", trackURL)
 
-	var trackResp struct {
-		Data  []deezerTrack `json:"data"`
-		Error *struct {
-			Type    string `json:"type"`
-			Message string `json:"message"`
-			Code    int    `json:"code"`
-		} `json:"error"`
-	}
-	if err := c.getJSON(ctx, trackURL, &trackResp); err != nil {
-		GoLog("[Deezer] Track search failed: %v\n", err)
-		return nil, fmt.Errorf("deezer track search failed: %w", err)
-	}
+		var trackResp struct {
+			Data  []deezerTrack `json:"data"`
+			Error *struct {
+				Type    string `json:"type"`
+				Message string `json:"message"`
+				Code    int    `json:"code"`
+			} `json:"error"`
+		}
+		if err := c.getJSON(ctx, trackURL, &trackResp); err != nil {
+			GoLog("[Deezer] Track search failed: %v\n", err)
+			return nil, fmt.Errorf("deezer track search failed: %w", err)
+		}
 
-	if trackResp.Error != nil {
-		GoLog("[Deezer] API error: type=%s, code=%d, message=%s\n", trackResp.Error.Type, trackResp.Error.Code, trackResp.Error.Message)
-		return nil, fmt.Errorf("deezer API error: %s (code %d)", trackResp.Error.Message, trackResp.Error.Code)
-	}
+		if trackResp.Error != nil {
+			GoLog("[Deezer] API error: type=%s, code=%d, message=%s\n", trackResp.Error.Type, trackResp.Error.Code, trackResp.Error.Message)
+			return nil, fmt.Errorf("deezer API error: %s (code %d)", trackResp.Error.Message, trackResp.Error.Code)
+		}
 
-	GoLog("[Deezer] Got %d tracks from API\n", len(trackResp.Data))
+		GoLog("[Deezer] Got %d tracks from API\n", len(trackResp.Data))
 
-	for _, track := range trackResp.Data {
-		// Convert directly without fetching ISRC - much faster
-		result.Tracks = append(result.Tracks, c.convertTrack(track))
+		for _, track := range trackResp.Data {
+			result.Tracks = append(result.Tracks, c.convertTrack(track))
+		}
 	}
 
 	// Search artists
-	artistURL := fmt.Sprintf("%s/artist?q=%s&limit=%d", deezerSearchURL, url.QueryEscape(query), artistLimit)
-	GoLog("[Deezer] Fetching artists from: %s\n", artistURL)
+	if artistLimit > 0 {
+		artistURL := fmt.Sprintf("%s/artist?q=%s&limit=%d", deezerSearchURL, url.QueryEscape(query), artistLimit)
+		GoLog("[Deezer] Fetching artists from: %s\n", artistURL)
 
-	var artistResp struct {
-		Data  []deezerArtist `json:"data"`
-		Error *struct {
-			Type    string `json:"type"`
-			Message string `json:"message"`
-			Code    int    `json:"code"`
-		} `json:"error"`
-	}
-	if err := c.getJSON(ctx, artistURL, &artistResp); err == nil {
-		if artistResp.Error != nil {
-			GoLog("[Deezer] Artist API error: type=%s, code=%d, message=%s\n", artistResp.Error.Type, artistResp.Error.Code, artistResp.Error.Message)
-		} else {
-			GoLog("[Deezer] Got %d artists from API\n", len(artistResp.Data))
-			for _, artist := range artistResp.Data {
-				result.Artists = append(result.Artists, SearchArtistResult{
-					ID:         fmt.Sprintf("deezer:%d", artist.ID),
-					Name:       artist.Name,
-					Images:     c.getBestArtistImage(artist),
-					Followers:  artist.NbFan,
-					Popularity: 0,
-				})
-			}
+		var artistResp struct {
+			Data  []deezerArtist `json:"data"`
+			Error *struct {
+				Type    string `json:"type"`
+				Message string `json:"message"`
+				Code    int    `json:"code"`
+			} `json:"error"`
+		}
+		if err := c.getJSON(ctx, artistURL, &artistResp); err == nil {
+			if artistResp.Error != nil {
+				GoLog("[Deezer] Artist API error: type=%s, code=%d, message=%s\n", artistResp.Error.Type, artistResp.Error.Code, artistResp.Error.Message)
+			} else {
+				GoLog("[Deezer] Got %d artists from API\n", len(artistResp.Data))
+				for _, artist := range artistResp.Data {
+					result.Artists = append(result.Artists, SearchArtistResult{
+						ID:         fmt.Sprintf("deezer:%d", artist.ID),
+						Name:       artist.Name,
+						Images:     c.getBestArtistImage(artist),
+						Followers:  artist.NbFan,
+						Popularity: 0,
+					})
+				}
+			}
+		} else {
+			GoLog("[Deezer] Artist search failed: %v\n", err)
 		}
-	} else {
-		GoLog("[Deezer] Artist search failed: %v\n", err)
 	}
 
-	GoLog("[Deezer] SearchAll complete: %d tracks, %d artists\n", len(result.Tracks), len(result.Artists))
+	// Search albums
+	if albumLimit > 0 {
+		albumURL := fmt.Sprintf("%s/album?q=%s&limit=%d", deezerSearchURL, url.QueryEscape(query), albumLimit)
+		GoLog("[Deezer] Fetching albums from: %s\n", albumURL)
+
+		var albumResp struct {
+			Data []struct {
+				ID          int64        `json:"id"`
+				Title       string       `json:"title"`
+				Cover       string       `json:"cover"`
+				CoverMedium string       `json:"cover_medium"`
+				CoverBig    string       `json:"cover_big"`
+				CoverXL     string       `json:"cover_xl"`
+				NbTracks    int          `json:"nb_tracks"`
+				ReleaseDate string       `json:"release_date"`
+				RecordType  string       `json:"record_type"`
+				Artist      deezerArtist `json:"artist"`
+			} `json:"data"`
+			Error *struct {
+				Type    string `json:"type"`
+				Message string `json:"message"`
+				Code    int    `json:"code"`
+			} `json:"error"`
+		}
+		if err := c.getJSON(ctx, albumURL, &albumResp); err == nil {
+			if albumResp.Error != nil {
+				GoLog("[Deezer] Album API error: type=%s, code=%d, message=%s\n", albumResp.Error.Type, albumResp.Error.Code, albumResp.Error.Message)
+			} else {
+				GoLog("[Deezer] Got %d albums from API\n", len(albumResp.Data))
+				for _, album := range albumResp.Data {
+					coverURL := album.CoverXL
+					if coverURL == "" {
+						coverURL = album.CoverBig
+					}
+					if coverURL == "" {
+						coverURL = album.CoverMedium
+					}
+					if coverURL == "" {
+						coverURL = album.Cover
+					}
+
+					albumType := album.RecordType
+					if albumType == "compile" {
+						albumType = "compilation"
+					}
+
+					result.Albums = append(result.Albums, SearchAlbumResult{
+						ID:          fmt.Sprintf("deezer:%d", album.ID),
+						Name:        album.Title,
+						Artists:     album.Artist.Name,
+						Images:      coverURL,
+						ReleaseDate: album.ReleaseDate,
+						TotalTracks: album.NbTracks,
+						AlbumType:   albumType,
+					})
+				}
+			}
+		} else {
+			GoLog("[Deezer] Album search failed: %v\n", err)
+		}
+	}
+
+	// Search playlists
+	if playlistLimit > 0 {
+		playlistURL := fmt.Sprintf("%s/playlist?q=%s&limit=%d", deezerSearchURL, url.QueryEscape(query), playlistLimit)
+		GoLog("[Deezer] Fetching playlists from: %s\n", playlistURL)
+
+		var playlistResp struct {
+			Data []struct {
+				ID            int64  `json:"id"`
+				Title         string `json:"title"`
+				Picture       string `json:"picture"`
+				PictureMedium string `json:"picture_medium"`
+				PictureBig    string `json:"picture_big"`
+				PictureXL     string `json:"picture_xl"`
+				NbTracks      int    `json:"nb_tracks"`
+				User          struct {
+					Name string `json:"name"`
+				} `json:"user"`
+			} `json:"data"`
+			Error *struct {
+				Type    string `json:"type"`
+				Message string `json:"message"`
+				Code    int    `json:"code"`
+			} `json:"error"`
+		}
+		if err := c.getJSON(ctx, playlistURL, &playlistResp); err == nil {
+			if playlistResp.Error != nil {
+				GoLog("[Deezer] Playlist API error: type=%s, code=%d, message=%s\n", playlistResp.Error.Type, playlistResp.Error.Code, playlistResp.Error.Message)
+			} else {
+				GoLog("[Deezer] Got %d playlists from API\n", len(playlistResp.Data))
+				for _, playlist := range playlistResp.Data {
+					pictureURL := playlist.PictureXL
+					if pictureURL == "" {
+						pictureURL = playlist.PictureBig
+					}
+					if pictureURL == "" {
+						pictureURL = playlist.PictureMedium
+					}
+					if pictureURL == "" {
+						pictureURL = playlist.Picture
+					}
+
+					result.Playlists = append(result.Playlists, SearchPlaylistResult{
+						ID:          fmt.Sprintf("deezer:%d", playlist.ID),
+						Name:        playlist.Title,
+						Owner:       playlist.User.Name,
+						Images:      pictureURL,
+						TotalTracks: playlist.NbTracks,
+					})
+				}
+			}
+		} else {
+			GoLog("[Deezer] Playlist search failed: %v\n", err)
+		}
+	}
+
+	GoLog("[Deezer] SearchAll complete: %d tracks, %d artists, %d albums, %d playlists\n", len(result.Tracks), len(result.Artists), len(result.Albums), len(result.Playlists))
 
-	// Cache result
 	c.cacheMu.Lock()
 	c.searchCache[cacheKey] = &cacheEntry{
 		data:      result,
@@ -287,7 +439,6 @@ func (c *DeezerClient) GetTrack(ctx context.Context, trackID string) (*TrackResp
 	}, nil
 }
 
-// GetAlbum fetches album with tracks
 // ISRC is fetched in parallel for better performance
 func (c *DeezerClient) GetAlbum(ctx context.Context, albumID string) (*AlbumResponsePayload, error) {
 	c.cacheMu.RLock()
@@ -314,22 +465,80 @@ func (c *DeezerClient) GetAlbum(ctx context.Context, albumID string) (*AlbumResp
 		artistName = strings.Join(names, ", ")
 	}
 
+	// Extract genres as comma-separated string
+	var genres []string
+	for _, g := range album.Genres.Data {
+		if g.Name != "" {
+			genres = append(genres, g.Name)
+		}
+	}
+	genreStr := strings.Join(genres, ", ")
+
 	info := AlbumInfoMetadata{
 		TotalTracks: album.NbTracks,
 		Name:        album.Title,
 		ReleaseDate: album.ReleaseDate,
 		Artists:     artistName,
+		ArtistId:    fmt.Sprintf("deezer:%d", album.Artist.ID),
 		Images:      albumImage,
+		Genre:       genreStr,    // From Deezer album
+		Label:       album.Label, // From Deezer album
 	}
 
-	// Fetch ISRCs in parallel
-	isrcMap := c.fetchISRCsParallel(ctx, album.Tracks.Data)
+	// Fetch all tracks with pagination (Deezer default limit is 25)
+	allTracks := album.Tracks.Data
 
-	tracks := make([]AlbumTrackMetadata, 0, len(album.Tracks.Data))
-	for _, track := range album.Tracks.Data {
+	// If album has more tracks than returned, fetch remaining pages
+	if album.NbTracks > len(allTracks) {
+		GoLog("[Deezer] Album has %d tracks but only got %d, fetching remaining...", album.NbTracks, len(allTracks))
+
+		tracksURL := fmt.Sprintf("%s/tracks?limit=100&index=%d", fmt.Sprintf(deezerAlbumURL, albumID), len(allTracks))
+
+		for len(allTracks) < album.NbTracks {
+			var tracksResp struct {
+				Data []deezerTrack `json:"data"`
+				Next string        `json:"next"`
+			}
+
+			if err := c.getJSON(ctx, tracksURL, &tracksResp); err != nil {
+				GoLog("[Deezer] Warning: failed to fetch album tracks page: %v", err)
+				break
+			}
+
+			if len(tracksResp.Data) == 0 {
+				break
+			}
+
+			allTracks = append(allTracks, tracksResp.Data...)
+
+			if tracksResp.Next == "" {
+				break
+			}
+			tracksURL = tracksResp.Next
+		}
+
+		GoLog("[Deezer] Fetched total %d tracks for album", len(allTracks))
+	}
+
+	isrcMap := c.fetchISRCsParallel(ctx, allTracks)
+
+	tracks := make([]AlbumTrackMetadata, 0, len(allTracks))
+	// Normalize record_type (Deezer uses "compile" instead of "compilation")
+	albumType := album.RecordType
+	if albumType == "compile" {
+		albumType = "compilation"
+	}
+
+	for i, track := range allTracks {
 		trackIDStr := fmt.Sprintf("%d", track.ID)
 		isrc := isrcMap[trackIDStr]
 
+		// Use track position from API, fallback to index+1 if not provided
+		trackNum := track.TrackPosition
+		if trackNum == 0 {
+			trackNum = i + 1
+		}
+
 		tracks = append(tracks, AlbumTrackMetadata{
 			SpotifyID:   fmt.Sprintf("deezer:%d", track.ID),
 			Artists:     track.Artist.Name,
@@ -339,12 +548,13 @@ func (c *DeezerClient) GetAlbum(ctx context.Context, albumID string) (*AlbumResp
 			DurationMS:  track.Duration * 1000,
 			Images:      albumImage,
 			ReleaseDate: album.ReleaseDate,
-			TrackNumber: track.TrackPosition,
+			TrackNumber: trackNum,
 			TotalTracks: album.NbTracks,
 			DiscNumber:  track.DiskNumber,
 			ExternalURL: track.Link,
 			ISRC:        isrc,
 			AlbumID:     fmt.Sprintf("deezer:%d", album.ID),
+			AlbumType:   albumType,
 		})
 	}
 
@@ -363,7 +573,6 @@ func (c *DeezerClient) GetAlbum(ctx context.Context, albumID string) (*AlbumResp
 	return result, nil
 }
 
-// GetArtist fetches artist with albums
 func (c *DeezerClient) GetArtist(ctx context.Context, artistID string) (*ArtistResponsePayload, error) {
 	c.cacheMu.RLock()
 	if entry, ok := c.artistCache[artistID]; ok && !entry.isExpired() {
@@ -449,8 +658,6 @@ func (c *DeezerClient) GetArtist(ctx context.Context, artistID string) (*ArtistR
 	return result, nil
 }
 
-// GetPlaylist fetches playlist with tracks
-// ISRC is fetched in parallel for better performance
 func (c *DeezerClient) GetPlaylist(ctx context.Context, playlistID string) (*PlaylistResponsePayload, error) {
 	playlistURL := fmt.Sprintf(deezerPlaylistURL, playlistID)
 
@@ -473,11 +680,45 @@ func (c *DeezerClient) GetPlaylist(ctx context.Context, playlistID string) (*Pla
 	info.Owner.Name = playlist.Title
 	info.Owner.Images = playlistImage
 
-	// Fetch ISRCs in parallel
-	isrcMap := c.fetchISRCsParallel(ctx, playlist.Tracks.Data)
+	// Fetch all tracks with pagination (Deezer default limit is 25)
+	allTracks := playlist.Tracks.Data
 
-	tracks := make([]AlbumTrackMetadata, 0, len(playlist.Tracks.Data))
-	for _, track := range playlist.Tracks.Data {
+	// If playlist has more tracks than returned, fetch remaining pages
+	if playlist.NbTracks > len(allTracks) {
+		GoLog("[Deezer] Playlist has %d tracks but only got %d, fetching remaining...", playlist.NbTracks, len(allTracks))
+
+		tracksURL := fmt.Sprintf("%s/tracks?limit=100&index=%d", fmt.Sprintf(deezerPlaylistURL, playlistID), len(allTracks))
+
+		for len(allTracks) < playlist.NbTracks {
+			var tracksResp struct {
+				Data []deezerTrack `json:"data"`
+				Next string        `json:"next"`
+			}
+
+			if err := c.getJSON(ctx, tracksURL, &tracksResp); err != nil {
+				GoLog("[Deezer] Warning: failed to fetch playlist tracks page: %v", err)
+				break
+			}
+
+			if len(tracksResp.Data) == 0 {
+				break
+			}
+
+			allTracks = append(allTracks, tracksResp.Data...)
+
+			if tracksResp.Next == "" {
+				break
+			}
+			tracksURL = tracksResp.Next
+		}
+
+		GoLog("[Deezer] Fetched total %d tracks for playlist", len(allTracks))
+	}
+
+	isrcMap := c.fetchISRCsParallel(ctx, allTracks)
+
+	tracks := make([]AlbumTrackMetadata, 0, len(allTracks))
+	for _, track := range allTracks {
 		albumImage := track.Album.CoverXL
 		if albumImage == "" {
 			albumImage = track.Album.CoverBig
@@ -512,15 +753,11 @@ func (c *DeezerClient) GetPlaylist(ctx context.Context, playlistID string) (*Pla
 	}, nil
 }
 
-// SearchByISRC searches for a track by ISRC using direct endpoint
 func (c *DeezerClient) SearchByISRC(ctx context.Context, isrc string) (*TrackMetadata, error) {
-	// Use direct ISRC endpoint (API 2.0)
-	// https://api.deezer.com/2.0/track/isrc:{ISRC}
 	directURL := fmt.Sprintf("%s/track/isrc:%s", deezerBaseURL, isrc)
 
 	var track deezerTrack
 	if err := c.getJSON(ctx, directURL, &track); err != nil {
-		// Fallback to search if direct endpoint fails
 		searchURL := fmt.Sprintf("%s/track?q=isrc:%s&limit=1", deezerSearchURL, isrc)
 		var resp struct {
 			Data []deezerTrack `json:"data"`
@@ -535,7 +772,6 @@ func (c *DeezerClient) SearchByISRC(ctx context.Context, isrc string) (*TrackMet
 		return &result, nil
 	}
 
-	// Check if we got a valid response (ID > 0)
 	if track.ID == 0 {
 		return nil, fmt.Errorf("no track found for ISRC: %s", isrc)
 	}
@@ -555,14 +791,24 @@ func (c *DeezerClient) fetchFullTrack(ctx context.Context, trackID string) (*dee
 
 // fetchISRCsParallel fetches ISRCs for multiple tracks in parallel with caching
 func (c *DeezerClient) fetchISRCsParallel(ctx context.Context, tracks []deezerTrack) map[string]string {
-	result := make(map[string]string)
+	result := make(map[string]string, len(tracks))
 	var resultMu sync.Mutex
 
-	// First, check cache for existing ISRCs
 	var tracksToFetch []deezerTrack
+	var directISRCs map[string]string
 	c.cacheMu.RLock()
 	for _, track := range tracks {
 		trackIDStr := fmt.Sprintf("%d", track.ID)
+		if track.ISRC != "" {
+			result[trackIDStr] = track.ISRC
+			if _, ok := c.isrcCache[trackIDStr]; !ok {
+				if directISRCs == nil {
+					directISRCs = make(map[string]string)
+				}
+				directISRCs[trackIDStr] = track.ISRC
+			}
+			continue
+		}
 		if isrc, ok := c.isrcCache[trackIDStr]; ok {
 			result[trackIDStr] = isrc
 		} else {
@@ -570,6 +816,13 @@ func (c *DeezerClient) fetchISRCsParallel(ctx context.Context, tracks []deezerTr
 		}
 	}
 	c.cacheMu.RUnlock()
+	if len(directISRCs) > 0 {
+		c.cacheMu.Lock()
+		for trackIDStr, isrc := range directISRCs {
+			c.isrcCache[trackIDStr] = isrc
+		}
+		c.cacheMu.Unlock()
+	}
 
 	if len(tracksToFetch) == 0 {
 		return result
@@ -584,7 +837,6 @@ func (c *DeezerClient) fetchISRCsParallel(ctx context.Context, tracks []deezerTr
 		go func(t deezerTrack) {
 			defer wg.Done()
 
-			// Acquire semaphore
 			select {
 			case sem <- struct{}{}:
 				defer func() { <-sem }()
@@ -613,10 +865,8 @@ func (c *DeezerClient) fetchISRCsParallel(ctx context.Context, tracks []deezerTr
 	return result
 }
 
-// GetTrackISRC fetches ISRC for a single track (with caching)
 // Use this when you need ISRC for download
 func (c *DeezerClient) GetTrackISRC(ctx context.Context, trackID string) (string, error) {
-	// Check cache first
 	c.cacheMu.RLock()
 	if isrc, ok := c.isrcCache[trackID]; ok {
 		c.cacheMu.RUnlock()
@@ -624,13 +874,11 @@ func (c *DeezerClient) GetTrackISRC(ctx context.Context, trackID string) (string
 	}
 	c.cacheMu.RUnlock()
 
-	// Fetch from API
 	fullTrack, err := c.fetchFullTrack(ctx, trackID)
 	if err != nil {
 		return "", err
 	}
 
-	// Cache the result
 	c.cacheMu.Lock()
 	c.isrcCache[trackID] = fullTrack.ISRC
 	c.cacheMu.Unlock()
@@ -677,6 +925,101 @@ func (c *DeezerClient) getBestAlbumImage(album deezerAlbumFull) string {
 	return album.Cover
 }
 
+type AlbumExtendedMetadata struct {
+	Genre string // Comma-separated list of genres
+	Label string // Record label name
+}
+
+// Uses the album ID from a track to fetch extended metadata
+func (c *DeezerClient) GetAlbumExtendedMetadata(ctx context.Context, albumID string) (*AlbumExtendedMetadata, error) {
+	if albumID == "" {
+		return nil, fmt.Errorf("empty album ID")
+	}
+
+	cacheKey := fmt.Sprintf("album_meta:%s", albumID)
+	c.cacheMu.RLock()
+	if entry, ok := c.searchCache[cacheKey]; ok && !entry.isExpired() {
+		c.cacheMu.RUnlock()
+		return entry.data.(*AlbumExtendedMetadata), nil
+	}
+	c.cacheMu.RUnlock()
+
+	albumURL := fmt.Sprintf(deezerAlbumURL, albumID)
+
+	var album deezerAlbumFull
+	if err := c.getJSON(ctx, albumURL, &album); err != nil {
+		return nil, fmt.Errorf("failed to fetch album: %w", err)
+	}
+
+	var genres []string
+	for _, g := range album.Genres.Data {
+		if g.Name != "" {
+			genres = append(genres, g.Name)
+		}
+	}
+
+	result := &AlbumExtendedMetadata{
+		Genre: strings.Join(genres, ", "),
+		Label: album.Label,
+	}
+
+	c.cacheMu.Lock()
+	c.searchCache[cacheKey] = &cacheEntry{
+		data:      result,
+		expiresAt: time.Now().Add(deezerCacheTTL),
+	}
+	c.cacheMu.Unlock()
+
+	GoLog("[Deezer] Album metadata fetched - Genre: %s, Label: %s\n", result.Genre, result.Label)
+
+	return result, nil
+}
+
+// GetTrackAlbumID fetches the album ID for a Deezer track
+func (c *DeezerClient) GetTrackAlbumID(ctx context.Context, trackID string) (string, error) {
+	trackURL := fmt.Sprintf(deezerTrackURL, trackID)
+
+	var track deezerTrack
+	if err := c.getJSON(ctx, trackURL, &track); err != nil {
+		return "", err
+	}
+
+	return fmt.Sprintf("%d", track.Album.ID), nil
+}
+
+// This is a convenience function that first gets the album ID, then fetches album metadata
+func (c *DeezerClient) GetExtendedMetadataByTrackID(ctx context.Context, trackID string) (*AlbumExtendedMetadata, error) {
+	albumID, err := c.GetTrackAlbumID(ctx, trackID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get album ID: %w", err)
+	}
+
+	return c.GetAlbumExtendedMetadata(ctx, albumID)
+}
+
+// GetExtendedMetadataByISRC searches for a track by ISRC and fetches extended metadata (genre, label)
+func (c *DeezerClient) GetExtendedMetadataByISRC(ctx context.Context, isrc string) (*AlbumExtendedMetadata, error) {
+	if isrc == "" {
+		return nil, fmt.Errorf("empty ISRC")
+	}
+
+	// First, search for track by ISRC
+	track, err := c.SearchByISRC(ctx, isrc)
+	if err != nil {
+		return nil, fmt.Errorf("failed to find track by ISRC: %w", err)
+	}
+
+	// SpotifyID contains "deezer:123" format, extract the ID
+	deezerID := strings.TrimPrefix(track.SpotifyID, "deezer:")
+
+	if deezerID == "" {
+		return nil, fmt.Errorf("track found but no Deezer ID")
+	}
+
+	// Then fetch extended metadata using the Deezer track ID
+	return c.GetExtendedMetadataByTrackID(ctx, deezerID)
+}
+
 func (c *DeezerClient) getJSON(ctx context.Context, endpoint string, dst interface{}) error {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
 	if err != nil {
@@ -721,7 +1064,6 @@ func parseDeezerURL(input string) (string, string, error) {
 
 	parts := strings.Split(strings.Trim(parsed.Path, "/"), "/")
 
-	// Skip language prefix if present (e.g., /en/, /fr/)
 	if len(parts) > 0 && len(parts[0]) == 2 {
 		parts = parts[1:]
 	}

go_backend/duplicate.go

@@ -18,30 +18,45 @@ type ISRCIndex struct {
 	mu        sync.RWMutex
 }
 
-// Global ISRC index cache (per output directory)
 var (
 	isrcIndexCache   = make(map[string]*ISRCIndex)
 	isrcIndexCacheMu sync.RWMutex
-	isrcIndexTTL     = 5 * time.Minute // Cache TTL - rebuild after 5 minutes
+	isrcBuildingMu   sync.Map // Per-directory build lock to prevent concurrent builds
+	isrcIndexTTL     = 5 * time.Minute
 )
 
 // GetISRCIndex returns or builds an ISRC index for the given directory
+// Uses per-directory mutex to prevent concurrent builds (race condition fix)
 func GetISRCIndex(outputDir string) *ISRCIndex {
+	// Fast path: check cache first
 	isrcIndexCacheMu.RLock()
 	idx, exists := isrcIndexCache[outputDir]
 	isrcIndexCacheMu.RUnlock()
 
-	// Return cached index if still valid
 	if exists && time.Since(idx.buildTime) < isrcIndexTTL {
 		return idx
 	}
 
-	// Build new index
+	// Slow path: need to build index
+	// Use per-directory mutex to prevent multiple goroutines from building simultaneously
+	buildLock, _ := isrcBuildingMu.LoadOrStore(outputDir, &sync.Mutex{})
+	mu := buildLock.(*sync.Mutex)
+	mu.Lock()
+	defer mu.Unlock()
+
+	// Double-check cache after acquiring lock (another goroutine may have built it)
+	isrcIndexCacheMu.RLock()
+	idx, exists = isrcIndexCache[outputDir]
+	isrcIndexCacheMu.RUnlock()
+
+	if exists && time.Since(idx.buildTime) < isrcIndexTTL {
+		return idx
+	}
+
 	return buildISRCIndex(outputDir)
 }
 
 // buildISRCIndex scans a directory and builds a map of ISRC -> file path
-// Same implementation as PC version for consistency
 func buildISRCIndex(outputDir string) *ISRCIndex {
 	idx := &ISRCIndex{
 		index:     make(map[string]string),
@@ -56,7 +71,6 @@ func buildISRCIndex(outputDir string) *ISRCIndex {
 	startTime := time.Now()
 	fileCount := 0
 
-	// Walk directory - only check .flac files
 	filepath.Walk(outputDir, func(path string, info os.FileInfo, err error) error {
 		if err != nil || info.IsDir() {
 			return nil
@@ -67,13 +81,11 @@ func buildISRCIndex(outputDir string) *ISRCIndex {
 			return nil
 		}
 
-		// Read ISRC from file
 		metadata, err := ReadMetadata(path)
 		if err != nil || metadata.ISRC == "" {
 			return nil
 		}
 
-		// Store in index (uppercase for case-insensitive matching)
 		idx.index[strings.ToUpper(metadata.ISRC)] = path
 		fileCount++
 		return nil
@@ -82,7 +94,6 @@ func buildISRCIndex(outputDir string) *ISRCIndex {
 	fmt.Printf("[ISRCIndex] Built index for %s: %d files in %v\n", 
 		outputDir, fileCount, time.Since(startTime).Round(time.Millisecond))
 
-	// Cache the index
 	isrcIndexCacheMu.Lock()
 	isrcIndexCache[outputDir] = idx
 	isrcIndexCacheMu.Unlock()
@@ -90,7 +101,6 @@ func buildISRCIndex(outputDir string) *ISRCIndex {
 	return idx
 }
 
-// lookup checks if an ISRC exists in the index (internal, returns bool)
 func (idx *ISRCIndex) lookup(isrc string) (string, bool) {
 	if isrc == "" {
 		return "", false
@@ -103,6 +113,18 @@ func (idx *ISRCIndex) lookup(isrc string) (string, bool) {
 	return path, exists
 }
 
+// remove deletes an ISRC entry from the index (internal use)
+func (idx *ISRCIndex) remove(isrc string) {
+	if isrc == "" {
+		return
+	}
+
+	idx.mu.Lock()
+	defer idx.mu.Unlock()
+
+	delete(idx.index, strings.ToUpper(isrc))
+}
+
 // Lookup checks if an ISRC exists in the index (gomobile compatible)
 // Returns filepath if found, empty string if not found
 func (idx *ISRCIndex) Lookup(isrc string) (string, error) {
@@ -136,13 +158,22 @@ func checkISRCExistsInternal(outputDir, isrc string) (string, bool) {
 		return "", false
 	}
 
-	// Use index for fast lookup
 	idx := GetISRCIndex(outputDir)
-	return idx.lookup(isrc)
+	filePath, exists := idx.lookup(isrc)
+	if !exists {
+		return "", false
+	}
+
+	if !CheckFileExists(filePath) {
+		// Stale index entry; remove it and return not found.
+		idx.remove(isrc)
+		return "", false
+	}
+
+	return filePath, true
 }
 
 // CheckISRCExists is the exported version for gomobile (returns string, error)
-// Returns the filepath if exists, empty string if not
 func CheckISRCExists(outputDir, isrc string) (string, error) {
 	filepath, _ := checkISRCExistsInternal(outputDir, isrc)
 	return filepath, nil
@@ -166,11 +197,7 @@ type FileExistenceResult struct {
 	ArtistName string `json:"artist_name,omitempty"`
 }
 
-// CheckFilesExistParallel checks if multiple files exist in parallel
-// It builds an ISRC index from the output directory once, then checks all tracks against it
-// Same implementation as PC version for consistency
 func CheckFilesExistParallel(outputDir string, tracksJSON string) (string, error) {
-	// Parse input JSON
 	var tracks []struct {
 		ISRC       string `json:"isrc"`
 		TrackName  string `json:"track_name"`
@@ -182,10 +209,8 @@ func CheckFilesExistParallel(outputDir string, tracksJSON string) (string, error
 
 	results := make([]FileExistenceResult, len(tracks))
 
-	// Build ISRC index from output directory (scan once)
 	isrcIdx := GetISRCIndex(outputDir)
 
-	// Check each track against the index (parallel)
 	var wg sync.WaitGroup
 	for i, track := range tracks {
 		wg.Add(1)
@@ -216,7 +241,6 @@ func CheckFilesExistParallel(outputDir string, tracksJSON string) (string, error
 
 	wg.Wait()
 
-	// Return results as JSON
 	resultJSON, err := json.Marshal(results)
 	if err != nil {
 		return "", fmt.Errorf("failed to marshal results: %w", err)
@@ -237,7 +261,6 @@ func PreBuildISRCIndex(outputDir string) error {
 }
 
 // AddToISRCIndex adds a new file to the ISRC index after successful download
-// This avoids rebuilding the entire index
 func AddToISRCIndex(outputDir, isrc, filePath string) {
 	if outputDir == "" || isrc == "" || filePath == "" {
 		return

go_backend/extension_manager.go

@@ -0,0 +1,997 @@
+package gobackend
+
+import (
+	"archive/zip"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/dop251/goja"
+)
+
+func compareVersions(v1, v2 string) int {
+	parts1 := strings.Split(strings.TrimPrefix(v1, "v"), ".")
+	parts2 := strings.Split(strings.TrimPrefix(v2, "v"), ".")
+
+	maxLen := len(parts1)
+	if len(parts2) > maxLen {
+		maxLen = len(parts2)
+	}
+
+	for i := 0; i < maxLen; i++ {
+		var n1, n2 int
+		if i < len(parts1) {
+			n1, _ = strconv.Atoi(parts1[i])
+		}
+		if i < len(parts2) {
+			n2, _ = strconv.Atoi(parts2[i])
+		}
+
+		if n1 < n2 {
+			return -1
+		}
+		if n1 > n2 {
+			return 1
+		}
+	}
+
+	return 0
+}
+
+type LoadedExtension struct {
+	ID        string             `json:"id"`
+	Manifest  *ExtensionManifest `json:"manifest"`
+	VM        *goja.Runtime      `json:"-"`
+	VMMu      sync.Mutex         `json:"-"` // Mutex to prevent concurrent VM access
+	Enabled   bool               `json:"enabled"`
+	Error     string             `json:"error,omitempty"`
+	DataDir   string             `json:"data_dir"`
+	SourceDir string             `json:"source_dir"`
+	IconPath  string             `json:"icon_path"`
+}
+
+// ExtensionManager manages all loaded extensions
+type ExtensionManager struct {
+	mu            sync.RWMutex
+	extensions    map[string]*LoadedExtension
+	extensionsDir string // Base directory for extensions
+	dataDir       string // Base directory for extension data
+}
+
+var (
+	globalExtManager     *ExtensionManager
+	globalExtManagerOnce sync.Once
+)
+
+func GetExtensionManager() *ExtensionManager {
+	globalExtManagerOnce.Do(func() {
+		globalExtManager = &ExtensionManager{
+			extensions: make(map[string]*LoadedExtension),
+		}
+	})
+	return globalExtManager
+}
+
+func (m *ExtensionManager) SetDirectories(extensionsDir, dataDir string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	m.extensionsDir = extensionsDir
+	m.dataDir = dataDir
+
+	if err := os.MkdirAll(extensionsDir, 0755); err != nil {
+		return fmt.Errorf("failed to create extensions directory: %w", err)
+	}
+	if err := os.MkdirAll(dataDir, 0755); err != nil {
+		return fmt.Errorf("failed to create data directory: %w", err)
+	}
+
+	return nil
+}
+
+func (m *ExtensionManager) LoadExtensionFromFile(filePath string) (*LoadedExtension, error) {
+	if !strings.HasSuffix(strings.ToLower(filePath), ".spotiflac-ext") {
+		return nil, fmt.Errorf("Invalid file format. Please select a .spotiflac-ext file")
+	}
+
+	// Open the zip file
+	zipReader, err := zip.OpenReader(filePath)
+	if err != nil {
+		return nil, fmt.Errorf("Cannot open extension file. The file may be corrupted or not a valid extension package")
+	}
+	defer zipReader.Close()
+
+	var manifestData []byte
+	var hasIndexJS bool
+	for _, file := range zipReader.File {
+		name := filepath.Base(file.Name)
+		if name == "manifest.json" {
+			rc, err := file.Open()
+			if err != nil {
+				return nil, fmt.Errorf("failed to open manifest.json: %w", err)
+			}
+			manifestData, err = io.ReadAll(rc)
+			rc.Close()
+			if err != nil {
+				return nil, fmt.Errorf("failed to read manifest.json: %w", err)
+			}
+		}
+		if name == "index.js" {
+			hasIndexJS = true
+		}
+	}
+
+	if manifestData == nil {
+		return nil, fmt.Errorf("Invalid extension package: manifest.json not found")
+	}
+
+	if !hasIndexJS {
+		return nil, fmt.Errorf("Invalid extension package: index.js not found")
+	}
+
+	manifest, err := ParseManifest(manifestData)
+	if err != nil {
+		return nil, fmt.Errorf("Invalid extension manifest: %w", err)
+	}
+
+	m.mu.RLock()
+	existing, exists := m.extensions[manifest.Name]
+	var existingVersion string
+	var existingDisplayName string
+	if exists {
+		existingVersion = existing.Manifest.Version
+		existingDisplayName = existing.Manifest.DisplayName
+	}
+	m.mu.RUnlock()
+
+	if exists {
+		versionCompare := compareVersions(manifest.Version, existingVersion)
+		if versionCompare > 0 {
+			// This is an upgrade - call UpgradeExtension
+			return m.UpgradeExtension(filePath)
+		} else if versionCompare == 0 {
+			return nil, fmt.Errorf("Extension '%s' v%s is already installed", existingDisplayName, existingVersion)
+		} else {
+			return nil, fmt.Errorf("Cannot downgrade '%s' from v%s to v%s", existingDisplayName, existingVersion, manifest.Version)
+		}
+	}
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if _, exists := m.extensions[manifest.Name]; exists {
+		return nil, fmt.Errorf("Extension '%s' was installed by another process", manifest.DisplayName)
+	}
+
+	extDir := filepath.Join(m.extensionsDir, manifest.Name)
+	if err := os.MkdirAll(extDir, 0755); err != nil {
+		return nil, fmt.Errorf("failed to create extension directory: %w", err)
+	}
+
+	for _, file := range zipReader.File {
+		if file.FileInfo().IsDir() {
+			continue
+		}
+
+		relPath := filepath.Clean(file.Name)
+		if strings.HasPrefix(relPath, "..") || filepath.IsAbs(relPath) {
+			GoLog("[Extension] Skipping unsafe path in archive: %s\n", file.Name)
+			continue
+		}
+		destPath := filepath.Join(extDir, relPath)
+
+		destDir := filepath.Dir(destPath)
+		if err := os.MkdirAll(destDir, 0755); err != nil {
+			return nil, fmt.Errorf("failed to create directory %s: %w", destDir, err)
+		}
+
+		destFile, err := os.Create(destPath)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create file %s: %w", destPath, err)
+		}
+
+		srcFile, err := file.Open()
+		if err != nil {
+			destFile.Close()
+			return nil, fmt.Errorf("failed to open file in archive: %w", err)
+		}
+
+		_, err = io.Copy(destFile, srcFile)
+		srcFile.Close()
+		destFile.Close()
+		if err != nil {
+			return nil, fmt.Errorf("failed to extract file: %w", err)
+		}
+	}
+
+	extDataDir := filepath.Join(m.dataDir, manifest.Name)
+	if err := os.MkdirAll(extDataDir, 0755); err != nil {
+		return nil, fmt.Errorf("failed to create extension data directory: %w", err)
+	}
+
+	ext := &LoadedExtension{
+		ID:        manifest.Name,
+		Manifest:  manifest,
+		Enabled:   false, // New extensions start disabled
+		DataDir:   extDataDir,
+		SourceDir: extDir,
+	}
+
+	// Initialize Goja VM
+	if err := m.initializeVM(ext); err != nil {
+		ext.Error = err.Error()
+		ext.Enabled = false
+		GoLog("[Extension] Failed to initialize VM for %s: %v\n", manifest.Name, err)
+	}
+
+	m.extensions[manifest.Name] = ext
+	GoLog("[Extension] Loaded extension: %s v%s\n", manifest.DisplayName, manifest.Version)
+
+	return ext, nil
+}
+
+func (m *ExtensionManager) initializeVM(ext *LoadedExtension) error {
+	vm := goja.New()
+	ext.VM = vm
+
+	indexPath := filepath.Join(ext.SourceDir, "index.js")
+	jsCode, err := os.ReadFile(indexPath)
+	if err != nil {
+		return fmt.Errorf("failed to read index.js: %w", err)
+	}
+
+	runtime := NewExtensionRuntime(ext)
+	runtime.RegisterAPIs(vm)
+	runtime.RegisterGoBackendAPIs(vm)
+
+	console := vm.NewObject()
+	console.Set("log", func(call goja.FunctionCall) goja.Value {
+		args := make([]interface{}, len(call.Arguments))
+		for i, arg := range call.Arguments {
+			args[i] = arg.Export()
+		}
+		GoLog("[Extension:%s] %v\n", ext.ID, args)
+		return goja.Undefined()
+	})
+	vm.Set("console", console)
+
+	var registeredExtension goja.Value
+	vm.Set("registerExtension", func(call goja.FunctionCall) goja.Value {
+		if len(call.Arguments) > 0 {
+			registeredExtension = call.Arguments[0]
+			vm.Set("extension", call.Arguments[0])
+		}
+		return goja.Undefined()
+	})
+
+	// Run the extension code
+	_, err = vm.RunString(string(jsCode))
+	if err != nil {
+		return fmt.Errorf("failed to execute extension code: %w", err)
+	}
+
+	// Verify extension was registered
+	if registeredExtension == nil || goja.IsUndefined(registeredExtension) {
+		return fmt.Errorf("extension did not call registerExtension()")
+	}
+
+	return nil
+}
+
+// UnloadExtension unloads an extension by ID
+func (m *ExtensionManager) UnloadExtension(extensionID string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	ext, exists := m.extensions[extensionID]
+	if !exists {
+		return fmt.Errorf("Extension not found")
+	}
+
+	// Call cleanup if VM is initialized
+	if ext.VM != nil {
+		// Try to call cleanup function
+		cleanup, err := ext.VM.RunString("typeof extension !== 'undefined' && typeof extension.cleanup === 'function' ? extension.cleanup() : null")
+		if err != nil {
+			GoLog("[Extension] Error calling cleanup for %s: %v\n", extensionID, err)
+		} else if cleanup != nil && !goja.IsUndefined(cleanup) && !goja.IsNull(cleanup) {
+			GoLog("[Extension] Cleanup called for %s\n", extensionID)
+		}
+	}
+
+	// Remove from registry
+	delete(m.extensions, extensionID)
+	GoLog("[Extension] Unloaded extension: %s\n", extensionID)
+
+	return nil
+}
+
+// Returns error if extension not found (gomobile compatible)
+func (m *ExtensionManager) GetExtension(extensionID string) (*LoadedExtension, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	ext, exists := m.extensions[extensionID]
+	if !exists {
+		return nil, fmt.Errorf("Extension not found")
+	}
+	return ext, nil
+}
+
+// GetAllExtensions returns all loaded extensions
+func (m *ExtensionManager) GetAllExtensions() []*LoadedExtension {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	result := make([]*LoadedExtension, 0, len(m.extensions))
+	for _, ext := range m.extensions {
+		result = append(result, ext)
+	}
+	return result
+}
+
+func (m *ExtensionManager) SetExtensionEnabled(extensionID string, enabled bool) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	ext, exists := m.extensions[extensionID]
+	if !exists {
+		return fmt.Errorf("Extension not found")
+	}
+
+	ext.Enabled = enabled
+	GoLog("[Extension] %s %s\n", extensionID, map[bool]string{true: "enabled", false: "disabled"}[enabled])
+
+	// Persist enabled state to settings store
+	store := GetExtensionSettingsStore()
+	if err := store.Set(extensionID, "_enabled", enabled); err != nil {
+		GoLog("[Extension] Failed to persist enabled state for %s: %v\n", extensionID, err)
+	}
+
+	return nil
+}
+
+// LoadExtensionsFromDirectory scans a directory and loads all valid extensions
+func (m *ExtensionManager) LoadExtensionsFromDirectory(dirPath string) ([]string, []error) {
+	var loaded []string
+	var errors []error
+
+	entries, err := os.ReadDir(dirPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return loaded, errors
+		}
+		return nil, []error{fmt.Errorf("failed to read extensions directory: %w", err)}
+	}
+
+	for _, entry := range entries {
+		if entry.IsDir() {
+			manifestPath := filepath.Join(dirPath, entry.Name(), "manifest.json")
+			if _, err := os.Stat(manifestPath); err == nil {
+				ext, err := m.loadExtensionFromDirectory(filepath.Join(dirPath, entry.Name()))
+				if err != nil {
+					GoLog("[Extension] Failed to load %s: %v\n", entry.Name(), err)
+					errors = append(errors, fmt.Errorf("%s: %w", entry.Name(), err))
+				} else {
+					loaded = append(loaded, ext.ID)
+				}
+			}
+		} else if strings.HasSuffix(strings.ToLower(entry.Name()), ".spotiflac-ext") {
+			ext, err := m.LoadExtensionFromFile(filepath.Join(dirPath, entry.Name()))
+			if err != nil {
+				GoLog("[Extension] Failed to load %s: %v\n", entry.Name(), err)
+				errors = append(errors, fmt.Errorf("%s: %w", entry.Name(), err))
+			} else {
+				loaded = append(loaded, ext.ID)
+			}
+		}
+	}
+
+	return loaded, errors
+}
+
+func (m *ExtensionManager) loadExtensionFromDirectory(dirPath string) (*LoadedExtension, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	manifestPath := filepath.Join(dirPath, "manifest.json")
+	manifestData, err := os.ReadFile(manifestPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read manifest.json: %w", err)
+	}
+
+	// Parse and validate manifest
+	manifest, err := ParseManifest(manifestData)
+	if err != nil {
+		return nil, fmt.Errorf("Invalid extension manifest: %w", err)
+	}
+
+	indexPath := filepath.Join(dirPath, "index.js")
+	if _, err := os.Stat(indexPath); os.IsNotExist(err) {
+		return nil, fmt.Errorf("Extension is missing index.js file")
+	}
+
+	if existing, exists := m.extensions[manifest.Name]; exists {
+		GoLog("[Extension] Extension '%s' already loaded, skipping\n", manifest.DisplayName)
+		return existing, nil
+	}
+
+	extDataDir := filepath.Join(m.dataDir, manifest.Name)
+	if err := os.MkdirAll(extDataDir, 0755); err != nil {
+		return nil, fmt.Errorf("failed to create extension data directory: %w", err)
+	}
+
+	ext := &LoadedExtension{
+		ID:        manifest.Name,
+		Manifest:  manifest,
+		Enabled:   false, // Will be restored from settings store
+		DataDir:   extDataDir,
+		SourceDir: dirPath,
+	}
+
+	// Restore enabled state from settings store
+	store := GetExtensionSettingsStore()
+	if enabledVal, err := store.Get(manifest.Name, "_enabled"); err == nil {
+		if enabled, ok := enabledVal.(bool); ok {
+			ext.Enabled = enabled
+			GoLog("[Extension] Restored enabled state for %s: %v\n", manifest.Name, enabled)
+		}
+	}
+
+	// Initialize Goja VM
+	if err := m.initializeVM(ext); err != nil {
+		ext.Error = err.Error()
+		ext.Enabled = false
+		GoLog("[Extension] Failed to initialize VM for %s: %v\n", manifest.Name, err)
+	}
+
+	m.extensions[manifest.Name] = ext
+	GoLog("[Extension] Loaded extension: %s v%s\n", manifest.DisplayName, manifest.Version)
+
+	return ext, nil
+}
+
+// RemoveExtension completely removes an extension (unload + delete files)
+func (m *ExtensionManager) RemoveExtension(extensionID string) error {
+	ext, err := m.GetExtension(extensionID)
+	if err != nil {
+		return err
+	}
+
+	// Unload first
+	if err := m.UnloadExtension(extensionID); err != nil {
+		return err
+	}
+
+	// Remove source directory
+	if ext.SourceDir != "" {
+		if err := os.RemoveAll(ext.SourceDir); err != nil {
+			GoLog("[Extension] Warning: failed to remove source dir: %v\n", err)
+		}
+	}
+
+	// Optionally remove data directory (keep for now to preserve settings)
+	// if ext.DataDir != "" {
+	//     os.RemoveAll(ext.DataDir)
+	// }
+
+	return nil
+}
+
+// Only allows upgrades (new version > current version), not downgrades
+func (m *ExtensionManager) UpgradeExtension(filePath string) (*LoadedExtension, error) {
+	// Validate file extension
+	if !strings.HasSuffix(strings.ToLower(filePath), ".spotiflac-ext") {
+		return nil, fmt.Errorf("Invalid file format. Please select a .spotiflac-ext file")
+	}
+
+	// Open the zip file
+	zipReader, err := zip.OpenReader(filePath)
+	if err != nil {
+		return nil, fmt.Errorf("Cannot open extension file. The file may be corrupted or not a valid extension package")
+	}
+	defer zipReader.Close()
+
+	var manifestData []byte
+	var hasIndexJS bool
+	for _, file := range zipReader.File {
+		name := filepath.Base(file.Name)
+		if name == "manifest.json" {
+			rc, err := file.Open()
+			if err != nil {
+				return nil, fmt.Errorf("failed to open manifest.json: %w", err)
+			}
+			manifestData, err = io.ReadAll(rc)
+			rc.Close()
+			if err != nil {
+				return nil, fmt.Errorf("failed to read manifest.json: %w", err)
+			}
+		}
+		if name == "index.js" {
+			hasIndexJS = true
+		}
+	}
+
+	if manifestData == nil {
+		return nil, fmt.Errorf("Invalid extension package: manifest.json not found")
+	}
+
+	if !hasIndexJS {
+		return nil, fmt.Errorf("Invalid extension package: index.js not found")
+	}
+
+	newManifest, err := ParseManifest(manifestData)
+	if err != nil {
+		return nil, fmt.Errorf("Invalid extension manifest: %w", err)
+	}
+
+	m.mu.RLock()
+	existing, exists := m.extensions[newManifest.Name]
+	m.mu.RUnlock()
+
+	if !exists {
+		return nil, fmt.Errorf("Extension '%s' is not installed. Use install instead of upgrade.", newManifest.DisplayName)
+	}
+
+	// Compare versions - only allow upgrade, not downgrade
+	versionCompare := compareVersions(newManifest.Version, existing.Manifest.Version)
+	if versionCompare < 0 {
+		return nil, fmt.Errorf("Cannot downgrade extension. Current version: %s, New version: %s", existing.Manifest.Version, newManifest.Version)
+	}
+	if versionCompare == 0 {
+		return nil, fmt.Errorf("Extension is already at version %s", existing.Manifest.Version)
+	}
+
+	GoLog("[Extension] Upgrading %s from v%s to v%s\n", newManifest.DisplayName, existing.Manifest.Version, newManifest.Version)
+
+	// Save data directory path and enabled state (we want to preserve them)
+	extDataDir := existing.DataDir
+	extDir := existing.SourceDir
+	wasEnabled := existing.Enabled
+
+	// Cleanup and unload existing extension
+	m.CleanupExtension(existing.ID)
+	m.UnloadExtension(existing.ID)
+
+	// Remove old source files but keep data directory
+	if extDir != "" {
+		if err := os.RemoveAll(extDir); err != nil {
+			GoLog("[Extension] Warning: failed to remove old source dir: %v\n", err)
+		}
+	}
+
+	if err := os.MkdirAll(extDir, 0755); err != nil {
+		return nil, fmt.Errorf("failed to create extension directory: %w", err)
+	}
+
+	for _, file := range zipReader.File {
+		if file.FileInfo().IsDir() {
+			continue
+		}
+
+		relPath := filepath.Clean(file.Name)
+		if strings.HasPrefix(relPath, "..") || filepath.IsAbs(relPath) {
+			GoLog("[Extension] Skipping unsafe path in archive: %s\n", file.Name)
+			continue
+		}
+		destPath := filepath.Join(extDir, relPath)
+
+		destDir := filepath.Dir(destPath)
+		if err := os.MkdirAll(destDir, 0755); err != nil {
+			return nil, fmt.Errorf("failed to create directory %s: %w", destDir, err)
+		}
+
+		destFile, err := os.Create(destPath)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create file %s: %w", destPath, err)
+		}
+
+		srcFile, err := file.Open()
+		if err != nil {
+			destFile.Close()
+			return nil, fmt.Errorf("failed to open file in archive: %w", err)
+		}
+
+		_, err = io.Copy(destFile, srcFile)
+		srcFile.Close()
+		destFile.Close()
+		if err != nil {
+			return nil, fmt.Errorf("failed to extract file: %w", err)
+		}
+	}
+
+	ext := &LoadedExtension{
+		ID:        newManifest.Name,
+		Manifest:  newManifest,
+		Enabled:   wasEnabled, // Preserve enabled state from before upgrade
+		DataDir:   extDataDir,
+		SourceDir: extDir,
+	}
+
+	// Initialize Goja VM
+	if err := m.initializeVM(ext); err != nil {
+		ext.Error = err.Error()
+		ext.Enabled = false
+		GoLog("[Extension] Failed to initialize VM for %s: %v\n", newManifest.Name, err)
+	}
+
+	m.mu.Lock()
+	m.extensions[newManifest.Name] = ext
+	m.mu.Unlock()
+
+	GoLog("[Extension] Upgraded extension: %s to v%s\n", newManifest.DisplayName, newManifest.Version)
+
+	return ext, nil
+}
+
+type ExtensionUpgradeInfo struct {
+	ExtensionID    string `json:"extension_id"`
+	CurrentVersion string `json:"current_version"`
+	NewVersion     string `json:"new_version"`
+	CanUpgrade     bool   `json:"can_upgrade"`
+	IsInstalled    bool   `json:"is_installed"`
+}
+
+// checkExtensionUpgradeInternal checks if a package file is an upgrade for an existing extension
+// Internal function that returns struct
+func (m *ExtensionManager) checkExtensionUpgradeInternal(filePath string) (*ExtensionUpgradeInfo, error) {
+	// Validate file extension
+	if !strings.HasSuffix(strings.ToLower(filePath), ".spotiflac-ext") {
+		return nil, fmt.Errorf("Invalid file format")
+	}
+
+	// Open the zip file
+	zipReader, err := zip.OpenReader(filePath)
+	if err != nil {
+		return nil, fmt.Errorf("Cannot open extension file")
+	}
+	defer zipReader.Close()
+
+	var manifestData []byte
+	for _, file := range zipReader.File {
+		name := filepath.Base(file.Name)
+		if name == "manifest.json" {
+			rc, err := file.Open()
+			if err != nil {
+				return nil, fmt.Errorf("failed to open manifest.json")
+			}
+			manifestData, err = io.ReadAll(rc)
+			rc.Close()
+			if err != nil {
+				return nil, fmt.Errorf("failed to read manifest.json")
+			}
+			break
+		}
+	}
+
+	if manifestData == nil {
+		return nil, fmt.Errorf("manifest.json not found")
+	}
+
+	newManifest, err := ParseManifest(manifestData)
+	if err != nil {
+		return nil, fmt.Errorf("Invalid manifest: %w", err)
+	}
+
+	m.mu.RLock()
+	existing, exists := m.extensions[newManifest.Name]
+	m.mu.RUnlock()
+
+	info := &ExtensionUpgradeInfo{
+		ExtensionID: newManifest.Name,
+		NewVersion:  newManifest.Version,
+		IsInstalled: exists,
+	}
+
+	if !exists {
+		// Not installed - this is a new install, not upgrade
+		info.CurrentVersion = ""
+		info.CanUpgrade = false
+	} else {
+		info.CurrentVersion = existing.Manifest.Version
+		info.CanUpgrade = compareVersions(newManifest.Version, existing.Manifest.Version) > 0
+	}
+
+	return info, nil
+}
+
+func (m *ExtensionManager) CheckExtensionUpgradeJSON(filePath string) (string, error) {
+	info, err := m.checkExtensionUpgradeInternal(filePath)
+	if err != nil {
+		return "", err
+	}
+
+	jsonBytes, err := json.Marshal(info)
+	if err != nil {
+		return "", err
+	}
+
+	return string(jsonBytes), nil
+}
+
+// GetInstalledExtensionsJSON returns all extensions as JSON for Flutter
+func (m *ExtensionManager) GetInstalledExtensionsJSON() (string, error) {
+	extensions := m.GetAllExtensions()
+
+	type ExtensionInfo struct {
+		ID                     string                 `json:"id"`
+		Name                   string                 `json:"name"`
+		DisplayName            string                 `json:"display_name"`
+		Version                string                 `json:"version"`
+		Author                 string                 `json:"author"`
+		Description            string                 `json:"description"`
+		Homepage               string                 `json:"homepage,omitempty"`
+		IconPath               string                 `json:"icon_path,omitempty"`
+		Types                  []ExtensionType        `json:"types"`
+		Enabled                bool                   `json:"enabled"`
+		Status                 string                 `json:"status"`
+		Error                  string                 `json:"error_message,omitempty"`
+		Settings               []ExtensionSetting     `json:"settings,omitempty"`
+		QualityOptions         []QualityOption        `json:"quality_options,omitempty"`
+		Permissions            []string               `json:"permissions"`
+		HasMetadataProvider    bool                   `json:"has_metadata_provider"`
+		HasDownloadProvider    bool                   `json:"has_download_provider"`
+		SkipMetadataEnrichment bool                   `json:"skip_metadata_enrichment"`
+		SearchBehavior         *SearchBehaviorConfig  `json:"search_behavior,omitempty"`
+		TrackMatching          *TrackMatchingConfig   `json:"track_matching,omitempty"`
+		PostProcessing         *PostProcessingConfig  `json:"post_processing,omitempty"`
+		Capabilities           map[string]interface{} `json:"capabilities,omitempty"`
+	}
+
+	infos := make([]ExtensionInfo, len(extensions))
+	for i, ext := range extensions {
+		permissions := []string{}
+		for _, domain := range ext.Manifest.Permissions.Network {
+			permissions = append(permissions, "network:"+domain)
+		}
+		if ext.Manifest.Permissions.Storage {
+			permissions = append(permissions, "storage:enabled")
+		}
+
+		// Determine status
+		status := "loaded"
+		if ext.Error != "" {
+			status = "error"
+		} else if !ext.Enabled {
+			status = "disabled"
+		}
+
+		iconPath := ""
+		if ext.Manifest.Icon != "" && ext.SourceDir != "" {
+			possibleIcon := filepath.Join(ext.SourceDir, ext.Manifest.Icon)
+			if _, err := os.Stat(possibleIcon); err == nil {
+				iconPath = possibleIcon
+			}
+		}
+		if iconPath == "" && ext.SourceDir != "" {
+			possibleIcon := filepath.Join(ext.SourceDir, "icon.png")
+			if _, err := os.Stat(possibleIcon); err == nil {
+				iconPath = possibleIcon
+			}
+		}
+
+		infos[i] = ExtensionInfo{
+			ID:                     ext.ID,
+			Name:                   ext.Manifest.Name,
+			DisplayName:            ext.Manifest.DisplayName,
+			Version:                ext.Manifest.Version,
+			Author:                 ext.Manifest.Author,
+			Description:            ext.Manifest.Description,
+			Homepage:               ext.Manifest.Homepage,
+			IconPath:               iconPath,
+			Types:                  ext.Manifest.Types,
+			Enabled:                ext.Enabled,
+			Status:                 status,
+			Error:                  ext.Error,
+			Settings:               ext.Manifest.Settings,
+			QualityOptions:         ext.Manifest.QualityOptions,
+			Permissions:            permissions,
+			HasMetadataProvider:    ext.Manifest.IsMetadataProvider(),
+			HasDownloadProvider:    ext.Manifest.IsDownloadProvider(),
+			SkipMetadataEnrichment: ext.Manifest.SkipMetadataEnrichment,
+			SearchBehavior:         ext.Manifest.SearchBehavior,
+			TrackMatching:          ext.Manifest.TrackMatching,
+			PostProcessing:         ext.Manifest.PostProcessing,
+			Capabilities:           ext.Manifest.Capabilities,
+		}
+	}
+
+	jsonBytes, err := json.Marshal(infos)
+	if err != nil {
+		return "", err
+	}
+
+	return string(jsonBytes), nil
+}
+
+// ==================== Extension Lifecycle ====================
+
+func (m *ExtensionManager) InitializeExtension(extensionID string, settings map[string]interface{}) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	ext, exists := m.extensions[extensionID]
+	if !exists {
+		return fmt.Errorf("Extension not found")
+	}
+
+	if ext.VM == nil {
+		return fmt.Errorf("Extension failed to load. Please reinstall the extension")
+	}
+
+	settingsJSON, err := json.Marshal(settings)
+	if err != nil {
+		return fmt.Errorf("Failed to save settings")
+	}
+
+	script := fmt.Sprintf(`
+		(function() {
+			var settings = %s;
+			if (typeof extension !== 'undefined' && typeof extension.initialize === 'function') {
+				try {
+					extension.initialize(settings);
+					return { success: true };
+				} catch (e) {
+					return { success: false, error: e.toString() };
+				}
+			}
+			return { success: true, message: 'no initialize function' };
+		})()
+	`, string(settingsJSON))
+
+	result, err := ext.VM.RunString(script)
+	if err != nil {
+		ext.Error = fmt.Sprintf("initialize failed: %v", err)
+		ext.Enabled = false
+		GoLog("[Extension] Initialize error for %s: %v\n", extensionID, err)
+		return err
+	}
+
+	if result != nil && !goja.IsUndefined(result) {
+		exported := result.Export()
+		if resultMap, ok := exported.(map[string]interface{}); ok {
+			if success, ok := resultMap["success"].(bool); ok && !success {
+				errMsg := "unknown error"
+				if e, ok := resultMap["error"].(string); ok {
+					errMsg = e
+				}
+				ext.Error = errMsg
+				ext.Enabled = false
+				GoLog("[Extension] Initialize failed for %s: %s\n", extensionID, errMsg)
+				return fmt.Errorf("initialize failed: %s", errMsg)
+			}
+		}
+	}
+
+	GoLog("[Extension] Initialized %s\n", extensionID)
+	return nil
+}
+
+func (m *ExtensionManager) CleanupExtension(extensionID string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	ext, exists := m.extensions[extensionID]
+	if !exists {
+		return fmt.Errorf("Extension not found")
+	}
+
+	if ext.VM == nil {
+		return nil
+	}
+
+	script := `
+		(function() {
+			if (typeof extension !== 'undefined' && typeof extension.cleanup === 'function') {
+				try {
+					extension.cleanup();
+					return { success: true };
+				} catch (e) {
+					return { success: false, error: e.toString() };
+				}
+			}
+			return { success: true, message: 'no cleanup function' };
+		})()
+	`
+
+	result, err := ext.VM.RunString(script)
+	if err != nil {
+		GoLog("[Extension] Cleanup error for %s: %v\n", extensionID, err)
+		return err
+	}
+
+	if result != nil && !goja.IsUndefined(result) {
+		exported := result.Export()
+		if resultMap, ok := exported.(map[string]interface{}); ok {
+			if success, ok := resultMap["success"].(bool); ok && !success {
+				errMsg := "unknown error"
+				if e, ok := resultMap["error"].(string); ok {
+					errMsg = e
+				}
+				GoLog("[Extension] Cleanup failed for %s: %s\n", extensionID, errMsg)
+				return fmt.Errorf("cleanup failed: %s", errMsg)
+			}
+		}
+	}
+
+	GoLog("[Extension] Cleaned up %s\n", extensionID)
+	return nil
+}
+
+// UnloadAllExtensions unloads all extensions gracefully
+func (m *ExtensionManager) UnloadAllExtensions() {
+	m.mu.Lock()
+	extensionIDs := make([]string, 0, len(m.extensions))
+	for id := range m.extensions {
+		extensionIDs = append(extensionIDs, id)
+	}
+	m.mu.Unlock()
+
+	for _, id := range extensionIDs {
+		m.CleanupExtension(id)
+		m.UnloadExtension(id)
+	}
+
+	GoLog("[Extension] All extensions unloaded\n")
+}
+
+// The function is called as extension.<actionName>() and can return a result
+func (m *ExtensionManager) InvokeAction(extensionID string, actionName string) (map[string]interface{}, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	ext, exists := m.extensions[extensionID]
+	if !exists {
+		return nil, fmt.Errorf("extension not found: %s", extensionID)
+	}
+
+	if ext.VM == nil {
+		return nil, fmt.Errorf("extension VM not initialized")
+	}
+
+	if !ext.Enabled {
+		return nil, fmt.Errorf("extension is disabled")
+	}
+
+	// Call the action function on the extension object
+	script := fmt.Sprintf(`
+		(function() {
+			if (typeof extension !== 'undefined' && typeof extension.%s === 'function') {
+				try {
+					var result = extension.%s();
+					if (result && typeof result.then === 'function') {
+						// Handle promise - return pending status
+						return { success: true, pending: true, message: 'Action started' };
+					}
+					return { success: true, result: result };
+				} catch (e) {
+					return { success: false, error: e.toString() };
+				}
+			}
+			return { success: false, error: 'Action function not found: %s' };
+		})()
+	`, actionName, actionName, actionName)
+
+	result, err := RunWithTimeoutAndRecover(ext.VM, script, DefaultJSTimeout)
+	if err != nil {
+		GoLog("[Extension] InvokeAction error for %s.%s: %v\n", extensionID, actionName, err)
+		return nil, fmt.Errorf("action failed: %v", err)
+	}
+
+	if result == nil || goja.IsUndefined(result) {
+		return map[string]interface{}{"success": true}, nil
+	}
+
+	exported := result.Export()
+	if resultMap, ok := exported.(map[string]interface{}); ok {
+		GoLog("[Extension] InvokeAction %s.%s result: %v\n", extensionID, actionName, resultMap)
+		return resultMap, nil
+	}
+
+	return map[string]interface{}{"success": true, "result": exported}, nil
+}

go_backend/extension_manifest.go

@@ -0,0 +1,315 @@
+// Package gobackend provides extension manifest parsing and validation
+package gobackend
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+// ExtensionType represents the type of extension
+type ExtensionType string
+
+const (
+	ExtensionTypeMetadataProvider ExtensionType = "metadata_provider"
+	ExtensionTypeDownloadProvider ExtensionType = "download_provider"
+)
+
+// SettingType represents the type of a setting field
+type SettingType string
+
+const (
+	SettingTypeString SettingType = "string"
+	SettingTypeNumber SettingType = "number"
+	SettingTypeBool   SettingType = "boolean"
+	SettingTypeSelect SettingType = "select"
+	SettingTypeButton SettingType = "button" // Action button that calls a JS function
+)
+
+// ExtensionPermissions defines what resources an extension can access
+type ExtensionPermissions struct {
+	Network []string `json:"network"` // List of allowed domains
+	Storage bool     `json:"storage"` // Whether extension can use storage API
+	File    bool     `json:"file"`    // Whether extension can use file API
+}
+
+// ExtensionSetting defines a configurable setting for an extension
+type ExtensionSetting struct {
+	Key         string      `json:"key"`
+	Type        SettingType `json:"type"`
+	Label       string      `json:"label"`
+	Description string      `json:"description,omitempty"`
+	Required    bool        `json:"required,omitempty"`
+	Secret      bool        `json:"secret,omitempty"`
+	Default     interface{} `json:"default,omitempty"`
+	Options     []string    `json:"options,omitempty"` // For select type
+	Action      string      `json:"action,omitempty"`  // For button type: JS function name to call (e.g., "startLogin")
+}
+
+// QualityOption represents a quality option for download providers
+type QualityOption struct {
+	ID          string                   `json:"id"`                 // Unique identifier (e.g., "mp3_320", "opus_128")
+	Label       string                   `json:"label"`              // Display name (e.g., "MP3 320kbps")
+	Description string                   `json:"description"`        // Optional description (e.g., "Best quality MP3")
+	Settings    []QualitySpecificSetting `json:"settings,omitempty"` // Quality-specific settings
+}
+
+// QualitySpecificSetting represents a setting that's specific to a quality option
+type QualitySpecificSetting struct {
+	Key         string      `json:"key"`
+	Type        SettingType `json:"type"`
+	Label       string      `json:"label"`
+	Description string      `json:"description,omitempty"`
+	Required    bool        `json:"required,omitempty"`
+	Secret      bool        `json:"secret,omitempty"`
+	Default     interface{} `json:"default,omitempty"`
+	Options     []string    `json:"options,omitempty"` // For select type
+}
+
+// SearchFilter defines a filter option for search
+type SearchFilter struct {
+	ID    string `json:"id"`              // Filter identifier (e.g., "track", "album", "artist", "playlist")
+	Label string `json:"label,omitempty"` // Display label (e.g., "Songs", "Albums", "Artists", "Playlists")
+	Icon  string `json:"icon,omitempty"`  // Optional icon name
+}
+
+// SearchBehaviorConfig defines custom search behavior for an extension
+type SearchBehaviorConfig struct {
+	Enabled         bool           `json:"enabled"`                   // Whether extension provides custom search
+	Placeholder     string         `json:"placeholder,omitempty"`     // Placeholder text for search box
+	Primary         bool           `json:"primary,omitempty"`         // If true, show as primary search tab
+	Icon            string         `json:"icon,omitempty"`            // Icon for search tab
+	ThumbnailRatio  string         `json:"thumbnailRatio,omitempty"`  // Thumbnail aspect ratio: "square" (1:1), "wide" (16:9), "portrait" (2:3)
+	ThumbnailWidth  int            `json:"thumbnailWidth,omitempty"`  // Custom thumbnail width in pixels
+	ThumbnailHeight int            `json:"thumbnailHeight,omitempty"` // Custom thumbnail height in pixels
+	Filters         []SearchFilter `json:"filters,omitempty"`         // Available search filters (e.g., track, album, artist, playlist)
+}
+
+// URLHandlerConfig defines custom URL handling for an extension
+type URLHandlerConfig struct {
+	Enabled  bool     `json:"enabled"`            // Whether extension handles URLs
+	Patterns []string `json:"patterns,omitempty"` // URL patterns to match (e.g., "music.youtube.com", "soundcloud.com")
+}
+
+// TrackMatchingConfig defines custom track matching behavior
+type TrackMatchingConfig struct {
+	CustomMatching    bool   `json:"customMatching"`              // Whether extension handles matching
+	Strategy          string `json:"strategy,omitempty"`          // "isrc", "name", "duration", "custom"
+	DurationTolerance int    `json:"durationTolerance,omitempty"` // Tolerance in seconds for duration matching
+}
+
+// PostProcessingHook defines a post-processing hook
+type PostProcessingHook struct {
+	ID               string   `json:"id"`                         // Unique identifier
+	Name             string   `json:"name"`                       // Display name
+	Description      string   `json:"description,omitempty"`      // Description
+	DefaultEnabled   bool     `json:"defaultEnabled,omitempty"`   // Whether enabled by default
+	SupportedFormats []string `json:"supportedFormats,omitempty"` // Supported file formats (e.g., ["flac", "mp3"])
+}
+
+// PostProcessingConfig defines post-processing capabilities
+type PostProcessingConfig struct {
+	Enabled bool                 `json:"enabled"`         // Whether extension provides post-processing
+	Hooks   []PostProcessingHook `json:"hooks,omitempty"` // Available hooks
+}
+
+// ExtensionManifest represents the manifest.json of an extension
+type ExtensionManifest struct {
+	Name                   string                 `json:"name"`
+	DisplayName            string                 `json:"displayName"`
+	Version                string                 `json:"version"`
+	Author                 string                 `json:"author"`
+	Description            string                 `json:"description"`
+	Homepage               string                 `json:"homepage,omitempty"`
+	Icon                   string                 `json:"icon,omitempty"` // Icon filename (e.g., "icon.png")
+	Types                  []ExtensionType        `json:"type"`
+	Permissions            ExtensionPermissions   `json:"permissions"`
+	Settings               []ExtensionSetting     `json:"settings,omitempty"`
+	QualityOptions         []QualityOption        `json:"qualityOptions,omitempty"` // Custom quality options for download providers
+	MinAppVersion          string                 `json:"minAppVersion,omitempty"`
+	SkipMetadataEnrichment bool                   `json:"skipMetadataEnrichment,omitempty"` // If true, don't enrich metadata from Deezer/Spotify
+	SkipBuiltInFallback    bool                   `json:"skipBuiltInFallback,omitempty"`    // If true, don't fallback to built-in providers (tidal/qobuz/amazon)
+	SearchBehavior         *SearchBehaviorConfig  `json:"searchBehavior,omitempty"`         // Custom search behavior
+	URLHandler             *URLHandlerConfig      `json:"urlHandler,omitempty"`             // Custom URL handling
+	TrackMatching          *TrackMatchingConfig   `json:"trackMatching,omitempty"`          // Custom track matching
+	PostProcessing         *PostProcessingConfig  `json:"postProcessing,omitempty"`         // Post-processing hooks
+	Capabilities           map[string]interface{} `json:"capabilities,omitempty"`           // Extension capabilities (homeFeed, browseCategories, etc.)
+}
+
+// ManifestValidationError represents a validation error in the manifest
+type ManifestValidationError struct {
+	Field   string
+	Message string
+}
+
+func (e *ManifestValidationError) Error() string {
+	return fmt.Sprintf("manifest validation error: %s - %s", e.Field, e.Message)
+}
+
+// ParseManifest parses and validates a manifest from JSON bytes
+func ParseManifest(data []byte) (*ExtensionManifest, error) {
+	var manifest ExtensionManifest
+	if err := json.Unmarshal(data, &manifest); err != nil {
+		return nil, fmt.Errorf("failed to parse manifest JSON: %w", err)
+	}
+
+	if err := manifest.Validate(); err != nil {
+		return nil, err
+	}
+
+	return &manifest, nil
+}
+
+func (m *ExtensionManifest) Validate() error {
+	if strings.TrimSpace(m.Name) == "" {
+		return &ManifestValidationError{Field: "name", Message: "name is required"}
+	}
+
+	if strings.TrimSpace(m.Version) == "" {
+		return &ManifestValidationError{Field: "version", Message: "version is required"}
+	}
+
+	if strings.TrimSpace(m.Author) == "" {
+		return &ManifestValidationError{Field: "author", Message: "author is required"}
+	}
+
+	if strings.TrimSpace(m.Description) == "" {
+		return &ManifestValidationError{Field: "description", Message: "description is required"}
+	}
+
+	if len(m.Types) == 0 {
+		return &ManifestValidationError{Field: "type", Message: "at least one type is required"}
+	}
+
+	for _, t := range m.Types {
+		if t != ExtensionTypeMetadataProvider && t != ExtensionTypeDownloadProvider {
+			return &ManifestValidationError{
+				Field:   "type",
+				Message: fmt.Sprintf("invalid extension type: %s (must be 'metadata_provider' or 'download_provider')", t),
+			}
+		}
+	}
+
+	// Validate settings if present
+	for i, setting := range m.Settings {
+		if strings.TrimSpace(setting.Key) == "" {
+			return &ManifestValidationError{
+				Field:   fmt.Sprintf("settings[%d].key", i),
+				Message: "setting key is required",
+			}
+		}
+
+		if setting.Type == "" {
+			return &ManifestValidationError{
+				Field:   fmt.Sprintf("settings[%d].type", i),
+				Message: "setting type is required",
+			}
+		}
+
+		// Select type requires options
+		if setting.Type == SettingTypeSelect && len(setting.Options) == 0 {
+			return &ManifestValidationError{
+				Field:   fmt.Sprintf("settings[%d].options", i),
+				Message: "select type requires options",
+			}
+		}
+
+		if setting.Type == SettingTypeButton && setting.Action == "" {
+			return &ManifestValidationError{
+				Field:   fmt.Sprintf("settings[%d].action", i),
+				Message: "button type requires action (JS function name)",
+			}
+		}
+	}
+
+	return nil
+}
+
+// HasType checks if the extension has a specific type
+func (m *ExtensionManifest) HasType(t ExtensionType) bool {
+	for _, et := range m.Types {
+		if et == t {
+			return true
+		}
+	}
+	return false
+}
+
+// IsMetadataProvider returns true if extension provides metadata
+func (m *ExtensionManifest) IsMetadataProvider() bool {
+	return m.HasType(ExtensionTypeMetadataProvider)
+}
+
+// IsDownloadProvider returns true if extension provides downloads
+func (m *ExtensionManifest) IsDownloadProvider() bool {
+	return m.HasType(ExtensionTypeDownloadProvider)
+}
+
+// IsDomainAllowed checks if a domain is in the allowed network permissions
+func (m *ExtensionManifest) IsDomainAllowed(domain string) bool {
+	domain = strings.ToLower(strings.TrimSpace(domain))
+	for _, allowed := range m.Permissions.Network {
+		allowed = strings.ToLower(strings.TrimSpace(allowed))
+		if allowed == domain {
+			return true
+		}
+		// Support wildcard subdomains (e.g., *.example.com)
+		if strings.HasPrefix(allowed, "*.") {
+			suffix := allowed[1:] // Remove the *
+			if strings.HasSuffix(domain, suffix) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// HasCustomSearch returns true if extension provides custom search
+func (m *ExtensionManifest) HasCustomSearch() bool {
+	return m.SearchBehavior != nil && m.SearchBehavior.Enabled
+}
+
+// HasCustomMatching returns true if extension provides custom track matching
+func (m *ExtensionManifest) HasCustomMatching() bool {
+	return m.TrackMatching != nil && m.TrackMatching.CustomMatching
+}
+
+// HasPostProcessing returns true if extension provides post-processing
+func (m *ExtensionManifest) HasPostProcessing() bool {
+	return m.PostProcessing != nil && m.PostProcessing.Enabled
+}
+
+// HasURLHandler returns true if extension handles custom URLs
+func (m *ExtensionManifest) HasURLHandler() bool {
+	return m.URLHandler != nil && m.URLHandler.Enabled && len(m.URLHandler.Patterns) > 0
+}
+
+// MatchesURL checks if a URL matches any of the extension's URL patterns
+func (m *ExtensionManifest) MatchesURL(urlStr string) bool {
+	if !m.HasURLHandler() {
+		return false
+	}
+
+	urlStr = strings.ToLower(strings.TrimSpace(urlStr))
+	for _, pattern := range m.URLHandler.Patterns {
+		pattern = strings.ToLower(strings.TrimSpace(pattern))
+		// Check if URL contains the pattern (host match)
+		if strings.Contains(urlStr, pattern) {
+			return true
+		}
+	}
+	return false
+}
+
+// GetPostProcessingHooks returns all post-processing hooks
+func (m *ExtensionManifest) GetPostProcessingHooks() []PostProcessingHook {
+	if m.PostProcessing == nil {
+		return nil
+	}
+	return m.PostProcessing.Hooks
+}
+
+// ToJSON serializes the manifest to JSON
+func (m *ExtensionManifest) ToJSON() ([]byte, error) {
+	return json.Marshal(m)
+}

go_backend/extension_runtime.go

@@ -0,0 +1,315 @@
+package gobackend
+
+import (
+	"net/http"
+	"net/url"
+	"sync"
+	"time"
+
+	"github.com/dop251/goja"
+)
+
+const DefaultJSTimeout = 30 * time.Second
+
+var (
+	extensionAuthState   = make(map[string]*ExtensionAuthState)
+	extensionAuthStateMu sync.RWMutex
+)
+
+type ExtensionAuthState struct {
+	PendingAuthURL  string
+	AuthCode        string
+	AccessToken     string
+	RefreshToken    string
+	ExpiresAt       time.Time
+	IsAuthenticated bool
+	// PKCE support
+	PKCEVerifier  string
+	PKCEChallenge string
+}
+
+type PendingAuthRequest struct {
+	ExtensionID string
+	AuthURL     string
+	CallbackURL string
+}
+
+var (
+	pendingAuthRequests   = make(map[string]*PendingAuthRequest)
+	pendingAuthRequestsMu sync.RWMutex
+)
+
+// GetPendingAuthRequest returns pending auth request for an extension (called from Flutter)
+func GetPendingAuthRequest(extensionID string) *PendingAuthRequest {
+	pendingAuthRequestsMu.RLock()
+	defer pendingAuthRequestsMu.RUnlock()
+	return pendingAuthRequests[extensionID]
+}
+
+func ClearPendingAuthRequest(extensionID string) {
+	pendingAuthRequestsMu.Lock()
+	defer pendingAuthRequestsMu.Unlock()
+	delete(pendingAuthRequests, extensionID)
+}
+
+func SetExtensionAuthCode(extensionID string, authCode string) {
+	extensionAuthStateMu.Lock()
+	defer extensionAuthStateMu.Unlock()
+
+	state, exists := extensionAuthState[extensionID]
+	if !exists {
+		state = &ExtensionAuthState{}
+		extensionAuthState[extensionID] = state
+	}
+	state.AuthCode = authCode
+}
+
+func SetExtensionTokens(extensionID string, accessToken, refreshToken string, expiresAt time.Time) {
+	extensionAuthStateMu.Lock()
+	defer extensionAuthStateMu.Unlock()
+
+	state, exists := extensionAuthState[extensionID]
+	if !exists {
+		state = &ExtensionAuthState{}
+		extensionAuthState[extensionID] = state
+	}
+	state.AccessToken = accessToken
+	state.RefreshToken = refreshToken
+	state.ExpiresAt = expiresAt
+	state.IsAuthenticated = accessToken != ""
+}
+
+type ExtensionRuntime struct {
+	extensionID string
+	manifest    *ExtensionManifest
+	settings    map[string]interface{}
+	httpClient  *http.Client
+	cookieJar   http.CookieJar
+	dataDir     string
+	vm          *goja.Runtime
+}
+
+func NewExtensionRuntime(ext *LoadedExtension) *ExtensionRuntime {
+	jar, _ := newSimpleCookieJar()
+
+	runtime := &ExtensionRuntime{
+		extensionID: ext.ID,
+		manifest:    ext.Manifest,
+		settings:    make(map[string]interface{}),
+		cookieJar:   jar,
+		dataDir:     ext.DataDir,
+		vm:          ext.VM,
+	}
+
+	client := &http.Client{
+		Timeout: 30 * time.Second,
+		Jar:     jar,
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			// Validate redirect target domain against allowed domains
+			domain := req.URL.Hostname()
+			if !ext.Manifest.IsDomainAllowed(domain) {
+				GoLog("[Extension:%s] Redirect blocked: domain '%s' not in allowed list\n", ext.ID, domain)
+				return &RedirectBlockedError{Domain: domain}
+			}
+			if isPrivateIP(domain) {
+				GoLog("[Extension:%s] Redirect blocked: private IP '%s'\n", ext.ID, domain)
+				return &RedirectBlockedError{Domain: domain, IsPrivate: true}
+			}
+			// Default redirect limit (10)
+			if len(via) >= 10 {
+				return http.ErrUseLastResponse
+			}
+			return nil
+		},
+	}
+	runtime.httpClient = client
+
+	return runtime
+}
+
+type RedirectBlockedError struct {
+	Domain    string
+	IsPrivate bool
+}
+
+func (e *RedirectBlockedError) Error() string {
+	if e.IsPrivate {
+		return "redirect blocked: private/local network access denied"
+	}
+	return "redirect blocked: domain '" + e.Domain + "' not in allowed list"
+}
+
+// isPrivateIP checks if a hostname resolves to a private/local IP address
+func isPrivateIP(host string) bool {
+	// Block common private network patterns
+	// This is a simple check - for production, consider DNS resolution
+	privatePatterns := []string{
+		"localhost",
+		"127.",
+		"10.",
+		"172.16.", "172.17.", "172.18.", "172.19.",
+		"172.20.", "172.21.", "172.22.", "172.23.",
+		"172.24.", "172.25.", "172.26.", "172.27.",
+		"172.28.", "172.29.", "172.30.", "172.31.",
+		"192.168.",
+		"169.254.",
+		"::1",
+		"fc00:",
+		"fe80:",
+	}
+
+	hostLower := host
+	for _, pattern := range privatePatterns {
+		if hostLower == pattern || len(hostLower) > len(pattern) && hostLower[:len(pattern)] == pattern {
+			return true
+		}
+	}
+
+	// Also block .local domains
+	if len(host) > 6 && host[len(host)-6:] == ".local" {
+		return true
+	}
+
+	return false
+}
+
+type simpleCookieJar struct {
+	cookies map[string][]*http.Cookie
+	mu      sync.RWMutex
+}
+
+func newSimpleCookieJar() (*simpleCookieJar, error) {
+	return &simpleCookieJar{
+		cookies: make(map[string][]*http.Cookie),
+	}, nil
+}
+
+func (j *simpleCookieJar) SetCookies(u *url.URL, cookies []*http.Cookie) {
+	j.mu.Lock()
+	defer j.mu.Unlock()
+	key := u.Host
+	j.cookies[key] = append(j.cookies[key], cookies...)
+}
+
+func (j *simpleCookieJar) Cookies(u *url.URL) []*http.Cookie {
+	j.mu.RLock()
+	defer j.mu.RUnlock()
+	return j.cookies[u.Host]
+}
+
+func (r *ExtensionRuntime) SetSettings(settings map[string]interface{}) {
+	r.settings = settings
+}
+
+// RegisterAPIs registers all sandboxed APIs to the Goja VM
+func (r *ExtensionRuntime) RegisterAPIs(vm *goja.Runtime) {
+	r.vm = vm
+
+	// HTTP client (sandboxed to allowed domains)
+	httpObj := vm.NewObject()
+	httpObj.Set("get", r.httpGet)
+	httpObj.Set("post", r.httpPost)
+	httpObj.Set("put", r.httpPut)
+	httpObj.Set("delete", r.httpDelete)
+	httpObj.Set("patch", r.httpPatch)
+	httpObj.Set("request", r.httpRequest) // Generic HTTP request (GET, POST, PUT, DELETE, etc.)
+	httpObj.Set("clearCookies", r.httpClearCookies)
+	vm.Set("http", httpObj)
+
+	storageObj := vm.NewObject()
+	storageObj.Set("get", r.storageGet)
+	storageObj.Set("set", r.storageSet)
+	storageObj.Set("remove", r.storageRemove)
+	vm.Set("storage", storageObj)
+
+	// Secure Credentials API (encrypted storage for sensitive data)
+	credentialsObj := vm.NewObject()
+	credentialsObj.Set("store", r.credentialsStore)
+	credentialsObj.Set("get", r.credentialsGet)
+	credentialsObj.Set("remove", r.credentialsRemove)
+	credentialsObj.Set("has", r.credentialsHas)
+	vm.Set("credentials", credentialsObj)
+
+	authObj := vm.NewObject()
+	authObj.Set("openAuthUrl", r.authOpenUrl)
+	authObj.Set("getAuthCode", r.authGetCode)
+	authObj.Set("setAuthCode", r.authSetCode)
+	authObj.Set("clearAuth", r.authClear)
+	authObj.Set("isAuthenticated", r.authIsAuthenticated)
+	authObj.Set("getTokens", r.authGetTokens)
+	// PKCE support
+	authObj.Set("generatePKCE", r.authGeneratePKCE)
+	authObj.Set("getPKCE", r.authGetPKCE)
+	authObj.Set("startOAuthWithPKCE", r.authStartOAuthWithPKCE)
+	authObj.Set("exchangeCodeWithPKCE", r.authExchangeCodeWithPKCE)
+	vm.Set("auth", authObj)
+
+	// File operations (sandboxed)
+	fileObj := vm.NewObject()
+	fileObj.Set("download", r.fileDownload)
+	fileObj.Set("exists", r.fileExists)
+	fileObj.Set("delete", r.fileDelete)
+	fileObj.Set("read", r.fileRead)
+	fileObj.Set("write", r.fileWrite)
+	fileObj.Set("copy", r.fileCopy)
+	fileObj.Set("move", r.fileMove)
+	fileObj.Set("getSize", r.fileGetSize)
+	vm.Set("file", fileObj)
+
+	ffmpegObj := vm.NewObject()
+	ffmpegObj.Set("execute", r.ffmpegExecute)
+	ffmpegObj.Set("getInfo", r.ffmpegGetInfo)
+	ffmpegObj.Set("convert", r.ffmpegConvert)
+	vm.Set("ffmpeg", ffmpegObj)
+
+	// Track matching API
+	matchingObj := vm.NewObject()
+	matchingObj.Set("compareStrings", r.matchingCompareStrings)
+	matchingObj.Set("compareDuration", r.matchingCompareDuration)
+	matchingObj.Set("normalizeString", r.matchingNormalizeString)
+	vm.Set("matching", matchingObj)
+
+	utilsObj := vm.NewObject()
+	utilsObj.Set("base64Encode", r.base64Encode)
+	utilsObj.Set("base64Decode", r.base64Decode)
+	utilsObj.Set("md5", r.md5Hash)
+	utilsObj.Set("sha256", r.sha256Hash)
+	utilsObj.Set("hmacSHA256", r.hmacSHA256)
+	utilsObj.Set("hmacSHA256Base64", r.hmacSHA256Base64)
+	utilsObj.Set("hmacSHA1", r.hmacSHA1)
+	utilsObj.Set("parseJSON", r.parseJSON)
+	utilsObj.Set("stringifyJSON", r.stringifyJSON)
+	// Crypto utilities for developers
+	utilsObj.Set("encrypt", r.cryptoEncrypt)
+	utilsObj.Set("decrypt", r.cryptoDecrypt)
+	utilsObj.Set("generateKey", r.cryptoGenerateKey)
+	utilsObj.Set("randomUserAgent", r.randomUserAgent)
+	vm.Set("utils", utilsObj)
+
+	// Log object (already set in extension_manager.go, but we can enhance it)
+	logObj := vm.NewObject()
+	logObj.Set("debug", r.logDebug)
+	logObj.Set("info", r.logInfo)
+	logObj.Set("warn", r.logWarn)
+	logObj.Set("error", r.logError)
+	vm.Set("log", logObj)
+
+	gobackendObj := vm.NewObject()
+	gobackendObj.Set("sanitizeFilename", r.sanitizeFilenameWrapper)
+	vm.Set("gobackend", gobackendObj)
+
+	// ==================== Browser-like Polyfills ====================
+	// These make porting browser/Node.js libraries easier
+
+	// Global fetch() - Promise-style HTTP API (browser-compatible)
+	vm.Set("fetch", r.fetchPolyfill)
+
+	vm.Set("atob", r.atobPolyfill)
+	vm.Set("btoa", r.btoaPolyfill)
+
+	r.registerTextEncoderDecoder(vm)
+
+	r.registerURLClass(vm)
+
+	r.registerJSONGlobal(vm)
+}

go_backend/extension_runtime_auth.go

@@ -0,0 +1,520 @@
+// Package gobackend provides Auth API and PKCE support for extension runtime
+package gobackend
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/dop251/goja"
+)
+
+// ==================== Auth API (OAuth Support) ====================
+
+func (r *ExtensionRuntime) authOpenUrl(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "auth URL is required",
+		})
+	}
+
+	authURL := call.Arguments[0].String()
+	callbackURL := ""
+	if len(call.Arguments) > 1 && !goja.IsUndefined(call.Arguments[1]) {
+		callbackURL = call.Arguments[1].String()
+	}
+
+	pendingAuthRequestsMu.Lock()
+	pendingAuthRequests[r.extensionID] = &PendingAuthRequest{
+		ExtensionID: r.extensionID,
+		AuthURL:     authURL,
+		CallbackURL: callbackURL,
+	}
+	pendingAuthRequestsMu.Unlock()
+
+	extensionAuthStateMu.Lock()
+	state, exists := extensionAuthState[r.extensionID]
+	if !exists {
+		state = &ExtensionAuthState{}
+		extensionAuthState[r.extensionID] = state
+	}
+	state.PendingAuthURL = authURL
+	state.AuthCode = ""
+	extensionAuthStateMu.Unlock()
+
+	GoLog("[Extension:%s] Auth URL requested: %s\n", r.extensionID, authURL)
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"message": "Auth URL will be opened by the app",
+	})
+}
+
+func (r *ExtensionRuntime) authGetCode(call goja.FunctionCall) goja.Value {
+	extensionAuthStateMu.RLock()
+	defer extensionAuthStateMu.RUnlock()
+
+	state, exists := extensionAuthState[r.extensionID]
+	if !exists || state.AuthCode == "" {
+		return goja.Undefined()
+	}
+
+	return r.vm.ToValue(state.AuthCode)
+}
+
+// authSetCode sets auth code and tokens (can be called by extension after token exchange)
+func (r *ExtensionRuntime) authSetCode(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(false)
+	}
+
+	// Can accept either just auth code or an object with tokens
+	arg := call.Arguments[0].Export()
+
+	extensionAuthStateMu.Lock()
+	defer extensionAuthStateMu.Unlock()
+
+	state, exists := extensionAuthState[r.extensionID]
+	if !exists {
+		state = &ExtensionAuthState{}
+		extensionAuthState[r.extensionID] = state
+	}
+
+	switch v := arg.(type) {
+	case string:
+		state.AuthCode = v
+	case map[string]interface{}:
+		if code, ok := v["code"].(string); ok {
+			state.AuthCode = code
+		}
+		if accessToken, ok := v["access_token"].(string); ok {
+			state.AccessToken = accessToken
+			state.IsAuthenticated = true
+		}
+		if refreshToken, ok := v["refresh_token"].(string); ok {
+			state.RefreshToken = refreshToken
+		}
+		if expiresIn, ok := v["expires_in"].(float64); ok {
+			state.ExpiresAt = time.Now().Add(time.Duration(expiresIn) * time.Second)
+		}
+	}
+
+	return r.vm.ToValue(true)
+}
+
+func (r *ExtensionRuntime) authClear(call goja.FunctionCall) goja.Value {
+	extensionAuthStateMu.Lock()
+	delete(extensionAuthState, r.extensionID)
+	extensionAuthStateMu.Unlock()
+
+	pendingAuthRequestsMu.Lock()
+	delete(pendingAuthRequests, r.extensionID)
+	pendingAuthRequestsMu.Unlock()
+
+	GoLog("[Extension:%s] Auth state cleared\n", r.extensionID)
+	return r.vm.ToValue(true)
+}
+
+// authIsAuthenticated checks if extension has valid auth
+func (r *ExtensionRuntime) authIsAuthenticated(call goja.FunctionCall) goja.Value {
+	extensionAuthStateMu.RLock()
+	defer extensionAuthStateMu.RUnlock()
+
+	state, exists := extensionAuthState[r.extensionID]
+	if !exists {
+		return r.vm.ToValue(false)
+	}
+
+	if state.IsAuthenticated && !state.ExpiresAt.IsZero() && time.Now().After(state.ExpiresAt) {
+		return r.vm.ToValue(false)
+	}
+
+	return r.vm.ToValue(state.IsAuthenticated)
+}
+
+func (r *ExtensionRuntime) authGetTokens(call goja.FunctionCall) goja.Value {
+	extensionAuthStateMu.RLock()
+	defer extensionAuthStateMu.RUnlock()
+
+	state, exists := extensionAuthState[r.extensionID]
+	if !exists {
+		return r.vm.ToValue(map[string]interface{}{})
+	}
+
+	result := map[string]interface{}{
+		"access_token":     state.AccessToken,
+		"refresh_token":    state.RefreshToken,
+		"is_authenticated": state.IsAuthenticated,
+	}
+
+	if !state.ExpiresAt.IsZero() {
+		result["expires_at"] = state.ExpiresAt.Unix()
+		result["is_expired"] = time.Now().After(state.ExpiresAt)
+	}
+
+	return r.vm.ToValue(result)
+}
+
+// ==================== PKCE Support ====================
+
+// generatePKCEVerifier generates a cryptographically random code verifier
+// Length should be between 43-128 characters (RFC 7636)
+func generatePKCEVerifier(length int) (string, error) {
+	if length < 43 {
+		length = 43
+	}
+	if length > 128 {
+		length = 128
+	}
+
+	bytes := make([]byte, length)
+	if _, err := rand.Read(bytes); err != nil {
+		return "", err
+	}
+
+	verifier := base64.RawURLEncoding.EncodeToString(bytes)
+
+	if len(verifier) > length {
+		verifier = verifier[:length]
+	}
+
+	return verifier, nil
+}
+
+func generatePKCEChallenge(verifier string) string {
+	hash := sha256.Sum256([]byte(verifier))
+	// Base64url encode without padding (RFC 7636)
+	return base64.RawURLEncoding.EncodeToString(hash[:])
+}
+
+func (r *ExtensionRuntime) authGeneratePKCE(call goja.FunctionCall) goja.Value {
+	// Default length is 64 characters
+	length := 64
+	if len(call.Arguments) > 0 && !goja.IsUndefined(call.Arguments[0]) {
+		if l, ok := call.Arguments[0].Export().(float64); ok && l >= 43 && l <= 128 {
+			length = int(l)
+		}
+	}
+
+	verifier, err := generatePKCEVerifier(length)
+	if err != nil {
+		GoLog("[Extension:%s] PKCE generation error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	challenge := generatePKCEChallenge(verifier)
+
+	extensionAuthStateMu.Lock()
+	state, exists := extensionAuthState[r.extensionID]
+	if !exists {
+		state = &ExtensionAuthState{}
+		extensionAuthState[r.extensionID] = state
+	}
+	state.PKCEVerifier = verifier
+	state.PKCEChallenge = challenge
+	extensionAuthStateMu.Unlock()
+
+	GoLog("[Extension:%s] PKCE generated (verifier length: %d)\n", r.extensionID, len(verifier))
+
+	return r.vm.ToValue(map[string]interface{}{
+		"verifier":  verifier,
+		"challenge": challenge,
+		"method":    "S256",
+	})
+}
+
+func (r *ExtensionRuntime) authGetPKCE(call goja.FunctionCall) goja.Value {
+	extensionAuthStateMu.RLock()
+	defer extensionAuthStateMu.RUnlock()
+
+	state, exists := extensionAuthState[r.extensionID]
+	if !exists || state.PKCEVerifier == "" {
+		return r.vm.ToValue(map[string]interface{}{})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"verifier":  state.PKCEVerifier,
+		"challenge": state.PKCEChallenge,
+		"method":    "S256",
+	})
+}
+
+// authStartOAuthWithPKCE is a high-level helper that generates PKCE and opens OAuth URL
+// config: { authUrl, clientId, redirectUri, scope, extraParams }
+// Returns: { success, authUrl, pkce: { verifier, challenge } }
+func (r *ExtensionRuntime) authStartOAuthWithPKCE(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "config object is required",
+		})
+	}
+
+	configObj := call.Arguments[0].Export()
+	config, ok := configObj.(map[string]interface{})
+	if !ok {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "config must be an object",
+		})
+	}
+
+	// Required fields
+	authURL, _ := config["authUrl"].(string)
+	clientID, _ := config["clientId"].(string)
+	redirectURI, _ := config["redirectUri"].(string)
+
+	if authURL == "" || clientID == "" || redirectURI == "" {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "authUrl, clientId, and redirectUri are required",
+		})
+	}
+
+	// Optional fields
+	scope, _ := config["scope"].(string)
+	extraParams, _ := config["extraParams"].(map[string]interface{})
+
+	// Generate PKCE
+	verifier, err := generatePKCEVerifier(64)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to generate PKCE: %v", err),
+		})
+	}
+	challenge := generatePKCEChallenge(verifier)
+
+	// Store PKCE in auth state
+	extensionAuthStateMu.Lock()
+	state, exists := extensionAuthState[r.extensionID]
+	if !exists {
+		state = &ExtensionAuthState{}
+		extensionAuthState[r.extensionID] = state
+	}
+	state.PKCEVerifier = verifier
+	state.PKCEChallenge = challenge
+	state.AuthCode = "" // Clear any previous auth code
+	extensionAuthStateMu.Unlock()
+
+	// Build OAuth URL with PKCE parameters
+	parsedURL, err := url.Parse(authURL)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("invalid authUrl: %v", err),
+		})
+	}
+
+	query := parsedURL.Query()
+	query.Set("client_id", clientID)
+	query.Set("redirect_uri", redirectURI)
+	query.Set("response_type", "code")
+	query.Set("code_challenge", challenge)
+	query.Set("code_challenge_method", "S256")
+
+	if scope != "" {
+		query.Set("scope", scope)
+	}
+
+	// Add extra params
+	for k, v := range extraParams {
+		query.Set(k, fmt.Sprintf("%v", v))
+	}
+
+	parsedURL.RawQuery = query.Encode()
+	fullAuthURL := parsedURL.String()
+
+	// Store pending auth request for Flutter
+	pendingAuthRequestsMu.Lock()
+	pendingAuthRequests[r.extensionID] = &PendingAuthRequest{
+		ExtensionID: r.extensionID,
+		AuthURL:     fullAuthURL,
+		CallbackURL: redirectURI,
+	}
+	pendingAuthRequestsMu.Unlock()
+
+	GoLog("[Extension:%s] PKCE OAuth started: %s\n", r.extensionID, fullAuthURL)
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"authUrl": fullAuthURL,
+		"pkce": map[string]interface{}{
+			"verifier":  verifier,
+			"challenge": challenge,
+			"method":    "S256",
+		},
+	})
+}
+
+// authExchangeCodeWithPKCE exchanges auth code for tokens using PKCE
+// config: { tokenUrl, clientId, redirectUri, code, extraParams }
+// Uses the stored PKCE verifier automatically
+func (r *ExtensionRuntime) authExchangeCodeWithPKCE(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "config object is required",
+		})
+	}
+
+	configObj := call.Arguments[0].Export()
+	config, ok := configObj.(map[string]interface{})
+	if !ok {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "config must be an object",
+		})
+	}
+
+	// Required fields
+	tokenURL, _ := config["tokenUrl"].(string)
+	clientID, _ := config["clientId"].(string)
+	redirectURI, _ := config["redirectUri"].(string)
+	code, _ := config["code"].(string)
+
+	if tokenURL == "" || clientID == "" || code == "" {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "tokenUrl, clientId, and code are required",
+		})
+	}
+
+	extensionAuthStateMu.RLock()
+	state, exists := extensionAuthState[r.extensionID]
+	var verifier string
+	if exists {
+		verifier = state.PKCEVerifier
+	}
+	extensionAuthStateMu.RUnlock()
+
+	if verifier == "" {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "no PKCE verifier found - call generatePKCE or startOAuthWithPKCE first",
+		})
+	}
+
+	if err := r.validateDomain(tokenURL); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	formData := url.Values{}
+	formData.Set("grant_type", "authorization_code")
+	formData.Set("client_id", clientID)
+	formData.Set("code", code)
+	formData.Set("code_verifier", verifier)
+	if redirectURI != "" {
+		formData.Set("redirect_uri", redirectURI)
+	}
+
+	if extraParams, ok := config["extraParams"].(map[string]interface{}); ok {
+		for k, v := range extraParams {
+			formData.Set(k, fmt.Sprintf("%v", v))
+		}
+	}
+
+	req, err := http.NewRequest("POST", tokenURL, strings.NewReader(formData.Encode()))
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("User-Agent", "SpotiFLAC-Extension/1.0")
+
+	resp, err := r.httpClient.Do(req)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	var tokenResp map[string]interface{}
+	if err := json.Unmarshal(body, &tokenResp); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to parse token response: %v", err),
+			"body":    string(body),
+		})
+	}
+
+	if errMsg, ok := tokenResp["error"].(string); ok {
+		errDesc, _ := tokenResp["error_description"].(string)
+		return r.vm.ToValue(map[string]interface{}{
+			"success":           false,
+			"error":             errMsg,
+			"error_description": errDesc,
+		})
+	}
+
+	accessToken, _ := tokenResp["access_token"].(string)
+	refreshToken, _ := tokenResp["refresh_token"].(string)
+	expiresIn, _ := tokenResp["expires_in"].(float64)
+
+	if accessToken == "" {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "no access_token in response",
+			"body":    string(body),
+		})
+	}
+
+	extensionAuthStateMu.Lock()
+	state, exists = extensionAuthState[r.extensionID]
+	if !exists {
+		state = &ExtensionAuthState{}
+		extensionAuthState[r.extensionID] = state
+	}
+	state.AccessToken = accessToken
+	state.RefreshToken = refreshToken
+	state.IsAuthenticated = true
+	if expiresIn > 0 {
+		state.ExpiresAt = time.Now().Add(time.Duration(expiresIn) * time.Second)
+	}
+	state.PKCEVerifier = ""
+	state.PKCEChallenge = ""
+	extensionAuthStateMu.Unlock()
+
+	GoLog("[Extension:%s] PKCE token exchange successful\n", r.extensionID)
+
+	result := map[string]interface{}{
+		"success":       true,
+		"access_token":  accessToken,
+		"refresh_token": refreshToken,
+		"token_type":    tokenResp["token_type"],
+	}
+	if expiresIn > 0 {
+		result["expires_in"] = expiresIn
+	}
+	if scope, ok := tokenResp["scope"].(string); ok {
+		result["scope"] = scope
+	}
+
+	return r.vm.ToValue(result)
+}

go_backend/extension_runtime_ffmpeg.go

@@ -0,0 +1,198 @@
+// Package gobackend provides FFmpeg API for extension runtime
+package gobackend
+
+import (
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/dop251/goja"
+)
+
+// ==================== FFmpeg API (Post-Processing) ====================
+
+// FFmpegCommand holds a pending FFmpeg command for Flutter to execute
+type FFmpegCommand struct {
+	ExtensionID string
+	Command     string
+	InputPath   string
+	OutputPath  string
+	Completed   bool
+	Success     bool
+	Error       string
+	Output      string
+}
+
+// Global FFmpeg command queue
+var (
+	ffmpegCommands   = make(map[string]*FFmpegCommand)
+	ffmpegCommandsMu sync.RWMutex
+	ffmpegCommandID  int64
+)
+
+func GetPendingFFmpegCommand(commandID string) *FFmpegCommand {
+	ffmpegCommandsMu.RLock()
+	defer ffmpegCommandsMu.RUnlock()
+	return ffmpegCommands[commandID]
+}
+
+func SetFFmpegCommandResult(commandID string, success bool, output, errorMsg string) {
+	ffmpegCommandsMu.Lock()
+	defer ffmpegCommandsMu.Unlock()
+	if cmd, exists := ffmpegCommands[commandID]; exists {
+		cmd.Completed = true
+		cmd.Success = success
+		cmd.Output = output
+		cmd.Error = errorMsg
+	}
+}
+
+func ClearFFmpegCommand(commandID string) {
+	ffmpegCommandsMu.Lock()
+	defer ffmpegCommandsMu.Unlock()
+	delete(ffmpegCommands, commandID)
+}
+
+func (r *ExtensionRuntime) ffmpegExecute(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "command is required",
+		})
+	}
+
+	command := call.Arguments[0].String()
+
+	// Generate unique command ID
+	ffmpegCommandsMu.Lock()
+	ffmpegCommandID++
+	cmdID := fmt.Sprintf("%s_%d", r.extensionID, ffmpegCommandID)
+	ffmpegCommands[cmdID] = &FFmpegCommand{
+		ExtensionID: r.extensionID,
+		Command:     command,
+		Completed:   false,
+	}
+	ffmpegCommandsMu.Unlock()
+
+	GoLog("[Extension:%s] FFmpeg command queued: %s\n", r.extensionID, cmdID)
+
+	// Wait for completion (with timeout)
+	timeout := 5 * time.Minute
+	start := time.Now()
+	for {
+		ffmpegCommandsMu.RLock()
+		cmd := ffmpegCommands[cmdID]
+		completed := cmd != nil && cmd.Completed
+		ffmpegCommandsMu.RUnlock()
+
+		if completed {
+			ffmpegCommandsMu.RLock()
+			result := map[string]interface{}{
+				"success": cmd.Success,
+				"output":  cmd.Output,
+			}
+			if cmd.Error != "" {
+				result["error"] = cmd.Error
+			}
+			ffmpegCommandsMu.RUnlock()
+
+			// Cleanup
+			ClearFFmpegCommand(cmdID)
+			return r.vm.ToValue(result)
+		}
+
+		if time.Since(start) > timeout {
+			ClearFFmpegCommand(cmdID)
+			return r.vm.ToValue(map[string]interface{}{
+				"success": false,
+				"error":   "FFmpeg command timed out",
+			})
+		}
+
+		time.Sleep(100 * time.Millisecond)
+	}
+}
+
+func (r *ExtensionRuntime) ffmpegGetInfo(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "file path is required",
+		})
+	}
+
+	filePath := call.Arguments[0].String()
+
+	// Use Go's built-in audio quality function
+	quality, err := GetAudioQuality(filePath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success":       true,
+		"bit_depth":     quality.BitDepth,
+		"sample_rate":   quality.SampleRate,
+		"total_samples": quality.TotalSamples,
+		"duration":      float64(quality.TotalSamples) / float64(quality.SampleRate),
+	})
+}
+
+func (r *ExtensionRuntime) ffmpegConvert(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "input and output paths are required",
+		})
+	}
+
+	inputPath := call.Arguments[0].String()
+	outputPath := call.Arguments[1].String()
+
+	// Get options if provided
+	options := map[string]interface{}{}
+	if len(call.Arguments) > 2 && !goja.IsUndefined(call.Arguments[2]) && !goja.IsNull(call.Arguments[2]) {
+		if opts, ok := call.Arguments[2].Export().(map[string]interface{}); ok {
+			options = opts
+		}
+	}
+
+	// Build FFmpeg command
+	var cmdParts []string
+	cmdParts = append(cmdParts, "-i", fmt.Sprintf("%q", inputPath))
+
+	// Audio codec
+	if codec, ok := options["codec"].(string); ok {
+		cmdParts = append(cmdParts, "-c:a", codec)
+	}
+
+	// Bitrate
+	if bitrate, ok := options["bitrate"].(string); ok {
+		cmdParts = append(cmdParts, "-b:a", bitrate)
+	}
+
+	// Sample rate
+	if sampleRate, ok := options["sample_rate"].(float64); ok {
+		cmdParts = append(cmdParts, "-ar", fmt.Sprintf("%d", int(sampleRate)))
+	}
+
+	// Channels
+	if channels, ok := options["channels"].(float64); ok {
+		cmdParts = append(cmdParts, "-ac", fmt.Sprintf("%d", int(channels)))
+	}
+
+	// Overwrite output
+	cmdParts = append(cmdParts, "-y", fmt.Sprintf("%q", outputPath))
+
+	command := strings.Join(cmdParts, " ")
+
+	// Execute via ffmpegExecute
+	execCall := goja.FunctionCall{
+		Arguments: []goja.Value{r.vm.ToValue(command)},
+	}
+	return r.ffmpegExecute(execCall)
+}

go_backend/extension_runtime_file.go

@@ -0,0 +1,485 @@
+// Package gobackend provides File API for extension runtime
+package gobackend
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"github.com/dop251/goja"
+)
+
+// ==================== File API (Sandboxed) ====================
+
+// List of allowed directories for file operations (set by Go backend for download operations)
+var (
+	allowedDownloadDirs   []string
+	allowedDownloadDirsMu sync.RWMutex
+)
+
+func SetAllowedDownloadDirs(dirs []string) {
+	allowedDownloadDirsMu.Lock()
+	defer allowedDownloadDirsMu.Unlock()
+	allowedDownloadDirs = dirs
+	GoLog("[Extension] Allowed download directories set: %v\n", dirs)
+}
+
+func AddAllowedDownloadDir(dir string) {
+	allowedDownloadDirsMu.Lock()
+	defer allowedDownloadDirsMu.Unlock()
+	absDir, err := filepath.Abs(dir)
+	if err == nil {
+		allowedDownloadDirs = append(allowedDownloadDirs, absDir)
+	}
+}
+
+func isPathInAllowedDirs(absPath string) bool {
+	allowedDownloadDirsMu.RLock()
+	defer allowedDownloadDirsMu.RUnlock()
+
+	for _, allowedDir := range allowedDownloadDirs {
+		if strings.HasPrefix(absPath, allowedDir) {
+			return true
+		}
+	}
+	return false
+}
+
+// validatePath checks if the path is within the extension's sandbox
+// Security: Absolute paths are BLOCKED unless they're in allowed download directories
+// Extensions should use relative paths for their own data storage
+func (r *ExtensionRuntime) validatePath(path string) (string, error) {
+	// Check if extension has file permission
+	if !r.manifest.Permissions.File {
+		return "", fmt.Errorf("file access denied: extension does not have 'file' permission")
+	}
+
+	cleanPath := filepath.Clean(path)
+
+	if filepath.IsAbs(cleanPath) {
+		absPath, err := filepath.Abs(cleanPath)
+		if err != nil {
+			return "", fmt.Errorf("invalid path: %w", err)
+		}
+
+		if isPathInAllowedDirs(absPath) {
+			return absPath, nil
+		}
+
+		return "", fmt.Errorf("file access denied: absolute paths are not allowed. Use relative paths within extension sandbox")
+	}
+
+	fullPath := filepath.Join(r.dataDir, cleanPath)
+
+	absPath, err := filepath.Abs(fullPath)
+	if err != nil {
+		return "", fmt.Errorf("invalid path: %w", err)
+	}
+
+	absDataDir, _ := filepath.Abs(r.dataDir)
+	if !strings.HasPrefix(absPath, absDataDir) {
+		return "", fmt.Errorf("file access denied: path '%s' is outside sandbox", path)
+	}
+
+	return absPath, nil
+}
+
+func (r *ExtensionRuntime) fileDownload(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "URL and output path are required",
+		})
+	}
+
+	urlStr := call.Arguments[0].String()
+	outputPath := call.Arguments[1].String()
+
+	if err := r.validateDomain(urlStr); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	fullPath, err := r.validatePath(outputPath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	var onProgress goja.Callable
+	var headers map[string]string
+	if len(call.Arguments) > 2 && !goja.IsUndefined(call.Arguments[2]) && !goja.IsNull(call.Arguments[2]) {
+		optionsObj := call.Arguments[2].Export()
+		if opts, ok := optionsObj.(map[string]interface{}); ok {
+			if h, ok := opts["headers"].(map[string]interface{}); ok {
+				headers = make(map[string]string)
+				for k, v := range h {
+					headers[k] = fmt.Sprintf("%v", v)
+				}
+			}
+			if progressVal, ok := opts["onProgress"]; ok {
+				if callable, ok := goja.AssertFunction(r.vm.ToValue(progressVal)); ok {
+					onProgress = callable
+				}
+			}
+		}
+	}
+
+	dir := filepath.Dir(fullPath)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to create directory: %v", err),
+		})
+	}
+
+	req, err := http.NewRequest("GET", urlStr, nil)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	if req.Header.Get("User-Agent") == "" {
+		req.Header.Set("User-Agent", "SpotiFLAC-Extension/1.0")
+	}
+
+	resp, err := r.httpClient.Do(req)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != 200 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("HTTP error: %d", resp.StatusCode),
+		})
+	}
+
+	out, err := os.Create(fullPath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to create file: %v", err),
+		})
+	}
+	defer out.Close()
+
+	contentLength := resp.ContentLength
+
+	var written int64
+	buf := make([]byte, 32*1024)
+	for {
+		nr, er := resp.Body.Read(buf)
+		if nr > 0 {
+			nw, ew := out.Write(buf[0:nr])
+			if nw < 0 || nr < nw {
+				nw = 0
+				if ew == nil {
+					ew = fmt.Errorf("invalid write result")
+				}
+			}
+			written += int64(nw)
+			if ew != nil {
+				return r.vm.ToValue(map[string]interface{}{
+					"success": false,
+					"error":   fmt.Sprintf("failed to write file: %v", ew),
+				})
+			}
+			if nr != nw {
+				return r.vm.ToValue(map[string]interface{}{
+					"success": false,
+					"error":   "short write",
+				})
+			}
+
+			if onProgress != nil && contentLength > 0 {
+				_, _ = onProgress(goja.Undefined(), r.vm.ToValue(written), r.vm.ToValue(contentLength))
+			}
+		}
+		if er != nil {
+			if er != io.EOF {
+				return r.vm.ToValue(map[string]interface{}{
+					"success": false,
+					"error":   fmt.Sprintf("failed to read response: %v", er),
+				})
+			}
+			break
+		}
+	}
+
+	GoLog("[Extension:%s] Downloaded %d bytes to %s\n", r.extensionID, written, fullPath)
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"path":    fullPath,
+		"size":    written,
+	})
+}
+
+func (r *ExtensionRuntime) fileExists(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(false)
+	}
+
+	path := call.Arguments[0].String()
+	fullPath, err := r.validatePath(path)
+	if err != nil {
+		return r.vm.ToValue(false)
+	}
+
+	_, err = os.Stat(fullPath)
+	return r.vm.ToValue(err == nil)
+}
+
+func (r *ExtensionRuntime) fileDelete(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "path is required",
+		})
+	}
+
+	path := call.Arguments[0].String()
+	fullPath, err := r.validatePath(path)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	if err := os.Remove(fullPath); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+	})
+}
+
+func (r *ExtensionRuntime) fileRead(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "path is required",
+		})
+	}
+
+	path := call.Arguments[0].String()
+	fullPath, err := r.validatePath(path)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	data, err := os.ReadFile(fullPath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"data":    string(data),
+	})
+}
+
+func (r *ExtensionRuntime) fileWrite(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "path and data are required",
+		})
+	}
+
+	path := call.Arguments[0].String()
+	data := call.Arguments[1].String()
+
+	fullPath, err := r.validatePath(path)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	// Create directory if needed
+	dir := filepath.Dir(fullPath)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to create directory: %v", err),
+		})
+	}
+
+	if err := os.WriteFile(fullPath, []byte(data), 0644); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"path":    fullPath,
+	})
+}
+
+func (r *ExtensionRuntime) fileCopy(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "source and destination paths are required",
+		})
+	}
+
+	srcPath := call.Arguments[0].String()
+	dstPath := call.Arguments[1].String()
+
+	fullSrc, err := r.validatePath(srcPath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	fullDst, err := r.validatePath(dstPath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	data, err := os.ReadFile(fullSrc)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to read source: %v", err),
+		})
+	}
+
+	dir := filepath.Dir(fullDst)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to create directory: %v", err),
+		})
+	}
+
+	if err := os.WriteFile(fullDst, data, 0644); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to write destination: %v", err),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"path":    fullDst,
+	})
+}
+
+func (r *ExtensionRuntime) fileMove(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "source and destination paths are required",
+		})
+	}
+
+	srcPath := call.Arguments[0].String()
+	dstPath := call.Arguments[1].String()
+
+	fullSrc, err := r.validatePath(srcPath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	fullDst, err := r.validatePath(dstPath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	dir := filepath.Dir(fullDst)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to create directory: %v", err),
+		})
+	}
+
+	if err := os.Rename(fullSrc, fullDst); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   fmt.Sprintf("failed to move file: %v", err),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"path":    fullDst,
+	})
+}
+
+func (r *ExtensionRuntime) fileGetSize(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "path is required",
+		})
+	}
+
+	path := call.Arguments[0].String()
+	fullPath, err := r.validatePath(path)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	info, err := os.Stat(fullPath)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"size":    info.Size(),
+	})
+}

go_backend/extension_runtime_http.go

@@ -0,0 +1,489 @@
+// Package gobackend provides HTTP API for extension runtime
+package gobackend
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/dop251/goja"
+)
+
+// ==================== HTTP API (Sandboxed) ====================
+
+// HTTPResponse represents the response from an HTTP request
+type HTTPResponse struct {
+	StatusCode int               `json:"statusCode"`
+	Body       string            `json:"body"`
+	Headers    map[string]string `json:"headers"`
+}
+
+// validateDomain checks if the domain is allowed by the extension's permissions
+func (r *ExtensionRuntime) validateDomain(urlStr string) error {
+	parsed, err := url.Parse(urlStr)
+	if err != nil {
+		return fmt.Errorf("invalid URL: %w", err)
+	}
+
+	domain := parsed.Hostname()
+
+	// Block private/local network access (SSRF protection)
+	if isPrivateIP(domain) {
+		return fmt.Errorf("network access denied: private/local network '%s' not allowed", domain)
+	}
+
+	if !r.manifest.IsDomainAllowed(domain) {
+		return fmt.Errorf("network access denied: domain '%s' not in allowed list", domain)
+	}
+
+	return nil
+}
+
+// httpGet performs a GET request (sandboxed)
+func (r *ExtensionRuntime) httpGet(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": "URL is required",
+		})
+	}
+
+	urlStr := call.Arguments[0].String()
+
+	if err := r.validateDomain(urlStr); err != nil {
+		GoLog("[Extension:%s] HTTP blocked: %v\n", r.extensionID, err)
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	headers := make(map[string]string)
+	if len(call.Arguments) > 1 && !goja.IsUndefined(call.Arguments[1]) && !goja.IsNull(call.Arguments[1]) {
+		headersObj := call.Arguments[1].Export()
+		if h, ok := headersObj.(map[string]interface{}); ok {
+			for k, v := range h {
+				headers[k] = fmt.Sprintf("%v", v)
+			}
+		}
+	}
+
+	req, err := http.NewRequest("GET", urlStr, nil)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Set headers - user headers first
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	// Only set default User-Agent if not provided by extension
+	if req.Header.Get("User-Agent") == "" {
+		req.Header.Set("User-Agent", "Spotiflac-Extension/1.0")
+	}
+
+	// Execute request
+	resp, err := r.httpClient.Do(req)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Extract response headers - return all values as arrays for multi-value headers (cookies, etc.)
+	respHeaders := make(map[string]interface{})
+	for k, v := range resp.Header {
+		if len(v) == 1 {
+			respHeaders[k] = v[0]
+		} else {
+			respHeaders[k] = v // Return as array if multiple values
+		}
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"statusCode": resp.StatusCode,
+		"status":     resp.StatusCode, // Alias for convenience
+		"ok":         resp.StatusCode >= 200 && resp.StatusCode < 300,
+		"body":       string(body),
+		"headers":    respHeaders,
+	})
+}
+
+// httpPost performs a POST request (sandboxed)
+func (r *ExtensionRuntime) httpPost(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": "URL is required",
+		})
+	}
+
+	urlStr := call.Arguments[0].String()
+
+	if err := r.validateDomain(urlStr); err != nil {
+		GoLog("[Extension:%s] HTTP blocked: %v\n", r.extensionID, err)
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Get body if provided - support both string and object
+	var bodyStr string
+	if len(call.Arguments) > 1 && !goja.IsUndefined(call.Arguments[1]) && !goja.IsNull(call.Arguments[1]) {
+		bodyArg := call.Arguments[1].Export()
+		switch v := bodyArg.(type) {
+		case string:
+			bodyStr = v
+		case map[string]interface{}, []interface{}:
+			// Auto-stringify objects and arrays to JSON
+			jsonBytes, err := json.Marshal(v)
+			if err != nil {
+				return r.vm.ToValue(map[string]interface{}{
+					"error": fmt.Sprintf("failed to stringify body: %v", err),
+				})
+			}
+			bodyStr = string(jsonBytes)
+		default:
+			// Fallback to string conversion
+			bodyStr = call.Arguments[1].String()
+		}
+	}
+
+	// Get headers if provided
+	headers := make(map[string]string)
+	if len(call.Arguments) > 2 && !goja.IsUndefined(call.Arguments[2]) && !goja.IsNull(call.Arguments[2]) {
+		headersObj := call.Arguments[2].Export()
+		if h, ok := headersObj.(map[string]interface{}); ok {
+			for k, v := range h {
+				headers[k] = fmt.Sprintf("%v", v)
+			}
+		}
+	}
+
+	req, err := http.NewRequest("POST", urlStr, strings.NewReader(bodyStr))
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Set headers - user headers first
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	// Only set defaults if not provided by extension
+	if req.Header.Get("User-Agent") == "" {
+		req.Header.Set("User-Agent", "Spotiflac-Extension/1.0")
+	}
+	if req.Header.Get("Content-Type") == "" {
+		req.Header.Set("Content-Type", "application/json")
+	}
+
+	// Execute request
+	resp, err := r.httpClient.Do(req)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Extract response headers - return all values as arrays for multi-value headers
+	respHeaders := make(map[string]interface{})
+	for k, v := range resp.Header {
+		if len(v) == 1 {
+			respHeaders[k] = v[0]
+		} else {
+			respHeaders[k] = v // Return as array if multiple values
+		}
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"statusCode": resp.StatusCode,
+		"status":     resp.StatusCode, // Alias for convenience
+		"ok":         resp.StatusCode >= 200 && resp.StatusCode < 300,
+		"body":       string(body),
+		"headers":    respHeaders,
+	})
+}
+
+func (r *ExtensionRuntime) httpRequest(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": "URL is required",
+		})
+	}
+
+	urlStr := call.Arguments[0].String()
+
+	if err := r.validateDomain(urlStr); err != nil {
+		GoLog("[Extension:%s] HTTP blocked: %v\n", r.extensionID, err)
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Default options
+	method := "GET"
+	var bodyStr string
+	headers := make(map[string]string)
+
+	// Parse options if provided
+	if len(call.Arguments) > 1 && !goja.IsUndefined(call.Arguments[1]) && !goja.IsNull(call.Arguments[1]) {
+		optionsObj := call.Arguments[1].Export()
+		if opts, ok := optionsObj.(map[string]interface{}); ok {
+			// Get method
+			if m, ok := opts["method"].(string); ok {
+				method = strings.ToUpper(m)
+			}
+
+			// Get body - support both string and object
+			if bodyArg, ok := opts["body"]; ok && bodyArg != nil {
+				switch v := bodyArg.(type) {
+				case string:
+					bodyStr = v
+				case map[string]interface{}, []interface{}:
+					// Auto-stringify objects and arrays to JSON
+					jsonBytes, err := json.Marshal(v)
+					if err != nil {
+						return r.vm.ToValue(map[string]interface{}{
+							"error": fmt.Sprintf("failed to stringify body: %v", err),
+						})
+					}
+					bodyStr = string(jsonBytes)
+				default:
+					bodyStr = fmt.Sprintf("%v", v)
+				}
+			}
+
+			// Get headers
+			if h, ok := opts["headers"].(map[string]interface{}); ok {
+				for k, v := range h {
+					headers[k] = fmt.Sprintf("%v", v)
+				}
+			}
+		}
+	}
+
+	// Create request
+	var reqBody io.Reader
+	if bodyStr != "" {
+		reqBody = strings.NewReader(bodyStr)
+	}
+
+	req, err := http.NewRequest(method, urlStr, reqBody)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Set headers - user headers first
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	// Only set defaults if not provided by extension
+	if req.Header.Get("User-Agent") == "" {
+		req.Header.Set("User-Agent", "Spotiflac-Extension/1.0")
+	}
+	if bodyStr != "" && req.Header.Get("Content-Type") == "" {
+		req.Header.Set("Content-Type", "application/json")
+	}
+
+	// Execute request
+	resp, err := r.httpClient.Do(req)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Extract response headers - return all values as arrays for multi-value headers
+	respHeaders := make(map[string]interface{})
+	for k, v := range resp.Header {
+		if len(v) == 1 {
+			respHeaders[k] = v[0]
+		} else {
+			respHeaders[k] = v // Return as array if multiple values
+		}
+	}
+
+	// Return response with helper properties
+	return r.vm.ToValue(map[string]interface{}{
+		"statusCode": resp.StatusCode,
+		"status":     resp.StatusCode, // Alias for convenience
+		"ok":         resp.StatusCode >= 200 && resp.StatusCode < 300,
+		"body":       string(body),
+		"headers":    respHeaders,
+	})
+}
+
+func (r *ExtensionRuntime) httpPut(call goja.FunctionCall) goja.Value {
+	return r.httpMethodShortcut("PUT", call)
+}
+
+// httpDelete performs a DELETE request (shortcut for http.request with method: "DELETE")
+func (r *ExtensionRuntime) httpDelete(call goja.FunctionCall) goja.Value {
+	return r.httpMethodShortcut("DELETE", call)
+}
+
+func (r *ExtensionRuntime) httpPatch(call goja.FunctionCall) goja.Value {
+	return r.httpMethodShortcut("PATCH", call)
+}
+
+// httpMethodShortcut is a helper for PUT/DELETE/PATCH shortcuts
+// Signature: http.put(url, body, headers) / http.delete(url, headers) / http.patch(url, body, headers)
+func (r *ExtensionRuntime) httpMethodShortcut(method string, call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": "URL is required",
+		})
+	}
+
+	urlStr := call.Arguments[0].String()
+
+	if err := r.validateDomain(urlStr); err != nil {
+		GoLog("[Extension:%s] HTTP blocked: %v\n", r.extensionID, err)
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	var bodyStr string
+	headers := make(map[string]string)
+
+	// For DELETE, second arg is headers; for PUT/PATCH, second arg is body
+	if method == "DELETE" {
+		// http.delete(url, headers)
+		if len(call.Arguments) > 1 && !goja.IsUndefined(call.Arguments[1]) && !goja.IsNull(call.Arguments[1]) {
+			headersObj := call.Arguments[1].Export()
+			if h, ok := headersObj.(map[string]interface{}); ok {
+				for k, v := range h {
+					headers[k] = fmt.Sprintf("%v", v)
+				}
+			}
+		}
+	} else {
+		// http.put(url, body, headers) / http.patch(url, body, headers)
+		if len(call.Arguments) > 1 && !goja.IsUndefined(call.Arguments[1]) && !goja.IsNull(call.Arguments[1]) {
+			bodyArg := call.Arguments[1].Export()
+			switch v := bodyArg.(type) {
+			case string:
+				bodyStr = v
+			case map[string]interface{}, []interface{}:
+				jsonBytes, err := json.Marshal(v)
+				if err != nil {
+					return r.vm.ToValue(map[string]interface{}{
+						"error": fmt.Sprintf("failed to stringify body: %v", err),
+					})
+				}
+				bodyStr = string(jsonBytes)
+			default:
+				bodyStr = call.Arguments[1].String()
+			}
+		}
+
+		if len(call.Arguments) > 2 && !goja.IsUndefined(call.Arguments[2]) && !goja.IsNull(call.Arguments[2]) {
+			headersObj := call.Arguments[2].Export()
+			if h, ok := headersObj.(map[string]interface{}); ok {
+				for k, v := range h {
+					headers[k] = fmt.Sprintf("%v", v)
+				}
+			}
+		}
+	}
+
+	// Create request
+	var reqBody io.Reader
+	if bodyStr != "" {
+		reqBody = strings.NewReader(bodyStr)
+	}
+
+	req, err := http.NewRequest(method, urlStr, reqBody)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Set headers - user headers first
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	if req.Header.Get("User-Agent") == "" {
+		req.Header.Set("User-Agent", "Spotiflac-Extension/1.0")
+	}
+	if bodyStr != "" && req.Header.Get("Content-Type") == "" {
+		req.Header.Set("Content-Type", "application/json")
+	}
+
+	// Execute request
+	resp, err := r.httpClient.Do(req)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"error": err.Error(),
+		})
+	}
+
+	// Extract response headers
+	respHeaders := make(map[string]interface{})
+	for k, v := range resp.Header {
+		if len(v) == 1 {
+			respHeaders[k] = v[0]
+		} else {
+			respHeaders[k] = v
+		}
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"statusCode": resp.StatusCode,
+		"status":     resp.StatusCode,
+		"ok":         resp.StatusCode >= 200 && resp.StatusCode < 300,
+		"body":       string(body),
+		"headers":    respHeaders,
+	})
+}
+
+func (r *ExtensionRuntime) httpClearCookies(call goja.FunctionCall) goja.Value {
+	if jar, ok := r.cookieJar.(*simpleCookieJar); ok {
+		jar.mu.Lock()
+		jar.cookies = make(map[string][]*http.Cookie)
+		jar.mu.Unlock()
+		GoLog("[Extension:%s] Cookies cleared\n", r.extensionID)
+		return r.vm.ToValue(true)
+	}
+	return r.vm.ToValue(false)
+}

go_backend/extension_runtime_matching.go

@@ -0,0 +1,151 @@
+// Package gobackend provides Track Matching API for extension runtime
+package gobackend
+
+import (
+	"strings"
+
+	"github.com/dop251/goja"
+)
+
+// ==================== Track Matching API ====================
+
+// matchingCompareStrings compares two strings with fuzzy matching
+func (r *ExtensionRuntime) matchingCompareStrings(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(0.0)
+	}
+
+	str1 := strings.ToLower(strings.TrimSpace(call.Arguments[0].String()))
+	str2 := strings.ToLower(strings.TrimSpace(call.Arguments[1].String()))
+
+	if str1 == str2 {
+		return r.vm.ToValue(1.0)
+	}
+
+	// Calculate Levenshtein distance-based similarity
+	similarity := calculateStringSimilarity(str1, str2)
+	return r.vm.ToValue(similarity)
+}
+
+// matchingCompareDuration compares two durations with tolerance
+func (r *ExtensionRuntime) matchingCompareDuration(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(false)
+	}
+
+	dur1 := int(call.Arguments[0].ToInteger())
+	dur2 := int(call.Arguments[1].ToInteger())
+
+	// Default tolerance: 3 seconds
+	tolerance := 3000 // milliseconds
+	if len(call.Arguments) > 2 && !goja.IsUndefined(call.Arguments[2]) {
+		tolerance = int(call.Arguments[2].ToInteger())
+	}
+
+	diff := dur1 - dur2
+	if diff < 0 {
+		diff = -diff
+	}
+
+	return r.vm.ToValue(diff <= tolerance)
+}
+
+// matchingNormalizeString normalizes a string for comparison
+func (r *ExtensionRuntime) matchingNormalizeString(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+
+	str := call.Arguments[0].String()
+	normalized := normalizeStringForMatching(str)
+	return r.vm.ToValue(normalized)
+}
+
+// calculateStringSimilarity calculates similarity between two strings (0-1)
+func calculateStringSimilarity(s1, s2 string) float64 {
+	if len(s1) == 0 && len(s2) == 0 {
+		return 1.0
+	}
+	if len(s1) == 0 || len(s2) == 0 {
+		return 0.0
+	}
+
+	// Use Levenshtein distance
+	distance := levenshteinDistance(s1, s2)
+	maxLen := len(s1)
+	if len(s2) > maxLen {
+		maxLen = len(s2)
+	}
+
+	return 1.0 - float64(distance)/float64(maxLen)
+}
+
+// levenshteinDistance calculates the Levenshtein distance between two strings
+func levenshteinDistance(s1, s2 string) int {
+	if len(s1) == 0 {
+		return len(s2)
+	}
+	if len(s2) == 0 {
+		return len(s1)
+	}
+
+	// Create matrix
+	matrix := make([][]int, len(s1)+1)
+	for i := range matrix {
+		matrix[i] = make([]int, len(s2)+1)
+		matrix[i][0] = i
+	}
+	for j := range matrix[0] {
+		matrix[0][j] = j
+	}
+
+	// Fill matrix
+	for i := 1; i <= len(s1); i++ {
+		for j := 1; j <= len(s2); j++ {
+			cost := 1
+			if s1[i-1] == s2[j-1] {
+				cost = 0
+			}
+			matrix[i][j] = min(
+				matrix[i-1][j]+1,      // deletion
+				matrix[i][j-1]+1,      // insertion
+				matrix[i-1][j-1]+cost, // substitution
+			)
+		}
+	}
+
+	return matrix[len(s1)][len(s2)]
+}
+
+// normalizeStringForMatching normalizes a string for comparison
+func normalizeStringForMatching(s string) string {
+	// Convert to lowercase
+	s = strings.ToLower(s)
+
+	// Remove common suffixes/prefixes
+	suffixes := []string{
+		" (remastered)", " (remaster)", " - remastered", " - remaster",
+		" (deluxe)", " (deluxe edition)", " - deluxe", " - deluxe edition",
+		" (explicit)", " (clean)", " [explicit]", " [clean]",
+		" (album version)", " (single version)", " (radio edit)",
+		" (feat.", " (ft.", " feat.", " ft.",
+	}
+	for _, suffix := range suffixes {
+		if idx := strings.Index(s, suffix); idx != -1 {
+			s = s[:idx]
+		}
+	}
+
+	// Remove special characters
+	var result strings.Builder
+	for _, r := range s {
+		if (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == ' ' {
+			result.WriteRune(r)
+		}
+	}
+
+	// Collapse multiple spaces
+	s = strings.Join(strings.Fields(result.String()), " ")
+
+	return strings.TrimSpace(s)
+}

go_backend/extension_runtime_polyfills.go

@@ -0,0 +1,488 @@
+// Package gobackend provides Browser-like Polyfills for extension runtime
+package gobackend
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/dop251/goja"
+)
+
+// ==================== Browser-like Polyfills ====================
+// These polyfills make porting browser/Node.js libraries easier
+// without compromising sandbox security
+
+// fetchPolyfill implements browser-compatible fetch() API
+// Returns a Promise-like object with json(), text() methods
+func (r *ExtensionRuntime) fetchPolyfill(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.createFetchError("URL is required")
+	}
+
+	urlStr := call.Arguments[0].String()
+
+	// Validate domain
+	if err := r.validateDomain(urlStr); err != nil {
+		GoLog("[Extension:%s] fetch blocked: %v\n", r.extensionID, err)
+		return r.createFetchError(err.Error())
+	}
+
+	// Parse options
+	method := "GET"
+	var bodyStr string
+	headers := make(map[string]string)
+
+	if len(call.Arguments) > 1 && !goja.IsUndefined(call.Arguments[1]) && !goja.IsNull(call.Arguments[1]) {
+		optionsObj := call.Arguments[1].Export()
+		if opts, ok := optionsObj.(map[string]interface{}); ok {
+			// Method
+			if m, ok := opts["method"].(string); ok {
+				method = strings.ToUpper(m)
+			}
+
+			// Body - support string, object (auto-stringify), or nil
+			if bodyArg, ok := opts["body"]; ok && bodyArg != nil {
+				switch v := bodyArg.(type) {
+				case string:
+					bodyStr = v
+				case map[string]interface{}, []interface{}:
+					jsonBytes, err := json.Marshal(v)
+					if err != nil {
+						return r.createFetchError(fmt.Sprintf("failed to stringify body: %v", err))
+					}
+					bodyStr = string(jsonBytes)
+				default:
+					bodyStr = fmt.Sprintf("%v", v)
+				}
+			}
+
+			// Headers
+			if h, ok := opts["headers"]; ok && h != nil {
+				switch hv := h.(type) {
+				case map[string]interface{}:
+					for k, v := range hv {
+						headers[k] = fmt.Sprintf("%v", v)
+					}
+				}
+			}
+		}
+	}
+
+	// Create HTTP request
+	var reqBody io.Reader
+	if bodyStr != "" {
+		reqBody = strings.NewReader(bodyStr)
+	}
+
+	req, err := http.NewRequest(method, urlStr, reqBody)
+	if err != nil {
+		return r.createFetchError(err.Error())
+	}
+
+	// Set headers - user headers first
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	// Set defaults if not provided
+	if req.Header.Get("User-Agent") == "" {
+		req.Header.Set("User-Agent", "SpotiFLAC-Extension/1.0")
+	}
+	if bodyStr != "" && req.Header.Get("Content-Type") == "" {
+		req.Header.Set("Content-Type", "application/json")
+	}
+
+	// Execute request
+	resp, err := r.httpClient.Do(req)
+	if err != nil {
+		return r.createFetchError(err.Error())
+	}
+	defer resp.Body.Close()
+
+	// Read body
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return r.createFetchError(err.Error())
+	}
+
+	// Extract response headers
+	respHeaders := make(map[string]interface{})
+	for k, v := range resp.Header {
+		if len(v) == 1 {
+			respHeaders[k] = v[0]
+		} else {
+			respHeaders[k] = v
+		}
+	}
+
+	// Create Response object (browser-compatible)
+	responseObj := r.vm.NewObject()
+	responseObj.Set("ok", resp.StatusCode >= 200 && resp.StatusCode < 300)
+	responseObj.Set("status", resp.StatusCode)
+	responseObj.Set("statusText", http.StatusText(resp.StatusCode))
+	responseObj.Set("headers", respHeaders)
+	responseObj.Set("url", urlStr)
+
+	// Store body for methods
+	bodyString := string(body)
+
+	// text() method - returns body as string
+	responseObj.Set("text", func(call goja.FunctionCall) goja.Value {
+		return r.vm.ToValue(bodyString)
+	})
+
+	// json() method - parses body as JSON
+	responseObj.Set("json", func(call goja.FunctionCall) goja.Value {
+		var result interface{}
+		if err := json.Unmarshal(body, &result); err != nil {
+			GoLog("[Extension:%s] fetch json() parse error: %v\n", r.extensionID, err)
+			return goja.Undefined()
+		}
+		return r.vm.ToValue(result)
+	})
+
+	// arrayBuffer() method - returns body as array (simplified)
+	responseObj.Set("arrayBuffer", func(call goja.FunctionCall) goja.Value {
+		// Return as array of bytes
+		byteArray := make([]interface{}, len(body))
+		for i, b := range body {
+			byteArray[i] = int(b)
+		}
+		return r.vm.ToValue(byteArray)
+	})
+
+	return responseObj
+}
+
+// createFetchError creates a fetch error response
+func (r *ExtensionRuntime) createFetchError(message string) goja.Value {
+	errorObj := r.vm.NewObject()
+	errorObj.Set("ok", false)
+	errorObj.Set("status", 0)
+	errorObj.Set("statusText", "Network Error")
+	errorObj.Set("error", message)
+	errorObj.Set("text", func(call goja.FunctionCall) goja.Value {
+		return r.vm.ToValue("")
+	})
+	errorObj.Set("json", func(call goja.FunctionCall) goja.Value {
+		return goja.Undefined()
+	})
+	return errorObj
+}
+
+// atobPolyfill implements browser atob() - decode base64 to string
+func (r *ExtensionRuntime) atobPolyfill(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+	input := call.Arguments[0].String()
+	decoded, err := base64.StdEncoding.DecodeString(input)
+	if err != nil {
+		// Try URL-safe base64
+		decoded, err = base64.URLEncoding.DecodeString(input)
+		if err != nil {
+			GoLog("[Extension:%s] atob decode error: %v\n", r.extensionID, err)
+			return r.vm.ToValue("")
+		}
+	}
+	return r.vm.ToValue(string(decoded))
+}
+
+// btoaPolyfill implements browser btoa() - encode string to base64
+func (r *ExtensionRuntime) btoaPolyfill(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+	input := call.Arguments[0].String()
+	return r.vm.ToValue(base64.StdEncoding.EncodeToString([]byte(input)))
+}
+
+// registerTextEncoderDecoder registers TextEncoder and TextDecoder classes
+func (r *ExtensionRuntime) registerTextEncoderDecoder(vm *goja.Runtime) {
+	// TextEncoder constructor
+	vm.Set("TextEncoder", func(call goja.ConstructorCall) *goja.Object {
+		encoder := call.This
+		encoder.Set("encoding", "utf-8")
+
+		// encode() method - string to Uint8Array
+		encoder.Set("encode", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) < 1 {
+				return vm.ToValue([]byte{})
+			}
+			input := call.Arguments[0].String()
+			bytes := []byte(input)
+
+			// Return as array (Uint8Array-like)
+			result := make([]interface{}, len(bytes))
+			for i, b := range bytes {
+				result[i] = int(b)
+			}
+			return vm.ToValue(result)
+		})
+
+		// encodeInto() method
+		encoder.Set("encodeInto", func(call goja.FunctionCall) goja.Value {
+			// Simplified implementation
+			if len(call.Arguments) < 2 {
+				return vm.ToValue(map[string]interface{}{"read": 0, "written": 0})
+			}
+			input := call.Arguments[0].String()
+			return vm.ToValue(map[string]interface{}{
+				"read":    len(input),
+				"written": len([]byte(input)),
+			})
+		})
+
+		return nil
+	})
+
+	// TextDecoder constructor
+	vm.Set("TextDecoder", func(call goja.ConstructorCall) *goja.Object {
+		decoder := call.This
+
+		// Get encoding from arguments (default: utf-8)
+		encoding := "utf-8"
+		if len(call.Arguments) > 0 && !goja.IsUndefined(call.Arguments[0]) {
+			encoding = call.Arguments[0].String()
+		}
+		decoder.Set("encoding", encoding)
+		decoder.Set("fatal", false)
+		decoder.Set("ignoreBOM", false)
+
+		// decode() method - Uint8Array to string
+		decoder.Set("decode", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) < 1 {
+				return vm.ToValue("")
+			}
+
+			// Handle different input types
+			input := call.Arguments[0].Export()
+			var bytes []byte
+
+			switch v := input.(type) {
+			case []byte:
+				bytes = v
+			case []interface{}:
+				bytes = make([]byte, len(v))
+				for i, val := range v {
+					switch n := val.(type) {
+					case int64:
+						bytes[i] = byte(n)
+					case float64:
+						bytes[i] = byte(n)
+					case int:
+						bytes[i] = byte(n)
+					}
+				}
+			case string:
+				// Already a string, just return it
+				return vm.ToValue(v)
+			default:
+				return vm.ToValue("")
+			}
+
+			return vm.ToValue(string(bytes))
+		})
+
+		return nil
+	})
+}
+
+// registerURLClass registers the URL class for URL parsing
+func (r *ExtensionRuntime) registerURLClass(vm *goja.Runtime) {
+	vm.Set("URL", func(call goja.ConstructorCall) *goja.Object {
+		urlObj := call.This
+
+		if len(call.Arguments) < 1 {
+			urlObj.Set("href", "")
+			return nil
+		}
+
+		urlStr := call.Arguments[0].String()
+
+		// Handle relative URLs with base
+		if len(call.Arguments) > 1 && !goja.IsUndefined(call.Arguments[1]) {
+			baseStr := call.Arguments[1].String()
+			baseURL, err := url.Parse(baseStr)
+			if err == nil {
+				relURL, err := url.Parse(urlStr)
+				if err == nil {
+					urlStr = baseURL.ResolveReference(relURL).String()
+				}
+			}
+		}
+
+		parsed, err := url.Parse(urlStr)
+		if err != nil {
+			urlObj.Set("href", urlStr)
+			return nil
+		}
+
+		// Set URL properties
+		urlObj.Set("href", parsed.String())
+		urlObj.Set("protocol", parsed.Scheme+":")
+		urlObj.Set("host", parsed.Host)
+		urlObj.Set("hostname", parsed.Hostname())
+		urlObj.Set("port", parsed.Port())
+		urlObj.Set("pathname", parsed.Path)
+		urlObj.Set("search", "")
+		if parsed.RawQuery != "" {
+			urlObj.Set("search", "?"+parsed.RawQuery)
+		}
+		urlObj.Set("hash", "")
+		if parsed.Fragment != "" {
+			urlObj.Set("hash", "#"+parsed.Fragment)
+		}
+		urlObj.Set("origin", parsed.Scheme+"://"+parsed.Host)
+		urlObj.Set("username", parsed.User.Username())
+		password, _ := parsed.User.Password()
+		urlObj.Set("password", password)
+
+		// searchParams object
+		searchParams := vm.NewObject()
+		queryValues := parsed.Query()
+
+		searchParams.Set("get", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) < 1 {
+				return goja.Null()
+			}
+			key := call.Arguments[0].String()
+			if val := queryValues.Get(key); val != "" {
+				return vm.ToValue(val)
+			}
+			return goja.Null()
+		})
+
+		searchParams.Set("getAll", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) < 1 {
+				return vm.ToValue([]string{})
+			}
+			key := call.Arguments[0].String()
+			return vm.ToValue(queryValues[key])
+		})
+
+		searchParams.Set("has", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) < 1 {
+				return vm.ToValue(false)
+			}
+			key := call.Arguments[0].String()
+			return vm.ToValue(queryValues.Has(key))
+		})
+
+		searchParams.Set("toString", func(call goja.FunctionCall) goja.Value {
+			return vm.ToValue(queryValues.Encode())
+		})
+
+		urlObj.Set("searchParams", searchParams)
+
+		// toString method
+		urlObj.Set("toString", func(call goja.FunctionCall) goja.Value {
+			return vm.ToValue(parsed.String())
+		})
+
+		// toJSON method
+		urlObj.Set("toJSON", func(call goja.FunctionCall) goja.Value {
+			return vm.ToValue(parsed.String())
+		})
+
+		return nil
+	})
+
+	// URLSearchParams constructor
+	vm.Set("URLSearchParams", func(call goja.ConstructorCall) *goja.Object {
+		paramsObj := call.This
+		values := url.Values{}
+
+		// Parse initial value if provided
+		if len(call.Arguments) > 0 && !goja.IsUndefined(call.Arguments[0]) {
+			init := call.Arguments[0].Export()
+			switch v := init.(type) {
+			case string:
+				// Parse query string
+				parsed, _ := url.ParseQuery(strings.TrimPrefix(v, "?"))
+				values = parsed
+			case map[string]interface{}:
+				for k, val := range v {
+					values.Set(k, fmt.Sprintf("%v", val))
+				}
+			}
+		}
+
+		paramsObj.Set("append", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) >= 2 {
+				values.Add(call.Arguments[0].String(), call.Arguments[1].String())
+			}
+			return goja.Undefined()
+		})
+
+		paramsObj.Set("delete", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) >= 1 {
+				values.Del(call.Arguments[0].String())
+			}
+			return goja.Undefined()
+		})
+
+		paramsObj.Set("get", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) < 1 {
+				return goja.Null()
+			}
+			if val := values.Get(call.Arguments[0].String()); val != "" {
+				return vm.ToValue(val)
+			}
+			return goja.Null()
+		})
+
+		paramsObj.Set("getAll", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) < 1 {
+				return vm.ToValue([]string{})
+			}
+			return vm.ToValue(values[call.Arguments[0].String()])
+		})
+
+		paramsObj.Set("has", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) < 1 {
+				return vm.ToValue(false)
+			}
+			return vm.ToValue(values.Has(call.Arguments[0].String()))
+		})
+
+		paramsObj.Set("set", func(call goja.FunctionCall) goja.Value {
+			if len(call.Arguments) >= 2 {
+				values.Set(call.Arguments[0].String(), call.Arguments[1].String())
+			}
+			return goja.Undefined()
+		})
+
+		paramsObj.Set("toString", func(call goja.FunctionCall) goja.Value {
+			return vm.ToValue(values.Encode())
+		})
+
+		return nil
+	})
+}
+
+// registerJSONGlobal ensures JSON global is properly set up
+func (r *ExtensionRuntime) registerJSONGlobal(vm *goja.Runtime) {
+	// JSON is already built-in to Goja, but we can enhance it
+	// This ensures JSON.parse and JSON.stringify work as expected
+
+	// The built-in JSON object should already work, but let's verify
+	// and add any missing functionality if needed
+	jsonScript := `
+		if (typeof JSON === 'undefined') {
+			var JSON = {
+				parse: function(text) {
+					return utils.parseJSON(text);
+				},
+				stringify: function(value, replacer, space) {
+					return utils.stringifyJSON(value);
+				}
+			};
+		}
+	`
+	_, _ = vm.RunString(jsonScript)
+}

go_backend/extension_runtime_storage.go

@@ -0,0 +1,377 @@
+// Package gobackend provides Storage and Credentials API for extension runtime
+package gobackend
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/dop251/goja"
+)
+
+// ==================== Storage API ====================
+
+// getStoragePath returns the path to the extension's storage file
+func (r *ExtensionRuntime) getStoragePath() string {
+	return filepath.Join(r.dataDir, "storage.json")
+}
+
+// loadStorage loads the storage data from disk
+func (r *ExtensionRuntime) loadStorage() (map[string]interface{}, error) {
+	storagePath := r.getStoragePath()
+	data, err := os.ReadFile(storagePath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return make(map[string]interface{}), nil
+		}
+		return nil, err
+	}
+
+	var storage map[string]interface{}
+	if err := json.Unmarshal(data, &storage); err != nil {
+		return nil, err
+	}
+
+	return storage, nil
+}
+
+// saveStorage saves the storage data to disk
+func (r *ExtensionRuntime) saveStorage(storage map[string]interface{}) error {
+	storagePath := r.getStoragePath()
+	data, err := json.MarshalIndent(storage, "", "  ")
+	if err != nil {
+		return err
+	}
+
+	return os.WriteFile(storagePath, data, 0644)
+}
+
+// storageGet retrieves a value from storage
+func (r *ExtensionRuntime) storageGet(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return goja.Undefined()
+	}
+
+	key := call.Arguments[0].String()
+
+	storage, err := r.loadStorage()
+	if err != nil {
+		GoLog("[Extension:%s] Storage load error: %v\n", r.extensionID, err)
+		return goja.Undefined()
+	}
+
+	value, exists := storage[key]
+	if !exists {
+		// Return default value if provided
+		if len(call.Arguments) > 1 {
+			return call.Arguments[1]
+		}
+		return goja.Undefined()
+	}
+
+	return r.vm.ToValue(value)
+}
+
+// storageSet stores a value in storage
+func (r *ExtensionRuntime) storageSet(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(false)
+	}
+
+	key := call.Arguments[0].String()
+	value := call.Arguments[1].Export()
+
+	storage, err := r.loadStorage()
+	if err != nil {
+		GoLog("[Extension:%s] Storage load error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(false)
+	}
+
+	storage[key] = value
+
+	if err := r.saveStorage(storage); err != nil {
+		GoLog("[Extension:%s] Storage save error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(false)
+	}
+
+	return r.vm.ToValue(true)
+}
+
+// storageRemove removes a value from storage
+func (r *ExtensionRuntime) storageRemove(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(false)
+	}
+
+	key := call.Arguments[0].String()
+
+	storage, err := r.loadStorage()
+	if err != nil {
+		GoLog("[Extension:%s] Storage load error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(false)
+	}
+
+	delete(storage, key)
+
+	if err := r.saveStorage(storage); err != nil {
+		GoLog("[Extension:%s] Storage save error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(false)
+	}
+
+	return r.vm.ToValue(true)
+}
+
+// ==================== Credentials API (Encrypted Storage) ====================
+
+// getCredentialsPath returns the path to the extension's encrypted credentials file
+func (r *ExtensionRuntime) getCredentialsPath() string {
+	return filepath.Join(r.dataDir, ".credentials.enc")
+}
+
+// getSaltPath returns the path to the extension's encryption salt file
+func (r *ExtensionRuntime) getSaltPath() string {
+	return filepath.Join(r.dataDir, ".cred_salt")
+}
+
+// getOrCreateSalt gets existing salt or creates a new random one
+func (r *ExtensionRuntime) getOrCreateSalt() ([]byte, error) {
+	saltPath := r.getSaltPath()
+
+	salt, err := os.ReadFile(saltPath)
+	if err == nil && len(salt) == 32 {
+		return salt, nil
+	}
+
+	salt = make([]byte, 32)
+	if _, err := io.ReadFull(rand.Reader, salt); err != nil {
+		return nil, fmt.Errorf("failed to generate salt: %w", err)
+	}
+
+	if err := os.WriteFile(saltPath, salt, 0600); err != nil {
+		return nil, fmt.Errorf("failed to save salt: %w", err)
+	}
+
+	return salt, nil
+}
+
+// getEncryptionKey derives an encryption key from extension ID + random salt
+func (r *ExtensionRuntime) getEncryptionKey() ([]byte, error) {
+	// Get or create per-installation random salt
+	salt, err := r.getOrCreateSalt()
+	if err != nil {
+		return nil, err
+	}
+
+	// Combine extension ID + random salt for key derivation
+	// This makes each installation unique, preventing mass decryption attacks
+	combined := append([]byte(r.extensionID), salt...)
+	hash := sha256.Sum256(combined)
+	return hash[:], nil
+}
+
+// loadCredentials loads and decrypts credentials from disk
+func (r *ExtensionRuntime) loadCredentials() (map[string]interface{}, error) {
+	credPath := r.getCredentialsPath()
+	data, err := os.ReadFile(credPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return make(map[string]interface{}), nil
+		}
+		return nil, err
+	}
+
+	// Decrypt the data
+	key, err := r.getEncryptionKey()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get encryption key: %w", err)
+	}
+	decrypted, err := decryptAES(data, key)
+	if err != nil {
+		return nil, fmt.Errorf("failed to decrypt credentials: %w", err)
+	}
+
+	var creds map[string]interface{}
+	if err := json.Unmarshal(decrypted, &creds); err != nil {
+		return nil, err
+	}
+
+	return creds, nil
+}
+
+// saveCredentials encrypts and saves credentials to disk
+func (r *ExtensionRuntime) saveCredentials(creds map[string]interface{}) error {
+	data, err := json.Marshal(creds)
+	if err != nil {
+		return err
+	}
+
+	key, err := r.getEncryptionKey()
+	if err != nil {
+		return fmt.Errorf("failed to get encryption key: %w", err)
+	}
+	encrypted, err := encryptAES(data, key)
+	if err != nil {
+		return fmt.Errorf("failed to encrypt credentials: %w", err)
+	}
+
+	credPath := r.getCredentialsPath()
+	return os.WriteFile(credPath, encrypted, 0600) // Restrictive permissions
+}
+
+// credentialsStore stores an encrypted credential
+func (r *ExtensionRuntime) credentialsStore(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "key and value are required",
+		})
+	}
+
+	key := call.Arguments[0].String()
+	value := call.Arguments[1].Export()
+
+	creds, err := r.loadCredentials()
+	if err != nil {
+		GoLog("[Extension:%s] Credentials load error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	creds[key] = value
+
+	if err := r.saveCredentials(creds); err != nil {
+		GoLog("[Extension:%s] Credentials save error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+	})
+}
+
+// credentialsGet retrieves a decrypted credential
+func (r *ExtensionRuntime) credentialsGet(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return goja.Undefined()
+	}
+
+	key := call.Arguments[0].String()
+
+	creds, err := r.loadCredentials()
+	if err != nil {
+		GoLog("[Extension:%s] Credentials load error: %v\n", r.extensionID, err)
+		return goja.Undefined()
+	}
+
+	value, exists := creds[key]
+	if !exists {
+		// Return default value if provided
+		if len(call.Arguments) > 1 {
+			return call.Arguments[1]
+		}
+		return goja.Undefined()
+	}
+
+	return r.vm.ToValue(value)
+}
+
+// credentialsRemove removes a credential
+func (r *ExtensionRuntime) credentialsRemove(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(false)
+	}
+
+	key := call.Arguments[0].String()
+
+	creds, err := r.loadCredentials()
+	if err != nil {
+		GoLog("[Extension:%s] Credentials load error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(false)
+	}
+
+	delete(creds, key)
+
+	if err := r.saveCredentials(creds); err != nil {
+		GoLog("[Extension:%s] Credentials save error: %v\n", r.extensionID, err)
+		return r.vm.ToValue(false)
+	}
+
+	return r.vm.ToValue(true)
+}
+
+// credentialsHas checks if a credential exists
+func (r *ExtensionRuntime) credentialsHas(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue(false)
+	}
+
+	key := call.Arguments[0].String()
+
+	creds, err := r.loadCredentials()
+	if err != nil {
+		return r.vm.ToValue(false)
+	}
+
+	_, exists := creds[key]
+	return r.vm.ToValue(exists)
+}
+
+// ==================== Crypto Utilities ====================
+
+// encryptAES encrypts data using AES-GCM
+func encryptAES(plaintext []byte, key []byte) ([]byte, error) {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		return nil, err
+	}
+
+	ciphertext := gcm.Seal(nonce, nonce, plaintext, nil)
+	return ciphertext, nil
+}
+
+// decryptAES decrypts data using AES-GCM
+func decryptAES(ciphertext []byte, key []byte) ([]byte, error) {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+
+	nonceSize := gcm.NonceSize()
+	if len(ciphertext) < nonceSize {
+		return nil, fmt.Errorf("ciphertext too short")
+	}
+
+	nonce, ciphertext := ciphertext[:nonceSize], ciphertext[nonceSize:]
+	plaintext, err := gcm.Open(nil, nonce, ciphertext, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return plaintext, nil
+}

go_backend/extension_runtime_utils.go

@@ -0,0 +1,395 @@
+// Package gobackend provides Utility functions for extension runtime
+package gobackend
+
+import (
+	"crypto/hmac"
+	"crypto/md5"
+	"crypto/rand"
+	"crypto/sha1"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/dop251/goja"
+)
+
+// ==================== Utility Functions ====================
+
+// base64Encode encodes a string to base64
+func (r *ExtensionRuntime) base64Encode(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+	input := call.Arguments[0].String()
+	return r.vm.ToValue(base64.StdEncoding.EncodeToString([]byte(input)))
+}
+
+// base64Decode decodes a base64 string
+func (r *ExtensionRuntime) base64Decode(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+	input := call.Arguments[0].String()
+	decoded, err := base64.StdEncoding.DecodeString(input)
+	if err != nil {
+		return r.vm.ToValue("")
+	}
+	return r.vm.ToValue(string(decoded))
+}
+
+// md5Hash computes MD5 hash of a string
+func (r *ExtensionRuntime) md5Hash(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+	input := call.Arguments[0].String()
+	hash := md5.Sum([]byte(input))
+	return r.vm.ToValue(hex.EncodeToString(hash[:]))
+}
+
+// sha256Hash computes SHA256 hash of a string
+func (r *ExtensionRuntime) sha256Hash(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+	input := call.Arguments[0].String()
+	hash := sha256.Sum256([]byte(input))
+	return r.vm.ToValue(hex.EncodeToString(hash[:]))
+}
+
+// hmacSHA256 computes HMAC-SHA256 of a message with a key
+func (r *ExtensionRuntime) hmacSHA256(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue("")
+	}
+	message := call.Arguments[0].String()
+	key := call.Arguments[1].String()
+
+	mac := hmac.New(sha256.New, []byte(key))
+	mac.Write([]byte(message))
+	return r.vm.ToValue(hex.EncodeToString(mac.Sum(nil)))
+}
+
+// hmacSHA256Base64 computes HMAC-SHA256 and returns base64 encoded result
+func (r *ExtensionRuntime) hmacSHA256Base64(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue("")
+	}
+	message := call.Arguments[0].String()
+	key := call.Arguments[1].String()
+
+	mac := hmac.New(sha256.New, []byte(key))
+	mac.Write([]byte(message))
+	return r.vm.ToValue(base64.StdEncoding.EncodeToString(mac.Sum(nil)))
+}
+
+// hmacSHA1 computes HMAC-SHA1 of a message with a key (for TOTP)
+// Arguments: message (string or array of bytes), key (string or array of bytes)
+// Returns: array of bytes (for TOTP dynamic truncation)
+func (r *ExtensionRuntime) hmacSHA1(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue([]byte{})
+	}
+
+	var keyBytes []byte
+	keyArg := call.Arguments[0].Export()
+	switch k := keyArg.(type) {
+	case string:
+		keyBytes = []byte(k)
+	case []interface{}:
+		keyBytes = make([]byte, len(k))
+		for i, v := range k {
+			if num, ok := v.(int64); ok {
+				keyBytes[i] = byte(num)
+			} else if num, ok := v.(float64); ok {
+				keyBytes[i] = byte(int(num))
+			}
+		}
+	default:
+		return r.vm.ToValue([]byte{})
+	}
+
+	var msgBytes []byte
+	msgArg := call.Arguments[1].Export()
+	switch m := msgArg.(type) {
+	case string:
+		msgBytes = []byte(m)
+	case []interface{}:
+		msgBytes = make([]byte, len(m))
+		for i, v := range m {
+			if num, ok := v.(int64); ok {
+				msgBytes[i] = byte(num)
+			} else if num, ok := v.(float64); ok {
+				msgBytes[i] = byte(int(num))
+			}
+		}
+	default:
+		return r.vm.ToValue([]byte{})
+	}
+
+	mac := hmac.New(sha1.New, keyBytes)
+	mac.Write(msgBytes)
+	result := mac.Sum(nil)
+
+	jsArray := make([]interface{}, len(result))
+	for i, b := range result {
+		jsArray[i] = int(b)
+	}
+	return r.vm.ToValue(jsArray)
+}
+
+// parseJSON parses a JSON string
+func (r *ExtensionRuntime) parseJSON(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return goja.Undefined()
+	}
+	input := call.Arguments[0].String()
+
+	var result interface{}
+	if err := json.Unmarshal([]byte(input), &result); err != nil {
+		GoLog("[Extension:%s] JSON parse error: %v\n", r.extensionID, err)
+		return goja.Undefined()
+	}
+
+	return r.vm.ToValue(result)
+}
+
+// stringifyJSON converts a value to JSON string
+func (r *ExtensionRuntime) stringifyJSON(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+	input := call.Arguments[0].Export()
+
+	data, err := json.Marshal(input)
+	if err != nil {
+		GoLog("[Extension:%s] JSON stringify error: %v\n", r.extensionID, err)
+		return r.vm.ToValue("")
+	}
+
+	return r.vm.ToValue(string(data))
+}
+
+// ==================== Crypto Utilities for Extensions ====================
+
+// cryptoEncrypt encrypts a string using AES-GCM (for extension use)
+func (r *ExtensionRuntime) cryptoEncrypt(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "plaintext and key are required",
+		})
+	}
+
+	plaintext := call.Arguments[0].String()
+	keyStr := call.Arguments[1].String()
+
+	// Derive 32-byte key from provided key string
+	keyHash := sha256.Sum256([]byte(keyStr))
+
+	encrypted, err := encryptAES([]byte(plaintext), keyHash[:])
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"data":    base64.StdEncoding.EncodeToString(encrypted),
+	})
+}
+
+// cryptoDecrypt decrypts a string using AES-GCM (for extension use)
+func (r *ExtensionRuntime) cryptoDecrypt(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 2 {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "ciphertext and key are required",
+		})
+	}
+
+	ciphertextB64 := call.Arguments[0].String()
+	keyStr := call.Arguments[1].String()
+
+	ciphertext, err := base64.StdEncoding.DecodeString(ciphertextB64)
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   "invalid base64 ciphertext",
+		})
+	}
+
+	// Derive 32-byte key from provided key string
+	keyHash := sha256.Sum256([]byte(keyStr))
+
+	decrypted, err := decryptAES(ciphertext, keyHash[:])
+	if err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"data":    string(decrypted),
+	})
+}
+
+// cryptoGenerateKey generates a random encryption key
+func (r *ExtensionRuntime) cryptoGenerateKey(call goja.FunctionCall) goja.Value {
+	length := 32 // Default 256-bit key
+	if len(call.Arguments) > 0 && !goja.IsUndefined(call.Arguments[0]) {
+		if l, ok := call.Arguments[0].Export().(float64); ok {
+			length = int(l)
+		}
+	}
+
+	key := make([]byte, length)
+	if _, err := rand.Read(key); err != nil {
+		return r.vm.ToValue(map[string]interface{}{
+			"success": false,
+			"error":   err.Error(),
+		})
+	}
+
+	return r.vm.ToValue(map[string]interface{}{
+		"success": true,
+		"key":     base64.StdEncoding.EncodeToString(key),
+		"hex":     hex.EncodeToString(key),
+	})
+}
+
+// randomUserAgent returns a random Chrome User-Agent string
+func (r *ExtensionRuntime) randomUserAgent(call goja.FunctionCall) goja.Value {
+	return r.vm.ToValue(getRandomUserAgent())
+}
+
+// ==================== Logging Functions ====================
+
+func (r *ExtensionRuntime) logDebug(call goja.FunctionCall) goja.Value {
+	msg := r.formatLogArgs(call.Arguments)
+	GoLog("[Extension:%s:DEBUG] %s\n", r.extensionID, msg)
+	return goja.Undefined()
+}
+
+func (r *ExtensionRuntime) logInfo(call goja.FunctionCall) goja.Value {
+	msg := r.formatLogArgs(call.Arguments)
+	GoLog("[Extension:%s:INFO] %s\n", r.extensionID, msg)
+	return goja.Undefined()
+}
+
+func (r *ExtensionRuntime) logWarn(call goja.FunctionCall) goja.Value {
+	msg := r.formatLogArgs(call.Arguments)
+	GoLog("[Extension:%s:WARN] %s\n", r.extensionID, msg)
+	return goja.Undefined()
+}
+
+func (r *ExtensionRuntime) logError(call goja.FunctionCall) goja.Value {
+	msg := r.formatLogArgs(call.Arguments)
+	GoLog("[Extension:%s:ERROR] %s\n", r.extensionID, msg)
+	return goja.Undefined()
+}
+
+func (r *ExtensionRuntime) formatLogArgs(args []goja.Value) string {
+	parts := make([]string, len(args))
+	for i, arg := range args {
+		parts[i] = fmt.Sprintf("%v", arg.Export())
+	}
+	return strings.Join(parts, " ")
+}
+
+// ==================== Go Backend Wrappers ====================
+
+func (r *ExtensionRuntime) sanitizeFilenameWrapper(call goja.FunctionCall) goja.Value {
+	if len(call.Arguments) < 1 {
+		return r.vm.ToValue("")
+	}
+	input := call.Arguments[0].String()
+	return r.vm.ToValue(sanitizeFilename(input))
+}
+
+// RegisterGoBackendAPIs adds more Go backend functions to the VM
+func (r *ExtensionRuntime) RegisterGoBackendAPIs(vm *goja.Runtime) {
+	gobackendObj := vm.Get("gobackend")
+	if gobackendObj == nil || goja.IsUndefined(gobackendObj) {
+		gobackendObj = vm.NewObject()
+		vm.Set("gobackend", gobackendObj)
+	}
+
+	obj := gobackendObj.(*goja.Object)
+
+	// Expose sanitizeFilename
+	obj.Set("sanitizeFilename", func(call goja.FunctionCall) goja.Value {
+		if len(call.Arguments) < 1 {
+			return vm.ToValue("")
+		}
+		return vm.ToValue(sanitizeFilename(call.Arguments[0].String()))
+	})
+
+	// Expose getAudioQuality
+	obj.Set("getAudioQuality", func(call goja.FunctionCall) goja.Value {
+		if len(call.Arguments) < 1 {
+			return vm.ToValue(map[string]interface{}{
+				"error": "file path is required",
+			})
+		}
+
+		filePath := call.Arguments[0].String()
+		quality, err := GetAudioQuality(filePath)
+		if err != nil {
+			return vm.ToValue(map[string]interface{}{
+				"error": err.Error(),
+			})
+		}
+
+		return vm.ToValue(map[string]interface{}{
+			"bitDepth":     quality.BitDepth,
+			"sampleRate":   quality.SampleRate,
+			"totalSamples": quality.TotalSamples,
+		})
+	})
+
+	// Expose buildFilename
+	obj.Set("buildFilename", func(call goja.FunctionCall) goja.Value {
+		if len(call.Arguments) < 2 {
+			return vm.ToValue("")
+		}
+
+		template := call.Arguments[0].String()
+		metadataObj := call.Arguments[1].Export()
+
+		metadata, ok := metadataObj.(map[string]interface{})
+		if !ok {
+			return vm.ToValue("")
+		}
+
+		return vm.ToValue(buildFilenameFromTemplate(template, metadata))
+	})
+
+	// Expose getLocalTime - returns device local time info
+	obj.Set("getLocalTime", func(call goja.FunctionCall) goja.Value {
+		now := time.Now()
+		_, offsetSeconds := now.Zone()
+		offsetMinutes := offsetSeconds / 60
+
+		return vm.ToValue(map[string]interface{}{
+			"year":          now.Year(),
+			"month":         int(now.Month()),
+			"day":           now.Day(),
+			"hour":          now.Hour(),
+			"minute":        now.Minute(),
+			"second":        now.Second(),
+			"weekday":       int(now.Weekday()),
+			"offsetMinutes": -offsetMinutes, // JS convention: negative for east of UTC
+			"timezone":      now.Location().String(),
+			"timestamp":     now.Unix(),
+		})
+	})
+}

go_backend/extension_settings.go

@@ -0,0 +1,217 @@
+// Package gobackend provides extension settings storage
+package gobackend
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sync"
+)
+
+// ExtensionSettingsStore manages settings for all extensions
+type ExtensionSettingsStore struct {
+	mu       sync.RWMutex
+	dataDir  string
+	settings map[string]map[string]interface{} // extensionID -> settings
+}
+
+// Global settings store
+var (
+	globalSettingsStore     *ExtensionSettingsStore
+	globalSettingsStoreOnce sync.Once
+)
+
+// GetExtensionSettingsStore returns the global settings store
+func GetExtensionSettingsStore() *ExtensionSettingsStore {
+	globalSettingsStoreOnce.Do(func() {
+		globalSettingsStore = &ExtensionSettingsStore{
+			settings: make(map[string]map[string]interface{}),
+		}
+	})
+	return globalSettingsStore
+}
+
+// SetDataDir sets the data directory for settings storage
+func (s *ExtensionSettingsStore) SetDataDir(dataDir string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.dataDir = dataDir
+	if err := os.MkdirAll(dataDir, 0755); err != nil {
+		return fmt.Errorf("failed to create settings directory: %w", err)
+	}
+
+	return s.loadAllSettings()
+}
+
+// getSettingsPath returns the path to an extension's settings file
+func (s *ExtensionSettingsStore) getSettingsPath(extensionID string) string {
+	return filepath.Join(s.dataDir, extensionID, "settings.json")
+}
+
+// loadAllSettings loads settings for all extensions from disk
+func (s *ExtensionSettingsStore) loadAllSettings() error {
+	entries, err := os.ReadDir(s.dataDir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+
+	for _, entry := range entries {
+		if entry.IsDir() {
+			extensionID := entry.Name()
+			settings, err := s.loadSettings(extensionID)
+			if err != nil {
+				GoLog("[ExtensionSettings] Failed to load settings for %s: %v\n", extensionID, err)
+				continue
+			}
+			s.settings[extensionID] = settings
+		}
+	}
+
+	return nil
+}
+
+// loadSettings loads settings for a specific extension
+func (s *ExtensionSettingsStore) loadSettings(extensionID string) (map[string]interface{}, error) {
+	settingsPath := s.getSettingsPath(extensionID)
+	data, err := os.ReadFile(settingsPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return make(map[string]interface{}), nil
+		}
+		return nil, err
+	}
+
+	var settings map[string]interface{}
+	if err := json.Unmarshal(data, &settings); err != nil {
+		return nil, err
+	}
+
+	return settings, nil
+}
+
+// saveSettings saves settings for a specific extension
+func (s *ExtensionSettingsStore) saveSettings(extensionID string, settings map[string]interface{}) error {
+	settingsPath := s.getSettingsPath(extensionID)
+
+	dir := filepath.Dir(settingsPath)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return err
+	}
+
+	data, err := json.MarshalIndent(settings, "", "  ")
+	if err != nil {
+		return err
+	}
+
+	return os.WriteFile(settingsPath, data, 0644)
+}
+
+// Get retrieves a setting value for an extension
+// Returns error if extension or key not found (gomobile compatible)
+func (s *ExtensionSettingsStore) Get(extensionID, key string) (interface{}, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	extSettings, exists := s.settings[extensionID]
+	if !exists {
+		return nil, fmt.Errorf("extension '%s' settings not found", extensionID)
+	}
+
+	value, exists := extSettings[key]
+	if !exists {
+		return nil, fmt.Errorf("setting '%s' not found for extension '%s'", key, extensionID)
+	}
+	return value, nil
+}
+
+// GetAll retrieves all settings for an extension
+func (s *ExtensionSettingsStore) GetAll(extensionID string) map[string]interface{} {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	extSettings, exists := s.settings[extensionID]
+	if !exists {
+		return make(map[string]interface{})
+	}
+
+	// Return a copy
+	result := make(map[string]interface{})
+	for k, v := range extSettings {
+		result[k] = v
+	}
+	return result
+}
+
+// Set stores a setting value for an extension
+func (s *ExtensionSettingsStore) Set(extensionID, key string, value interface{}) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if _, exists := s.settings[extensionID]; !exists {
+		s.settings[extensionID] = make(map[string]interface{})
+	}
+
+	s.settings[extensionID][key] = value
+
+	return s.saveSettings(extensionID, s.settings[extensionID])
+}
+
+// SetAll stores all settings for an extension
+func (s *ExtensionSettingsStore) SetAll(extensionID string, settings map[string]interface{}) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.settings[extensionID] = settings
+
+	// Persist to disk
+	return s.saveSettings(extensionID, settings)
+}
+
+// Remove removes a setting for an extension
+func (s *ExtensionSettingsStore) Remove(extensionID, key string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	extSettings, exists := s.settings[extensionID]
+	if !exists {
+		return nil
+	}
+
+	delete(extSettings, key)
+
+	// Persist to disk
+	return s.saveSettings(extensionID, extSettings)
+}
+
+// RemoveAll removes all settings for an extension
+func (s *ExtensionSettingsStore) RemoveAll(extensionID string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	delete(s.settings, extensionID)
+
+	settingsPath := s.getSettingsPath(extensionID)
+	if err := os.Remove(settingsPath); err != nil && !os.IsNotExist(err) {
+		return err
+	}
+
+	return nil
+}
+
+// GetAllExtensionSettings returns settings for all extensions as JSON
+func (s *ExtensionSettingsStore) GetAllExtensionSettingsJSON() (string, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	data, err := json.Marshal(s.settings)
+	if err != nil {
+		return "", err
+	}
+
+	return string(data), nil
+}

go_backend/extension_store.go

@@ -0,0 +1,451 @@
+package gobackend
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sync"
+	"time"
+)
+
+// Extension categories
+const (
+	CategoryMetadata    = "metadata"
+	CategoryDownload    = "download"
+	CategoryUtility     = "utility"
+	CategoryLyrics      = "lyrics"
+	CategoryIntegration = "integration"
+)
+
+// StoreExtension represents an extension in the store
+type StoreExtension struct {
+	ID            string   `json:"id"`
+	Name          string   `json:"name"`
+	DisplayName   string   `json:"display_name,omitempty"`
+	Version       string   `json:"version"`
+	Author        string   `json:"author"`
+	Description   string   `json:"description"`
+	DownloadURL   string   `json:"download_url,omitempty"`
+	IconURL       string   `json:"icon_url,omitempty"`
+	Category      string   `json:"category"`
+	Tags          []string `json:"tags,omitempty"`
+	Downloads     int      `json:"downloads"`
+	UpdatedAt     string   `json:"updated_at"`
+	MinAppVersion string   `json:"min_app_version,omitempty"`
+	DisplayNameAlt   string `json:"displayName,omitempty"`
+	DownloadURLAlt   string `json:"downloadUrl,omitempty"`
+	IconURLAlt       string `json:"iconUrl,omitempty"`
+	MinAppVersionAlt string `json:"minAppVersion,omitempty"`
+}
+
+// getDisplayName returns display name, falling back to name (private to avoid gomobile conflict)
+func (e *StoreExtension) getDisplayName() string {
+	if e.DisplayName != "" {
+		return e.DisplayName
+	}
+	if e.DisplayNameAlt != "" {
+		return e.DisplayNameAlt
+	}
+	return e.Name
+}
+
+// getDownloadURL returns download URL from either field (private to avoid gomobile conflict)
+func (e *StoreExtension) getDownloadURL() string {
+	if e.DownloadURL != "" {
+		return e.DownloadURL
+	}
+	return e.DownloadURLAlt
+}
+
+// getIconURL returns icon URL from either field (private to avoid gomobile conflict)
+func (e *StoreExtension) getIconURL() string {
+	if e.IconURL != "" {
+		return e.IconURL
+	}
+	return e.IconURLAlt
+}
+
+// getMinAppVersion returns min app version from either field (private to avoid gomobile conflict)
+func (e *StoreExtension) getMinAppVersion() string {
+	if e.MinAppVersion != "" {
+		return e.MinAppVersion
+	}
+	return e.MinAppVersionAlt
+}
+
+// StoreRegistry represents the extension registry
+type StoreRegistry struct {
+	Version    int              `json:"version"`
+	UpdatedAt  string           `json:"updated_at"`
+	Extensions []StoreExtension `json:"extensions"`
+}
+
+// StoreExtensionResponse is the normalized response sent to Flutter
+type StoreExtensionResponse struct {
+	ID               string   `json:"id"`
+	Name             string   `json:"name"`
+	DisplayName      string   `json:"display_name"`
+	Version          string   `json:"version"`
+	Author           string   `json:"author"`
+	Description      string   `json:"description"`
+	DownloadURL      string   `json:"download_url"`
+	IconURL          string   `json:"icon_url,omitempty"`
+	Category         string   `json:"category"`
+	Tags             []string `json:"tags,omitempty"`
+	Downloads        int      `json:"downloads"`
+	UpdatedAt        string   `json:"updated_at"`
+	MinAppVersion    string   `json:"min_app_version,omitempty"`
+	IsInstalled      bool     `json:"is_installed"`
+	InstalledVersion string   `json:"installed_version,omitempty"`
+	HasUpdate        bool     `json:"has_update"`
+}
+
+// ToResponse converts StoreExtension to normalized response
+func (e *StoreExtension) ToResponse() StoreExtensionResponse {
+	return StoreExtensionResponse{
+		ID:            e.ID,
+		Name:          e.Name,
+		DisplayName:   e.getDisplayName(),
+		Version:       e.Version,
+		Author:        e.Author,
+		Description:   e.Description,
+		DownloadURL:   e.getDownloadURL(),
+		IconURL:       e.getIconURL(),
+		Category:      e.Category,
+		Tags:          e.Tags,
+		Downloads:     e.Downloads,
+		UpdatedAt:     e.UpdatedAt,
+		MinAppVersion: e.getMinAppVersion(),
+	}
+}
+
+// ExtensionStore manages the extension store
+type ExtensionStore struct {
+	registryURL string
+	cacheDir    string
+	cache       *StoreRegistry
+	cacheMu     sync.RWMutex
+	cacheTime   time.Time
+	cacheTTL    time.Duration
+}
+
+var (
+	extensionStore   *ExtensionStore
+	extensionStoreMu sync.Mutex
+)
+
+const (
+	defaultRegistryURL = "https://raw.githubusercontent.com/zarzet/SpotiFLAC-Extension/main/registry.json"
+	cacheTTL           = 30 * time.Minute
+	cacheFileName      = "store_cache.json"
+)
+
+// InitExtensionStore initializes the extension store
+func InitExtensionStore(cacheDir string) *ExtensionStore {
+	extensionStoreMu.Lock()
+	defer extensionStoreMu.Unlock()
+
+	if extensionStore == nil {
+		extensionStore = &ExtensionStore{
+			registryURL: defaultRegistryURL,
+			cacheDir:    cacheDir,
+			cacheTTL:    cacheTTL,
+		}
+		// Try to load from disk cache
+		extensionStore.loadDiskCache()
+	}
+	return extensionStore
+}
+
+// GetExtensionStore returns the singleton store instance
+func GetExtensionStore() *ExtensionStore {
+	extensionStoreMu.Lock()
+	defer extensionStoreMu.Unlock()
+	return extensionStore
+}
+
+// loadDiskCache loads cached registry from disk
+func (s *ExtensionStore) loadDiskCache() {
+	if s.cacheDir == "" {
+		return
+	}
+
+	cachePath := filepath.Join(s.cacheDir, cacheFileName)
+	data, err := os.ReadFile(cachePath)
+	if err != nil {
+		return
+	}
+
+	var cacheData struct {
+		Registry  StoreRegistry `json:"registry"`
+		CacheTime int64         `json:"cache_time"`
+	}
+
+	if err := json.Unmarshal(data, &cacheData); err != nil {
+		return
+	}
+
+	s.cache = &cacheData.Registry
+	s.cacheTime = time.Unix(cacheData.CacheTime, 0)
+	LogDebug("ExtensionStore", "Loaded %d extensions from disk cache", len(s.cache.Extensions))
+}
+
+// saveDiskCache saves registry to disk cache
+func (s *ExtensionStore) saveDiskCache() {
+	if s.cacheDir == "" || s.cache == nil {
+		return
+	}
+
+	cacheData := struct {
+		Registry  StoreRegistry `json:"registry"`
+		CacheTime int64         `json:"cache_time"`
+	}{
+		Registry:  *s.cache,
+		CacheTime: s.cacheTime.Unix(),
+	}
+
+	data, err := json.Marshal(cacheData)
+	if err != nil {
+		return
+	}
+
+	cachePath := filepath.Join(s.cacheDir, cacheFileName)
+	os.WriteFile(cachePath, data, 0644)
+}
+
+// FetchRegistry fetches the extension registry from GitHub
+func (s *ExtensionStore) FetchRegistry(forceRefresh bool) (*StoreRegistry, error) {
+	s.cacheMu.Lock()
+	defer s.cacheMu.Unlock()
+
+	// Return cached if valid and not forcing refresh
+	if !forceRefresh && s.cache != nil && time.Since(s.cacheTime) < s.cacheTTL {
+		LogDebug("ExtensionStore", "Using cached registry (%d extensions)", len(s.cache.Extensions))
+		return s.cache, nil
+	}
+
+	LogInfo("ExtensionStore", "Fetching registry from %s", s.registryURL)
+
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Get(s.registryURL)
+	if err != nil {
+		// Return cached data if available on network error
+		if s.cache != nil {
+			LogWarn("ExtensionStore", "Network error, using cached registry: %v", err)
+			return s.cache, nil
+		}
+		return nil, fmt.Errorf("failed to fetch registry: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		if s.cache != nil {
+			LogWarn("ExtensionStore", "HTTP %d, using cached registry", resp.StatusCode)
+			return s.cache, nil
+		}
+		return nil, fmt.Errorf("registry returned HTTP %d", resp.StatusCode)
+	}
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read registry: %w", err)
+	}
+
+	var registry StoreRegistry
+	if err := json.Unmarshal(body, &registry); err != nil {
+		return nil, fmt.Errorf("failed to parse registry: %w", err)
+	}
+
+	s.cache = &registry
+	s.cacheTime = time.Now()
+	s.saveDiskCache()
+
+	LogInfo("ExtensionStore", "Fetched %d extensions from registry", len(registry.Extensions))
+	return &registry, nil
+}
+
+// GetExtensionsWithStatus returns extensions with installation status
+func (s *ExtensionStore) GetExtensionsWithStatus() ([]StoreExtensionResponse, error) {
+	registry, err := s.FetchRegistry(false)
+	if err != nil {
+		return nil, err
+	}
+
+	manager := GetExtensionManager()
+	installed := make(map[string]string) // id -> version
+
+	if manager != nil {
+		for _, ext := range manager.GetAllExtensions() {
+			installed[ext.ID] = ext.Manifest.Version
+		}
+	}
+
+	result := make([]StoreExtensionResponse, len(registry.Extensions))
+	for i, ext := range registry.Extensions {
+		resp := ext.ToResponse()
+
+		if installedVersion, ok := installed[ext.ID]; ok {
+			resp.IsInstalled = true
+			resp.InstalledVersion = installedVersion
+			resp.HasUpdate = compareVersions(ext.Version, installedVersion) > 0
+		}
+
+		result[i] = resp
+	}
+
+	return result, nil
+}
+
+// DownloadExtension downloads an extension package to the specified path
+func (s *ExtensionStore) DownloadExtension(extensionID string, destPath string) error {
+	registry, err := s.FetchRegistry(false)
+	if err != nil {
+		return err
+	}
+
+	var ext *StoreExtension
+	for _, e := range registry.Extensions {
+		if e.ID == extensionID {
+			ext = &e
+			break
+		}
+	}
+
+	if ext == nil {
+		return fmt.Errorf("extension %s not found in store", extensionID)
+	}
+
+	LogInfo("ExtensionStore", "Downloading %s from %s", ext.getDisplayName(), ext.getDownloadURL())
+
+	client := &http.Client{Timeout: 5 * time.Minute}
+	resp, err := client.Get(ext.getDownloadURL())
+	if err != nil {
+		return fmt.Errorf("failed to download: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("download returned HTTP %d", resp.StatusCode)
+	}
+
+	out, err := os.Create(destPath)
+	if err != nil {
+		return fmt.Errorf("failed to create file: %w", err)
+	}
+	defer out.Close()
+
+	_, err = io.Copy(out, resp.Body)
+	if err != nil {
+		os.Remove(destPath)
+		return fmt.Errorf("failed to write file: %w", err)
+	}
+
+	LogInfo("ExtensionStore", "Downloaded %s to %s", ext.getDisplayName(), destPath)
+	return nil
+}
+
+// GetCategories returns all available categories
+func (s *ExtensionStore) GetCategories() []string {
+	return []string{
+		CategoryMetadata,
+		CategoryDownload,
+		CategoryUtility,
+		CategoryLyrics,
+		CategoryIntegration,
+	}
+}
+
+// SearchExtensions searches extensions by query
+func (s *ExtensionStore) SearchExtensions(query string, category string) ([]StoreExtensionResponse, error) {
+	extensions, err := s.GetExtensionsWithStatus()
+	if err != nil {
+		return nil, err
+	}
+
+	if query == "" && category == "" {
+		return extensions, nil
+	}
+
+	var result []StoreExtensionResponse
+	queryLower := toLower(query)
+
+	for _, ext := range extensions {
+		// Filter by category
+		if category != "" && ext.Category != category {
+			continue
+		}
+
+		// Filter by query
+		if query != "" {
+			if !containsIgnoreCase(ext.Name, queryLower) &&
+				!containsIgnoreCase(ext.DisplayName, queryLower) &&
+				!containsIgnoreCase(ext.Description, queryLower) &&
+				!containsIgnoreCase(ext.Author, queryLower) {
+				// Check tags
+				found := false
+				for _, tag := range ext.Tags {
+					if containsIgnoreCase(tag, queryLower) {
+						found = true
+						break
+					}
+				}
+				if !found {
+					continue
+				}
+			}
+		}
+
+		result = append(result, ext)
+	}
+
+	return result, nil
+}
+
+// ClearCache clears the in-memory and disk cache
+func (s *ExtensionStore) ClearCache() {
+	s.cacheMu.Lock()
+	defer s.cacheMu.Unlock()
+
+	s.cache = nil
+	s.cacheTime = time.Time{}
+
+	if s.cacheDir != "" {
+		cachePath := filepath.Join(s.cacheDir, cacheFileName)
+		os.Remove(cachePath)
+	}
+
+	LogInfo("ExtensionStore", "Cache cleared")
+}
+
+// Helper: case-insensitive contains
+func containsIgnoreCase(s, substr string) bool {
+	return containsStr(toLower(s), substr)
+}
+
+func toLower(s string) string {
+	result := make([]byte, len(s))
+	for i := 0; i < len(s); i++ {
+		c := s[i]
+		if c >= 'A' && c <= 'Z' {
+			c += 'a' - 'A'
+		}
+		result[i] = c
+	}
+	return string(result)
+}
+
+func containsStr(s, substr string) bool {
+	return len(substr) == 0 || (len(s) >= len(substr) && findSubstring(s, substr) >= 0)
+}
+
+func findSubstring(s, substr string) int {
+	for i := 0; i <= len(s)-len(substr); i++ {
+		if s[i:i+len(substr)] == substr {
+			return i
+		}
+	}
+	return -1
+}

go_backend/extension_test.go

@@ -0,0 +1,329 @@
+package gobackend
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/dop251/goja"
+)
+
+func TestParseManifest_Valid(t *testing.T) {
+	validManifest := `{
+		"name": "test-provider",
+		"displayName": "Test Provider",
+		"version": "1.0.0",
+		"author": "Test Author",
+		"description": "A test extension",
+		"type": ["metadata_provider"],
+		"permissions": {
+			"network": ["api.test.com"],
+			"storage": true
+		}
+	}`
+
+	manifest, err := ParseManifest([]byte(validManifest))
+	if err != nil {
+		t.Fatalf("Expected valid manifest to parse, got error: %v", err)
+	}
+
+	if manifest.Name != "test-provider" {
+		t.Errorf("Expected name 'test-provider', got '%s'", manifest.Name)
+	}
+
+	if manifest.Version != "1.0.0" {
+		t.Errorf("Expected version '1.0.0', got '%s'", manifest.Version)
+	}
+
+	if !manifest.IsMetadataProvider() {
+		t.Error("Expected IsMetadataProvider() to return true")
+	}
+
+	if manifest.IsDownloadProvider() {
+		t.Error("Expected IsDownloadProvider() to return false")
+	}
+}
+
+func TestParseManifest_MissingName(t *testing.T) {
+	invalidManifest := `{
+		"version": "1.0.0",
+		"author": "Test Author",
+		"description": "A test extension",
+		"type": ["metadata_provider"]
+	}`
+
+	_, err := ParseManifest([]byte(invalidManifest))
+	if err == nil {
+		t.Fatal("Expected error for missing name")
+	}
+}
+
+func TestParseManifest_MissingType(t *testing.T) {
+	invalidManifest := `{
+		"name": "test-provider",
+		"version": "1.0.0",
+		"author": "Test Author",
+		"description": "A test extension"
+	}`
+
+	_, err := ParseManifest([]byte(invalidManifest))
+	if err == nil {
+		t.Fatal("Expected error for missing type")
+	}
+}
+
+func TestIsDomainAllowed(t *testing.T) {
+	manifest := &ExtensionManifest{
+		Permissions: ExtensionPermissions{
+			Network: []string{"api.test.com", "*.example.com"},
+		},
+	}
+
+	tests := []struct {
+		domain   string
+		expected bool
+	}{
+		{"api.test.com", true},
+		{"api.example.com", true},
+		{"sub.example.com", true},
+		{"notallowed.com", false},
+		{"test.com", false},
+	}
+
+	for _, tt := range tests {
+		result := manifest.IsDomainAllowed(tt.domain)
+		if result != tt.expected {
+			t.Errorf("IsDomainAllowed(%s) = %v, expected %v", tt.domain, result, tt.expected)
+		}
+	}
+}
+
+func TestExtensionRuntime_NetworkSandbox(t *testing.T) {
+	// Create a mock extension with limited network permissions
+	ext := &LoadedExtension{
+		ID: "test-ext",
+		Manifest: &ExtensionManifest{
+			Name: "test-ext",
+			Permissions: ExtensionPermissions{
+				Network: []string{"api.allowed.com", "*.wildcard.com"},
+			},
+		},
+		DataDir: t.TempDir(),
+	}
+
+	runtime := NewExtensionRuntime(ext)
+
+	// Test allowed domains
+	if err := runtime.validateDomain("https://api.allowed.com/path"); err != nil {
+		t.Errorf("Expected api.allowed.com to be allowed, got error: %v", err)
+	}
+
+	if err := runtime.validateDomain("https://sub.wildcard.com/path"); err != nil {
+		t.Errorf("Expected sub.wildcard.com to be allowed (wildcard), got error: %v", err)
+	}
+
+	// Test blocked domains
+	if err := runtime.validateDomain("https://blocked.com/path"); err == nil {
+		t.Error("Expected blocked.com to be denied")
+	}
+
+	if err := runtime.validateDomain("https://notallowed.com/path"); err == nil {
+		t.Error("Expected notallowed.com to be denied")
+	}
+}
+
+func TestExtensionRuntime_FileSandbox(t *testing.T) {
+	tempDir := t.TempDir()
+
+	ext := &LoadedExtension{
+		ID: "test-ext",
+		Manifest: &ExtensionManifest{
+			Name: "test-ext",
+			Permissions: ExtensionPermissions{
+				File: true, // Enable file permission for test
+			},
+		},
+		DataDir: tempDir,
+	}
+
+	runtime := NewExtensionRuntime(ext)
+
+	// Test valid path within sandbox
+	validPath, err := runtime.validatePath("test.txt")
+	if err != nil {
+		t.Errorf("Expected relative path to be valid, got error: %v", err)
+	}
+	if validPath == "" {
+		t.Error("Expected non-empty path")
+	}
+
+	// Test path traversal attack
+	_, err = runtime.validatePath("../../../etc/passwd")
+	if err == nil {
+		t.Error("Expected path traversal to be blocked")
+	}
+
+	// Test nested path within sandbox (should be allowed)
+	nestedPath, err := runtime.validatePath("subdir/file.txt")
+	if err != nil {
+		t.Errorf("Expected nested path to be valid, got error: %v", err)
+	}
+	if nestedPath == "" {
+		t.Error("Expected non-empty nested path")
+	}
+
+	// Test absolute path should be blocked (security fix)
+	// Use platform-appropriate absolute path
+	var absPath string
+	if filepath.IsAbs("C:\\Windows\\System32") {
+		absPath = "C:\\Windows\\System32\\test.txt" // Windows
+	} else {
+		absPath = "/etc/passwd" // Unix
+	}
+	_, err = runtime.validatePath(absPath)
+	if err == nil {
+		t.Error("Expected absolute path to be blocked")
+	}
+
+	// Test that extension without file permission is blocked
+	extNoFile := &LoadedExtension{
+		ID: "test-ext-no-file",
+		Manifest: &ExtensionManifest{
+			Name: "test-ext-no-file",
+			Permissions: ExtensionPermissions{
+				File: false, // No file permission
+			},
+		},
+		DataDir: tempDir,
+	}
+	runtimeNoFile := NewExtensionRuntime(extNoFile)
+	_, err = runtimeNoFile.validatePath("test.txt")
+	if err == nil {
+		t.Error("Expected file access to be denied without file permission")
+	}
+}
+
+func TestExtensionRuntime_UtilityFunctions(t *testing.T) {
+	ext := &LoadedExtension{
+		ID: "test-ext",
+		Manifest: &ExtensionManifest{
+			Name: "test-ext",
+		},
+		DataDir: t.TempDir(),
+	}
+
+	runtime := NewExtensionRuntime(ext)
+	vm := goja.New()
+	runtime.RegisterAPIs(vm)
+
+	// Test base64 encode/decode
+	result, err := vm.RunString(`utils.base64Encode("hello")`)
+	if err != nil {
+		t.Fatalf("base64Encode failed: %v", err)
+	}
+	if result.String() != "aGVsbG8=" {
+		t.Errorf("Expected 'aGVsbG8=', got '%s'", result.String())
+	}
+
+	result, err = vm.RunString(`utils.base64Decode("aGVsbG8=")`)
+	if err != nil {
+		t.Fatalf("base64Decode failed: %v", err)
+	}
+	if result.String() != "hello" {
+		t.Errorf("Expected 'hello', got '%s'", result.String())
+	}
+
+	// Test MD5
+	result, err = vm.RunString(`utils.md5("hello")`)
+	if err != nil {
+		t.Fatalf("md5 failed: %v", err)
+	}
+	if result.String() != "5d41402abc4b2a76b9719d911017c592" {
+		t.Errorf("Expected '5d41402abc4b2a76b9719d911017c592', got '%s'", result.String())
+	}
+
+	// Test JSON parse/stringify
+	result, err = vm.RunString(`utils.stringifyJSON({name: "test", value: 123})`)
+	if err != nil {
+		t.Fatalf("stringifyJSON failed: %v", err)
+	}
+	// JSON output may vary in order, just check it's valid
+	if result.String() == "" {
+		t.Error("Expected non-empty JSON string")
+	}
+}
+
+func TestExtensionRuntime_SSRFProtection(t *testing.T) {
+	// Create extension with limited network permissions
+	ext := &LoadedExtension{
+		ID: "test-ext",
+		Manifest: &ExtensionManifest{
+			Name: "test-ext",
+			Permissions: ExtensionPermissions{
+				Network: []string{"api.example.com"},
+			},
+		},
+		DataDir: t.TempDir(),
+	}
+
+	runtime := NewExtensionRuntime(ext)
+
+	// Test that private IPs are blocked (SSRF protection)
+	privateIPs := []string{
+		"http://localhost/admin",
+		"http://127.0.0.1/admin",
+		"http://192.168.1.1/admin",
+		"http://10.0.0.1/admin",
+		"http://172.16.0.1/admin",
+		"http://169.254.169.254/latest/meta-data/", // AWS metadata
+		"http://router.local/admin",
+	}
+
+	for _, url := range privateIPs {
+		err := runtime.validateDomain(url)
+		if err == nil {
+			t.Errorf("Expected private IP/host '%s' to be blocked", url)
+		}
+	}
+
+	// Test that allowed public domain still works
+	if err := runtime.validateDomain("https://api.example.com/path"); err != nil {
+		t.Errorf("Expected api.example.com to be allowed, got error: %v", err)
+	}
+}
+
+func TestIsPrivateIP(t *testing.T) {
+	tests := []struct {
+		host     string
+		expected bool
+	}{
+		// Private IPs should be blocked
+		{"localhost", true},
+		{"127.0.0.1", true},
+		{"127.0.0.2", true},
+		{"10.0.0.1", true},
+		{"10.255.255.255", true},
+		{"172.16.0.1", true},
+		{"172.31.255.255", true},
+		{"192.168.0.1", true},
+		{"192.168.255.255", true},
+		{"169.254.169.254", true}, // AWS metadata
+		{"router.local", true},
+		{"mydevice.local", true},
+
+		// Public IPs should be allowed
+		{"8.8.8.8", false},
+		{"1.1.1.1", false},
+		{"api.example.com", false},
+		{"google.com", false},
+		{"172.15.0.1", false},  // Just outside 172.16-31 range
+		{"172.32.0.1", false},  // Just outside 172.16-31 range
+		{"192.167.0.1", false}, // Not 192.168.x.x
+	}
+
+	for _, tt := range tests {
+		result := isPrivateIP(tt.host)
+		if result != tt.expected {
+			t.Errorf("isPrivateIP(%s) = %v, expected %v", tt.host, result, tt.expected)
+		}
+	}
+}

go_backend/extension_timeout.go

@@ -0,0 +1,118 @@
+// Package gobackend provides timeout execution for extension JS code
+package gobackend
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/dop251/goja"
+)
+
+// JSExecutionError represents an error during JS execution
+type JSExecutionError struct {
+	Message   string
+	IsTimeout bool
+}
+
+func (e *JSExecutionError) Error() string {
+	return e.Message
+}
+
+// RunWithTimeout executes JavaScript code with a timeout
+// Returns the result value and any error (including timeout)
+func RunWithTimeout(vm *goja.Runtime, script string, timeout time.Duration) (goja.Value, error) {
+	if timeout <= 0 {
+		timeout = DefaultJSTimeout
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+
+	// Channel to receive result
+	type result struct {
+		value goja.Value
+		err   error
+	}
+	resultCh := make(chan result, 1)
+
+	// Track if we've interrupted
+	var interrupted bool
+	var interruptMu sync.Mutex
+
+	// Run script in goroutine
+	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				// Check if this was our interrupt
+				interruptMu.Lock()
+				wasInterrupted := interrupted
+				interruptMu.Unlock()
+
+				if wasInterrupted {
+					resultCh <- result{nil, &JSExecutionError{
+						Message:   "execution timeout exceeded",
+						IsTimeout: true,
+					}}
+				} else {
+					resultCh <- result{nil, fmt.Errorf("panic during execution: %v", r)}
+				}
+			}
+		}()
+
+		val, err := vm.RunString(script)
+		resultCh <- result{val, err}
+	}()
+
+	// Wait for result or timeout
+	select {
+	case res := <-resultCh:
+		return res.value, res.err
+	case <-ctx.Done():
+		// Timeout - interrupt the VM
+		interruptMu.Lock()
+		interrupted = true
+		interruptMu.Unlock()
+
+		vm.Interrupt("execution timeout")
+
+		// Wait a bit for the goroutine to finish
+		select {
+		case res := <-resultCh:
+			// If we got a result after interrupt, it might be the timeout error
+			if res.err != nil {
+				return nil, res.err
+			}
+			return nil, &JSExecutionError{
+				Message:   "execution timeout exceeded",
+				IsTimeout: true,
+			}
+		case <-time.After(1 * time.Second):
+			// Force return timeout error
+			return nil, &JSExecutionError{
+				Message:   "execution timeout exceeded (force)",
+				IsTimeout: true,
+			}
+		}
+	}
+}
+
+// RunWithTimeoutAndRecover runs JS with timeout and clears interrupt state after
+// This should be used when you want to continue using the VM after a timeout
+func RunWithTimeoutAndRecover(vm *goja.Runtime, script string, timeout time.Duration) (goja.Value, error) {
+	result, err := RunWithTimeout(vm, script, timeout)
+
+	// Clear any interrupt state so VM can be reused
+	vm.ClearInterrupt()
+
+	return result, err
+}
+
+// IsTimeoutError checks if an error is a timeout error
+func IsTimeoutError(err error) bool {
+	if jsErr, ok := err.(*JSExecutionError); ok {
+		return jsErr.IsTimeout
+	}
+	return false
+}

go_backend/filename.go

@@ -6,28 +6,21 @@ import (
 	"strings"
 )
 
-// Invalid filename characters for Android/Windows/Linux
 var invalidChars = regexp.MustCompile(`[<>:"/\\|?*\x00-\x1f]`)
 
-// sanitizeFilename removes invalid characters from filename
 func sanitizeFilename(filename string) string {
-	// Replace invalid characters with underscore
 	sanitized := invalidChars.ReplaceAllString(filename, "_")
 	
-	// Remove leading/trailing spaces and dots
 	sanitized = strings.TrimSpace(sanitized)
 	sanitized = strings.Trim(sanitized, ".")
 	
-	// Collapse multiple underscores
 	multiUnderscore := regexp.MustCompile(`_+`)
 	sanitized = multiUnderscore.ReplaceAllString(sanitized, "_")
 	
-	// Limit length (Android has 255 byte limit for filenames)
 	if len(sanitized) > 200 {
 		sanitized = sanitized[:200]
 	}
 	
-	// Ensure not empty
 	if sanitized == "" {
 		sanitized = "untitled"
 	}
@@ -35,7 +28,6 @@ func sanitizeFilename(filename string) string {
 	return sanitized
 }
 
-// buildFilenameFromTemplate builds a filename from template and metadata
 func buildFilenameFromTemplate(template string, metadata map[string]interface{}) string {
 	if template == "" {
 		template = "{artist} - {title}"
@@ -43,7 +35,6 @@ func buildFilenameFromTemplate(template string, metadata map[string]interface{})
 	
 	result := template
 	
-	// Replace placeholders
 	placeholders := map[string]string{
 		"{title}":  getString(metadata, "title"),
 		"{artist}": getString(metadata, "artist"),
@@ -63,7 +54,6 @@ func buildFilenameFromTemplate(template string, metadata map[string]interface{})
 func getString(m map[string]interface{}, key string) string {
 	if v, ok := m[key]; ok {
 		if s, ok := v.(string); ok {
-			// Trim leading/trailing whitespace to prevent filename issues
 			return strings.TrimSpace(s)
 		}
 	}
@@ -98,7 +88,6 @@ func formatDiscNumber(n int) string {
 	return fmt.Sprintf("%d", n)
 }
 
-// extractYear extracts year from date string (YYYY-MM-DD or YYYY)
 func extractYear(date string) string {
 	if len(date) >= 4 {
 		return date[:4]

go_backend/go.mod

@@ -1,18 +1,29 @@
 module github.com/zarz/spotiflac_android/go_backend
 
-go 1.24.0
+go 1.25.0
 
-toolchain go1.24.5
+toolchain go1.25.6
 
 require (
+	github.com/dop251/goja v0.0.0-20260106131823-651366fbe6e3
 	github.com/go-flac/flacpicture v0.3.0
 	github.com/go-flac/flacvorbis v0.2.0
 	github.com/go-flac/go-flac v1.0.0
+	github.com/refraction-networking/utls v1.8.2
+	golang.org/x/mobile v0.0.0-20260120165949-40bd9ace6ce4
+	golang.org/x/net v0.49.0
 )
 
 require (
-	golang.org/x/mobile v0.0.0-20251209145715-2553ed8ce294 // indirect
-	golang.org/x/mod v0.31.0 // indirect
+	github.com/andybalholm/brotli v1.0.6 // indirect
+	github.com/dlclark/regexp2 v1.11.4 // indirect
+	github.com/go-sourcemap/sourcemap v2.1.3+incompatible // indirect
+	github.com/google/pprof v0.0.0-20230207041349-798e818bf904 // indirect
+	github.com/klauspost/compress v1.17.4 // indirect
+	golang.org/x/crypto v0.47.0 // indirect
+	golang.org/x/mod v0.32.0 // indirect
 	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/tools v0.40.0 // indirect
+	golang.org/x/sys v0.40.0 // indirect
+	golang.org/x/text v0.33.0 // indirect
+	golang.org/x/tools v0.41.0 // indirect
 )

go_backend/go.sum

@@ -1,14 +1,42 @@
+github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
+github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/andybalholm/brotli v1.0.6 h1:Yf9fFpf49Zrxb9NlQaluyE92/+X7UVHlhMNJN2sxfOI=
+github.com/andybalholm/brotli v1.0.6/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
+github.com/dlclark/regexp2 v1.11.4 h1:rPYF9/LECdNymJufQKmri9gV604RvvABwgOA8un7yAo=
+github.com/dlclark/regexp2 v1.11.4/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dop251/goja v0.0.0-20260106131823-651366fbe6e3 h1:bVp3yUzvSAJzu9GqID+Z96P+eu5TKnIMJSV4QaZMauM=
+github.com/dop251/goja v0.0.0-20260106131823-651366fbe6e3/go.mod h1:MxLav0peU43GgvwVgNbLAj1s/bSGboKkhuULvq/7hx4=
 github.com/go-flac/flacpicture v0.3.0 h1:LkmTxzFLIynwfhHiZsX0s8xcr3/u33MzvV89u+zOT8I=
 github.com/go-flac/flacpicture v0.3.0/go.mod h1:DPbrzVYQ3fJcvSgLFp9HXIrEQEdfdk/+m0nQCzwodZI=
 github.com/go-flac/flacvorbis v0.2.0 h1:KH0xjpkNTXFER4cszH4zeJxYcrHbUobz/RticWGOESs=
 github.com/go-flac/flacvorbis v0.2.0/go.mod h1:uIysHOtuU7OLGoCRG92bvnkg7QEqHx19qKRV6K1pBrI=
 github.com/go-flac/go-flac v1.0.0 h1:6qI9XOVLcO50xpzm3nXvO31BgDgHhnr/p/rER/K/doY=
 github.com/go-flac/go-flac v1.0.0/go.mod h1:WnZhcpmq4u1UdZMNn9LYSoASpWOCMOoxXxcWEHSzkW8=
-golang.org/x/mobile v0.0.0-20251209145715-2553ed8ce294 h1:Cr6kbEvA6nqvdHynE4CtVKlqpZB9dS1Jva/6IsHA19g=
-golang.org/x/mobile v0.0.0-20251209145715-2553ed8ce294/go.mod h1:RdZ+3sb4CVgpCFnzv+I4haEpwqFfsfzlLHs3L7ok+e0=
-golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
-golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
+github.com/go-sourcemap/sourcemap v2.1.3+incompatible h1:W1iEw64niKVGogNgBN3ePyLFfuisuzeidWPMPWmECqU=
+github.com/go-sourcemap/sourcemap v2.1.3+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/pprof v0.0.0-20230207041349-798e818bf904 h1:4/hN5RUoecvl+RmJRE2YxKWtnnQls6rQjjW5oV7qg2U=
+github.com/google/pprof v0.0.0-20230207041349-798e818bf904/go.mod h1:uglQLonpP8qtYCYyzA+8c/9qtqgA3qsXGYqCPKARAFg=
+github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4=
+github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
+github.com/refraction-networking/utls v1.8.2 h1:j4Q1gJj0xngdeH+Ox/qND11aEfhpgoEvV+S9iJ2IdQo=
+github.com/refraction-networking/utls v1.8.2/go.mod h1:jkSOEkLqn+S/jtpEHPOsVv/4V4EVnelwbMQl4vCWXAM=
+golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
+golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
+golang.org/x/mobile v0.0.0-20260120165949-40bd9ace6ce4 h1:C3JuLOLhdaE75vk5m7u18NvZciRk+lnO34xcXl3NPTU=
+golang.org/x/mobile v0.0.0-20260120165949-40bd9ace6ce4/go.mod h1:yHJY0EGzMJ0i5ONrrhdpDSSnoyres5LO7D2hSIbJJ5I=
+golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
+golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
+golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
+golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
 golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
 golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
-golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
-golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
+golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
+golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
+golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
+golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
+golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=

go_backend/httputil.go

@@ -15,74 +15,33 @@ import (
 	"time"
 )
 
-// HTTP utility functions for consistent request handling across all downloaders
-
 // getRandomUserAgent generates a random Windows Chrome User-Agent string
-// Uses same format as PC version (referensi/backend/spotify_metadata.go) for better API compatibility
+// Uses modern Chrome format with build and patch numbers
+// Windows 11 still reports as "Windows NT 10.0" for compatibility
 func getRandomUserAgent() string {
-	// Windows 10/11 Chrome format - same as PC version for maximum compatibility
-	// Some APIs may block mobile User-Agents, so we use desktop format
-	winMajor := rand.Intn(2) + 10  // Windows 10 or 11
-	
-	chromeVersion := rand.Intn(25) + 100 // Chrome 100-124
-	chromeBuild := rand.Intn(1500) + 3000 // Build 3000-4500
-	chromePatch := rand.Intn(65) + 60 // Patch 60-125
-	
+	// Chrome version 120-145 (modern range)
+	chromeVersion := rand.Intn(26) + 120
+	chromeBuild := rand.Intn(1500) + 6000
+	chromePatch := rand.Intn(200) + 100
+
 	return fmt.Sprintf(
-		"Mozilla/5.0 (Windows NT %d.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/%d.0.%d.%d Safari/537.36",
-		winMajor,
+		"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/%d.0.%d.%d Safari/537.36",
 		chromeVersion,
 		chromeBuild,
 		chromePatch,
 	)
 }
 
-// getRandomMacUserAgent generates a random Mac Chrome User-Agent string
-// Alternative format matching referensi/backend/spotify_metadata.go exactly
-func getRandomMacUserAgent() string {
-	macMajor := rand.Intn(4) + 11  // macOS 11-14
-	macMinor := rand.Intn(5) + 4   // Minor 4-8
-	webkitMajor := rand.Intn(7) + 530
-	webkitMinor := rand.Intn(7) + 30
-	chromeMajor := rand.Intn(25) + 80
-	chromeBuild := rand.Intn(1500) + 3000
-	chromePatch := rand.Intn(65) + 60
-	safariMajor := rand.Intn(7) + 530
-	safariMinor := rand.Intn(6) + 30
-
-	return fmt.Sprintf(
-		"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_%d_%d) AppleWebKit/%d.%d (KHTML, like Gecko) Chrome/%d.0.%d.%d Safari/%d.%d",
-		macMajor,
-		macMinor,
-		webkitMajor,
-		webkitMinor,
-		chromeMajor,
-		chromeBuild,
-		chromePatch,
-		safariMajor,
-		safariMinor,
-	)
-}
-
-// getRandomDesktopUserAgent randomly picks between Windows and Mac User-Agent
-func getRandomDesktopUserAgent() string {
-	if rand.Intn(2) == 0 {
-		return getRandomUserAgent() // Windows
-	}
-	return getRandomMacUserAgent() // Mac
-}
-
-// Default timeout values
 const (
-	DefaultTimeout     = 60 * time.Second  // Default HTTP timeout
-	DownloadTimeout    = 120 * time.Second // Timeout for file downloads
-	SongLinkTimeout    = 30 * time.Second  // Timeout for SongLink API
-	DefaultMaxRetries  = 3                 // Default retry count
-	DefaultRetryDelay  = 1 * time.Second   // Initial retry delay
+	DefaultTimeout    = 60 * time.Second
+	DownloadTimeout   = 120 * time.Second
+	SongLinkTimeout   = 30 * time.Second
+	DefaultMaxRetries = 3
+	DefaultRetryDelay = 1 * time.Second
+	Second            = time.Second // Exported for use in other files
 )
 
 // Shared transport with connection pooling to prevent TCP exhaustion
-// Optimized for large file downloads (FLAC ~30-50MB)
 var sharedTransport = &http.Transport{
 	DialContext: (&net.Dialer{
 		Timeout:   30 * time.Second,
@@ -94,27 +53,23 @@ var sharedTransport = &http.Transport{
 	IdleConnTimeout:       90 * time.Second,
 	TLSHandshakeTimeout:   10 * time.Second,
 	ExpectContinueTimeout: 1 * time.Second,
-	DisableKeepAlives:     false, // Enable keep-alives for connection reuse
+	DisableKeepAlives:     false,
 	ForceAttemptHTTP2:     true,
-	WriteBufferSize:       64 * 1024,  // 64KB write buffer
-	ReadBufferSize:        64 * 1024,  // 64KB read buffer
-	DisableCompression:    true,       // FLAC is already compressed
+	WriteBufferSize:       64 * 1024,
+	ReadBufferSize:        64 * 1024,
+	DisableCompression:    true,
 }
 
-// Shared HTTP client for general requests (reuses connections)
 var sharedClient = &http.Client{
 	Transport: sharedTransport,
 	Timeout:   DefaultTimeout,
 }
 
-// Shared HTTP client for downloads (longer timeout, reuses connections)
 var downloadClient = &http.Client{
 	Transport: sharedTransport,
 	Timeout:   DownloadTimeout,
 }
 
-// NewHTTPClientWithTimeout creates an HTTP client with specified timeout
-// Uses shared transport for connection reuse
 func NewHTTPClientWithTimeout(timeout time.Duration) *http.Client {
 	return &http.Client{
 		Transport: sharedTransport,
@@ -122,29 +77,24 @@ func NewHTTPClientWithTimeout(timeout time.Duration) *http.Client {
 	}
 }
 
-// GetSharedClient returns the shared HTTP client for general requests
 func GetSharedClient() *http.Client {
 	return sharedClient
 }
 
-// GetDownloadClient returns the shared HTTP client for downloads
 func GetDownloadClient() *http.Client {
 	return downloadClient
 }
 
 // CloseIdleConnections closes idle connections in the shared transport
-// Call this periodically during large batch downloads to prevent connection buildup
 func CloseIdleConnections() {
 	sharedTransport.CloseIdleConnections()
 }
 
-// DoRequestWithUserAgent executes an HTTP request with a random User-Agent header
 // Also checks for ISP blocking on errors
 func DoRequestWithUserAgent(client *http.Client, req *http.Request) (*http.Response, error) {
 	req.Header.Set("User-Agent", getRandomUserAgent())
 	resp, err := client.Do(req)
 	if err != nil {
-		// Check for ISP blocking
 		CheckAndLogISPBlocking(err, req.URL.String(), "HTTP")
 	}
 	return resp, err
@@ -158,7 +108,6 @@ type RetryConfig struct {
 	BackoffFactor float64
 }
 
-// DefaultRetryConfig returns default retry configuration
 func DefaultRetryConfig() RetryConfig {
 	return RetryConfig{
 		MaxRetries:    DefaultMaxRetries,
@@ -184,15 +133,15 @@ func DoRequestWithRetry(client *http.Client, req *http.Request, config RetryConf
 		resp, err := client.Do(reqCopy)
 		if err != nil {
 			lastErr = err
-			
+
 			// Check for ISP blocking on network errors
 			if CheckAndLogISPBlocking(err, requestURL, "HTTP") {
 				// Don't retry if ISP blocking is detected - it won't help
 				return nil, WrapErrorWithISPCheck(err, requestURL, "HTTP")
 			}
-			
+
 			if attempt < config.MaxRetries {
-				GoLog("[HTTP] Request failed (attempt %d/%d): %v, retrying in %v...\n", 
+				GoLog("[HTTP] Request failed (attempt %d/%d): %v, retrying in %v...\n",
 					attempt+1, config.MaxRetries+1, err, delay)
 				time.Sleep(delay)
 				delay = calculateNextDelay(delay, config)
@@ -227,13 +176,13 @@ func DoRequestWithRetry(client *http.Client, req *http.Request, config RetryConf
 			body, _ := io.ReadAll(resp.Body)
 			resp.Body.Close()
 			bodyStr := strings.ToLower(string(body))
-			
+
 			// Check if response looks like ISP blocking page
 			ispBlockingIndicators := []string{
 				"blocked", "forbidden", "access denied", "not available in your",
 				"restricted", "censored", "unavailable for legal", "blocked by",
 			}
-			
+
 			for _, indicator := range ispBlockingIndicators {
 				if strings.Contains(bodyStr, indicator) {
 					LogError("HTTP", "ISP BLOCKING DETECTED via HTTP %d response", resp.StatusCode)
@@ -264,16 +213,11 @@ func DoRequestWithRetry(client *http.Client, req *http.Request, config RetryConf
 	return nil, fmt.Errorf("request failed after %d retries: %w", config.MaxRetries+1, lastErr)
 }
 
-// calculateNextDelay calculates the next delay with exponential backoff
 func calculateNextDelay(currentDelay time.Duration, config RetryConfig) time.Duration {
 	nextDelay := time.Duration(float64(currentDelay) * config.BackoffFactor)
-	if nextDelay > config.MaxDelay {
-		nextDelay = config.MaxDelay
-	}
-	return nextDelay
+	return min(nextDelay, config.MaxDelay)
 }
 
-// getRetryAfterDuration parses Retry-After header and returns duration
 // Returns 60 seconds as default if header is missing or invalid
 func getRetryAfterDuration(resp *http.Response) time.Duration {
 	retryAfter := resp.Header.Get("Retry-After")
@@ -316,7 +260,6 @@ func ReadResponseBody(resp *http.Response) ([]byte, error) {
 	return body, nil
 }
 
-// ValidateResponse checks if response is valid (non-nil, status 2xx)
 func ValidateResponse(resp *http.Response) error {
 	if resp == nil {
 		return fmt.Errorf("response is nil")
@@ -345,7 +288,6 @@ func BuildErrorMessage(apiURL string, statusCode int, responsePreview string) st
 	return msg
 }
 
-// ISPBlockingError represents an error caused by ISP blocking
 type ISPBlockingError struct {
 	Domain      string
 	Reason      string
@@ -461,7 +403,6 @@ func IsISPBlocking(err error, requestURL string) *ISPBlockingError {
 	return nil
 }
 
-// CheckAndLogISPBlocking checks for ISP blocking and logs if detected
 // Returns true if ISP blocking was detected
 func CheckAndLogISPBlocking(err error, requestURL string, tag string) bool {
 	ispErr := IsISPBlocking(err, requestURL)
@@ -481,7 +422,7 @@ func extractDomain(rawURL string) string {
 	if rawURL == "" {
 		return "unknown"
 	}
-	
+
 	parsed, err := url.Parse(rawURL)
 	if err != nil {
 		// Try to extract domain manually
@@ -492,24 +433,23 @@ func extractDomain(rawURL string) string {
 		}
 		return rawURL
 	}
-	
+
 	if parsed.Host != "" {
 		return parsed.Host
 	}
 	return "unknown"
 }
 
-// WrapErrorWithISPCheck wraps an error with ISP blocking detection
 // If ISP blocking is detected, returns a more descriptive error
 func WrapErrorWithISPCheck(err error, requestURL string, tag string) error {
 	if err == nil {
 		return nil
 	}
-	
+
 	if CheckAndLogISPBlocking(err, requestURL, tag) {
 		domain := extractDomain(requestURL)
 		return fmt.Errorf("ISP blocking detected for %s - try using VPN or change DNS to 1.1.1.1/8.8.8.8: %w", domain, err)
 	}
-	
+
 	return err
 }

go_backend/httputil_ios.go

@@ -0,0 +1,27 @@
+//go:build ios
+
+package gobackend
+
+import (
+	"net/http"
+)
+
+// iOS version: uTLS is not supported on iOS due to cgo DNS resolver issues
+// Fall back to standard HTTP client
+
+// GetCloudflareBypassClient returns the standard HTTP client on iOS
+// uTLS is not available on iOS due to cgo DNS resolver compatibility issues
+func GetCloudflareBypassClient() *http.Client {
+	return sharedClient
+}
+
+// DoRequestWithCloudflareBypass on iOS just uses the standard client
+// uTLS Chrome fingerprint bypass is not available on iOS
+func DoRequestWithCloudflareBypass(req *http.Request) (*http.Response, error) {
+	req.Header.Set("User-Agent", getRandomUserAgent())
+	resp, err := sharedClient.Do(req)
+	if err != nil {
+		CheckAndLogISPBlocking(err, req.URL.String(), "HTTP")
+	}
+	return resp, err
+}

go_backend/httputil_utls.go

@@ -0,0 +1,188 @@
+//go:build !ios
+
+package gobackend
+
+import (
+	"context"
+	"crypto/tls"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+	"sync"
+
+	utls "github.com/refraction-networking/utls"
+	"golang.org/x/net/http2"
+)
+
+// uTLS transport that mimics Chrome's TLS fingerprint to bypass Cloudflare
+// Uses HTTP/2 for optimal performance as uTLS works best with HTTP/2
+type utlsTransport struct {
+	dialer       *net.Dialer
+	mu           sync.Mutex
+	h2Transports map[string]*http2.Transport
+}
+
+func newUTLSTransport() *utlsTransport {
+	return &utlsTransport{
+		dialer: &net.Dialer{
+			Timeout:   30 * Second,
+			KeepAlive: 30 * Second,
+		},
+		h2Transports: make(map[string]*http2.Transport),
+	}
+}
+
+func (t *utlsTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	// For non-HTTPS, use standard transport
+	if req.URL.Scheme != "https" {
+		return sharedTransport.RoundTrip(req)
+	}
+
+	host := req.URL.Hostname()
+	port := t.getPort(req.URL)
+	addr := net.JoinHostPort(host, port)
+
+	// Dial TCP connection
+	conn, err := t.dialer.DialContext(req.Context(), "tcp", addr)
+	if err != nil {
+		return nil, err
+	}
+
+	// Create uTLS connection with Chrome fingerprint (supports HTTP/2 ALPN)
+	tlsConn := utls.UClient(conn, &utls.Config{
+		ServerName: host,
+		NextProtos: []string{"h2", "http/1.1"}, // Prefer HTTP/2
+	}, utls.HelloChrome_Auto)
+
+	// Perform TLS handshake
+	if err := tlsConn.Handshake(); err != nil {
+		conn.Close()
+		return nil, err
+	}
+
+	// Check if server supports HTTP/2
+	negotiatedProto := tlsConn.ConnectionState().NegotiatedProtocol
+
+	if negotiatedProto == "h2" {
+		// Use HTTP/2 transport
+		h2Transport := &http2.Transport{
+			DialTLSContext: func(ctx context.Context, network, addr string, cfg *tls.Config) (net.Conn, error) {
+				return tlsConn, nil
+			},
+			AllowHTTP:          false,
+			DisableCompression: false,
+		}
+		return h2Transport.RoundTrip(req)
+	}
+
+	// Fallback to HTTP/1.1
+	transport := &http.Transport{
+		DialTLSContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			return tlsConn, nil
+		},
+		DisableKeepAlives: true,
+	}
+
+	return transport.RoundTrip(req)
+}
+
+func (t *utlsTransport) getPort(u *url.URL) string {
+	if u.Port() != "" {
+		return u.Port()
+	}
+	if u.Scheme == "https" {
+		return "443"
+	}
+	return "80"
+}
+
+// Cloudflare bypass client using uTLS Chrome fingerprint
+var cloudflareBypassTransport = newUTLSTransport()
+
+var cloudflareBypassClient = &http.Client{
+	Transport: cloudflareBypassTransport,
+	Timeout:   DefaultTimeout,
+}
+
+// GetCloudflareBypassClient returns an HTTP client that mimics Chrome's TLS fingerprint
+// Use this when requests are blocked by Cloudflare (common when using VPN)
+func GetCloudflareBypassClient() *http.Client {
+	return cloudflareBypassClient
+}
+
+// DoRequestWithCloudflareBypass attempts request with standard client first,
+// then retries with uTLS Chrome fingerprint if Cloudflare blocks it.
+// This is useful when using VPN as Cloudflare detects Go's default TLS fingerprint.
+func DoRequestWithCloudflareBypass(req *http.Request) (*http.Response, error) {
+	req.Header.Set("User-Agent", getRandomUserAgent())
+
+	// Try with standard client first
+	resp, err := sharedClient.Do(req)
+	if err == nil {
+		// Check for Cloudflare challenge page (403 with specific markers)
+		if resp.StatusCode == 403 || resp.StatusCode == 503 {
+			body, readErr := io.ReadAll(resp.Body)
+			resp.Body.Close()
+
+			if readErr == nil {
+				bodyStr := strings.ToLower(string(body))
+				cloudflareMarkers := []string{
+					"cloudflare", "cf-ray", "checking your browser",
+					"please wait", "ddos protection", "ray id",
+					"enable javascript", "challenge-platform",
+				}
+
+				isCloudflare := false
+				for _, marker := range cloudflareMarkers {
+					if strings.Contains(bodyStr, marker) {
+						isCloudflare = true
+						break
+					}
+				}
+
+				if isCloudflare {
+					LogDebug("HTTP", "Cloudflare detected, retrying with Chrome TLS fingerprint...")
+
+					// Clone request for retry
+					reqCopy := req.Clone(req.Context())
+					reqCopy.Header.Set("User-Agent", getRandomUserAgent())
+
+					// Retry with uTLS Chrome fingerprint
+					return cloudflareBypassClient.Do(reqCopy)
+				}
+			}
+
+			// Not Cloudflare, return original response (recreate body)
+			return &http.Response{
+				Status:     resp.Status,
+				StatusCode: resp.StatusCode,
+				Header:     resp.Header,
+				Body:       io.NopCloser(strings.NewReader(string(body))),
+			}, nil
+		}
+		return resp, nil
+	}
+
+	// Check if error might be TLS-related (Cloudflare blocking)
+	errStr := strings.ToLower(err.Error())
+	tlsRelated := strings.Contains(errStr, "tls") ||
+		strings.Contains(errStr, "handshake") ||
+		strings.Contains(errStr, "certificate") ||
+		strings.Contains(errStr, "connection reset")
+
+	if tlsRelated {
+		LogDebug("HTTP", "TLS error detected, retrying with Chrome TLS fingerprint: %v", err)
+
+		// Clone request for retry
+		reqCopy := req.Clone(req.Context())
+		reqCopy.Header.Set("User-Agent", getRandomUserAgent())
+
+		// Retry with uTLS Chrome fingerprint
+		return cloudflareBypassClient.Do(reqCopy)
+	}
+
+	CheckAndLogISPBlocking(err, req.URL.String(), "HTTP")
+	return nil, err
+}

go_backend/idhs.go

@@ -0,0 +1,189 @@
+package gobackend
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+)
+
+// IDHSClient is a client for I Don't Have Spotify API
+// Used as fallback when SongLink fails or is rate limited
+type IDHSClient struct {
+	client *http.Client
+}
+
+var (
+	globalIDHSClient *IDHSClient
+	idhsClientOnce   sync.Once
+	idhsRateLimiter  = NewRateLimiter(8, time.Minute) // 8 req/min (below 10 limit)
+)
+
+// IDHSSearchRequest represents the request body for IDHS API
+type IDHSSearchRequest struct {
+	Link     string   `json:"link"`
+	Adapters []string `json:"adapters,omitempty"`
+}
+
+// IDHSSearchResponse represents the response from IDHS API
+type IDHSSearchResponse struct {
+	ID            string     `json:"id"`
+	Type          string     `json:"type"` // song, album, artist, podcast, show
+	Title         string     `json:"title"`
+	Description   string     `json:"description"`
+	Image         string     `json:"image,omitempty"`
+	Audio         string     `json:"audio,omitempty"`
+	Source        string     `json:"source"`
+	UniversalLink string     `json:"universalLink"`
+	Links         []IDHSLink `json:"links"`
+}
+
+// IDHSLink represents a link to a streaming platform
+type IDHSLink struct {
+	Type         string `json:"type"` // spotify, youTube, appleMusic, deezer, soundCloud, tidal
+	URL          string `json:"url"`
+	IsVerified   bool   `json:"isVerified,omitempty"`
+	NotAvailable bool   `json:"notAvailable,omitempty"`
+}
+
+// NewIDHSClient creates a new IDHS client
+func NewIDHSClient() *IDHSClient {
+	idhsClientOnce.Do(func() {
+		globalIDHSClient = &IDHSClient{
+			client: NewHTTPClientWithTimeout(15 * time.Second),
+		}
+	})
+	return globalIDHSClient
+}
+
+// Search converts a music link to links on other platforms
+func (c *IDHSClient) Search(link string, adapters []string) (*IDHSSearchResponse, error) {
+	idhsRateLimiter.WaitForSlot()
+
+	reqBody := IDHSSearchRequest{
+		Link:     link,
+		Adapters: adapters,
+	}
+
+	jsonBody, err := json.Marshal(reqBody)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal request: %w", err)
+	}
+
+	req, err := http.NewRequest("POST", "https://idonthavespotify.sjdonado.com/api/search?v=1", bytes.NewBuffer(jsonBody))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("User-Agent", getRandomUserAgent())
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == 400 {
+		return nil, fmt.Errorf("invalid link or missing parameters")
+	}
+	if resp.StatusCode == 429 {
+		return nil, fmt.Errorf("IDHS rate limit exceeded")
+	}
+	if resp.StatusCode == 500 {
+		return nil, fmt.Errorf("IDHS processing failed")
+	}
+	if resp.StatusCode != 200 {
+		return nil, fmt.Errorf("IDHS API returned status %d", resp.StatusCode)
+	}
+
+	body, err := ReadResponseBody(resp)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	var result IDHSSearchResponse
+	if err := json.Unmarshal(body, &result); err != nil {
+		return nil, fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	return &result, nil
+}
+
+// GetAvailabilityFromSpotify checks track availability using IDHS as fallback
+func (c *IDHSClient) GetAvailabilityFromSpotify(spotifyTrackID string) (*TrackAvailability, error) {
+	spotifyURL := fmt.Sprintf("https://open.spotify.com/track/%s", spotifyTrackID)
+
+	// Request only the platforms we need
+	adapters := []string{"tidal", "deezer"}
+
+	result, err := c.Search(spotifyURL, adapters)
+	if err != nil {
+		return nil, err
+	}
+
+	availability := &TrackAvailability{
+		SpotifyID: spotifyTrackID,
+	}
+
+	for _, link := range result.Links {
+		if link.NotAvailable {
+			continue
+		}
+
+		switch strings.ToLower(link.Type) {
+		case "tidal":
+			availability.Tidal = true
+			availability.TidalURL = link.URL
+		case "deezer":
+			availability.Deezer = true
+			availability.DeezerURL = link.URL
+			availability.DeezerID = extractDeezerIDFromURL(link.URL)
+		}
+	}
+
+	LogDebug("IDHS", "Availability from Spotify %s: Tidal=%v, Deezer=%v",
+		spotifyTrackID, availability.Tidal, availability.Deezer)
+
+	return availability, nil
+}
+
+// GetAvailabilityFromDeezer checks track availability using IDHS
+func (c *IDHSClient) GetAvailabilityFromDeezer(deezerTrackID string) (*TrackAvailability, error) {
+	deezerURL := fmt.Sprintf("https://www.deezer.com/track/%s", deezerTrackID)
+
+	// Request only the platforms we need
+	adapters := []string{"spotify", "tidal"}
+
+	result, err := c.Search(deezerURL, adapters)
+	if err != nil {
+		return nil, err
+	}
+
+	availability := &TrackAvailability{
+		Deezer:   true,
+		DeezerID: deezerTrackID,
+	}
+
+	for _, link := range result.Links {
+		if link.NotAvailable {
+			continue
+		}
+
+		switch strings.ToLower(link.Type) {
+		case "spotify":
+			availability.SpotifyID = extractSpotifyIDFromURL(link.URL)
+		case "tidal":
+			availability.Tidal = true
+			availability.TidalURL = link.URL
+		}
+	}
+
+	LogDebug("IDHS", "Availability from Deezer %s: Spotify=%s, Tidal=%v",
+		deezerTrackID, availability.SpotifyID, availability.Tidal)
+
+	return availability, nil
+}

go_backend/logbuffer.go

@@ -8,7 +8,6 @@ import (
 	"time"
 )
 
-// LogEntry represents a single log entry
 type LogEntry struct {
 	Timestamp string `json:"timestamp"`
 	Level     string `json:"level"`
@@ -16,12 +15,11 @@ type LogEntry struct {
 	Message   string `json:"message"`
 }
 
-// LogBuffer stores logs in a circular buffer for retrieval by Flutter
 type LogBuffer struct {
 	entries        []LogEntry
 	maxSize        int
 	mu             sync.RWMutex
-	loggingEnabled bool // Whether logging is enabled (controlled by Flutter)
+	loggingEnabled bool
 }
 
 var (
@@ -33,15 +31,14 @@ var (
 func GetLogBuffer() *LogBuffer {
 	logBufferOnce.Do(func() {
 		globalLogBuffer = &LogBuffer{
-			entries:        make([]LogEntry, 0, 500),
-			maxSize:        500,
+			entries:        make([]LogEntry, 0, 1000),
+			maxSize:        1000,
 			loggingEnabled: false, // Default: disabled for performance (user can enable in settings)
 		}
 	})
 	return globalLogBuffer
 }
 
-// SetLoggingEnabled enables or disables logging
 func (lb *LogBuffer) SetLoggingEnabled(enabled bool) {
 	lb.mu.Lock()
 	defer lb.mu.Unlock()
@@ -55,12 +52,10 @@ func (lb *LogBuffer) IsLoggingEnabled() bool {
 	return lb.loggingEnabled
 }
 
-// Add adds a log entry to the buffer
 func (lb *LogBuffer) Add(level, tag, message string) {
 	lb.mu.Lock()
 	defer lb.mu.Unlock()
 
-	// Skip if logging is disabled (except for errors which are always logged)
 	if !lb.loggingEnabled && level != "ERROR" && level != "FATAL" {
 		return
 	}
@@ -73,12 +68,10 @@ func (lb *LogBuffer) Add(level, tag, message string) {
 	}
 
 	if len(lb.entries) >= lb.maxSize {
-		// Remove oldest entry
 		lb.entries = lb.entries[1:]
 	}
 	lb.entries = append(lb.entries, entry)
 
-	// Also print to logcat for debugging
 	fmt.Printf("[%s] %s\n", tag, message)
 }
 
@@ -91,7 +84,6 @@ func (lb *LogBuffer) GetAll() string {
 	return string(jsonBytes)
 }
 
-// getSince returns log entries since the given index (internal use)
 func (lb *LogBuffer) getSince(index int) ([]LogEntry, int) {
 	lb.mu.RLock()
 	defer lb.mu.RUnlock()
@@ -158,11 +150,11 @@ func GoLog(format string, args ...interface{}) {
 
 	// Determine level from message content
 	msgLower := strings.ToLower(message)
-	if strings.Contains(msgLower, "error") || strings.Contains(msgLower, "failed") || strings.HasPrefix(message, "✗") {
+	if strings.Contains(msgLower, "error") || strings.Contains(msgLower, "failed") {
 		level = "ERROR"
 	} else if strings.Contains(msgLower, "warning") || strings.Contains(msgLower, "warn") {
 		level = "WARN"
-	} else if strings.HasPrefix(message, "✓") || strings.Contains(msgLower, "success") || strings.Contains(msgLower, "match found") {
+	} else if strings.Contains(msgLower, "success") || strings.Contains(msgLower, "match found") {
 		level = "INFO"
 	} else if strings.Contains(msgLower, "searching") || strings.Contains(msgLower, "trying") || strings.Contains(msgLower, "found") {
 		level = "DEBUG"

go_backend/lyrics.go

@@ -3,14 +3,93 @@ package gobackend
 import (
 	"encoding/json"
 	"fmt"
+	"math"
 	"net/http"
 	"net/url"
+	"os"
+	"path/filepath"
 	"regexp"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 )
 
+const (
+	lyricsCacheTTL       = 24 * time.Hour
+	durationToleranceSec = 10.0
+)
+
+type lyricsCacheEntry struct {
+	response  *LyricsResponse
+	expiresAt time.Time
+}
+
+type lyricsCache struct {
+	mu    sync.RWMutex
+	cache map[string]*lyricsCacheEntry
+}
+
+var globalLyricsCache = &lyricsCache{
+	cache: make(map[string]*lyricsCacheEntry),
+}
+
+func (c *lyricsCache) generateKey(artist, track string, durationSec float64) string {
+	normalizedArtist := strings.ToLower(strings.TrimSpace(artist))
+	normalizedTrack := strings.ToLower(strings.TrimSpace(track))
+	roundedDuration := math.Round(durationSec/10) * 10
+	return fmt.Sprintf("%s|%s|%.0f", normalizedArtist, normalizedTrack, roundedDuration)
+}
+
+func (c *lyricsCache) Get(artist, track string, durationSec float64) (*LyricsResponse, bool) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	key := c.generateKey(artist, track, durationSec)
+	entry, exists := c.cache[key]
+	if !exists {
+		return nil, false
+	}
+
+	if time.Now().After(entry.expiresAt) {
+		return nil, false
+	}
+
+	return entry.response, true
+}
+
+func (c *lyricsCache) Set(artist, track string, durationSec float64, response *LyricsResponse) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	key := c.generateKey(artist, track, durationSec)
+	c.cache[key] = &lyricsCacheEntry{
+		response:  response,
+		expiresAt: time.Now().Add(lyricsCacheTTL),
+	}
+}
+
+func (c *lyricsCache) CleanExpired() int {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	now := time.Now()
+	cleaned := 0
+	for key, entry := range c.cache {
+		if now.After(entry.expiresAt) {
+			delete(c.cache, key)
+			cleaned++
+		}
+	}
+	return cleaned
+}
+
+func (c *lyricsCache) Size() int {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return len(c.cache)
+}
+
 type LRCLibResponse struct {
 	ID           int     `json:"id"`
 	Name         string  `json:"name"`
@@ -44,9 +123,7 @@ type LyricsClient struct {
 
 func NewLyricsClient() *LyricsClient {
 	return &LyricsClient{
-		httpClient: &http.Client{
-			Timeout: 15 * time.Second,
-		},
+		httpClient: NewHTTPClientWithTimeout(15 * time.Second),
 	}
 }
 
@@ -86,7 +163,7 @@ func (c *LyricsClient) FetchLyricsWithMetadata(artist, track string) (*LyricsRes
 	return c.parseLRCLibResponse(&lrcResp), nil
 }
 
-func (c *LyricsClient) FetchLyricsFromLRCLibSearch(query string) (*LyricsResponse, error) {
+func (c *LyricsClient) FetchLyricsFromLRCLibSearch(query string, durationSec float64) (*LyricsResponse, error) {
 	baseURL := "https://lrclib.net/api/search"
 	params := url.Values{}
 	params.Set("q", query)
@@ -118,6 +195,11 @@ func (c *LyricsClient) FetchLyricsFromLRCLibSearch(query string) (*LyricsRespons
 		return nil, fmt.Errorf("no lyrics found")
 	}
 
+	bestMatch := c.findBestMatch(results, durationSec)
+	if bestMatch != nil {
+		return c.parseLRCLibResponse(bestMatch), nil
+	}
+
 	for _, result := range results {
 		if result.SyncedLyrics != "" {
 			return c.parseLRCLibResponse(&result), nil
@@ -127,38 +209,101 @@ func (c *LyricsClient) FetchLyricsFromLRCLibSearch(query string) (*LyricsRespons
 	return c.parseLRCLibResponse(&results[0]), nil
 }
 
-func (c *LyricsClient) FetchLyricsAllSources(spotifyID, trackName, artistName string) (*LyricsResponse, error) {
-	// Strategy 1: Direct match with artist and track name
-	lyrics, err := c.FetchLyricsWithMetadata(artistName, trackName)
-	if err == nil && lyrics != nil && len(lyrics.Lines) > 0 {
+func (c *LyricsClient) findBestMatch(results []LRCLibResponse, targetDurationSec float64) *LRCLibResponse {
+	var bestSynced *LRCLibResponse
+	var bestPlain *LRCLibResponse
+
+	for i := range results {
+		result := &results[i]
+
+		durationMatches := targetDurationSec == 0 || c.durationMatches(result.Duration, targetDurationSec)
+
+		if durationMatches {
+			if result.SyncedLyrics != "" && bestSynced == nil {
+				bestSynced = result
+			} else if result.PlainLyrics != "" && bestPlain == nil {
+				bestPlain = result
+			}
+		}
+	}
+
+	if bestSynced != nil {
+		return bestSynced
+	}
+	return bestPlain
+}
+
+func (c *LyricsClient) durationMatches(lrcDuration, targetDuration float64) bool {
+	diff := math.Abs(lrcDuration - targetDuration)
+	return diff <= durationToleranceSec
+}
+
+// durationSec: track duration in seconds for matching, use 0 to skip duration matching
+func (c *LyricsClient) FetchLyricsAllSources(spotifyID, trackName, artistName string, durationSec float64) (*LyricsResponse, error) {
+	// Normalize artist name - take first artist before comma/semicolon for better matching
+	primaryArtist := normalizeArtistName(artistName)
+
+	// Check cache first (use original artist name for cache key)
+	if cached, found := globalLyricsCache.Get(artistName, trackName, durationSec); found {
+		fmt.Printf("[Lyrics] Cache hit for: %s - %s\n", artistName, trackName)
+		cachedCopy := *cached
+		cachedCopy.Source = cached.Source + " (cached)"
+		return &cachedCopy, nil
+	}
+
+	var lyrics *LyricsResponse
+	var err error
+
+	// Helper to check if lyrics result is valid (has lines OR is instrumental)
+	isValidResult := func(l *LyricsResponse) bool {
+		return l != nil && (len(l.Lines) > 0 || l.Instrumental)
+	}
+
+	// Try exact match first with primary artist
+	lyrics, err = c.FetchLyricsWithMetadata(primaryArtist, trackName)
+	if err == nil && isValidResult(lyrics) {
 		lyrics.Source = "LRCLIB"
+		globalLyricsCache.Set(artistName, trackName, durationSec, lyrics)
 		return lyrics, nil
 	}
 
-	// Strategy 2: Try with simplified track name
-	simplifiedTrack := simplifyTrackName(trackName)
-	if simplifiedTrack != trackName {
-		lyrics, err = c.FetchLyricsWithMetadata(artistName, simplifiedTrack)
-		if err == nil && lyrics != nil && len(lyrics.Lines) > 0 {
-			lyrics.Source = "LRCLIB (simplified)"
+	// Try with full artist name if different from primary
+	if primaryArtist != artistName {
+		lyrics, err = c.FetchLyricsWithMetadata(artistName, trackName)
+		if err == nil && isValidResult(lyrics) {
+			lyrics.Source = "LRCLIB"
+			globalLyricsCache.Set(artistName, trackName, durationSec, lyrics)
 			return lyrics, nil
 		}
 	}
 
-	// Strategy 3: Search with full query
-	query := artistName + " " + trackName
-	lyrics, err = c.FetchLyricsFromLRCLibSearch(query)
-	if err == nil && lyrics != nil && len(lyrics.Lines) > 0 {
+	// Try with simplified track name
+	simplifiedTrack := simplifyTrackName(trackName)
+	if simplifiedTrack != trackName {
+		lyrics, err = c.FetchLyricsWithMetadata(primaryArtist, simplifiedTrack)
+		if err == nil && isValidResult(lyrics) {
+			lyrics.Source = "LRCLIB (simplified)"
+			globalLyricsCache.Set(artistName, trackName, durationSec, lyrics)
+			return lyrics, nil
+		}
+	}
+
+	// Search with duration matching (use primary artist for search)
+	query := primaryArtist + " " + trackName
+	lyrics, err = c.FetchLyricsFromLRCLibSearch(query, durationSec)
+	if err == nil && isValidResult(lyrics) {
 		lyrics.Source = "LRCLIB Search"
+		globalLyricsCache.Set(artistName, trackName, durationSec, lyrics)
 		return lyrics, nil
 	}
 
-	// Strategy 4: Search with simplified query
+	// Search with simplified name and duration matching
 	if simplifiedTrack != trackName {
-		query = artistName + " " + simplifiedTrack
-		lyrics, err = c.FetchLyricsFromLRCLibSearch(query)
-		if err == nil && lyrics != nil && len(lyrics.Lines) > 0 {
+		query = primaryArtist + " " + simplifiedTrack
+		lyrics, err = c.FetchLyricsFromLRCLibSearch(query, durationSec)
+		if err == nil && isValidResult(lyrics) {
 			lyrics.Source = "LRCLIB Search (simplified)"
+			globalLyricsCache.Set(artistName, trackName, durationSec, lyrics)
 			return lyrics, nil
 		}
 	}
@@ -248,34 +393,32 @@ func msToLRCTimestamp(ms int64) string {
 	return fmt.Sprintf("[%02d:%02d.%02d]", minutes, seconds, centiseconds)
 }
 
-// convertToLRC converts lyrics to LRC format string (without metadata headers)
 // Use convertToLRCWithMetadata for full LRC with headers
-func convertToLRC(lyrics *LyricsResponse) string {
-	if lyrics == nil || len(lyrics.Lines) == 0 {
-		return ""
-	}
+// Kept for potential future use
+// func convertToLRC(lyrics *LyricsResponse) string {
+// 	if lyrics == nil || len(lyrics.Lines) == 0 {
+// 		return ""
+// 	}
+//
+// 	var builder strings.Builder
+//
+// 	if lyrics.SyncType == "LINE_SYNCED" {
+// 		for _, line := range lyrics.Lines {
+// 			timestamp := msToLRCTimestamp(line.StartTimeMs)
+// 			builder.WriteString(timestamp)
+// 			builder.WriteString(line.Words)
+// 			builder.WriteString("\n")
+// 		}
+// 	} else {
+// 		for _, line := range lyrics.Lines {
+// 			builder.WriteString(line.Words)
+// 			builder.WriteString("\n")
+// 		}
+// 	}
+//
+// 	return builder.String()
+// }
 
-	var builder strings.Builder
-
-	if lyrics.SyncType == "LINE_SYNCED" {
-		for _, line := range lyrics.Lines {
-			timestamp := msToLRCTimestamp(line.StartTimeMs)
-			builder.WriteString(timestamp)
-			builder.WriteString(line.Words)
-			builder.WriteString("\n")
-		}
-	} else {
-		for _, line := range lyrics.Lines {
-			builder.WriteString(line.Words)
-			builder.WriteString("\n")
-		}
-	}
-
-	return builder.String()
-}
-
-// convertToLRCWithMetadata converts lyrics to LRC format with metadata headers
-// Includes [ti:], [ar:], [by:] headers
 func convertToLRCWithMetadata(lyrics *LyricsResponse, trackName, artistName string) string {
 	if lyrics == nil || len(lyrics.Lines) == 0 {
 		return ""
@@ -283,13 +426,11 @@ func convertToLRCWithMetadata(lyrics *LyricsResponse, trackName, artistName stri
 
 	var builder strings.Builder
 
-	// Add metadata headers
 	builder.WriteString(fmt.Sprintf("[ti:%s]\n", trackName))
 	builder.WriteString(fmt.Sprintf("[ar:%s]\n", artistName))
 	builder.WriteString("[by:SpotiFLAC-Mobile]\n")
 	builder.WriteString("\n")
 
-	// Add lyrics lines
 	if lyrics.SyncType == "LINE_SYNCED" {
 		for _, line := range lyrics.Lines {
 			if line.Words == "" {
@@ -338,3 +479,40 @@ func simplifyTrackName(name string) string {
 
 	return strings.TrimSpace(result)
 }
+
+// normalizeArtistName extracts the primary artist from multi-artist strings
+// e.g., "HOYO-MiX, AURORA" -> "HOYO-MiX"
+// e.g., "Artist1; Artist2" -> "Artist1"
+func normalizeArtistName(name string) string {
+	// Split by common separators: ", " or "; " or " & " or " feat. " or " ft. "
+	separators := []string{", ", "; ", " & ", " feat. ", " ft. ", " featuring ", " with "}
+
+	result := name
+	for _, sep := range separators {
+		if idx := strings.Index(strings.ToLower(result), strings.ToLower(sep)); idx > 0 {
+			result = result[:idx]
+			break
+		}
+	}
+
+	return strings.TrimSpace(result)
+}
+
+func SaveLRCFile(audioFilePath, lrcContent string) (string, error) {
+	if lrcContent == "" {
+		return "", fmt.Errorf("empty LRC content")
+	}
+
+	dir := filepath.Dir(audioFilePath)
+	ext := filepath.Ext(audioFilePath)
+	baseName := strings.TrimSuffix(filepath.Base(audioFilePath), ext)
+
+	lrcFilePath := filepath.Join(dir, baseName+".lrc")
+
+	if err := os.WriteFile(lrcFilePath, []byte(lrcContent), 0644); err != nil {
+		return "", fmt.Errorf("failed to write LRC file: %w", err)
+	}
+
+	GoLog("[Lyrics] Saved LRC file: %s\n", lrcFilePath)
+	return lrcFilePath, nil
+}

go_backend/metadata.go

@@ -1,7 +1,10 @@
 package gobackend
 
 import (
+	"bytes"
+	"encoding/binary"
 	"fmt"
+	"io"
 	"os"
 	"strconv"
 	"strings"
@@ -11,7 +14,6 @@ import (
 	"github.com/go-flac/go-flac"
 )
 
-// Metadata represents track metadata for embedding
 type Metadata struct {
 	Title       string
 	Artist      string
@@ -24,16 +26,17 @@ type Metadata struct {
 	ISRC        string
 	Description string
 	Lyrics      string
+	Genre       string
+	Label       string
+	Copyright   string
 }
 
-// EmbedMetadata embeds metadata into a FLAC file
 func EmbedMetadata(filePath string, metadata Metadata, coverPath string) error {
 	f, err := flac.ParseFile(filePath)
 	if err != nil {
 		return fmt.Errorf("failed to parse FLAC file: %w", err)
 	}
 
-	// Find or create vorbis comment block
 	var cmtIdx int = -1
 	var cmt *flacvorbis.MetaDataBlockVorbisComment
 
@@ -52,7 +55,6 @@ func EmbedMetadata(filePath string, metadata Metadata, coverPath string) error {
 		cmt = flacvorbis.New()
 	}
 
-	// Set metadata fields
 	setComment(cmt, "TITLE", metadata.Title)
 	setComment(cmt, "ARTIST", metadata.Artist)
 	setComment(cmt, "ALBUM", metadata.Album)
@@ -84,7 +86,18 @@ func EmbedMetadata(filePath string, metadata Metadata, coverPath string) error {
 		setComment(cmt, "UNSYNCEDLYRICS", metadata.Lyrics)
 	}
 
-	// Update or add vorbis comment block
+	if metadata.Genre != "" {
+		setComment(cmt, "GENRE", metadata.Genre)
+	}
+
+	if metadata.Label != "" {
+		setComment(cmt, "ORGANIZATION", metadata.Label)
+	}
+
+	if metadata.Copyright != "" {
+		setComment(cmt, "COPYRIGHT", metadata.Copyright)
+	}
+
 	cmtBlock := cmt.Marshal()
 	if cmtIdx >= 0 {
 		f.Meta[cmtIdx] = &cmtBlock
@@ -92,14 +105,12 @@ func EmbedMetadata(filePath string, metadata Metadata, coverPath string) error {
 		f.Meta = append(f.Meta, &cmtBlock)
 	}
 
-	// Add cover art if provided
 	if coverPath != "" {
 		if fileExists(coverPath) {
 			coverData, err := os.ReadFile(coverPath)
 			if err != nil {
 				fmt.Printf("[Metadata] Warning: Failed to read cover file %s: %v\n", coverPath, err)
 			} else {
-				// Remove existing picture blocks first (like PC version)
 				for i := len(f.Meta) - 1; i >= 0; i-- {
 					if f.Meta[i].Type == flac.Picture {
 						f.Meta = append(f.Meta[:i], f.Meta[i+1:]...)
@@ -125,19 +136,15 @@ func EmbedMetadata(filePath string, metadata Metadata, coverPath string) error {
 		}
 	}
 
-	// Save file
 	return f.Save(filePath)
 }
 
-// EmbedMetadataWithCoverData embeds metadata into a FLAC file with cover data as bytes
-// This avoids file permission issues on Android by not requiring a temp file
 func EmbedMetadataWithCoverData(filePath string, metadata Metadata, coverData []byte) error {
 	f, err := flac.ParseFile(filePath)
 	if err != nil {
 		return fmt.Errorf("failed to parse FLAC file: %w", err)
 	}
 
-	// Find or create vorbis comment block
 	var cmtIdx int = -1
 	var cmt *flacvorbis.MetaDataBlockVorbisComment
 
@@ -156,7 +163,6 @@ func EmbedMetadataWithCoverData(filePath string, metadata Metadata, coverData []
 		cmt = flacvorbis.New()
 	}
 
-	// Set metadata fields
 	setComment(cmt, "TITLE", metadata.Title)
 	setComment(cmt, "ARTIST", metadata.Artist)
 	setComment(cmt, "ALBUM", metadata.Album)
@@ -188,7 +194,18 @@ func EmbedMetadataWithCoverData(filePath string, metadata Metadata, coverData []
 		setComment(cmt, "UNSYNCEDLYRICS", metadata.Lyrics)
 	}
 
-	// Update or add vorbis comment block
+	if metadata.Genre != "" {
+		setComment(cmt, "GENRE", metadata.Genre)
+	}
+
+	if metadata.Label != "" {
+		setComment(cmt, "ORGANIZATION", metadata.Label)
+	}
+
+	if metadata.Copyright != "" {
+		setComment(cmt, "COPYRIGHT", metadata.Copyright)
+	}
+
 	cmtBlock := cmt.Marshal()
 	if cmtIdx >= 0 {
 		f.Meta[cmtIdx] = &cmtBlock
@@ -196,9 +213,7 @@ func EmbedMetadataWithCoverData(filePath string, metadata Metadata, coverData []
 		f.Meta = append(f.Meta, &cmtBlock)
 	}
 
-	// Add cover art if provided
 	if len(coverData) > 0 {
-		// Remove existing picture blocks first
 		for i := len(f.Meta) - 1; i >= 0; i-- {
 			if f.Meta[i].Type == flac.Picture {
 				f.Meta = append(f.Meta[:i], f.Meta[i+1:]...)
@@ -220,7 +235,6 @@ func EmbedMetadataWithCoverData(filePath string, metadata Metadata, coverData []
 		}
 	}
 
-	// Save file
 	return f.Save(filePath)
 }
 
@@ -257,7 +271,6 @@ func ReadMetadata(filePath string) (*Metadata, error) {
 			if trackNum != "" {
 				fmt.Sscanf(trackNum, "%d", &metadata.TrackNumber)
 			}
-			// Also try lowercase variant (some encoders use lowercase)
 			if metadata.TrackNumber == 0 {
 				trackNum = getComment(cmt, "TRACK")
 				if trackNum != "" {
@@ -269,7 +282,6 @@ func ReadMetadata(filePath string) (*Metadata, error) {
 			if discNum != "" {
 				fmt.Sscanf(discNum, "%d", &metadata.DiscNumber)
 			}
-			// Also try DISC variant
 			if metadata.DiscNumber == 0 {
 				discNum = getComment(cmt, "DISC")
 				if discNum != "" {
@@ -277,7 +289,6 @@ func ReadMetadata(filePath string) (*Metadata, error) {
 				}
 			}
 
-			// Try DATE variants
 			if metadata.Date == "" {
 				metadata.Date = getComment(cmt, "YEAR")
 			}
@@ -293,7 +304,6 @@ func setComment(cmt *flacvorbis.MetaDataBlockVorbisComment, key, value string) {
 	if value == "" {
 		return
 	}
-	// Remove existing (case-insensitive comparison for Vorbis comments)
 	keyUpper := strings.ToUpper(key)
 	for i := len(cmt.Comments) - 1; i >= 0; i-- {
 		comment := cmt.Comments[i]
@@ -305,7 +315,6 @@ func setComment(cmt *flacvorbis.MetaDataBlockVorbisComment, key, value string) {
 			}
 		}
 	}
-	// Add new
 	cmt.Comments = append(cmt.Comments, key+"="+value)
 }
 
@@ -313,7 +322,6 @@ func getComment(cmt *flacvorbis.MetaDataBlockVorbisComment, key string) string {
 	keyUpper := strings.ToUpper(key) + "="
 	for _, comment := range cmt.Comments {
 		if len(comment) > len(key) {
-			// Case-insensitive comparison for Vorbis comments
 			commentUpper := strings.ToUpper(comment[:len(key)+1])
 			if commentUpper == keyUpper {
 				return comment[len(key)+1:]
@@ -323,13 +331,11 @@ func getComment(cmt *flacvorbis.MetaDataBlockVorbisComment, key string) string {
 	return ""
 }
 
-// fileExists checks if a file exists
 func fileExists(path string) bool {
 	_, err := os.Stat(path)
 	return err == nil
 }
 
-// EmbedLyrics embeds lyrics into a FLAC file as a separate operation
 func EmbedLyrics(filePath string, lyrics string) error {
 	f, err := flac.ParseFile(filePath)
 	if err != nil {
@@ -367,6 +373,51 @@ func EmbedLyrics(filePath string, lyrics string) error {
 	return f.Save(filePath)
 }
 
+func EmbedGenreLabel(filePath string, genre, label string) error {
+	if genre == "" && label == "" {
+		return nil
+	}
+
+	f, err := flac.ParseFile(filePath)
+	if err != nil {
+		return fmt.Errorf("failed to parse FLAC file: %w", err)
+	}
+
+	var cmtIdx int = -1
+	var cmt *flacvorbis.MetaDataBlockVorbisComment
+
+	for idx, meta := range f.Meta {
+		if meta.Type == flac.VorbisComment {
+			cmtIdx = idx
+			cmt, err = flacvorbis.ParseFromMetaDataBlock(*meta)
+			if err != nil {
+				return fmt.Errorf("failed to parse vorbis comment: %w", err)
+			}
+			break
+		}
+	}
+
+	if cmt == nil {
+		cmt = flacvorbis.New()
+	}
+
+	if genre != "" {
+		setComment(cmt, "GENRE", genre)
+	}
+	if label != "" {
+		setComment(cmt, "ORGANIZATION", label)
+	}
+
+	cmtBlock := cmt.Marshal()
+	if cmtIdx >= 0 {
+		f.Meta[cmtIdx] = &cmtBlock
+	} else {
+		f.Meta = append(f.Meta, &cmtBlock)
+	}
+
+	return f.Save(filePath)
+}
+
 // ExtractLyrics extracts embedded lyrics from a FLAC file
 func ExtractLyrics(filePath string) (string, error) {
 	f, err := flac.ParseFile(filePath)
@@ -381,13 +432,11 @@ func ExtractLyrics(filePath string) (string, error) {
 				continue
 			}
 
-			// Try LYRICS tag first
 			lyrics, err := cmt.Get("LYRICS")
 			if err == nil && len(lyrics) > 0 && lyrics[0] != "" {
 				return lyrics[0], nil
 			}
 
-			// Fallback to UNSYNCEDLYRICS
 			lyrics, err = cmt.Get("UNSYNCEDLYRICS")
 			if err == nil && len(lyrics) > 0 && lyrics[0] != "" {
 				return lyrics[0], nil
@@ -398,16 +447,12 @@ func ExtractLyrics(filePath string) (string, error) {
 	return "", fmt.Errorf("no lyrics found in file")
 }
 
-// AudioQuality represents audio quality info from a FLAC file
 type AudioQuality struct {
 	BitDepth     int   `json:"bit_depth"`
 	SampleRate   int   `json:"sample_rate"`
 	TotalSamples int64 `json:"total_samples"`
 }
 
-// GetAudioQuality reads bit depth and sample rate from a FLAC file's StreamInfo block
-// FLAC StreamInfo is always the first metadata block after the 4-byte "fLaC" marker
-// For M4A files, it delegates to GetM4AQuality
 func GetAudioQuality(filePath string) (AudioQuality, error) {
 	file, err := os.Open(filePath)
 	if err != nil {
@@ -415,16 +460,12 @@ func GetAudioQuality(filePath string) (AudioQuality, error) {
 	}
 	defer file.Close()
 
-	// Read first 4 bytes to detect file type
 	marker := make([]byte, 4)
 	if _, err := file.Read(marker); err != nil {
 		return AudioQuality{}, fmt.Errorf("failed to read marker: %w", err)
 	}
 
-	// Check if it's a FLAC file
 	if string(marker) == "fLaC" {
-		// Continue reading FLAC metadata
-		// Read metadata block header (4 bytes)
 		header := make([]byte, 4)
 		if _, err := file.Read(header); err != nil {
 			return AudioQuality{}, fmt.Errorf("failed to read header: %w", err)
@@ -435,19 +476,15 @@ func GetAudioQuality(filePath string) (AudioQuality, error) {
 			return AudioQuality{}, fmt.Errorf("first block is not STREAMINFO")
 		}
 
-		// Read STREAMINFO block (34 bytes minimum)
 		streamInfo := make([]byte, 34)
 		if _, err := file.Read(streamInfo); err != nil {
 			return AudioQuality{}, fmt.Errorf("failed to read STREAMINFO: %w", err)
 		}
 
-		// Parse sample rate (20 bits starting at byte 10)
 		sampleRate := (int(streamInfo[10]) << 12) | (int(streamInfo[11]) << 4) | (int(streamInfo[12]) >> 4)
 
-		// Parse bits per sample (5 bits)
 		bitsPerSample := ((int(streamInfo[12]) & 0x01) << 4) | (int(streamInfo[13]) >> 4) + 1
 
-		// Parse total samples (36 bits: 4 bits from byte 13, all of bytes 14-17)
 		totalSamples := int64(streamInfo[13]&0x0F)<<32 |
 			int64(streamInfo[14])<<24 |
 			int64(streamInfo[15])<<16 |
@@ -461,17 +498,14 @@ func GetAudioQuality(filePath string) (AudioQuality, error) {
 		}, nil
 	}
 
-	// Check if it's an M4A/MP4 file (starts with size + "ftyp")
-	// First 4 bytes are size, next 4 should be "ftyp"
-	file.Seek(0, 0) // Reset to beginning
+	file.Seek(0, 0)
 	header8 := make([]byte, 8)
 	if _, err := file.Read(header8); err != nil {
 		return AudioQuality{}, fmt.Errorf("failed to read header: %w", err)
 	}
 
 	if string(header8[4:8]) == "ftyp" {
-		// It's an M4A/MP4 file, use M4A quality reader
-		file.Close() // Close before calling GetM4AQuality which opens the file again
+		file.Close()
 		return GetM4AQuality(filePath)
 	}
 
@@ -483,157 +517,211 @@ func GetAudioQuality(filePath string) (AudioQuality, error) {
 // ========================================
 
 // EmbedM4AMetadata embeds metadata into an M4A file using iTunes-style atoms
-// This is a simplified implementation that writes metadata to the file
 func EmbedM4AMetadata(filePath string, metadata Metadata, coverData []byte) error {
-	// Read the entire file
-	data, err := os.ReadFile(filePath)
+	input, err := os.Open(filePath)
 	if err != nil {
-		return fmt.Errorf("failed to read M4A file: %w", err)
+		return fmt.Errorf("failed to open M4A file: %w", err)
 	}
+	defer input.Close()
 
-	// Find moov atom position
-	moovPos := findAtom(data, "moov", 0)
-	if moovPos < 0 {
+	info, err := input.Stat()
+	if err != nil {
+		return fmt.Errorf("failed to stat M4A file: %w", err)
+	}
+	fileSize := info.Size()
+
+	moovHeader, moovFound, err := findAtomInRange(input, 0, fileSize, "moov", fileSize)
+	if err != nil {
+		return fmt.Errorf("failed to find moov atom: %w", err)
+	}
+	if !moovFound {
 		return fmt.Errorf("moov atom not found in M4A file")
 	}
 
-	// Find udta atom inside moov, or create one
-	moovSize := int(data[moovPos]<<24 | data[moovPos+1]<<16 | data[moovPos+2]<<8 | data[moovPos+3])
-	udtaPos := findAtom(data, "udta", moovPos+8)
+	moovContentStart := moovHeader.offset + moovHeader.headerSize
+	moovContentSize := moovHeader.size - moovHeader.headerSize
 
-	// Build new metadata atoms
-	metaAtom := buildMetaAtom(metadata, coverData)
+	udtaHeader, udtaFound, err := findAtomInRange(input, moovContentStart, moovContentSize, "udta", fileSize)
+	if err != nil {
+		return fmt.Errorf("failed to locate udta atom: %w", err)
+	}
 
-	var newData []byte
-	if udtaPos >= 0 && udtaPos < moovPos+moovSize {
-		// udta exists, find meta inside it or replace
-		udtaSize := int(data[udtaPos]<<24 | data[udtaPos+1]<<16 | data[udtaPos+2]<<8 | data[udtaPos+3])
-		metaPos := findAtom(data, "meta", udtaPos+8)
-
-		if metaPos >= 0 && metaPos < udtaPos+udtaSize {
-			// Replace existing meta atom
-			metaSize := int(data[metaPos]<<24 | data[metaPos+1]<<16 | data[metaPos+2]<<8 | data[metaPos+3])
-			newData = append(newData, data[:metaPos]...)
-			newData = append(newData, metaAtom...)
-			newData = append(newData, data[metaPos+metaSize:]...)
-		} else {
-			// Add meta atom to udta
-			newUdtaContent := append(data[udtaPos+8:udtaPos+udtaSize], metaAtom...)
-			newUdtaSize := 8 + len(newUdtaContent)
-			newUdta := make([]byte, 4)
-			newUdta[0] = byte(newUdtaSize >> 24)
-			newUdta[1] = byte(newUdtaSize >> 16)
-			newUdta[2] = byte(newUdtaSize >> 8)
-			newUdta[3] = byte(newUdtaSize)
-			newUdta = append(newUdta, []byte("udta")...)
-			newUdta = append(newUdta, newUdtaContent...)
-
-			newData = append(newData, data[:udtaPos]...)
-			newData = append(newData, newUdta...)
-			newData = append(newData, data[udtaPos+udtaSize:]...)
+	var metaHeader atomHeader
+	metaFound := false
+	if udtaFound {
+		udtaContentStart := udtaHeader.offset + udtaHeader.headerSize
+		udtaContentSize := udtaHeader.size - udtaHeader.headerSize
+		metaHeader, metaFound, err = findAtomInRange(input, udtaContentStart, udtaContentSize, "meta", fileSize)
+		if err != nil {
+			return fmt.Errorf("failed to locate meta atom: %w", err)
 		}
-	} else {
-		// Create new udta with meta
-		udtaContent := metaAtom
-		udtaSize := 8 + len(udtaContent)
-		newUdta := make([]byte, 4)
-		newUdta[0] = byte(udtaSize >> 24)
-		newUdta[1] = byte(udtaSize >> 16)
-		newUdta[2] = byte(udtaSize >> 8)
-		newUdta[3] = byte(udtaSize)
-		newUdta = append(newUdta, []byte("udta")...)
-		newUdta = append(newUdta, udtaContent...)
-
-		// Insert udta at end of moov
-		insertPos := moovPos + moovSize
-		newData = append(newData, data[:insertPos]...)
-		newData = append(newData, newUdta...)
-		newData = append(newData, data[insertPos:]...)
 	}
 
-	// Update moov size
-	newMoovSize := moovSize + len(newData) - len(data)
-	newData[moovPos] = byte(newMoovSize >> 24)
-	newData[moovPos+1] = byte(newMoovSize >> 16)
-	newData[moovPos+2] = byte(newMoovSize >> 8)
-	newData[moovPos+3] = byte(newMoovSize)
+	metaAtom := buildMetaAtom(metadata, coverData)
+	metaSize := int64(len(metaAtom))
 
-	// Write back to file
-	if err := os.WriteFile(filePath, newData, 0644); err != nil {
-		return fmt.Errorf("failed to write M4A file: %w", err)
+	var delta int64
+	var newUdtaSize int64
+	switch {
+	case udtaFound && metaFound:
+		delta = metaSize - metaHeader.size
+		newUdtaSize = udtaHeader.size + delta
+	case udtaFound && !metaFound:
+		delta = metaSize
+		newUdtaSize = udtaHeader.size + delta
+	case !udtaFound:
+		newUdtaSize = int64(8 + len(metaAtom))
+		delta = newUdtaSize
 	}
 
+	newMoovSize := moovHeader.size + delta
+	if moovHeader.headerSize == 8 && newMoovSize > int64(^uint32(0)) {
+		return fmt.Errorf("moov atom exceeds 32-bit size after update")
+	}
+	if udtaFound && udtaHeader.headerSize == 8 && newUdtaSize > int64(^uint32(0)) {
+		return fmt.Errorf("udta atom exceeds 32-bit size after update")
+	}
+	if !udtaFound && newUdtaSize > int64(^uint32(0)) {
+		return fmt.Errorf("udta atom exceeds 32-bit size after update")
+	}
+
+	tempPath := filePath + ".tmp"
+	output, err := os.OpenFile(tempPath, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0644)
+	if err != nil {
+		return fmt.Errorf("failed to create temp file: %w", err)
+	}
+	cleanupTemp := true
+	defer func() {
+		_ = output.Close()
+		if cleanupTemp {
+			_ = os.Remove(tempPath)
+		}
+	}()
+
+	switch {
+	case udtaFound && metaFound:
+		if err := copyRange(output, input, 0, moovHeader.offset); err != nil {
+			return err
+		}
+		if err := writeAtomHeader(output, "moov", newMoovSize, moovHeader.headerSize); err != nil {
+			return err
+		}
+		if err := copyRange(output, input, moovHeader.offset+moovHeader.headerSize, udtaHeader.offset-(moovHeader.offset+moovHeader.headerSize)); err != nil {
+			return err
+		}
+		if err := writeAtomHeader(output, "udta", newUdtaSize, udtaHeader.headerSize); err != nil {
+			return err
+		}
+		if err := copyRange(output, input, udtaHeader.offset+udtaHeader.headerSize, metaHeader.offset-(udtaHeader.offset+udtaHeader.headerSize)); err != nil {
+			return err
+		}
+		if _, err := output.Write(metaAtom); err != nil {
+			return fmt.Errorf("failed to write meta atom: %w", err)
+		}
+		metaEnd := metaHeader.offset + metaHeader.size
+		if err := copyRange(output, input, metaEnd, fileSize-metaEnd); err != nil {
+			return err
+		}
+	case udtaFound && !metaFound:
+		if err := copyRange(output, input, 0, moovHeader.offset); err != nil {
+			return err
+		}
+		if err := writeAtomHeader(output, "moov", newMoovSize, moovHeader.headerSize); err != nil {
+			return err
+		}
+		if err := copyRange(output, input, moovHeader.offset+moovHeader.headerSize, udtaHeader.offset-(moovHeader.offset+moovHeader.headerSize)); err != nil {
+			return err
+		}
+		if err := writeAtomHeader(output, "udta", newUdtaSize, udtaHeader.headerSize); err != nil {
+			return err
+		}
+		insertPos := udtaHeader.offset + udtaHeader.size
+		if err := copyRange(output, input, udtaHeader.offset+udtaHeader.headerSize, insertPos-(udtaHeader.offset+udtaHeader.headerSize)); err != nil {
+			return err
+		}
+		if _, err := output.Write(metaAtom); err != nil {
+			return fmt.Errorf("failed to write meta atom: %w", err)
+		}
+		if err := copyRange(output, input, insertPos, fileSize-insertPos); err != nil {
+			return err
+		}
+	case !udtaFound:
+		newUdtaAtom := buildUdtaAtom(metaAtom)
+		if err := copyRange(output, input, 0, moovHeader.offset); err != nil {
+			return err
+		}
+		if err := writeAtomHeader(output, "moov", newMoovSize, moovHeader.headerSize); err != nil {
+			return err
+		}
+		moovEnd := moovHeader.offset + moovHeader.size
+		if err := copyRange(output, input, moovHeader.offset+moovHeader.headerSize, moovEnd-(moovHeader.offset+moovHeader.headerSize)); err != nil {
+			return err
+		}
+		if _, err := output.Write(newUdtaAtom); err != nil {
+			return fmt.Errorf("failed to write udta atom: %w", err)
+		}
+		if err := copyRange(output, input, moovEnd, fileSize-moovEnd); err != nil {
+			return err
+		}
+	}
+
+	if err := output.Close(); err != nil {
+		return fmt.Errorf("failed to close temp file: %w", err)
+	}
+
+	_ = input.Close()
+	if err := os.Remove(filePath); err != nil {
+		return fmt.Errorf("failed to replace original file: %w", err)
+	}
+	if err := os.Rename(tempPath, filePath); err != nil {
+		return fmt.Errorf("failed to move temp file: %w", err)
+	}
+	cleanupTemp = false
+
 	fmt.Printf("[M4A] Metadata embedded successfully\n")
 	return nil
 }
 
-// findAtom finds an atom by name starting from offset
-func findAtom(data []byte, name string, offset int) int {
-	for i := offset; i < len(data)-8; {
-		size := int(data[i]<<24 | data[i+1]<<16 | data[i+2]<<8 | data[i+3])
-		if size < 8 {
-			break
-		}
-		atomName := string(data[i+4 : i+8])
-		if atomName == name {
-			return i
-		}
-		i += size
-	}
-	return -1
-}
-
 // buildMetaAtom builds a complete meta atom with ilst containing metadata
 func buildMetaAtom(metadata Metadata, coverData []byte) []byte {
-	// Build ilst content
 	var ilst []byte
 
-	// ©nam - Title
 	if metadata.Title != "" {
 		ilst = append(ilst, buildTextAtom("©nam", metadata.Title)...)
 	}
 
-	// ©ART - Artist
 	if metadata.Artist != "" {
 		ilst = append(ilst, buildTextAtom("©ART", metadata.Artist)...)
 	}
 
-	// ©alb - Album
 	if metadata.Album != "" {
 		ilst = append(ilst, buildTextAtom("©alb", metadata.Album)...)
 	}
 
-	// aART - Album Artist
 	if metadata.AlbumArtist != "" {
 		ilst = append(ilst, buildTextAtom("aART", metadata.AlbumArtist)...)
 	}
 
-	// ©day - Year/Date
 	if metadata.Date != "" {
 		ilst = append(ilst, buildTextAtom("©day", metadata.Date)...)
 	}
 
-	// trkn - Track Number
 	if metadata.TrackNumber > 0 {
 		ilst = append(ilst, buildTrackNumberAtom(metadata.TrackNumber, metadata.TotalTracks)...)
 	}
 
-	// disk - Disc Number
 	if metadata.DiscNumber > 0 {
 		ilst = append(ilst, buildDiscNumberAtom(metadata.DiscNumber, 0)...)
 	}
 
-	// ©lyr - Lyrics
 	if metadata.Lyrics != "" {
 		ilst = append(ilst, buildTextAtom("©lyr", metadata.Lyrics)...)
 	}
 
-	// covr - Cover Art
 	if len(coverData) > 0 {
 		ilst = append(ilst, buildCoverAtom(coverData)...)
 	}
 
-	// Build ilst atom
 	ilstSize := 8 + len(ilst)
 	ilstAtom := make([]byte, 4)
 	ilstAtom[0] = byte(ilstSize >> 24)
@@ -643,7 +731,6 @@ func buildMetaAtom(metadata Metadata, coverData []byte) []byte {
 	ilstAtom = append(ilstAtom, []byte("ilst")...)
 	ilstAtom = append(ilstAtom, ilst...)
 
-	// Build hdlr atom (required for meta)
 	hdlr := []byte{
 		0, 0, 0, 33, // size = 33
 		'h', 'd', 'l', 'r',
@@ -656,7 +743,6 @@ func buildMetaAtom(metadata Metadata, coverData []byte) []byte {
 		0, // null terminator
 	}
 
-	// Build meta atom
 	metaContent := append([]byte{0, 0, 0, 0}, hdlr...) // version + flags + hdlr
 	metaContent = append(metaContent, ilstAtom...)
 
@@ -672,11 +758,9 @@ func buildMetaAtom(metadata Metadata, coverData []byte) []byte {
 	return metaAtom
 }
 
-// buildTextAtom builds a text metadata atom (©nam, ©ART, etc.)
 func buildTextAtom(name, value string) []byte {
 	valueBytes := []byte(value)
 
-	// data atom
 	dataSize := 16 + len(valueBytes)
 	dataAtom := make([]byte, 4)
 	dataAtom[0] = byte(dataSize >> 24)
@@ -688,7 +772,6 @@ func buildTextAtom(name, value string) []byte {
 	dataAtom = append(dataAtom, 0, 0, 0, 0) // locale
 	dataAtom = append(dataAtom, valueBytes...)
 
-	// container atom
 	atomSize := 8 + len(dataAtom)
 	atom := make([]byte, 4)
 	atom[0] = byte(atomSize >> 24)
@@ -703,7 +786,6 @@ func buildTextAtom(name, value string) []byte {
 
 // buildTrackNumberAtom builds trkn atom
 func buildTrackNumberAtom(track, total int) []byte {
-	// data atom with track number
 	dataAtom := []byte{
 		0, 0, 0, 24, // size
 		'd', 'a', 't', 'a',
@@ -715,7 +797,6 @@ func buildTrackNumberAtom(track, total int) []byte {
 		0, 0, // padding
 	}
 
-	// trkn atom
 	atomSize := 8 + len(dataAtom)
 	atom := make([]byte, 4)
 	atom[0] = byte(atomSize >> 24)
@@ -728,9 +809,7 @@ func buildTrackNumberAtom(track, total int) []byte {
 	return atom
 }
 
-// buildDiscNumberAtom builds disk atom
 func buildDiscNumberAtom(disc, total int) []byte {
-	// data atom with disc number
 	dataAtom := []byte{
 		0, 0, 0, 22, // size
 		'd', 'a', 't', 'a',
@@ -741,7 +820,6 @@ func buildDiscNumberAtom(disc, total int) []byte {
 		byte(total >> 8), byte(total), // total discs
 	}
 
-	// disk atom
 	atomSize := 8 + len(dataAtom)
 	atom := make([]byte, 4)
 	atom[0] = byte(atomSize >> 24)
@@ -756,13 +834,11 @@ func buildDiscNumberAtom(disc, total int) []byte {
 
 // buildCoverAtom builds covr atom with image data
 func buildCoverAtom(coverData []byte) []byte {
-	// Detect image type (JPEG = 13, PNG = 14)
-	imageType := byte(13) // default JPEG
+	imageType := byte(13)
 	if len(coverData) > 8 && coverData[0] == 0x89 && coverData[1] == 'P' && coverData[2] == 'N' && coverData[3] == 'G' {
-		imageType = 14 // PNG
+		imageType = 14
 	}
 
-	// data atom
 	dataSize := 16 + len(coverData)
 	dataAtom := make([]byte, 4)
 	dataAtom[0] = byte(dataSize >> 24)
@@ -770,11 +846,10 @@ func buildCoverAtom(coverData []byte) []byte {
 	dataAtom[2] = byte(dataSize >> 8)
 	dataAtom[3] = byte(dataSize)
 	dataAtom = append(dataAtom, []byte("data")...)
-	dataAtom = append(dataAtom, 0, 0, 0, imageType) // type = JPEG or PNG
-	dataAtom = append(dataAtom, 0, 0, 0, 0)         // locale
+	dataAtom = append(dataAtom, 0, 0, 0, imageType)
+	dataAtom = append(dataAtom, 0, 0, 0, 0)
 	dataAtom = append(dataAtom, coverData...)
 
-	// covr atom
 	atomSize := 8 + len(dataAtom)
 	atom := make([]byte, 4)
 	atom[0] = byte(atomSize >> 24)
@@ -787,36 +862,226 @@ func buildCoverAtom(coverData []byte) []byte {
 	return atom
 }
 
-// GetM4AQuality reads audio quality from M4A file
 func GetM4AQuality(filePath string) (AudioQuality, error) {
-	data, err := os.ReadFile(filePath)
+	f, err := os.Open(filePath)
 	if err != nil {
-		return AudioQuality{}, fmt.Errorf("failed to read M4A file: %w", err)
+		return AudioQuality{}, fmt.Errorf("failed to open M4A file: %w", err)
 	}
+	defer f.Close()
 
-	// Find moov -> trak -> mdia -> minf -> stbl -> stsd
-	moovPos := findAtom(data, "moov", 0)
-	if moovPos < 0 {
+	info, err := f.Stat()
+	if err != nil {
+		return AudioQuality{}, fmt.Errorf("failed to stat M4A file: %w", err)
+	}
+	fileSize := info.Size()
+
+	moovHeader, moovFound, err := findAtomInRange(f, 0, fileSize, "moov", fileSize)
+	if err != nil {
+		return AudioQuality{}, fmt.Errorf("failed to find moov atom: %w", err)
+	}
+	if !moovFound {
 		return AudioQuality{}, fmt.Errorf("moov atom not found")
 	}
 
-	// Search for mp4a or alac atom which contains audio info
-	// This is a simplified search - real implementation would traverse the atom tree
-	for i := moovPos; i < len(data)-20; i++ {
-		if string(data[i:i+4]) == "mp4a" || string(data[i:i+4]) == "alac" {
-			// Sample rate is at offset 22-23 from atom start (16-bit big-endian)
-			if i+24 < len(data) {
-				sampleRate := int(data[i+22])<<8 | int(data[i+23])
-				// For AAC, bit depth is typically 16
-				bitDepth := 16
-				if string(data[i:i+4]) == "alac" {
-					// ALAC can have higher bit depth, check esds or alac specific data
-					bitDepth = 24 // Assume 24-bit for ALAC
-				}
-				return AudioQuality{BitDepth: bitDepth, SampleRate: sampleRate}, nil
-			}
-		}
+	moovStart := moovHeader.offset
+	moovEnd := moovHeader.offset + moovHeader.size
+
+	sampleOffset, atomType, err := findAudioSampleEntry(f, moovStart, moovEnd, fileSize)
+	if err != nil {
+		return AudioQuality{}, err
 	}
 
-	return AudioQuality{}, fmt.Errorf("audio info not found in M4A file")
+	buf := make([]byte, 24)
+	if _, err := f.ReadAt(buf, sampleOffset); err != nil {
+		return AudioQuality{}, fmt.Errorf("failed to read audio sample entry: %w", err)
+	}
+
+	sampleRate := int(buf[22])<<8 | int(buf[23])
+	bitDepth := 16
+	if atomType == "alac" {
+		bitDepth = 24
+	}
+
+	return AudioQuality{BitDepth: bitDepth, SampleRate: sampleRate}, nil
+}
+
+type atomHeader struct {
+	offset     int64
+	size       int64
+	headerSize int64
+	typ        string
+}
+
+func readAtomHeaderAt(f *os.File, offset, fileSize int64) (atomHeader, error) {
+	if offset+8 > fileSize {
+		return atomHeader{}, io.ErrUnexpectedEOF
+	}
+
+	headerBuf := make([]byte, 8)
+	if _, err := f.ReadAt(headerBuf, offset); err != nil {
+		return atomHeader{}, err
+	}
+
+	size32 := binary.BigEndian.Uint32(headerBuf[0:4])
+	typ := string(headerBuf[4:8])
+
+	if size32 == 1 {
+		if offset+16 > fileSize {
+			return atomHeader{}, io.ErrUnexpectedEOF
+		}
+		extBuf := make([]byte, 8)
+		if _, err := f.ReadAt(extBuf, offset+8); err != nil {
+			return atomHeader{}, err
+		}
+		size64 := binary.BigEndian.Uint64(extBuf)
+		return atomHeader{offset: offset, size: int64(size64), headerSize: 16, typ: typ}, nil
+	}
+
+	return atomHeader{offset: offset, size: int64(size32), headerSize: 8, typ: typ}, nil
+}
+
+func findAtomInRange(f *os.File, start, size int64, target string, fileSize int64) (atomHeader, bool, error) {
+	if size <= 0 {
+		return atomHeader{}, false, nil
+	}
+
+	end := start + size
+	pos := start
+
+	for pos+8 <= end {
+		header, err := readAtomHeaderAt(f, pos, fileSize)
+		if err != nil {
+			return atomHeader{}, false, err
+		}
+
+		atomSize := header.size
+		if atomSize == 0 {
+			atomSize = end - pos
+		}
+
+		if atomSize < header.headerSize {
+			return atomHeader{}, false, fmt.Errorf("invalid atom size for %s", header.typ)
+		}
+
+		header.size = atomSize
+		if header.typ == target {
+			return header, true, nil
+		}
+
+		pos += atomSize
+	}
+
+	return atomHeader{}, false, nil
+}
+
+func writeAtomHeader(w io.Writer, typ string, size int64, headerSize int64) error {
+	if len(typ) != 4 {
+		return fmt.Errorf("invalid atom type: %s", typ)
+	}
+
+	if headerSize == 16 {
+		header := make([]byte, 16)
+		binary.BigEndian.PutUint32(header[0:4], 1)
+		copy(header[4:8], []byte(typ))
+		binary.BigEndian.PutUint64(header[8:16], uint64(size))
+		_, err := w.Write(header)
+		return err
+	}
+
+	if size > int64(^uint32(0)) {
+		return fmt.Errorf("atom size exceeds 32-bit for %s", typ)
+	}
+
+	header := make([]byte, 8)
+	binary.BigEndian.PutUint32(header[0:4], uint32(size))
+	copy(header[4:8], []byte(typ))
+	_, err := w.Write(header)
+	return err
+}
+
+func copyRange(dst io.Writer, src *os.File, offset, length int64) error {
+	if length <= 0 {
+		return nil
+	}
+	if _, err := src.Seek(offset, io.SeekStart); err != nil {
+		return fmt.Errorf("failed to seek source: %w", err)
+	}
+	if _, err := io.CopyN(dst, src, length); err != nil {
+		return fmt.Errorf("failed to copy data: %w", err)
+	}
+	return nil
+}
+
+func buildUdtaAtom(metaAtom []byte) []byte {
+	size := 8 + len(metaAtom)
+	header := make([]byte, 8)
+	binary.BigEndian.PutUint32(header[0:4], uint32(size))
+	copy(header[4:8], []byte("udta"))
+	return append(header, metaAtom...)
+}
+
+func findAudioSampleEntry(f *os.File, start, end, fileSize int64) (int64, string, error) {
+	const chunkSize = 64 * 1024
+	patternMP4A := []byte("mp4a")
+	patternALAC := []byte("alac")
+
+	var tail []byte
+	readPos := start
+
+	for readPos < end {
+		toRead := end - readPos
+		if toRead > chunkSize {
+			toRead = chunkSize
+		}
+
+		buf := make([]byte, toRead)
+		n, err := f.ReadAt(buf, readPos)
+		if err != nil && err != io.EOF {
+			return 0, "", fmt.Errorf("failed to read M4A atom data: %w", err)
+		}
+		if n == 0 {
+			break
+		}
+
+		data := append(tail, buf[:n]...)
+		mp4aIdx := bytes.Index(data, patternMP4A)
+		alacIdx := bytes.Index(data, patternALAC)
+
+		bestIdx := -1
+		bestType := ""
+		switch {
+		case mp4aIdx >= 0 && alacIdx >= 0:
+			if mp4aIdx <= alacIdx {
+				bestIdx = mp4aIdx
+				bestType = "mp4a"
+			} else {
+				bestIdx = alacIdx
+				bestType = "alac"
+			}
+		case mp4aIdx >= 0:
+			bestIdx = mp4aIdx
+			bestType = "mp4a"
+		case alacIdx >= 0:
+			bestIdx = alacIdx
+			bestType = "alac"
+		}
+
+		if bestIdx >= 0 {
+			absolute := readPos - int64(len(tail)) + int64(bestIdx)
+			if absolute+24 > fileSize {
+				return 0, "", fmt.Errorf("audio info not found in M4A file")
+			}
+			return absolute, bestType, nil
+		}
+
+		if len(data) >= 3 {
+			tail = append([]byte{}, data[len(data)-3:]...)
+		} else {
+			tail = append([]byte{}, data...)
+		}
+
+		readPos += int64(n)
+	}
+
+	return 0, "", fmt.Errorf("audio info not found in M4A file")
 }

go_backend/mobile_deps.go

@@ -0,0 +1,10 @@
+// mobile_deps.go
+// This file ensures gomobile dependencies are not removed by go mod tidy.
+// These packages are required by gomobile bind but not directly imported in code.
+
+package gobackend
+
+import (
+	// Required for gomobile bind to work
+	_ "golang.org/x/mobile/bind"
+)

go_backend/parallel.go

@@ -6,11 +6,6 @@ import (
 	"time"
 )
 
-// ========================================
-// ISRC to Track ID Cache
-// ========================================
-
-// TrackIDCacheEntry holds cached track ID with metadata
 type TrackIDCacheEntry struct {
 	TidalTrackID  int64
 	QobuzTrackID  int64
@@ -18,11 +13,13 @@ type TrackIDCacheEntry struct {
 	ExpiresAt     time.Time
 }
 
-// TrackIDCache caches ISRC to track ID mappings
 type TrackIDCache struct {
 	cache map[string]*TrackIDCacheEntry
 	mu    sync.RWMutex
 	ttl   time.Duration
+	// Cleanup is triggered on writes at a fixed interval to avoid unbounded growth.
+	lastCleanup     time.Time
+	cleanupInterval time.Duration
 }
 
 var (
@@ -30,30 +27,49 @@ var (
 	trackIDCacheOnce   sync.Once
 )
 
-// GetTrackIDCache returns the global track ID cache
 func GetTrackIDCache() *TrackIDCache {
 	trackIDCacheOnce.Do(func() {
 		globalTrackIDCache = &TrackIDCache{
-			cache: make(map[string]*TrackIDCacheEntry),
-			ttl:   30 * time.Minute, // Cache for 30 minutes
+			cache:           make(map[string]*TrackIDCacheEntry),
+			ttl:             30 * time.Minute,
+			cleanupInterval: 5 * time.Minute,
 		}
 	})
 	return globalTrackIDCache
 }
 
-// Get retrieves a cached entry by ISRC
 func (c *TrackIDCache) Get(isrc string) *TrackIDCacheEntry {
 	c.mu.RLock()
-	defer c.mu.RUnlock()
-
 	entry, exists := c.cache[isrc]
-	if !exists || time.Now().After(entry.ExpiresAt) {
+	if !exists {
+		c.mu.RUnlock()
 		return nil
 	}
-	return entry
+	expired := time.Now().After(entry.ExpiresAt)
+	c.mu.RUnlock()
+
+	if !expired {
+		return entry
+	}
+
+	// Lazily delete expired entry.
+	c.mu.Lock()
+	entry, exists = c.cache[isrc]
+	if exists && time.Now().After(entry.ExpiresAt) {
+		delete(c.cache, isrc)
+	}
+	c.mu.Unlock()
+	return nil
+}
+
+func (c *TrackIDCache) pruneExpiredLocked(now time.Time) {
+	for key, entry := range c.cache {
+		if now.After(entry.ExpiresAt) {
+			delete(c.cache, key)
+		}
+	}
 }
 
-// SetTidal caches Tidal track ID for an ISRC
 func (c *TrackIDCache) SetTidal(isrc string, trackID int64) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
@@ -64,10 +80,15 @@ func (c *TrackIDCache) SetTidal(isrc string, trackID int64) {
 		c.cache[isrc] = entry
 	}
 	entry.TidalTrackID = trackID
-	entry.ExpiresAt = time.Now().Add(c.ttl)
+	now := time.Now()
+	entry.ExpiresAt = now.Add(c.ttl)
+
+	if c.cleanupInterval > 0 && (c.lastCleanup.IsZero() || now.Sub(c.lastCleanup) >= c.cleanupInterval) {
+		c.pruneExpiredLocked(now)
+		c.lastCleanup = now
+	}
 }
 
-// SetQobuz caches Qobuz track ID for an ISRC
 func (c *TrackIDCache) SetQobuz(isrc string, trackID int64) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
@@ -78,10 +99,15 @@ func (c *TrackIDCache) SetQobuz(isrc string, trackID int64) {
 		c.cache[isrc] = entry
 	}
 	entry.QobuzTrackID = trackID
-	entry.ExpiresAt = time.Now().Add(c.ttl)
+	now := time.Now()
+	entry.ExpiresAt = now.Add(c.ttl)
+
+	if c.cleanupInterval > 0 && (c.lastCleanup.IsZero() || now.Sub(c.lastCleanup) >= c.cleanupInterval) {
+		c.pruneExpiredLocked(now)
+		c.lastCleanup = now
+	}
 }
 
-// SetAmazon caches Amazon track ID for an ISRC
 func (c *TrackIDCache) SetAmazon(isrc string, trackID string) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
@@ -92,27 +118,27 @@ func (c *TrackIDCache) SetAmazon(isrc string, trackID string) {
 		c.cache[isrc] = entry
 	}
 	entry.AmazonTrackID = trackID
-	entry.ExpiresAt = time.Now().Add(c.ttl)
+	now := time.Now()
+	entry.ExpiresAt = now.Add(c.ttl)
+
+	if c.cleanupInterval > 0 && (c.lastCleanup.IsZero() || now.Sub(c.lastCleanup) >= c.cleanupInterval) {
+		c.pruneExpiredLocked(now)
+		c.lastCleanup = now
+	}
 }
 
-// Clear removes all cached entries
 func (c *TrackIDCache) Clear() {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	c.cache = make(map[string]*TrackIDCacheEntry)
 }
 
-// Size returns the number of cached entries
 func (c *TrackIDCache) Size() int {
 	c.mu.RLock()
 	defer c.mu.RUnlock()
 	return len(c.cache)
 }
 
-// ========================================
-// Parallel Download Helper
-// ========================================
-
 // ParallelDownloadResult holds results from parallel operations
 type ParallelDownloadResult struct {
 	CoverData  []byte
@@ -122,8 +148,6 @@ type ParallelDownloadResult struct {
 	LyricsErr  error
 }
 
-// FetchCoverAndLyricsParallel downloads cover and fetches lyrics in parallel
-// This runs while the main audio download is happening
 func FetchCoverAndLyricsParallel(
 	coverURL string,
 	maxQualityCover bool,
@@ -131,11 +155,11 @@ func FetchCoverAndLyricsParallel(
 	trackName string,
 	artistName string,
 	embedLyrics bool,
+	durationMs int64,
 ) *ParallelDownloadResult {
 	result := &ParallelDownloadResult{}
 	var wg sync.WaitGroup
 
-	// Download cover in parallel
 	if coverURL != "" {
 		wg.Add(1)
 		go func() {
@@ -152,20 +176,19 @@ func FetchCoverAndLyricsParallel(
 		}()
 	}
 
-	// Fetch lyrics in parallel
 	if embedLyrics {
 		wg.Add(1)
 		go func() {
 			defer wg.Done()
 			fmt.Println("[Parallel] Starting lyrics fetch...")
 			client := NewLyricsClient()
-			lyrics, err := client.FetchLyricsAllSources(spotifyID, trackName, artistName)
+			durationSec := float64(durationMs) / 1000.0
+			lyrics, err := client.FetchLyricsAllSources(spotifyID, trackName, artistName, durationSec)
 			if err != nil {
 				result.LyricsErr = err
 				fmt.Printf("[Parallel] Lyrics fetch failed: %v\n", err)
 			} else if lyrics != nil && len(lyrics.Lines) > 0 {
 				result.LyricsData = lyrics
-				// Use LRC with metadata headers (like PC version)
 				result.LyricsLRC = convertToLRCWithMetadata(lyrics, trackName, artistName)
 				fmt.Printf("[Parallel] Lyrics fetched: %d lines\n", len(lyrics.Lines))
 			} else {
@@ -179,11 +202,6 @@ func FetchCoverAndLyricsParallel(
 	return result
 }
 
-// ========================================
-// Pre-warm Cache for Album/Playlist
-// ========================================
-
-// PreWarmCacheRequest represents a track to pre-warm cache for
 type PreWarmCacheRequest struct {
 	ISRC       string
 	TrackName  string
@@ -192,8 +210,6 @@ type PreWarmCacheRequest struct {
 	Service    string // "tidal", "qobuz", "amazon"
 }
 
-// PreWarmTrackCache pre-fetches track IDs for multiple tracks (for album/playlist)
-// This runs in background while user is viewing the track list
 func PreWarmTrackCache(requests []PreWarmCacheRequest) {
 	if len(requests) == 0 {
 		return
@@ -202,12 +218,10 @@ func PreWarmTrackCache(requests []PreWarmCacheRequest) {
 	fmt.Printf("[Cache] Pre-warming cache for %d tracks...\n", len(requests))
 	cache := GetTrackIDCache()
 
-	// Limit concurrent pre-warm requests
-	semaphore := make(chan struct{}, 3) // Max 3 concurrent
+	semaphore := make(chan struct{}, 3)
 	var wg sync.WaitGroup
 
 	for _, req := range requests {
-		// Skip if already cached
 		if cached := cache.Get(req.ISRC); cached != nil {
 			continue
 		}
@@ -215,8 +229,8 @@ func PreWarmTrackCache(requests []PreWarmCacheRequest) {
 		wg.Add(1)
 		go func(r PreWarmCacheRequest) {
 			defer wg.Done()
-			semaphore <- struct{}{}        // Acquire
-			defer func() { <-semaphore }() // Release
+			semaphore <- struct{}{}
+			defer func() { <-semaphore }()
 
 			switch r.Service {
 			case "tidal":
@@ -233,7 +247,7 @@ func PreWarmTrackCache(requests []PreWarmCacheRequest) {
 	fmt.Printf("[Cache] Pre-warm complete. Cache size: %d\n", cache.Size())
 }
 
-func preWarmTidalCache(isrc, trackName, artistName string) {
+func preWarmTidalCache(isrc, _, _ string) {
 	downloader := NewTidalDownloader()
 	track, err := downloader.SearchTrackByISRC(isrc)
 	if err == nil && track != nil {
@@ -252,38 +266,26 @@ func preWarmQobuzCache(isrc string) {
 }
 
 func preWarmAmazonCache(isrc, spotifyID string) {
-	// Amazon uses SongLink to get URL, so we pre-warm by checking availability
 	client := NewSongLinkClient()
 	availability, err := client.CheckTrackAvailability(spotifyID, isrc)
 	if err == nil && availability != nil && availability.Amazon {
-		// Store Amazon URL in cache (using ISRC as key)
 		GetTrackIDCache().SetAmazon(isrc, availability.AmazonURL)
 		fmt.Printf("[Cache] Cached Amazon URL for ISRC %s\n", isrc)
 	}
 }
 
-// ========================================
-// Exported Functions for Flutter
-// ========================================
-
-// PreWarmCache is called from Flutter to pre-warm cache for album/playlist tracks
-// tracksJSON is a JSON array of {isrc, track_name, artist_name, service}
 func PreWarmCache(tracksJSON string) error {
 	var requests []PreWarmCacheRequest
-	// Parse JSON (simplified - in production use proper JSON parsing)
-	// For now, this is called from exports.go with proper parsing
-	
-	go PreWarmTrackCache(requests) // Run in background
+
+	go PreWarmTrackCache(requests)
 	return nil
 }
 
-// ClearTrackCache clears the track ID cache
 func ClearTrackCache() {
 	GetTrackIDCache().Clear()
 	fmt.Println("[Cache] Track ID cache cleared")
 }
 
-// GetCacheSize returns the current cache size
 func GetCacheSize() int {
 	return GetTrackIDCache().Size()
 }

go_backend/progress.go

@@ -6,8 +6,6 @@ import (
 	"time"
 )
 
-// DownloadProgress represents current download progress
-// Now unified - returns data from multi-progress system
 type DownloadProgress struct {
 	CurrentFile   string  `json:"current_file"`
 	Progress      float64 `json:"progress"`
@@ -15,21 +13,19 @@ type DownloadProgress struct {
 	BytesTotal    int64   `json:"bytes_total"`
 	BytesReceived int64   `json:"bytes_received"`
 	IsDownloading bool    `json:"is_downloading"`
-	Status        string  `json:"status"` // "downloading", "finalizing", "completed"
+	Status        string  `json:"status"`
 }
 
-// ItemProgress represents progress for a single download item
 type ItemProgress struct {
 	ItemID        string  `json:"item_id"`
 	BytesTotal    int64   `json:"bytes_total"`
 	BytesReceived int64   `json:"bytes_received"`
-	Progress      float64 `json:"progress"` // 0.0 to 1.0
-	SpeedMBps     float64 `json:"speed_mbps"` // Download speed in MB/s
+	Progress      float64 `json:"progress"`
+	SpeedMBps     float64 `json:"speed_mbps"`
 	IsDownloading bool    `json:"is_downloading"`
-	Status        string  `json:"status"` // "downloading", "finalizing", "completed"
+	Status        string  `json:"status"`
 }
 
-// MultiProgress holds progress for multiple concurrent downloads
 type MultiProgress struct {
 	Items map[string]*ItemProgress `json:"items"`
 }
@@ -38,22 +34,18 @@ var (
 	downloadDir   string
 	downloadDirMu sync.RWMutex
 
-	// Multi-download progress tracking (unified system)
 	multiProgress = MultiProgress{Items: make(map[string]*ItemProgress)}
 	multiMu       sync.RWMutex
 )
 
-// getProgress returns current download progress from multi-progress system
-// Returns first active item's progress for backward compatibility
 func getProgress() DownloadProgress {
 	multiMu.RLock()
 	defer multiMu.RUnlock()
 
-	// Find first active item
 	for _, item := range multiProgress.Items {
 		return DownloadProgress{
 			CurrentFile:   item.ItemID,
-			Progress:      item.Progress * 100, // Convert to percentage
+			Progress:      item.Progress * 100,
 			BytesTotal:    item.BytesTotal,
 			BytesReceived: item.BytesReceived,
 			IsDownloading: item.IsDownloading,
@@ -64,7 +56,6 @@ func getProgress() DownloadProgress {
 	return DownloadProgress{}
 }
 
-// GetMultiProgress returns progress for all active downloads as JSON
 func GetMultiProgress() string {
 	multiMu.RLock()
 	defer multiMu.RUnlock()
@@ -76,7 +67,6 @@ func GetMultiProgress() string {
 	return string(jsonBytes)
 }
 
-// GetItemProgress returns progress for a specific item as JSON
 func GetItemProgress(itemID string) string {
 	multiMu.RLock()
 	defer multiMu.RUnlock()
@@ -203,13 +193,6 @@ func setDownloadDir(path string) error {
 	return nil
 }
 
-// getDownloadDir returns the default download directory
-func getDownloadDir() string {
-	downloadDirMu.RLock()
-	defer downloadDirMu.RUnlock()
-	return downloadDir
-}
-
 // ItemProgressWriter wraps io.Writer to track download progress for a specific item
 type ItemProgressWriter struct {
 	writer       interface{ Write([]byte) (int, error) }
@@ -239,16 +222,16 @@ func NewItemProgressWriter(w interface{ Write([]byte) (int, error) }, itemID str
 
 // Write implements io.Writer with threshold-based progress updates and speed tracking
 func (pw *ItemProgressWriter) Write(p []byte) (int, error) {
+	if pw.itemID != "" && isDownloadCancelled(pw.itemID) {
+		return 0, ErrDownloadCancelled
+	}
 	n, err := pw.writer.Write(p)
 	if err != nil {
 		return n, err
 	}
 	pw.current += int64(n)
 
-	// Update progress when we've received at least 64KB since last update
-	// Also update on first write to show download has started
 	if pw.lastReported == 0 || pw.current-pw.lastReported >= progressUpdateThreshold {
-		// Calculate speed (MB/s) based on bytes received since last update
 		now := time.Now()
 		elapsed := now.Sub(pw.lastTime).Seconds()
 		var speedMBps float64
@@ -256,7 +239,7 @@ func (pw *ItemProgressWriter) Write(p []byte) (int, error) {
 			bytesInInterval := pw.current - pw.lastBytes
 			speedMBps = float64(bytesInInterval) / (1024 * 1024) / elapsed
 		}
-		
+
 		SetItemBytesReceivedWithSpeed(pw.itemID, pw.current, speedMBps)
 		pw.lastReported = pw.current
 		pw.lastTime = now

go_backend/qobuz.go

@@ -2,8 +2,10 @@ package gobackend
 
 import (
 	"bufio"
+	"context"
 	"encoding/base64"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -12,9 +14,9 @@ import (
 	"path/filepath"
 	"strings"
 	"sync"
+	"time"
 )
 
-// QobuzDownloader handles Qobuz downloads
 type QobuzDownloader struct {
 	client *http.Client
 	appID  string
@@ -22,12 +24,10 @@ type QobuzDownloader struct {
 }
 
 var (
-	// Global Qobuz downloader instance for connection reuse
 	globalQobuzDownloader *QobuzDownloader
 	qobuzDownloaderOnce   sync.Once
 )
 
-// QobuzTrack represents a Qobuz track
 type QobuzTrack struct {
 	ID                  int64   `json:"id"`
 	Title               string  `json:"title"`
@@ -48,7 +48,6 @@ type QobuzTrack struct {
 	} `json:"performer"`
 }
 
-// qobuzArtistsMatch checks if the artist names are similar enough
 func qobuzArtistsMatch(expectedArtist, foundArtist string) bool {
 	normExpected := strings.ToLower(strings.TrimSpace(expectedArtist))
 	normFound := strings.ToLower(strings.TrimSpace(foundArtist))
@@ -63,28 +62,24 @@ func qobuzArtistsMatch(expectedArtist, foundArtist string) bool {
 		return true
 	}
 
-	// Check first artist (before comma or feat)
-	expectedFirst := strings.Split(normExpected, ",")[0]
-	expectedFirst = strings.Split(expectedFirst, " feat")[0]
-	expectedFirst = strings.Split(expectedFirst, " ft.")[0]
-	expectedFirst = strings.TrimSpace(expectedFirst)
+	expectedArtists := qobuzSplitArtists(normExpected)
+	foundArtists := qobuzSplitArtists(normFound)
 
-	foundFirst := strings.Split(normFound, ",")[0]
-	foundFirst = strings.Split(foundFirst, " feat")[0]
-	foundFirst = strings.Split(foundFirst, " ft.")[0]
-	foundFirst = strings.TrimSpace(foundFirst)
-
-	if expectedFirst == foundFirst {
-		return true
+	for _, exp := range expectedArtists {
+		for _, fnd := range foundArtists {
+			if exp == fnd {
+				return true
+			}
+			if strings.Contains(exp, fnd) || strings.Contains(fnd, exp) {
+				return true
+			}
+			if qobuzSameWordsUnordered(exp, fnd) {
+				GoLog("[Qobuz] Artist names have same words in different order: '%s' vs '%s'\n", exp, fnd)
+				return true
+			}
+		}
 	}
 
-	// Check if first artist is contained in the other
-	if strings.Contains(expectedFirst, foundFirst) || strings.Contains(foundFirst, expectedFirst) {
-		return true
-	}
-
-	// If scripts are TRULY different (Latin vs CJK/Arabic/Cyrillic), assume match (transliteration)
-	// Don't treat Latin Extended (Polish, French, etc.) as different script
 	expectedLatin := qobuzIsLatinScript(expectedArtist)
 	foundLatin := qobuzIsLatinScript(foundArtist)
 	if expectedLatin != foundLatin {
@@ -95,7 +90,65 @@ func qobuzArtistsMatch(expectedArtist, foundArtist string) bool {
 	return false
 }
 
-// qobuzTitlesMatch checks if track titles are similar enough
+func qobuzSplitArtists(artists string) []string {
+	normalized := artists
+	normalized = strings.ReplaceAll(normalized, " feat. ", "|")
+	normalized = strings.ReplaceAll(normalized, " feat ", "|")
+	normalized = strings.ReplaceAll(normalized, " ft. ", "|")
+	normalized = strings.ReplaceAll(normalized, " ft ", "|")
+	normalized = strings.ReplaceAll(normalized, " & ", "|")
+	normalized = strings.ReplaceAll(normalized, " and ", "|")
+	normalized = strings.ReplaceAll(normalized, ", ", "|")
+	normalized = strings.ReplaceAll(normalized, " x ", "|")
+
+	parts := strings.Split(normalized, "|")
+	result := make([]string, 0, len(parts))
+	for _, p := range parts {
+		trimmed := strings.TrimSpace(p)
+		if trimmed != "" {
+			result = append(result, trimmed)
+		}
+	}
+	return result
+}
+
+// qobuzSameWordsUnordered checks if two strings have the same words regardless of order
+// Useful for Japanese names: "Sawano Hiroyuki" vs "Hiroyuki Sawano"
+func qobuzSameWordsUnordered(a, b string) bool {
+	wordsA := strings.Fields(a)
+	wordsB := strings.Fields(b)
+
+	// Must have same number of words
+	if len(wordsA) != len(wordsB) || len(wordsA) == 0 {
+		return false
+	}
+
+	// Sort and compare
+	sortedA := make([]string, len(wordsA))
+	sortedB := make([]string, len(wordsB))
+	copy(sortedA, wordsA)
+	copy(sortedB, wordsB)
+
+	// Simple bubble sort (usually just 2-3 words)
+	for i := 0; i < len(sortedA)-1; i++ {
+		for j := i + 1; j < len(sortedA); j++ {
+			if sortedA[i] > sortedA[j] {
+				sortedA[i], sortedA[j] = sortedA[j], sortedA[i]
+			}
+			if sortedB[i] > sortedB[j] {
+				sortedB[i], sortedB[j] = sortedB[j], sortedB[i]
+			}
+		}
+	}
+
+	for i := range sortedA {
+		if sortedA[i] != sortedB[i] {
+			return false
+		}
+	}
+	return true
+}
+
 func qobuzTitlesMatch(expectedTitle, foundTitle string) bool {
 	normExpected := strings.ToLower(strings.TrimSpace(expectedTitle))
 	normFound := strings.ToLower(strings.TrimSpace(foundTitle))
@@ -105,12 +158,10 @@ func qobuzTitlesMatch(expectedTitle, foundTitle string) bool {
 		return true
 	}
 
-	// Check if one contains the other
 	if strings.Contains(normExpected, normFound) || strings.Contains(normFound, normExpected) {
 		return true
 	}
 
-	// Clean BOTH titles and compare (removes suffixes like remaster, remix, etc)
 	cleanExpected := qobuzCleanTitle(normExpected)
 	cleanFound := qobuzCleanTitle(normFound)
 
@@ -118,14 +169,12 @@ func qobuzTitlesMatch(expectedTitle, foundTitle string) bool {
 		return true
 	}
 
-	// Check if cleaned versions contain each other
 	if cleanExpected != "" && cleanFound != "" {
 		if strings.Contains(cleanExpected, cleanFound) || strings.Contains(cleanFound, cleanExpected) {
 			return true
 		}
 	}
 
-	// Extract core title (before any parentheses/brackets)
 	coreExpected := qobuzExtractCoreTitle(normExpected)
 	coreFound := qobuzExtractCoreTitle(normFound)
 
@@ -166,19 +215,15 @@ func qobuzExtractCoreTitle(title string) string {
 	return strings.TrimSpace(title[:cutIdx])
 }
 
-// qobuzCleanTitle removes common suffixes from track titles for comparison
 func qobuzCleanTitle(title string) string {
 	cleaned := title
 
-	// Remove content in parentheses/brackets that are version indicators
-	// This helps match "Song (Remastered)" with "Song" or "Song (2024 Remaster)"
 	versionPatterns := []string{
 		"remaster", "remastered", "deluxe", "bonus", "single",
 		"album version", "radio edit", "original mix", "extended",
 		"club mix", "remix", "live", "acoustic", "demo",
 	}
 
-	// Remove parenthetical content if it contains version indicators
 	for {
 		startParen := strings.LastIndex(cleaned, "(")
 		endParen := strings.LastIndex(cleaned, ")")
@@ -199,7 +244,6 @@ func qobuzCleanTitle(title string) string {
 		break
 	}
 
-	// Same for brackets
 	for {
 		startBracket := strings.LastIndex(cleaned, "[")
 		endBracket := strings.LastIndex(cleaned, "]")
@@ -220,7 +264,6 @@ func qobuzCleanTitle(title string) string {
 		break
 	}
 
-	// Remove trailing " - version" patterns
 	dashPatterns := []string{
 		" - remaster", " - remastered", " - single version", " - radio edit",
 		" - live", " - acoustic", " - demo", " - remix",
@@ -231,7 +274,6 @@ func qobuzCleanTitle(title string) string {
 		}
 	}
 
-	// Remove multiple spaces
 	for strings.Contains(cleaned, "  ") {
 		cleaned = strings.ReplaceAll(cleaned, "  ", " ")
 	}
@@ -271,14 +313,15 @@ func qobuzIsLatinScript(s string) bool {
 }
 
 // qobuzIsASCIIString checks if a string contains only ASCII characters
-func qobuzIsASCIIString(s string) bool {
-	for _, r := range s {
-		if r > 127 {
-			return false
-		}
-	}
-	return true
-}
+// Kept for potential future use
+// func qobuzIsASCIIString(s string) bool {
+// 	for _, r := range s {
+// 		if r > 127 {
+// 			return false
+// 		}
+// 	}
+// 	return true
+// }
 
 // containsQueryQobuz checks if a query already exists in the list
 func containsQueryQobuz(queries []string, query string) bool {
@@ -290,7 +333,6 @@ func containsQueryQobuz(queries []string, query string) bool {
 	return false
 }
 
-// NewQobuzDownloader creates a new Qobuz downloader (returns singleton for connection reuse)
 func NewQobuzDownloader() *QobuzDownloader {
 	qobuzDownloaderOnce.Do(func() {
 		globalQobuzDownloader = &QobuzDownloader{
@@ -301,14 +343,43 @@ func NewQobuzDownloader() *QobuzDownloader {
 	return globalQobuzDownloader
 }
 
+func (q *QobuzDownloader) GetTrackByID(trackID int64) (*QobuzTrack, error) {
+	// Qobuz API: /track/get?track_id=XXX
+	apiBase, _ := base64.StdEncoding.DecodeString("aHR0cHM6Ly93d3cucW9idXouY29tL2FwaS5qc29uLzAuMi90cmFjay9nZXQ/dHJhY2tfaWQ9")
+	trackURL := fmt.Sprintf("%s%d&app_id=%s", string(apiBase), trackID, q.appID)
+
+	req, err := http.NewRequest("GET", trackURL, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	resp, err := DoRequestWithUserAgent(q.client, req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != 200 {
+		return nil, fmt.Errorf("get track failed: HTTP %d", resp.StatusCode)
+	}
+
+	var track QobuzTrack
+	if err := json.NewDecoder(resp.Body).Decode(&track); err != nil {
+		return nil, err
+	}
+
+	return &track, nil
+}
+
 // GetAvailableAPIs returns list of available Qobuz APIs
 // Uses same APIs as PC version for compatibility
 func (q *QobuzDownloader) GetAvailableAPIs() []string {
 	// Same APIs as PC version (referensi/backend/qobuz.go)
-	// Primary: dab.yeet.su, Fallback: dabmusic.xyz
+	// Primary: dab.yeet.su, Fallback: dabmusic.xyz, qobuz.squid.wtf
 	encodedAPIs := []string{
-		"ZGFiLnllZXQuc3UvYXBpL3N0cmVhbT90cmFja0lkPQ==", // dab.yeet.su/api/stream?trackId= (PRIMARY - same as PC)
-		"ZGFibXVzaWMueHl6L2FwaS9zdHJlYW0/dHJhY2tJZD0=", // dabmusic.xyz/api/stream?trackId= (FALLBACK - same as PC)
+		"ZGFiLnllZXQuc3UvYXBpL3N0cmVhbT90cmFja0lkPQ==",                 // dab.yeet.su/api/stream?trackId=
+		"ZGFibXVzaWMueHl6L2FwaS9zdHJlYW0/dHJhY2tJZD0=",                 // dabmusic.xyz/api/stream?trackId=
+		"cW9idXouc3F1aWQud3RmL2FwaS9kb3dubG9hZC1tdXNpYz90cmFja19pZD0=", // qobuz.squid.wtf/api/download-music?track_id=
 	}
 
 	var apis []string
@@ -323,7 +394,95 @@ func (q *QobuzDownloader) GetAvailableAPIs() []string {
 	return apis
 }
 
-// SearchTrackByISRC searches for a track by ISRC
+// mapJumoQuality maps Qobuz quality codes to Jumo format
+func mapJumoQuality(quality string) int {
+	switch quality {
+	case "6":
+		return 6 // 16-bit FLAC
+	case "7":
+		return 7 // 24-bit 96kHz
+	case "27":
+		return 27 // 24-bit 192kHz
+	default:
+		return 6
+	}
+}
+
+// decodeXOR decodes XOR-encoded response from Jumo API
+func decodeXOR(data []byte) string {
+	text := string(data)
+	runes := []rune(text)
+	result := make([]rune, len(runes))
+	for i, char := range runes {
+		key := rune((i * 17) % 128)
+		result[i] = char ^ 253 ^ key
+	}
+	return string(result)
+}
+
+// downloadFromJumo gets download URL from Jumo API (fallback)
+func (q *QobuzDownloader) downloadFromJumo(trackID int64, quality string) (string, error) {
+	formatID := mapJumoQuality(quality)
+	region := "US"
+
+	// Jumo API endpoint
+	jumoURL := fmt.Sprintf("https://jumo-dl.pages.dev/file?track_id=%d&format_id=%d&region=%s", trackID, formatID, region)
+
+	GoLog("[Qobuz] Trying Jumo API fallback...\n")
+
+	client := NewHTTPClientWithTimeout(30 * time.Second)
+	req, err := http.NewRequest("GET", jumoURL, nil)
+	if err != nil {
+		return "", err
+	}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != 200 {
+		return "", fmt.Errorf("Jumo API returned HTTP %d", resp.StatusCode)
+	}
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", err
+	}
+
+	var result map[string]any
+
+	// Try parsing as plain JSON first
+	if err := json.Unmarshal(body, &result); err != nil {
+		// Try XOR decoding
+		decoded := decodeXOR(body)
+		if err := json.Unmarshal([]byte(decoded), &result); err != nil {
+			return "", fmt.Errorf("failed to parse Jumo response (plain or XOR): %w", err)
+		}
+	}
+
+	// Check for URL in various response formats
+	if urlVal, ok := result["url"].(string); ok && urlVal != "" {
+		GoLog("[Qobuz] Jumo API returned URL successfully\n")
+		return urlVal, nil
+	}
+
+	if data, ok := result["data"].(map[string]any); ok {
+		if urlVal, ok := data["url"].(string); ok && urlVal != "" {
+			GoLog("[Qobuz] Jumo API returned URL successfully (from data)\n")
+			return urlVal, nil
+		}
+	}
+
+	if linkVal, ok := result["link"].(string); ok && linkVal != "" {
+		GoLog("[Qobuz] Jumo API returned URL successfully (from link)\n")
+		return linkVal, nil
+	}
+
+	return "", fmt.Errorf("URL not found in Jumo response")
+}
+
 func (q *QobuzDownloader) SearchTrackByISRC(isrc string) (*QobuzTrack, error) {
 	apiBase, _ := base64.StdEncoding.DecodeString("aHR0cHM6Ly93d3cucW9idXouY29tL2FwaS5qc29uLzAuMi90cmFjay9zZWFyY2g/cXVlcnk9")
 	searchURL := fmt.Sprintf("%s%s&limit=50&app_id=%s", string(apiBase), url.QueryEscape(isrc), q.appID)
@@ -366,7 +525,6 @@ func (q *QobuzDownloader) SearchTrackByISRC(isrc string) (*QobuzTrack, error) {
 	return nil, fmt.Errorf("no exact ISRC match found for: %s", isrc)
 }
 
-// SearchTrackByISRCWithTitle searches for a track by ISRC with duration verification
 // expectedDurationSec is the expected duration in seconds (0 to skip verification)
 func (q *QobuzDownloader) SearchTrackByISRCWithDuration(isrc string, expectedDurationSec int) (*QobuzTrack, error) {
 	GoLog("[Qobuz] Searching by ISRC: %s\n", isrc)
@@ -411,7 +569,6 @@ func (q *QobuzDownloader) SearchTrackByISRCWithDuration(isrc string, expectedDur
 	GoLog("[Qobuz] Found %d exact ISRC matches\n", len(isrcMatches))
 
 	if len(isrcMatches) > 0 {
-		// Verify duration if provided
 		if expectedDurationSec > 0 {
 			var durationVerifiedMatches []*QobuzTrack
 			for _, track := range isrcMatches {
@@ -419,7 +576,6 @@ func (q *QobuzDownloader) SearchTrackByISRCWithDuration(isrc string, expectedDur
 				if durationDiff < 0 {
 					durationDiff = -durationDiff
 				}
-				// Allow 10 seconds tolerance
 				if durationDiff <= 10 {
 					durationVerifiedMatches = append(durationVerifiedMatches, track)
 				}
@@ -431,14 +587,12 @@ func (q *QobuzDownloader) SearchTrackByISRCWithDuration(isrc string, expectedDur
 				return durationVerifiedMatches[0], nil
 			}
 
-			// ISRC matches but duration doesn't
 			GoLog("[Qobuz] WARNING: ISRC %s found but duration mismatch. Expected=%ds, Found=%ds. Rejecting.\n",
 				isrc, expectedDurationSec, isrcMatches[0].Duration)
 			return nil, fmt.Errorf("ISRC found but duration mismatch: expected %ds, found %ds (likely different version)",
 				expectedDurationSec, isrcMatches[0].Duration)
 		}
 
-		// No duration to verify, return first match
 		GoLog("[Qobuz] ISRC match (no duration verification): '%s'\n", isrcMatches[0].Title)
 		return isrcMatches[0], nil
 	}
@@ -450,17 +604,14 @@ func (q *QobuzDownloader) SearchTrackByISRCWithDuration(isrc string, expectedDur
 	return nil, fmt.Errorf("no exact ISRC match found for: %s", isrc)
 }
 
-// SearchTrackByISRCWithTitle is deprecated, use SearchTrackByISRCWithDuration instead
 func (q *QobuzDownloader) SearchTrackByISRCWithTitle(isrc, expectedTitle string) (*QobuzTrack, error) {
 	return q.SearchTrackByISRCWithDuration(isrc, 0)
 }
 
-// SearchTrackByMetadata searches for a track using artist name and track name
 func (q *QobuzDownloader) SearchTrackByMetadata(trackName, artistName string) (*QobuzTrack, error) {
 	return q.SearchTrackByMetadataWithDuration(trackName, artistName, 0)
 }
 
-// SearchTrackByMetadataWithDuration searches for a track with duration verification
 // Now includes romaji conversion for Japanese text (same as Tidal)
 // Also includes title verification to prevent wrong song downloads
 func (q *QobuzDownloader) SearchTrackByMetadataWithDuration(trackName, artistName string, expectedDurationSec int) (*QobuzTrack, error) {
@@ -599,34 +750,32 @@ func (q *QobuzDownloader) SearchTrackByMetadataWithDuration(trackName, artistNam
 		}
 
 		if len(durationMatches) > 0 {
-			// Return best quality among duration matches
 			for _, track := range durationMatches {
 				if track.MaximumBitDepth >= 24 {
-					GoLog("[Qobuz] ✓ Match found: '%s' by '%s' (title+duration verified, hi-res)\n",
+					GoLog("[Qobuz] Match found: '%s' by '%s' (title+duration verified, hi-res)\n",
 						track.Title, track.Performer.Name)
 					return track, nil
 				}
 			}
-			GoLog("[Qobuz] ✓ Match found: '%s' by '%s' (title+duration verified)\n",
+			GoLog("[Qobuz] Match found: '%s' by '%s' (title+duration verified)\n",
 				durationMatches[0].Title, durationMatches[0].Performer.Name)
 			return durationMatches[0], nil
 		}
 
-		// No duration match found
 		return nil, fmt.Errorf("no tracks found with matching title and duration (expected '%s', %ds)", trackName, expectedDurationSec)
 	}
 
 	// No duration verification, return best quality from title matches
 	for _, track := range tracksToCheck {
 		if track.MaximumBitDepth >= 24 {
-			GoLog("[Qobuz] ✓ Match found: '%s' by '%s' (title verified, hi-res)\n",
+			GoLog("[Qobuz] Match found: '%s' by '%s' (title verified, hi-res)\n",
 				track.Title, track.Performer.Name)
 			return track, nil
 		}
 	}
 
 	if len(tracksToCheck) > 0 {
-		GoLog("[Qobuz] ✓ Match found: '%s' by '%s' (title verified)\n",
+		GoLog("[Qobuz] Match found: '%s' by '%s' (title verified)\n",
 			tracksToCheck[0].Title, tracksToCheck[0].Performer.Name)
 		return tracksToCheck[0], nil
 	}
@@ -634,107 +783,182 @@ func (q *QobuzDownloader) SearchTrackByMetadataWithDuration(trackName, artistNam
 	return nil, fmt.Errorf("no matching track found for: %s - %s", artistName, trackName)
 }
 
-// getQobuzDownloadURLSequential requests download URL from APIs sequentially
-// Uses same URL format as PC version: /api/stream?trackId={id}&quality={quality}
-func getQobuzDownloadURLSequential(apis []string, trackID int64, quality string) (string, string, error) {
+// qobuzAPIResult holds the result from a parallel API request
+type qobuzAPIResult struct {
+	apiURL      string
+	downloadURL string
+	err         error
+	duration    time.Duration
+}
+
+func getQobuzDownloadURLParallel(apis []string, trackID int64, quality string) (string, string, error) {
 	if len(apis) == 0 {
 		return "", "", fmt.Errorf("no APIs available")
 	}
 
-	client := NewHTTPClientWithTimeout(DefaultTimeout)
-	retryConfig := DefaultRetryConfig()
-	var errors []string
+	GoLog("[Qobuz] Requesting download URL from %d APIs in parallel...\n", len(apis))
 
+	resultChan := make(chan qobuzAPIResult, len(apis))
+	startTime := time.Now()
+
+	// Start all requests in parallel
 	for _, apiURL := range apis {
-		// All APIs now use same format: https://domain/api/stream?trackId={id}&quality={quality}
-		// The apiURL already includes the path, just append trackID and quality
-		reqURL := fmt.Sprintf("%s%d&quality=%s", apiURL, trackID, quality)
+		go func(api string) {
+			reqStart := time.Now()
 
-		GoLog("[Qobuz] Trying: %s\n", reqURL)
+			client := NewHTTPClientWithTimeout(15 * time.Second)
 
-		req, err := http.NewRequest("GET", reqURL, nil)
-		if err != nil {
-			errors = append(errors, BuildErrorMessage(apiURL, 0, err.Error()))
-			continue
-		}
+			reqURL := fmt.Sprintf("%s%d&quality=%s", api, trackID, quality)
 
-		resp, err := DoRequestWithRetry(client, req, retryConfig)
-		if err != nil {
-			errors = append(errors, BuildErrorMessage(apiURL, 0, err.Error()))
-			continue
-		}
+			req, err := http.NewRequest("GET", reqURL, nil)
+			if err != nil {
+				resultChan <- qobuzAPIResult{apiURL: api, err: err, duration: time.Since(reqStart)}
+				return
+			}
 
-		body, err := ReadResponseBody(resp)
-		resp.Body.Close()
-		if err != nil {
-			errors = append(errors, BuildErrorMessage(apiURL, resp.StatusCode, err.Error()))
-			continue
-		}
+			resp, err := client.Do(req)
+			if err != nil {
+				resultChan <- qobuzAPIResult{apiURL: api, err: err, duration: time.Since(reqStart)}
+				return
+			}
+			defer resp.Body.Close()
 
-		// Check if response is HTML (error page)
-		if len(body) > 0 && body[0] == '<' {
-			errors = append(errors, BuildErrorMessage(apiURL, resp.StatusCode, "received HTML instead of JSON"))
-			continue
-		}
+			if resp.StatusCode != 200 {
+				resultChan <- qobuzAPIResult{apiURL: api, err: fmt.Errorf("HTTP %d", resp.StatusCode), duration: time.Since(reqStart)}
+				return
+			}
 
-		// Check for error in JSON response
-		var errorResp struct {
-			Error string `json:"error"`
-		}
-		if json.Unmarshal(body, &errorResp) == nil && errorResp.Error != "" {
-			errors = append(errors, BuildErrorMessage(apiURL, resp.StatusCode, errorResp.Error))
-			continue
-		}
+			body, err := io.ReadAll(resp.Body)
+			if err != nil {
+				resultChan <- qobuzAPIResult{apiURL: api, err: err, duration: time.Since(reqStart)}
+				return
+			}
 
-		var result struct {
-			URL string `json:"url"`
-		}
-		if err := json.Unmarshal(body, &result); err != nil {
-			errors = append(errors, BuildErrorMessage(apiURL, resp.StatusCode, "invalid JSON: "+err.Error()))
-			continue
-		}
+			// Check if response is HTML (error page)
+			if len(body) > 0 && body[0] == '<' {
+				resultChan <- qobuzAPIResult{apiURL: api, err: fmt.Errorf("received HTML instead of JSON"), duration: time.Since(reqStart)}
+				return
+			}
 
-		if result.URL != "" {
-			GoLog("[Qobuz] Got download URL from: %s\n", apiURL)
-			return apiURL, result.URL, nil
-		}
+			// Check for error in JSON response
+			var errorResp struct {
+				Error string `json:"error"`
+			}
+			if json.Unmarshal(body, &errorResp) == nil && errorResp.Error != "" {
+				resultChan <- qobuzAPIResult{apiURL: api, err: fmt.Errorf("%s", errorResp.Error), duration: time.Since(reqStart)}
+				return
+			}
 
-		errors = append(errors, BuildErrorMessage(apiURL, resp.StatusCode, "no download URL in response"))
+			var result struct {
+				URL string `json:"url"`
+			}
+			if err := json.Unmarshal(body, &result); err != nil {
+				resultChan <- qobuzAPIResult{apiURL: api, err: fmt.Errorf("invalid JSON: %v", err), duration: time.Since(reqStart)}
+				return
+			}
+
+			if result.URL != "" {
+				resultChan <- qobuzAPIResult{apiURL: api, downloadURL: result.URL, err: nil, duration: time.Since(reqStart)}
+				return
+			}
+
+			resultChan <- qobuzAPIResult{apiURL: api, err: fmt.Errorf("no download URL in response"), duration: time.Since(reqStart)}
+		}(apiURL)
 	}
 
+	// Collect results - return first success
+	var errors []string
+
+	for i := 0; i < len(apis); i++ {
+		result := <-resultChan
+		if result.err == nil {
+			GoLog("[Qobuz] [Parallel] Got response from %s in %v\n", result.apiURL, result.duration)
+
+			// Drain remaining results to avoid goroutine leaks
+			go func(remaining int) {
+				for j := 0; j < remaining; j++ {
+					<-resultChan
+				}
+			}(len(apis) - i - 1)
+
+			GoLog("[Qobuz] [Parallel] Total time: %v (first success)\n", time.Since(startTime))
+			return result.apiURL, result.downloadURL, nil
+		}
+		errMsg := result.err.Error()
+		if len(errMsg) > 50 {
+			errMsg = errMsg[:50] + "..."
+		}
+		errors = append(errors, fmt.Sprintf("%s: %s", result.apiURL, errMsg))
+	}
+
+	GoLog("[Qobuz] [Parallel] All %d APIs failed in %v\n", len(apis), time.Since(startTime))
 	return "", "", fmt.Errorf("all %d Qobuz APIs failed. Errors: %v", len(apis), errors)
 }
 
-// GetDownloadURL gets download URL for a track - tries APIs sequentially
 func (q *QobuzDownloader) GetDownloadURL(trackID int64, quality string) (string, error) {
 	apis := q.GetAvailableAPIs()
 	if len(apis) == 0 {
 		return "", fmt.Errorf("no Qobuz API available")
 	}
 
-	_, downloadURL, err := getQobuzDownloadURLSequential(apis, trackID, quality)
-	if err != nil {
-		return "", err
+	_, downloadURL, err := getQobuzDownloadURLParallel(apis, trackID, quality)
+	if err == nil {
+		return downloadURL, nil
 	}
 
-	return downloadURL, nil
+	// All standard APIs failed, try Jumo as fallback
+	GoLog("[Qobuz] Standard APIs failed, trying Jumo fallback...\n")
+	jumoURL, jumoErr := q.downloadFromJumo(trackID, quality)
+	if jumoErr == nil {
+		return jumoURL, nil
+	}
+
+	// If quality is 27 (hi-res), try fallback to lower quality
+	if quality == "27" {
+		GoLog("[Qobuz] Hi-res (27) failed, trying 24-bit (7)...\n")
+		jumoURL, jumoErr = q.downloadFromJumo(trackID, "7")
+		if jumoErr == nil {
+			return jumoURL, nil
+		}
+	}
+
+	if quality == "27" || quality == "7" {
+		GoLog("[Qobuz] 24-bit failed, trying 16-bit (6)...\n")
+		jumoURL, jumoErr = q.downloadFromJumo(trackID, "6")
+		if jumoErr == nil {
+			return jumoURL, nil
+		}
+	}
+
+	return "", fmt.Errorf("all Qobuz APIs and Jumo fallback failed: %w", err)
 }
 
 // DownloadFile downloads a file from URL with User-Agent and progress tracking
 func (q *QobuzDownloader) DownloadFile(downloadURL, outputPath, itemID string) error {
+	ctx := context.Background()
+
 	// Initialize item progress (required for all downloads)
 	if itemID != "" {
 		StartItemProgress(itemID)
 		defer CompleteItemProgress(itemID)
+		ctx = initDownloadCancel(itemID)
+		defer clearDownloadCancel(itemID)
 	}
 
-	req, err := http.NewRequest("GET", downloadURL, nil)
+	if isDownloadCancelled(itemID) {
+		return ErrDownloadCancelled
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "GET", downloadURL, nil)
 	if err != nil {
 		return fmt.Errorf("failed to create request: %w", err)
 	}
 
 	resp, err := DoRequestWithUserAgent(q.client, req)
 	if err != nil {
+		if isDownloadCancelled(itemID) {
+			return ErrDownloadCancelled
+		}
 		return err
 	}
 	defer resp.Body.Close()
@@ -744,7 +968,6 @@ func (q *QobuzDownloader) DownloadFile(downloadURL, outputPath, itemID string) e
 	}
 
 	expectedSize := resp.ContentLength
-	// Set total bytes if available
 	if expectedSize > 0 && itemID != "" {
 		SetItemBytesTotal(itemID, expectedSize)
 	}
@@ -754,16 +977,13 @@ func (q *QobuzDownloader) DownloadFile(downloadURL, outputPath, itemID string) e
 		return err
 	}
 
-	// Use buffered writer for better performance (256KB buffer)
 	bufWriter := bufio.NewWriterSize(out, 256*1024)
 
-	// Use item progress writer with buffered output
 	var written int64
 	if itemID != "" {
 		progressWriter := NewItemProgressWriter(bufWriter, itemID)
 		written, err = io.Copy(progressWriter, resp.Body)
 	} else {
-		// Fallback: direct copy without progress tracking
 		written, err = io.Copy(bufWriter, resp.Body)
 	}
 
@@ -771,9 +991,11 @@ func (q *QobuzDownloader) DownloadFile(downloadURL, outputPath, itemID string) e
 	flushErr := bufWriter.Flush()
 	closeErr := out.Close()
 
-	// Check for any errors
 	if err != nil {
 		os.Remove(outputPath)
+		if isDownloadCancelled(itemID) {
+			return ErrDownloadCancelled
+		}
 		return fmt.Errorf("download interrupted: %w", err)
 	}
 	if flushErr != nil {
@@ -794,7 +1016,6 @@ func (q *QobuzDownloader) DownloadFile(downloadURL, outputPath, itemID string) e
 	return nil
 }
 
-// QobuzDownloadResult contains download result with quality info
 type QobuzDownloadResult struct {
 	FilePath    string
 	BitDepth    int
@@ -808,23 +1029,34 @@ type QobuzDownloadResult struct {
 	ISRC        string
 }
 
-// downloadFromQobuz downloads a track using the request parameters
 func downloadFromQobuz(req DownloadRequest) (QobuzDownloadResult, error) {
 	downloader := NewQobuzDownloader()
 
-	// Check for existing file first
 	if existingFile, exists := checkISRCExistsInternal(req.OutputDir, req.ISRC); exists {
 		return QobuzDownloadResult{FilePath: "EXISTS:" + existingFile}, nil
 	}
 
-	// Convert expected duration from ms to seconds
 	expectedDurationSec := req.DurationMS / 1000
 
 	var track *QobuzTrack
 	var err error
 
+	if req.QobuzID != "" {
+		GoLog("[Qobuz] Using Qobuz ID from Odesli enrichment: %s\n", req.QobuzID)
+		var trackID int64
+		if _, parseErr := fmt.Sscanf(req.QobuzID, "%d", &trackID); parseErr == nil && trackID > 0 {
+			track, err = downloader.GetTrackByID(trackID)
+			if err != nil {
+				GoLog("[Qobuz] Failed to get track by Odesli ID %d: %v\n", trackID, err)
+				track = nil
+			} else if track != nil {
+				GoLog("[Qobuz] Successfully found track via Odesli ID: '%s' by '%s'\n", track.Title, track.Performer.Name)
+			}
+		}
+	}
+
 	// OPTIMIZATION: Check cache first for track ID
-	if req.ISRC != "" {
+	if track == nil && req.ISRC != "" {
 		if cached := GetTrackIDCache().Get(req.ISRC); cached != nil && cached.QobuzTrackID > 0 {
 			GoLog("[Qobuz] Cache hit! Using cached track ID: %d\n", cached.QobuzTrackID)
 			// For Qobuz we need to search again to get full track info, but we can use the ID
@@ -879,7 +1111,6 @@ func downloadFromQobuz(req DownloadRequest) (QobuzDownloadResult, error) {
 		GetTrackIDCache().SetQobuz(req.ISRC, track.ID)
 	}
 
-	// Build filename
 	filename := buildFilenameFromTemplate(req.FilenameFormat, map[string]interface{}{
 		"title":  req.TrackName,
 		"artist": req.ArtistName,
@@ -891,7 +1122,6 @@ func downloadFromQobuz(req DownloadRequest) (QobuzDownloadResult, error) {
 	filename = sanitizeFilename(filename) + ".flac"
 	outputPath := filepath.Join(req.OutputDir, filename)
 
-	// Check if file already exists
 	if fileInfo, statErr := os.Stat(outputPath); statErr == nil && fileInfo.Size() > 0 {
 		return QobuzDownloadResult{FilePath: "EXISTS:" + outputPath}, nil
 	}
@@ -910,12 +1140,10 @@ func downloadFromQobuz(req DownloadRequest) (QobuzDownloadResult, error) {
 	}
 	GoLog("[Qobuz] Using quality: %s (mapped from %s)\n", qobuzQuality, req.Quality)
 
-	// Get actual quality from track metadata
 	actualBitDepth := track.MaximumBitDepth
 	actualSampleRate := int(track.MaximumSamplingRate * 1000) // Convert kHz to Hz
 	GoLog("[Qobuz] Actual quality: %d-bit/%.1fkHz\n", actualBitDepth, track.MaximumSamplingRate)
 
-	// Get download URL using parallel API requests
 	downloadURL, err := downloader.GetDownloadURL(track.ID, qobuzQuality)
 	if err != nil {
 		return QobuzDownloadResult{}, fmt.Errorf("failed to get download URL: %w", err)
@@ -933,45 +1161,52 @@ func downloadFromQobuz(req DownloadRequest) (QobuzDownloadResult, error) {
 			req.TrackName,
 			req.ArtistName,
 			req.EmbedLyrics,
+			int64(req.DurationMS),
 		)
 	}()
 
 	// Download audio file with item ID for progress tracking
 	if err := downloader.DownloadFile(downloadURL, outputPath, req.ItemID); err != nil {
+		if errors.Is(err, ErrDownloadCancelled) {
+			return QobuzDownloadResult{}, ErrDownloadCancelled
+		}
 		return QobuzDownloadResult{}, fmt.Errorf("download failed: %w", err)
 	}
 
 	// Wait for parallel operations to complete
 	<-parallelDone
 
-	// Set progress to 100% and status to finalizing (before embedding)
-	// This makes the UI show "Finalizing..." while embedding happens
 	if req.ItemID != "" {
 		SetItemProgress(req.ItemID, 1.0, 0, 0)
 		SetItemFinalizing(req.ItemID)
 	}
 
-	// Embed metadata using parallel-fetched cover data
-	// Use metadata from the actual Qobuz track found (more accurate than request) but prefer
-	// requested Album Name to avoid ISRC version mismatches (e.g. Compilations vs Original)
 	albumName := track.Album.Title
 	if req.AlbumName != "" {
 		albumName = req.AlbumName
 	}
 
+	// Use track number from request if available, otherwise from Qobuz API
+	actualTrackNumber := req.TrackNumber
+	if actualTrackNumber == 0 {
+		actualTrackNumber = track.TrackNumber
+	}
+
 	metadata := Metadata{
 		Title:       track.Title,
 		Artist:      track.Performer.Name,
 		Album:       albumName,
 		AlbumArtist: req.AlbumArtist, // Qobuz track struct might not have this handy, keep req or check album struct
 		Date:        track.Album.ReleaseDate,
-		TrackNumber: track.TrackNumber,
+		TrackNumber: actualTrackNumber,
 		TotalTracks: req.TotalTracks,
 		DiscNumber:  req.DiscNumber, // QobuzTrack struct usually doesn't have disc info in simple search result
 		ISRC:        track.ISRC,
+		Genre:       req.Genre,     // From Deezer album metadata
+		Label:       req.Label,     // From Deezer album metadata
+		Copyright:   req.Copyright, // From Deezer album metadata
 	}
 
-	// Use cover data from parallel fetch
 	var coverData []byte
 	if parallelResult != nil && parallelResult.CoverData != nil {
 		coverData = parallelResult.CoverData
@@ -982,13 +1217,28 @@ func downloadFromQobuz(req DownloadRequest) (QobuzDownloadResult, error) {
 		fmt.Printf("Warning: failed to embed metadata: %v\n", err)
 	}
 
-	// Embed lyrics from parallel fetch
 	if req.EmbedLyrics && parallelResult != nil && parallelResult.LyricsLRC != "" {
-		GoLog("[Qobuz] Embedding parallel-fetched lyrics (%d lines)...\n", len(parallelResult.LyricsData.Lines))
-		if embedErr := EmbedLyrics(outputPath, parallelResult.LyricsLRC); embedErr != nil {
-			GoLog("[Qobuz] Warning: failed to embed lyrics: %v\n", embedErr)
-		} else {
-			fmt.Println("[Qobuz] Lyrics embedded successfully")
+		lyricsMode := req.LyricsMode
+		if lyricsMode == "" {
+			lyricsMode = "embed"
+		}
+
+		if lyricsMode == "external" || lyricsMode == "both" {
+			GoLog("[Qobuz] Saving external LRC file...\n")
+			if lrcPath, lrcErr := SaveLRCFile(outputPath, parallelResult.LyricsLRC); lrcErr != nil {
+				GoLog("[Qobuz] Warning: failed to save LRC file: %v\n", lrcErr)
+			} else {
+				GoLog("[Qobuz] LRC file saved: %s\n", lrcPath)
+			}
+		}
+
+		if lyricsMode == "embed" || lyricsMode == "both" {
+			GoLog("[Qobuz] Embedding parallel-fetched lyrics (%d lines)...\n", len(parallelResult.LyricsData.Lines))
+			if embedErr := EmbedLyrics(outputPath, parallelResult.LyricsLRC); embedErr != nil {
+				GoLog("[Qobuz] Warning: failed to embed lyrics: %v\n", embedErr)
+			} else {
+				fmt.Println("[Qobuz] Lyrics embedded successfully")
+			}
 		}
 	} else if req.EmbedLyrics {
 		fmt.Println("[Qobuz] No lyrics available from parallel fetch")
@@ -1005,7 +1255,7 @@ func downloadFromQobuz(req DownloadRequest) (QobuzDownloadResult, error) {
 		Artist:      track.Performer.Name,
 		Album:       track.Album.Title,
 		ReleaseDate: track.Album.ReleaseDate,
-		TrackNumber: track.TrackNumber,
+		TrackNumber: actualTrackNumber,
 		DiscNumber:  req.DiscNumber, // Qobuz track struct limitations
 		ISRC:        track.ISRC,
 	}, nil

go_backend/ratelimit.go

@@ -5,7 +5,6 @@ import (
 	"time"
 )
 
-// RateLimiter implements a sliding window rate limiter
 type RateLimiter struct {
 	mu          sync.Mutex
 	maxRequests int
@@ -13,7 +12,6 @@ type RateLimiter struct {
 	timestamps  []time.Time
 }
 
-// NewRateLimiter creates a new rate limiter with specified max requests per window
 func NewRateLimiter(maxRequests int, window time.Duration) *RateLimiter {
 	return &RateLimiter{
 		maxRequests: maxRequests,
@@ -22,39 +20,31 @@ func NewRateLimiter(maxRequests int, window time.Duration) *RateLimiter {
 	}
 }
 
-// WaitForSlot blocks until a request is allowed under the rate limit
-// Returns immediately if under the limit, otherwise waits until a slot is available
 func (r *RateLimiter) WaitForSlot() {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 
 	now := time.Now()
 
-	// Remove timestamps outside the window
 	r.cleanOldTimestamps(now)
 
-	// If under limit, record and return immediately
 	if len(r.timestamps) < r.maxRequests {
 		r.timestamps = append(r.timestamps, now)
 		return
 	}
 
-	// Calculate wait time until oldest timestamp expires
 	oldestTimestamp := r.timestamps[0]
 	waitUntil := oldestTimestamp.Add(r.window)
 	waitDuration := waitUntil.Sub(now)
 
 	if waitDuration > 0 {
-		// Release lock while waiting
 		r.mu.Unlock()
 		time.Sleep(waitDuration)
 		r.mu.Lock()
 
-		// Clean again after waiting
 		r.cleanOldTimestamps(time.Now())
 	}
 
-	// Record this request
 	r.timestamps = append(r.timestamps, time.Now())
 }
 
@@ -76,8 +66,6 @@ func (r *RateLimiter) cleanOldTimestamps(now time.Time) {
 	}
 }
 
-// TryAcquire attempts to acquire a slot without blocking
-// Returns true if successful, false if rate limit would be exceeded
 func (r *RateLimiter) TryAcquire() bool {
 	r.mu.Lock()
 	defer r.mu.Unlock()
@@ -93,7 +81,6 @@ func (r *RateLimiter) TryAcquire() bool {
 	return false
 }
 
-// Available returns the number of requests available in the current window
 func (r *RateLimiter) Available() int {
 	r.mu.Lock()
 	defer r.mu.Unlock()
@@ -105,7 +92,6 @@ func (r *RateLimiter) Available() int {
 // Global SongLink rate limiter - 9 requests per minute (to be safe, limit is 10)
 var songLinkRateLimiter = NewRateLimiter(9, time.Minute)
 
-// GetSongLinkRateLimiter returns the global SongLink rate limiter
 func GetSongLinkRateLimiter() *RateLimiter {
 	return songLinkRateLimiter
 }

go_backend/romaji.go

@@ -5,7 +5,6 @@ import (
 	"unicode"
 )
 
-// Hiragana to Romaji mapping
 var hiraganaToRomaji = map[rune]string{
 	'あ': "a", 'い': "i", 'う': "u", 'え': "e", 'お': "o",
 	'か': "ka", 'き': "ki", 'く': "ku", 'け': "ke", 'こ': "ko",
@@ -30,7 +29,6 @@ var hiraganaToRomaji = map[rune]string{
 	'ぁ': "a", 'ぃ': "i", 'ぅ': "u", 'ぇ': "e", 'ぉ': "o",
 }
 
-// Katakana to Romaji mapping
 var katakanaToRomaji = map[rune]string{
 	'ア': "a", 'イ': "i", 'ウ': "u", 'エ': "e", 'オ': "o",
 	'カ': "ka", 'キ': "ki", 'ク': "ku", 'ケ': "ke", 'コ': "ko",
@@ -58,7 +56,6 @@ var katakanaToRomaji = map[rune]string{
 	'ヴ': "vu",
 }
 
-// Combination mappings for きゃ, しゃ, etc.
 var combinationHiragana = map[string]string{
 	"きゃ": "kya", "きゅ": "kyu", "きょ": "kyo",
 	"しゃ": "sha", "しゅ": "shu", "しょ": "sho",
@@ -91,7 +88,6 @@ var combinationKatakana = map[string]string{
 	"ウィ": "wi", "ウェ": "we", "ウォ": "wo",
 }
 
-// ContainsJapanese checks if a string contains Japanese characters
 func ContainsJapanese(s string) bool {
 	for _, r := range s {
 		if isHiragana(r) || isKatakana(r) || isKanji(r) {
@@ -114,8 +110,6 @@ func isKanji(r rune) bool {
 		(r >= 0x3400 && r <= 0x4DBF) // CJK Unified Ideographs Extension A
 }
 
-// JapaneseToRomaji converts Japanese text (hiragana/katakana) to romaji
-// Note: Kanji cannot be converted without a dictionary, so they are kept as-is
 func JapaneseToRomaji(text string) string {
 	if !ContainsJapanese(text) {
 		return text
@@ -175,8 +169,6 @@ func JapaneseToRomaji(text string) string {
 	return result.String()
 }
 
-// BuildSearchQuery creates a search query from track name and artist
-// Converts Japanese to romaji if present
 func BuildSearchQuery(trackName, artistName string) string {
 	// Convert Japanese to romaji
 	trackRomaji := JapaneseToRomaji(trackName)
@@ -189,7 +181,6 @@ func BuildSearchQuery(trackName, artistName string) string {
 	return strings.TrimSpace(artistClean + " " + trackClean)
 }
 
-// cleanSearchQuery removes special characters that might interfere with search
 func cleanSearchQuery(s string) string {
 	var result strings.Builder
 	for _, r := range s {
@@ -202,8 +193,6 @@ func cleanSearchQuery(s string) string {
 	return strings.TrimSpace(result.String())
 }
 
-// CleanToASCII removes all non-ASCII characters and keeps only letters, numbers, spaces
-// This is useful for creating search queries that work better with Tidal's search
 func CleanToASCII(s string) string {
 	var result strings.Builder
 	for _, r := range s {

go_backend/songlink.go

@@ -11,12 +11,10 @@ import (
 	"time"
 )
 
-// SongLinkClient handles song.link API interactions
 type SongLinkClient struct {
 	client *http.Client
 }
 
-// TrackAvailability represents track availability on different platforms
 type TrackAvailability struct {
 	SpotifyID string `json:"spotify_id"`
 	Tidal     bool   `json:"tidal"`
@@ -31,32 +29,49 @@ type TrackAvailability struct {
 }
 
 var (
-	// Global SongLink client instance for connection reuse
 	globalSongLinkClient *SongLinkClient
 	songLinkClientOnce   sync.Once
 )
 
-// NewSongLinkClient creates a new SongLink client (returns singleton for connection reuse)
 func NewSongLinkClient() *SongLinkClient {
 	songLinkClientOnce.Do(func() {
 		globalSongLinkClient = &SongLinkClient{
-			client: NewHTTPClientWithTimeout(SongLinkTimeout), // 30s timeout
+			client: NewHTTPClientWithTimeout(SongLinkTimeout),
 		}
 	})
 	return globalSongLinkClient
 }
 
-// CheckTrackAvailability checks track availability on streaming platforms
 func (s *SongLinkClient) CheckTrackAvailability(spotifyTrackID string, isrc string) (*TrackAvailability, error) {
-	// Validate Spotify ID format (should be 22 characters alphanumeric)
 	if spotifyTrackID == "" {
 		return nil, fmt.Errorf("spotify track ID is empty")
 	}
-	
-	// Use global rate limiter - blocks until request is allowed
+
+	// Try SongLink first
+	availability, err := s.checkTrackAvailabilitySongLink(spotifyTrackID)
+	if err != nil {
+		// Fallback to IDHS if SongLink fails
+		LogWarn("SongLink", "SongLink failed, trying IDHS fallback: %v", err)
+		idhsClient := NewIDHSClient()
+		availability, err = idhsClient.GetAvailabilityFromSpotify(spotifyTrackID)
+		if err != nil {
+			return nil, fmt.Errorf("both SongLink and IDHS failed: %w", err)
+		}
+		LogInfo("SongLink", "IDHS fallback successful for %s", spotifyTrackID)
+	}
+
+	// Check Qobuz availability separately via ISRC
+	if isrc != "" {
+		availability.Qobuz = checkQobuzAvailability(isrc)
+	}
+
+	return availability, nil
+}
+
+// checkTrackAvailabilitySongLink is the original SongLink implementation
+func (s *SongLinkClient) checkTrackAvailabilitySongLink(spotifyTrackID string) (*TrackAvailability, error) {
 	songLinkRateLimiter.WaitForSlot()
 
-	// Build API URL
 	spotifyBase, _ := base64.StdEncoding.DecodeString("aHR0cHM6Ly9vcGVuLnNwb3RpZnkuY29tL3RyYWNrLw==")
 	spotifyURL := fmt.Sprintf("%s%s", string(spotifyBase), spotifyTrackID)
 
@@ -68,7 +83,6 @@ func (s *SongLinkClient) CheckTrackAvailability(spotifyTrackID string, isrc stri
 		return nil, fmt.Errorf("failed to create request: %w", err)
 	}
 
-	// Use retry logic with User-Agent
 	retryConfig := DefaultRetryConfig()
 	resp, err := DoRequestWithRetry(s.client, req, retryConfig)
 	if err != nil {
@@ -76,7 +90,6 @@ func (s *SongLinkClient) CheckTrackAvailability(spotifyTrackID string, isrc stri
 	}
 	defer resp.Body.Close()
 
-	// Handle specific error codes
 	if resp.StatusCode == 400 {
 		return nil, fmt.Errorf("track not found on SongLink (invalid Spotify ID or track unavailable)")
 	}
@@ -109,35 +122,25 @@ func (s *SongLinkClient) CheckTrackAvailability(spotifyTrackID string, isrc stri
 		SpotifyID: spotifyTrackID,
 	}
 
-	// Check Tidal
 	if tidalLink, ok := songLinkResp.LinksByPlatform["tidal"]; ok && tidalLink.URL != "" {
 		availability.Tidal = true
 		availability.TidalURL = tidalLink.URL
 	}
 
-	// Check Amazon
 	if amazonLink, ok := songLinkResp.LinksByPlatform["amazonMusic"]; ok && amazonLink.URL != "" {
 		availability.Amazon = true
 		availability.AmazonURL = amazonLink.URL
 	}
 
-	// Check Deezer
 	if deezerLink, ok := songLinkResp.LinksByPlatform["deezer"]; ok && deezerLink.URL != "" {
 		availability.Deezer = true
 		availability.DeezerURL = deezerLink.URL
-		// Extract Deezer ID from URL (e.g., https://www.deezer.com/track/123456)
 		availability.DeezerID = extractDeezerIDFromURL(deezerLink.URL)
 	}
 
-	// Check Qobuz using ISRC (SongLink doesn't support Qobuz directly)
-	if isrc != "" {
-		availability.Qobuz = checkQobuzAvailability(isrc)
-	}
-
 	return availability, nil
 }
 
-// GetStreamingURLs gets streaming URLs for a Spotify track
 func (s *SongLinkClient) GetStreamingURLs(spotifyTrackID string) (map[string]string, error) {
 	availability, err := s.CheckTrackAvailability(spotifyTrackID, "")
 	if err != nil {
@@ -191,12 +194,9 @@ func checkQobuzAvailability(isrc string) bool {
 
 // extractDeezerIDFromURL extracts Deezer track/album/artist ID from URL
 func extractDeezerIDFromURL(deezerURL string) string {
-	// URL format: https://www.deezer.com/track/123456 or https://www.deezer.com/en/track/123456
 	parts := strings.Split(deezerURL, "/")
 	if len(parts) > 0 {
-		// Get the last part which should be the ID
 		lastPart := parts[len(parts)-1]
-		// Remove any query parameters
 		if idx := strings.Index(lastPart, "?"); idx > 0 {
 			lastPart = lastPart[:idx]
 		}
@@ -205,17 +205,16 @@ func extractDeezerIDFromURL(deezerURL string) string {
 	return ""
 }
 
-// GetDeezerIDFromSpotify converts a Spotify track ID to Deezer track ID using SongLink
 func (s *SongLinkClient) GetDeezerIDFromSpotify(spotifyTrackID string) (string, error) {
 	availability, err := s.CheckTrackAvailability(spotifyTrackID, "")
 	if err != nil {
 		return "", err
 	}
-	
+
 	if !availability.Deezer || availability.DeezerID == "" {
 		return "", fmt.Errorf("track not found on Deezer")
 	}
-	
+
 	return availability.DeezerID, nil
 }
 
@@ -227,7 +226,6 @@ type AlbumAvailability struct {
 	DeezerID  string `json:"deezer_id,omitempty"`
 }
 
-// CheckAlbumAvailability checks album availability on streaming platforms using SongLink
 func (s *SongLinkClient) CheckAlbumAvailability(spotifyAlbumID string) (*AlbumAvailability, error) {
 	// Use global rate limiter
 	songLinkRateLimiter.WaitForSlot()
@@ -274,7 +272,6 @@ func (s *SongLinkClient) CheckAlbumAvailability(spotifyAlbumID string) (*AlbumAv
 		SpotifyID: spotifyAlbumID,
 	}
 
-	// Check Deezer
 	if deezerLink, ok := songLinkResp.LinksByPlatform["deezer"]; ok && deezerLink.URL != "" {
 		availability.Deezer = true
 		availability.DeezerURL = deezerLink.URL
@@ -290,32 +287,42 @@ func (s *SongLinkClient) GetDeezerAlbumIDFromSpotify(spotifyAlbumID string) (str
 	if err != nil {
 		return "", err
 	}
-	
+
 	if !availability.Deezer || availability.DeezerID == "" {
 		return "", fmt.Errorf("album not found on Deezer")
 	}
-	
+
 	return availability.DeezerID, nil
 }
 
-// ========================================
-// Deezer ID Support - Query SongLink using Deezer as source
-// ========================================
-
-// CheckAvailabilityFromDeezer checks track availability using Deezer track ID as source
 // This is useful when we have Deezer metadata and want to find the track on other platforms
 func (s *SongLinkClient) CheckAvailabilityFromDeezer(deezerTrackID string) (*TrackAvailability, error) {
 	if deezerTrackID == "" {
 		return nil, fmt.Errorf("deezer track ID is empty")
 	}
-	
-	// Use global rate limiter
+
+	// Try SongLink first
+	availability, err := s.checkAvailabilityFromDeezerSongLink(deezerTrackID)
+	if err != nil {
+		// Fallback to IDHS if SongLink fails
+		LogWarn("SongLink", "SongLink failed for Deezer, trying IDHS fallback: %v", err)
+		idhsClient := NewIDHSClient()
+		availability, err = idhsClient.GetAvailabilityFromDeezer(deezerTrackID)
+		if err != nil {
+			return nil, fmt.Errorf("both SongLink and IDHS failed: %w", err)
+		}
+		LogInfo("SongLink", "IDHS fallback successful for Deezer %s", deezerTrackID)
+	}
+
+	return availability, nil
+}
+
+// checkAvailabilityFromDeezerSongLink is the original SongLink implementation for Deezer
+func (s *SongLinkClient) checkAvailabilityFromDeezerSongLink(deezerTrackID string) (*TrackAvailability, error) {
 	songLinkRateLimiter.WaitForSlot()
 
-	// Build Deezer URL
 	deezerURL := fmt.Sprintf("https://www.deezer.com/track/%s", deezerTrackID)
 
-	// Build API URL using Deezer URL as source
 	apiBase, _ := base64.StdEncoding.DecodeString("aHR0cHM6Ly9hcGkuc29uZy5saW5rL3YxLWFscGhhLjEvbGlua3M/dXJsPQ==")
 	apiURL := fmt.Sprintf("%s%s&userCountry=US", string(apiBase), url.QueryEscape(deezerURL))
 
@@ -371,25 +378,20 @@ func (s *SongLinkClient) CheckAvailabilityFromDeezer(deezerTrackID string) (*Tra
 		DeezerID: deezerTrackID,
 	}
 
-	// Check Spotify
 	if spotifyLink, ok := songLinkResp.LinksByPlatform["spotify"]; ok && spotifyLink.URL != "" {
-		// Extract Spotify ID from URL
 		availability.SpotifyID = extractSpotifyIDFromURL(spotifyLink.URL)
 	}
 
-	// Check Tidal
 	if tidalLink, ok := songLinkResp.LinksByPlatform["tidal"]; ok && tidalLink.URL != "" {
 		availability.Tidal = true
 		availability.TidalURL = tidalLink.URL
 	}
 
-	// Check Amazon
 	if amazonLink, ok := songLinkResp.LinksByPlatform["amazonMusic"]; ok && amazonLink.URL != "" {
 		availability.Amazon = true
 		availability.AmazonURL = amazonLink.URL
 	}
 
-	// Check Deezer URL
 	if deezerLink, ok := songLinkResp.LinksByPlatform["deezer"]; ok && deezerLink.URL != "" {
 		availability.DeezerURL = deezerLink.URL
 	}
@@ -397,7 +399,6 @@ func (s *SongLinkClient) CheckAvailabilityFromDeezer(deezerTrackID string) (*Tra
 	return availability, nil
 }
 
-// CheckAvailabilityByPlatform checks track availability using any supported platform
 // platform: "spotify", "deezer", "tidal", "amazonMusic", "appleMusic", "youtube", etc.
 // entityType: "song" or "album"
 // entityID: the ID on that platform
@@ -405,7 +406,7 @@ func (s *SongLinkClient) CheckAvailabilityByPlatform(platform, entityType, entit
 	if entityID == "" {
 		return nil, fmt.Errorf("%s ID is empty", platform)
 	}
-	
+
 	// Use global rate limiter
 	songLinkRateLimiter.WaitForSlot()
 
@@ -459,24 +460,20 @@ func (s *SongLinkClient) CheckAvailabilityByPlatform(platform, entityType, entit
 
 	availability := &TrackAvailability{}
 
-	// Check Spotify
 	if spotifyLink, ok := songLinkResp.LinksByPlatform["spotify"]; ok && spotifyLink.URL != "" {
 		availability.SpotifyID = extractSpotifyIDFromURL(spotifyLink.URL)
 	}
 
-	// Check Tidal
 	if tidalLink, ok := songLinkResp.LinksByPlatform["tidal"]; ok && tidalLink.URL != "" {
 		availability.Tidal = true
 		availability.TidalURL = tidalLink.URL
 	}
 
-	// Check Amazon
 	if amazonLink, ok := songLinkResp.LinksByPlatform["amazonMusic"]; ok && amazonLink.URL != "" {
 		availability.Amazon = true
 		availability.AmazonURL = amazonLink.URL
 	}
 
-	// Check Deezer
 	if deezerLink, ok := songLinkResp.LinksByPlatform["deezer"]; ok && deezerLink.URL != "" {
 		availability.Deezer = true
 		availability.DeezerURL = deezerLink.URL
@@ -488,10 +485,8 @@ func (s *SongLinkClient) CheckAvailabilityByPlatform(platform, entityType, entit
 
 // extractSpotifyIDFromURL extracts Spotify track ID from URL
 func extractSpotifyIDFromURL(spotifyURL string) string {
-	// URL format: https://open.spotify.com/track/0Jcij1eWd5bDMU5iPbxe2i
 	parts := strings.Split(spotifyURL, "/track/")
 	if len(parts) > 1 {
-		// Get the ID part and remove any query parameters
 		idPart := parts[1]
 		if idx := strings.Index(idPart, "?"); idx > 0 {
 			idPart = idPart[:idx]
@@ -501,17 +496,16 @@ func extractSpotifyIDFromURL(spotifyURL string) string {
 	return ""
 }
 
-// GetSpotifyIDFromDeezer converts a Deezer track ID to Spotify track ID using SongLink
 func (s *SongLinkClient) GetSpotifyIDFromDeezer(deezerTrackID string) (string, error) {
 	availability, err := s.CheckAvailabilityFromDeezer(deezerTrackID)
 	if err != nil {
 		return "", err
 	}
-	
+
 	if availability.SpotifyID == "" {
 		return "", fmt.Errorf("track not found on Spotify")
 	}
-	
+
 	return availability.SpotifyID, nil
 }
 
@@ -521,24 +515,23 @@ func (s *SongLinkClient) GetTidalURLFromDeezer(deezerTrackID string) (string, er
 	if err != nil {
 		return "", err
 	}
-	
+
 	if !availability.Tidal || availability.TidalURL == "" {
 		return "", fmt.Errorf("track not found on Tidal")
 	}
-	
+
 	return availability.TidalURL, nil
 }
 
-// GetAmazonURLFromDeezer converts a Deezer track ID to Amazon Music URL using SongLink
 func (s *SongLinkClient) GetAmazonURLFromDeezer(deezerTrackID string) (string, error) {
 	availability, err := s.CheckAvailabilityFromDeezer(deezerTrackID)
 	if err != nil {
 		return "", err
 	}
-	
+
 	if !availability.Amazon || availability.AmazonURL == "" {
 		return "", fmt.Errorf("track not found on Amazon Music")
 	}
-	
+
 	return availability.AmazonURL, nil
 }

go_backend/spotify.go

@@ -2,7 +2,6 @@ package gobackend
 
 import (
 	"context"
-	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -17,15 +16,14 @@ import (
 )
 
 const (
-	spotifyTokenURL     = "https://accounts.spotify.com/api/token"
-	playlistBaseURL     = "https://api.spotify.com/v1/playlists/%s"
-	albumBaseURL        = "https://api.spotify.com/v1/albums/%s"
-	trackBaseURL        = "https://api.spotify.com/v1/tracks/%s"
-	artistBaseURL       = "https://api.spotify.com/v1/artists/%s"
-	artistAlbumsURL     = "https://api.spotify.com/v1/artists/%s/albums"
-	searchBaseURL       = "https://api.spotify.com/v1/search"
-	
-	// Cache TTL settings
+	spotifyTokenURL = "https://accounts.spotify.com/api/token"
+	playlistBaseURL = "https://api.spotify.com/v1/playlists/%s"
+	albumBaseURL    = "https://api.spotify.com/v1/albums/%s"
+	trackBaseURL    = "https://api.spotify.com/v1/tracks/%s"
+	artistBaseURL   = "https://api.spotify.com/v1/artists/%s"
+	artistAlbumsURL = "https://api.spotify.com/v1/artists/%s/albums"
+	searchBaseURL   = "https://api.spotify.com/v1/search"
+
 	artistCacheTTL = 10 * time.Minute
 	searchCacheTTL = 5 * time.Minute
 	albumCacheTTL  = 10 * time.Minute
@@ -33,7 +31,6 @@ const (
 
 var errInvalidSpotifyURL = errors.New("invalid or unsupported Spotify URL")
 
-// cacheEntry holds cached data with expiration
 type cacheEntry struct {
 	data      interface{}
 	expiresAt time.Time
@@ -43,34 +40,33 @@ func (e *cacheEntry) isExpired() bool {
 	return time.Now().After(e.expiresAt)
 }
 
-// SpotifyMetadataClient handles Spotify API interactions
 type SpotifyMetadataClient struct {
 	httpClient     *http.Client
 	clientID       string
 	clientSecret   string
 	cachedToken    string
 	tokenExpiresAt time.Time
-	tokenMu        sync.Mutex // Protects token cache for concurrent access
+	tokenMu        sync.Mutex
 	rng            *rand.Rand
 	rngMu          sync.Mutex
 	userAgent      string
-	
-	// Caches to reduce API calls
-	artistCache map[string]*cacheEntry // key: artistID
-	searchCache map[string]*cacheEntry // key: query+type
-	albumCache  map[string]*cacheEntry // key: albumID
+
+	artistCache map[string]*cacheEntry
+	searchCache map[string]*cacheEntry
+	albumCache  map[string]*cacheEntry
 	cacheMu     sync.RWMutex
 }
 
-// Custom credentials storage (set from Flutter)
 var (
 	customClientID     string
 	customClientSecret string
 	credentialsMu      sync.RWMutex
 )
 
+// ErrNoSpotifyCredentials is returned when Spotify credentials are not configured
+var ErrNoSpotifyCredentials = errors.New("Spotify credentials not configured. Please set your own Client ID and Secret in Settings, or use Deezer as metadata source (free, no credentials required)")
+
 // SetSpotifyCredentials sets custom Spotify API credentials
-// Pass empty strings to use default credentials
 func SetSpotifyCredentials(clientID, clientSecret string) {
 	credentialsMu.Lock()
 	defer credentialsMu.Unlock()
@@ -78,42 +74,50 @@ func SetSpotifyCredentials(clientID, clientSecret string) {
 	customClientSecret = clientSecret
 }
 
-// getCredentials returns the current credentials (custom or default)
-func getCredentials() (string, string) {
+func HasSpotifyCredentials() bool {
 	credentialsMu.RLock()
 	defer credentialsMu.RUnlock()
-	
+
 	if customClientID != "" && customClientSecret != "" {
-		return customClientID, customClientSecret
-	}
-	
-	// Fall back to default credentials
-	clientID := os.Getenv("SPOTIFY_CLIENT_ID")
-	if clientID == "" {
-		if decoded, err := base64.StdEncoding.DecodeString("NWY1NzNjOTYyMDQ5NGJhZTg3ODkwYzBmMDhhNjAyOTM="); err == nil {
-			clientID = string(decoded)
-		}
+		return true
 	}
 
-	clientSecret := os.Getenv("SPOTIFY_CLIENT_SECRET")
-	if clientSecret == "" {
-		if decoded, err := base64.StdEncoding.DecodeString("MjEyNDc2ZDliMGYzNDcyZWFhNzYyZDkwYjE5YjBiYTg="); err == nil {
-			clientSecret = string(decoded)
-		}
+	if os.Getenv("SPOTIFY_CLIENT_ID") != "" && os.Getenv("SPOTIFY_CLIENT_SECRET") != "" {
+		return true
 	}
-	
-	return clientID, clientSecret
+
+	return false
 }
 
-// NewSpotifyMetadataClient creates a new Spotify client
-func NewSpotifyMetadataClient() *SpotifyMetadataClient {
+// getCredentials returns the current credentials or error if not configured
+func getCredentials() (string, string, error) {
+	credentialsMu.RLock()
+	defer credentialsMu.RUnlock()
+
+	if customClientID != "" && customClientSecret != "" {
+		return customClientID, customClientSecret, nil
+	}
+
+	clientID := os.Getenv("SPOTIFY_CLIENT_ID")
+	clientSecret := os.Getenv("SPOTIFY_CLIENT_SECRET")
+
+	if clientID != "" && clientSecret != "" {
+		return clientID, clientSecret, nil
+	}
+
+	return "", "", ErrNoSpotifyCredentials
+}
+
+func NewSpotifyMetadataClient() (*SpotifyMetadataClient, error) {
+	clientID, clientSecret, err := getCredentials()
+	if err != nil {
+		return nil, err
+	}
+
 	src := rand.NewSource(time.Now().UnixNano())
 
-	// Get credentials (custom or default)
-	clientID, clientSecret := getCredentials()
-
 	c := &SpotifyMetadataClient{
-		httpClient:   NewHTTPClientWithTimeout(15 * time.Second), // Use shared transport for connection pooling
+		httpClient:   NewHTTPClientWithTimeout(15 * time.Second),
 		clientID:     clientID,
 		clientSecret: clientSecret,
 		rng:          rand.New(src),
@@ -122,10 +126,9 @@ func NewSpotifyMetadataClient() *SpotifyMetadataClient {
 		albumCache:   make(map[string]*cacheEntry),
 	}
 	c.userAgent = c.randomUserAgent()
-	return c
+	return c, nil
 }
 
-// TrackMetadata represents track information
 type TrackMetadata struct {
 	SpotifyID   string `json:"spotify_id,omitempty"`
 	Artists     string `json:"artists"`
@@ -140,9 +143,9 @@ type TrackMetadata struct {
 	DiscNumber  int    `json:"disc_number,omitempty"`
 	ExternalURL string `json:"external_urls"`
 	ISRC        string `json:"isrc"`
+	AlbumType   string `json:"album_type,omitempty"` // album, single, ep, compilation
 }
 
-// AlbumTrackMetadata holds per-track info for album/playlist
 type AlbumTrackMetadata struct {
 	SpotifyID   string `json:"spotify_id,omitempty"`
 	Artists     string `json:"artists"`
@@ -159,24 +162,26 @@ type AlbumTrackMetadata struct {
 	ISRC        string `json:"isrc"`
 	AlbumID     string `json:"album_id,omitempty"`
 	AlbumURL    string `json:"album_url,omitempty"`
+	AlbumType   string `json:"album_type,omitempty"`
 }
 
-// AlbumInfoMetadata holds album information
 type AlbumInfoMetadata struct {
 	TotalTracks int    `json:"total_tracks"`
 	Name        string `json:"name"`
 	ReleaseDate string `json:"release_date"`
 	Artists     string `json:"artists"`
+	ArtistId    string `json:"artist_id,omitempty"`
 	Images      string `json:"images"`
+	Genre       string `json:"genre,omitempty"`
+	Label       string `json:"label,omitempty"`
+	Copyright   string `json:"copyright,omitempty"`
 }
 
-// AlbumResponsePayload is the response for album requests
 type AlbumResponsePayload struct {
 	AlbumInfo AlbumInfoMetadata    `json:"album_info"`
 	TrackList []AlbumTrackMetadata `json:"track_list"`
 }
 
-// PlaylistInfoMetadata holds playlist information
 type PlaylistInfoMetadata struct {
 	Tracks struct {
 		Total int `json:"total"`
@@ -188,13 +193,11 @@ type PlaylistInfoMetadata struct {
 	} `json:"owner"`
 }
 
-// PlaylistResponsePayload is the response for playlist requests
 type PlaylistResponsePayload struct {
 	PlaylistInfo PlaylistInfoMetadata `json:"playlist_info"`
 	TrackList    []AlbumTrackMetadata `json:"track_list"`
 }
 
-// ArtistInfoMetadata holds artist information
 type ArtistInfoMetadata struct {
 	ID         string `json:"id"`
 	Name       string `json:"name"`
@@ -203,7 +206,6 @@ type ArtistInfoMetadata struct {
 	Popularity int    `json:"popularity"`
 }
 
-// ArtistAlbumMetadata holds album info for artist discography
 type ArtistAlbumMetadata struct {
 	ID          string `json:"id"`
 	Name        string `json:"name"`
@@ -214,24 +216,20 @@ type ArtistAlbumMetadata struct {
 	Artists     string `json:"artists"`
 }
 
-// ArtistResponsePayload is the response for artist requests
 type ArtistResponsePayload struct {
 	ArtistInfo ArtistInfoMetadata    `json:"artist_info"`
 	Albums     []ArtistAlbumMetadata `json:"albums"`
 }
 
-// TrackResponse is the response for single track requests
 type TrackResponse struct {
 	Track TrackMetadata `json:"track"`
 }
 
-// SearchResult represents search results
 type SearchResult struct {
 	Tracks []TrackMetadata `json:"tracks"`
 	Total  int             `json:"total"`
 }
 
-// SearchArtistResult represents an artist in search results
 type SearchArtistResult struct {
 	ID         string `json:"id"`
 	Name       string `json:"name"`
@@ -240,10 +238,29 @@ type SearchArtistResult struct {
 	Popularity int    `json:"popularity"`
 }
 
-// SearchAllResult represents combined search results for tracks and artists
+type SearchAlbumResult struct {
+	ID          string `json:"id"`
+	Name        string `json:"name"`
+	Artists     string `json:"artists"`
+	Images      string `json:"images"`
+	ReleaseDate string `json:"release_date"`
+	TotalTracks int    `json:"total_tracks"`
+	AlbumType   string `json:"album_type"`
+}
+
+type SearchPlaylistResult struct {
+	ID          string `json:"id"`
+	Name        string `json:"name"`
+	Owner       string `json:"owner"`
+	Images      string `json:"images"`
+	TotalTracks int    `json:"total_tracks"`
+}
+
 type SearchAllResult struct {
-	Tracks  []TrackMetadata      `json:"tracks"`
-	Artists []SearchArtistResult `json:"artists"`
+	Tracks    []TrackMetadata        `json:"tracks"`
+	Artists   []SearchArtistResult   `json:"artists"`
+	Albums    []SearchAlbumResult    `json:"albums"`
+	Playlists []SearchPlaylistResult `json:"playlists"`
 }
 
 type spotifyURI struct {
@@ -257,7 +274,6 @@ type accessTokenResponse struct {
 	TokenType   string      `json:"token_type"`
 }
 
-// Internal API response types
 type image struct {
 	URL string `json:"url"`
 }
@@ -283,6 +299,7 @@ type albumSimplified struct {
 	Images      []image     `json:"images"`
 	ExternalURL externalURL `json:"external_urls"`
 	Artists     []artist    `json:"artists"`
+	AlbumType   string      `json:"album_type"`
 }
 
 type trackFull struct {
@@ -297,7 +314,6 @@ type trackFull struct {
 	Artists     []artist        `json:"artists"`
 }
 
-// GetFilteredData fetches and formats Spotify data
 func (c *SpotifyMetadataClient) GetFilteredData(ctx context.Context, spotifyURL string, batch bool, delay time.Duration) (interface{}, error) {
 	parsed, err := parseSpotifyURI(spotifyURL)
 	if err != nil {
@@ -323,7 +339,6 @@ func (c *SpotifyMetadataClient) GetFilteredData(ctx context.Context, spotifyURL
 	}
 }
 
-// SearchTracks searches for tracks on Spotify
 func (c *SpotifyMetadataClient) SearchTracks(ctx context.Context, query string, limit int) (*SearchResult, error) {
 	token, err := c.getAccessToken(ctx)
 	if err != nil {
@@ -331,14 +346,14 @@ func (c *SpotifyMetadataClient) SearchTracks(ctx context.Context, query string,
 	}
 
 	searchURL := fmt.Sprintf("%s?q=%s&type=track&limit=%d", searchBaseURL, url.QueryEscape(query), limit)
-	
+
 	var response struct {
 		Tracks struct {
 			Items []trackFull `json:"items"`
 			Total int         `json:"total"`
 		} `json:"tracks"`
 	}
-	
+
 	if err := c.getJSON(ctx, searchURL, token, &response); err != nil {
 		return nil, err
 	}
@@ -363,18 +378,16 @@ func (c *SpotifyMetadataClient) SearchTracks(ctx context.Context, query string,
 			DiscNumber:  track.DiscNumber,
 			ExternalURL: track.ExternalURL.Spotify,
 			ISRC:        track.ExternalID.ISRC,
+			AlbumType:   track.Album.AlbumType,
 		})
 	}
 
 	return result, nil
 }
 
-// SearchAll searches for tracks and artists on Spotify
 func (c *SpotifyMetadataClient) SearchAll(ctx context.Context, query string, trackLimit, artistLimit int) (*SearchAllResult, error) {
-	// Create cache key
 	cacheKey := fmt.Sprintf("all:%s:%d:%d", query, trackLimit, artistLimit)
-	
-	// Check cache first
+
 	c.cacheMu.RLock()
 	if entry, ok := c.searchCache[cacheKey]; ok && !entry.isExpired() {
 		c.cacheMu.RUnlock()
@@ -388,24 +401,24 @@ func (c *SpotifyMetadataClient) SearchAll(ctx context.Context, query string, tra
 	}
 
 	searchURL := fmt.Sprintf("%s?q=%s&type=track,artist&limit=%d", searchBaseURL, url.QueryEscape(query), trackLimit)
-	
+
 	var response struct {
 		Tracks struct {
 			Items []trackFull `json:"items"`
 		} `json:"tracks"`
 		Artists struct {
 			Items []struct {
-				ID         string  `json:"id"`
-				Name       string  `json:"name"`
-				Images     []image `json:"images"`
-				Followers  struct {
+				ID        string  `json:"id"`
+				Name      string  `json:"name"`
+				Images    []image `json:"images"`
+				Followers struct {
 					Total int `json:"total"`
 				} `json:"followers"`
 				Popularity int `json:"popularity"`
 			} `json:"items"`
 		} `json:"artists"`
 	}
-	
+
 	if err := c.getJSON(ctx, searchURL, token, &response); err != nil {
 		return nil, err
 	}
@@ -430,15 +443,15 @@ func (c *SpotifyMetadataClient) SearchAll(ctx context.Context, query string, tra
 			DiscNumber:  track.DiscNumber,
 			ExternalURL: track.ExternalURL.Spotify,
 			ISRC:        track.ExternalID.ISRC,
+			AlbumType:   track.Album.AlbumType,
 		})
 	}
 
-	// Limit artists to artistLimit
 	artistCount := len(response.Artists.Items)
 	if artistCount > artistLimit {
 		artistCount = artistLimit
 	}
-	
+
 	for i := 0; i < artistCount; i++ {
 		artist := response.Artists.Items[i]
 		result.Artists = append(result.Artists, SearchArtistResult{
@@ -450,7 +463,6 @@ func (c *SpotifyMetadataClient) SearchAll(ctx context.Context, query string, tra
 		})
 	}
 
-	// Store in cache
 	c.cacheMu.Lock()
 	c.searchCache[cacheKey] = &cacheEntry{
 		data:      result,
@@ -487,7 +499,6 @@ func (c *SpotifyMetadataClient) fetchTrack(ctx context.Context, trackID, token s
 }
 
 func (c *SpotifyMetadataClient) fetchAlbum(ctx context.Context, albumID, token string) (*AlbumResponsePayload, error) {
-	// Check cache first
 	c.cacheMu.RLock()
 	if entry, ok := c.albumCache[albumID]; ok && !entry.isExpired() {
 		c.cacheMu.RUnlock()
@@ -495,7 +506,6 @@ func (c *SpotifyMetadataClient) fetchAlbum(ctx context.Context, albumID, token s
 	}
 	c.cacheMu.RUnlock()
 
-	// Track item structure for pagination
 	type trackItem struct {
 		ID          string      `json:"id"`
 		Name        string      `json:"name"`
@@ -523,19 +533,25 @@ func (c *SpotifyMetadataClient) fetchAlbum(ctx context.Context, albumID, token s
 	}
 
 	albumImage := firstImageURL(data.Images)
+
+	// Get first artist ID
+	var firstArtistId string
+	if len(data.Artists) > 0 {
+		firstArtistId = data.Artists[0].ID
+	}
+
 	info := AlbumInfoMetadata{
 		TotalTracks: data.TotalTracks,
 		Name:        data.Name,
 		ReleaseDate: data.ReleaseDate,
 		Artists:     joinArtists(data.Artists),
+		ArtistId:    firstArtistId,
 		Images:      albumImage,
 	}
 
-	// Collect all tracks (including paginated)
 	allTrackItems := data.Tracks.Items
 	nextURL := data.Tracks.Next
-	
-	// Fetch remaining tracks using pagination (no limit)
+
 	for nextURL != "" {
 		var pageData struct {
 			Items []trackItem `json:"items"`
@@ -557,13 +573,12 @@ func (c *SpotifyMetadataClient) fetchAlbum(ctx context.Context, albumID, token s
 		trackIDs[i] = item.ID
 	}
 
-	// Fetch ISRCs in parallel for ALL tracks (like Deezer implementation)
 	isrcMap := c.fetchISRCsParallel(ctx, trackIDs, token)
 
 	tracks := make([]AlbumTrackMetadata, 0, len(allTrackItems))
 	for _, item := range allTrackItems {
 		isrc := isrcMap[item.ID]
-		
+
 		tracks = append(tracks, AlbumTrackMetadata{
 			SpotifyID:   item.ID,
 			Artists:     joinArtists(item.Artists),
@@ -587,7 +602,6 @@ func (c *SpotifyMetadataClient) fetchAlbum(ctx context.Context, albumID, token s
 		TrackList: tracks,
 	}
 
-	// Store in cache
 	c.cacheMu.Lock()
 	c.albumCache[albumID] = &cacheEntry{
 		data:      result,
@@ -598,49 +612,44 @@ func (c *SpotifyMetadataClient) fetchAlbum(ctx context.Context, albumID, token s
 	return result, nil
 }
 
-// fetchISRCsParallel fetches ISRCs for multiple tracks in parallel
-// Similar to Deezer implementation for consistency
 func (c *SpotifyMetadataClient) fetchISRCsParallel(ctx context.Context, trackIDs []string, token string) map[string]string {
-	const maxParallelISRC = 10 // Max concurrent ISRC fetches
-	
+	const maxParallelISRC = 10
+
 	result := make(map[string]string)
 	var resultMu sync.Mutex
-	
+
 	if len(trackIDs) == 0 {
 		return result
 	}
-	
-	// Use semaphore to limit concurrent requests
+
 	sem := make(chan struct{}, maxParallelISRC)
 	var wg sync.WaitGroup
-	
+
 	for _, trackID := range trackIDs {
 		wg.Add(1)
 		go func(id string) {
 			defer wg.Done()
-			
-			// Acquire semaphore
+
 			select {
 			case sem <- struct{}{}:
 				defer func() { <-sem }()
 			case <-ctx.Done():
 				return
 			}
-			
+
 			isrc := c.fetchTrackISRC(ctx, id, token)
-			
+
 			resultMu.Lock()
 			result[id] = isrc
 			resultMu.Unlock()
 		}(trackID)
 	}
-	
+
 	wg.Wait()
 	return result
 }
 
 func (c *SpotifyMetadataClient) fetchPlaylist(ctx context.Context, playlistID, token string) (*PlaylistResponsePayload, error) {
-	// First request to get playlist info and first batch of tracks
 	var data struct {
 		Name   string  `json:"name"`
 		Images []image `json:"images"`
@@ -666,10 +675,8 @@ func (c *SpotifyMetadataClient) fetchPlaylist(ctx context.Context, playlistID, t
 	info.Owner.Name = data.Name
 	info.Owner.Images = firstImageURL(data.Images)
 
-	// Pre-allocate with expected capacity
 	tracks := make([]AlbumTrackMetadata, 0, data.Tracks.Total)
-	
-	// Add first batch of tracks
+
 	for _, item := range data.Tracks.Items {
 		if item.Track == nil {
 			continue
@@ -693,9 +700,8 @@ func (c *SpotifyMetadataClient) fetchPlaylist(ctx context.Context, playlistID, t
 		})
 	}
 
-	// Fetch remaining tracks using pagination (NO LIMIT - fetch all tracks)
 	nextURL := data.Tracks.Next
-	
+
 	for nextURL != "" {
 		var pageData struct {
 			Items []struct {
@@ -705,7 +711,6 @@ func (c *SpotifyMetadataClient) fetchPlaylist(ctx context.Context, playlistID, t
 		}
 
 		if err := c.getJSON(ctx, nextURL, token, &pageData); err != nil {
-			// Log error but return what we have so far
 			fmt.Printf("[Spotify] Warning: failed to fetch page, returning %d tracks: %v\n", len(tracks), err)
 			break
 		}
@@ -745,7 +750,6 @@ func (c *SpotifyMetadataClient) fetchPlaylist(ctx context.Context, playlistID, t
 }
 
 func (c *SpotifyMetadataClient) fetchArtist(ctx context.Context, artistID, token string) (*ArtistResponsePayload, error) {
-	// Check cache first
 	c.cacheMu.RLock()
 	if entry, ok := c.artistCache[artistID]; ok && !entry.isExpired() {
 		c.cacheMu.RUnlock()
@@ -753,12 +757,11 @@ func (c *SpotifyMetadataClient) fetchArtist(ctx context.Context, artistID, token
 	}
 	c.cacheMu.RUnlock()
 
-	// Fetch artist info
 	var artistData struct {
-		ID         string  `json:"id"`
-		Name       string  `json:"name"`
-		Images     []image `json:"images"`
-		Followers  struct {
+		ID        string  `json:"id"`
+		Name      string  `json:"name"`
+		Images    []image `json:"images"`
+		Followers struct {
 			Total int `json:"total"`
 		} `json:"followers"`
 		Popularity int `json:"popularity"`
@@ -776,7 +779,6 @@ func (c *SpotifyMetadataClient) fetchArtist(ctx context.Context, artistID, token
 		Popularity: artistData.Popularity,
 	}
 
-	// Fetch artist albums (all types: album, single, compilation)
 	albums := make([]ArtistAlbumMetadata, 0)
 	offset := 0
 	limit := 50
@@ -816,13 +818,11 @@ func (c *SpotifyMetadataClient) fetchArtist(ctx context.Context, artistID, token
 			})
 		}
 
-		// Check if there are more albums
 		if albumsData.Next == "" || len(albumsData.Items) < limit {
 			break
 		}
 		offset += limit
 
-		// Safety limit to prevent infinite loops
 		if offset > 500 {
 			break
 		}
@@ -833,7 +833,6 @@ func (c *SpotifyMetadataClient) fetchArtist(ctx context.Context, artistID, token
 		Albums:     albums,
 	}
 
-	// Store in cache
 	c.cacheMu.Lock()
 	c.artistCache[artistID] = &cacheEntry{
 		data:      result,
@@ -904,7 +903,6 @@ func (c *SpotifyMetadataClient) getJSON(ctx context.Context, endpoint, token str
 		return err
 	}
 
-	// Set headers (same as PC version baseHeaders)
 	req.Header.Set("User-Agent", c.userAgent)
 	req.Header.Set("Accept", "application/json")
 	req.Header.Set("Accept-Language", "en-US,en;q=0.9")
@@ -940,16 +938,15 @@ func (c *SpotifyMetadataClient) randomUserAgent() string {
 	c.rngMu.Lock()
 	defer c.rngMu.Unlock()
 
-	// Use Mac User-Agent format (same as PC version)
-	macMajor := c.rng.Intn(4) + 11    // 11-14
-	macMinor := c.rng.Intn(5) + 4     // 4-8
-	webkitMajor := c.rng.Intn(7) + 530 // 530-536
-	webkitMinor := c.rng.Intn(7) + 30  // 30-36
-	chromeMajor := c.rng.Intn(25) + 80 // 80-104
+	macMajor := c.rng.Intn(4) + 11
+	macMinor := c.rng.Intn(5) + 4          // 4-8
+	webkitMajor := c.rng.Intn(7) + 530     // 530-536
+	webkitMinor := c.rng.Intn(7) + 30      // 30-36
+	chromeMajor := c.rng.Intn(25) + 80     // 80-104
 	chromeBuild := c.rng.Intn(1500) + 3000 // 3000-4499
-	chromePatch := c.rng.Intn(65) + 60 // 60-124
-	safariMajor := c.rng.Intn(7) + 530 // 530-536
-	safariMinor := c.rng.Intn(6) + 30  // 30-35
+	chromePatch := c.rng.Intn(65) + 60     // 60-124
+	safariMajor := c.rng.Intn(7) + 530     // 530-536
+	safariMinor := c.rng.Intn(6) + 30      // 30-35
 
 	return fmt.Sprintf(
 		"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_%d_%d) AppleWebKit/%d.%d (KHTML, like Gecko) Chrome/%d.0.%d.%d Safari/%d.%d",
@@ -966,7 +963,6 @@ func parseSpotifyURI(input string) (spotifyURI, error) {
 		return spotifyURI{}, errInvalidSpotifyURL
 	}
 
-	// Handle spotify: URI format
 	if strings.HasPrefix(trimmed, "spotify:") {
 		parts := strings.Split(trimmed, ":")
 		if len(parts) == 3 {
@@ -977,13 +973,11 @@ func parseSpotifyURI(input string) (spotifyURI, error) {
 		}
 	}
 
-	// Handle URL format
 	parsed, err := url.Parse(trimmed)
 	if err != nil {
 		return spotifyURI{}, err
 	}
 
-	// Handle embed.spotify.com URLs
 	if parsed.Host == "embed.spotify.com" {
 		if parsed.RawQuery == "" {
 			return spotifyURI{}, errInvalidSpotifyURL
@@ -996,7 +990,6 @@ func parseSpotifyURI(input string) (spotifyURI, error) {
 		return parseSpotifyURI(embedded)
 	}
 
-	// Handle plain ID (no scheme/host) - defaults to playlist
 	if parsed.Scheme == "" && parsed.Host == "" {
 		id := strings.Trim(strings.TrimSpace(parsed.Path), "/")
 		if id == "" {
@@ -1022,7 +1015,6 @@ func parseSpotifyURI(input string) (spotifyURI, error) {
 		return spotifyURI{}, errInvalidSpotifyURL
 	}
 
-	// Skip intl- prefix if present
 	if strings.HasPrefix(parts[0], "intl-") {
 		parts = parts[1:]
 	}
@@ -1030,7 +1022,6 @@ func parseSpotifyURI(input string) (spotifyURI, error) {
 		return spotifyURI{}, errInvalidSpotifyURL
 	}
 
-	// Handle standard URLs: /album/{id}, /track/{id}, /playlist/{id}, /artist/{id}
 	if len(parts) == 2 {
 		switch parts[0] {
 		case "album", "track", "playlist", "artist":
@@ -1038,7 +1029,6 @@ func parseSpotifyURI(input string) (spotifyURI, error) {
 		}
 	}
 
-	// Handle nested playlist URLs: /user/{user}/playlist/{id}
 	if len(parts) == 4 && parts[2] == "playlist" {
 		return spotifyURI{Type: "playlist", ID: parts[3]}, nil
 	}

ios/Runner/AppDelegate.swift

@@ -120,6 +120,12 @@ import Gobackend  // Import Go framework
             let itemId = args["item_id"] as! String
             GobackendClearItemProgress(itemId)
             return nil
+
+        case "cancelDownload":
+            let args = call.arguments as! [String: Any]
+            let itemId = args["item_id"] as! String
+            GobackendCancelDownload(itemId)
+            return nil
             
         case "setDownloadDirectory":
             let args = call.arguments as! [String: Any]
@@ -136,6 +142,27 @@ import Gobackend  // Import Go framework
             if let error = error { throw error }
             return response
             
+        case "checkDuplicatesBatch":
+            let args = call.arguments as! [String: Any]
+            let outputDir = args["output_dir"] as! String
+            let tracksJson = args["tracks"] as? String ?? "[]"
+            let response = GobackendCheckDuplicatesBatch(outputDir, tracksJson, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "preBuildDuplicateIndex":
+            let args = call.arguments as! [String: Any]
+            let outputDir = args["output_dir"] as! String
+            GobackendPreBuildDuplicateIndex(outputDir, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "invalidateDuplicateIndex":
+            let args = call.arguments as! [String: Any]
+            let outputDir = args["output_dir"] as! String
+            GobackendInvalidateDuplicateIndex(outputDir)
+            return nil
+            
         case "buildFilename":
             let args = call.arguments as! [String: Any]
             let template = args["template"] as! String
@@ -155,7 +182,8 @@ import Gobackend  // Import Go framework
             let spotifyId = args["spotify_id"] as! String
             let trackName = args["track_name"] as! String
             let artistName = args["artist_name"] as! String
-            let response = GobackendFetchLyrics(spotifyId, trackName, artistName, &error)
+            let durationMs = args["duration_ms"] as? Int64 ?? 0
+            let response = GobackendFetchLyrics(spotifyId, trackName, artistName, durationMs, &error)
             if let error = error { throw error }
             return response
             
@@ -165,7 +193,8 @@ import Gobackend  // Import Go framework
             let trackName = args["track_name"] as! String
             let artistName = args["artist_name"] as! String
             let filePath = args["file_path"] as? String ?? ""
-            let response = GobackendGetLyricsLRC(spotifyId, trackName, artistName, filePath, &error)
+            let durationMs = args["duration_ms"] as? Int64 ?? 0
+            let response = GobackendGetLyricsLRC(spotifyId, trackName, artistName, filePath, durationMs, &error)
             if let error = error { throw error }
             return response
             
@@ -193,7 +222,8 @@ import Gobackend  // Import Go framework
             let query = args["query"] as! String
             let trackLimit = args["track_limit"] as? Int ?? 15
             let artistLimit = args["artist_limit"] as? Int ?? 3
-            let response = GobackendSearchDeezerAll(query, Int(trackLimit), Int(artistLimit), &error)
+            let filter = args["filter"] as? String ?? ""
+            let response = GobackendSearchDeezerAll(query, Int(trackLimit), Int(artistLimit), filter, &error)
             if let error = error { throw error }
             return response
 
@@ -219,6 +249,13 @@ import Gobackend  // Import Go framework
             if let error = error { throw error }
             return response
 
+        case "getDeezerExtendedMetadata":
+            let args = call.arguments as! [String: Any]
+            let trackId = args["track_id"] as! String
+            let response = GobackendGetDeezerExtendedMetadata(trackId, &error)
+            if let error = error { throw error }
+            return response
+
         case "convertSpotifyToDeezer":
             let args = call.arguments as! [String: Any]
             let resourceType = args["resource_type"] as! String
@@ -234,6 +271,43 @@ import Gobackend  // Import Go framework
             if let error = error { throw error }
             return response
             
+        case "checkAvailabilityFromDeezerID":
+            let args = call.arguments as! [String: Any]
+            let deezerTrackId = args["deezer_track_id"] as! String
+            let response = GobackendCheckAvailabilityFromDeezerID(deezerTrackId, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "checkAvailabilityByPlatformID":
+            let args = call.arguments as! [String: Any]
+            let platform = args["platform"] as! String
+            let entityType = args["entity_type"] as! String
+            let entityId = args["entity_id"] as! String
+            let response = GobackendCheckAvailabilityByPlatformID(platform, entityType, entityId, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "getSpotifyIDFromDeezerTrack":
+            let args = call.arguments as! [String: Any]
+            let deezerTrackId = args["deezer_track_id"] as! String
+            let response = GobackendGetSpotifyIDFromDeezerTrack(deezerTrackId, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "getTidalURLFromDeezerTrack":
+            let args = call.arguments as! [String: Any]
+            let deezerTrackId = args["deezer_track_id"] as! String
+            let response = GobackendGetTidalURLFromDeezerTrack(deezerTrackId, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "getAmazonURLFromDeezerTrack":
+            let args = call.arguments as! [String: Any]
+            let deezerTrackId = args["deezer_track_id"] as! String
+            let response = GobackendGetAmazonURLFromDeezerTrack(deezerTrackId, &error)
+            if let error = error { throw error }
+            return response
+            
         case "preWarmTrackCache":
             let args = call.arguments as! [String: Any]
             let tracksJson = args["tracks"] as! String
@@ -256,6 +330,10 @@ import Gobackend  // Import Go framework
             GobackendSetSpotifyAPICredentials(clientId, clientSecret)
             return nil
             
+        case "hasSpotifyCredentials":
+            let hasCredentials = GobackendCheckSpotifyCredentials()
+            return hasCredentials
+            
         // Log methods
         case "getLogs":
             let response = GobackendGetLogs()
@@ -281,6 +359,334 @@ import Gobackend  // Import Go framework
             GobackendSetLoggingEnabled(enabled)
             return nil
             
+        // Extension System methods
+        case "initExtensionSystem":
+            let args = call.arguments as! [String: Any]
+            let extensionsDir = args["extensions_dir"] as! String
+            let dataDir = args["data_dir"] as! String
+            GobackendInitExtensionSystem(extensionsDir, dataDir, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "loadExtensionsFromDir":
+            let args = call.arguments as! [String: Any]
+            let dirPath = args["dir_path"] as! String
+            let response = GobackendLoadExtensionsFromDir(dirPath, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "loadExtensionFromPath":
+            let args = call.arguments as! [String: Any]
+            let filePath = args["file_path"] as! String
+            let response = GobackendLoadExtensionFromPath(filePath, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "unloadExtension":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            GobackendUnloadExtensionByID(extensionId, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "getInstalledExtensions":
+            let response = GobackendGetInstalledExtensions(&error)
+            if let error = error { throw error }
+            return response
+            
+        case "setExtensionEnabled":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let enabled = args["enabled"] as? Bool ?? false
+            GobackendSetExtensionEnabledByID(extensionId, enabled, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "setProviderPriority":
+            let args = call.arguments as! [String: Any]
+            let priorityJson = args["priority"] as! String
+            GobackendSetProviderPriorityJSON(priorityJson, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "getProviderPriority":
+            let response = GobackendGetProviderPriorityJSON(&error)
+            if let error = error { throw error }
+            return response
+            
+        case "setMetadataProviderPriority":
+            let args = call.arguments as! [String: Any]
+            let priorityJson = args["priority"] as! String
+            GobackendSetMetadataProviderPriorityJSON(priorityJson, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "getMetadataProviderPriority":
+            let response = GobackendGetMetadataProviderPriorityJSON(&error)
+            if let error = error { throw error }
+            return response
+            
+        case "getExtensionSettings":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let response = GobackendGetExtensionSettingsJSON(extensionId, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "setExtensionSettings":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let settingsJson = args["settings"] as! String
+            GobackendSetExtensionSettingsJSON(extensionId, settingsJson, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "invokeExtensionAction":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let actionName = args["action"] as! String
+            let response = GobackendInvokeExtensionActionJSON(extensionId, actionName, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "searchTracksWithExtensions":
+            let args = call.arguments as! [String: Any]
+            let query = args["query"] as! String
+            let limit = args["limit"] as? Int ?? 20
+            let response = GobackendSearchTracksWithExtensionsJSON(query, Int(limit), &error)
+            if let error = error { throw error }
+            return response
+            
+        case "downloadWithExtensions":
+            let requestJson = call.arguments as! String
+            let response = GobackendDownloadWithExtensionsJSON(requestJson, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "enrichTrackWithExtension":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let trackJson = args["track"] as? String ?? "{}"
+            let response = GobackendEnrichTrackWithExtensionJSON(extensionId, trackJson, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "removeExtension":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            GobackendRemoveExtensionByID(extensionId, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "upgradeExtension":
+            let args = call.arguments as! [String: Any]
+            let filePath = args["file_path"] as! String
+            let response = GobackendUpgradeExtensionFromPath(filePath, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "checkExtensionUpgrade":
+            let args = call.arguments as! [String: Any]
+            let filePath = args["file_path"] as! String
+            let response = GobackendCheckExtensionUpgradeFromPath(filePath, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "cleanupExtensions":
+            GobackendCleanupExtensions()
+            return nil
+            
+        // Extension Auth API
+        case "getExtensionPendingAuth":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let response = GobackendGetExtensionPendingAuthJSON(extensionId, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "setExtensionAuthCode":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let authCode = args["auth_code"] as! String
+            GobackendSetExtensionAuthCodeByID(extensionId, authCode)
+            return nil
+            
+        case "setExtensionTokens":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let accessToken = args["access_token"] as! String
+            let refreshToken = args["refresh_token"] as? String ?? ""
+            let expiresIn = args["expires_in"] as? Int ?? 0
+            GobackendSetExtensionTokensByID(extensionId, accessToken, refreshToken, Int(expiresIn))
+            return nil
+            
+        case "clearExtensionPendingAuth":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            GobackendClearExtensionPendingAuthByID(extensionId)
+            return nil
+            
+        case "isExtensionAuthenticated":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let response = GobackendIsExtensionAuthenticatedByID(extensionId)
+            return response
+            
+        case "getAllPendingAuthRequests":
+            let response = GobackendGetAllPendingAuthRequestsJSON(&error)
+            if let error = error { throw error }
+            return response
+            
+        // Extension FFmpeg API
+        case "getPendingFFmpegCommand":
+            let args = call.arguments as! [String: Any]
+            let commandId = args["command_id"] as! String
+            let response = GobackendGetPendingFFmpegCommandJSON(commandId, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "setFFmpegCommandResult":
+            let args = call.arguments as! [String: Any]
+            let commandId = args["command_id"] as! String
+            let success = args["success"] as? Bool ?? false
+            let output = args["output"] as? String ?? ""
+            let errorMsg = args["error"] as? String ?? ""
+            GobackendSetFFmpegCommandResult(commandId, success, output, errorMsg)
+            return nil
+            
+        case "getAllPendingFFmpegCommands":
+            let response = GobackendGetAllPendingFFmpegCommandsJSON(&error)
+            if let error = error { throw error }
+            return response
+            
+        // Extension Custom Search API
+        case "customSearchWithExtension":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let query = args["query"] as! String
+            let optionsJson = args["options"] as? String ?? ""
+            let response = GobackendCustomSearchWithExtensionJSON(extensionId, query, optionsJson, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "getSearchProviders":
+            let response = GobackendGetSearchProvidersJSON(&error)
+            if let error = error { throw error }
+            return response
+            
+        // Extension URL Handler API
+        case "handleURLWithExtension":
+            let args = call.arguments as! [String: Any]
+            let url = args["url"] as! String
+            let response = GobackendHandleURLWithExtensionJSON(url, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "findURLHandler":
+            let args = call.arguments as! [String: Any]
+            let url = args["url"] as! String
+            let response = GobackendFindURLHandlerJSON(url)
+            return response
+            
+        case "getURLHandlers":
+            let response = GobackendGetURLHandlersJSON(&error)
+            if let error = error { throw error }
+            return response
+            
+        case "getAlbumWithExtension":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let albumId = args["album_id"] as! String
+            let response = GobackendGetAlbumWithExtensionJSON(extensionId, albumId, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "getPlaylistWithExtension":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let playlistId = args["playlist_id"] as! String
+            let response = GobackendGetPlaylistWithExtensionJSON(extensionId, playlistId, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "getArtistWithExtension":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let artistId = args["artist_id"] as! String
+            let response = GobackendGetArtistWithExtensionJSON(extensionId, artistId, &error)
+            if let error = error { throw error }
+            return response
+            
+        // Extension Post-Processing API
+        case "runPostProcessing":
+            let args = call.arguments as! [String: Any]
+            let filePath = args["file_path"] as! String
+            let metadataJson = args["metadata"] as? String ?? ""
+            let response = GobackendRunPostProcessingJSON(filePath, metadataJson, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "getPostProcessingProviders":
+            let response = GobackendGetPostProcessingProvidersJSON(&error)
+            if let error = error { throw error }
+            return response
+            
+        // Extension Store
+        case "initExtensionStore":
+            let args = call.arguments as! [String: Any]
+            let cacheDir = args["cache_dir"] as! String
+            GobackendInitExtensionStoreJSON(cacheDir, &error)
+            if let error = error { throw error }
+            return nil
+            
+        case "getStoreExtensions":
+            let args = call.arguments as! [String: Any]
+            let forceRefresh = args["force_refresh"] as? Bool ?? false
+            let response = GobackendGetStoreExtensionsJSON(forceRefresh, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "searchStoreExtensions":
+            let args = call.arguments as! [String: Any]
+            let query = args["query"] as? String ?? ""
+            let category = args["category"] as? String ?? ""
+            let response = GobackendSearchStoreExtensionsJSON(query, category, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "getStoreCategories":
+            let response = GobackendGetStoreCategoriesJSON(&error)
+            if let error = error { throw error }
+            return response
+            
+        case "downloadStoreExtension":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let destDir = args["dest_dir"] as! String
+            let response = GobackendDownloadStoreExtensionJSON(extensionId, destDir, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "clearStoreCache":
+            GobackendClearStoreCacheJSON(&error)
+            if let error = error { throw error }
+            return nil
+            
+        // Extension Home Feed API
+        case "getExtensionHomeFeed":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let response = GobackendGetExtensionHomeFeedJSON(extensionId, &error)
+            if let error = error { throw error }
+            return response
+            
+        case "getExtensionBrowseCategories":
+            let args = call.arguments as! [String: Any]
+            let extensionId = args["extension_id"] as! String
+            let response = GobackendGetExtensionBrowseCategoriesJSON(extensionId, &error)
+            if let error = error { throw error }
+            return response
+            
         default:
             throw NSError(
                 domain: "SpotiFLAC",

ios/Runner/Info.plist

@@ -4,6 +4,23 @@
 <dict>
 	<key>CFBundleDevelopmentRegion</key>
 	<string>$(DEVELOPMENT_LANGUAGE)</string>
+	<key>CFBundleLocalizations</key>
+	<array>
+		<string>en</string>
+		<string>de</string>
+		<string>es</string>
+		<string>fr</string>
+		<string>hi</string>
+		<string>id</string>
+		<string>ja</string>
+		<string>ko</string>
+		<string>nl</string>
+		<string>pt</string>
+		<string>ru</string>
+		<string>zh</string>
+		<string>zh-Hans</string>
+		<string>zh-Hant</string>
+	</array>
 	<key>CFBundleDisplayName</key>
 	<string>SpotiFLAC</string>
 	<key>CFBundleExecutable</key>

l10n.yaml

@@ -0,0 +1,6 @@
+arb-dir: lib/l10n/arb
+template-arb-file: app_en.arb
+output-localization-file: app_localizations.dart
+output-class: AppLocalizations
+output-dir: lib/l10n
+nullable-getter: false

lib/app.dart

@@ -1,13 +1,14 @@
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:flutter_localizations/flutter_localizations.dart';
 import 'package:go_router/go_router.dart';
 import 'package:spotiflac_android/screens/main_shell.dart';
 import 'package:spotiflac_android/screens/setup_screen.dart';
 import 'package:spotiflac_android/providers/settings_provider.dart';
 import 'package:spotiflac_android/theme/dynamic_color_wrapper.dart';
+import 'package:spotiflac_android/l10n/app_localizations.dart';
 
 final _routerProvider = Provider<GoRouter>((ref) {
-  // Only watch isFirstLaunch to prevent router rebuild on other settings changes
   final isFirstLaunch = ref.watch(settingsProvider.select((s) => s.isFirstLaunch));
   
   return GoRouter(
@@ -31,6 +32,17 @@ class SpotiFLACApp extends ConsumerWidget {
   @override
   Widget build(BuildContext context, WidgetRef ref) {
     final router = ref.watch(_routerProvider);
+    final localeString = ref.watch(settingsProvider.select((s) => s.locale));
+    
+    Locale? locale;
+    if (localeString != 'system') {
+      if (localeString.contains('_')) {
+        final parts = localeString.split('_');
+        locale = Locale(parts[0], parts[1]);
+      } else {
+        locale = Locale(localeString);
+      }
+    }
     
     return DynamicColorWrapper(
       builder: (lightTheme, darkTheme, themeMode) {
@@ -43,6 +55,14 @@ class SpotiFLACApp extends ConsumerWidget {
           themeAnimationDuration: const Duration(milliseconds: 300),
           themeAnimationCurve: Curves.easeInOut,
           routerConfig: router,
+          locale: locale,
+          localizationsDelegates: const [
+            AppLocalizations.delegate,
+            GlobalMaterialLocalizations.delegate,
+            GlobalWidgetsLocalizations.delegate,
+            GlobalCupertinoLocalizations.delegate,
+          ],
+          supportedLocales: AppLocalizations.supportedLocales,
         );
       },
     );

lib/constants/app_info.dart

@@ -1,8 +1,8 @@
 /// App version and info constants
 /// Update version here only - all other files will reference this
 class AppInfo {
-  static const String version = '2.2.7';
-  static const String buildNumber = '49';
+static const String version = '3.3.1';
+  static const String buildNumber = '68';
   static const String fullVersion = '$version+$buildNumber';