@follenfang/fupload 0.0.1 → 0.0.2

package/README.md

@@ -1,12 +1,13 @@
 # Fuploader
 
-Fuploader 是一个面向 Agent 的《魔兽世界》作者发布 Skill 和 CLI。npm 安装后统一使用 `fupload` 命令；命令内部运行随 Skill 分发的纯 Python 实现。新手盒子（NewBeeBox）默认优先使用官方 `ncc` CLI，用户显式要求第三方管理工具时才使用 Fuploader 通道；网易 DD 使用 Fuploader 调用官方无头客户端。
+Fuploader 是一个面向 Agent 的《魔兽世界》作者发布 Skill 和 CLI。npm 安装后统一使用 `fupload` 命令；命令内部运行随 Skill 分发的纯 Python 实现。新手盒子（NewBeeBox）默认优先使用官方 `ncc` CLI，用户显式要求第三方管理工具时才使用 Fuploader 通道；网易 DD 使用 Fuploader 调用官方无头客户端；CurseForge 使用 Core API 查询作者公开项目，并使用 Authors Upload API 上传插件 ZIP。
 
 项目强调显式调用、完整字段收集、写入前确认和写入后读回验证。CLI 只负责单次原子读写，业务选择、执行计划和异常恢复由 Agent 在对话中完成。
 
 ## 功能
 
-- 支持新手盒子官方 `ncc`、第三方 Python 管理通道和网易 DD。
+- 支持新手盒子官方 `ncc`、第三方 Python 管理通道、网易 DD 和 CurseForge。
+- CurseForge 支持按作者 ID 查询 WoW 公开项目、读取上传用游戏版本，以及向已有项目上传插件 ZIP；不创建 Project，也不枚举私有、草稿或待审 Project。
 - 支持插件、配置分享、WA/字符串的创建、内容更新与元数据编辑。
 - 官方通道严格采用已安装 `ncc` 暴露的能力；第三方 Python 通道覆盖版本、游戏分支、分类、媒体、可见性、审核、商业设置、频道、关联内容和配置备份选择等页面字段。
 - 第三方 Python 以 Creator Center 网页的请求和表单状态为基准，编辑和更新采用 `GET -> 动态选项查询 -> presence-aware patch -> 写入 -> 读回`；关联作者/内容在主记录读回后替换并再次读回。官方通道采用 `ncc` 文档规定的只读查询、写入和读回命令。
@@ -54,6 +55,16 @@ fupload --help
 
 全局安装会同时创建 `fupload` 命令，并把版本匹配的 Skill 原子安装到 `~/.agents/skills/fupload/`。可用 `FUPLOAD_AGENT_HOME` 把默认位置改为 `<home>/skills/fupload`，或在单次命令中使用 `--skill-dir <完整路径>`；所有成功管理过的 Skill 路径都会登记，供完整卸载使用。
 
+安装和 `fupload update` 还会幂等创建缺失的 `~/.fupload/curseforge.env`；已有文件逐字节保留，不覆盖或补写其中的值：
+
+```dotenv
+CURSEFORGE_AUTHOR_ID=
+CURSEFORGE_API_KEY=
+CURSEFORGE_UPLOAD_TOKEN=
+```
+
+`CURSEFORGE_AUTHOR_ID` 是可在对话中提供的非秘密数字 ID；Core API Key 与 Upload Token 是两套不同秘密。请只在本机 env 文件或进程环境中填写秘密，不要粘贴到 Agent 对话、命令参数、项目文件或 Git。
+
 ## 作为 Skill 使用
 
 安装后显式调用：
@@ -62,7 +73,7 @@ fupload --help
 $fupload
 ```
 
-该 Skill 不会因普通提及“发布”“新手盒子”或“DD”而自动触发。Agent 会先询问平台、资源和动作。新手盒子会自动检测 `ncc`：已安装即默认使用官方通道；未安装时先询问是否安装；只有用户显式选择第三方 Python 管理工具才进入项目内 CLI。Agent 在被发布项目中创建 `publish/<时间>-<平台>-<资源>-<动作>/`，同一次发布的脱敏 JSON 按原子步骤保存为 `01-<动作>.json`、`02-<动作>.json`。展示完整写入计划并得到确认后才会真实写入。
+该 Skill 不会因普通提及“发布”“新手盒子”“DD”或“CurseForge”而自动触发。Agent 会先询问平台、资源和动作。新手盒子会自动检测 `ncc`：已安装即默认使用官方通道；未安装时先询问是否安装；只有用户显式选择第三方 Python 管理工具才进入项目内 CLI。CurseForge 上传缺少作者 ID 时，Agent 会主动询问；缺少 API Key 或 Upload Token 时，只会引导用户在本机填写 `~/.fupload/curseforge.env`，不会要求在对话中提供秘密。Agent 在被发布项目中创建 `publish/<时间>-<平台>-<资源>-<动作>/`，同一次发布的脱敏 JSON 按原子步骤保存为 `01-<动作>.json`、`02-<动作>.json`。展示完整写入计划并得到确认后才会真实写入。
 
 ## CLI 使用
 
@@ -77,7 +88,7 @@ ncc whoami -o json
 
 创建令牌和本机登录说明见[官方 CLI 文档](https://creator.newbeebox.com/cli-docs)。不要把令牌粘贴到 Agent 对话；在自己的终端完成 `ncc login`。
 
-以下为 Fuploader 第三方 NewBeeBox 与 DD 执行层。
+以下为 Fuploader 第三方 NewBeeBox、DD 与 CurseForge 执行层。
 
 查看总帮助：
 
@@ -85,6 +96,22 @@ ncc whoami -o json
 fupload --help
 ```
 
+检查 CurseForge 配置、查询作者公开项目和读取游戏版本：
+
+```powershell
+fupload curseforge session doctor
+fupload curseforge project list
+fupload curseforge project list --author-id 138844367
+fupload curseforge plugin game-versions
+```
+
+上传前先执行本地 dry-run；确认完整计划后再移除 `--dry-run`：
+
+```powershell
+fupload curseforge plugin upload --input fupload\examples\curseforge-plugin-upload.json --dry-run
+fupload curseforge plugin upload --input publish\20260807-120000-curseforge-plugin-upload\01-upload.json
+```
+
 查看具体操作的可执行字段契约：
 
 ```powershell
@@ -134,7 +161,7 @@ fupload uninstall
 
 `fupload update` 固定安装 `@follenfang/fupload@latest`，随后把默认位置和所有登记有效的自定义 Skill 同步到同一版本。未知目录不会被覆盖。
 
-`fupload uninstall` 先删除所有仍有有效 npm 管理标记的 Fuploader Skill，再调用 npm 删除 `@follenfang/fupload` 和 `fupload` 命令。Skill 清理失败时 npm 包保持可用，处理占用或权限问题后可重试。项目中的 `publish/`、新手盒子/DD 登录数据和 DD 日志始终保留。
+`fupload uninstall` 先删除所有仍有有效 npm 管理标记的 Fuploader Skill，再调用 npm 删除 `@follenfang/fupload` 和 `fupload` 命令。Skill 清理失败时 npm 包保持可用，处理占用或权限问题后可重试。项目中的 `publish/`、新手盒子/DD 登录数据、DD 日志和 `~/.fupload/curseforge.env` 始终保留。
 
 npm 7 及以上不执行卸载 lifecycle，因此直接运行 `npm uninstall -g @follenfang/fupload` 只删除 npm 包和 CLI，可能留下 Skill；它不属于完整卸载流程。
 
@@ -154,6 +181,7 @@ npm 7 及以上不执行卸载 lifecycle，因此直接运行 `npm uninstall -g
 - [新手盒子官方 CLI 完整参考](fupload/references/newbee-official-cli.md)
 - [新手盒子第三方 Python 字段参考](fupload/references/newbee.md)
 - [网易 DD 字段参考](fupload/references/dd.md)
+- [CurseForge API、字段与上传参考](fupload/references/curseforge.md)
 
 ## 测试
 
@@ -166,7 +194,7 @@ python -m unittest discover -s fupload\scripts\tests
 python -m compileall -q fupload\scripts
 ```
 
-当前回归测试覆盖 CLI 路由、严格 JSON、字段 Schema、双平台 builder、动态选项校验、字段保留与清空语义，以及所有内置示例的 dry-run。
+当前回归测试覆盖 CLI 路由、严格 JSON、字段 Schema、平台 builder、动态选项校验、字段保留与清空语义，以及所有内置示例的 dry-run。
 
 DD 逐字段 wire 矩阵可单独运行并生成本地审计报告：
 
@@ -184,7 +212,7 @@ python fupload\scripts\tests\generate_dd_wire_matrix_report.py > analyze\dd-fiel
 - `fupload/scripts/fupload_cli/__init__.py` 的 `__version__`
 - `npm/skill-manifest.json` 的包版本与 Skill 版本
 
-当前初版为 `0.0.1`，对应 tag `v0.0.1`。`.github/workflows/publish-npm.yml` 在 pull request、`main` push 和 `v*` tag 上运行 Windows/Linux CI；只有 tag CI 全部通过时才通过 npm Trusted Publishing/OIDC 发布，不使用长期 `NPM_TOKEN`。
+当前版本为 `0.0.2`，对应 tag `v0.0.2`。`.github/workflows/publish-npm.yml` 在 pull request、`main` push 和 `v*` tag 上运行 Windows/Linux CI；只有 tag CI 全部通过时才通过 npm Trusted Publishing/OIDC 发布，不使用长期 `NPM_TOKEN`。
 
 发布前在 npm 包设置中绑定 Trusted Publisher：
 
@@ -197,12 +225,12 @@ python fupload\scripts\tests\generate_dd_wire_matrix_report.py > analyze\dd-fiel
 
 ```powershell
 npm run check:versions
-npm run check:release -- v0.0.1
-git tag -a v0.0.1 -m "Fuploader 0.0.1"
-git push origin v0.0.1
+npm run check:release -- v0.0.2
+git tag -a v0.0.2 -m "Fuploader 0.0.2"
+git push origin v0.0.2
 ```
 
-npm 对首次创建的包可能要求先由账号所有者完成一次 bootstrap 发布；该步骤只用于建立包身份，正式 `latest` 仍由 `v0.0.1` workflow 发布。需要人工处理时，不要把 npm token 写入仓库或 GitHub Secret。
+npm 对首次创建的包可能要求先由账号所有者完成一次 bootstrap 发布；该步骤只用于建立包身份，正式 `latest` 由版本 tag workflow 发布。需要人工处理时，不要把 npm token 写入仓库或 GitHub Secret。
 
 ## 说明
 

package/fupload/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: fupload
-description: Explicit author-publishing workflow for World of Warcraft plugins, configuration shares, and WA/strings on NewBeeBox and NetEase DD. Use only when the user explicitly invokes `$fupload`, explicitly asks to use the Fupload Skill, or loads this Skill by path. Do not trigger from ordinary mentions of publishing, NewBeeBox, DD, plugins, configurations, or WA.
+description: Explicit author-publishing workflow for World of Warcraft plugins, configuration shares, and WA/strings on NewBeeBox, NetEase DD, and CurseForge, including CurseForge author project lookup and plugin ZIP upload. Use only when the user explicitly invokes `$fupload`, explicitly asks to use the Fupload Skill, or loads this Skill by path. Do not trigger from ordinary mentions of publishing, NewBeeBox, DD, CurseForge, plugins, configurations, or WA.
 metadata:
-  version: "0.0.1"
+  version: "0.0.2"
 ---
 
 # Fupload
 
-Act as the publishing operator. For NewBeeBox, prefer the official `ncc` CLI whenever it is installed unless the user explicitly requests the third-party Python management tool. For DD, and for an explicitly selected third-party NewBeeBox workflow, use the bundled Python CLI. Keep investigation, choices, planning, confirmation, and recovery in the conversation.
+Act as the publishing operator. For NewBeeBox, prefer the official `ncc` CLI whenever it is installed unless the user explicitly requests the third-party Python management tool. For DD, CurseForge, and an explicitly selected third-party NewBeeBox workflow, use the bundled Python CLI. Keep investigation, choices, planning, confirmation, and recovery in the conversation.
 
 When installed from npm, interpret `<fupload-cli>` as `fupload`. Only while maintaining the source repository, directly installing this Skill, or when `fupload` is absent from PATH, use `python <skill-root>/scripts/fupload.py`. Keep the user's current project as the working directory in either mode.
 
@@ -15,8 +15,8 @@ When installed from npm, interpret `<fupload-cli>` as `fupload`. Only while main
 
 When the user has not already stated both dimensions, ask in one short message:
 
-1. Platform: NewBeeBox or DD.
-2. Resource and action: plugin/configuration/WA, then create/content update/metadata edit/delete.
+1. Platform: NewBeeBox, DD, or CurseForge.
+2. Resource and action: plugin/configuration/WA, then create/content update/metadata edit/delete. CurseForge supports public project listing and uploading a plugin ZIP to an existing project only.
 
 Map natural language consistently:
 
@@ -27,10 +27,14 @@ Map natural language consistently:
 
 Never offer bulk delete, version-file delete, drafts, guides, messages, or GUI control automation. The DD task-session command may close verified official GUI processes only after the consent flow below.
 
+CurseForge cannot create a project or enumerate private, draft, or pending-review projects. Direct project creation to the Authors website; use the Core API list only as the public-project view for one numeric author ID.
+
 ## Select the execution channel
 
 For DD, use the bundled Python CLI.
 
+For CurseForge, use the bundled Python CLI. Do not substitute direct HTTP calls or the CurseForge for Studios API for uploads: public project lookup uses the Core API, while game-version lookup and upload use the separate Upload API and credential.
+
 For NewBeeBox, apply this order exactly:
 
 1. If the user explicitly requests the third-party Python management tool, use the bundled Python CLI even when `ncc` is installed.
@@ -44,9 +48,11 @@ Never switch channels silently. Before changing channels, re-read remote state a
 
 ## Protect credentials
 
-Prefer an existing official `ncc login`, then a caller-provided `NCC_TOKEN`, then user-performed local login. Never ask the user to paste a token into the conversation. Never place a real token in `--token`, shell history, command output, JSON, `.env`, `publish/`, `analyze/`, tests, Skill files, references, or Git. Do not inspect or copy the official CLI credential store.
+For NewBeeBox, prefer an existing official `ncc login`, then a caller-provided `NCC_TOKEN`, then user-performed local login. Never ask the user to paste a token into the conversation. Never place a real NewBeeBox token in `--token`, shell history, command output, JSON, `.env`, `publish/`, `analyze/`, tests, Skill files, references, or Git. Do not inspect or copy the official CLI credential store.
+
+For CurseForge, use `~/.fupload/curseforge.env`, created idempotently by npm install/update, with `CURSEFORGE_AUTHOR_ID`, `CURSEFORGE_API_KEY`, and `CURSEFORGE_UPLOAD_TOKEN`. The author ID is non-secret: if absent, proactively ask for its numeric value or offer `--author-id`. The API key and upload token are secrets: never ask the user to paste either into the conversation; direct them to fill the local env file in their own editor or terminal, then run `curseforge session doctor`. Never print file contents or secret values. Process environment values may override the file without being shown.
 
-If a token is pasted into the conversation, do not repeat or use it. Tell the user to revoke it from the official CLI token page and create a replacement through local login or pre-launch environment injection. Check only whether `NCC_TOKEN` is present, never its length, prefix, hash, or value.
+If a token is pasted into the conversation, do not repeat or use it. Tell the user to revoke or regenerate it at its provider and configure the replacement locally. Check only whether the expected field is present, never its length, prefix, hash, or value.
 
 ## Locate the Fuploader CLI
 
@@ -62,6 +68,7 @@ For npm package maintenance, use `fupload update` to update the CLI and every re
 - For official NewBeeBox, read [references/newbee-official-cli.md](references/newbee-official-cli.md), then run the installed `ncc docs` and exact leaf `--help`. The bundled reference is a complete official snapshot, but runtime docs win when versions differ.
 - Read [references/newbee.md](references/newbee.md) only when the user explicitly selected the third-party Python NewBeeBox channel.
 - Read [references/dd.md](references/dd.md) only for DD.
+- Read [references/curseforge.md](references/curseforge.md) for every CurseForge lookup or upload.
 - For Python, run the exact leaf command with `--help` before creating its input. Treat help as the executable schema contract.
 
 ## Investigate
@@ -70,6 +77,8 @@ Inspect the user-provided project or current workspace for `.toc`, README, chang
 
 Use read-only commands from the selected channel to discover the current account's records, target detail, versions, backups, categories, game branches/builds, installation paths, life types, VIP levels, channels, and association candidates. Never ask the user to copy an ID that the selected CLI can query.
 
+For CurseForge, run `curseforge session doctor`, then `curseforge project list` using `CURSEFORGE_AUTHOR_ID` or the user-provided non-secret `--author-id`. Select a public project by name plus `project_id`. Before a version-tagged upload, run `curseforge plugin game-versions` and select returned IDs or names; do not guess IDs from display names. A parent-file upload instead uses `parent_file_id` and omits both game-version fields. Inspect the ZIP and local release notes. An empty public list does not prove the account has no private, draft, or pending-review projects.
+
 For official NewBeeBox, use the documented `ncc wow addons list|info|categories|versions`, `wa list|info|categories`, `uipack list|info`, `cloudbackup list|info`, and related commands needed by the action. Use the exact options returned by the installed help. `addons push` compatibility uses explicit build strings or documented `auto`; never substitute a parent branch ID. An empty required option list blocks the write.
 
 For third-party Python NewBeeBox, use Creator Center webpage requests and form behavior as the business baseline. Always read `newbee options content-origins`, `subscribe-plans`, and `time-ranges` when the corresponding field is present. Also read plugin categories/builds, WA categories, attachment paths, and each resource's `co-author`/`reference` candidates for those fields. Empty option output blocks the write. Plugin compatibility uses build strings from `game-versions.items[].versions`, never the parent branch `id`. Preserve omitted edit fields; an explicit empty `co_authors` or `references` array replaces and clears that complete relation only after the main record readback succeeds.
@@ -96,13 +105,13 @@ For a configuration, require a cloud backup already uploaded by the matching des
 
 Expose every business field writable through the selected channel. Do not silently accept a webpage preselection or invent a business default. This includes applicable game type/build, categories, origin, format, visibility, review submission, payment, lifetime, price, room/channel, synchronization, membership, associations, backup content, WTF roles, incremental selections, retail UI data, WA material mode, and install path. When official `ncc` does not expose a webpage field or action, state that capability boundary; do not guess a hidden flag or silently switch to Python.
 
-Use existing remote values only for omitted fields in `edit` or `update`, where omission means preserve. Show candidates by human name plus ID/SN and relevant status. Ask only choices that cannot be determined from the user's explicit request, local artifacts, or remote reads. For DD, do not draft the executable JSON incrementally: close the full dependency graph first, then generate one final JSON containing parent fields and stable child IDs/selectors. Python repeats the live GETs before upload or mutation and rejects missing or cross-parent selections; detail is authoritative when DD list and detail timestamps differ. When an existing plugin or WA has `assign_user_sn`, only public scope is selectable and the final rebuilt form must remain public.
+Use existing remote values only for omitted fields in `edit` or `update`, where omission means preserve. Show candidates by human name plus ID/SN and relevant status. Ask only choices that cannot be determined from the user's explicit request, local artifacts, or remote reads. For CurseForge upload, collect project ID, ZIP path, changelog, release type, version IDs/names or parent file choice, and each requested optional metadata field; do not infer visibility or approval from upload acceptance. For DD, do not draft the executable JSON incrementally: close the full dependency graph first, then generate one final JSON containing parent fields and stable child IDs/selectors. Python repeats the live GETs before upload or mutation and rejects missing or cross-parent selections; detail is authoritative when DD list and detail timestamps differ. When an existing plugin or WA has `assign_user_sn`, only public scope is selectable and the final rebuilt form must remain public.
 
 ## Prepare and confirm
 
 Create a durable release directory under the target project's root, never under or beside the installed Skill. Use `publish/<YYYYMMDD-HHmmss>-<platform>-<resource>-<action>/`; if that name already exists, append `-2`, `-3`, and so on instead of reusing it. Put every atomic step in a versioned JSON file ordered as `01-<action>.json`, `02-<action>.json`, and so on. A retry or readback for the same plan reuses its directory; a new independent publishing plan gets a new directory. Use JSON, not YAML. Keep the directory after execution as the target project's publishing record, and do not change its ignore rules unless the user asks.
 
-For Python, these are executable `--input` documents using the leaf schema. For official `ncc`, these are redacted plan records containing the channel, working directory, argument vector, non-secret business inputs, local file references, and expected readback; `ncc` does not consume them. Never store a token, raw WA string, raw configuration content, or signed URL in a plan record. Use `@file` or local path references for content. Run `--dry-run` where the selected leaf documents it, especially `ncc wow addons push --dry-run`; do not invent dry-run support for other official commands.
+For Python, these are executable `--input` documents using the leaf schema. For official `ncc`, these are redacted plan records containing the channel, working directory, argument vector, non-secret business inputs, local file references, and expected readback; `ncc` does not consume them. Never store a token, API key, raw WA string, raw configuration content, or signed URL in a plan record. Use `@file` or local path references for content. Run `--dry-run` where the selected leaf documents it, especially `ncc wow addons push --dry-run` and every CurseForge upload; do not invent dry-run support for other official commands.
 
 Before the first write, present one complete human-readable plan containing:
 
@@ -116,12 +125,16 @@ Before the first write, present one complete human-readable plan containing:
 
 Obtain one explicit confirmation for that exact plan. If the plan changes materially, confirm the changed plan once.
 
+For CurseForge, confirmation must name the public project and numeric ID, ZIP path, selected game-version IDs/names or parent file ID, changelog, release type, optional metadata and relations, and whether manual release is requested. After confirmation, execute exactly one upload attempt. A dry-run performs local validation only and is not remote permission or ID validation.
+
 For a Python delete, first run the resource `get` command, show the exact name and ID/SN, and obtain confirmation for that single record. NewBeeBox delete input contains only the schema, `id`, and `confirm: "DELETE"`; DD delete input contains only the schema, `sn`, and `confirm_delete: true`. Do not reuse confirmation for another record and do not retry an uncertain delete. Official `ncc` currently documents plugin, WA, and configuration main-record deletion as web-only; state that boundary and wait for an explicit third-party selection before offering the Python delete command.
 
 ## Execute and verify
 
 Run writes serially. For official `ncc`, always request `-o json`, parse stdout as JSON, and treat stderr only as progress diagnostics. For Python, parse its stable JSON output. Never scrape human text. After each successful step, immediately run the corresponding info/get/list/versions/history command and compare the intended fields in the same DD session when applicable. DD performs a bounded GET-only readback poll and never resends a mutation during verification. For DD plugin update, use a nonempty `/addon/addon_versions` result only as a pre-upload duplicate guard; the matching author-list item's `latest_version` is the primary success confirmation and `detail_v2` is supplementary. Plugin edit also uses the same-SN author projection when detail remains stale. An empty history is diagnostic-only. Treat “submitted for review” and “under review” as distinct from “approved” or “publicly visible.”
 
+For CurseForge, treat the Upload API's returned file ID as upload acceptance only. Record the ID and command result, then report that moderation, processing, manual release, and public visibility are separate states. On an interrupted or ambiguous upload, do not resend automatically because that can create a duplicate file; inspect the Authors project page or public file list before deciding on a new attempt. Follow the HTTP/error handling table in the CurseForge reference.
+
 In the third-party Python NewBeeBox channel, public plugin publication is three atomic writes: create privately, upload and verify the first version, then edit to public with explicit review intent. Never send a public `share_state` during Python create. In the official channel, follow the installed `ncc docs` sequence for create, init, push, and visibility instead of applying Python wire rules.
 
 Stop on the first failure. Report completed steps, retained IDs/SNs or media references, the redacted failure stage, whether verification is required, and the smallest safe retry. Explicit DD HTTP/business rejection has `verification_required=false`; interrupted PUT/mutation or failed readback after an accepted write has `verification_required=true`. Native DD failures may include a bounded message, HTTP status, native business code, field validation hints, and `details.log_path`. When `log_path` is present, read only the referenced Fuploader JSONL record under the DD version directory; do not inspect DD's other logs or any credential files. The Fuploader record contains sanitized request and response JSON/body plus byte counts and truncation flags, with signed URLs, cookies, JWTs, credentials, client identifiers, signatures, and tokens recursively redacted. Read back after an uncertain write before resending it. Official NewBeeBox exit codes are `0` success, `1` business error, `2` authentication failure, and `3` network error. Never loop on `quota_exceeded`.

package/fupload/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "Fupload"
-  short_description: "整理并发布新手盒子与网易DD的插件、配置分享及WA字符串"
-  default_prompt: "使用 $fupload 检查当前项目和远端状态；新手盒子优先检测并使用官方 ncc，显式要求第三方时使用 fupload CLI；整理全部业务选项并在确认后完成发布或更新。"
+  short_description: "发布新手盒子、网易DD与CurseForge的魔兽世界作者内容"
+  default_prompt: "使用 $fupload 检查当前项目和远端状态；新手盒子优先使用官方 ncc，DD 与 CurseForge 使用 fupload CLI；整理全部业务选项并在确认后完成发布或更新。"

package/fupload/examples/curseforge-plugin-upload.json

@@ -0,0 +1,21 @@
+{
+  "schema": "fupload.v1.curseforge.plugin.upload",
+  "project_id": 123456,
+  "file": "./addon.zip",
+  "changelog": "Release notes for 1.0.0",
+  "changelog_type": "markdown",
+  "display_name": "Example AddOn 1.0.0",
+  "game_versions": [12345],
+  "game_version_names": ["Retail"],
+  "release_type": "release",
+  "relations": {
+    "projects": [
+      {
+        "slug": "example-library",
+        "project_id": 74924,
+        "type": "requiredDependency"
+      }
+    ]
+  },
+  "is_marked_for_manual_release": false
+}

package/fupload/references/curseforge.md

@@ -0,0 +1,233 @@
+# CurseForge reference
+
+Use this reference only for CurseForge public author-project lookup and WoW plugin ZIP upload. Fuploader uses two independent official APIs and credentials.
+
+## Contents
+
+- [Capability boundary](#capability-boundary)
+- [Local configuration](#local-configuration)
+- [Public project lookup](#public-project-lookup)
+- [Game versions](#game-versions)
+- [Plugin upload](#plugin-upload)
+- [Metadata contract](#metadata-contract)
+- [Relations](#relations)
+- [Plan, dry-run, and confirmation](#plan-dry-run-and-confirmation)
+- [Success, visibility, and verification](#success-visibility-and-verification)
+- [Errors and retry rules](#errors-and-retry-rules)
+- [Official documentation](#official-documentation)
+
+## Capability boundary
+
+Fuploader supports:
+
+- querying public World of Warcraft projects for one numeric author ID through the CurseForge Core API;
+- listing Upload API game-version choices;
+- uploading one ZIP to an existing World of Warcraft project.
+
+It does not create projects, list an authenticated account's private/draft/pending-review projects, update an existing file, or delete a project/file. Create and inspect non-public projects in the [CurseForge Authors dashboard](https://authors.curseforge.com/). An empty Core API result means only that no matching public project was returned.
+
+## Local configuration
+
+Use `~/.fupload/curseforge.env`:
+
+```dotenv
+CURSEFORGE_AUTHOR_ID=
+CURSEFORGE_API_KEY=
+CURSEFORGE_UPLOAD_TOKEN=
+```
+
+- `CURSEFORGE_AUTHOR_ID`: non-secret positive integer used by public project lookup. It is an author membership/owner identifier, not an account username or project ID.
+- `CURSEFORGE_API_KEY`: secret CurseForge for Studios/Core API key sent as `x-api-key`.
+- `CURSEFORGE_UPLOAD_TOKEN`: secret Authors Upload API token sent as `X-Api-Token`.
+
+The two secrets are not interchangeable. npm install/update creates the directory and template file when missing; an existing file is preserved byte for byte and is never backfilled or overwritten. Process environment values override file values for the current process. Never read, echo, log, copy into `publish/`, or request either secret in chat.
+
+Check presence without exposing values:
+
+```powershell
+fupload curseforge session doctor
+```
+
+If the author ID is absent, ask for the numeric ID because it is non-secret, or use `--author-id` for that lookup. If a secret is absent, direct the user to fill the local file and rerun doctor.
+
+## Public project lookup
+
+Official request:
+
+```http
+GET https://api.curseforge.com/v1/mods/search?gameId=1&authorId=AUTHOR_ID&index=0&pageSize=50
+Accept: application/json
+x-api-key: CURSEFORGE_API_KEY
+```
+
+`gameId=1` selects World of Warcraft. The Core API defines `authorId` as filtering mods for which that author is a member; `primaryAuthorId` is the separate owner-only filter. `index` is zero-based, `pageSize` defaults to and is capped at 50, and `index + pageSize` cannot exceed 10,000.
+
+Fuploader commands:
+
+```powershell
+fupload curseforge project list
+fupload curseforge project list --author-id 138844367
+```
+
+Use `pagination.totalCount` as the count of matching public projects. Select the upload target by human-readable project name and returned numeric project ID. Do not interpret this response as a private account inventory.
+
+## Game versions
+
+Official request against the WoW Authors host:
+
+```http
+GET https://wow.curseforge.com/api/game/versions
+X-Api-Token: CURSEFORGE_UPLOAD_TOKEN
+```
+
+The response entries contain `id`, `gameVersionTypeID`, `name`, and `slug`. Use the returned IDs or official names in upload metadata.
+
+Fuploader command:
+
+```powershell
+fupload curseforge plugin game-versions
+```
+
+Fetch the current list immediately before planning an upload. Present selected names and IDs together; never derive IDs from version strings.
+
+## Plugin upload
+
+Official request:
+
+```http
+POST https://wow.curseforge.com/api/projects/{projectId}/upload-file
+X-Api-Token: CURSEFORGE_UPLOAD_TOKEN
+Content-Type: multipart/form-data; boundary=...
+
+metadata=<JSON object>
+file=<ZIP bytes>
+```
+
+The multipart request has the text field `metadata` and binary field `file`. The project ID comes from the existing project's overview URL/API record. On acceptance the official API returns JSON containing the new file `id`.
+
+Fuploader accepts the strict schema `fupload.v1.curseforge.plugin.upload`:
+
+| Field | Required | Contract |
+| --- | --- | --- |
+| `schema` | yes | Exactly `fupload.v1.curseforge.plugin.upload`. |
+| `project_id` | yes | Positive integer for an existing project. |
+| `file` | yes | Existing local ZIP path. |
+| `changelog` | yes | Release notes string. |
+| `changelog_type` | no | `text`, `html`, or `markdown`; official default is `text`. |
+| `display_name` | no | Non-empty friendly file name. |
+| `game_versions` | no | Non-empty array of numeric IDs from `plugin game-versions`; not supported with `parent_file_id`. |
+| `game_version_names` | no | Array of non-empty official game-version names. |
+| `release_type` | yes | `alpha`, `beta`, or `release`. |
+| `parent_file_id` | no | Positive parent file ID; mutually exclusive with `game_versions` and `game_version_names`. |
+| `relations` | no | Object described below. |
+| `is_marked_for_manual_release` | no | Boolean; when true, approval does not immediately release the file. |
+
+Compatibility fields are optional in the official API and executable schema. When supplied, use current values returned by `plugin game-versions`; do not combine `parent_file_id` with either version field. Example: [curseforge-plugin-upload.json](../examples/curseforge-plugin-upload.json).
+
+```powershell
+fupload curseforge plugin upload --input publish\20260807-120000-curseforge-plugin-upload\01-upload.json --dry-run
+fupload curseforge plugin upload --input publish\20260807-120000-curseforge-plugin-upload\01-upload.json
+```
+
+The executable Fuploader JSON uses snake_case. The provider maps it to the official camelCase Upload API metadata keys.
+
+## Metadata contract
+
+The official Upload API documents these metadata fields:
+
+| Official field | Fuploader field | Meaning and constraints |
+| --- | --- | --- |
+| `changelog` | `changelog` | Change description; HTML or Markdown requires matching `changelogType`. |
+| `changelogType` | `changelog_type` | `text`, `html`, or `markdown`; optional, defaults to `text`. |
+| `displayName` | `display_name` | Optional friendly display name. |
+| `parentFileID` | `parent_file_id` | Optional positive parent file ID. Fuploader rejects it together with `gameVersions` or `gameVersionNames`. |
+| `gameVersions` | `game_versions` | Optional array of numeric game-version IDs; not supported with `parentFileID`. |
+| `gameVersionNames` | `game_version_names` | Optional array of game-version names. |
+| `releaseType` | `release_type` | Required: `alpha`, `beta`, or `release`. |
+| `isMarkedForManualRelease` | `is_marked_for_manual_release` | Optional manual-release flag. |
+| `relations` | `relations` | Optional project dependency relations. |
+
+Do not put official camelCase keys directly into Fuploader input; unknown fields are rejected. `project_id` and `file` select the endpoint/body file and are not members of the metadata JSON.
+
+## Relations
+
+Fuploader input mirrors the official relation shape while using snake_case for `projectID`:
+
+```json
+{
+  "relations": {
+    "projects": [
+      {
+        "slug": "related-project-slug",
+        "project_id": 74924,
+        "type": "requiredDependency"
+      }
+    ]
+  }
+}
+```
+
+Each item requires non-empty `slug` and `type`. `project_id` is optional and, when supplied, must be a positive integer for an exact project match. Unknown relation keys are rejected. Official relation types are:
+
+- `embeddedLibrary`
+- `incompatible`
+- `optionalDependency`
+- `requiredDependency`
+- `tool`
+
+The wire mapping is `slug`, optional `projectID`, and `type` inside `relations.projects`. Resolve and show each intended related project during planning; do not guess a slug or ID.
+
+## Plan, dry-run, and confirmation
+
+Create `publish/<YYYYMMDD-HHmmss>-curseforge-plugin-upload/01-upload.json`. Store only non-secret business fields and local file paths. Never store the API key or upload token.
+
+Run `--dry-run` before confirmation. It validates strict JSON, field values, relation structure, and local file existence without authenticating, querying remote permissions, or uploading.
+
+Present one complete plan containing:
+
+- author ID and public project name plus project ID;
+- ZIP path and inspected filename;
+- selected game-version names plus IDs, or parent file ID;
+- release type, changelog/type, display name, relations, and manual-release value;
+- the exact `fupload curseforge plugin upload --input ...` command;
+- the effects boundary: acceptance is not approval, release, or public visibility.
+
+Obtain one explicit confirmation for that exact plan. If any project, file, version, parent, relation, release type, or manual-release choice changes, present and confirm the changed plan. After confirmation, issue only one upload request.
+
+## Success, visibility, and verification
+
+The Upload API success response is a JSON object containing the new file ID. Record that literal ID and exit status. This verifies that CurseForge accepted the upload request, not that moderation completed or the file is publicly visible.
+
+Visibility boundaries:
+
+- Core project search lists public projects only and has no authenticated current-account inventory.
+- Upload acceptance can precede processing, moderation, approval, manual release, and public visibility.
+- `is_marked_for_manual_release=true` intentionally adds a later author release decision after approval.
+- The public search/list response cannot verify private, draft, or pending-review state.
+
+Fuploader does not expose an authenticated uploaded-file status/readback endpoint. Use the returned file ID as the acceptance record and inspect the Authors dashboard when a later state must be confirmed. Do not describe acceptance as publication.
+
+## Errors and retry rules
+
+Interpret responses conservatively:
+
+| Result | Meaning and action |
+| --- | --- |
+| Local schema/file error | No request was sent. Correct the input and rerun dry-run. |
+| `400`/`422` | Metadata, version, relation, or multipart validation was rejected. Do not retry unchanged input. |
+| `401` | Credential missing, invalid, or expired. Regenerate/configure locally; never request it in chat. |
+| `403` | Token lacks permission for the project/action. Recheck project ownership and token scope locally. |
+| `404` | Host, project, or endpoint was not found. Confirm the WoW host and project ID. |
+| `409` | Treat as a conflicting/duplicate state; inspect the project before another write. |
+| `429` | Rate limited. Honor `Retry-After` when supplied; do not loop. |
+| `5xx` after request transmission | Outcome may be uncertain. Inspect the Authors dashboard before retrying. |
+| Network interruption/timeout during upload | Outcome is uncertain. Never automatically resend; check the project/file list first to prevent duplicates. |
+
+Expose only sanitized status, error kind, stage, and provider message. Never include request headers, secret values, or raw multipart bodies in output or logs.
+
+## Official documentation
+
+- [CurseForge for Studios introduction](https://docs.curseforge.com/docs/curseforge-for-studios/intro)
+- [CurseForge Core REST API](https://docs.curseforge.com/rest-api/): base URL, `x-api-key`, pagination, and `GET /v1/mods/search` including `authorId`/`primaryAuthorId`.
+- [CurseForge Upload API](https://support.curseforge.com/en/support/solutions/articles/9000197321-curseforge-upload-api): token generation, `X-Api-Token`, `GET /api/game/versions`, multipart `POST /api/projects/{projectId}/upload-file`, metadata, relations, and success file ID.
+- [CurseForge Authors dashboard](https://authors.curseforge.com/): project creation and non-public author state.

package/fupload/scripts/fupload_cli/__init__.py

@@ -1,3 +1,3 @@
 """Fupload Python CLI."""
 
-__version__ = "0.0.1"
+__version__ = "0.0.2"

package/fupload/scripts/fupload_cli/cli.py

@@ -10,6 +10,7 @@ from typing import Any, Callable, Dict, Optional, Sequence, Tuple
 
 from . import __version__
 from .dd import DD
+from .curseforge import CurseForge
 from .errors import FuploadError, ValidationError
 from .io import read_json, write_error, write_output
 from .newbee import NewBee
@@ -186,16 +187,30 @@ def _dd_tree(platforms: argparse._SubParsersAction) -> None:
     leaf = _read_leaf(wa, "categories", "List DD WA category choices for a game type.", platform="dd", resource="wa", action="categories"); leaf.add_argument("--game-type", type=_positive, required=True)
 
 
+def _curseforge_tree(platforms: argparse._SubParsersAction) -> None:
+    root = platforms.add_parser("curseforge", help="CurseForge public project lookup and author uploads")
+    groups = root.add_subparsers(dest="resource_command", required=True)
+    session = groups.add_parser("session", help="Configuration diagnostics").add_subparsers(dest="action_command", required=True)
+    _read_leaf(session, "doctor", "Check whether the fixed CurseForge configuration fields exist without revealing their values.", platform="curseforge", resource="session", action="doctor")
+    project = groups.add_parser("project", help="Public project lookup").add_subparsers(dest="action_command", required=True)
+    leaf = _read_leaf(project, "list", "List public WoW projects for one CurseForge author ID.", platform="curseforge", resource="project", action="list")
+    leaf.add_argument("--author-id", type=_positive, help="Override CURSEFORGE_AUTHOR_ID for this lookup.")
+    plugin = groups.add_parser("plugin", help="WoW plugin versions and uploads").add_subparsers(dest="action_command", required=True)
+    _read_leaf(plugin, "game-versions", "List CurseForge Upload API game-version choices.", platform="curseforge", resource="plugin", action="game-versions")
+    _write_leaf(plugin, "curseforge", "plugin", "upload", "Upload one plugin archive to an existing CurseForge project.")
+
+
 def build_parser() -> argparse.ArgumentParser:
     parser = _parser(
         prog="fupload",
-        description="Atomic World of Warcraft author publishing CLI for NewBeeBox and NetEase DD.",
+        description="Atomic World of Warcraft author publishing CLI for NewBeeBox, NetEase DD, and CurseForge.",
         epilog="All output is JSON. Write commands require versioned JSON through --input and never prompt.",
     )
     parser.add_argument("--version", action="version", version="%(prog)s " + __version__)
     platforms = parser.add_subparsers(dest="platform_command", required=True)
     _newbee_tree(platforms)
     _dd_tree(platforms)
+    _curseforge_tree(platforms)
     return parser
 
 
@@ -243,14 +258,14 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
             if args.dry_run:
                 write_output(platform, operation, _dry_run_data(doc, schema.name), dry_run=True)
                 return 0
-            provider = NewBee() if platform == "newbee" else DD()
+            provider = NewBee() if platform == "newbee" else (DD() if platform == "dd" else CurseForge())
             if platform == "dd":
                 data = provider.execute_write(resource, action, doc, getattr(args, "session", None))
             else:
                 data = provider.execute_write(resource, action, doc)
             write_output(platform, operation, data)
             return 0
-        provider = NewBee() if platform == "newbee" else DD()
+        provider = NewBee() if platform == "newbee" else (DD() if platform == "dd" else CurseForge())
         if platform == "dd":
             data = provider.execute_read(resource, action, args, getattr(args, "session", None))
         else:

package/fupload/scripts/fupload_cli/curseforge.py

@@ -0,0 +1,186 @@
+"""CurseForge public project lookup and author upload provider."""
+
+from __future__ import annotations
+
+import json
+import os
+import urllib.parse
+from pathlib import Path
+from typing import Any, Dict, Mapping, Optional
+
+from .errors import FuploadError, ValidationError
+from .transport import json_request, multipart_request
+
+
+CORE_BASE = "https://api.curseforge.com"
+UPLOAD_BASE = "https://wow.curseforge.com"
+CONFIG_KEYS = (
+    "CURSEFORGE_AUTHOR_ID",
+    "CURSEFORGE_API_KEY",
+    "CURSEFORGE_UPLOAD_TOKEN",
+)
+
+
+def config_path() -> Path:
+    return Path.home() / ".fupload" / "curseforge.env"
+
+
+def load_config(path: Optional[Path] = None) -> Dict[str, str]:
+    """Load only the fixed CurseForge fields, with process env taking precedence."""
+    source = path or config_path()
+    values: Dict[str, str] = {}
+    if source.is_file():
+        try:
+            lines = source.read_text(encoding="utf-8-sig").splitlines()
+        except OSError as exc:
+            raise FuploadError("cannot read CurseForge configuration: %s" % exc, stage="dependency_get") from exc
+        for number, raw in enumerate(lines, 1):
+            line = raw.strip()
+            if not line or line.startswith("#"):
+                continue
+            if "=" not in line:
+                raise ValidationError("expected NAME=VALUE", path="%s:%d" % (source, number))
+            name, value = line.split("=", 1)
+            name, value = name.strip(), value.strip()
+            if name not in CONFIG_KEYS:
+                raise ValidationError("unknown CurseForge configuration field", path="%s:%d" % (source, number))
+            if name in values:
+                raise ValidationError("duplicate CurseForge configuration field", path="%s:%d" % (source, number))
+            values[name] = value
+    for name in CONFIG_KEYS:
+        environment_value = os.environ.get(name, "").strip()
+        if environment_value:
+            values[name] = environment_value
+    return values
+
+
+def _required(config: Mapping[str, str], *names: str) -> None:
+    missing = [name for name in names if not config.get(name)]
+    if missing:
+        raise FuploadError(
+            "missing CurseForge configuration field(s): %s" % ", ".join(missing),
+            kind="authentication_error", stage="dependency_get",
+            details={"config_path": str(config_path()), "missing": missing},
+        )
+
+
+def _author_id(value: Any) -> int:
+    try:
+        result = int(value)
+    except (TypeError, ValueError) as exc:
+        raise ValidationError("author ID must be a positive integer", path="--author-id") from exc
+    if result <= 0:
+        raise ValidationError("author ID must be a positive integer", path="--author-id")
+    return result
+
+
+class CurseForge:
+    def __init__(self, config: Optional[Mapping[str, str]] = None) -> None:
+        self.config = dict(config) if config is not None else load_config()
+
+    def execute_read(self, resource: str, action: str, args: Any) -> Any:
+        if resource == "session" and action == "doctor":
+            return self.doctor()
+        if resource == "project" and action == "list":
+            return self.project_list(getattr(args, "author_id", None))
+        if resource == "plugin" and action == "game-versions":
+            return self.game_versions()
+        raise ValidationError("unsupported CurseForge read operation")
+
+    def execute_write(self, resource: str, action: str, doc: Mapping[str, Any]) -> Any:
+        if resource == "plugin" and action == "upload":
+            return self.upload(doc)
+        raise ValidationError("unsupported CurseForge write operation")
+
+    def doctor(self) -> Dict[str, Any]:
+        fields = [{"name": name, "present": bool(self.config.get(name))} for name in CONFIG_KEYS]
+        return {
+            "config_path": str(config_path()),
+            "fields": fields,
+            "ready": all(field["present"] for field in fields),
+        }
+
+    def project_list(self, author_id: Optional[int]) -> Dict[str, Any]:
+        _required(self.config, "CURSEFORGE_API_KEY")
+        selected = _author_id(author_id if author_id is not None else self.config.get("CURSEFORGE_AUTHOR_ID"))
+        query = urllib.parse.urlencode({"gameId": 1, "authorId": selected, "index": 0, "pageSize": 50})
+        url = CORE_BASE + "/v1/mods/search?" + query
+        payload = json_request(url, headers={"x-api-key": self.config["CURSEFORGE_API_KEY"]})
+        if not isinstance(payload, dict) or not isinstance(payload.get("data"), list):
+            raise FuploadError("CurseForge project response did not contain a data array", kind="platform_data_error", endpoint=url)
+        pagination = payload.get("pagination") if isinstance(payload.get("pagination"), dict) else {}
+        projects = []
+        for item in payload["data"]:
+            if not isinstance(item, dict):
+                raise FuploadError("CurseForge project response contained a non-object item", kind="platform_data_error", endpoint=url)
+            projects.append({
+                "id": item.get("id"),
+                "name": item.get("name"),
+                "slug": item.get("slug"),
+                "status": item.get("status"),
+                "dateCreated": item.get("dateCreated"),
+                "dateModified": item.get("dateModified"),
+            })
+        total_count = pagination.get("totalCount")
+        if isinstance(total_count, bool) or not isinstance(total_count, int) or total_count < 0:
+            total_count = len(projects)
+        return {
+            "author_id": selected,
+            "game_id": 1,
+            "total_count": total_count,
+            "projects": projects,
+            "pagination": pagination,
+        }
+
+    def game_versions(self) -> Any:
+        _required(self.config, "CURSEFORGE_UPLOAD_TOKEN")
+        return json_request(
+            UPLOAD_BASE + "/api/game/versions",
+            headers={"X-Api-Token": self.config["CURSEFORGE_UPLOAD_TOKEN"]},
+        )
+
+    def upload(self, doc: Mapping[str, Any]) -> Dict[str, Any]:
+        _required(self.config, "CURSEFORGE_UPLOAD_TOKEN")
+        project_id = int(doc["project_id"])
+        file_path = str(doc["file"])
+        field_names = {
+            "changelog": "changelog",
+            "changelog_type": "changelogType",
+            "display_name": "displayName",
+            "game_versions": "gameVersions",
+            "game_version_names": "gameVersionNames",
+            "release_type": "releaseType",
+            "parent_file_id": "parentFileID",
+            "is_marked_for_manual_release": "isMarkedForManualRelease",
+        }
+        metadata = {wire: doc[name] for name, wire in field_names.items() if name in doc}
+        if "relations" in doc:
+            projects = []
+            for item in doc["relations"]["projects"]:
+                relation = {"slug": item["slug"], "type": item["type"]}
+                if "project_id" in item:
+                    relation["projectID"] = item["project_id"]
+                projects.append(relation)
+            metadata["relations"] = {"projects": projects}
+        url = UPLOAD_BASE + "/api/projects/%d/upload-file" % project_id
+        response = multipart_request(
+            url, file_path, file_field="file",
+            fields={"metadata": json.dumps(metadata, ensure_ascii=False, separators=(",", ":"))},
+            headers={"X-Api-Token": self.config["CURSEFORGE_UPLOAD_TOKEN"]},
+        )
+        if (
+            not isinstance(response, dict)
+            or isinstance(response.get("id"), bool)
+            or not isinstance(response.get("id"), int)
+            or response["id"] <= 0
+        ):
+            raise FuploadError(
+                "CurseForge upload response did not contain a positive integer id",
+                kind="platform_data_error", endpoint=url,
+            )
+        return {
+            "file_id": response["id"],
+            "project_id": project_id,
+            "archive": Path(file_path).name,
+            "status": "uploaded",
+        }

package/fupload/scripts/fupload_cli/schema.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import os
+import zipfile
 from dataclasses import dataclass, field
 from typing import Any, Dict, Iterable, Mapping, Optional, Sequence, Tuple
 
@@ -306,6 +307,39 @@ class Schema:
                         raise ValidationError("expected nonempty string or null", path="$.retail_ui_config.default_edit_mode_selector")
                 if "enable_dd_setup_wizard" in retail and not isinstance(retail["enable_dd_setup_wizard"], bool):
                     raise ValidationError("expected boolean", path="$.retail_ui_config.enable_dd_setup_wizard")
+        if self.name == "fupload.v1.curseforge.plugin.upload":
+            if not zipfile.is_zipfile(value["file"]):
+                raise ValidationError("file must be a valid ZIP archive", path="$.file")
+            if "game_versions" in value and any(isinstance(item, bool) or not isinstance(item, int) or item <= 0 for item in value["game_versions"]):
+                raise ValidationError("array must contain positive integer IDs", path="$.game_versions")
+            if "game_version_names" in value and any(not isinstance(item, str) or not item.strip() for item in value["game_version_names"]):
+                raise ValidationError("array must contain nonempty strings", path="$.game_version_names")
+            relations = value.get("relations")
+            if relations is not None:
+                if set(relations) != {"projects"}:
+                    unknown = sorted(set(relations) - {"projects"})
+                    message = "unknown field(s): %s" % ", ".join(unknown) if unknown else "projects is required"
+                    raise ValidationError(message, path="$.relations")
+                if not isinstance(relations["projects"], list):
+                    raise ValidationError("expected array", path="$.relations.projects")
+            for index, relation in enumerate((relations or {}).get("projects") or []):
+                if not isinstance(relation, dict):
+                    raise ValidationError("expected object", path="$.relations.projects[%d]" % index)
+                unknown = sorted(set(relation) - {"slug", "type", "project_id"})
+                if unknown:
+                    raise ValidationError("unknown field(s): %s" % ", ".join(unknown), path="$.relations.projects[%d].%s" % (index, unknown[0]))
+                if not {"slug", "type"}.issubset(relation):
+                    raise ValidationError("slug and type are required", path="$.relations.projects[%d]" % index)
+                if not isinstance(relation["slug"], str) or not relation["slug"].strip():
+                    raise ValidationError("expected nonempty string", path="$.relations.projects[%d].slug" % index)
+                if relation["type"] not in ("embeddedLibrary", "incompatible", "optionalDependency", "requiredDependency", "tool"):
+                    raise ValidationError("unsupported relation type", path="$.relations.projects[%d].type" % index)
+                if "project_id" in relation and (isinstance(relation["project_id"], bool) or not isinstance(relation["project_id"], int) or relation["project_id"] <= 0):
+                    raise ValidationError("must be a positive integer", path="$.relations.projects[%d].project_id" % index)
+            if "parent_file_id" in value:
+                for field_name in ("game_versions", "game_version_names"):
+                    if field_name in value:
+                        raise ValidationError("must be omitted when parent_file_id is set", path="$.%s" % field_name)
 
 
 def f(type_name: str, **kwargs: Any) -> Field:
@@ -504,6 +538,20 @@ for _resource in ("plugin", "config", "wa"):
         "confirm_delete": f("boolean", choices=(True,)),
     }, ("sn", "confirm_delete")))
 
+register("curseforge", "plugin", "upload", required({
+    "project_id": f("integer", minimum=1),
+    "file": f("string", local_file=True),
+    "changelog": f("string"),
+    "changelog_type": f("string", choices=("text", "html", "markdown")),
+    "display_name": f("string", nonempty=True),
+    "game_versions": f("array", nonempty=True),
+    "game_version_names": f("array"),
+    "release_type": f("string", choices=("alpha", "beta", "release")),
+    "parent_file_id": f("integer", minimum=1),
+    "relations": f("object"),
+    "is_marked_for_manual_release": f("boolean"),
+}, ("project_id", "file", "changelog", "release_type")))
+
 
 def get_schema(platform: str, resource: str, action: str) -> Schema:
     try:

package/npm/bin/fupload.mjs

@@ -3,6 +3,7 @@
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+import { ensureCurseForgeEnv } from "../lib/curseforge-config.mjs";
 import { recordManagedSkill } from "../lib/managed-install.mjs";
 import { parseLauncherOptions, resolveSkillDirectory } from "../lib/options.mjs";
 import { discoverPython, runPython } from "../lib/python.mjs";
@@ -52,6 +53,7 @@ async function main() {
 
   let ensured;
   try {
+    ensureCurseForgeEnv();
     ensured = await ensureSkill({ packageRoot, target });
     recordManagedSkill(target);
   } catch (error) {

package/npm/lib/curseforge-config.mjs

@@ -0,0 +1,36 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+export const CURSEFORGE_ENV_TEMPLATE = [
+  "CURSEFORGE_AUTHOR_ID=",
+  "CURSEFORGE_API_KEY=",
+  "CURSEFORGE_UPLOAD_TOKEN=",
+  "",
+].join("\n");
+
+export function curseForgeEnvPath({ home = os.homedir() } = {}) {
+  return path.join(home, ".fupload", "curseforge.env");
+}
+
+export function ensureCurseForgeEnv({ home = os.homedir(), platform = process.platform } = {}) {
+  const filename = curseForgeEnvPath({ home });
+  fs.mkdirSync(path.dirname(filename), { recursive: true, mode: 0o700 });
+
+  try {
+    fs.writeFileSync(filename, CURSEFORGE_ENV_TEMPLATE, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: 0o600,
+    });
+    if (platform !== "win32") {
+      fs.chmodSync(filename, 0o600);
+    }
+    return { path: filename, status: "created" };
+  } catch (error) {
+    if (error?.code === "EEXIST") {
+      return { path: filename, status: "preserved" };
+    }
+    throw error;
+  }
+}

package/npm/lib/update.mjs

@@ -1,6 +1,7 @@
 import os from "node:os";
 import path from "node:path";
 
+import { ensureCurseForgeEnv } from "./curseforge-config.mjs";
 import { readManagedInstall, recordManagedSkill } from "./managed-install.mjs";
 import { resolveSkillDirectory } from "./options.mjs";
 import { ensureSkill, loadDistribution } from "./skill-installer.mjs";
@@ -27,6 +28,7 @@ export async function updateSelf({
   home = os.homedir(),
   runNpm = runNpmCli,
 } = {}) {
+  const curseforgeConfig = ensureCurseForgeEnv({ home, platform });
   const installation = resolveGlobalInstall(packageRoot, platform);
   const current = loadDistribution(packageRoot);
   const primary = target || resolveSkillDirectory({ env, home });
@@ -94,6 +96,7 @@ export async function updateSelf({
     from_version: current.packageRecord.version,
     to_version: updated.packageRecord.version,
     npm_exit_status: npmResult.status,
+    curseforge_config: curseforgeConfig,
     skills,
   };
 }

package/npm/postinstall.mjs

@@ -1,6 +1,7 @@
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+import { ensureCurseForgeEnv } from "./lib/curseforge-config.mjs";
 import { recordManagedSkill } from "./lib/managed-install.mjs";
 import { resolveSkillDirectory } from "./lib/options.mjs";
 import { ensureSkill } from "./lib/skill-installer.mjs";
@@ -9,9 +10,11 @@ const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "
 const target = resolveSkillDirectory();
 
 try {
+  const config = ensureCurseForgeEnv();
   const result = await ensureSkill({ packageRoot, target });
   recordManagedSkill(target);
   process.stdout.write(`Fuploader Skill ${result.status}: ${target}\n`);
+  process.stdout.write(`CurseForge configuration ${config.status}: ${config.path}\n`);
 } catch (error) {
   process.stderr.write(`Fuploader Skill installation failed: ${error.message}\n`);
   process.exitCode = 1;

package/npm/skill-manifest.json

@@ -1,14 +1,19 @@
 {
   "schema": "fupload.npm-skill-manifest.v1",
   "package_name": "@follenfang/fupload",
-  "package_version": "0.0.1",
-  "skill_version": "0.0.1",
-  "tree_sha256": "310b805667d90a590f5e1ac9f8833224e5b6a6050e4d2e3c412f712993e362a7",
+  "package_version": "0.0.2",
+  "skill_version": "0.0.2",
+  "tree_sha256": "4ea99f3fb2dee23792450b0d890dcd4520aa8ed827edddf6c6353a8cd753d32e",
   "files": [
     {
       "path": "agents/openai.yaml",
-      "bytes": 364,
-      "sha256": "8316fb299d1e77fbbca1cfc6ec80b2078372dff96940d154af425e692ea9bd58"
+      "bytes": 342,
+      "sha256": "473872fbc6fcecb2030fd2ac66589afd72f813ad47b2e6e968ee2bca4b7e6ab3"
+    },
+    {
+      "path": "examples/curseforge-plugin-upload.json",
+      "bytes": 515,
+      "sha256": "624cc03b0d6debd842270d129817904aadff67b6d462f8d1481fc95e999c053e"
     },
     {
       "path": "examples/dd-config-delete.json",
@@ -70,6 +75,11 @@
       "bytes": 168,
       "sha256": "40491e9aeddc71a4e9578264e5c42b40613e0ea5f0321da29e170b84ff9f1905"
     },
+    {
+      "path": "references/curseforge.md",
+      "bytes": 11917,
+      "sha256": "2dd0a2429a37af30c4f85a884c2e8ea6fcdb1691c34ccc0c34925890e4e60d92"
+    },
     {
       "path": "references/dd.md",
       "bytes": 16543,
@@ -93,12 +103,17 @@
     {
       "path": "scripts/fupload_cli/__init__.py",
       "bytes": 49,
-      "sha256": "c324e2309cb62d40e43669d5cf8c09f9ffe354ddb4cee317fc9d68caa0740b50"
+      "sha256": "72609f840f9864ae70d3ee5226e29dc260e132e06ea4c89b0174b3ba9313d95e"
     },
     {
       "path": "scripts/fupload_cli/cli.py",
-      "bytes": 22260,
-      "sha256": "4ab353e8c322dfaea76bce52d39fb777bcf0296a515d4065e52afe62f38ed92c"
+      "bytes": 23794,
+      "sha256": "3c01585b50e1db308444d094e60751491667ea05a98e5a51f284f098b7a8f376"
+    },
+    {
+      "path": "scripts/fupload_cli/curseforge.py",
+      "bytes": 7959,
+      "sha256": "c607c6caba5c551a7e3970bd152de94ab1e96350ee73969048f5aea5bf42c75d"
     },
     {
       "path": "scripts/fupload_cli/dd_broker.py",
@@ -137,8 +152,8 @@
     },
     {
       "path": "scripts/fupload_cli/schema.py",
-      "bytes": 31522,
-      "sha256": "8256229fd2b82db42628bc7c61ba7881035b37640483f3398bb771aa327fea21"
+      "bytes": 35113,
+      "sha256": "388c89131bf032428d2ed6c047b52c54adf2fa9d1db91833caefe7a1296acf58"
     },
     {
       "path": "scripts/fupload_cli/transport.py",
@@ -157,8 +172,8 @@
     },
     {
       "path": "SKILL.md",
-      "bytes": 18699,
-      "sha256": "ff3b6e220ffbe94361f59e9cbcc925c9ddb3568c655ce908ad4117b75f0a89fc"
+      "bytes": 21764,
+      "sha256": "ea2019f79aca3a6420aff657fa29b75fd731fc0b3fa4941068e0cfce0921afba"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@follenfang/fupload",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Install and run the Fuploader Agent Skill and Python CLI.",
   "type": "module",
   "bin": {