@follenfang/fupload 0.0.1 → 0.0.4

package/fupload/scripts/fupload_cli/blackbox.py

@@ -0,0 +1,151 @@
+"""Heybox Workshop plugin provider."""
+from __future__ import annotations
+import hashlib, json, secrets, time
+from pathlib import Path
+from urllib.parse import urlencode
+from urllib.request import Request, urlopen
+from typing import Any, Mapping
+from .errors import FuploadError, ValidationError
+from .blackbox_auth import API_BASE, hkey, load_session
+
+class Blackbox:
+    def __init__(self, config: Mapping[str, Any] | None = None, transport=None):
+        self.config = dict(config or {})
+        self.profile = Path(self.config.get("client_profile") or Path.home() / "AppData/Roaming/heybox-pc-launcher")
+        self._transport = transport
+    def _request(self, method, path, body=None, query=None):
+        if self._transport: return self._transport(method, path, body or {}, query or {})
+        cookies, identity = load_session(self.profile); ts=int(time.time()); nonce=hashlib.md5((str(ts)+secrets.token_hex(16)).encode()).hexdigest().upper()
+        params={**identity,"version":identity.get("version","1.12.0"),"hkey":hkey(path,ts,nonce),"_time":ts,"_chat_time":int(time.time()*1000),"nonce":nonce,**(query or {})}
+        headers={"User-Agent":"HeyboxApp/1.12.0","x_xhh_tokenid":cookies["x_xhh_tokenid"],"Cookie":"; ".join(f"{k}={v}" for k,v in cookies.items()),"Content-Type":"application/x-www-form-urlencoded"}
+        url=API_BASE+path+"?"+urlencode(params); data=urlencode(body or {},doseq=True).encode() if method=="POST" else None
+        try:
+            with urlopen(Request(url,data=data,headers=headers,method=method),timeout=60) as r: result=json.loads(r.read().decode())
+        except Exception as exc: raise FuploadError("Workshop API request failed", endpoint=path, verification_required=method=="POST") from exc
+        if not isinstance(result,dict) or result.get("status")!="ok": raise FuploadError("Workshop API rejected request", endpoint=path, details={"status":result.get("status") if isinstance(result,dict) else None})
+        return result
+    @staticmethod
+    def _result(payload): return payload.get("result") or {}
+    def execute_read(self, resource: str, action: str, args: Any):
+        if resource == "plugin" and action in ("list", "get", "versions"):
+            if action == "list": return self.plugin_list()
+            module_id = getattr(args,"module_id",None) if not isinstance(args,Mapping) else args.get("module_id")
+            result = self.plugin_get(int(module_id))
+            return result["versions"] if action == "versions" else result
+        raise ValidationError("unsupported blackbox read operation")
+    def execute_write(self, resource: str, action: str, doc: Mapping[str,Any]):
+        if doc.get("dry_run"): return {"dry_run":True,"operation":f"{resource}.{action}","fields":sorted(k for k in doc if k not in {"dry_run","schema"})}
+        if resource == "plugin" and action == "edit": return self.module_edit(doc)
+        if resource == "plugin" and action == "update": return self.version_upsert(doc)
+        if resource=="version" and action in ("create","update","edit"): return self.version_upsert(doc)
+        if resource=="version" and action=="delete": return self.version_delete(doc)
+        raise ValidationError("unsupported blackbox write operation")
+    def plugin_list(self):
+        rows=self._result(self._request("GET","/wow/open_platform/module/list/")).get("moduleList") or []
+        return {"total_count":len(rows),"plugins":[self._redact(x) for x in rows if isinstance(x,dict)]}
+    def plugin_get(self,module_id:int):
+        detail=self._result(self._request("GET","/wow/open_platform/module/detail/",query={"moduleId":module_id}))
+        versions=self._result(self._request("GET","/wow/open_platform/module_version/list/",query={"moduleId":module_id,"offset":0,"limit":100}))
+        return {"module":self._redact(detail.get("module") or detail),"versions":[self._redact(x) for x in (versions.get("versionList") or [])]}
+    def module_edit(self,doc):
+        aliases={"module_id":"id","logo_url":"logoUrl","category_ids":"categoryIds","official_url":"officialUrl","core_folders":"coreFolders"}
+        normalized={aliases.get(k,k):v for k,v in doc.items() if k not in {"schema","dry_run"}}
+        if "id" not in normalized: raise ValidationError("id is required",path="$.id")
+        module_id = int(normalized["id"])
+        current = self.plugin_get(module_id)["module"]
+        # The web client sends a complete module object; preserve omitted fields.
+        defaults = {"name":"", "logoUrl":"", "id":module_id, "categoryIds":[],
+                    "type":1, "desc":"", "official":"", "officialUrl":"", "coreFolders":""}
+        fields={key: normalized.get(key, current.get(key, defaults[key]))
+                for key in ("name","logoUrl","id","categoryIds","type","desc","official","officialUrl","coreFolders")}
+        fields["id"] = module_id
+        if isinstance(fields.get("coreFolders"),list): fields["coreFolders"]=",".join(map(str,fields["coreFolders"]))
+        response=self._request("POST","/wow/open_platform/module/update/",body=fields)
+        actual=self.plugin_get(module_id)["module"]
+        mismatches=[]
+        for key,wanted in ((aliases.get(key,key), value) for key,value in normalized.items() if key in aliases or key in fields):
+            observed=actual.get(key)
+            if key=="coreFolders" and isinstance(observed,list): wanted=[x for x in str(wanted).split(",") if x]
+            if observed != wanted: mismatches.append(key)
+        if mismatches: raise FuploadError("module update readback mismatch",kind="verification_required",verification_required=True,details={"fields":mismatches})
+        return {"accepted":True,"verified":True,"module_id":module_id,"response":self._redact(response)}
+    def version_upsert(self,doc):
+        aliases={"module_id":"moduleId","version_id":"versionId","game_versions":"gameVersions","file_url":"fileUrl"}
+        normalized={aliases.get(k,k):v for k,v in doc.items() if k not in {"schema","dry_run"}}
+        if "file" in normalized and "fileUrl" not in normalized:
+            normalized["fileUrl"]=self.upload_zip(int(normalized["moduleId"]),str(normalized["file"]))["url"]
+        if "fileUrl" not in normalized and "versionId" in normalized:
+            existing = self._find_version(int(normalized["moduleId"]), int(normalized["versionId"]))
+            if existing and existing.get("fileUrlHeybox"):
+                normalized["fileUrl"] = existing["fileUrlHeybox"]
+        required=("moduleId","name","type","gameVersions","fileUrl")
+        missing=[k for k in required if k not in normalized]
+        if missing: raise ValidationError("missing field(s): %s"%", ".join(missing))
+        games=normalized["gameVersions"] if isinstance(normalized["gameVersions"],list) else [x for x in str(normalized["gameVersions"]).split(",") if x]
+        body={"moduleId":int(normalized["moduleId"]),"name":normalized["name"],"type":int(normalized["type"]),"gameVersions":",".join(map(str,games)),"fileUrl":normalized["fileUrl"]}
+        if "versionId" in normalized: body["versionId"]=int(normalized["versionId"])
+        response=self._request("POST","/wow/open_platform/module_version/upsert/",body=body)
+        found=self._wait_version(body["moduleId"],body.get("versionId"),body["name"],
+                                 expected={"name":body["name"],"type":body["type"],"gameVersions":list(map(str,games))})
+        mismatches=[key for key,wanted in {"name":body["name"],"type":body["type"],"gameVersions":list(map(str,games))}.items() if found.get(key)!=wanted]
+        if not found.get("fileUrlHeybox"):
+            mismatches.append("fileUrl")
+        if mismatches: raise FuploadError("version upsert readback mismatch",kind="verification_required",verification_required=True,details={"fields":mismatches})
+        return {"accepted":True,"verified":True,"module_id":body["moduleId"],"version_id":found.get("id"),"readback":self._redact(found),"response":self._redact(response)}
+    def version_delete(self,doc):
+        version_id=doc.get("versionId",doc.get("version_id")); module_id=doc.get("moduleId",doc.get("module_id"))
+        if version_id is None or module_id is None: raise ValidationError("versionId and moduleId are required")
+        response=self._request("POST","/wow/open_platform/module_version/delete/",body={"versionId":int(version_id),"moduleId":int(module_id)})
+        found=self._wait_version(int(module_id),int(version_id),None,deleted=True)
+        retry = False
+        settle = float(self.config.get("delete_settle_seconds", 10))
+        if settle:
+            time.sleep(settle)
+            current = self._find_version(int(module_id), int(version_id))
+            if current is not None and current.get("auditState") != 4:
+                retry = True
+                response = self._request("POST","/wow/open_platform/module_version/delete/",body={"versionId":int(version_id),"moduleId":int(module_id)})
+                found = self._wait_version(int(module_id),int(version_id),None,deleted=True)
+        return {"accepted":True,"verified":True,"module_id":int(module_id),"version_id":int(version_id),"audit_state":found.get("auditState") if found else None,"retry":retry,"response":self._redact(response)}
+    def _version_rows(self,module_id):
+        return self._result(self._request("GET","/wow/open_platform/module_version/list/",query={"moduleId":module_id,"offset":0,"limit":100})).get("versionList") or []
+
+    def _find_version(self, module_id, version_id):
+        return next((x for x in self._version_rows(module_id) if x.get("id") == version_id), None)
+    def _wait_version(self,module_id,version_id,name,deleted=False,expected=None):
+        for attempt in range(int(self.config.get("verify_attempts",20))):
+            rows=self._version_rows(module_id)
+            found=next((x for x in rows if (version_id is not None and x.get("id")==version_id) or (version_id is None and x.get("name")==name)),None)
+            matches_expected = found and all(
+                (list(map(str, found.get(key) or [])) if key == "gameVersions" else found.get(key)) == wanted
+                for key, wanted in (expected or {}).items()
+            )
+            if (deleted and (found is None or found.get("auditState")==4)) or (not deleted and found and matches_expected): return found or {}
+            if attempt+1<int(self.config.get("verify_attempts",20)): time.sleep(float(self.config.get("verify_interval",2)))
+        raise FuploadError("version write was not confirmed by readback",kind="verification_required",verification_required=True)
+    @staticmethod
+    def _redact(value):
+        if isinstance(value,dict): return {k:("<redacted>" if any(s in k.lower() for s in ("token","secret","cookie","nonce","hkey")) else Blackbox._redact(v)) for k,v in value.items()}
+        if isinstance(value,list): return [Blackbox._redact(v) for v in value]
+        return value
+
+    def upload_zip(self, module_id: int, file_path: str, *, dry_run=False):
+        path=Path(file_path)
+        if not path.is_file(): raise ValidationError("file does not exist",path="$.file")
+        if dry_run: return {"dry_run":True,"bytes":path.stat().st_size,"sha256":hashlib.sha256(path.read_bytes()).hexdigest()}
+        size_mb=path.stat().st_size/1024/1024
+        token=self._result(self._request("POST","/wow/cos/upload/token/",body={"jsonData":json.dumps({"upload_infos":[{"filename":path.name,"file_size":size_mb,"type":"module"}]},separators=(",",":"))}))
+        info=token["info"]; f=token["files"][0]; creds=info["Credentials"].get("Credentials",info["Credentials"])
+        try:
+            from qcloud_cos import CosConfig, CosS3Client
+        except ModuleNotFoundError as exc:
+            raise FuploadError(
+                "Heybox ZIP upload requires cos-python-sdk-v5",
+                kind="environment_error",
+                details={"install_command":"python -m pip install cos-python-sdk-v5"},
+            ) from exc
+        try:
+            cos=CosS3Client(CosConfig(Region=info.get("region") or "ap-shanghai",SecretId=creds["TmpSecretID"],SecretKey=creds["TmpSecretKey"],Token=creds["Token"],Scheme="https"))
+            with path.open("rb") as stream: cos.put_object(Bucket=info["bucket"],Key=f["key"],Body=stream)
+        except Exception as exc: raise FuploadError("COS upload failed",verification_required=True) from exc
+        return {"url":"https://%s/%s"%(info["host"],f["key"]),"bytes":path.stat().st_size,"sha256":hashlib.sha256(path.read_bytes()).hexdigest()}

package/fupload/scripts/fupload_cli/blackbox_auth.py

@@ -0,0 +1,54 @@
+"""Authentication helpers for the Heybox desktop Workshop client."""
+from __future__ import annotations
+import hashlib, json, secrets, sqlite3, time
+from pathlib import Path
+from urllib.parse import parse_qs, urlparse
+from .errors import FuploadError
+
+API_BASE = "https://workshopapi.xiaoheihe.cn"
+_ALPHABET = "AB45STUVWZEFGJ6CH01D237IXYPQRKLMN89"
+
+def _n8(value: str, limit: int) -> str:
+    table = _ALPHABET[:limit]
+    return "".join(table[ord(ch) % len(table)] for ch in value)
+def _i8(value: str) -> str:
+    return "".join(_ALPHABET[ord(ch) % len(_ALPHABET)] for ch in value)
+def _interleave(parts):
+    return "".join(part[i] for i in range(max(map(len, parts))) for part in parts if i < len(part))
+def _mix(values):
+    def p(x): return ((x << 1) ^ 27) & 255 if x & 128 else (x << 1) & 255
+    def hm(x): return p(x) ^ x
+    def qg(x): return hm(p(x))
+    def dx(x): return qg(hm(p(x)))
+    def mw(x): return dx(x) ^ qg(x) ^ hm(x)
+    a,b,c,d,*rest=values
+    return [mw(a)^dx(b)^qg(c)^hm(d), hm(a)^mw(b)^dx(c)^qg(d), qg(a)^hm(b)^mw(c)^dx(d), dx(a)^qg(b)^hm(c)^mw(d), *rest]
+def hkey(path: str, timestamp: int, nonce: str) -> str:
+    normalized = "/" + "/".join(x for x in path.split("/") if x) + "/"
+    digest = hashlib.md5(_interleave([_n8(str(timestamp), -2), _i8(normalized), _i8(nonce)]).encode()).hexdigest()
+    return _n8(digest[:5], -4) + "%02d" % (sum(_mix([ord(x) for x in digest[-6:]])) % 100)
+
+def load_session(profile: Path | None = None):
+    profile = profile or Path.home() / "AppData/Roaming/heybox-pc-launcher"
+    db = profile / "Network/Cookies"
+    try:
+        with sqlite3.connect("file:%s?mode=ro" % db, uri=True) as con:
+            rows = con.execute("select name,value from cookies where host_key like '%xiaoheihe.cn'").fetchall()
+    except (OSError, sqlite3.Error) as exc:
+        raise FuploadError("Heybox desktop Cookie DB is missing", kind="authentication_error") from exc
+    cookies = {str(k): str(v) for k,v in rows if k in {"user_heybox_id","user_pkey","x_xhh_tokenid"} and v}
+    if not {"user_heybox_id","user_pkey","x_xhh_tokenid"} <= set(cookies):
+        raise FuploadError("Heybox desktop login state is incomplete", kind="authentication_error")
+    identity = {}
+    scope = profile / "sentry/scope_v3.json"
+    try:
+        crumbs = json.loads(scope.read_text(encoding="utf-8")).get("scope",{}).get("breadcrumbs",[])
+        for crumb in reversed(crumbs):
+            raw = crumb.get("data",{}).get("url","")
+            if "x_app=heybox_pc" in raw:
+                query = parse_qs(urlparse(raw).query)
+                allowed = {"x_client_type","x_os_type","x_app","version","exe_version","os_version","device_id","channel","heybox_id"}
+                identity = {k:v[-1] for k,v in query.items() if k in allowed and v}; break
+    except (OSError, ValueError, TypeError):
+        pass
+    return cookies, identity

package/fupload/scripts/fupload_cli/cli.py

@@ -10,6 +10,8 @@ from typing import Any, Callable, Dict, Optional, Sequence, Tuple
 
 from . import __version__
 from .dd import DD
+from .curseforge import CurseForge
+from .blackbox import Blackbox
 from .errors import FuploadError, ValidationError
 from .io import read_json, write_error, write_output
 from .newbee import NewBee
@@ -57,9 +59,10 @@ def _list_flags(parser: argparse.ArgumentParser, *, offset: bool = False, game_t
         parser.add_argument("--game-type", type=_positive, required=True, help="DD game type selected from `dd options game-types`.")
 
 
-def _write_leaf(parent: argparse._SubParsersAction, platform: str, resource: str, action: str, summary: str) -> None:
+def _write_leaf(parent: argparse._SubParsersAction, platform: str, resource: str, action: str, summary: str, *, command: Optional[str] = None) -> None:
+    command = command or action
     leaf = parent.add_parser(
-        action, help=summary, description=summary + "\n\n" + WRITE_HELP,
+        command, help=summary, description=summary + "\n\n" + WRITE_HELP,
         epilog=schema_help(platform, resource, action),
         formatter_class=argparse.RawDescriptionHelpFormatter,
     )
@@ -186,16 +189,50 @@ def _dd_tree(platforms: argparse._SubParsersAction) -> None:
     leaf = _read_leaf(wa, "categories", "List DD WA category choices for a game type.", platform="dd", resource="wa", action="categories"); leaf.add_argument("--game-type", type=_positive, required=True)
 
 
+def _curseforge_tree(platforms: argparse._SubParsersAction) -> None:
+    root = platforms.add_parser("curseforge", help="CurseForge public project lookup and author uploads")
+    groups = root.add_subparsers(dest="resource_command", required=True)
+    session = groups.add_parser("session", help="Configuration diagnostics").add_subparsers(dest="action_command", required=True)
+    _read_leaf(session, "doctor", "Check whether the fixed CurseForge configuration fields exist without revealing their values.", platform="curseforge", resource="session", action="doctor")
+    project = groups.add_parser("project", help="Public project lookup").add_subparsers(dest="action_command", required=True)
+    leaf = _read_leaf(project, "list", "List public WoW projects for one CurseForge author ID.", platform="curseforge", resource="project", action="list")
+    leaf.add_argument("--author-id", type=_positive, help="Override CURSEFORGE_AUTHOR_ID for this lookup.")
+    plugin = groups.add_parser("plugin", help="WoW plugin versions and uploads").add_subparsers(dest="action_command", required=True)
+    _read_leaf(plugin, "game-versions", "List CurseForge Upload API game-version choices.", platform="curseforge", resource="plugin", action="game-versions")
+    _write_leaf(plugin, "curseforge", "plugin", "upload", "Upload one plugin archive to an existing CurseForge project.")
+
+
+def _blackbox_tree(platforms: argparse._SubParsersAction) -> None:
+    root = platforms.add_parser(
+        "blackbox",
+        help="Heybox Workshop plugin management",
+        description="Reuse the signed-in Heybox desktop client login state; no credential input is accepted.",
+    )
+    groups = root.add_subparsers(dest="resource_command", required=True)
+    plugin = groups.add_parser("plugin", help="Heybox Workshop plugin metadata and versions").add_subparsers(dest="action_command", required=True)
+    _read_leaf(plugin, "list", "List plugins managed by the current Heybox Workshop account.", platform="blackbox", resource="plugin", action="list")
+    leaf = _read_leaf(plugin, "get", "Read one Heybox Workshop plugin and its versions.", platform="blackbox", resource="plugin", action="get")
+    leaf.add_argument("--module-id", type=_positive, required=True)
+    leaf = _read_leaf(plugin, "versions", "List versions for one Heybox Workshop plugin.", platform="blackbox", resource="plugin", action="versions")
+    leaf.add_argument("--module-id", type=_positive, required=True)
+    _write_leaf(plugin, "blackbox", "plugin", "edit", "Edit Heybox Workshop plugin metadata and verify the module readback.")
+    _write_leaf(plugin, "blackbox", "plugin", "update", "Upload a ZIP and create a new Heybox Workshop plugin version.")
+    _write_leaf(plugin, "blackbox", "version", "edit", "Edit an existing Heybox Workshop plugin version and verify its readback.", command="version-edit")
+    _write_leaf(plugin, "blackbox", "version", "delete", "Soft-delete one Heybox Workshop plugin version and verify its deleted state.", command="version-delete")
+
+
 def build_parser() -> argparse.ArgumentParser:
     parser = _parser(
         prog="fupload",
-        description="Atomic World of Warcraft author publishing CLI for NewBeeBox and NetEase DD.",
+        description="Atomic World of Warcraft author publishing CLI for NewBeeBox, NetEase DD, and CurseForge.",
         epilog="All output is JSON. Write commands require versioned JSON through --input and never prompt.",
     )
     parser.add_argument("--version", action="version", version="%(prog)s " + __version__)
     platforms = parser.add_subparsers(dest="platform_command", required=True)
     _newbee_tree(platforms)
     _dd_tree(platforms)
+    _curseforge_tree(platforms)
+    _blackbox_tree(platforms)
     return parser
 
 
@@ -243,14 +280,14 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
             if args.dry_run:
                 write_output(platform, operation, _dry_run_data(doc, schema.name), dry_run=True)
                 return 0
-            provider = NewBee() if platform == "newbee" else DD()
+            provider = NewBee() if platform == "newbee" else (DD() if platform == "dd" else (Blackbox() if platform == "blackbox" else CurseForge()))
             if platform == "dd":
                 data = provider.execute_write(resource, action, doc, getattr(args, "session", None))
             else:
                 data = provider.execute_write(resource, action, doc)
             write_output(platform, operation, data)
             return 0
-        provider = NewBee() if platform == "newbee" else DD()
+        provider = NewBee() if platform == "newbee" else (DD() if platform == "dd" else (Blackbox() if platform == "blackbox" else CurseForge()))
         if platform == "dd":
             data = provider.execute_read(resource, action, args, getattr(args, "session", None))
         else:

package/fupload/scripts/fupload_cli/curseforge.py

@@ -0,0 +1,186 @@
+"""CurseForge public project lookup and author upload provider."""
+
+from __future__ import annotations
+
+import json
+import os
+import urllib.parse
+from pathlib import Path
+from typing import Any, Dict, Mapping, Optional
+
+from .errors import FuploadError, ValidationError
+from .transport import json_request, multipart_request
+
+
+CORE_BASE = "https://api.curseforge.com"
+UPLOAD_BASE = "https://wow.curseforge.com"
+CONFIG_KEYS = (
+    "CURSEFORGE_AUTHOR_ID",
+    "CURSEFORGE_API_KEY",
+    "CURSEFORGE_UPLOAD_TOKEN",
+)
+
+
+def config_path() -> Path:
+    return Path.home() / ".fupload" / "curseforge.env"
+
+
+def load_config(path: Optional[Path] = None) -> Dict[str, str]:
+    """Load only the fixed CurseForge fields, with process env taking precedence."""
+    source = path or config_path()
+    values: Dict[str, str] = {}
+    if source.is_file():
+        try:
+            lines = source.read_text(encoding="utf-8-sig").splitlines()
+        except OSError as exc:
+            raise FuploadError("cannot read CurseForge configuration: %s" % exc, stage="dependency_get") from exc
+        for number, raw in enumerate(lines, 1):
+            line = raw.strip()
+            if not line or line.startswith("#"):
+                continue
+            if "=" not in line:
+                raise ValidationError("expected NAME=VALUE", path="%s:%d" % (source, number))
+            name, value = line.split("=", 1)
+            name, value = name.strip(), value.strip()
+            if name not in CONFIG_KEYS:
+                raise ValidationError("unknown CurseForge configuration field", path="%s:%d" % (source, number))
+            if name in values:
+                raise ValidationError("duplicate CurseForge configuration field", path="%s:%d" % (source, number))
+            values[name] = value
+    for name in CONFIG_KEYS:
+        environment_value = os.environ.get(name, "").strip()
+        if environment_value:
+            values[name] = environment_value
+    return values
+
+
+def _required(config: Mapping[str, str], *names: str) -> None:
+    missing = [name for name in names if not config.get(name)]
+    if missing:
+        raise FuploadError(
+            "missing CurseForge configuration field(s): %s" % ", ".join(missing),
+            kind="authentication_error", stage="dependency_get",
+            details={"config_path": str(config_path()), "missing": missing},
+        )
+
+
+def _author_id(value: Any) -> int:
+    try:
+        result = int(value)
+    except (TypeError, ValueError) as exc:
+        raise ValidationError("author ID must be a positive integer", path="--author-id") from exc
+    if result <= 0:
+        raise ValidationError("author ID must be a positive integer", path="--author-id")
+    return result
+
+
+class CurseForge:
+    def __init__(self, config: Optional[Mapping[str, str]] = None) -> None:
+        self.config = dict(config) if config is not None else load_config()
+
+    def execute_read(self, resource: str, action: str, args: Any) -> Any:
+        if resource == "session" and action == "doctor":
+            return self.doctor()
+        if resource == "project" and action == "list":
+            return self.project_list(getattr(args, "author_id", None))
+        if resource == "plugin" and action == "game-versions":
+            return self.game_versions()
+        raise ValidationError("unsupported CurseForge read operation")
+
+    def execute_write(self, resource: str, action: str, doc: Mapping[str, Any]) -> Any:
+        if resource == "plugin" and action == "upload":
+            return self.upload(doc)
+        raise ValidationError("unsupported CurseForge write operation")
+
+    def doctor(self) -> Dict[str, Any]:
+        fields = [{"name": name, "present": bool(self.config.get(name))} for name in CONFIG_KEYS]
+        return {
+            "config_path": str(config_path()),
+            "fields": fields,
+            "ready": all(field["present"] for field in fields),
+        }
+
+    def project_list(self, author_id: Optional[int]) -> Dict[str, Any]:
+        _required(self.config, "CURSEFORGE_API_KEY")
+        selected = _author_id(author_id if author_id is not None else self.config.get("CURSEFORGE_AUTHOR_ID"))
+        query = urllib.parse.urlencode({"gameId": 1, "authorId": selected, "index": 0, "pageSize": 50})
+        url = CORE_BASE + "/v1/mods/search?" + query
+        payload = json_request(url, headers={"x-api-key": self.config["CURSEFORGE_API_KEY"]})
+        if not isinstance(payload, dict) or not isinstance(payload.get("data"), list):
+            raise FuploadError("CurseForge project response did not contain a data array", kind="platform_data_error", endpoint=url)
+        pagination = payload.get("pagination") if isinstance(payload.get("pagination"), dict) else {}
+        projects = []
+        for item in payload["data"]:
+            if not isinstance(item, dict):
+                raise FuploadError("CurseForge project response contained a non-object item", kind="platform_data_error", endpoint=url)
+            projects.append({
+                "id": item.get("id"),
+                "name": item.get("name"),
+                "slug": item.get("slug"),
+                "status": item.get("status"),
+                "dateCreated": item.get("dateCreated"),
+                "dateModified": item.get("dateModified"),
+            })
+        total_count = pagination.get("totalCount")
+        if isinstance(total_count, bool) or not isinstance(total_count, int) or total_count < 0:
+            total_count = len(projects)
+        return {
+            "author_id": selected,
+            "game_id": 1,
+            "total_count": total_count,
+            "projects": projects,
+            "pagination": pagination,
+        }
+
+    def game_versions(self) -> Any:
+        _required(self.config, "CURSEFORGE_UPLOAD_TOKEN")
+        return json_request(
+            UPLOAD_BASE + "/api/game/versions",
+            headers={"X-Api-Token": self.config["CURSEFORGE_UPLOAD_TOKEN"]},
+        )
+
+    def upload(self, doc: Mapping[str, Any]) -> Dict[str, Any]:
+        _required(self.config, "CURSEFORGE_UPLOAD_TOKEN")
+        project_id = int(doc["project_id"])
+        file_path = str(doc["file"])
+        field_names = {
+            "changelog": "changelog",
+            "changelog_type": "changelogType",
+            "display_name": "displayName",
+            "game_versions": "gameVersions",
+            "game_version_names": "gameVersionNames",
+            "release_type": "releaseType",
+            "parent_file_id": "parentFileID",
+            "is_marked_for_manual_release": "isMarkedForManualRelease",
+        }
+        metadata = {wire: doc[name] for name, wire in field_names.items() if name in doc}
+        if "relations" in doc:
+            projects = []
+            for item in doc["relations"]["projects"]:
+                relation = {"slug": item["slug"], "type": item["type"]}
+                if "project_id" in item:
+                    relation["projectID"] = item["project_id"]
+                projects.append(relation)
+            metadata["relations"] = {"projects": projects}
+        url = UPLOAD_BASE + "/api/projects/%d/upload-file" % project_id
+        response = multipart_request(
+            url, file_path, file_field="file",
+            fields={"metadata": json.dumps(metadata, ensure_ascii=False, separators=(",", ":"))},
+            headers={"X-Api-Token": self.config["CURSEFORGE_UPLOAD_TOKEN"]},
+        )
+        if (
+            not isinstance(response, dict)
+            or isinstance(response.get("id"), bool)
+            or not isinstance(response.get("id"), int)
+            or response["id"] <= 0
+        ):
+            raise FuploadError(
+                "CurseForge upload response did not contain a positive integer id",
+                kind="platform_data_error", endpoint=url,
+            )
+        return {
+            "file_id": response["id"],
+            "project_id": project_id,
+            "archive": Path(file_path).name,
+            "status": "uploaded",
+        }

package/fupload/scripts/fupload_cli/schema.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import os
+import zipfile
 from dataclasses import dataclass, field
 from typing import Any, Dict, Iterable, Mapping, Optional, Sequence, Tuple
 
@@ -306,6 +307,39 @@ class Schema:
                         raise ValidationError("expected nonempty string or null", path="$.retail_ui_config.default_edit_mode_selector")
                 if "enable_dd_setup_wizard" in retail and not isinstance(retail["enable_dd_setup_wizard"], bool):
                     raise ValidationError("expected boolean", path="$.retail_ui_config.enable_dd_setup_wizard")
+        if self.name == "fupload.v1.curseforge.plugin.upload":
+            if not zipfile.is_zipfile(value["file"]):
+                raise ValidationError("file must be a valid ZIP archive", path="$.file")
+            if "game_versions" in value and any(isinstance(item, bool) or not isinstance(item, int) or item <= 0 for item in value["game_versions"]):
+                raise ValidationError("array must contain positive integer IDs", path="$.game_versions")
+            if "game_version_names" in value and any(not isinstance(item, str) or not item.strip() for item in value["game_version_names"]):
+                raise ValidationError("array must contain nonempty strings", path="$.game_version_names")
+            relations = value.get("relations")
+            if relations is not None:
+                if set(relations) != {"projects"}:
+                    unknown = sorted(set(relations) - {"projects"})
+                    message = "unknown field(s): %s" % ", ".join(unknown) if unknown else "projects is required"
+                    raise ValidationError(message, path="$.relations")
+                if not isinstance(relations["projects"], list):
+                    raise ValidationError("expected array", path="$.relations.projects")
+            for index, relation in enumerate((relations or {}).get("projects") or []):
+                if not isinstance(relation, dict):
+                    raise ValidationError("expected object", path="$.relations.projects[%d]" % index)
+                unknown = sorted(set(relation) - {"slug", "type", "project_id"})
+                if unknown:
+                    raise ValidationError("unknown field(s): %s" % ", ".join(unknown), path="$.relations.projects[%d].%s" % (index, unknown[0]))
+                if not {"slug", "type"}.issubset(relation):
+                    raise ValidationError("slug and type are required", path="$.relations.projects[%d]" % index)
+                if not isinstance(relation["slug"], str) or not relation["slug"].strip():
+                    raise ValidationError("expected nonempty string", path="$.relations.projects[%d].slug" % index)
+                if relation["type"] not in ("embeddedLibrary", "incompatible", "optionalDependency", "requiredDependency", "tool"):
+                    raise ValidationError("unsupported relation type", path="$.relations.projects[%d].type" % index)
+                if "project_id" in relation and (isinstance(relation["project_id"], bool) or not isinstance(relation["project_id"], int) or relation["project_id"] <= 0):
+                    raise ValidationError("must be a positive integer", path="$.relations.projects[%d].project_id" % index)
+            if "parent_file_id" in value:
+                for field_name in ("game_versions", "game_version_names"):
+                    if field_name in value:
+                        raise ValidationError("must be omitted when parent_file_id is set", path="$.%s" % field_name)
 
 
 def f(type_name: str, **kwargs: Any) -> Field:
@@ -504,6 +538,38 @@ for _resource in ("plugin", "config", "wa"):
         "confirm_delete": f("boolean", choices=(True,)),
     }, ("sn", "confirm_delete")))
 
+register("curseforge", "plugin", "upload", required({
+    "project_id": f("integer", minimum=1),
+    "file": f("string", local_file=True),
+    "changelog": f("string"),
+    "changelog_type": f("string", choices=("text", "html", "markdown")),
+    "display_name": f("string", nonempty=True),
+    "game_versions": f("array", nonempty=True),
+    "game_version_names": f("array"),
+    "release_type": f("string", choices=("alpha", "beta", "release")),
+    "parent_file_id": f("integer", minimum=1),
+    "relations": f("object"),
+    "is_marked_for_manual_release": f("boolean"),
+}, ("project_id", "file", "changelog", "release_type")))
+
+register("blackbox", "plugin", "edit", required({
+    "id": f("integer"), "name": f("string"), "logo_url": f("string"), "category_ids": f("array"),
+    "type": f("integer", choices=(1, 9)), "desc": f("string"), "official": f("string"),
+    "official_url": f("string"), "core_folders": f("array"),
+}, ("id",)))
+register("blackbox", "plugin", "update", required({
+    "module_id": f("integer"), "name": f("string", nonempty=True), "type": f("integer", choices=(1, 2, 3)),
+    "game_versions": f("array", nonempty=True), "file": f("string", local_file=True), "file_url": f("string"),
+}, ("module_id", "name", "type", "game_versions", "file")))
+register("blackbox", "version", "edit", required({
+    "version_id": f("integer"), "module_id": f("integer"), "name": f("string", nonempty=True),
+    "type": f("integer", choices=(1, 2, 3)), "game_versions": f("array", nonempty=True),
+    "file": f("string", local_file=True), "file_url": f("string"),
+}, ("version_id", "module_id", "name", "type", "game_versions")))
+register("blackbox", "version", "delete", required({
+    "version_id": f("integer"), "module_id": f("integer"),
+}, ("version_id", "module_id")))
+
 
 def get_schema(platform: str, resource: str, action: str) -> Schema:
     try:

package/npm/bin/fupload.mjs

@@ -3,6 +3,7 @@
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+import { ensureCurseForgeEnv } from "../lib/curseforge-config.mjs";
 import { recordManagedSkill } from "../lib/managed-install.mjs";
 import { parseLauncherOptions, resolveSkillDirectory } from "../lib/options.mjs";
 import { discoverPython, runPython } from "../lib/python.mjs";
@@ -52,6 +53,7 @@ async function main() {
 
   let ensured;
   try {
+    ensureCurseForgeEnv();
     ensured = await ensureSkill({ packageRoot, target });
     recordManagedSkill(target);
   } catch (error) {

package/npm/lib/curseforge-config.mjs

@@ -0,0 +1,36 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+export const CURSEFORGE_ENV_TEMPLATE = [
+  "CURSEFORGE_AUTHOR_ID=",
+  "CURSEFORGE_API_KEY=",
+  "CURSEFORGE_UPLOAD_TOKEN=",
+  "",
+].join("\n");
+
+export function curseForgeEnvPath({ home = os.homedir() } = {}) {
+  return path.join(home, ".fupload", "curseforge.env");
+}
+
+export function ensureCurseForgeEnv({ home = os.homedir(), platform = process.platform } = {}) {
+  const filename = curseForgeEnvPath({ home });
+  fs.mkdirSync(path.dirname(filename), { recursive: true, mode: 0o700 });
+
+  try {
+    fs.writeFileSync(filename, CURSEFORGE_ENV_TEMPLATE, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: 0o600,
+    });
+    if (platform !== "win32") {
+      fs.chmodSync(filename, 0o600);
+    }
+    return { path: filename, status: "created" };
+  } catch (error) {
+    if (error?.code === "EEXIST") {
+      return { path: filename, status: "preserved" };
+    }
+    throw error;
+  }
+}