@yoonion/mimi-seed-mcp 0.15.4 → 0.15.6

package/README.md

@@ -58,6 +58,7 @@ npx -y @yoonion/mimi-seed-mcp mimi-seed-bigquery-auth     # BigQuery
 npx -y @yoonion/mimi-seed-mcp mimi-seed-jenkins-auth      # Jenkins (저장 전 서버 프로브)
 npx -y @yoonion/mimi-seed-mcp mimi-seed-googleads-auth    # Google Ads (저장 전 실제 호출로 검증)
 npx -y @yoonion/mimi-seed-mcp mimi-seed-social-auth       # Facebook / Instagram / Threads
+npx -y @yoonion/mimi-seed-mcp mimi-seed-tiktok-business-auth # TikTok Business Organic API
 ```
 
 각 자격증명을 **어디서 어떻게 발급받는지**는 [`docs/credentials.md`](../../docs/credentials.md) 참고.
@@ -74,7 +75,7 @@ export ANTHROPIC_API_KEY=sk-ant-...
 
 ---
 
-## 제공 도구 (150+ 개 · 19개 영역)
+## 제공 도구 (150+ 개 · 20개 영역)
 
 | 영역 | 도구 수 | 주요 도구 |
 |------|---------|-----------|
@@ -90,7 +91,8 @@ export ANTHROPIC_API_KEY=sk-ant-...
 | Facebook | 6 | `facebook_post_photo` / `facebook_post_multi_photo` / `facebook_list_pages` |
 | Google Cloud IAM | 5 | `iam_create_service_account` / `iam_create_key` / `iam_add_iam_policy_binding` |
 | BigQuery | 5 | `bigquery_run_query` / `bigquery_list_datasets` / `bigquery_get_table_schema` |
-| Threads | 6 | `threads_post` / `threads_post_carousel` / `threads_refresh_token` |
+| Threads | 7 | `threads_post` / `threads_post_video` / `threads_post_carousel` / `threads_refresh_token` |
+| TikTok Business | 7 | `tiktok_business_plan_video_post` / `tiktok_business_publish_video` / `tiktok_business_get_publish_status` |
 | 점검 / 위험 | 4 | `playstore_check_submission_risks` / `appstore_check_submission_risks` / `screenshot_validate` / `release_status` |
 | Instagram | 4 | `instagram_post_image` / `instagram_post_carousel` / `instagram_save_config` |
 | Android 서명 | 3 | `android_signing_setup` / `android_generate_keystore` / `jenkins_upload_playstore_sa` |

package/assets/agent-guide.md

@@ -72,7 +72,8 @@ you can paste. Pick the row for the job; batching two rows in one `select:` call
 | AdMob | `select:admob_list_accounts,admob_list_apps,admob_create_app,admob_create_ad_unit,admob_list_ad_units,admob_get_today_earnings,admob_get_report` |
 | Google Ads (UAC) | `select:googleads_config_status,googleads_save_config,googleads_list_accessible_customers,googleads_list_campaigns,googleads_get_campaign_report,googleads_get_uac_report` |
 | Search Console | `select:gsc_list_sites,gsc_list_sitemaps,gsc_get_sitemap,gsc_submit_sitemap,gsc_inspect_url,gsc_search_analytics` |
-| Social posting (Facebook / Instagram / Threads) | `select:facebook_current_config,facebook_save_config,facebook_list_pages,facebook_get_page,facebook_post_photo,facebook_post_multi_photo,instagram_save_config,instagram_get_account,instagram_post_image,instagram_post_carousel,threads_current_config,threads_save_config,threads_refresh_token,threads_get_account,threads_post,threads_post_carousel` |
+| Social posting (Facebook / Instagram / Threads) | `select:facebook_current_config,facebook_save_config,facebook_list_pages,facebook_get_page,facebook_post_photo,facebook_post_multi_photo,instagram_save_config,instagram_get_account,instagram_post_image,instagram_post_carousel,threads_current_config,threads_save_config,threads_refresh_token,threads_get_account,threads_post,threads_post_video,threads_post_carousel` |
+| TikTok Business video publish | `select:tiktok_business_auth_status,tiktok_business_get_account,tiktok_business_get_video_settings,tiktok_business_plan_video_post,tiktok_business_publish_video,tiktok_business_get_publish_status,tiktok_business_list_publish_audits` |
 | Jenkins credentials + jobs | `select:jenkins_status,jenkins_save_config,jenkins_list_credentials,jenkins_create_credential,jenkins_delete_credential,jenkins_upload_keystore,jenkins_upload_playstore_sa,jenkins_list_jobs,jenkins_get_job_config,jenkins_create_job,jenkins_update_job` |
 | CI (GitHub/GitLab) | `select:ci_save_config,ci_list_workflows,ci_trigger_build,ci_get_build_status,ci_list_recent_builds,ci_cancel_build` |
 | Android signing / keystore | `select:android_signing_setup,android_generate_keystore,jenkins_upload_keystore,jenkins_upload_playstore_sa` |
@@ -86,7 +87,7 @@ you can paste. Pick the row for the job; batching two rows in one `select:` call
 
 Before any task, call **`mimi_seed_status`** — the setup doctor. It scans your service
 credentials (Google OAuth · Play SA · App Store · Jenkins · CI · Google Ads · Facebook · Instagram ·
-Threads · BigQuery) and returns a ✅/❌ report plus the exact next tool to call for anything
+Threads · TikTok Business · BigQuery) and returns a ✅/❌ report plus the exact next tool to call for anything
 missing. This avoids a late `401`/`403` deep into a workflow.
 
 > If the repo has a **`.mimi-seed.json`** manifest at its root, `mimi_seed_status` (and
@@ -110,6 +111,7 @@ every credential, which also tells them where to obtain each token
 | GitHub / GitLab CI | `mimi-seed auth ci` |
 | Google Ads | `mimi-seed auth googleads` — needs the `adwords` OAuth scope; an old token may need `mimi-seed auth login --domains googleads` (adds the grant, keeps the rest) |
 | Facebook / Instagram / Threads | `mimi-seed auth facebook` / `mimi-seed auth instagram` / `mimi-seed auth threads` |
+| TikTok Business | `mimi-seed auth tiktok` → verify with `tiktok_business_auth_status` and `tiktok_business_get_account` |
 
 `mimi-seed auth meta` opens the combined social setup entry point when the user wants to review or reconnect
 all three Meta platforms in one pass.
@@ -146,6 +148,8 @@ Credentials live under `~/.mimi-seed/` (legacy `~/.preseed/` is still read):
 | `google-ads.json` | Google Ads developer token + customer id |
 | `facebook.json`, `instagram.json`, `threads.json` | Default/legacy Page / account tokens for social post tools |
 | `social-profiles/<profile>.json` | Named Facebook/Instagram/Threads tokens selected by the current project's `.mimi-seed.json` |
+| `tiktok-business.json` | TikTok API for Business app credentials + short-term/refresh tokens (0600) |
+| `tiktok-business/plans`, `tiktok-business/audit`, `tiktok-business/locks` | Expiring post plans, deduplication/audit records, and atomic publish reservations; signed URL query strings are not written to audit records |
 
 Notes that matter in practice:
 
@@ -181,7 +185,8 @@ per-domain inventory is [`docs/domain/tool-catalog.md`](domain/tool-catalog.md).
 | **Google Ads (UAC)** | `googleads_list_campaigns` · `googleads_get_uac_report` · `googleads_get_campaign_report` · `googleads_config_status` |
 | **Search Console** | `gsc_inspect_url` · `gsc_search_analytics` · `gsc_submit_sitemap` |
 | **Android signing** | `android_signing_setup` · `android_generate_keystore` · `jenkins_upload_playstore_sa` |
-| **Facebook / Instagram / Threads** | `facebook_post_photo` · `instagram_post_carousel` · `threads_post` · `threads_refresh_token` |
+| **Facebook / Instagram / Threads** | `facebook_post_photo` · `instagram_post_carousel` · `threads_post` · `threads_post_video` · `threads_refresh_token` |
+| **TikTok Business** | `tiktok_business_auth_status` · `tiktok_business_plan_video_post` · `tiktok_business_publish_video` · `tiktok_business_get_publish_status` |
 | **Checks** | `playstore_check_submission_risks` · `appstore_check_submission_risks` · `screenshot_validate` · `release_status` |
 | **AI / Auth** | `generate_release_notes_from_commits` · `generate_review_reply` · `mimi_seed_status` · `mimi_seed_auth_start` · `mimi_seed_auth_status` · `mimi_seed_remote_sync_credentials` |
 | **Video production** | `youtube_upload_video` · `youtube_get_video_status` · `youtube_update_video_privacy` · `video_plan_from_story` · `video_research_youtube` · `video_search_stock_assets` · `video_synthesize_research` · `video_generate_image` · `video_build_timeline` · `video_render` · `video_job_status` · `video_validate` |

package/dist/index.js

@@ -17,6 +17,7 @@ const SUBCOMMANDS = {
     'mimi-seed-jenkins-auth': () => import('./jenkins/setup-cli.js'),
     'mimi-seed-googleads-auth': () => import('./googleads/setup-cli.js'),
     'mimi-seed-social-auth': () => import('./social/setup-cli.js'),
+    'mimi-seed-tiktok-business-auth': () => import('./tiktok-business/setup-cli.js'),
     'mimi-seed-firebase': () => import('./firebase/cli.js'),
     'mimi-seed-admob': () => import('./admob/cli.js'),
     'mimi-seed-ga4': () => import('./ga4/cli.js'),

package/dist/registers/auth.js

@@ -11,6 +11,8 @@ import { loadConfig as loadGoogleAdsConfig } from '../googleads/config.js';
 import { loadFacebookConfig } from '../facebook/config.js';
 import { loadInstagramConfig } from '../instagram/config.js';
 import { loadThreadsConfig } from '../threads/config.js';
+import { loadTikTokBusinessConfig } from '../tiktok-business/config.js';
+import { tokenFreshness as tiktokTokenFreshness } from '../tiktok-business/auth.js';
 import { metaTokenFreshness } from '../lib/meta-auth.js';
 import { readPackageRootText } from '../lib/package-root.js';
 import { resolveBigQueryAuth } from '../auth/bigquery-auth.js';
@@ -114,7 +116,7 @@ export function registerAuthTools(server) {
     // ── 전체 연결 상태 진단 ────────────────────────────────────────────────────
     server.tool('mimi_seed_status', [
         '⭐ 새 세션을 시작하거나 "뭐가 연결됐지?" 라는 질문엔 이 도구를 먼저 호출하세요.',
-        '전체 서비스(Google OAuth / Play SA / App Store / Jenkins / CI / Google Ads / Facebook / Instagram / Threads / BigQuery)',
+        '전체 서비스(Google OAuth / Play SA / App Store / Jenkins / CI / Google Ads / Facebook / Instagram / Threads / TikTok Business / BigQuery)',
         '설정 상태를 한 번에 스캔해 ✅ / ❌ 트래픽 라이트 리포트와 번호 매긴 다음 단계를 반환합니다.',
         '미설정 서비스마다 어떤 도구를 호출하면 되는지 구체적으로 알려줍니다.',
     ].join(' '), {}, async () => {
@@ -197,7 +199,22 @@ export function registerAuthTools(server) {
         const threadsTarget = resolveSocialConfigTarget('threads');
         const threads = loadThreadsConfig();
         lines.push(renderMetaConnection('Threads', threads, `${threadsTarget.profile ? `profile: ${threadsTarget.profile}, ` : ''}userId: ${threads?.userId ?? ''}`, `mimi-seed auth threads${threadsTarget.profile ? ` --profile ${threadsTarget.profile}` : ''}`));
-        // 10. BigQuery — resolveBigQueryAuth 기준(서비스 계정 우선, OAuth fallback).
+        // 10. TikTok Business — 네트워크 없이 refresh token 만료 상태까지 판정.
+        const tiktok = loadTikTokBusinessConfig();
+        const tiktokFreshness = tiktokTokenFreshness(tiktok);
+        if (!tiktok) {
+            lines.push('❌ TikTok Business    — 미설정 → mimi-seed auth tiktok  (선택)');
+        }
+        else if (tiktokFreshness.state === 'refresh_expired') {
+            lines.push(`❌ TikTok Business    — refresh token 만료 (${tiktok.openId}) → mimi-seed auth tiktok`);
+        }
+        else if (tiktokFreshness.state === 'access_expired') {
+            lines.push(`⚠️  TikTok Business    — 연결됨, 다음 호출에서 access token 자동 갱신 (${tiktok.openId})`);
+        }
+        else {
+            lines.push(`✅ TikTok Business    — Organic API 연결됨 (${tiktok.openId})`);
+        }
+        // 11. BigQuery — resolveBigQueryAuth 기준(서비스 계정 우선, OAuth fallback).
         // 이전엔 SA 파일만 검사해 OAuth fallback 이 살아있어도 ❌ 로 오표기했다.
         const bqAuth = resolveBigQueryAuth();
         if (bqAuth?.source === 'service-account') {

package/dist/registers/threads.js

@@ -94,6 +94,30 @@ export function registerThreadsTools(server) {
                 }],
         };
     });
+    server.tool('threads_post_video', [
+        'public URL의 영상을 Threads에 게시합니다.',
+        'Meta가 videoUrl을 직접 가져가므로 외부에서 인증 없이 접근 가능한 URL이어야 합니다.',
+        '3-step API: VIDEO container 생성 → 처리 완료 자동 대기 → threads_publish.',
+        '공개 게시 작업이므로 같은 턴에 사용자의 명시 승인을 받은 뒤 호출하세요.',
+    ].join(' '), {
+        videoUrl: z.string().url().describe('Threads가 가져갈 영상의 public URL'),
+        text: z.string().max(500).default('').describe('게시할 텍스트 (선택, 최대 500자)'),
+        altText: z.string().optional().describe('영상 접근성 대체 텍스트 (선택)'),
+        profile: profileSchema,
+    }, async ({ videoUrl, text, altText, profile }) => {
+        const cfg = requireThreadsConfig({ profile });
+        const result = await api.postVideo(cfg, videoUrl, text, altText);
+        return {
+            content: [{
+                    type: 'text',
+                    text: [
+                        '✅ 영상 게시 완료',
+                        `   media_id: ${result.id}`,
+                        result.permalink ? `   URL: ${result.permalink}` : '',
+                    ].filter(Boolean).join('\n'),
+                }],
+        };
+    });
     // 진단용 — 현재 저장된 Threads 설정 요약 (facebook_current_config 와 동일한 패턴).
     server.tool('threads_current_config', '현재 선택된 Threads 연결 설정을 확인합니다. 프로젝트 매핑 또는 profile 인자를 따릅니다.', { profile: profileSchema }, async ({ profile }) => {
         const options = { profile };

package/dist/registers/tiktok.d.ts

@@ -0,0 +1,2 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerTikTokBusinessTools(server: McpServer): void;

package/dist/registers/tiktok.js

@@ -0,0 +1,60 @@
+import { z } from 'zod';
+import { getBusinessAccount, getVideoSettings, inspectAccessToken } from '../tiktok-business/api.js';
+import { ensureFreshTikTokConfig, ensureTikTokPublishConfig, safeTokenInspection, tokenFreshness, } from '../tiktok-business/auth.js';
+import { safeTikTokBusinessConfig } from '../tiktok-business/config.js';
+import { checkPublishStatus, listPublishAudits, planVideoPost, publishPlannedVideo, } from '../tiktok-business/posting.js';
+import { jsonResult } from '../lib/mcp-response.js';
+const absolutePath = z.string().min(1).refine((value) => value.startsWith('/') || /^[A-Za-z]:[\\/]/.test(value), {
+    message: '절대경로만 허용합니다.',
+});
+const httpsUrl = z.string().url().refine((value) => new URL(value).protocol === 'https:', {
+    message: 'HTTPS URL만 허용합니다.',
+});
+export function registerTikTokBusinessTools(server) {
+    server.tool('tiktok_business_auth_status', [
+        'TikTok API for Business Organic API 연결과 권한 상태를 확인합니다.',
+        '만료 5분 전이면 refresh token으로 access token을 자동 갱신합니다.',
+        '토큰·앱 시크릿은 응답하지 않습니다. 미연결이면 `mimi-seed auth tiktok`을 실행하세요.',
+    ].join(' '), {}, async () => {
+        const config = await ensureFreshTikTokConfig();
+        const tokenInfo = await inspectAccessToken(config);
+        return jsonResult({
+            connected: true,
+            ...safeTikTokBusinessConfig(config),
+            freshness: tokenFreshness(config).state,
+            tokenInfo: safeTokenInspection(config, tokenInfo),
+        });
+    });
+    server.tool('tiktok_business_get_account', '연결된 owned TikTok Business Account 프로필을 조회하고 현재 토큰으로 접근 가능한지 검증합니다.', {}, async () => jsonResult(await getBusinessAccount(await ensureFreshTikTokConfig())));
+    server.tool('tiktok_business_get_video_settings', '게시 전에 계정별 최대 영상 길이와 댓글·듀엣·스티치 설정을 조회합니다.', {}, async () => jsonResult(await getVideoSettings(await ensureTikTokPublishConfig())));
+    server.tool('tiktok_business_plan_video_post', [
+        'TikTok 공개 게시 전용 계획을 만들고 30분 동안 로컬에 보관합니다.',
+        '로컬 원본을 ffprobe로 검사하고 SHA-256으로 중복 게시를 차단하며 계정별 영상 설정과 대조합니다.',
+        'videoUrl은 TikTok 앱에서 검증한 도메인의 HTTPS URL이어야 하고 최소 30분 이상 유효해야 합니다.',
+        '이 도구는 TikTok에 게시하지 않습니다. 검토 후 tiktok_business_publish_video를 별도로 호출하세요.',
+    ].join(' '), {
+        sourceFilePath: absolutePath.describe('검증·중복 판정할 로컬 .mp4/.mov/.webm 절대경로'),
+        videoUrl: httpsUrl.describe('TikTok 서버가 가져갈 영상의 검증된 HTTPS URL'),
+        customThumbnailUrl: httpsUrl.optional().describe('선택 썸네일 HTTPS URL'),
+        caption: z.string().max(2_200).optional().describe('UTF-16 기준 최대 2,200자, 멘션 최대 30개'),
+        isBrandOrganic: z.boolean().default(false).describe('브랜드 자체 홍보 콘텐츠 여부'),
+        isBrandedContent: z.boolean().default(false).describe('유료 파트너십/브랜디드 콘텐츠 여부'),
+        disableComment: z.boolean().default(false),
+        disableDuet: z.boolean().default(false),
+        disableStitch: z.boolean().default(false),
+        thumbnailOffsetMs: z.number().int().min(0).optional().describe('영상 시작 기준 썸네일 오프셋(ms)'),
+        isAiGenerated: z.boolean().default(true).describe('AI 생성·변형 영상 고지'),
+        ffmpegPath: z.string().optional().describe('FFmpeg 절대경로. 생략하면 PATH의 ffprobe 사용'),
+    }, async (input) => jsonResult(await planVideoPost(input)));
+    server.tool('tiktok_business_publish_video', [
+        '검증된 30분짜리 계획을 owned TikTok Business Account에 공개 게시합니다.',
+        '외부 공개 작업이므로 같은 턴에 사용자의 명시 승인을 받은 뒤 confirmPublish=true로 호출해야 합니다.',
+        'POST 타임아웃은 결과 불명으로 감사 로그에 남고 자동 재시도를 막습니다.',
+        '성공 응답은 보통 pending이며 tiktok_business_get_publish_status로 완료를 확인하세요.',
+    ].join(' '), {
+        planId: z.string().regex(/^[a-f0-9]{32}$/),
+        confirmPublish: z.boolean().default(false).describe('사용자의 공개 게시 명시 승인 확인'),
+    }, async ({ planId, confirmPublish }) => jsonResult(await publishPlannedVideo(planId, confirmPublish)));
+    server.tool('tiktok_business_get_publish_status', 'TikTok 게시 처리 상태를 조회하고 로컬 감사 로그의 pending/published/failed 상태를 갱신합니다.', { publishId: z.string().min(1).max(128).describe('publish 응답의 share_id 또는 publish_id') }, async ({ publishId }) => jsonResult(await checkPublishStatus(publishId)));
+    server.tool('tiktok_business_list_publish_audits', '로컬 TikTok 게시 감사 로그를 최신순으로 조회합니다. 토큰·앱 시크릿·서명 URL 쿼리는 저장하거나 반환하지 않습니다.', { limit: z.number().int().min(1).max(100).default(20) }, async ({ limit }) => jsonResult(listPublishAudits(limit)));
+}

package/dist/server.js

@@ -18,6 +18,7 @@ import { registerGa4Tools } from './registers/ga4.js';
 import { registerJenkinsTools } from './registers/jenkins.js';
 import { registerAndroidTools } from './registers/android.js';
 import { registerVideoTools } from './registers/video.js';
+import { registerTikTokBusinessTools } from './registers/tiktok.js';
 import { registerPrompts } from './prompts.js';
 import { registerResources } from './resources.js';
 /**
@@ -52,6 +53,7 @@ export function buildServer(version) {
     registerJenkinsTools(server);
     registerAndroidTools(server);
     registerVideoTools(server);
+    registerTikTokBusinessTools(server);
     registerPrompts(server);
     registerResources(server);
     return server;

package/dist/threads/api.d.ts

@@ -20,4 +20,6 @@ export interface PublishResult {
 }
 /** 텍스트 전용 게시 — Threads 의 핵심 유스케이스. imageUrl 을 주면 이미지 게시. */
 export declare function postText(cfg: ThreadsConfig, text: string, imageUrl?: string): Promise<PublishResult>;
+/** public URL의 영상을 Threads 미디어 컨테이너로 만든 뒤 처리 완료 후 게시한다. */
+export declare function postVideo(cfg: ThreadsConfig, videoUrl: string, text?: string, altText?: string): Promise<PublishResult>;
 export declare function postCarousel(cfg: ThreadsConfig, imageUrls: string[], text: string): Promise<PublishResult>;

package/dist/threads/api.js

@@ -126,6 +126,20 @@ export async function postText(cfg, text, imageUrl) {
         await waitForContainer(cfg, container.id); // 미디어만 처리 대기
     return publish(cfg, container.id);
 }
+/** public URL의 영상을 Threads 미디어 컨테이너로 만든 뒤 처리 완료 후 게시한다. */
+export async function postVideo(cfg, videoUrl, text = '', altText) {
+    const params = {
+        media_type: 'VIDEO',
+        video_url: videoUrl,
+        text,
+        access_token: cfg.accessToken,
+    };
+    if (altText)
+        params.alt_text = altText;
+    const container = await thFetch(cfg.accessToken, '/me/threads', params, 'POST');
+    await waitForContainer(cfg, container.id);
+    return publish(cfg, container.id);
+}
 export async function postCarousel(cfg, imageUrls, text) {
     if (imageUrls.length < 2 || imageUrls.length > 20) {
         throw new Error(`캐러셀은 2~20장의 이미지가 필요합니다 (받은 수: ${imageUrls.length}).`);

package/dist/tiktok-business/api.d.ts

@@ -0,0 +1,21 @@
+import type { TikTokBusinessConfig } from './config.js';
+import type { TikTokPublishData, TikTokPublishRequest, TikTokTokenData, TikTokVideoSettings } from './types.js';
+export declare const TIKTOK_API_BASE = "https://business-api.tiktok.com/open_api/v1.3";
+export declare class TikTokApiError extends Error {
+    readonly code?: number | undefined;
+    readonly requestId?: string | undefined;
+    readonly outcomeUnknown: boolean;
+    constructor(message: string, code?: number | undefined, requestId?: string | undefined, outcomeUnknown?: boolean);
+}
+export declare function exchangeAuthorizationCode(input: {
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    authCode: string;
+}): Promise<TikTokTokenData>;
+export declare function refreshAccessToken(config: TikTokBusinessConfig): Promise<TikTokTokenData>;
+export declare function inspectAccessToken(config: TikTokBusinessConfig): Promise<Record<string, unknown>>;
+export declare function getBusinessAccount(config: TikTokBusinessConfig): Promise<Record<string, unknown>>;
+export declare function getVideoSettings(config: TikTokBusinessConfig): Promise<TikTokVideoSettings>;
+export declare function publishVideo(config: TikTokBusinessConfig, request: TikTokPublishRequest): Promise<TikTokPublishData>;
+export declare function getPublishStatus(config: TikTokBusinessConfig, publishId: string): Promise<Record<string, unknown>>;

package/dist/tiktok-business/api.js

@@ -0,0 +1,102 @@
+import { fetchWithTimeout } from '../lib/http.js';
+export const TIKTOK_API_BASE = 'https://business-api.tiktok.com/open_api/v1.3';
+export class TikTokApiError extends Error {
+    code;
+    requestId;
+    outcomeUnknown;
+    constructor(message, code, requestId, outcomeUnknown = false) {
+        super(message);
+        this.code = code;
+        this.requestId = requestId;
+        this.outcomeUnknown = outcomeUnknown;
+        this.name = 'TikTokApiError';
+    }
+}
+function parseEnvelope(text, status, endpoint) {
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        throw new TikTokApiError(`TikTok ${endpoint} 응답을 해석하지 못했습니다 (HTTP ${status}).`);
+    }
+    if (status < 200 || status >= 300 || body.code !== 0) {
+        throw new TikTokApiError(`TikTok ${endpoint} 실패: ${body.message || `HTTP ${status}`} (code ${body.code})`, body.code, body.request_id);
+    }
+    return body;
+}
+async function tokenPost(endpoint, payload) {
+    const response = await fetchWithTimeout(`${TIKTOK_API_BASE}${endpoint}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload),
+    });
+    const envelope = parseEnvelope(await response.text(), response.status, endpoint);
+    if (!envelope.data?.access_token || !envelope.data.refresh_token || !envelope.data.open_id) {
+        throw new TikTokApiError(`TikTok ${endpoint} 응답에 필수 토큰 필드가 없습니다.`);
+    }
+    return envelope.data;
+}
+export function exchangeAuthorizationCode(input) {
+    return tokenPost('/tt_user/oauth2/token/', {
+        client_id: input.clientId,
+        client_secret: input.clientSecret,
+        grant_type: 'authorization_code',
+        auth_code: input.authCode,
+        redirect_uri: input.redirectUri,
+    });
+}
+export function refreshAccessToken(config) {
+    return tokenPost('/tt_user/oauth2/refresh_token/', {
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        grant_type: 'refresh_token',
+        refresh_token: config.refreshToken,
+    });
+}
+async function authorizedRequest(config, endpoint, method, payload) {
+    const url = new URL(`${TIKTOK_API_BASE}${endpoint}`);
+    let body;
+    if (method === 'GET') {
+        for (const [key, value] of Object.entries(payload)) {
+            if (value !== undefined)
+                url.searchParams.set(key, typeof value === 'string' ? value : JSON.stringify(value));
+        }
+    }
+    else {
+        body = JSON.stringify(payload);
+    }
+    let response;
+    try {
+        response = await fetchWithTimeout(url, {
+            method,
+            headers: {
+                'Access-Token': config.accessToken,
+                ...(method === 'POST' ? { 'Content-Type': 'application/json' } : {}),
+            },
+            body,
+        }, method === 'POST' ? { maxAttempts: 1 } : {});
+    }
+    catch (error) {
+        throw new TikTokApiError(error instanceof Error ? error.message : String(error), undefined, undefined, method === 'POST');
+    }
+    return parseEnvelope(await response.text(), response.status, endpoint).data;
+}
+export function inspectAccessToken(config) {
+    return authorizedRequest(config, '/tt_user/token_info/get/', 'GET', {});
+}
+export function getBusinessAccount(config) {
+    return authorizedRequest(config, '/business/get/', 'GET', { business_id: config.openId });
+}
+export function getVideoSettings(config) {
+    return authorizedRequest(config, '/business/video/settings/', 'GET', { business_id: config.openId });
+}
+export function publishVideo(config, request) {
+    return authorizedRequest(config, '/business/video/publish/', 'POST', { ...request });
+}
+export function getPublishStatus(config, publishId) {
+    return authorizedRequest(config, '/business/publish/status/', 'GET', {
+        business_id: config.openId,
+        publish_id: publishId,
+    });
+}

package/dist/tiktok-business/auth.d.ts

@@ -0,0 +1,38 @@
+import type { TikTokTokenData } from './types.js';
+import { type TikTokBusinessConfig } from './config.js';
+declare function expiresAt(seconds: number, now?: number): string;
+export declare function configFromToken(app: Pick<TikTokBusinessConfig, 'clientId' | 'clientSecret' | 'redirectUri'>, token: TikTokTokenData, now?: number): TikTokBusinessConfig;
+export declare function tokenFreshness(config?: TikTokBusinessConfig | null, now?: number): {
+    state: "missing";
+    config?: undefined;
+    accessMs?: undefined;
+    refreshMs?: undefined;
+} | {
+    state: "refresh_expired";
+    config: TikTokBusinessConfig;
+    accessMs?: undefined;
+    refreshMs?: undefined;
+} | {
+    state: "access_expired";
+    config: TikTokBusinessConfig;
+    accessMs: number;
+    refreshMs: number;
+} | {
+    state: "fresh";
+    config: TikTokBusinessConfig;
+    accessMs: number;
+    refreshMs: number;
+};
+export declare function ensureFreshTikTokConfig(): Promise<TikTokBusinessConfig>;
+export declare function hasTikTokScope(config: Pick<TikTokBusinessConfig, 'scope'>, required: string): boolean;
+export declare function safeTokenInspection(config: Pick<TikTokBusinessConfig, 'openId' | 'scope'>, tokenInfo: Record<string, unknown>): {
+    providerVerified: boolean;
+    openIdMatches: boolean | undefined;
+    scope: string;
+};
+export declare function ensureTikTokPublishConfig(): Promise<TikTokBusinessConfig>;
+export declare const __testing: {
+    expiresAt: typeof expiresAt;
+    REFRESH_EARLY_MS: number;
+};
+export {};

package/dist/tiktok-business/auth.js

@@ -0,0 +1,67 @@
+import { loadTikTokBusinessConfig, requireTikTokBusinessConfig, saveTikTokBusinessConfig, } from './config.js';
+import { refreshAccessToken } from './api.js';
+const REFRESH_EARLY_MS = 5 * 60 * 1000;
+function expiresAt(seconds, now = Date.now()) {
+    return new Date(now + seconds * 1000).toISOString();
+}
+export function configFromToken(app, token, now = Date.now()) {
+    return {
+        ...app,
+        accessToken: token.access_token,
+        refreshToken: token.refresh_token,
+        accessTokenExpiresAt: expiresAt(token.expires_in, now),
+        refreshTokenExpiresAt: expiresAt(token.refresh_token_expires_in, now),
+        openId: token.open_id,
+        scope: token.scope,
+        tokenType: token.token_type,
+    };
+}
+export function tokenFreshness(config = loadTikTokBusinessConfig(), now = Date.now()) {
+    if (!config)
+        return { state: 'missing' };
+    const accessMs = Date.parse(config.accessTokenExpiresAt) - now;
+    const refreshMs = Date.parse(config.refreshTokenExpiresAt) - now;
+    if (!Number.isFinite(refreshMs) || refreshMs <= 0)
+        return { state: 'refresh_expired', config };
+    if (!Number.isFinite(accessMs) || accessMs <= REFRESH_EARLY_MS) {
+        return { state: 'access_expired', config, accessMs, refreshMs };
+    }
+    return { state: 'fresh', config, accessMs, refreshMs };
+}
+export async function ensureFreshTikTokConfig() {
+    const config = requireTikTokBusinessConfig();
+    const freshness = tokenFreshness(config);
+    if (freshness.state === 'refresh_expired') {
+        throw new Error('TikTok refresh token이 만료되었습니다. `mimi-seed auth tiktok`으로 다시 연결하세요.');
+    }
+    if (freshness.state === 'fresh')
+        return config;
+    const token = await refreshAccessToken(config);
+    const refreshed = configFromToken(config, token);
+    saveTikTokBusinessConfig(refreshed);
+    return refreshed;
+}
+export function hasTikTokScope(config, required) {
+    return config.scope.split(/[\s,]+/).includes(required);
+}
+export function safeTokenInspection(config, tokenInfo) {
+    const providerOpenId = typeof tokenInfo.open_id === 'string' ? tokenInfo.open_id : undefined;
+    const providerScope = typeof tokenInfo.scope === 'string'
+        ? tokenInfo.scope
+        : Array.isArray(tokenInfo.scopes) && tokenInfo.scopes.every((scope) => typeof scope === 'string')
+            ? tokenInfo.scopes.join(',')
+            : undefined;
+    return {
+        providerVerified: true,
+        openIdMatches: providerOpenId === undefined ? undefined : providerOpenId === config.openId,
+        scope: providerScope ?? config.scope,
+    };
+}
+export async function ensureTikTokPublishConfig() {
+    const config = await ensureFreshTikTokConfig();
+    if (!hasTikTokScope(config, 'video.publish')) {
+        throw new Error('TikTok 연결에 video.publish 권한이 없습니다. Developer 앱 권한을 승인한 뒤 `mimi-seed auth tiktok`으로 다시 연결하세요.');
+    }
+    return config;
+}
+export const __testing = { expiresAt, REFRESH_EARLY_MS };

package/dist/tiktok-business/config.d.ts

@@ -0,0 +1,23 @@
+export interface TikTokBusinessConfig {
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    accessToken: string;
+    refreshToken: string;
+    accessTokenExpiresAt: string;
+    refreshTokenExpiresAt: string;
+    openId: string;
+    scope: string;
+    tokenType: string;
+}
+export declare const TIKTOK_BUSINESS_CONFIG_PATH: string;
+export declare function loadTikTokBusinessConfig(): TikTokBusinessConfig | null;
+export declare function saveTikTokBusinessConfig(config: TikTokBusinessConfig): void;
+export declare function requireTikTokBusinessConfig(): TikTokBusinessConfig;
+export declare function safeTikTokBusinessConfig(config: TikTokBusinessConfig): {
+    openId: string;
+    scope: string;
+    tokenType: string;
+    accessTokenExpiresAt: string;
+    refreshTokenExpiresAt: string;
+};

package/dist/tiktok-business/config.js

@@ -0,0 +1,39 @@
+import { readFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { writeCredentialJson } from '../lib/atomic-write.js';
+export const TIKTOK_BUSINESS_CONFIG_PATH = path.join(os.homedir(), '.mimi-seed', 'tiktok-business.json');
+export function loadTikTokBusinessConfig() {
+    try {
+        const value = JSON.parse(readFileSync(TIKTOK_BUSINESS_CONFIG_PATH, 'utf8'));
+        const required = [
+            'clientId', 'clientSecret', 'redirectUri', 'accessToken', 'refreshToken',
+            'accessTokenExpiresAt', 'refreshTokenExpiresAt', 'openId', 'scope', 'tokenType',
+        ];
+        if (required.some((key) => typeof value[key] !== 'string' || !value[key]))
+            return null;
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
+export function saveTikTokBusinessConfig(config) {
+    writeCredentialJson(TIKTOK_BUSINESS_CONFIG_PATH, config);
+}
+export function requireTikTokBusinessConfig() {
+    const config = loadTikTokBusinessConfig();
+    if (!config) {
+        throw new Error('TikTok Business 설정이 없습니다. 터미널에서 `mimi-seed auth tiktok`을 실행하세요.');
+    }
+    return config;
+}
+export function safeTikTokBusinessConfig(config) {
+    return {
+        openId: config.openId,
+        scope: config.scope,
+        tokenType: config.tokenType,
+        accessTokenExpiresAt: config.accessTokenExpiresAt,
+        refreshTokenExpiresAt: config.refreshTokenExpiresAt,
+    };
+}

package/dist/tiktok-business/posting.d.ts

@@ -0,0 +1,105 @@
+import type { TikTokPublishRequest, TikTokVideoSettings } from './types.js';
+export interface PlanVideoPostInput {
+    sourceFilePath: string;
+    videoUrl: string;
+    customThumbnailUrl?: string;
+    caption?: string;
+    isBrandOrganic?: boolean;
+    isBrandedContent?: boolean;
+    disableComment?: boolean;
+    disableDuet?: boolean;
+    disableStitch?: boolean;
+    thumbnailOffsetMs?: number;
+    isAiGenerated?: boolean;
+    ffmpegPath?: string;
+}
+interface VideoFacts {
+    sizeBytes: number;
+    width: number;
+    height: number;
+    durationSec: number;
+    fps: number;
+    format?: string;
+    codec?: string;
+}
+export interface TikTokPostPlan {
+    planId: string;
+    createdAt: string;
+    expiresAt: string;
+    openId: string;
+    contentHash: string;
+    sourceFilePath: string;
+    videoFacts: VideoFacts;
+    request: TikTokPublishRequest;
+    settings: TikTokVideoSettings;
+    warnings: string[];
+}
+export type AuditState = 'pending' | 'published' | 'failed' | 'unknown';
+export interface TikTokPublishAudit {
+    planId: string;
+    contentHash: string;
+    openId: string;
+    publishId?: string;
+    state: AuditState;
+    createdAt: string;
+    updatedAt: string;
+    caption?: string;
+    videoUrl: string;
+    requestId?: string;
+    providerStatus?: Record<string, unknown>;
+    error?: string;
+}
+declare function safeUrl(value: string): string;
+declare function countMentions(caption: string): number;
+declare function assertCaption(caption: string): void;
+declare function fpsValue(value: unknown): number;
+declare function assertVideoFacts(facts: VideoFacts, settings: TikTokVideoSettings): void;
+declare function assertThumbnailOffset(thumbnailOffsetMs: number | undefined, durationSec: number): void;
+declare function acquirePublishLock(openId: string, contentHash: string, lockDir?: string): void;
+declare function releasePublishLock(openId: string, contentHash: string, lockDir?: string): void;
+export declare function planVideoPost(input: PlanVideoPostInput): Promise<TikTokPostPlan>;
+export declare function loadPostPlan(planId: string): TikTokPostPlan;
+export declare function publishPlannedVideo(planId: string, confirmPublish: boolean): Promise<{
+    publishId: string;
+    state: string;
+    planId: string;
+    audit: TikTokPublishAudit;
+}>;
+declare function statusState(status: Record<string, unknown>): AuditState | null;
+declare function shouldReleasePublishLock(previous: AuditState, next: AuditState): boolean;
+export declare function checkPublishStatus(publishId: string): Promise<{
+    publishId: string;
+    status: Record<string, unknown>;
+    audit: {
+        state: AuditState;
+        updatedAt: string;
+        providerStatus: Record<string, unknown>;
+        planId: string;
+        contentHash: string;
+        openId: string;
+        publishId?: string;
+        createdAt: string;
+        caption?: string;
+        videoUrl: string;
+        requestId?: string;
+        error?: string;
+    };
+} | {
+    publishId: string;
+    status: Record<string, unknown>;
+    audit: null;
+}>;
+export declare function listPublishAudits(limit?: number): TikTokPublishAudit[];
+export declare const __testing: {
+    assertCaption: typeof assertCaption;
+    assertThumbnailOffset: typeof assertThumbnailOffset;
+    assertVideoFacts: typeof assertVideoFacts;
+    acquirePublishLock: typeof acquirePublishLock;
+    countMentions: typeof countMentions;
+    fpsValue: typeof fpsValue;
+    releasePublishLock: typeof releasePublishLock;
+    safeUrl: typeof safeUrl;
+    shouldReleasePublishLock: typeof shouldReleasePublishLock;
+    statusState: typeof statusState;
+};
+export {};

package/dist/tiktok-business/posting.js

@@ -0,0 +1,383 @@
+import { createHash } from 'node:crypto';
+import { closeSync, createReadStream, existsSync, mkdirSync, openSync, readFileSync, readdirSync, statSync, unlinkSync, } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { CREDENTIAL_DIR_MODE, CREDENTIAL_FILE_MODE, writeJsonAtomic } from '../lib/atomic-write.js';
+import { validateVideo } from '../video/render.js';
+import { TikTokApiError, getPublishStatus, getVideoSettings, publishVideo } from './api.js';
+import { ensureTikTokPublishConfig } from './auth.js';
+const STATE_DIR = path.join(os.homedir(), '.mimi-seed', 'tiktok-business');
+const PLAN_DIR = path.join(STATE_DIR, 'plans');
+const AUDIT_DIR = path.join(STATE_DIR, 'audit');
+const LOCK_DIR = path.join(STATE_DIR, 'locks');
+const PLAN_TTL_MS = 30 * 60 * 1000;
+const MAX_FILE_BYTES = 1024 * 1024 * 1024;
+function privateWrite(filePath, value) {
+    writeJsonAtomic(filePath, value, { mode: CREDENTIAL_FILE_MODE, dirMode: CREDENTIAL_DIR_MODE });
+}
+function assertHttpsUrl(value, field) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`${field}는 유효한 HTTPS URL이어야 합니다.`);
+    }
+    if (url.protocol !== 'https:')
+        throw new Error(`${field}는 HTTPS URL이어야 합니다.`);
+}
+function safeUrl(value) {
+    const url = new URL(value);
+    return `${url.origin}${url.pathname}`;
+}
+function countMentions(caption) {
+    return caption.match(/(^|\s)@[\p{L}\p{N}._]+/gu)?.length ?? 0;
+}
+function assertCaption(caption) {
+    if (caption.length > 2_200)
+        throw new Error('TikTok caption은 UTF-16 기준 2,200자 이하여야 합니다.');
+    if (countMentions(caption) > 30)
+        throw new Error('TikTok caption의 멘션은 최대 30개입니다.');
+}
+function numberValue(value) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : NaN;
+}
+function fpsValue(value) {
+    if (typeof value !== 'string')
+        return numberValue(value);
+    const [numerator, denominator = '1'] = value.split('/');
+    const den = Number(denominator);
+    return den ? Number(numerator) / den : NaN;
+}
+function factsFromValidation(sourceFilePath, validation) {
+    const stream = validation.streams.find((item) => typeof item === 'object' && item !== null && item.codec_type === 'video');
+    const format = validation.format;
+    if (!stream)
+        throw new Error('업로드 파일에 비디오 스트림이 없습니다.');
+    const facts = {
+        sizeBytes: statSync(sourceFilePath).size,
+        width: numberValue(stream.width),
+        height: numberValue(stream.height),
+        durationSec: numberValue(format.duration),
+        fps: fpsValue(stream.r_frame_rate),
+        format: typeof format.format_name === 'string' ? format.format_name : undefined,
+        codec: typeof stream.codec_name === 'string' ? stream.codec_name : undefined,
+    };
+    if (Object.values(facts).slice(0, 5).some((value) => typeof value !== 'number' || !Number.isFinite(value))) {
+        throw new Error('TikTok 규격 검사에 필요한 영상 메타데이터를 읽지 못했습니다.');
+    }
+    return facts;
+}
+function assertVideoFacts(facts, settings) {
+    if (facts.sizeBytes <= 0 || facts.sizeBytes > MAX_FILE_BYTES)
+        throw new Error('TikTok 영상은 0바이트 초과, 1GB 이하여야 합니다.');
+    if (facts.durationSec < 3 || facts.durationSec > 600)
+        throw new Error('TikTok 영상 길이는 3~600초여야 합니다.');
+    const accountMax = Number(settings.max_video_post_duration_sec);
+    if (Number.isFinite(accountMax) && facts.durationSec > accountMax) {
+        throw new Error(`영상 길이 ${facts.durationSec.toFixed(1)}초가 계정 한도 ${accountMax}초를 초과합니다.`);
+    }
+    if (facts.width < 360 || facts.height < 360)
+        throw new Error('TikTok 영상의 가로·세로는 각각 최소 360px이어야 합니다.');
+    if (facts.fps < 23 || facts.fps > 60)
+        throw new Error('TikTok 영상 FPS는 23~60이어야 합니다.');
+}
+function assertThumbnailOffset(thumbnailOffsetMs, durationSec) {
+    if (thumbnailOffsetMs !== undefined && thumbnailOffsetMs > durationSec * 1000) {
+        throw new Error('thumbnailOffsetMs는 영상 길이를 초과할 수 없습니다.');
+    }
+}
+function assertSourceFile(sourceFilePath) {
+    if (!path.isAbsolute(sourceFilePath) || !existsSync(sourceFilePath)) {
+        throw new Error('sourceFilePath는 존재하는 절대경로여야 합니다.');
+    }
+    const stat = statSync(sourceFilePath);
+    if (!stat.isFile())
+        throw new Error('sourceFilePath는 파일이어야 합니다.');
+    const ext = path.extname(sourceFilePath).toLowerCase();
+    if (!['.mp4', '.mov', '.webm'].includes(ext)) {
+        throw new Error('TikTok 지원 영상 형식은 .mp4, .mov, .webm입니다.');
+    }
+}
+async function sha256File(filePath) {
+    return await new Promise((resolve, reject) => {
+        const hash = createHash('sha256');
+        const stream = createReadStream(filePath);
+        stream.on('data', (chunk) => hash.update(chunk));
+        stream.on('error', reject);
+        stream.on('end', () => resolve(hash.digest('hex')));
+    });
+}
+function planPath(planId) {
+    return path.join(PLAN_DIR, `${planId}.json`);
+}
+function auditKey(openId, contentHash) {
+    return createHash('sha256').update(`${openId}:${contentHash}`).digest('hex');
+}
+function auditPath(openId, contentHash) {
+    return path.join(AUDIT_DIR, `${auditKey(openId, contentHash)}.json`);
+}
+function publishLockPath(openId, contentHash, lockDir = LOCK_DIR) {
+    return path.join(lockDir, `${auditKey(openId, contentHash)}.lock`);
+}
+function acquirePublishLock(openId, contentHash, lockDir = LOCK_DIR) {
+    mkdirSync(lockDir, { recursive: true, mode: CREDENTIAL_DIR_MODE });
+    let descriptor;
+    try {
+        descriptor = openSync(publishLockPath(openId, contentHash, lockDir), 'wx', CREDENTIAL_FILE_MODE);
+    }
+    catch (error) {
+        if (error.code === 'EEXIST') {
+            throw new Error('동일 영상의 게시 예약이 이미 존재합니다. 감사 로그와 TikTok 상태를 먼저 확인하세요.', {
+                cause: error,
+            });
+        }
+        throw error;
+    }
+    closeSync(descriptor);
+}
+function releasePublishLock(openId, contentHash, lockDir = LOCK_DIR) {
+    try {
+        unlinkSync(publishLockPath(openId, contentHash, lockDir));
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+}
+function readJson(filePath) {
+    try {
+        return JSON.parse(readFileSync(filePath, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function existingBlockingAudit(openId, contentHash) {
+    const audit = readJson(auditPath(openId, contentHash));
+    return audit && ['pending', 'published', 'unknown'].includes(audit.state) ? audit : null;
+}
+function postInfo(input) {
+    return {
+        caption: input.caption?.trim() || undefined,
+        is_brand_organic: input.isBrandOrganic ?? false,
+        is_branded_content: input.isBrandedContent ?? false,
+        disable_comment: input.disableComment ?? false,
+        disable_duet: input.disableDuet ?? false,
+        disable_stitch: input.disableStitch ?? false,
+        thumbnail_offset: input.thumbnailOffsetMs,
+        is_ai_generated: input.isAiGenerated ?? true,
+    };
+}
+export async function planVideoPost(input) {
+    assertSourceFile(input.sourceFilePath);
+    assertHttpsUrl(input.videoUrl, 'videoUrl');
+    if (input.customThumbnailUrl)
+        assertHttpsUrl(input.customThumbnailUrl, 'customThumbnailUrl');
+    assertCaption(input.caption ?? '');
+    const config = await ensureTikTokPublishConfig();
+    const settings = await getVideoSettings(config);
+    const validation = await validateVideo(input.sourceFilePath, input.ffmpegPath);
+    const facts = factsFromValidation(input.sourceFilePath, validation);
+    assertVideoFacts(facts, settings);
+    assertThumbnailOffset(input.thumbnailOffsetMs, facts.durationSec);
+    const contentHash = await sha256File(input.sourceFilePath);
+    const duplicate = existingBlockingAudit(config.openId, contentHash);
+    if (duplicate) {
+        throw new Error(`동일 영상의 기존 게시 기록이 있습니다 (state=${duplicate.state}, publishId=${duplicate.publishId ?? 'unknown'}). ` +
+            '중복 자동 게시를 차단했습니다.');
+    }
+    const request = {
+        business_id: config.openId,
+        video_url: input.videoUrl,
+        ...(input.customThumbnailUrl ? { custom_thumbnail_url: input.customThumbnailUrl } : {}),
+        post_info: postInfo(input),
+    };
+    const planId = createHash('sha256')
+        .update(JSON.stringify({ openId: config.openId, contentHash, request }))
+        .digest('hex')
+        .slice(0, 32);
+    const now = Date.now();
+    const plan = {
+        planId,
+        createdAt: new Date(now).toISOString(),
+        expiresAt: new Date(now + PLAN_TTL_MS).toISOString(),
+        openId: config.openId,
+        contentHash,
+        sourceFilePath: input.sourceFilePath,
+        videoFacts: facts,
+        request,
+        settings,
+        warnings: [
+            'videoUrl은 TikTok API for Business 앱에 등록·검증된 도메인의 HTTPS URL이어야 합니다.',
+            'videoUrl은 리디렉션 없이 영상에 직접 2xx로 응답해야 합니다. TikTok은 3xx 리디렉션을 따라가지 않습니다.',
+            'URL은 TikTok이 가져갈 때까지 최소 30분 이상 유효해야 합니다.',
+            '이 계획은 공개 게시이며 30분 뒤 만료됩니다.',
+        ],
+    };
+    privateWrite(planPath(planId), plan);
+    return plan;
+}
+export function loadPostPlan(planId) {
+    if (!/^[a-f0-9]{32}$/.test(planId))
+        throw new Error('planId 형식이 올바르지 않습니다.');
+    const plan = readJson(planPath(planId));
+    if (!plan)
+        throw new Error(`TikTok 게시 계획을 찾지 못했습니다: ${planId}`);
+    if (Date.parse(plan.expiresAt) <= Date.now())
+        throw new Error('TikTok 게시 계획이 만료되었습니다. 다시 계획을 생성하세요.');
+    return plan;
+}
+export async function publishPlannedVideo(planId, confirmPublish) {
+    if (!confirmPublish)
+        throw new Error('공개 게시에는 같은 턴의 명시 승인 후 confirmPublish=true가 필요합니다.');
+    const plan = loadPostPlan(planId);
+    const config = await ensureTikTokPublishConfig();
+    if (config.openId !== plan.openId)
+        throw new Error('게시 계획을 만든 TikTok 계정과 현재 연결 계정이 다릅니다.');
+    const duplicate = existingBlockingAudit(plan.openId, plan.contentHash);
+    if (duplicate)
+        throw new Error(`중복 게시 차단: 기존 기록 state=${duplicate.state}.`);
+    acquirePublishLock(plan.openId, plan.contentHash);
+    const now = new Date().toISOString();
+    const baseAudit = {
+        planId,
+        contentHash: plan.contentHash,
+        openId: plan.openId,
+        state: 'unknown',
+        createdAt: now,
+        updatedAt: now,
+        caption: plan.request.post_info.caption,
+        videoUrl: safeUrl(plan.request.video_url),
+    };
+    try {
+        privateWrite(auditPath(plan.openId, plan.contentHash), baseAudit);
+    }
+    catch (error) {
+        releasePublishLock(plan.openId, plan.contentHash);
+        throw error;
+    }
+    let result;
+    try {
+        result = await publishVideo(config, plan.request);
+    }
+    catch (error) {
+        const knownFailure = error instanceof TikTokApiError && !error.outcomeUnknown;
+        const audit = {
+            ...baseAudit,
+            state: knownFailure ? 'failed' : 'unknown',
+            updatedAt: new Date().toISOString(),
+            requestId: error instanceof TikTokApiError ? error.requestId : undefined,
+            error: error instanceof Error ? error.message : String(error),
+        };
+        privateWrite(auditPath(plan.openId, plan.contentHash), audit);
+        if (knownFailure) {
+            releasePublishLock(plan.openId, plan.contentHash);
+        }
+        else {
+            throw new Error(`${audit.error} 게시 결과가 불명확하므로 자동 재시도하지 마세요.`, { cause: error });
+        }
+        throw error;
+    }
+    const publishId = result.share_id ?? result.publish_id;
+    if (!publishId) {
+        const error = 'TikTok 성공 응답에 share_id/publish_id가 없어 게시 결과를 확인할 수 없습니다.';
+        privateWrite(auditPath(plan.openId, plan.contentHash), {
+            ...baseAudit,
+            updatedAt: new Date().toISOString(),
+            error,
+        });
+        throw new TikTokApiError(`${error} 자동 재시도하지 마세요.`, undefined, undefined, true);
+    }
+    const audit = {
+        ...baseAudit,
+        publishId,
+        state: 'pending',
+        updatedAt: new Date().toISOString(),
+    };
+    try {
+        privateWrite(auditPath(plan.openId, plan.contentHash), audit);
+    }
+    catch (error) {
+        throw new Error('TikTok은 게시 요청을 수락했지만 로컬 감사 로그 갱신에 실패했습니다. 자동 재시도하지 마세요.', {
+            cause: error,
+        });
+    }
+    return { publishId, state: 'pending', planId, audit };
+}
+function findAuditByPublishId(publishId) {
+    try {
+        for (const name of readdirSync(AUDIT_DIR)) {
+            if (!name.endsWith('.json'))
+                continue;
+            const audit = readJson(path.join(AUDIT_DIR, name));
+            if (audit?.publishId === publishId)
+                return audit;
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+function statusState(status) {
+    const value = status.status ?? status.publish_status ?? status.publishStatus;
+    const raw = typeof value === 'string' || typeof value === 'number'
+        ? String(value).toUpperCase()
+        : '';
+    if (raw.includes('COMPLETE') || raw.includes('SUCCESS') || raw === 'PUBLISHED')
+        return 'published';
+    if (raw.includes('FAIL') || raw.includes('REJECT'))
+        return 'failed';
+    if (raw.includes('PROCESS') || raw.includes('PENDING') || raw.includes('PUBLISH'))
+        return 'pending';
+    return null;
+}
+function shouldReleasePublishLock(previous, next) {
+    return previous !== 'failed' && next === 'failed';
+}
+export async function checkPublishStatus(publishId) {
+    const config = await ensureTikTokPublishConfig();
+    const status = await getPublishStatus(config, publishId);
+    const audit = findAuditByPublishId(publishId);
+    if (audit) {
+        const updated = {
+            ...audit,
+            state: statusState(status) ?? audit.state,
+            updatedAt: new Date().toISOString(),
+            providerStatus: status,
+        };
+        privateWrite(auditPath(audit.openId, audit.contentHash), updated);
+        if (shouldReleasePublishLock(audit.state, updated.state)) {
+            releasePublishLock(audit.openId, audit.contentHash);
+        }
+        return { publishId, status, audit: updated };
+    }
+    return { publishId, status, audit: null };
+}
+export function listPublishAudits(limit = 20) {
+    try {
+        return readdirSync(AUDIT_DIR)
+            .filter((name) => name.endsWith('.json'))
+            .map((name) => readJson(path.join(AUDIT_DIR, name)))
+            .filter((audit) => audit !== null)
+            .sort((a, b) => b.updatedAt.localeCompare(a.updatedAt))
+            .slice(0, limit);
+    }
+    catch {
+        return [];
+    }
+}
+export const __testing = {
+    assertCaption,
+    assertThumbnailOffset,
+    assertVideoFacts,
+    acquirePublishLock,
+    countMentions,
+    fpsValue,
+    releasePublishLock,
+    safeUrl,
+    shouldReleasePublishLock,
+    statusState,
+};

package/dist/tiktok-business/setup-cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/tiktok-business/setup-cli.js

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+import readline from 'node:readline';
+import { exchangeAuthorizationCode, getBusinessAccount } from './api.js';
+import { configFromToken, hasTikTokScope } from './auth.js';
+import { loadTikTokBusinessConfig, saveTikTokBusinessConfig } from './config.js';
+import { resolveLang } from '../lib/lang.js';
+const ko = {
+    title: '  🤖 Mimi Seed — TikTok Business 연결',
+    existing: (openId) => `  ✅ 이미 연결됨 (${openId})`,
+    reconnect: '  다시 연결할래? (y/N): ',
+    intro: [
+        '  TikTok for Business Developer 앱과 Organic API 승인이 먼저 필요합니다.',
+        '  앱에서 TikTok Accounts > Business Content > Video Publish 권한을 켜고,',
+        '  TikTok account holder authorization URL로 대상 owned 계정을 승인하세요.',
+        '  callback URL의 auth_code는 10분 동안 한 번만 사용할 수 있습니다.',
+    ],
+    clientId: '  Client ID (App ID): ',
+    clientSecret: '  Client Secret: ',
+    redirectUri: '  Redirect URI (앱 설정값과 정확히 같아야 함): ',
+    authCode: '  callback URL의 auth_code: ',
+    exchanging: '  🔎 authorization code 교환 및 계정 검증 중...',
+    saved: (openId) => `  ✅ 연결 완료 (${openId}) — ~/.mimi-seed/tiktok-business.json (0600)`,
+    cancelled: '  취소됨.',
+};
+const en = {
+    title: '  🤖 Mimi Seed — Connect TikTok Business',
+    existing: (openId) => `  ✅ Already connected (${openId})`,
+    reconnect: '  Connect again? (y/N): ',
+    intro: [
+        '  You first need an approved TikTok for Business developer app with Organic API access.',
+        '  Enable TikTok Accounts > Business Content > Video Publish, then authorize the owned',
+        '  account with the TikTok account-holder authorization URL.',
+        '  The auth_code in the callback URL is single-use and expires in 10 minutes.',
+    ],
+    clientId: '  Client ID (App ID): ',
+    clientSecret: '  Client Secret: ',
+    redirectUri: '  Redirect URI (must exactly match the app setting): ',
+    authCode: '  auth_code from the callback URL: ',
+    exchanging: '  🔎 Exchanging the authorization code and verifying the account...',
+    saved: (openId) => `  ✅ Connected (${openId}) — ~/.mimi-seed/tiktok-business.json (0600)`,
+    cancelled: '  Cancelled.',
+};
+const M = resolveLang() === 'en' ? en : ko;
+const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+const ask = (question) => new Promise((resolve) => rl.question(question, (answer) => resolve(answer.trim())));
+async function main() {
+    console.log('');
+    console.log(M.title);
+    const existing = loadTikTokBusinessConfig();
+    if (existing) {
+        console.log(M.existing(existing.openId));
+        if ((await ask(M.reconnect)).toLowerCase() !== 'y') {
+            console.log(M.cancelled);
+            return;
+        }
+    }
+    console.log('');
+    for (const line of M.intro)
+        console.log(line);
+    console.log('');
+    const clientId = await ask(M.clientId);
+    const clientSecret = await ask(M.clientSecret);
+    const redirectUri = await ask(M.redirectUri);
+    const authCode = await ask(M.authCode);
+    if (![clientId, clientSecret, redirectUri, authCode].every(Boolean)) {
+        console.log(M.cancelled);
+        return;
+    }
+    console.log(M.exchanging);
+    const token = await exchangeAuthorizationCode({ clientId, clientSecret, redirectUri, authCode });
+    const config = configFromToken({ clientId, clientSecret, redirectUri }, token);
+    if (!hasTikTokScope(config, 'video.publish')) {
+        throw new Error('승인된 권한에 video.publish가 없습니다. 앱 권한을 확인한 뒤 다시 승인하세요.');
+    }
+    await getBusinessAccount(config);
+    saveTikTokBusinessConfig(config);
+    console.log(M.saved(config.openId));
+}
+main().catch((error) => {
+    console.error(`\n  ❌ ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+}).finally(() => rl.close());

package/dist/tiktok-business/types.d.ts

@@ -0,0 +1,44 @@
+export interface TikTokEnvelope<T> {
+    code: number;
+    message: string;
+    request_id?: string;
+    data?: T;
+}
+export interface TikTokTokenData {
+    access_token: string;
+    expires_in: number;
+    open_id: string;
+    refresh_token: string;
+    refresh_token_expires_in: number;
+    scope: string;
+    token_type: string;
+}
+export interface TikTokVideoSettings {
+    privacy_level_options?: string[];
+    comment_disabled?: boolean;
+    duet_disabled?: boolean;
+    stitch_disabled?: boolean;
+    max_video_post_duration_sec?: number;
+    [key: string]: unknown;
+}
+export interface TikTokPostInfo {
+    caption?: string;
+    is_brand_organic?: boolean;
+    is_branded_content?: boolean;
+    disable_comment?: boolean;
+    disable_duet?: boolean;
+    disable_stitch?: boolean;
+    thumbnail_offset?: number;
+    is_ai_generated?: boolean;
+}
+export interface TikTokPublishRequest {
+    business_id: string;
+    video_url: string;
+    custom_thumbnail_url?: string;
+    post_info: TikTokPostInfo;
+}
+export interface TikTokPublishData {
+    share_id?: string;
+    publish_id?: string;
+    [key: string]: unknown;
+}

package/dist/tiktok-business/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yoonion/mimi-seed-mcp",
-  "version": "0.15.4",
+  "version": "0.15.6",
   "description": "Mimi Seed MCP server \u2014 Firebase + AdMob + Google Play + App Store management for Claude Code / Codex / Cursor / any MCP client.",
   "type": "module",
   "bin": {
@@ -12,6 +12,7 @@
     "mimi-seed-jenkins-auth": "dist/jenkins/setup-cli.js",
     "mimi-seed-googleads-auth": "dist/googleads/setup-cli.js",
     "mimi-seed-social-auth": "dist/social/setup-cli.js",
+    "mimi-seed-tiktok-business-auth": "dist/tiktok-business/setup-cli.js",
     "mimi-seed-firebase": "dist/firebase/cli.js",
     "mimi-seed-admob": "dist/admob/cli.js",
     "mimi-seed-ga4": "dist/ga4/cli.js"

package/tool-manifest.json

@@ -1,6 +1,6 @@
 {
   "$comment": "등록된 MCP 도구 + 도메인 메타데이터(label·credential·summary)의 SSOT. src/__tests__/tool-manifest.test.ts 가 실제 서버 등록 목록과 diff 하고 메타데이터 정합성을 검사한다. 도구 추가/삭제/개명 시 이 파일을 함께 갱신할 것 — 산문 문서에는 정확한 개수를 쓰지 말고 이 파일을 가리킬 것. mimi-seed://tools/catalog 리소스가 이 파일을 그대로 서빙한다.",
-  "total": 214,
+  "total": 222,
   "domains": {
     "admob": {
       "label": "AdMob",
@@ -318,16 +318,31 @@
     "threads": {
       "label": "Threads",
       "credential": "Threads 토큰 (mimi-seed auth threads)",
-      "summary": "텍스트/이미지 포스팅·토큰 갱신",
+      "summary": "텍스트/이미지/영상 포스팅·토큰 갱신",
       "tools": [
         "threads_save_config",
         "threads_refresh_token",
         "threads_get_account",
         "threads_post",
+        "threads_post_video",
         "threads_post_carousel",
         "threads_current_config"
       ]
     },
+    "tiktok": {
+      "label": "TikTok Business",
+      "credential": "TikTok API for Business OAuth (mimi-seed auth tiktok)",
+      "summary": "Organic API 계정 진단·게시 전 검증·공개 영상 게시·상태·중복 방지 감사 로그",
+      "tools": [
+        "tiktok_business_auth_status",
+        "tiktok_business_get_account",
+        "tiktok_business_get_video_settings",
+        "tiktok_business_plan_video_post",
+        "tiktok_business_publish_video",
+        "tiktok_business_get_publish_status",
+        "tiktok_business_list_publish_audits"
+      ]
+    },
     "video": {
       "label": "영상 제작",
       "credential": "기능별 API 키 + Google OAuth(YouTube 게시) + FFmpeg",