redskillhub-upload 1.0.0-alpha.1

package/README.md

@@ -0,0 +1,76 @@
+# SkillHub Upload CLI
+
+Node.js CLI for uploading local Skills to 小红书 SkillHub.
+
+Install from the public npm registry:
+
+```bash
+npm install -g redskillhub-upload
+```
+
+The CLI owns the executable flow: authorization, local packaging, upload, submit prompts, and final submit. `skill/SKILL.md` is a thin agent workflow that translates chat requests into CLI invocations.
+
+Publish input can be a local Skill directory or a `.zip` file. User-provided zip archives are unpacked and validated as source containers; the zip uploaded to COS is always regenerated by this CLI after local validation.
+
+## API Endpoints
+
+All paths and hosts are centralized in `cli/config.mjs` (`PATHS` + `DEFAULT_API_BASE` / `DEFAULT_OAS_BASE`).
+
+| Path Key | Path | Host | Description |
+|----------|------|------|-------------|
+| `UPLOAD_TOKEN` | `/api/sns/v2/red_skill/upload/permit` | `DEFAULT_API_BASE` | 获取上传授权（COS 临时凭证） |
+| `SUBMIT_SKILL_VERSION` | `/api/sns/v1/openapi/skillhub/submit_skill_version` | `DEFAULT_API_BASE` | 提交 skill 版本 |
+| `CREATE_CLI_OAUTH_DEVICE_CODE` | `/api/sns/v1/creator/red_skill/create_cli_oauth_device_code` | `DEFAULT_API_BASE` | 创建 CLI OAuth 设备码 |
+| `POLL_CLI_OAUTH_DEVICE_TOKEN` | `/api/sns/v1/creator/red_skill/poll_cli_oauth_device_token` | `DEFAULT_API_BASE` | 轮询 CLI OAuth 授权状态 |
+| `OAS_ACCESS_TOKEN` | `/api/sns/v1/oauth2/access_token` | `DEFAULT_OAS_BASE` | 用授权码换取 access_token |
+| `OAS_REFRESH_TOKEN` | `/api/sns/v1/oauth2/refresh_token` | `DEFAULT_OAS_BASE` | 用 refresh_token 续期 access_token |
+
+- `DEFAULT_API_BASE` = `https://edith-skillhub.sl.beta.xiaohongshu.com` — 业务接口
+- `DEFAULT_OAS_BASE` = `https://openaccount.beta.xiaohongshu.com` — OAuth2 开放平台接口
+- 业务接口 host 可通过 `--api-base` 参数或 `SKILLHUB_UPLOAD_API_BASE` 环境变量覆盖
+- OAS 换 token 如需 confidential client 凭证，通过 `SKILLHUB_UPLOAD_APP_SECRET` 注入；不要写入仓库或命令行参数
+
+## Auth Flow
+
+`publish` 会自动保证登录可用，不需要先执行 `whoami` 或 `login`：
+
+1. access_token 有效：直接继续发布
+2. access_token 过期但 refresh_token 有效：自动调用 `refreshToken` 静默续期后继续发布
+3. 首次登录或 refresh_token 也过期：自动进入设备码 OAuth（`createCliOauthDeviceCode` → 用户授权 → `pollCliOauthDeviceToken` → `exchangeToken`），授权成功后原地继续发布
+
+`login` / `whoami` 仍保留用于手动登录和状态诊断。
+
+## Local Dry Run
+
+```bash
+cd tools/redskillhub-upload
+npm install
+node cli/index.mjs publish test/fixtures/minimal-skill --dry-run --agent --source original --tag-id 101,102 --yes
+```
+
+Dry-run examples may use numeric tag IDs because the backend contract accepts `contentTagIds`. Multiple tags are comma-separated; `--tag` can also accept display names resolved from the live tag dictionary.
+
+## Commands
+
+```bash
+redskillhub-upload login
+redskillhub-upload login --agent
+redskillhub-upload login --cancel
+redskillhub-upload publish /absolute/path/to/skill
+redskillhub-upload publish /absolute/path/to/skill --agent
+redskillhub-upload publish /absolute/path/to/skill.zip --agent
+redskillhub-upload whoami
+redskillhub-upload logout
+```
+
+## Agent Protocol
+
+See `docs/protocol.md` for the line protocol:
+
+- `PROMPT:<json>` requests user or agent input.
+- `RESULT_JSON:<json>` reports terminal command state.
+- `UPLOAD_PROGRESS:<number>` reports upload progress.
+
+See `docs/design.md` for the full tool architecture, auth/upload flow, boundaries, and verification plan.
+
+Dry-run never calls external services. Real OAuth, COS upload, and submit adapters are wired; production use depends on the SkillHub OpenAPI endpoints being reachable and configured.

package/cli/auth-prompt.mjs

@@ -0,0 +1,41 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import QRCode from 'qrcode';
+import { getAuthQrPath } from './config.mjs';
+import { writePrompt } from './output.mjs';
+
+export async function renderDeviceAuthPrompt(payload, options = {}) {
+  const {
+    agent = false,
+    env = process.env,
+    stream = process.stdout,
+    qrCode = QRCode
+  } = options;
+
+  if (agent) {
+    const qrCodePath = getAuthQrPath(env);
+    await fs.mkdir(path.dirname(qrCodePath), { recursive: true, mode: 0o700 });
+    await qrCode.toFile(qrCodePath, payload.authorizeUrl, {
+      type: 'png',
+      width: 512,
+      margin: 2,
+      errorCorrectionLevel: 'M'
+    });
+    await fs.chmod(qrCodePath, 0o600);
+    writePrompt({ ...payload, qrCodePath }, stream);
+    return;
+  }
+
+  const qr = await qrCode.toString(payload.authorizeUrl, {
+    type: 'terminal',
+    small: true,
+    errorCorrectionLevel: 'M'
+  });
+  const minutes = Math.max(1, Math.ceil(Number(payload.expiresInSeconds || 0) / 60));
+  stream.write(`${qr}\n`);
+  stream.write(`${payload.message}\n`);
+  stream.write(`授权链接：${payload.authorizeUrl}\n`);
+  stream.write(`授权码：${payload.userCode}\n`);
+  stream.write(`有效期：${minutes} 分钟\n`);
+}
+

package/cli/auth.mjs

@@ -0,0 +1,453 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import {
+  DEFAULT_API_BASE,
+  DEFAULT_APP_ID,
+  DEFAULT_OAS_BASE,
+  DEFAULT_SCOPE,
+  DEFAULT_SCOPES,
+  PATHS,
+  TOKEN_REFRESH_BUFFER_MS,
+  getAuthQrPath,
+  getCredentialsPath,
+  getHomeDir,
+  getPendingAuthPath,
+  resolveApiBase
+} from './config.mjs';
+import { ExitCodes, SkillhubUploadError } from './errors.mjs';
+import { compatibleFetch } from './fetch.mjs';
+import { renderDeviceAuthPrompt } from './auth-prompt.mjs';
+
+function base64Url(input) {
+  return Buffer.from(input).toString('base64url');
+}
+
+export async function createPkcePair() {
+  const codeVerifier = base64Url(crypto.randomBytes(48)).slice(0, 64).replace(/-/g, '.');
+  const hash = crypto.createHash('sha256').update(codeVerifier).digest();
+  return {
+    codeVerifier,
+    codeChallenge: base64Url(hash),
+    codeChallengeMethod: 'S256'
+  };
+}
+
+function isValidCredentials(credentials, nowMs = Date.now()) {
+  if (!credentials?.accessToken) return false;
+  const expireTimeMs = Number(credentials.expireTimeMs || 0);
+  return Number.isFinite(expireTimeMs) && expireTimeMs > nowMs + TOKEN_REFRESH_BUFFER_MS;
+}
+
+function canRefreshCredentials(credentials, nowMs = Date.now()) {
+  if (!credentials?.refreshToken) return false;
+  const refreshExpireTimeMs = Number(credentials.refreshExpireTimeMs || 0);
+  return Number.isFinite(refreshExpireTimeMs) && refreshExpireTimeMs > nowMs + TOKEN_REFRESH_BUFFER_MS;
+}
+
+export async function readCredentials(env = process.env) {
+  try {
+    const file = getCredentialsPath(env);
+    await fs.chmod(file, 0o600).catch(() => {});
+    return JSON.parse(await fs.readFile(file, 'utf8'));
+  } catch (error) {
+    if (error.code === 'ENOENT') return null;
+    throw error;
+  }
+}
+
+export async function writeCredentials(credentials, env = process.env) {
+  const home = getHomeDir(env);
+  const file = getCredentialsPath(env);
+  const tmp = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  await fs.mkdir(home, { recursive: true, mode: 0o700 });
+  try {
+    await fs.writeFile(tmp, `${JSON.stringify(credentials, null, 2)}\n`, { mode: 0o600 });
+    await fs.chmod(tmp, 0o600);
+    await fs.rename(tmp, file);
+    await fs.chmod(file, 0o600);
+  } catch (error) {
+    await fs.rm(tmp, { force: true }).catch(() => {});
+    throw error;
+  }
+}
+
+export async function removeCredentials(env = process.env) {
+  await fs.rm(getCredentialsPath(env), { force: true });
+}
+
+export function maskCredentials(credentials) {
+  if (!credentials) return { loggedIn: false };
+  const loggedIn = Boolean(credentials.accessToken);
+  return {
+    loggedIn,
+    appId: credentials.appId,
+    openId: credentials.openId,
+    scope: credentials.scope,
+    expireTimeMs: credentials.expireTimeMs,
+    refreshExpireTimeMs: credentials.refreshExpireTimeMs,
+    accessToken: '<hidden>',
+    refreshToken: '<hidden>'
+  };
+}
+
+function normalizeAuthStatus(status) {
+  if (typeof status === 'number') {
+    if (status === 1) return 'pending';
+    if (status === 2) return 'approved';
+    if (status === 3) return 'denied';
+    if (status === 4) return 'expired';
+    if (status === 5) return 'cancelled';
+    return 'unknown';
+  }
+  return String(status || '').toLowerCase();
+}
+
+function unwrapResponseBody(body) {
+  return body?.data && typeof body.data === 'object' ? body.data : body;
+}
+
+function resolveAppSecret(flags = {}, env = process.env) {
+  return flags.appSecret || flags['app-secret'] || env.SKILLHUB_UPLOAD_APP_SECRET || '';
+}
+
+function buildTokenRequestBody(fields = {}) {
+  const body = {
+    app_id: fields.appId,
+    code: fields.authorizationCode,
+    code_verifier: fields.codeVerifier
+  };
+  if (fields.appSecret) {
+    body.app_secret = fields.appSecret;
+  }
+  return body;
+}
+
+function buildRefreshRequestBody(fields = {}) {
+  const body = {
+    app_id: fields.appId,
+    refresh_token: fields.refreshToken
+  };
+  if (fields.appSecret) {
+    body.app_secret = fields.appSecret;
+  }
+  return body;
+}
+
+function getRejectMessage(body, fallback) {
+  const data = unwrapResponseBody(body);
+  return data?.message
+    || data?.msg
+    || data?.error_description
+    || data?.error
+    || body?.message
+    || body?.msg
+    || body?.error_description
+    || body?.error
+    || fallback;
+}
+
+function assertTokenResponseAccepted(body, errorCode, fallbackMessage) {
+  const data = unwrapResponseBody(body);
+  if (body?.success === false || data?.success === false) {
+    throw new SkillhubUploadError(
+      errorCode,
+      getRejectMessage(body, fallbackMessage),
+      ExitCodes.AUTH
+    );
+  }
+}
+
+function normalizeDeviceCodePayload(body) {
+  const data = unwrapResponseBody(body);
+  return {
+    deviceCode: data.deviceCode || data.device_code || '',
+    userCode: data.userCode || data.user_code || '',
+    authorizeUrl: data.authorizeUrl || data.authorize_url || '',
+    expiresInSeconds: data.expiresInSeconds || data.expires_in_seconds,
+    pollIntervalSeconds: data.pollIntervalSeconds || data.poll_interval_seconds
+  };
+}
+
+function normalizePollPayload(body) {
+  const data = unwrapResponseBody(body);
+  const result = {
+    authStatus: data.authStatus ?? data.auth_status ?? data.status
+  };
+  const authorizationCode = data.authorizationCode || data.authorization_code;
+  if (authorizationCode) {
+    result.authorizationCode = authorizationCode;
+  }
+  return result;
+}
+
+export async function requestDeviceCode({ apiBase, pkce, fetchImpl = compatibleFetch }) {
+  const response = await fetchImpl(`${apiBase}${PATHS.CREATE_CLI_OAUTH_DEVICE_CODE}`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({
+      code_challenge: pkce.codeChallenge,
+      code_challenge_method: pkce.codeChallengeMethod,
+      scopes: DEFAULT_SCOPES
+    })
+  });
+  if (!response.ok) {
+    throw new SkillhubUploadError(
+      'AUTH_DEVICE_CODE_FAILED',
+      `申请授权码失败: HTTP ${response.status}`,
+      ExitCodes.AUTH
+    );
+  }
+  return normalizeDeviceCodePayload(await response.json());
+}
+
+export async function pollDeviceToken({ apiBase, deviceCode, fetchImpl = compatibleFetch }) {
+  const url = new URL(`${apiBase}${PATHS.POLL_CLI_OAUTH_DEVICE_TOKEN}`);
+  url.searchParams.set('device_code', deviceCode);
+  const response = await fetchImpl(url.toString(), {
+    method: 'GET'
+  });
+  if (!response.ok) {
+    throw new SkillhubUploadError(
+      'AUTH_POLL_FAILED',
+      `轮询授权状态失败: HTTP ${response.status}`,
+      ExitCodes.AUTH
+    );
+  }
+  return normalizePollPayload(await response.json());
+}
+
+export async function exchangeToken({
+  tokenUrl = `${DEFAULT_OAS_BASE}${PATHS.OAS_ACCESS_TOKEN}`,
+  appId = DEFAULT_APP_ID,
+  appSecret = '',
+  authorizationCode,
+  codeVerifier,
+  fetchImpl = compatibleFetch
+}) {
+  const body = buildTokenRequestBody({ appId, appSecret, authorizationCode, codeVerifier });
+  const response = await fetchImpl(tokenUrl, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body)
+  });
+  if (!response.ok) {
+    throw new SkillhubUploadError(
+      'OAS_TOKEN_EXCHANGE_UNAVAILABLE',
+      `换取 token 失败: HTTP ${response.status}`,
+      ExitCodes.AUTH
+    );
+  }
+  const responseBody = await response.json();
+  assertTokenResponseAccepted(responseBody, 'OAS_TOKEN_EXCHANGE_REJECTED', '换取 token 被 OAS 拒绝');
+  return unwrapResponseBody(responseBody);
+}
+
+export async function refreshToken({
+  tokenUrl = `${DEFAULT_OAS_BASE}${PATHS.OAS_REFRESH_TOKEN}`,
+  appId = DEFAULT_APP_ID,
+  appSecret = '',
+  refreshToken: rt,
+  fetchImpl = compatibleFetch
+}) {
+  const body = buildRefreshRequestBody({ appId, appSecret, refreshToken: rt });
+  const response = await fetchImpl(tokenUrl, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body)
+  });
+  if (!response.ok) {
+    throw new SkillhubUploadError(
+      'OAS_TOKEN_REFRESH_UNAVAILABLE',
+      `刷新 token 失败: HTTP ${response.status}`,
+      ExitCodes.AUTH
+    );
+  }
+  const responseBody = await response.json();
+  assertTokenResponseAccepted(responseBody, 'OAS_TOKEN_REFRESH_REJECTED', '刷新 token 被 OAS 拒绝');
+  return unwrapResponseBody(responseBody);
+}
+
+function buildCredentialsFromToken(token, nowMs, errorCode) {
+  const credentials = {
+    appId: token.app_id || token.appId || DEFAULT_APP_ID,
+    accessToken: token.access_token || token.accessToken || '',
+    refreshToken: token.refresh_token || token.refreshToken || '',
+    expireTimeMs: String(token.expire_time_ms || token.expireTimeMs || nowMs + Number(token.expires_in || 7200) * 1000),
+    refreshExpireTimeMs: String(
+      token.refresh_expire_time_ms
+        || token.refreshExpireTimeMs
+        || nowMs + 180 * 24 * 3600 * 1000
+    ),
+    openId: token.open_id || token.openId || '',
+    scope: token.scope || DEFAULT_SCOPE,
+    obtainedAtMs: String(nowMs)
+  };
+  if (!credentials.accessToken || !credentials.refreshToken) {
+    throw new SkillhubUploadError(
+      errorCode,
+      '换取 token 响应缺少 access_token 或 refresh_token',
+      ExitCodes.AUTH
+    );
+  }
+  return credentials;
+}
+
+async function readPendingAuth(env, now) {
+  try {
+    const raw = JSON.parse(await fs.readFile(getPendingAuthPath(env), 'utf8'));
+    if (raw?.expiresAtMs && raw.expiresAtMs > now() && raw.deviceCode && raw.codeVerifier) {
+      return raw;
+    }
+  } catch {
+    // no pending state
+  }
+  return null;
+}
+
+async function writePendingAuth(env, state) {
+  const file = getPendingAuthPath(env);
+  await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+  await fs.writeFile(file, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+}
+
+async function clearPendingAuth(env) {
+  await fs.rm(getPendingAuthPath(env), { force: true });
+  await fs.rm(getAuthQrPath(env), { force: true });
+}
+
+export async function cancelLogin(env = process.env) {
+  let hadPending = true;
+  try {
+    await fs.access(getPendingAuthPath(env));
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+    hadPending = false;
+  }
+  await clearPendingAuth(env);
+  return { hadPending };
+}
+
+export async function login({
+  flags = {},
+  env = process.env,
+  fetchImpl = compatibleFetch,
+  sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  now = () => Date.now(),
+  promptStream = process.stdout
+} = {}) {
+  const cachedCredentials = await readCredentials(env);
+  if (isValidCredentials(cachedCredentials, now())) {
+    return maskCredentials(cachedCredentials);
+  }
+
+  // access_token 过期但 refresh_token 仍有效，静默续期
+  if (canRefreshCredentials(cachedCredentials, now())) {
+    try {
+      const appSecret = resolveAppSecret(flags, env);
+      const token = await refreshToken({
+        appId: cachedCredentials.appId || DEFAULT_APP_ID,
+        appSecret,
+        refreshToken: cachedCredentials.refreshToken,
+        tokenUrl: flags.tokenUrl || `${DEFAULT_OAS_BASE}${PATHS.OAS_REFRESH_TOKEN}`,
+        fetchImpl
+      });
+      await writeCredentials(buildCredentialsFromToken(token, now(), 'OAS_TOKEN_REFRESH_INVALID_RESPONSE'), env);
+      return maskCredentials(await readCredentials(env));
+    } catch (error) {
+      if (error instanceof SkillhubUploadError) {
+        // 刷新失败，降级走设备码
+      } else {
+        throw error;
+      }
+    }
+  }
+
+  const apiBase = resolveApiBase(flags);
+
+  // 从磁盘恢复未完成的授权状态，避免进程重启后要求用户重新授权
+  let pending = await readPendingAuth(env, now);
+  let codeVerifier;
+  if (pending) {
+    codeVerifier = pending.codeVerifier;
+    await renderDeviceAuthPrompt({
+      type: 'auth_device_code',
+      authorizeUrl: pending.authorizeUrl,
+      userCode: pending.userCode,
+      expiresInSeconds: Math.round((pending.expiresAtMs - now()) / 1000),
+      message: '检测到未完成的授权，继续等待中（无需重新打开授权链接）'
+    }, { agent: Boolean(flags.agent), env, stream: promptStream });
+  } else {
+    const pkce = await createPkcePair();
+    codeVerifier = pkce.codeVerifier;
+    const device = await requestDeviceCode({ apiBase, pkce, fetchImpl });
+    await writePendingAuth(env, {
+      deviceCode: device.deviceCode,
+      codeVerifier: pkce.codeVerifier,
+      authorizeUrl: device.authorizeUrl,
+      userCode: device.userCode,
+      pollIntervalSeconds: device.pollIntervalSeconds || 5,
+      expiresAtMs: now() + (device.expiresInSeconds || 600) * 1000
+    });
+    pending = await readPendingAuth(env, now);
+    await renderDeviceAuthPrompt({
+      type: 'auth_device_code',
+      authorizeUrl: device.authorizeUrl,
+      userCode: device.userCode,
+      expiresInSeconds: device.expiresInSeconds || 600,
+      message: '请用手机自带浏览器打开授权链接，页面会自动跳转至小红书 App 授权；授权页输入授权码后 CLI 会自动轮询'
+    }, { agent: Boolean(flags.agent), env, stream: promptStream });
+  }
+
+  const deadline = pending.expiresAtMs;
+  let authorizationCode = '';
+  try {
+    while (now() < deadline) {
+      await sleep((pending.pollIntervalSeconds || 5) * 1000);
+      // 这里只检测跨进程取消，不把自然过期误判为取消。
+      const activePending = await readPendingAuth(env, () => 0);
+      if (!activePending || activePending.deviceCode !== pending.deviceCode) {
+        throw new SkillhubUploadError(
+          'AUTH_CANCELLED',
+          '已取消等待登录',
+          ExitCodes.CANCELLED
+        );
+      }
+      const polled = await pollDeviceToken({ apiBase, deviceCode: pending.deviceCode, fetchImpl });
+      const authStatus = normalizeAuthStatus(polled.authStatus ?? polled.status);
+      if (authStatus === 'approved') {
+        authorizationCode = polled.authorizationCode || polled.authorization_code || '';
+        break;
+      }
+      if (authStatus === 'expired') {
+        await clearPendingAuth(env);
+        throw new SkillhubUploadError('AUTH_TIMEOUT', '授权超时，请重新发起', ExitCodes.AUTH);
+      }
+      if (authStatus === 'cancelled' || authStatus === 'denied' || authStatus === 'rejected') {
+        await clearPendingAuth(env);
+        throw new SkillhubUploadError('AUTH_DENIED', '用户拒绝授权', ExitCodes.AUTH);
+      }
+    }
+    if (!authorizationCode) {
+      await clearPendingAuth(env);
+      throw new SkillhubUploadError('AUTH_TIMEOUT', '授权超时，请重新发起', ExitCodes.AUTH);
+    }
+  } catch (error) {
+    if (!(error instanceof SkillhubUploadError)) {
+      await clearPendingAuth(env);
+    }
+    throw error;
+  }
+
+  const token = await exchangeToken({
+    appId: DEFAULT_APP_ID,
+    appSecret: resolveAppSecret(flags, env),
+    authorizationCode,
+    codeVerifier,
+    tokenUrl: flags.tokenUrl || `${DEFAULT_OAS_BASE}${PATHS.OAS_ACCESS_TOKEN}`,
+    fetchImpl
+  });
+  await writeCredentials(buildCredentialsFromToken(token, now(), 'OAS_TOKEN_EXCHANGE_INVALID_RESPONSE'), env);
+  await clearPendingAuth(env);
+  return maskCredentials(await readCredentials(env));
+}

package/cli/config.mjs

@@ -0,0 +1,51 @@
+import os from 'node:os';
+import path from 'node:path';
+
+export const DEFAULT_API_BASE = 'https://edith.xiaohongshu.com';
+export const DEFAULT_OAS_BASE = 'https://openaccount.xiaohongshu.com';
+export const DEFAULT_APP_ID = 'xhsyfHfmZQAQ24o';
+export const DEFAULT_SCOPES = ['base_info', 'skill_publish'];
+export const DEFAULT_SCOPE = DEFAULT_SCOPES.join(',');
+
+export const PATHS = {
+  UPLOAD_TOKEN: '/api/sns/v2/red_skill/upload/permit',
+  SUBMIT_SKILL_VERSION: '/api/sns/v1/creator/red_skill/cli_submit_skill_version',
+  CREATE_CLI_OAUTH_DEVICE_CODE: '/api/sns/v1/creator/red_skill/create_cli_oauth_device_code',
+  POLL_CLI_OAUTH_DEVICE_TOKEN: '/api/sns/v1/creator/red_skill/poll_cli_oauth_device_token',
+  OAS_ACCESS_TOKEN: '/api/sns/v1/oauth2/access_token',
+  OAS_REFRESH_TOKEN: '/api/sns/v1/oauth2/refresh_token',
+  QUERY_CONTENT_TAG_CONFIG: '/api/sns/v1/activity_platform/config/query_config'
+};
+export const TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1000;
+export const CONTENT_TAG_MATERIAL_ID = '750';
+export const CONTENT_TAG_MODULE_ID = '811';
+export const CONTENT_TAG_CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+export const CONTENT_TAG_FETCH_TIMEOUT_MS = 3000;
+
+export function getHomeDir(env = process.env) {
+  return env.SKILLHUB_UPLOAD_HOME || path.join(os.homedir(), '.skillhub-upload');
+}
+
+export function getCredentialsPath(env = process.env) {
+  return path.join(getHomeDir(env), 'credentials.json');
+}
+
+export function getTmpDir(env = process.env) {
+  return path.join(getHomeDir(env), 'tmp');
+}
+
+export function getContentTagCachePath(env = process.env) {
+  return path.join(getHomeDir(env), 'content-tags.json');
+}
+
+export function getPendingAuthPath(env = process.env) {
+  return path.join(getHomeDir(env), 'pending-auth.json');
+}
+
+export function getAuthQrPath(env = process.env) {
+  return path.join(getHomeDir(env), 'auth-qr.png');
+}
+
+export function resolveApiBase(flags = {}) {
+  return flags.apiBase || process.env.SKILLHUB_UPLOAD_API_BASE || DEFAULT_API_BASE;
+}

package/cli/errors.mjs

@@ -0,0 +1,30 @@
+export class SkillhubUploadError extends Error {
+  constructor(code, message, exitCode = 1) {
+    super(message);
+    this.name = 'SkillhubUploadError';
+    this.code = code;
+    this.exitCode = exitCode;
+  }
+}
+
+export const ExitCodes = Object.freeze({
+  OK: 0,
+  GENERAL: 1,
+  NEED_LOGIN: 2,
+  AUTH: 3,
+  CANCELLED: 130,
+  INVALID_ARGS: 64,
+  LOCAL_VALIDATION: 10,
+  PACK_FAILED: 11,
+  PERMIT_FAILED: 20,
+  COS_UPLOAD_FAILED: 21,
+  SUBMIT_REJECTED: 22,
+  SUBMIT_FAILED: 23
+});
+
+export function toResultError(error) {
+  if (error instanceof SkillhubUploadError) {
+    return { status: 'error', code: error.code, message: error.message };
+  }
+  return { status: 'error', code: 'UNEXPECTED_ERROR', message: error?.message || String(error) };
+}