@coze-arch/cli 0.0.36-alpha.a7a716 → 0.0.36-alpha.af24fb

package/lib/cli.js

@@ -28,6 +28,7 @@ var node_os = require('node:os');
 var promises = require('node:fs/promises');
 var node_child_process = require('node:child_process');
 var node_util = require('node:util');
+var tar = require('tar');
 var node_stream = require('node:stream');
 
 /**
@@ -2113,7 +2114,7 @@ const EventBuilder = {
 };
 
 var name = "@coze-arch/cli";
-var version = "0.0.36-alpha.a7a716";
+var version = "0.0.36-alpha.af24fb";
 var description = "coze coding devtools cli";
 var license = "MIT";
 var author = "fanwenjie.fe@bytedance.com";
@@ -5961,35 +5962,66 @@ const saveProjectPatchState = async (
   await saveTomlCozeConfig(config, projectPath);
 };
 
-/**
- * 获取指定命令的配置
- *
- * @param config - .coze 配置对象
- * @param commandName - 命令名称 (dev/build/start)
- * @returns 命令配置数组
- */
-const getCommandConfig = (
+
+
+const getDefaultCommandConfig = (
   config,
   commandName,
 ) => {
-  let commandConfig;
+  switch (commandName) {
+    case 'dev':
+      return _optionalChain$k([config, 'access', _ => _.dev, 'optionalAccess', _2 => _2.run]);
+    case 'build':
+      return _optionalChain$k([config, 'access', _3 => _3.deploy, 'optionalAccess', _4 => _4.build]);
+    case 'start':
+      return _optionalChain$k([config, 'access', _5 => _5.deploy, 'optionalAccess', _6 => _6.run]);
+    case 'validate':
+      return _optionalChain$k([config, 'access', _7 => _7.dev, 'optionalAccess', _8 => _8.validate]);
+    default:
+      throw new Error(`Unknown command: ${commandName}`);
+  }
+};
 
+const getWindowsCommandConfig = (
+  config,
+  commandName,
+) => {
   switch (commandName) {
     case 'dev':
-      commandConfig = _optionalChain$k([config, 'access', _ => _.dev, 'optionalAccess', _2 => _2.run]);
-      break;
+      return _optionalChain$k([config, 'access', _9 => _9.dev, 'optionalAccess', _10 => _10.run_win]);
     case 'build':
-      commandConfig = _optionalChain$k([config, 'access', _3 => _3.deploy, 'optionalAccess', _4 => _4.build]);
-      break;
+      return _optionalChain$k([config, 'access', _11 => _11.deploy, 'optionalAccess', _12 => _12.build_win]);
     case 'start':
-      commandConfig = _optionalChain$k([config, 'access', _5 => _5.deploy, 'optionalAccess', _6 => _6.run]);
-      break;
+      return _optionalChain$k([config, 'access', _13 => _13.deploy, 'optionalAccess', _14 => _14.run_win]);
     case 'validate':
-      commandConfig = _optionalChain$k([config, 'access', _7 => _7.dev, 'optionalAccess', _8 => _8.validate]);
-      break;
+      return _optionalChain$k([config, 'access', _15 => _15.dev, 'optionalAccess', _16 => _16.validate_win]);
     default:
       throw new Error(`Unknown command: ${commandName}`);
   }
+};
+
+/**
+ * 获取指定命令的配置
+ *
+ * Windows 优先使用非空的 *_win 配置；其他平台（包括 WSL）始终使用默认配置。
+ *
+ * @param config - .coze 配置对象
+ * @param commandName - 命令名称 (dev/build/start)
+ * @returns 命令配置数组
+ */
+const getCommandConfig = (
+  config,
+  commandName,
+  platform = process.platform,
+) => {
+  const defaultCommandConfig = getDefaultCommandConfig(config, commandName);
+  const windowsCommandConfig =
+    platform === 'win32'
+      ? getWindowsCommandConfig(config, commandName)
+      : undefined;
+  const commandConfig = _optionalChain$k([windowsCommandConfig, 'optionalAccess', _17 => _17.length])
+    ? windowsCommandConfig
+    : defaultCommandConfig;
 
   if (!commandConfig || commandConfig.length === 0) {
     throw new Error(
@@ -10484,11 +10516,15 @@ const loadConfig = async (options = {}) => {
         }
       : {}),
     ...(process.env.COZE_ORG_ID ? { organizationId: process.env.COZE_ORG_ID } : {}),
+    ...(process.env.COZE_ACCOUNT_ID ? { cozeAccountId: process.env.COZE_ACCOUNT_ID } : {}),
     ...(process.env.COZE_SPACE_ID ? { spaceId: process.env.COZE_SPACE_ID } : {}),
     ...(process.env.COZE_PROJECT_ID ? { projectId: process.env.COZE_PROJECT_ID } : {}),
     ...(options.orgId ? { organizationId: options.orgId } : {}),
     ...(options.spaceId ? { spaceId: options.spaceId } : {}),
     ...(options.apiBaseUrl ? { apiBaseUrl: options.apiBaseUrl } : {}),
+    // Runtime-only trust decision: a value persisted in config.json must never enable
+    // project-secret injection for an OAuth access token.
+    injectApiToken: Boolean(environmentAccessToken),
   };
   return config;
 };
@@ -10932,8 +10968,20 @@ class DeployApiClient {
       'agw-js-conv': 'str',
       'x-request-from-coze-cli': '1',
     };
-    if (this.config.organizationId) {
-      headers['x-coze-account'] = this.config.organizationId;
+    // Only an explicit environment credential may become a project runtime secret.
+    // OAuth credentials loaded from config.json remain authentication-only.
+    if (
+      this.config.injectApiToken &&
+      path === '/deploy_history/create' &&
+      useApiPrefix
+    ) {
+      headers['x-coze-deploy-inject-api-token'] = 'true';
+    }
+    // Coze account id: an explicit COZE_ACCOUNT_ID (config.cozeAccountId) always wins;
+    // otherwise fall back to the organization id resolved from login/config.
+    const cozeAccount = this.config.cozeAccountId || this.config.organizationId;
+    if (cozeAccount) {
+      headers['x-coze-account'] = cozeAccount;
     }
     const lane = _optionalChain$9([this, 'access', _4 => _4.globalOptions, 'access', _5 => _5.lane, 'optionalAccess', _6 => _6.trim, 'call', _7 => _7()]) || _optionalChain$9([this, 'access', _8 => _8.config, 'access', _9 => _9.xTTEnv, 'optionalAccess', _10 => _10.trim, 'call', _11 => _11()]);
     if (lane) {
@@ -10999,6 +11047,17 @@ class DeployApiClient {
     );
   }
 
+  // 回读当前登录态对应的 Coze 账号 id。无入参：账号由服务端从登录态解析（X-Coze-Account →
+  // access token → 兜底登录用户），客户端传什么都只有「等于登录态」一种合法取值。
+  // 只在建 Project 前用一次，用来定这个 Project 下应用的账号归属。
+  getCozeAccount() {
+    return this.post(
+      '/account/get',
+      {},
+      'coze_account_id',
+    );
+  }
+
   listSpaces(body
 
 
@@ -11171,6 +11230,35 @@ class DeployApiClient {
     );
   }
 
+  authorizeMiniProgram(body
+
+
+
+
+
+
+) {
+    return this.post
+
+
+
+('/mini_program/auth', body);
+  }
+
+  createMiniProgramPreview(body
+
+
+
+
+) {
+    return this.post
+
+
+
+
+('/mini_program/preview', body);
+  }
+
   listDomains(appId, unitType) {
     return this.post(
       '/domain/list', {
@@ -11442,6 +11530,59 @@ const getDeployAppIdOption = (
   command,
 ) => options.appId || getDeployParentOptions(command).appId;
 
+function _optionalChain$7(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } async function _asyncOptionalChain$1(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = await fn(value); } else if (op === 'call' || op === 'optionalCall') { value = await fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+const isAccountId = (value) => /^[1-9]\d*$/u.test(value);
+
+/**
+ * 定出这个 Project 下的应用该归属哪个 Coze 账号，写进 project_settings.extra.coze_account_id。
+ *
+ * 优先级（与 api-client 里 x-coze-account 的取值顺序一致，不另立一套口径）：
+ *   1. COZE_ACCOUNT_ID（config.cozeAccountId）—— 用户显式指定
+ *   2. COZE_ORG_ID / --org-id（config.organizationId）—— 用户显式指定组织
+ *   3. 登录态回读（deploy v2 account/get）
+ *
+ * ⚠️ 1、2 命中时**不打接口**：本地已经知道账号了，再问一次服务端只是多一个 RTT 和一个失败点。
+ *
+ * 拿不到就返回 undefined（不写 extra），部署照常继续：服务端在 deploy_history/create 里仍会
+ * 按同一条阶梯解析账号，结果与不加这段逻辑时完全一致 —— 只是无登录态的预览初始化那条链路
+ * 少了 Project 上这份归属记录。这是一个辅助接口，不该成为首次部署的单点。
+ */
+const resolveCozeAccountId = async (
+  runtime,
+) => {
+  const configured =
+    _optionalChain$7([runtime, 'access', _ => _.config, 'access', _2 => _2.cozeAccountId, 'optionalAccess', _3 => _3.trim, 'call', _4 => _4()]) || _optionalChain$7([runtime, 'access', _5 => _5.config, 'access', _6 => _6.organizationId, 'optionalAccess', _7 => _7.trim, 'call', _8 => _8()]);
+  if (configured) {
+    if (!isAccountId(configured)) {
+      // 不把非法值写进 Project —— 它会被服务端当成「明确但损坏的归属」直接报错。
+      // 该值仍会作为 x-coze-account 发出去，由服务端给出明确的参数错误。
+      runtime.output.debug(
+        `[deploy] Ignoring malformed Coze account id for project settings: ${configured}`,
+      );
+      return undefined;
+    }
+    runtime.output.debug(`[deploy] Using configured Coze account ${configured}`);
+    return configured;
+  }
+  try {
+    const accountId = await _asyncOptionalChain$1([(await runtime.client.getCozeAccount()), 'access', async _9 => _9.coze_account_id, 'optionalAccess', async _10 => _10.trim, 'call', async _11 => _11()]);
+    if (!accountId || !isAccountId(accountId)) {
+      runtime.output.debug(
+        `[deploy] Deployment API returned no usable Coze account id: ${String(accountId)}`,
+      );
+      return undefined;
+    }
+    runtime.output.debug(`[deploy] Resolved Coze account ${accountId} from the current login`);
+    return accountId;
+  } catch (error) {
+    runtime.output.warn(
+      `Unable to resolve the Coze account from the current login; the project will be created without an explicit account: ${String(error)}`,
+    );
+    return undefined;
+  }
+};
+
 const getCreateDeployConfig = (config) => ({
   deploy_config: {
     cpu: config.deploy_config.cpu,
@@ -11485,10 +11626,10 @@ const TERMINAL_STATUSES = new Set([
 const getDeployStatusText = (status) =>
   status ? STATUS_NAMES[status] || 'Unknown' : 'Unknown';
 
-function _optionalChain$7(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+function _optionalChain$6(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
 const formatDeployDetails = (history) =>
-  (_optionalChain$7([history, 'optionalAccess', _ => _.deploy_detail]) || []).map(detail => ({
+  (_optionalChain$6([history, 'optionalAccess', _ => _.deploy_detail]) || []).map(detail => ({
     target: detail.target,
     status: getDeployStatusText(detail.status),
     deploy_log_key: detail.deploy_log_key,
@@ -11498,7 +11639,7 @@ const formatDeployDetails = (history) =>
 const getDeployLogKeys = (history) =>
   [...new Set(
     (history.deploy_detail || [])
-      .map(detail => _optionalChain$7([detail, 'access', _2 => _2.deploy_log_key, 'optionalAccess', _3 => _3.trim, 'call', _4 => _4()]))
+      .map(detail => _optionalChain$6([detail, 'access', _2 => _2.deploy_log_key, 'optionalAccess', _3 => _3.trim, 'call', _4 => _4()]))
       .filter((key) => Boolean(key)),
   )];
 
@@ -11513,7 +11654,7 @@ const resolveDeployHistoryId = (
 ) =>
   normalizePositiveId(deployHistoryId) || normalizePositiveId(previousDeployHistoryId);
 
-function _optionalChain$6(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+function _optionalChain$5(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
 const SOURCE_SNAPSHOT_BYTES = 20;
 const PROJECT_METADATA_FILE_MODE = 0o644;
@@ -11523,7 +11664,7 @@ const isId = (value) =>
 
 
 const resolveAppId = async (cwd, appId) => {
-  const explicit = _optionalChain$6([appId, 'optionalAccess', _ => _.trim, 'call', _2 => _2()]);
+  const explicit = _optionalChain$5([appId, 'optionalAccess', _ => _.trim, 'call', _2 => _2()]);
   if (explicit) {
     return explicit;
   }
@@ -11569,11 +11710,11 @@ const readProjectMetadata = async (
     }
     throw error;
   }
-  const projectSection = _optionalChain$6([cozeFileContent, 'access', _3 => _3.match, 'call', _4 => _4(
+  const projectSection = _optionalChain$5([cozeFileContent, 'access', _3 => _3.match, 'call', _4 => _4(
     /^\s*\[project\]\s*(?:#.*)?$([\s\S]*?)(?=^\s*\[[^\]]+\]\s*(?:#.*)?$|(?![\s\S]))/mu,
   ), 'optionalAccess', _5 => _5[1]]);
   const readProjectString = (key) =>
-    _optionalChain$6([projectSection
+    _optionalChain$5([projectSection
 , 'optionalAccess', _6 => _6.match, 'call', _7 => _7(new RegExp(`^\\s*${key}\\s*=\\s*["']([^"']+)["']`, 'mu')), 'optionalAccess', _8 => _8[1]
 , 'optionalAccess', _9 => _9.trim, 'call', _10 => _10()]);
   const name = readProjectString('name');
@@ -11581,7 +11722,7 @@ const readProjectMetadata = async (
   const projectId = readProjectString('project_id');
   const appId = readProjectString('app_id');
   const hasUnquotedId = (key) =>
-    Boolean(_optionalChain$6([projectSection, 'optionalAccess', _11 => _11.match, 'call', _12 => _12(new RegExp(`^\\s*${key}\\s*=\\s*(?!["'])\\S+`, 'mu'))]));
+    Boolean(_optionalChain$5([projectSection, 'optionalAccess', _11 => _11.match, 'call', _12 => _12(new RegExp(`^\\s*${key}\\s*=\\s*(?!["'])\\S+`, 'mu'))]));
   if (hasUnquotedId('project_id') || hasUnquotedId('app_id')) {
     throw new CliError(
       '.coze [project].project_id and app_id must be quoted decimal strings.',
@@ -11606,7 +11747,7 @@ const updateProjectValue = (content, key, value) => {
   const sectionStart = sectionMatch.index + sectionMatch[0].length;
   const following = content.slice(sectionStart);
   const nextSection = /^\s*\[[^\]]+\]\s*(?:#.*)?$/mu.exec(following);
-  const sectionEnd = _optionalChain$6([nextSection, 'optionalAccess', _13 => _13.index]) === undefined
+  const sectionEnd = _optionalChain$5([nextSection, 'optionalAccess', _13 => _13.index]) === undefined
     ? content.length
     : sectionStart + nextSection.index;
   const before = content.slice(0, sectionStart);
@@ -11660,8 +11801,8 @@ const ensureProjectMetadata = async (
       throw error;
     }
   }
-  const name = _optionalChain$6([options, 'access', _14 => _14.name, 'optionalAccess', _15 => _15.trim, 'call', _16 => _16()]) || 'Pages application';
-  const projectType = _optionalChain$6([options, 'access', _17 => _17.projectType, 'optionalAccess', _18 => _18.trim, 'call', _19 => _19()]) || 'web';
+  const name = _optionalChain$5([options, 'access', _14 => _14.name, 'optionalAccess', _15 => _15.trim, 'call', _16 => _16()]) || 'Pages application';
+  const projectType = _optionalChain$5([options, 'access', _17 => _17.projectType, 'optionalAccess', _18 => _18.trim, 'call', _19 => _19()]) || 'web';
   await promises.writeFile(
     node_path.join(sourceRoot, '.coze'),
     `[project]\nname = ${JSON.stringify(name)}\nproject_type = ${JSON.stringify(projectType)}\n`,
@@ -11671,7 +11812,7 @@ const ensureProjectMetadata = async (
   return readProjectMetadata(sourceRoot);
 };
 
-function _optionalChain$5(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+function _optionalChain$4(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 const isFile = async (path) => {
   try {
     return (await promises.stat(path)).isFile();
@@ -11701,14 +11842,14 @@ const validatePagesSource = async (
     );
   }
   const project = config.project ;
-  if (typeof _optionalChain$5([project, 'optionalAccess', _ => _.template]) !== 'string' || project.template.trim().toLowerCase() !== 'nextjs') {
+  if (typeof _optionalChain$4([project, 'optionalAccess', _ => _.template]) !== 'string' || project.template.trim().toLowerCase() !== 'nextjs') {
     throw new CliError(
       'Pages source contains no index.html; .coze project.template must be "nextjs".',
       'PAGES_BUILD_CONFIG_REQUIRED',
     );
   }
   const deploy = config.deploy ;
-  const build = _optionalChain$5([deploy, 'optionalAccess', _2 => _2.build]);
+  const build = _optionalChain$4([deploy, 'optionalAccess', _2 => _2.build]);
   if (!Array.isArray(build) || build.length === 0 || !build.every(part => typeof part === 'string' && part.length > 0)) {
     throw new CliError(
       'Pages source contains no index.html; .coze deploy.build must be a non-empty string array.',
@@ -11860,6 +12001,7 @@ const registerDeployReadCommands = (deploy) => {
         deploy_history_id: deployHistoryId,
         status: getDeployStatusText(history.status),
         commit_hash: history.commit_hash,
+        commit_message: history.commit_message,
         domains: history.domain_list || [],
         error_analysis: history.error_analysis,
         deploy_detail: formatDeployDetails(history),
@@ -11889,6 +12031,7 @@ const registerDeployReadCommands = (deploy) => {
           deploy_history_id: item.deploy_history_id,
           status: getDeployStatusText(item.status),
           commit_hash: item.commit_hash_short || item.commit_hash,
+          commit_message: item.commit_message,
           created_at: item.created_at,
           can_rollback: item.can_rollback,
           deploy_detail: formatDeployDetails(item),
@@ -11914,6 +12057,7 @@ const registerDeployReadCommands = (deploy) => {
           deploy_history_id: item.deploy_history_id,
           status: getDeployStatusText(item.status),
           commit_hash: item.commit_hash_short || item.commit_hash,
+          commit_message: item.commit_message,
           created_at: item.created_at,
           deploy_detail: formatDeployDetails(item),
           domains: item.domain_list || [],
@@ -11979,12 +12123,107 @@ const registerEnv = (code) => {
     });
 };
 
-function _nullishCoalesce$1(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain$4(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+/* eslint-disable security/detect-non-literal-fs-filename -- validated project-local build output paths */
+
+const BUILD_OUTPUT_DIRS = new Set(['dist', 'dist-tt']);
+const EXCLUDED_PARTS = new Set([
+  '.git',
+  '.env',
+  'node_modules',
+]);
+const REPRODUCIBLE_ARCHIVE_MTIME = new Date(0);
+
+const validateBuildOutput = async (
+  sourceRoot,
+  buildOutputDir,
+) => {
+  if (!BUILD_OUTPUT_DIRS.has(buildOutputDir)) {
+    throw new CliError(
+      `Unsupported Mini-program build output directory: ${buildOutputDir}.`,
+      'SOURCE_PACKAGE_FAILED',
+    );
+  }
+  const buildOutputRoot = node_path.resolve(sourceRoot, buildOutputDir);
+  try {
+    const info = await promises.lstat(buildOutputRoot);
+    if (info.isSymbolicLink() || !info.isDirectory()) {
+      throw new Error('build output must be a regular directory');
+    }
+    const realSourceRoot = await promises.realpath(sourceRoot);
+    const realBuildOutputRoot = await promises.realpath(buildOutputRoot);
+    const relativeOutput = node_path.relative(realSourceRoot, realBuildOutputRoot);
+    if (!relativeOutput || relativeOutput.startsWith('..')) {
+      throw new Error('build output must be inside the source root');
+    }
+  } catch (error) {
+    throw new CliError(
+      `Invalid Mini-program build output ${buildOutputRoot}: ${error instanceof Error ? error.message : String(error)}`,
+      'SOURCE_PACKAGE_FAILED',
+    );
+  }
+};
+
+const shouldInclude = (
+  archivePath,
+  entry,
+) => {
+  if ('isSymbolicLink' in entry && entry.isSymbolicLink()) {
+    return false;
+  }
+  return !archivePath.split(/[\\/]/u).some(part =>
+    EXCLUDED_PARTS.has(part) || part.startsWith('.git'),
+  );
+};
+
+const createMiniProgramPackage = async (
+  sourceRoot,
+  buildOutputDir,
+) => {
+  const resolvedSourceRoot = node_path.resolve(sourceRoot);
+  await validateBuildOutput(resolvedSourceRoot, buildOutputDir);
+  const tempDirectory = await promises.mkdtemp(node_path.join(node_os.tmpdir(), 'coze-mini-program-source-'));
+  const outputPath = node_path.join(tempDirectory, 'source.tar.gz');
+  try {
+    await tar.create(
+      {
+        cwd: resolvedSourceRoot,
+        file: outputPath,
+        filter: shouldInclude,
+        gzip: true,
+        mtime: REPRODUCIBLE_ARCHIVE_MTIME,
+        portable: true,
+      },
+      [buildOutputDir],
+    );
+    const info = await promises.stat(outputPath);
+    if (info.size === 0) {
+      throw new Error('source archive is empty');
+    }
+    return {
+      path: outputPath,
+      sizeBytes: info.size,
+      cleanup: () => promises.rm(tempDirectory, { recursive: true, force: true }),
+    };
+  } catch (error) {
+    await promises.rm(tempDirectory, { recursive: true, force: true });
+    throw new CliError(
+      `Unable to package Mini-program build output: ${error instanceof Error ? error.message : String(error)}`,
+      'SOURCE_PACKAGE_FAILED',
+    );
+  }
+};
+
+function _nullishCoalesce$1(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain$3(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 const CONNECTOR_IDS = {
   wechat: '10000127',
   douyin: '10000126',
 } ;
 
+const MINI_PROGRAM_BUILD_OUTPUT_DIRS = {
+  wechat: 'dist',
+  douyin: 'dist-tt',
+} ;
+
 
 
 
@@ -12009,11 +12248,23 @@ const resolveConnectorId = (platform) => {
   return connectorId;
 };
 
+const resolveBuildOutputDir = (platform) => {
+  const outputDir =
+    MINI_PROGRAM_BUILD_OUTPUT_DIRS[platform ];
+  if (!outputDir) {
+    throw new CliError(
+      `Unsupported Mini-program platform ${String(platform)}; expected wechat or douyin.`,
+      'INVALID_MINIPROGRAM_PLATFORM',
+    );
+  }
+  return outputDir;
+};
+
 const resolveProjectId = async (
   command,
   options,
 ) => {
-  if (_optionalChain$4([options, 'access', _ => _.projectId, 'optionalAccess', _2 => _2.trim, 'call', _3 => _3()])) {
+  if (_optionalChain$3([options, 'access', _ => _.projectId, 'optionalAccess', _2 => _2.trim, 'call', _3 => _3()])) {
     return options.projectId.trim();
   }
   const runtime = await getRuntime(command);
@@ -12028,6 +12279,137 @@ const resolveProjectId = async (
   return metadata.projectId;
 };
 
+const MINI_PROGRAM_AUTH_STATUS = {
+  authorized: 1,
+  needAuthorize: 2,
+  boundToOtherUser: 3,
+} ;
+
+const getBoundToOtherUserMessage = (platform) => {
+  const platformName = platform === 'wechat' ? 'WeChat' : 'Douyin';
+  const platformConsole =
+    platform === 'wechat' ? 'WeChat Public Platform' : 'Douyin Open Platform';
+  return [
+    `This ${platformName} Mini-program AppID is authorized by another Coze user.`,
+    `If this is an AppID you manage, revoke Coze's previous third-party platform authorization in the ${platformConsole}, then rerun this auth command. The CLI will recheck the AppID and authorize it for your current Coze account.`,
+    'If this is not your AppID, change --mini-app-id to an AppID for which you have administrator permission, then rerun this auth command.',
+  ].join(' ');
+};
+
+const getAuthRequiredMessage = () =>
+  'This Mini-program AppID is not authorized for the current Coze user. Run `coze-dev deploy code mini-program auth` first.';
+
+const getPreviewFailureMessage = (data
+
+
+) =>
+  _optionalChain$3([data, 'access', _4 => _4.stderr, 'optionalAccess', _5 => _5.trim, 'call', _6 => _6()]) || _optionalChain$3([data, 'access', _7 => _7.stdout, 'optionalAccess', _8 => _8.trim, 'call', _9 => _9()]) || 'Mini-program preview failed.';
+
+const registerAuthorizationCommand = (miniProgram) => {
+  miniProgram
+    .command('auth')
+    .description('Authorize a Mini-program AppID for the current Coze user')
+    .requiredOption('--platform <platform>', 'wechat or douyin')
+    .requiredOption('--mini-app-id <miniAppId>', 'Mini-program AppID')
+    .option('--project-id <projectId>', 'Deployment Project ID')
+    .option('--source-root <sourceRoot>', 'Directory containing .coze', '.')
+    .action(async (options, command) => {
+      const runtime = await getRuntime(command);
+      const projectId = await resolveProjectId(command, options);
+      const authorization = await runtime.client.authorizeMiniProgram({
+        project_id: projectId,
+        app_id: options.miniAppId || '',
+        connector_id: resolveConnectorId(options.platform),
+        redirect_url: 'https://code.coze.cn/coding/auth/callback/miniprogram',
+      });
+      if (authorization.status === MINI_PROGRAM_AUTH_STATUS.needAuthorize) {
+        runtime.output.print({
+          project_id: projectId,
+          mini_app_id: options.miniAppId,
+          platform: options.platform,
+          authorization_required: true,
+          auth_url: authorization.auth_url,
+        });
+        return;
+      }
+      if (authorization.status === MINI_PROGRAM_AUTH_STATUS.boundToOtherUser) {
+        throw new CliError(
+          getBoundToOtherUserMessage(options.platform),
+          'MINIPROGRAM_AUTHORIZED_BY_OTHER_USER',
+        );
+      }
+      if (authorization.status !== MINI_PROGRAM_AUTH_STATUS.authorized) {
+        throw new CliError(
+          `Unexpected Mini-program authorization status: ${String(authorization.status)}.`,
+          'INVALID_RESPONSE',
+        );
+      }
+      runtime.output.print({
+        project_id: projectId,
+        mini_app_id: options.miniAppId,
+        platform: options.platform,
+        authorized: true,
+      });
+    });
+};
+
+const registerPreviewCommand = (miniProgram) => {
+  miniProgram
+    .command('preview')
+    .description('Create a Mini-program preview QR code from the local build artifact')
+    .requiredOption('--platform <platform>', 'wechat or douyin')
+    .requiredOption('--mini-app-id <miniAppId>', 'Mini-program AppID')
+    .option('--project-id <projectId>', 'Deployment Project ID')
+    .option('--source-root <sourceRoot>', 'Directory containing dist or dist-tt', '.')
+    .action(async (options, command) => {
+      const runtime = await getRuntime(command);
+      const projectId = await resolveProjectId(command, options);
+      const authorization = await runtime.client.getMiniProgramAuthStatus({
+        project_id: projectId,
+        connector_id: resolveConnectorId(options.platform),
+      });
+      if (
+        !authorization.is_authorized ||
+        authorization.bound_related_id !== options.miniAppId
+      ) {
+        throw new CliError(
+          getAuthRequiredMessage(),
+          'MINIPROGRAM_AUTH_REQUIRED',
+        );
+      }
+      const sourceRoot = node_path.resolve(runtime.cwd, options.sourceRoot || '.');
+      const buildOutputDir = resolveBuildOutputDir(options.platform);
+      const sourcePackage = await createMiniProgramPackage(
+        sourceRoot,
+        buildOutputDir,
+      );
+      try {
+        const content = await promises.readFile(sourcePackage.path);
+        const data = await runtime.client.createMiniProgramPreview({
+          project_id: projectId,
+          app_id: options.miniAppId || '',
+          connector_id: resolveConnectorId(options.platform),
+          source_package_base64: content.toString('base64'),
+        });
+        if (data.failed) {
+          throw new CliError(
+            getPreviewFailureMessage(data),
+            'MINIPROGRAM_PREVIEW_FAILED',
+          );
+        }
+        runtime.output.print({
+          project_id: projectId,
+          mini_app_id: options.miniAppId,
+          platform: options.platform,
+          source_package_size_bytes: sourcePackage.sizeBytes,
+          ...data,
+        });
+      } finally {
+        await sourcePackage.cleanup();
+      }
+    });
+};
+
 const registerMiniProgram = (code) => {
   const miniProgram = code
     .command('mini-program')
@@ -12112,9 +12494,12 @@ const registerMiniProgram = (code) => {
       });
       runtime.output.print({ project_id: projectId, platform: options.platform, unbound: true });
     });
+
+  registerAuthorizationCommand(miniProgram);
+  registerPreviewCommand(miniProgram);
 };
 
-function _optionalChain$3(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+function _optionalChain$2(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
 const POLL_INTERVAL_MS = 3000;
 const MAX_CONSECUTIVE_RETRIES = 5;
@@ -12126,7 +12511,7 @@ const wait = async () =>
 const isRetryablePollError = (error) =>
   error instanceof CliError &&
   error.code === 'API_REJECTED' &&
-  Number(_optionalChain$3([error, 'access', _ => _.details, 'optionalAccess', _2 => _2.business_code])) === TRANSIENT_RPC_ERROR_CODE;
+  Number(_optionalChain$2([error, 'access', _ => _.details, 'optionalAccess', _2 => _2.business_code])) === TRANSIENT_RPC_ERROR_CODE;
 
 const pollHistory = async (
   command,
@@ -12505,52 +12890,6 @@ const registerDomain = (code) => {
     });
 };
 
-function _optionalChain$2(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
-
-const firstPage = { page: 1, size: 1 };
-
-const listSpaceRequest = (runtime) => ({
-  ...(runtime.config.organizationId
-    ? { organization_id: runtime.config.organizationId }
-    : {}),
-  ...(runtime.config.enterpriseId
-    ? { enterprise_id: runtime.config.enterpriseId }
-    : {}),
-});
-
-const resolveDeploymentSpaceId = async (runtime) => {
-  const configuredSpaceId = _optionalChain$2([runtime, 'access', _ => _.config, 'access', _2 => _2.spaceId, 'optionalAccess', _3 => _3.trim, 'call', _4 => _4()]);
-  const request = listSpaceRequest(runtime);
-  if (configuredSpaceId) {
-    const data = await runtime.client.listSpaces(request);
-    if (!data.bot_space_list.some(space => space.id === configuredSpaceId)) {
-      throw new CliError(
-        `Space ID ${configuredSpaceId} is invalid or is not available to the current account.`,
-        'INVALID_SPACE_ID',
-      );
-    }
-    return configuredSpaceId;
-  }
-
-  const data = await runtime.client.listSpaces({ ...request, ...firstPage });
-  const space = data.bot_space_list.find(item => item.id);
-  if (!space) {
-    throw new CliError(
-      'No available Space was found for the current account. Create or join a Space before deploying.',
-      'SPACE_NOT_FOUND',
-    );
-  }
-
-  runtime.config.spaceId = space.id;
-  try {
-    await saveSharedConfig({ spaceId: space.id }, runtime.globalOptions);
-  } catch (error) {
-    runtime.output.warn(`Unable to save the auto-selected Space: ${String(error)}`);
-  }
-  runtime.output.debug(`Auto-selected Space: ${space.name || space.id} (${space.id})`);
-  return space.id;
-};
-
 const PACKAGE_SCRIPT_CANDIDATES = [
   node_path.resolve(__dirname, 'deploy/package-project.js'),
   node_path.resolve(__dirname, '../../../scripts/deploy/package-project.js'),
@@ -12922,14 +13261,21 @@ const registerDeploy = (code) => {
         }
       }
       if (!projectId) {
-        runtime.output.debug('[deploy] Creating a dedicated deployment project...');
-        const spaceId = await resolveDeploymentSpaceId(runtime);
+        runtime.output.debug(
+          '[deploy] Creating a dedicated deployment project in personal space...',
+        );
+        // 账号归属只在建 Project 这一次定死：写进 project_settings.extra 之后，有登录态的首次
+        // 部署和无登录态的预览初始化读到的是同一个账号。本地已经知道账号就不打这次接口。
+        const cozeAccountId = await resolveCozeAccountId(runtime);
         const project = await runtime.client.createDeploymentProject({
-          space_id: spaceId,
+          space_id: '0',
           user_query: deploymentName || 'CLI deployment project',
           project_type: resolveCreationProjectType(metadata.projectType),
           create_source: 'cli',
-          project_settings: { project_symbol: 'v3.5' },
+          project_settings: {
+            project_symbol: 'v3.5',
+            ...(cozeAccountId ? { extra: { coze_account_id: cozeAccountId } } : {}),
+          },
         });
         projectId = project.project_id;
         projectCreated = true;
@@ -13018,6 +13364,7 @@ const registerDeploy = (code) => {
           ...(appId ? { app_id: appId } : { project_id: projectId }),
           application_type: applicationType,
           commit_hash: commitHash,
+          ...(options.message ? { commit_message: options.message } : {}),
           ...(!appId
             ? { name: deploymentName, source_root: sourceRoot }
             : {}),