magic-builder 1.2.0 → 1.3.1

package/src/commands/widget-publish.js

@@ -0,0 +1,339 @@
+'use strict';
+
+const { existsSync, readFileSync } = require('fs');
+const { resolve } = require('path');
+const { getWidgetPublishConfigPath } = require('../lib/config');
+const { success, fail } = require('../lib/output');
+
+const DEFAULT_ORIGIN = 'https://open.larkoffice.com';
+
+async function run(args, opts) {
+  if (args.length) {
+    fail('Usage: magic-builder widget-publish --app-id <id> --block-type-id <id>', 'E_INVALID_ARGS');
+  }
+
+  const appId = String(opts.appId || '').trim();
+  const blockTypeId = String(opts.blockTypeId || '').trim();
+  if (!appId || !blockTypeId) {
+    fail('Missing --app-id or --block-type-id.', 'E_INVALID_ARGS');
+  }
+
+  const auth = loadPublishAuth(opts.config);
+  const client = createOpenPlatformClient(auth, opts.origin || DEFAULT_ORIGIN);
+  const detail = await client.post(`/developers/v2/block/detail/${appId}/${blockTypeId}`, {});
+  const block = extractBlock(detail);
+  const pkgId = extractDraftPkgId(detail, block);
+  if (!pkgId) throw commandError('Draft widget pkgId was not found in block detail.', 'E_INVALID_RESPONSE');
+
+  const updatePayload = { block: buildBlockUpdatePayload(block, pkgId, blockTypeId) };
+  if (!opts.dryRun) {
+    await client.post(`/developers/v2/block/detail/update/${appId}/${blockTypeId}`, updatePayload);
+  }
+  const versionChangeResponse = await client.post(`/developers/v1/app_version/change/${appId}`, {});
+  const versionChange = unwrapData(versionChangeResponse) || {};
+  const versionsResponse = await client.post(`/developers/v1/app_version/list/${appId}`, {});
+  const versions = extractVersionList(versionsResponse);
+  const appVersion = opts.version || getNextPatchVersion(versions);
+  const createPayload = buildCreateVersionPayload(
+    appVersion,
+    opts.changeLog,
+    getLatestVersion(versions),
+    versionChange
+  );
+
+  if (opts.dryRun) {
+    success({
+      dryRun: true,
+      appId,
+      blockTypeId,
+      pkgId,
+      appVersion,
+      updatePayload,
+      createPayload,
+    }, opts);
+    return;
+  }
+
+  const createResponse = await client.post(`/developers/v1/app_version/create/${appId}`, createPayload);
+  const appVersionId = extractAppVersionId(createResponse);
+  if (!appVersionId) throw commandError('Created app version id was not found in response.', 'E_INVALID_RESPONSE');
+
+  const publishResponse = await client.post(`/developers/v1/publish/commit/${appId}/${appVersionId}`, {});
+  success({
+    appId,
+    blockTypeId,
+    pkgId,
+    appVersion,
+    appVersionId,
+    published: true,
+    response: publishResponse,
+  }, opts);
+}
+
+function loadPublishAuth(configFile) {
+  const path = resolve(String(configFile || getWidgetPublishConfigPath()));
+  if (!existsSync(path)) {
+    throw commandError(`Widget publish config not found: ${path}`, 'E_NO_CONFIG');
+  }
+
+  let config;
+  try {
+    config = JSON.parse(readFileSync(path, 'utf8'));
+  } catch (error) {
+    throw commandError(`Invalid widget publish config: ${error.message}`, 'E_INVALID_CONFIG');
+  }
+
+  const cookie = String(config.cookie || '').trim();
+  const csrfToken = String(config.csrfToken || config.csrf_token || '').trim();
+  if (!cookie || !csrfToken) {
+    throw commandError('Widget publish config must contain cookie and csrfToken.', 'E_INVALID_CONFIG');
+  }
+  return {
+    cookie,
+    csrfToken,
+    timezoneOffset: Number.isFinite(Number(config.timezoneOffset)) ? Number(config.timezoneOffset) : -480,
+    locale: String(config.locale || 'zh-CN'),
+  };
+}
+
+function createOpenPlatformClient(auth, origin = DEFAULT_ORIGIN, fetchImpl = fetch) {
+  const baseUrl = String(origin || DEFAULT_ORIGIN).replace(/\/+$/, '');
+  return {
+    async post(path, body) {
+      const response = await fetchImpl(`${baseUrl}${path}`, {
+        method: 'POST',
+        headers: {
+          accept: '*/*',
+          'accept-language': `${auth.locale},zh;q=0.9`,
+          'cache-control': 'no-cache',
+          'content-type': 'application/json',
+          cookie: auth.cookie,
+          origin: baseUrl,
+          pragma: 'no-cache',
+          referer: getRequestReferer(baseUrl, path),
+          'x-csrf-token': auth.csrfToken,
+          'x-timezone-offset': String(auth.timezoneOffset),
+        },
+        body: JSON.stringify(body || {}),
+      });
+      const text = await response.text();
+      const data = parseJson(text);
+      if (!response.ok || isApiFailure(data)) {
+        const reason = data?.msg || data?.message || `HTTP ${response.status}`;
+        throw commandError(
+          `Open Platform request failed at ${path}: ${reason}`,
+          response.status === 401 || response.status === 403 ? 'E_AUTH_FAILED' : 'E_REQUEST_FAILED'
+        );
+      }
+      return data ?? text;
+    },
+  };
+}
+
+function extractBlock(response) {
+  const data = unwrapData(response);
+  return data?.block || data?.detail?.block || data?.blockDetail?.block || data?.detail || data;
+}
+
+function extractDraftPkgId(response, block = {}) {
+  const candidates = [
+    response?.data?.blockVersions?.testVersion?.id,
+    response?.data?.blockVersions?.testVersion?.pkgId,
+    response?.data?.blockVersions?.draftVersion?.id,
+    response?.data?.blockVersions?.draftVersion?.pkgId,
+    block?.draftVersion?.pkgId,
+    block?.draftPkg?.pkgId,
+    block?.draftPackage?.pkgId,
+    block?.draft?.pkgId,
+    findDraftPkgId(response),
+    findValue(response, ['draftPkgId', 'draftPackageId']),
+    block?.pkgId,
+  ];
+  return String(candidates.find(Boolean) || '').trim();
+}
+
+function buildBlockUpdatePayload(block = {}, pkgId, blockTypeId) {
+  return {
+    pkgId: String(pkgId),
+    icon: block.icon || '',
+    i18nTitle: block.i18nTitle || {},
+    i18nDesc: block.i18nDesc || {},
+    status: block.status !== false,
+    blockTypeId: block.blockTypeId || block.blockTypeID || blockTypeId,
+    pkgUpdateType: Number.isFinite(Number(block.pkgUpdateType)) ? Number(block.pkgUpdateType) : 0,
+    docXHost: block.docXHost || block.docxHost || {},
+  };
+}
+
+function extractVersionList(response) {
+  const data = unwrapData(response);
+  if (Array.isArray(data)) return data;
+  for (const key of ['items', 'list', 'appVersions', 'versions']) {
+    if (Array.isArray(data?.[key])) return data[key];
+  }
+  return findArray(data, ['items', 'list', 'appVersions', 'versions']);
+}
+
+function getNextPatchVersion(versions) {
+  const parsed = versions
+    .map(item => String(item?.appVersion || item?.version || item?.versionName || item || ''))
+    .map(parseSemver)
+    .filter(Boolean)
+    .sort(compareSemver);
+  const latest = parsed.at(-1) || [1, 0, -1];
+  return `${latest[0]}.${latest[1]}.${latest[2] + 1}`;
+}
+
+function getLatestVersion(versions) {
+  return versions
+    .map(item => ({ item, version: parseSemver(item?.appVersion || item?.version || item?.versionName || item) }))
+    .filter(entry => entry.version)
+    .sort((a, b) => compareSemver(a.version, b.version))
+    .at(-1)?.item || {};
+}
+
+function buildCreateVersionPayload(
+  appVersion,
+  changeLog = '更新文档小组件版本',
+  latestVersion = {},
+  versionChange = {}
+) {
+  const shareConfig = versionChange.changeAppShareConfig?.b2cShareSplitConfigSuggest;
+  return {
+    appVersion: String(appVersion),
+    mobileDefaultAbility: versionChange.mobileDefaultAbility || latestVersion.mobileDefaultAbility || 'bot',
+    pcDefaultAbility: versionChange.pcDefaultAbility || latestVersion.pcDefaultAbility || 'bot',
+    changeLog: String(changeLog || '更新文档小组件版本'),
+    visibleSuggest: latestVersion.visibleSuggest || { departments: [], members: [], groups: [], isAll: 1 },
+    applyReasonConfig: versionChange.applyReasonConfig || latestVersion.applyReasonConfig || {
+      apiPrivilegeNeedReason: true,
+      contactPrivilegeNeedReason: true,
+      dataPrivilegeReasonMap: {},
+      visibleScopeNeedReason: true,
+      apiPrivilegeReasonMap: {},
+      contactPrivilegeReason: '',
+      isDataPrivilegeExpandMap: { vc: false },
+      visibleScopeReason: '',
+      dataPrivilegeNeedReason: true,
+      isAutoAudit: false,
+      isContactExpand: false,
+    },
+    b2cShareSplitConfigSuggest: shareConfig || latestVersion.b2cShareSplitConfigSuggest || {
+      b2cGroupChatShareEnable: false,
+      b2cP2PChatShareEnable: false,
+      b2cP2PChatNeedAudit: false,
+    },
+    autoPublish: false,
+    blackVisibleSuggest: latestVersion.blackVisibleSuggest || { departments: [], members: [], groups: [], isAll: 0 },
+  };
+}
+
+function extractAppVersionId(response) {
+  const data = unwrapData(response);
+  return String(
+    data?.appVersionId
+    || data?.versionId
+    || data?.appVersion?.id
+    || data?.version?.id
+    || data?.id
+    || findValue(data, ['appVersionId', 'versionId'])
+    || ''
+  ).trim();
+}
+
+function unwrapData(value) {
+  let current = value;
+  for (let i = 0; i < 3; i++) {
+    if (!current || typeof current !== 'object' || Array.isArray(current) || !('data' in current)) break;
+    current = current.data;
+  }
+  return current;
+}
+
+function findValue(value, names, predicate = () => true, path = '') {
+  if (!value || typeof value !== 'object') return '';
+  for (const [name, child] of Object.entries(value)) {
+    const childPath = path ? `${path}.${name}` : name;
+    if (names.includes(name) && child != null && predicate({ name, path: childPath })) return child;
+    const nested = findValue(child, names, predicate, childPath);
+    if (nested) return nested;
+  }
+  return '';
+}
+
+function findDraftPkgId(value, path = '') {
+  if (!value || typeof value !== 'object') return '';
+  const marker = [
+    path,
+    value.status,
+    value.versionStatus,
+    value.pkgStatus,
+    value.type,
+    value.name,
+  ].filter(Boolean).join(' ');
+  if (/draft|草稿/i.test(marker) && value.pkgId) return value.pkgId;
+  for (const [name, child] of Object.entries(value)) {
+    const found = findDraftPkgId(child, path ? `${path}.${name}` : name);
+    if (found) return found;
+  }
+  return '';
+}
+
+function findArray(value, names) {
+  if (!value || typeof value !== 'object') return [];
+  for (const [name, child] of Object.entries(value)) {
+    if (names.includes(name) && Array.isArray(child)) return child;
+    const found = findArray(child, names);
+    if (found.length) return found;
+  }
+  return [];
+}
+
+function getRequestReferer(baseUrl, path) {
+  const blockMatch = path.match(/\/block\/detail(?:\/update)?\/([^/]+)\/([^/]+)/);
+  if (blockMatch) return `${baseUrl}/app/${blockMatch[1]}/blocks/${blockMatch[2]}`;
+  const publishMatch = path.match(/\/publish\/commit\/([^/]+)\/([^/]+)/);
+  if (publishMatch) return `${baseUrl}/app/${publishMatch[1]}/version/${publishMatch[2]}`;
+  const appMatch = path.match(/\/app_version\/(?:list|create)\/([^/]+)/);
+  if (appMatch) return `${baseUrl}/app/${appMatch[1]}/version/create`;
+  return `${baseUrl}/`;
+}
+
+function parseSemver(value) {
+  const match = String(value || '').trim().match(/^(\d+)\.(\d+)\.(\d+)$/);
+  return match ? match.slice(1).map(Number) : null;
+}
+
+function compareSemver(a, b) {
+  return a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+}
+
+function parseJson(text) {
+  try { return JSON.parse(text); } catch (_) { return null; }
+}
+
+function isApiFailure(data) {
+  if (!data || typeof data !== 'object') return false;
+  if ('code' in data && ![0, '0', 200, '200'].includes(data.code)) return true;
+  return data.success === false;
+}
+
+function commandError(message, code) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+module.exports = {
+  run,
+  loadPublishAuth,
+  createOpenPlatformClient,
+  extractBlock,
+  extractDraftPkgId,
+  buildBlockUpdatePayload,
+  extractVersionList,
+  getNextPatchVersion,
+  getLatestVersion,
+  buildCreateVersionPayload,
+  extractAppVersionId,
+};

package/src/index.js

@@ -15,6 +15,7 @@ module.exports = {
     feedback: require('./commands/feedback'),
     performance: require('./commands/performance'),
     perf: require('./commands/performance'),
+    widgetPublish: require('./commands/widget-publish'),
     extractCookie: require('./commands/extract-cookie'),
     skill: require('./commands/skill'),
     version: require('./commands/version'),

package/src/lib/config.js

@@ -8,6 +8,8 @@ const DEFAULT_BASE_URL = 'https://magic.solutionsuite.cn';
 const CONFIG_DIR = path.join(os.homedir(), '.magic-builder');
 const APPS_CONFIG_FILE = 'magic-apps.json';
 const LEGACY_APPS_CONFIG_FILE = '.magic-apps.json';
+const WIDGET_PUBLISH_CONFIG_FILE = 'widget-publish.json';
+const PERFORMANCE_CONFIG_FILE = 'performance.json';
 
 function normalizeMagicBaseUrl(value) {
   const raw = String(value || DEFAULT_BASE_URL).trim().replace(/\/+$/, '');
@@ -23,6 +25,20 @@ function getAppsConfigPath() {
   return path.join(CONFIG_DIR, APPS_CONFIG_FILE);
 }
 
+function getWidgetPublishConfigPath() {
+  return path.join(CONFIG_DIR, WIDGET_PUBLISH_CONFIG_FILE);
+}
+
+function getPerformanceConfigPath() {
+  return path.join(CONFIG_DIR, PERFORMANCE_CONFIG_FILE);
+}
+
+function loadPerformanceConfig() {
+  const p = getPerformanceConfigPath();
+  if (!fs.existsSync(p)) return {};
+  try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch (_) { return {}; }
+}
+
 function loadAppsConfig() {
   const p = fs.existsSync(getAppsConfigPath())
     ? getAppsConfigPath()
@@ -38,4 +54,15 @@ function saveAppsConfig(config) {
   fs.writeFileSync(getAppsConfigPath(), JSON.stringify(config, null, 2));
 }
 
-module.exports = { DEFAULT_BASE_URL, CONFIG_DIR, normalizeMagicBaseUrl, getBaseUrl, getAppsConfigPath, loadAppsConfig, saveAppsConfig };
+module.exports = {
+  DEFAULT_BASE_URL,
+  CONFIG_DIR,
+  normalizeMagicBaseUrl,
+  getBaseUrl,
+  getAppsConfigPath,
+  getWidgetPublishConfigPath,
+  getPerformanceConfigPath,
+  loadPerformanceConfig,
+  loadAppsConfig,
+  saveAppsConfig,
+};

package/src/lib/help.js

@@ -15,13 +15,14 @@ SYNTAX:
 
 COMMANDS:
   auth       Login and manage Magic developer tokens
-  page       Publish, list, export, and delete Magic pages
+  page       Publish and manage Magic pages, collaborators, and access
   faas       Publish, list, and delete Magic FaaS functions
   file       Upload, list, and delete TOS files
   link       Generate Magic share links
   doc        Create or append Feishu Doc HTML Box apps
   feedback   Create Magic feedback records
-  performance Submit Markdown content to a People performance draft (alias: perf)
+  performance Write or formally submit a People performance review (alias: perf)
+  widget-publish Publish a document widget draft as a new app version
   extract-cookie Extract Cookie data from a curl command
   skill      Check or update the Magic Builder skill package
   version    Show CLI version
@@ -38,6 +39,8 @@ EXAMPLES:
   magic-builder page list --scope mine
   magic-builder page export --id recxxx --out app.html
   magic-builder page delete --id recxxx
+  magic-builder page collaborators add --id recxxx --open-ids ou_xxx,ou_yyy
+  magic-builder page access groups add --id recxxx --chat-ids oc_xxx
   magic-builder faas publish handler.js --name report-api
   magic-builder faas list
   magic-builder faas delete --id recxxx
@@ -48,6 +51,7 @@ EXAMPLES:
   magic-builder doc create --html app.html --title "Demo"
   magic-builder feedback create --feedback "打不开页面"
   magic-builder performance --cookie ./cookie.txt --markdown ./performance.md
+  magic-builder widget-publish --app-id cli_xxx --block-type-id blk_xxx
   magic-builder extract-cookie --curl-file ./request.curl
   magic-builder skill install
   magic-builder skill check-update
@@ -83,11 +87,19 @@ COMMANDS:
   auth set <token>
   auth show
 
-  page publish <html> --title <title> [--id <id>] [--open-source]
+  page publish <html> --title <title> [--id <id>] [--custom-id <id>] [--open-source] [--comments]
   page list [--title <keyword>] [--scope mine|public]
   page export --id <id> --out <file|dir> [--scope mine|public]
   page export --title <keyword> --out <dir> [--all] [--scope mine|public]
   page delete --id <id>
+  page collaborators list --id <id>
+  page collaborators add|remove|set --id <id> --open-ids <ou_a,ou_b>
+  page collaborators set --id <id> --file <collaborators.json>
+  page access get|enable|disable --id <id>
+  page access require-login --id <id> --enabled true|false
+  page access users add|remove|set --id <id> --open-ids <ou_a,ou_b>
+  page access groups add|remove|set --id <id> --chat-ids <oc_a,oc_b>
+  page access set --id <id> --file <access.json>
 
   faas publish <file.js> --name <name> [--id <id>]
   faas publish --code <code> --name <name> [--id <id>]
@@ -101,16 +113,26 @@ COMMANDS:
   link create --title <text>
   link create --fid <id>
 
-  doc create --html <file> --title <title> [--summary <text>] [--as bot|user]
-  doc append --html <file> --doc-token <token> [--as bot|user]
+  doc create --html <file> --title <title> [--summary <text>] [--as bot|user] [--edition external|bytedance]
+  doc append --html <file> --doc-token <token> [--as bot|user] [--edition external|bytedance]
 
   feedback create --feedback <text> [--title <title>] [--summary <text>]
   feedback create --feedback-file <file> [--dry-run]
 
   performance --review-url <url> --cookie <content|file> --markdown <content|file|url> [--dry-run]
+  perf self-review --review-url <url> [--good <text>|--good-file <file>]
+    [--improve <text>|--improve-file <file>] [--values-comment <text>|--values-comment-file <file>] [--dry-run]
+  perf submit --review-url <url> --cookie-file <file> --template-group-id <id> [--dry-run|--yes]
+  perf key-works --root-review-id <id> [--template-id <id>] --cookie-file <file>
+  perf review-users --review-id <id> --stage-id <id> --cookie-file <file>
+  perf review-users --review-url <url> --cookie-file <file>
+  perf invite-review --payload-file <file> --review-url <url> --cookie-file <file> [--dry-run]
   perf --review-url <url> --cookie-file <file> --markdown-file <file> [--dry-run]
 
-  extract-cookie --curl <content|file> [--out <file>|--out-dir <dir>]
+  widget-publish --app-id <id> --block-type-id <id> [--version <x.y.z>] [--change-log <text>]
+    [--config <file>] [--dry-run]
+
+  extract-cookie --curl <content|file> [--out <file>|--out-dir <dir>] [--widget-publish]
 
   skill install [--environment auto|local|cloud] [--skills-root <dir>]
   skill check-update [--environment auto|local|cloud] [--skills-root <dir>]
@@ -155,11 +177,19 @@ SYNTAX:
   page: `@HELP magic-builder/page
 
 SYNTAX:
-  magic-builder page publish <html> --title <title> [--id <id>] [--open-source]
+  magic-builder page publish <html> --title <title> [--id <id>] [--custom-id <id>] [--open-source] [--comments]
   magic-builder page list [--title <keyword>] [--scope mine|public]
   magic-builder page export --id <id> --out <file|dir> [--scope mine|public]
   magic-builder page export --title <keyword> --out <dir> [--all] [--scope mine|public]
   magic-builder page delete --id <id>
+  magic-builder page collaborators list --id <id>
+  magic-builder page collaborators add|remove|set --id <id> --open-ids <ou_a,ou_b>
+  magic-builder page collaborators set --id <id> --file <collaborators.json>
+  magic-builder page access get|enable|disable --id <id>
+  magic-builder page access require-login --id <id> --enabled true|false
+  magic-builder page access users add|remove|set --id <id> --open-ids <ou_a,ou_b>
+  magic-builder page access groups add|remove|set --id <id> --chat-ids <oc_a,oc_b>
+  magic-builder page access set --id <id> --file <access.json>
 `,
   faas: `@HELP magic-builder/faas
 
@@ -185,8 +215,8 @@ SYNTAX:
   doc: `@HELP magic-builder/doc
 
 SYNTAX:
-  magic-builder doc create --html <file> --title <title> [--summary <text>] [--as bot|user]
-  magic-builder doc append --html <file> --doc-token <token> [--as bot|user]
+  magic-builder doc create --html <file> --title <title> [--summary <text>] [--as bot|user] [--edition external|bytedance]
+  magic-builder doc append --html <file> --doc-token <token> [--as bot|user] [--edition external|bytedance]
 `,
   feedback: `@HELP magic-builder/feedback
 
@@ -198,6 +228,14 @@ SYNTAX:
 
 SYNTAX:
   magic-builder performance --review-url <url> --cookie <content|file> --markdown <content|file|url>
+  magic-builder perf self-review --review-url <url> --good <text> --improve <text> --values-comment <text>
+  magic-builder perf self-review --review-url <url> --good-file <file> --improve-file <file> --values-comment-file <file>
+  magic-builder perf submit --review-url <url> --cookie-file <file> --template-group-id <id> --dry-run
+  magic-builder perf submit --review-url <url> --cookie-file <file> --template-group-id <id> --yes
+  magic-builder perf key-works --root-review-id <id> [--template-id <id>] --cookie-file <file>
+  magic-builder perf review-users --review-id <id> --stage-id <id> --cookie-file <file>
+  magic-builder perf review-users --review-url <url> --cookie-file <file>
+  magic-builder perf invite-review --payload-file <file> --review-url <url> --cookie-file <file> [--dry-run]
   magic-builder perf --review-url <url> --cookie-file <file> --markdown-file <file>
 
 COOKIE:
@@ -207,9 +245,41 @@ DRAFT:
   --review-url resolves operator, tenant, form ids, and the current version
   from /perf/api/user/settings and /perf/api/foundation/draft.
 
+SELF REVIEW:
+  self-review updates only the explicitly passed text fields and preserves
+  the current performance and values ratings. It writes by default; use
+  --dry-run to inspect the generated payload without saving it.
+
+KEY WORKS:
+  key-works reads the review-stage data for the specified template and root
+  review. The template id defaults to invite_review_template_id in
+  ~/.magic-builder/performance.json and can be overridden with --template-id.
+  It is read-only and prints the complete API response as JSON.
+
+REVIEW USERS:
+  review-users reads the invited review-user list for a review and stage. It
+  accepts either --review-url or explicit --review-id and --stage-id. Explicit
+  ids override values parsed from the URL. It does not modify review data and
+  prints the complete API response as JSON.
+
+INVITE REVIEW:
+  invite-review writes a complete invite-review draft payload to People. Pass
+  the current payload as JSON or a JSON file. Use --dry-run to inspect it
+  without writing. The payload must contain key, data, and version, and its key
+  must identify an invite_review draft.
+
 OPTIONS:
   --dry-run                    Print the generated payload without sending it
   --review-url <url>           People performance review URL (recommended)
+  --good <text>                Update the "did well" self-review text
+  --good-file <file>           Read the "did well" text from a file
+  --improve <text>             Update the "to improve" self-review text
+  --improve-file <file>        Read the "to improve" text from a file
+  --values-comment <text>      Update the values self-review comment
+  --values-comment-file <file> Read the values comment from a file
+  --template-group-id <id>     Template group id (only needed when absent from the draft)
+  --submit-endpoint <url>      Override the formal submission endpoint
+  --yes                        Confirm the irreversible formal submission
   --draft-version <number>     Override the version loaded from the current draft
   --review-id <id>             Override the performance review id
   --form-id <id>               Override the invitation/form id used by the draft key
@@ -219,17 +289,42 @@ OPTIONS:
   --source-id <id>             Override the form source id
   --field-source-id <id>       Override the writable field source id
   --tenant-id <id>             Override the People tenant id
+  --referer <url>              Override the People request Referer
+  --stage-endpoint <url>       Override the key-works query endpoint
+  --stage-id <id>              Review stage id used by review-users
+  --review-users-endpoint <url> Override the review-users API origin
+  --payload <json>              Complete invite-review draft payload
+  --payload-file <file>         Read invite-review draft payload from a file
   --endpoint <url>             Override the draft API endpoint
 `,
   perf: `@HELP magic-builder/performance
 
 Alias of "magic-builder performance".
+`,
+  'widget-publish': `@HELP magic-builder/widget-publish
+
+SYNTAX:
+  magic-builder widget-publish --app-id <id> --block-type-id <id>
+    [--version <x.y.z>] [--change-log <text>] [--config <file>] [--dry-run]
+
+AUTH CONFIG:
+  Defaults to ~/.magic-builder/widget-publish.json:
+  {
+    "cookie": "open_locale=zh-CN; session=...",
+    "csrfToken": "...",
+    "timezoneOffset": -480
+  }
+
+FLOW:
+  Load widget detail and latest uploaded pkgId, update the widget package, load the app's
+  version defaults, calculate the next version, create it, then submit publishing.
 `,
   'extract-cookie': `@HELP magic-builder/extract-cookie
 
 SYNTAX:
   magic-builder extract-cookie --curl <content|file> [--out <file>]
   magic-builder extract-cookie --curl-file <file> [--out-dir <dir>]
+  magic-builder extract-cookie --curl-file <file> --widget-publish
   cat request.curl | magic-builder extract-cookie [--out <file>]
 
 OPTIONS:
@@ -237,6 +332,7 @@ OPTIONS:
   --curl-file <file>      Read curl command from a local file
   --out <file>            Output file (default: ./cookie.txt)
   --out-dir <dir>         Output directory; created when missing
+  --widget-publish        Write Cookie and x-csrf-token to the widget publish config
 `,
   skill: `@HELP magic-builder/skill
 

package/src/lib/multipart.js

@@ -21,6 +21,7 @@ async function uploadSingle(filePath, opts = {}) {
 
   const signRes = await request(`${baseUrl}/api/tos/sign`, {
     method: 'POST',
+    token,
     body: signBody,
   });
 
@@ -48,6 +49,8 @@ async function uploadSingle(filePath, opts = {}) {
     token,
     body: {
       action: 'record',
+      audit_id: signRes.data.audit_id,
+      audit_table_id: signRes.data.audit_table_id,
       url,
       key: signRes.data.key,
       filename,