@microi.net/cli 4.7.2 → 4.7.4

package/dist/microi-skills.meta.json

@@ -1,13 +1,13 @@
 {
-  "builtAt": "2026-08-06T11:15:28.918Z",
+  "builtAt": "2026-08-07T04:21:56.206Z",
   "source": "../microi.skills",
   "extension": {
     "name": "v8-engine",
-    "version": "4.7.2",
+    "version": "4.7.4",
     "publisher": "Microi"
   },
   "skills": {
-    "version": "4.7.2",
+    "version": "4.7.4",
     "versionRule": "Microi version uses three numeric parts. Each publish increments the last part; when a part exceeds 9 it carries to the previous part: 1.0.9 -> 1.1.0, 1.9.9 -> 2.0.0.",
     "managedBy": "Microi.VSCode/bump-version.js"
   },
@@ -15,10 +15,10 @@
     "dir": "dist/microi.skills",
     "files": 105,
     "skills": 58,
-    "bytes": 1621098
+    "bytes": 1630404
   },
   "fileHashes": {
-    ".microi-skills-version.json": "1b89a65b838593374f876c75d22d51beab3a4edc5e623fa326cfa190c4223310",
+    ".microi-skills-version.json": "fb7f2280ee7f2d9001407d57fd7c3788ab5c128f2ae42c7dd8d2d3e10456deea",
     "README.md": "f88db8f5a0ad3788583b1a0787cb4c485f1027e50a5c21997da41334e2be3b82",
     "ai-engine/SKILL.md": "371b00ce9860d1516f6eb7eeaed001cbfa852c52e7c0cfccbedc4a71a113e568",
     "ai-engine/agents/openai.yaml": "40deb07801006a46b9a7f0020d13251955eeadd04c8e591160210479936f8b5b",
@@ -50,7 +50,7 @@
     "microi-deployment/SKILL.md": "26faa91740c874cfd676ceb69c1e4f8c12acfb85a2fc9fe1e8d0298ffe84b310",
     "microi-deployment/references/deployment-matrix.md": "32d9d1424bf19eae0d2cee2b1667203c830ea7610c71a806e7ddf785a0083009",
     "microi-docs-coverage/SKILL.md": "5fad3dd7b83cf01ef7a303506902c95da7ae85d60b0067d266f1e2fa2326db95",
-    "microi-docs-coverage/references/capability-map.md": "0d3ffff2ecaf3612680a610ffa0df0b731f9ed39432605aa5720c16ce42bd93a",
+    "microi-docs-coverage/references/capability-map.md": "f460427304dca6f4d3ff57b79eaa3c5eab72b03726655b0c8bac1e27c844ce9b",
     "microi-docs-coverage/scripts/audit-doc-skill-coverage.mjs": "ebd57f17f2ebae499bfa59ad17830db458590feb76f7f0f20219ff0987b33af3",
     "microi-form-engine/SKILL.md": "1afefedb468b5bab219f726bddb9ceca99547ee4149722a847a50eb9001b6927",
     "microi-form-engine/references/component-catalog.md": "68963c2d5211a4610c09fab1fa127a349339abbb7427509b183d4be72e977c7b",
@@ -58,7 +58,7 @@
     "microi-form-layout/SKILL.md": "48814c2c138e2c0fb6a11d39cf458df6a1cc28a3156c7540db1fa482a2ce6aec",
     "microi-frontend-sdk/SKILL.md": "0ff6e2df0dc01a42ca875bb6eeb92a4397c5dd4ecae0f808ccf36f1f549c58f0",
     "microi-left-right-layout/SKILL.md": "d8c482224846477b6c3068bdf94930cca6d699570f59b09f946601b0a65715f6",
-    "microi-microservice/SKILL.md": "38b95724999b7a990c1ef992a1e5719c4ff2571b1cbd1a9b5703efdd1d19a551",
+    "microi-microservice/SKILL.md": "e8edecf40b0b18ab0bf3d69b0d647e16e2d471b15ef7b149ca1f6dfb16484f67",
     "microi-microservice/references/runtime-delivery.md": "704ed30623d91c971bed359403caa1f848edd07528ecbf211fa3b619ccec117d",
     "microi-mobile-app-quality/SKILL.md": "810bc23f3cfd4ee47ff3a51917b9aaa46cad8d59d2e3a880ed5f4c41b70eb1d7",
     "microi-solution-quotation/SKILL.md": "1bd47bd019a62bdc904612a7d8e2501c76df66eed9ef247544dd7fe38eba02e4",
@@ -82,7 +82,7 @@
     "search-engine/SKILL.md": "ddabf0b288d04c72985d3528e12c19bcd212a292a09593514d8385c4cb2c53a4",
     "search-engine/agents/openai.yaml": "5ddbe54965386287b00eba1cd7e38f3c7058edc437538f12ddb165f96f75a6eb",
     "spider-engine/SKILL.md": "09e9e164dc09c35bb4bebfbe77e3ba18164c89503313b28a1b4f1061e0de5e30",
-    "translate-engine/SKILL.md": "4147778f7ee1c96e41ce9cda72c5666bfd2f9efe71df7fb91b2393aaf157b40a",
+    "translate-engine/SKILL.md": "384ab8a4c064f1ded98ef3890d5f65daee0001c784cd42d8560623ae64469203",
     "translate-engine/agents/openai.yaml": "8eb47e08a691219bbe22a797ddbdf73234ec77f86e5724bc735fb0738d899112",
     "ui-design/SKILL.md": "72026459d3a2da49abee8af379f0a4c13ecfc955bd61e4e0d8e398d1af4213d1",
     "ui-design/assets/pattern-showcase/app.js": "68a8d404c30096da853c6edbc7cb27f336982147ddfebccd66c03ba3d99427cd",
@@ -102,7 +102,7 @@
     "v8-export-import/SKILL.md": "e55299d75b24bcbb6248ec2572b55cd0515fb4fbfadaa1f78bcbe4a8d701a1f9",
     "v8-file-upload/SKILL.md": "3c1f9390ed6c2457796b341e45fca7f5492a9cda4419d35dae33cbfa2fc80383",
     "v8-formengine-http/SKILL.md": "d975bc116e100f91d80acf7932128de6fff78c5fcd17557d3d5a5504e3359682",
-    "v8-frontend-events/SKILL.md": "b4265a5e6d0dbeb8c64441465caf764ffe2039decff0f16b3572ce685cf6e911",
+    "v8-frontend-events/SKILL.md": "1e7edb8c77e13a8489533d81f36cfc134430be6f4d7c4eab2f581713ee5f083a",
     "v8-frontend-events/references/bluetooth-print-api.md": "c5667cc6a9ed1bf385a21ddbc28e39993bc9e6d527bc31b53fb4ad582abf719e",
     "v8-frontend-events/references/bluetooth-print.md": "d57f6981d846093277c1456c84bbf9586f65db70129d007fe25fdfb12f58e589",
     "v8-http-integration/SKILL.md": "08bb5e9e7a18be162dc907cc02ab8b60ab0aee198617f3c9e1354c620b6f2dc4",
@@ -113,123 +113,123 @@
     "v8-mongodb/SKILL.md": "7da703b5dc9fb9613cca1929fd854e3d333ad7d86200b839bb78ccdc8e0cc6cf",
     "v8-mq-mqtt/SKILL.md": "3894fc353a3e9896b16b54b9e12758f0aea950968f80b7f3ec86c6652040341c",
     "v8-saas-multi-tenant/SKILL.md": "0145ddd39e109e39b601cfac45b746624f21d9dfce5951b662ac713e80f3fc72",
-    "v8-security/SKILL.md": "7cd66077bf297d9f57b2d045cd3cba02fd120d84c22e1b58cfd35aee3bce08d2",
+    "v8-security/SKILL.md": "91ccb35136fce4e5c9524b9a787ca33712fac06be9c114a925e48f9b5be1e62c",
     "v8-sql-query/SKILL.md": "0ebedf72732479e24ca7528120345d468f98fbf96c21a8f45aaa64eb8ef6a488",
     "v8-table-event/SKILL.md": "ddeb3020e8c7e3002c8f8598a65208b7a2f706ee13f040037f85979c7bc1e8fd",
     "v8-template-engine/SKILL.md": "20002c2124214641b782db9deabb367c151b6be1b2d32f6689c163dcb0925cce",
     "v8-utilities/SKILL.md": "cdc1c33e2c464a89635bbcb96bf5079d9e22c58a0c70158634c2ab70fd034d3b",
-    "v8-utilities/references/client-api-index.md": "e7b4c9dea4e83e449b9efbb23c3d19da500d8683996a2dba06c568b79adbee60",
+    "v8-utilities/references/client-api-index.md": "88741d5f5bb2b727c72ae553819cdccd647862414bf03f973ecacf79f9454296",
     "v8-utilities/references/platform-http-routes.md": "87579eef4e89b4c80e1757ad34ec951e0ccadb6bd15aab4f3ab247f55d5f1cd5",
-    "v8-utilities/references/server-api-index.md": "761f4910050b217d3fecc14f4405b779a0f1661cbd8051086fd35b067a794dc8",
+    "v8-utilities/references/server-api-index.md": "8879c16421fccbf69177683ef201976292e7b84757f53bcf0945bad985426893",
     "v8-workflow/SKILL.md": "cd6738edd79f628948adfac898b6d58a81feb28d1ec6d1f83fc12758fb570819",
-    "workspace-conventions/SKILL.md": "90ed592cebb82f786f3810cfb04f6b4a58af74690a4dc6818c8d819bd230c53f"
+    "workspace-conventions/SKILL.md": "950480ad1e5a32176823d4f024af6aecd9b37ee7423c05e2ec4c1b1a4130cb66"
   },
   "fileVersions": {
-    ".microi-skills-version.json": "4.7.2",
-    "README.md": "4.7.2",
-    "ai-engine/SKILL.md": "4.7.2",
-    "ai-engine/agents/openai.yaml": "4.7.2",
-    "app-store/SKILL.md": "4.7.2",
-    "app-store/agents/openai.yaml": "4.7.2",
-    "business-blueprint/SKILL.md": "4.7.2",
-    "datasource-engine/SKILL.md": "4.7.2",
-    "datasource-engine/agents/openai.yaml": "4.7.2",
-    "dos-orm/SKILL.md": "4.7.2",
-    "dos-orm/references/api-reference.md": "4.7.2",
-    "job-engine/SKILL.md": "4.7.2",
-    "job-engine/agents/openai.yaml": "4.7.2",
-    "message-notification/SKILL.md": "4.7.2",
-    "message-notification/agents/openai.yaml": "4.7.2",
-    "message-notification/references/contracts.md": "4.7.2",
-    "microi-ai-app-auth.js": "4.7.2",
-    "microi-ai-application/SKILL.md": "4.7.2",
-    "microi-ai-application/agents/openai.yaml": "4.7.2",
-    "microi-ai-application/references/frontend-baseline.md": "4.7.2",
-    "microi-client-frontend/SKILL.md": "4.7.2",
-    "microi-datasource-mapping/SKILL.md": "4.7.2",
-    "microi-db-schema/SKILL.md": "4.7.2",
-    "microi-db-schema/agents/openai.yaml": "4.7.2",
-    "microi-db-schema/references/core-tables.md": "4.7.2",
-    "microi-db-schema/references/form-component-options.md": "4.7.2",
-    "microi-db-schema/references/schema-overview.md": "4.7.2",
-    "microi-db-schema/references/schema.md": "4.7.2",
-    "microi-db-schema/references/table-catalog.md": "4.7.2",
-    "microi-deployment/SKILL.md": "4.7.2",
-    "microi-deployment/references/deployment-matrix.md": "4.7.2",
-    "microi-docs-coverage/SKILL.md": "4.7.2",
-    "microi-docs-coverage/references/capability-map.md": "4.7.2",
-    "microi-docs-coverage/scripts/audit-doc-skill-coverage.mjs": "4.7.2",
-    "microi-form-engine/SKILL.md": "4.7.2",
-    "microi-form-engine/references/component-catalog.md": "4.7.2",
-    "microi-form-engine/references/data-source-events.md": "4.7.2",
-    "microi-form-layout/SKILL.md": "4.7.2",
-    "microi-frontend-sdk/SKILL.md": "4.7.2",
-    "microi-left-right-layout/SKILL.md": "4.7.2",
-    "microi-microservice/SKILL.md": "4.7.2",
-    "microi-microservice/references/runtime-delivery.md": "4.7.2",
-    "microi-mobile-app-quality/SKILL.md": "4.7.2",
-    "microi-solution-quotation/SKILL.md": "4.7.2",
-    "microi-solution-quotation/agents/openai.yaml": "4.7.2",
-    "microi-solution-quotation/scripts/build_solution_quote.py": "4.7.2",
-    "microi-system-delivery/SKILL.md": "4.7.2",
-    "microi-ui/SKILL.md": "4.7.2",
-    "microi-uniapp-frontend/SKILL.md": "4.7.2",
-    "microi.v8.js": "4.7.2",
-    "module-engine/SKILL.md": "4.7.2",
-    "module-engine/references/module-config.md": "4.7.2",
-    "ocr-engine/SKILL.md": "4.7.2",
-    "ocr-engine/agents/openai.yaml": "4.7.2",
-    "page-engine/SKILL.md": "4.7.2",
-    "performance-testing/SKILL.md": "4.7.2",
-    "playwright-e2e/SKILL.md": "4.7.2",
-    "print-engine/SKILL.md": "4.7.2",
-    "production-readonly-audit/SKILL.md": "4.7.2",
-    "report-engine/SKILL.md": "4.7.2",
-    "report-engine/agents/openai.yaml": "4.7.2",
-    "search-engine/SKILL.md": "4.7.2",
-    "search-engine/agents/openai.yaml": "4.7.2",
-    "spider-engine/SKILL.md": "4.7.2",
-    "translate-engine/SKILL.md": "4.7.2",
-    "translate-engine/agents/openai.yaml": "4.7.2",
-    "ui-design/SKILL.md": "4.7.2",
-    "ui-design/assets/pattern-showcase/app.js": "4.7.2",
-    "ui-design/assets/pattern-showcase/index.html": "4.7.2",
-    "ui-design/assets/pattern-showcase/styles.css": "4.7.2",
-    "ui-design/assets/templates/MCI-DESIGN.md": "4.7.2",
-    "ui-design/references/design-pattern-library.md": "4.7.2",
-    "ui-design/references/mci-design-contract.md": "4.7.2",
-    "ui-design/references/motion-and-media.md": "4.7.2",
-    "ui-design/references/product-flow-recipes.md": "4.7.2",
-    "uniapp-mall-assets/SKILL.md": "4.7.2",
-    "v8-api-config/SKILL.md": "4.7.2",
-    "v8-cache-pattern/SKILL.md": "4.7.2",
-    "v8-crud-api/SKILL.md": "4.7.2",
-    "v8-debugging/SKILL.md": "4.7.2",
-    "v8-explorer-tree/SKILL.md": "4.7.2",
-    "v8-export-import/SKILL.md": "4.7.2",
-    "v8-file-upload/SKILL.md": "4.7.2",
-    "v8-formengine-http/SKILL.md": "4.7.2",
-    "v8-frontend-events/SKILL.md": "4.7.2",
-    "v8-frontend-events/references/bluetooth-print-api.md": "4.7.2",
-    "v8-frontend-events/references/bluetooth-print.md": "4.7.2",
-    "v8-http-integration/SKILL.md": "4.7.2",
-    "v8-image-processing/SKILL.md": "4.7.2",
-    "v8-image-processing/agents/openai.yaml": "4.7.2",
-    "v8-image-processing/references/api-reference.md": "4.7.2",
-    "v8-menu-buttons/SKILL.md": "4.7.2",
-    "v8-mongodb/SKILL.md": "4.7.2",
-    "v8-mq-mqtt/SKILL.md": "4.7.2",
-    "v8-saas-multi-tenant/SKILL.md": "4.7.2",
-    "v8-security/SKILL.md": "4.7.2",
-    "v8-sql-query/SKILL.md": "4.7.2",
-    "v8-table-event/SKILL.md": "4.7.2",
-    "v8-template-engine/SKILL.md": "4.7.2",
-    "v8-utilities/SKILL.md": "4.7.2",
-    "v8-utilities/references/client-api-index.md": "4.7.2",
-    "v8-utilities/references/platform-http-routes.md": "4.7.2",
-    "v8-utilities/references/server-api-index.md": "4.7.2",
-    "v8-workflow/SKILL.md": "4.7.2",
-    "workspace-conventions/SKILL.md": "4.7.2"
+    ".microi-skills-version.json": "4.7.4",
+    "README.md": "4.7.4",
+    "ai-engine/SKILL.md": "4.7.4",
+    "ai-engine/agents/openai.yaml": "4.7.4",
+    "app-store/SKILL.md": "4.7.4",
+    "app-store/agents/openai.yaml": "4.7.4",
+    "business-blueprint/SKILL.md": "4.7.4",
+    "datasource-engine/SKILL.md": "4.7.4",
+    "datasource-engine/agents/openai.yaml": "4.7.4",
+    "dos-orm/SKILL.md": "4.7.4",
+    "dos-orm/references/api-reference.md": "4.7.4",
+    "job-engine/SKILL.md": "4.7.4",
+    "job-engine/agents/openai.yaml": "4.7.4",
+    "message-notification/SKILL.md": "4.7.4",
+    "message-notification/agents/openai.yaml": "4.7.4",
+    "message-notification/references/contracts.md": "4.7.4",
+    "microi-ai-app-auth.js": "4.7.4",
+    "microi-ai-application/SKILL.md": "4.7.4",
+    "microi-ai-application/agents/openai.yaml": "4.7.4",
+    "microi-ai-application/references/frontend-baseline.md": "4.7.4",
+    "microi-client-frontend/SKILL.md": "4.7.4",
+    "microi-datasource-mapping/SKILL.md": "4.7.4",
+    "microi-db-schema/SKILL.md": "4.7.4",
+    "microi-db-schema/agents/openai.yaml": "4.7.4",
+    "microi-db-schema/references/core-tables.md": "4.7.4",
+    "microi-db-schema/references/form-component-options.md": "4.7.4",
+    "microi-db-schema/references/schema-overview.md": "4.7.4",
+    "microi-db-schema/references/schema.md": "4.7.4",
+    "microi-db-schema/references/table-catalog.md": "4.7.4",
+    "microi-deployment/SKILL.md": "4.7.4",
+    "microi-deployment/references/deployment-matrix.md": "4.7.4",
+    "microi-docs-coverage/SKILL.md": "4.7.4",
+    "microi-docs-coverage/references/capability-map.md": "4.7.4",
+    "microi-docs-coverage/scripts/audit-doc-skill-coverage.mjs": "4.7.4",
+    "microi-form-engine/SKILL.md": "4.7.4",
+    "microi-form-engine/references/component-catalog.md": "4.7.4",
+    "microi-form-engine/references/data-source-events.md": "4.7.4",
+    "microi-form-layout/SKILL.md": "4.7.4",
+    "microi-frontend-sdk/SKILL.md": "4.7.4",
+    "microi-left-right-layout/SKILL.md": "4.7.4",
+    "microi-microservice/SKILL.md": "4.7.4",
+    "microi-microservice/references/runtime-delivery.md": "4.7.4",
+    "microi-mobile-app-quality/SKILL.md": "4.7.4",
+    "microi-solution-quotation/SKILL.md": "4.7.4",
+    "microi-solution-quotation/agents/openai.yaml": "4.7.4",
+    "microi-solution-quotation/scripts/build_solution_quote.py": "4.7.4",
+    "microi-system-delivery/SKILL.md": "4.7.4",
+    "microi-ui/SKILL.md": "4.7.4",
+    "microi-uniapp-frontend/SKILL.md": "4.7.4",
+    "microi.v8.js": "4.7.4",
+    "module-engine/SKILL.md": "4.7.4",
+    "module-engine/references/module-config.md": "4.7.4",
+    "ocr-engine/SKILL.md": "4.7.4",
+    "ocr-engine/agents/openai.yaml": "4.7.4",
+    "page-engine/SKILL.md": "4.7.4",
+    "performance-testing/SKILL.md": "4.7.4",
+    "playwright-e2e/SKILL.md": "4.7.4",
+    "print-engine/SKILL.md": "4.7.4",
+    "production-readonly-audit/SKILL.md": "4.7.4",
+    "report-engine/SKILL.md": "4.7.4",
+    "report-engine/agents/openai.yaml": "4.7.4",
+    "search-engine/SKILL.md": "4.7.4",
+    "search-engine/agents/openai.yaml": "4.7.4",
+    "spider-engine/SKILL.md": "4.7.4",
+    "translate-engine/SKILL.md": "4.7.4",
+    "translate-engine/agents/openai.yaml": "4.7.4",
+    "ui-design/SKILL.md": "4.7.4",
+    "ui-design/assets/pattern-showcase/app.js": "4.7.4",
+    "ui-design/assets/pattern-showcase/index.html": "4.7.4",
+    "ui-design/assets/pattern-showcase/styles.css": "4.7.4",
+    "ui-design/assets/templates/MCI-DESIGN.md": "4.7.4",
+    "ui-design/references/design-pattern-library.md": "4.7.4",
+    "ui-design/references/mci-design-contract.md": "4.7.4",
+    "ui-design/references/motion-and-media.md": "4.7.4",
+    "ui-design/references/product-flow-recipes.md": "4.7.4",
+    "uniapp-mall-assets/SKILL.md": "4.7.4",
+    "v8-api-config/SKILL.md": "4.7.4",
+    "v8-cache-pattern/SKILL.md": "4.7.4",
+    "v8-crud-api/SKILL.md": "4.7.4",
+    "v8-debugging/SKILL.md": "4.7.4",
+    "v8-explorer-tree/SKILL.md": "4.7.4",
+    "v8-export-import/SKILL.md": "4.7.4",
+    "v8-file-upload/SKILL.md": "4.7.4",
+    "v8-formengine-http/SKILL.md": "4.7.4",
+    "v8-frontend-events/SKILL.md": "4.7.4",
+    "v8-frontend-events/references/bluetooth-print-api.md": "4.7.4",
+    "v8-frontend-events/references/bluetooth-print.md": "4.7.4",
+    "v8-http-integration/SKILL.md": "4.7.4",
+    "v8-image-processing/SKILL.md": "4.7.4",
+    "v8-image-processing/agents/openai.yaml": "4.7.4",
+    "v8-image-processing/references/api-reference.md": "4.7.4",
+    "v8-menu-buttons/SKILL.md": "4.7.4",
+    "v8-mongodb/SKILL.md": "4.7.4",
+    "v8-mq-mqtt/SKILL.md": "4.7.4",
+    "v8-saas-multi-tenant/SKILL.md": "4.7.4",
+    "v8-security/SKILL.md": "4.7.4",
+    "v8-sql-query/SKILL.md": "4.7.4",
+    "v8-table-event/SKILL.md": "4.7.4",
+    "v8-template-engine/SKILL.md": "4.7.4",
+    "v8-utilities/SKILL.md": "4.7.4",
+    "v8-utilities/references/client-api-index.md": "4.7.4",
+    "v8-utilities/references/platform-http-routes.md": "4.7.4",
+    "v8-utilities/references/server-api-index.md": "4.7.4",
+    "v8-workflow/SKILL.md": "4.7.4",
+    "workspace-conventions/SKILL.md": "4.7.4"
   },
   "files": [
     ".microi-skills-version.json",

package/dist/microi.skills/.microi-skills-version.json

@@ -1,6 +1,6 @@
 {
-  "version": "4.7.2",
+  "version": "4.7.4",
   "versionRule": "Microi version uses three numeric parts. Each publish increments the last part; when a part exceeds 9 it carries to the previous part: 1.0.9 -> 1.1.0, 1.9.9 -> 2.0.0.",
   "managedBy": "Microi.VSCode/bump-version.js",
-  "updatedAt": "2026-08-06T11:15:17.861Z"
+  "updatedAt": "2026-08-07T04:21:46.680Z"
 }

package/dist/microi.skills/microi-docs-coverage/references/capability-map.md

@@ -26,6 +26,7 @@ Markdown。第一列是相对 `microi.doc/docs/doc/` 的路径；第二列 Skill
 | `more/dos-orm.md` | dos-orm, v8-sql-query | ORM 查询、参数和事务 |
 | `more/dos-result.md` | v8-utilities, v8-crud-api | DosResult/DosResultList 返回协议 |
 | `more/hdfs.md` | v8-file-upload | 分布式文件存储和 URL |
+| `more/identity-verification.md` | v8-security, v8-utilities, microi-microservice | DiyToken、Passkey、严格人脸、一次性步进票据和个人设置 |
 | `more/office.md` | v8-export-import, microi-microservice | Office 导入导出与在线编辑集成 |
 | `more/security.md` | v8-security | 平台安全和兼容基线 |
 | `more/sys-config.md` | v8-utilities, microi-deployment | 系统/租户配置和敏感边界 |
@@ -52,8 +53,8 @@ Markdown。第一列是相对 `microi.doc/docs/doc/` 的路径；第二列 Skill
 | `v8-engine/api-engine.md` | v8-api-config, v8-utilities | 接口上下文、配置和调用 |
 | `v8-engine/apiengine-index.md` | v8-crud-api, v8-api-config | 接口引擎实战和规范 |
 | `v8-engine/form-engine.md` | v8-crud-api, v8-formengine-http | FormEngine API 与 HTTP |
-| `v8-engine/v8-client.md` | v8-utilities, v8-frontend-events, v8-http-integration, ai-engine, print-engine | 全部前端 V8、平台 AI、扫码和蓝牙打印 |
-| `v8-engine/v8-server.md` | v8-utilities, v8-api-config, v8-http-integration, ai-engine | 全部后端 V8、平台 AI 和专项路由 |
+| `v8-engine/v8-client.md` | v8-utilities, v8-frontend-events, v8-http-integration, v8-security, ai-engine, print-engine | 全部前端 V8、平台 AI、强身份验证、扫码和蓝牙打印 |
+| `v8-engine/v8-server.md` | v8-utilities, v8-api-config, v8-http-integration, v8-security, ai-engine | 全部后端 V8、强身份票据、平台 AI 和专项路由 |
 | `v8-engine/vs-code-plugin.md` | v8-explorer-tree, microi-client-frontend, workspace-conventions | VS Code 插件、Microi CLI、AI/MCP 初始化、类型、资源树和共享工作区 |
 | `v8-engine/where.md` | v8-crud-api, v8-sql-query | 参数化 `_Where` 条件 |
 

package/dist/microi.skills/microi-microservice/SKILL.md

@@ -79,6 +79,9 @@ AppKey 稳定且只含安全字符。`microi.routes.json` 是页面事实源，
 - 创建/更新元数据：`microi_create_microservice`。
 - 同步私有源码：`microi_sync_microservice_source`。
 - 真实编译目录优先 `microi_publish_application_directory_stream` 流式发布。
+- 发布动作必须明确区分两种模式：默认“源码+编译产物”先把完整工程同步到私有桶并逐文件回读 SHA-256，再把 `dist` 流式发布到公有桶；显式“仅编译产物”只更新公有桶，必须在界面中告知其他用户仍会拉取上一次私有源码，禁止暗示源码已同步。
+- 私有源码同步使用 `ReplacePrivateSourceOnly` 精确清理过期源码；兼容调用可以继续接受 `replace`，但实现不得用旧式全表 `Replace=true` 删除同一应用的公有运行产物元数据。
+- `mci_ai_app_file` 同时存在私有源码和公有编译产物。源码拉取/差异比较必须优先按 `StorageScope=PublicBuildStream|PublicBuildStreamArchived|PublicBuildOnly` 排除公有产物，并保留旧数据中 `HdfsPath == PublishHdfsPath` 的兼容判断；不能仅靠两个路径相等识别，否则版本路径与稳定别名不同的流式产物会被误读成私有源码。
 - 只有服务器不支持流式端点且产物很小时，才兼容 `microi_publish_microservice`。
 - 正常发布支持最多 20,000 个文件、总计 20GB；逐文件从磁盘流入 HDFS，不生成整包 Buffer/Base64。几百 MB、1GB 级项目不得自动降级到旧 Base64 发布器。
 - `StorageMode=db` 仅是显式的小型应急恢复模式，不是正常发布容量；当前最多 256 文件/5MB。超过该边界必须修复租户 HDFS/网关并恢复流式文件模式，不能调大数据库内联上限来承载大项目。
@@ -138,6 +141,7 @@ AI 生成菜单微服务时，应优先封装一个 `callMicroiHost(action, data
 ## 验收
 
 - 源码、构建文件、运行时、页面路由和菜单五层分别回读。
+- 组合发布成功前，私有源码回读必须与本地源码在路径集合、文件数、字节数、逐文件 SHA-256 和规范化清单哈希上完全一致；任何缺失、多余或读取错误都要阻止运行版本切换。
 - 直接刷新友好路由与连续切换多个微应用不 404、白屏或实例名冲突。
 - Dialog/Drawer 成功、取消、错误和关闭协议正确。
 - 宿主 API 请求携带当前 Token/OsClient/菜单上下文，普通用户权限正确。

package/dist/microi.skills/translate-engine/SKILL.md

@@ -39,6 +39,8 @@ var code = V8.TranslateEngine.GetLangCode('NoAuth');
 
 LibreTranslate 的 `/frontend/settings`、API Key 管理、`/metrics` 和 Web UI 是运维控制面，不得从普通 V8/HTTP/MCP 代理。
 
+文件入口的完整名称是 `V8.TranslateEngine.TranslateFile({...})`，不要把叶子名误当全局函数。
+
 ## 租户与密钥
 
 - V8 调用统一绑定当前 `V8TenantContext`。普通租户传其它 `OsClient` 不会跨租户翻译或读取配置。
@@ -80,6 +82,8 @@ LibreTranslate 是动态翻译供应商，不是 `diy_lang` 的替代品。一
 
 已登录 HTTP 入口固定为 `/api/Translate/TranslateText|Detect|Languages|TranslateFile|Suggest|Health`。Controller 必须用验证后的 Token 覆盖请求体 `OsClient`，不得接受 endpoint/key/header。
 
+覆盖审计所用的标准路由为 `/api/translate/detect`、`/api/translate/languages`、`/api/translate/translatefile`、`/api/translate/suggest` 和 `/api/translate/health`；它们都服从同一登录与租户绑定规则。
+
 MCP 固定工具：`microi_translate`、`microi_detect_language`、`microi_list_translate_languages`、`microi_translate_file`、`microi_suggest_translation`、`microi_get_translate_health`。文件翻译需要 `confirmExecution=TRANSLATE_FILE`，建议写入需要 `confirmExecution=TRANSLATE_SUGGEST`；审计只记录长度、SHA-256、语言和输出模式，不记录文本、文件内容、本机路径或凭据。大文件结果落到新的绝对路径，不允许覆盖已有文件。
 
 ## 安全硬上限

package/dist/microi.skills/v8-frontend-events/SKILL.md

@@ -17,6 +17,7 @@ description: Microi 前端 V8 事件与客户端能力指南。用于编写浏
 - 需求包含“蓝牙打印、标签打印、TSC/TSPL、ESC/POS、小票打印、佳博打印机”时，必须先读取 `references/bluetooth-print.md`；需要完整指令签名、编码或位图参数时，再读取 `references/bluetooth-print-api.md`。
 - 浏览器模板打印、PDF/纸张模板、`mic_print`、`PageObj`、`PrintObj` 使用 `print-engine/SKILL.md`，不要与直接蓝牙指令混为一套 API。
 - 扫码使用 `V8.Method.ScanCode`，结果从 Promise/回调取得；`V8.ScanCodeRes` 只作兼容结果槽，详见客户端 API 索引。
+- 登录后的敏感操作使用 `V8.Identity.Verify` 完成 Passkey/严格人脸交互；前端只取得一次性 Ticket，后端接口引擎必须重算 `ActionHash` 并原子消费，不能把前端成功当作授权。
 
 ## 字段事件（在【字段属性】中配置）
 

package/dist/microi.skills/v8-security/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: v8-security
-description: Microi V8 安全指南。用于审查接口引擎安全、密钥管理、SQL 注入、权限检查、匿名端点、文件上传安全和租户隔离。
+description: Microi V8 安全指南。用于审查 DiyToken 与权限、可逆业务秘密、Passkey/人脸步进验证、接口引擎安全、密钥管理、SQL 注入、匿名端点、文件上传和租户隔离。
 ---
 
 # Microi V8 安全最佳实践
@@ -31,6 +31,8 @@ var openaiKey = 'sk-xxxxxxxxxx';
 
 登录和管理端必须强制 HTTPS。登录 RSA 只用于避免密码在请求体、代理调试界面中直接显示，不能替代 HTTPS，也不能作为身份认证或密码存储密钥。平台为兼容已发布客户、旧前端和浏览器缓存，保留历史登录 RSA 密钥对作为缺省回退；安全修复不得直接删除该回退并造成全量客户无法登录。需要部署专属密钥时，在主租户 SaaS 引擎【后端运行配置】中成对维护 `BackendLoginRsaPrivateKey` 与 `BackendLoginRsaPublicKey`；私钥只允许可信服务端读取，匿名 `GetSysConfig` 只返回匹配公钥。源码、环境变量、普通 V8、前端业务代码和日志中仍禁止新增或输出真正的业务私钥、JWT 密钥、支付密钥及对象存储凭据。
 
+微信内容安全回调固定使用 `/api/wechatcontentsecurity/callback` 或第三方不支持 QueryString 时以 `/api/wechatcontentsecurity/callback--osclient--` 为路径前缀并追加 `{OsClient}--`；回调只能由服务端按签名和租户规则建立信任。
+
 吾码现有多端兼容约定是：主 SaaS 引擎 `sys_osclients.CorsAllowOrigins` 为空时默认允许全部跨域，便于本地开发、独立前端、H5 和不同租户域名访问；配置了来源后才按精确来源或通配符限制。安全修复不得把“未配置”改成默认拒绝，否则会造成所有存量部署和本地调试突然失效。CORS 不是鉴权边界，权限仍必须依赖 Token、租户隔离、菜单/表权限和服务端数据范围。
 
 吾码既有客户大量通过 `V8.Http` 访问内网设备、InfluxDB、内部 ApiEngine 和本机 sidecar。严格 SSRF 防护必须默认关闭：未配置时不得限制协议、URL 内嵌凭据、回环、私网、链路本地、云元数据或重定向。只有客户在 SaaS 引擎主租户启用 `SsrfProtectionEnabled` 后才进入严格模式，并用精确 `SsrfAllowedHosts` 放行；不要为这类普通运行参数增加 API 容器环境变量。
@@ -85,6 +87,17 @@ V8.Db.FromSql("SELECT * FROM " + V8.Param.table).ToArray();
 
 ## 2. 权限校验
 
+### DiyToken 是平台会话与权限入口，不替换为 ASP.NET Identity
+
+DiyToken 与 `sys_user`、`OsClient`、终端 `did`、共享 Redis 登录态、角色/部门、菜单动作、表权限、数据范围和接口引擎共同构成吾码认证授权体系。它不是“只有一个 Token 字符串”的简化登录：
+
+- 登录、SSO、OAuth、Passkey、人脸或访问密钥验证成功后，统一签发/兑换 DiyToken。
+- Token 认证只证明用户和租户；服务端仍按资源、动作和数据范围授权，前端按钮不可代替。
+- 用户停用、角色变化、单终端/全部终端吊销和 Token 轮换都依赖共享会话事实，不依赖单机内存。
+- ASP.NET Identity 可以作为外部身份源的适配参考，但不能整体替换吾码的租户、低代码权限、V8 和在线终端协议。
+
+开发新登录入口时只实现“验证身份 -> 获取仍启用的 `sys_user` -> 签发 DiyToken”，禁止并行创建第二套用户、角色、权限 Token 或会话有效期规则。
+
 ### 平台 FormEngine 授权边界
 
 **Token 只完成身份认证，不是任意表的访问凭证。** 来自浏览器、UniApp、SDK 或其它外部客户端的通用 FormEngine 请求，必须由服务端完成以下授权，V8 或前端代码不得自行模拟、放宽：
@@ -260,6 +273,45 @@ if (old.Code === 1 && old.Data) {
 业务 V8 禁止自行查询 `sys_user`、保存密码或用 MD5/SHA1/SHA256 直接哈希密码。统一使用平台登录、重置密码和管理员用户管理接口；新密码存储必须由后端使用带盐、可调成本的专用密码哈希，并支持版本与轮换。登录 RSA 只隐藏传输报文中的明文外观，不能替代 HTTPS，也不能用于密码存储。
 
 存量 `PwdEncode=DES` 的兼容例外只能位于 `[PlatformAdminOnly]` 的 `GetSysUserPassword`：还要拒绝访问密钥会话、按当前 `OsClient` 和准确用户 Id 查询、用“解密后重新加密等于原密文”验证结果、返回 `no-store` 并写不含明文的安全审计。`PwdEncode=V8` 不假定可逆。不得把该能力暴露给 FormEngine、V8、普通角色或匿名端点。
+
+### 可逆业务秘密：允许加密存储和授权显示
+
+设备口令、第三方业务账号密码、客户明确要求再次显示的字段可以使用 `V8.EncryptHelper.DESEncode/DESDecode` 兼容机制，但必须与登录密码、支付私钥、`AuthSecret` 和基础设施密钥分开：
+
+```javascript
+// 保存：只在可信后端执行
+V8.Form.SecretCipher = V8.EncryptHelper.DESEncode(String(V8.Form.SecretPlain || ''));
+V8.NotSaveField.push('SecretPlain');
+```
+
+显示明文必须设计为独立后端动作，并同时做到：
+
+- 校验当前 DiyToken、准确 `OsClient`、当前用户真实角色/菜单/业务权限；高风险场景再要求下面的一次性强身份票据。
+- 只解密一条明确记录，不向列表、批量导出、通用 FormEngine、匿名或访问密钥会话提供解密器。
+- 只记录操作者、目标 Id、用途、结果和时间，禁止日志/审计/通知/缓存保存明文；HTTP 响应设置 `no-store`。
+- 页面默认掩码，点击显示需二次确认，失焦/超时/路由离开后清除；禁止复制到 URL、LocalStorage 或前端日志。
+- DES 是存量兼容格式。新高价值秘密优先由可信 C# 原子能力使用带版本的现代认证加密和集中密钥管理，V8 仍只编排授权显示，不能获取主密钥。
+
+### Passkey、人脸与敏感操作票据
+
+前端 V8 使用 `V8.Identity.Verify({Purpose,ActionHash,Method})` 完成人机交互，后端必须从数据库重读权威业务字段、按稳定版本/顺序重算 `ActionHash`，再消费票据：
+
+```javascript
+var actionHash = V8.EncryptHelper.Sha256Hex(canonicalCommand);
+var verified = V8.Method.ConsumeIdentityVerificationTicket({
+  Ticket: V8.Param.IdentityVerificationTicket,
+  Purpose: 'RevealBusinessSecret',
+  ActionHash: actionHash
+});
+if (verified.Code !== 1) return verified;
+```
+
+- Ticket 绑定 `OsClient + UserId + Purpose + ActionHash`，共享 Redis 保存两分钟并使用原子 `GETDEL`，只能消费一次。
+- 前端提交的摘要、`Verified=true`、认证器名称或方法不能作为授权事实；访问密钥会话不能使用。
+- 票据只证明近期强身份，不代替菜单/表/行权限、业务状态机、事务、幂等或审计。
+- 设备指纹/Face ID/Windows Hello 优先走 WebAuthn/Passkey，不需要模型 Docker；只有严格服务端人脸/活体检测才通过 `Microi Face Gateway v1` 接入独立服务。
+- 完整表、SaaS 字段、API 和启用顺序见 `microi.doc/docs/doc/more/identity-verification.md`。
+- 身份验证 HTTP 控制面统一位于 `/api/identityverification/`，业务页面优先使用 `V8.Identity`，不要自行复制 WebAuthn 序列化代码。
 
 ### 脱敏返回
 
@@ -384,6 +436,9 @@ try {
 - [ ] 涉及数据修改的接口校验请求参数合法性
 - [ ] 敏感数据（手机号、身份证等）脱敏返回
 - [ ] 密码只走平台认证/重置流程；禁止MD5/SHA直接存储，后端使用带盐自适应密码哈希
+- [ ] 可逆业务秘密只在后端加解密；列表掩码、独立授权显示、no-store 且审计不含明文
+- [ ] 新登录/SSO/Passkey/人脸入口最终签发 DiyToken，不并行创建第二套权限体系
+- [ ] 敏感操作票据由后端重算 ActionHash 后原子消费，不能相信前端验证成功布尔值
 - [ ] 写操作有防重复提交机制
 - [ ] 关键操作写审计日志
 - [ ] catch 块不暴露内部错误给前端

package/dist/microi.skills/v8-utilities/references/client-api-index.md

@@ -115,8 +115,13 @@
 | `V8.SendSystemMessage(...)` | 发送站内系统消息 |
 | `await V8.Method.ScanCode()` | 扫码；成功值同时写入 `V8.ScanCodeRes` |
 | `V8.Print.*` | BLE 标签/小票打印，见蓝牙打印参考 |
+| `V8.Identity.GetCapabilities()` | 读取当前租户强身份能力和本人登记状态 |
+| `V8.Identity.CreateActionHash(value)` | 为稳定业务命令生成 SHA-256 摘要 |
+| `V8.Identity.RegisterPasskey(options?)` | 登记当前用户 Passkey |
+| `V8.Identity.Verify({Purpose,ActionHash,Method})` | 完成 Passkey/严格人脸验证并取得一次性后端票据 |
 
 扫码应优先接收 Promise 返回值；兼容代码可在调用后读取 `V8.ScanCodeRes`。
+`V8.Identity` 是强身份验证模块。`V8.Identity.Verify` 的成功结果不能直接授权业务；后端必须重读权威数据、重算摘要并调用 `V8.Method.ConsumeIdentityVerificationTicket`。
 蓝牙打印完整 API 包含 `V8.Print.createNew`、`V8.Print.createNewESC`、
 `V8.Print.OpenBluetoothPage`、`V8.Print.isConnected`、
 `V8.Print.prepareSend`、`V8.Print.Send`、`V8.Print.setOneTimeData`、

package/dist/microi.skills/v8-utilities/references/server-api-index.md

@@ -50,6 +50,7 @@
 | `V8.Method.GetCurrentToken(token,osClient)` | 读取当前 Token 对象；不透传前端 |
 | `V8.Method.RefreshLoginUser(userId,osClient)` | 刷新用户登录缓存 |
 | `V8.Method.ClearUserLoginInfo(userId,osClient)` | 管理员吊销用户全部终端 Token |
+| `V8.Method.ConsumeIdentityVerificationTicket({Ticket,Purpose,ActionHash})` | 按当前 DiyToken 用户、租户、用途和操作摘要原子消费一次性 Passkey/人脸票据 |
 | `V8.Method.GetPrivateFileUrl({FilePathName})` | 签发当前租户短期私有文件代理地址 |
 | `V8.Method.Upload(options)` | 受配额限制的上传 |
 | `V8.Method.AddSysLog(options)` | 结构化系统日志 |
@@ -82,6 +83,8 @@ var signature = V8.EncryptHelper.HmacSha256(secretFromConfig, payload);
 `V8.EncryptHelper.AESEncrypt`、`V8.EncryptHelper.AESDecrypt`、
 `V8.EncryptHelper.DESEncode`、`V8.EncryptHelper.DESDecode`。
 
+DES 只用于明确要求取回原文的兼容业务秘密；保存和显示都在可信后端完成，列表掩码、独立授权、`no-store` 且审计不含明文。登录密码不使用摘要或可逆加密的新设计，完整分级见 `v8-security/SKILL.md`。
+
 MD5/SHA1 仅为兼容摘要；任何摘要都不能直接作为新密码存储方案。AES/DES/HMAC
 密钥从受控配置读取，不硬编码、不写日志、不返回客户端。
 

package/dist/microi.skills/workspace-conventions/SKILL.md

@@ -163,6 +163,15 @@ AI 新增或修改 Microi 配置文件时，凡是面向开发者、部署人员
 - 除上述十项外，任何业务开关、重试、超时、限额、安全策略、密钥或可执行文件路径通常都必须进入 SaaS 引擎 `sys_osclients` 的合适 Tab，并提供幂等升级、默认值、缓存刷新、敏感字段脱敏和子租户隔离。官方 License 信任链是固定例外：恢复重试次数/间隔使用代码常量，签发私钥固定只读挂载 `/app/microi_private.pem`，不得建立对应 SaaS 字段。禁止新增 `MICROI_*`、`DOS_ORM_*`、额外 `AppSettings` 节点或通用动态环境变量读取。
 - `ASPNETCORE_*`、`DOTNET_*` 是框架宿主配置；`PW_*`、MCP、构建、安装器和发布脚本变量只服务各自工具进程。它们不能成为生产 API 的业务配置入口。
 - 修改后必须用源码测试扫描生产 `.cs`、API `appsettings.json` 及在线/离线 Compose，精确断言十项白名单。不能用注释约定代替自动化守卫。
+
+## 身份、可逆业务秘密与敏感操作统一规范（强制）
+
+- DiyToken 是吾码多租户、多终端、V8 和低代码权限体系的唯一会话入口。新增密码、SSO、OAuth、Passkey、人脸或其它登录方式时，验证成功后必须继续签发 DiyToken，并复用现有角色、部门、菜单、表权限、数据范围、终端吊销和 Token 轮换；禁止整体替换为 ASP.NET Identity 或并行建立第二套用户/权限 Token。
+- 登录密码的新存储必须使用后端带盐、可调成本的专用密码哈希。存量 `PwdEncode=DES` 的管理员显示密码只是兼容能力，不得扩展给普通 V8、FormEngine、匿名或访问密钥会话。
+- 业务明确要求再次显示原文的设备口令、第三方业务账号密码等字段，允许使用吾码可逆加密兼容机制。保存只在可信后端加密；列表/导出默认掩码；显示明文走独立授权动作，校验 DiyToken、租户和业务权限，返回 `no-store`，记录不含明文的审计，失焦/超时后清除。
+- DES 是现有兼容格式，不得宣称能抵抗服务器所有者或代码执行者。新高价值秘密优先使用带版本的现代认证加密与集中密钥管理；基础设施密钥仍不得进入可编辑 V8。
+- 登录后的敏感操作优先用 `V8.Identity.Verify` 申请 Passkey/严格人脸一次性票据，接口引擎从权威数据重算 `ActionHash` 后调用 `V8.Method.ConsumeIdentityVerificationTicket` 原子消费。票据不能代替菜单/表/行权限、状态机、幂等、事务或审计。
+- Windows Hello、Touch ID、Face ID 和 Android 设备验证优先采用 WebAuthn/Passkey，不增加模型服务；只有服务端严格人脸与活体检测才接入独立 `Microi Face Gateway v1` 云服务或 Docker/集群。完整规范读取 `microi.skills/v8-security/SKILL.md` 与 `microi.doc/docs/doc/more/identity-verification.md`。
 - 一键安装恢复客户旧库时只允许定位精确主租户三元组；缺失则幂等创建，重复则停止，不能批量重写其它子租户。新主租户行不得持久化数据库、MongoDB 或 Redis 连接，安装器对 MinIO/OCR 等业务配置的后续更新也必须带同一三元组、活动状态条件并做唯一回读。
 
 ## 多语言优先约定

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microi.net/cli",
-  "version": "4.7.2",
+  "version": "4.7.4",
   "description": "Microi吾码 AI 开发命令行：服务器连接、登录、AI/MCP 初始化与 V8 资源同步",
   "license": "MIT",
   "homepage": "https://microi.net/doc/v8-engine/vs-code-plugin.html",