@microi.net/cli 6.1.7 → 6.1.8

package/skills/microi.v8.js

@@ -569,12 +569,394 @@ function installDatePrototypeCompat() {
   }
 }
 
+// BEGIN GENERATED PUBLIC RESOURCE ROUTER; source SHA256 d90207991f19b46429dc21a654e2915e1b4fd6e96f191cede20485d823f3a975
+const createSdkPublicResourceClient = (() => {
+// 公有资源路由的纯校验器与实际消费者桥接；私有分支继续走既有授权接口。
+const HASH = /^[a-f0-9]{64}$/;
+const IDENTIFIER = /^[a-zA-Z0-9_-]{1,64}$/;
+const BLOCKED = /^(?:\.git|\.env|private|private-source|privatesource|source|_origin)$/i;
+
+function key(value) {
+  if (typeof value !== 'string' || !value || value.length > 1000 || /[\\%?#:\u0000-\u001f\u007f]/.test(value)
+      || value.split('/').some(part => !part || part === '.' || part === '..' || BLOCKED.test(part)) || /\.map$/i.test(value)) throw Error('InvalidPublicObjectKey');
+  encodeURIComponent(value); // Reject malformed UTF-16 rather than changing the key.
+  return value;
+}
+const encodeKey = value => value.split('/').map(encodeURIComponent).join('/');
+function plainBase(value, originOnly = false) {
+  if (typeof value !== 'string' || /[\\%?#@\u0000-\u0020\u007f]/.test(value)) throw Error('InvalidPublicBinding');
+  const parsed = new URL(value);
+  if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.search || parsed.hash
+      || (originOnly && parsed.pathname !== '/')) throw Error('InvalidPublicBinding');
+  return value.replace(/\/+$/, '');
+}
+function bindingSnapshot(binding) {
+  if (!binding || !IDENTIFIER.test(binding.tenant) || !IDENTIFIER.test(binding.storageOwnerTenant)
+      || !HASH.test(binding.targetConfigHash) || !/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(binding.publicBucket)
+      || binding.publicBucket.includes('..') || binding.publicBucket === binding.privateBucket) throw Error('InvalidPublicBinding');
+  const value = { tenant: binding.tenant, storageOwnerTenant: binding.storageOwnerTenant.toLowerCase(),
+    primaryBase: plainBase(binding.primaryBase), backupOrigin: plainBase(binding.backupOrigin, true),
+    publicBucket: binding.publicBucket, targetConfigHash: binding.targetConfigHash,
+    sourceMappings: (binding.sourceMappings || []).map(item => ({ origin: plainBase(item.origin, true),
+      pathPrefix: item.pathPrefix ? key(item.pathPrefix.replace(/\/+$/, '')) + '/' : '' })) };
+  if (!value.sourceMappings.length || value.sourceMappings.length > 20) throw Error('InvalidPublicBinding');
+  return { ...value, identity: JSON.stringify(value) };
+}
+function legacyPublicFallback(input, binding) {
+  if (!input || input.private === true || typeof input.path !== 'string') return '';
+  const path = input.path;
+  try {
+    if (/^https?:/i.test(path)) {
+      const url = new URL(path);
+      return !/[\\\u0000-\u0020\u007f]/.test(path) && !url.username && !url.password ? path : '';
+    }
+    if (path.startsWith('//') || path.startsWith('.')) return '';
+    if (/[\\\u0000-\u001f\u007f]/.test(path)) return '';
+    const relative = path.startsWith('/') ? path.slice(1) : path;
+    const decoratedAt = relative.search(/[?#]/);
+    const rawKey = decoratedAt < 0 ? relative : relative.slice(0, decoratedAt);
+    const suffix = decoratedAt < 0 ? '' : relative.slice(decoratedAt);
+    const objectKey = key(rawKey.split('/').map(part => decodeURIComponent(part)).join('/'));
+    return plainBase(binding?.primaryBase) + '/' + encodeKey(objectKey) + suffix;
+  } catch { return ''; }
+}
+function identify(input, binding) {
+  if (!input || input.private === true) return { input, accepted: false, reason: 'PrivateRoutingNotSupported', primaryUrl: '' };
+  const path = input.path;
+  try {
+    if (typeof path !== 'string' || !path) throw Error('InvalidInput');
+    if (/^https?:/i.test(path)) {
+      if (/[\\?#@\u0000-\u001f\u007f]/.test(path)) throw Error('SignedOrDecoratedUrlNotEligible');
+      const parsed = new URL(path);
+      const mapping = binding.sourceMappings.find(value => new URL(value.origin).origin === parsed.origin);
+      if (!mapping || parsed.protocol !== 'https:') throw Error('UnmanagedOrigin');
+      // Check raw path before URL() can normalize dot segments.
+      const begin = path.indexOf('/', path.indexOf('://') + 3);
+      if (begin < 0) throw Error('ObjectKeyMissing');
+      const objectKey = key(path.slice(begin + 1).split('/').map(part => {
+        const decoded = decodeURIComponent(part);
+        if (/[\/%\\?#:\u0000-\u001f\u007f]/.test(decoded)) throw Error('InvalidEncodedPath');
+        return decoded;
+      }).join('/'));
+      if (!objectKey.startsWith(mapping.pathPrefix)) throw Error('BucketPrefixMismatch');
+      return { accepted: true, objectKey: key(objectKey.slice(mapping.pathPrefix.length)), primaryUrl: path };
+    }
+    // Protocol-relative, traversal and double-slash paths are never interpreted
+    // as the configured public bucket. A single leading slash is legacy input.
+    if (path.startsWith('//') || path.startsWith('.')) throw Error('UnmanagedRelativePath');
+    const objectKey = key(path.startsWith('/') ? path.slice(1) : path);
+    return { accepted: true, objectKey, primaryUrl: binding.primaryBase + '/' + encodeKey(objectKey) };
+  } catch (error) { return { accepted: false, reason: error.message, primaryUrl: legacyPublicFallback(input, binding) }; }
+}
+function original(item, reason) {
+  return Object.freeze({ useBackup: false, url: item.primaryUrl, primaryUrl: item.primaryUrl,
+    objectKey: item.objectKey || null, reason });
+}
+function acceptedRoute(row, item, binding, time) {
+  if (!row || row.UseBackup !== true || row.ObjectKey !== item.objectKey || !HASH.test(row.SourceRevision)
+      || !HASH.test(row.ResourceId) || row.TargetConfigHash !== binding.targetConfigHash
+      || !Number.isSafeInteger(row.ExpiresAtUtc) || row.ExpiresAtUtc * 1000 <= time
+      || row.ExpiresAtUtc * 1000 > time + 300000 || typeof row.Url !== 'string' || /[?#@\\]/.test(row.Url)) return null;
+  const prefix = binding.backupOrigin + '/' + binding.publicBucket + '/_microi-hotspot/public/v3/'
+    + binding.storageOwnerTenant + '/' + row.ResourceId + '/' + row.SourceRevision + '/';
+  if (!row.Url.startsWith(prefix)) return null;
+  const rest = row.Url.slice(prefix.length), slash = rest.indexOf('/');
+  if (!/^[a-f0-9]{32}$/.test(rest.slice(0, slash)) || rest.slice(slash + 1) !== encodeKey(item.objectKey)) return null;
+  return Object.freeze({ useBackup: true, url: row.Url, primaryUrl: item.primaryUrl, objectKey: item.objectKey,
+    expiresAt: row.ExpiresAtUtc * 1000, reason: 'VerifiedPublicReplica' });
+}
+
+function createPublicResourceRouter({ getBinding, resolveBatch, now = Date.now, maxEntries = 512, timeoutMs = 5000 }) {
+  if (typeof getBinding !== 'function' || typeof resolveBatch !== 'function' || !Number.isInteger(maxEntries)
+      || maxEntries < 1 || maxEntries > 10000 || !Number.isInteger(timeoutMs)
+      || timeoutMs < 1 || timeoutMs > 30000) throw Error('InvalidRouterDependencies');
+  const cache = new Map(), pending = new Map(), cooldown = new Map();
+  const cacheKey = (binding, item) => binding.identity + '\n' + item.objectKey;
+  const put = (map, id, value) => { map.delete(id); map.set(id, value); while (map.size > maxEntries) map.delete(map.keys().next().value); };
+  function cached(binding, item) {
+    const id = cacheKey(binding, item), time = now();
+    if ((cooldown.get(id) || 0) > time) return original(item, 'BackupFailureCooldown');
+    const hit = cache.get(id);
+    if (hit && hit.until > time) return hit.route.useBackup ? Object.freeze({ ...hit.route, primaryUrl: item.primaryUrl }) : original(item, hit.route.reason);
+    cache.delete(id); cooldown.delete(id); return null;
+  }
+  function snapshot() { return bindingSnapshot(getBinding()); }
+  function fallback(input) { try { return legacyPublicFallback(input, getBinding()); } catch { return legacyPublicFallback(input, null); } }
+
+  async function resolveMany(inputs) {
+    if (!Array.isArray(inputs) || inputs.length > 100) throw Error('ResourceBatchLimitExceeded');
+    let binding;
+    try { binding = snapshot(); }
+    catch { return inputs.map(item => original({ primaryUrl: fallback(item) }, 'BackupBindingUnavailable')); }
+    const work = [], created = [];
+    const tasks = inputs.map(input => {
+      const item = identify(input, binding);
+      if (!item.accepted) return Promise.resolve(original(item, item.reason));
+      const known = cached(binding, item); if (known) return Promise.resolve(known);
+      const id = cacheKey(binding, item);
+      if (pending.has(id)) return pending.get(id).then(route => Object.freeze({ ...route, primaryUrl: item.primaryUrl,
+        url: route.useBackup ? route.url : item.primaryUrl }));
+      let done; const promise = new Promise(resolve => { done = resolve; });
+      pending.set(id, promise); work.push(item); created.push({ item, id, done, promise }); return promise;
+    });
+    if (work.length) {
+      // Do not pass secrets, arbitrary URLs or a caller-selected storage endpoint.
+      const controller = new AbortController(); let timer;
+      Promise.race([
+        Promise.resolve().then(() => resolveBatch({ ObjectKeys: work.map(item => item.objectKey), OsClient: binding.tenant }, { signal: controller.signal })),
+        new Promise((_, reject) => { timer = setTimeout(() => reject(Error('ResolverTimeout')), timeoutMs); })
+      ])
+        .then(response => {
+          let current; try { current = snapshot(); } catch { current = null; }
+          const data = response?.Code === 1 ? response.Data : null;
+          const valid = current?.identity === binding.identity && data?.Protocol === 'GenericPublicResourceRoutes/1'
+            && data.TargetConfigHash === binding.targetConfigHash && Array.isArray(data.Routes) && data.Routes.length <= 100;
+          const rows = new Map(), duplicates = new Set();
+          if (valid) for (const row of data.Routes) {
+            if (rows.has(row?.ObjectKey)) duplicates.add(row.ObjectKey);
+            rows.set(row?.ObjectKey, row);
+          }
+          for (const job of created) {
+            const time = now();
+            const route = valid && !duplicates.has(job.item.objectKey)
+              ? acceptedRoute(rows.get(job.item.objectKey), job.item, binding, time) : null;
+            const selected = (cooldown.get(job.id) || 0) > time ? original(job.item, 'BackupFailureCooldown')
+              : route || original(job.item, current?.identity !== binding.identity ? 'TenantOrBindingChanged' : 'VerifiedRouteUnavailable');
+            put(cache, job.id, { route: selected, until: selected.useBackup ? selected.expiresAt : time + 15000 });
+            job.done(selected);
+          }
+        })
+        .catch(() => {
+          for (const job of created) { const route = original(job.item, 'ResolverUnavailable');
+            put(cache, job.id, { route, until: now() + 15000 }); job.done(route); }
+        })
+        .finally(() => { clearTimeout(timer); controller.abort();
+          for (const job of created) if (pending.get(job.id) === job.promise) pending.delete(job.id); });
+    }
+    return Promise.all(tasks);
+  }
+  return Object.freeze({
+    resolveMany,
+    async resolve(input) { return (await resolveMany([input]))[0]; },
+    // Sync compatibility is cache-only. Callers must pre-resolve before assigning
+    // src/href if their FIRST request must avoid the original CDN/OSS endpoint.
+    peek(input) {
+      try { const binding = snapshot(), item = identify(input, binding);
+        return item.accepted ? cached(binding, item) || original(item, 'NotResolvedYet') : original(item, item.reason); }
+      catch { return original({ primaryUrl: fallback(input) }, 'BackupBindingUnavailable'); }
+    },
+    reportFailure(input) {
+      try { const binding = snapshot(), item = identify(input, binding);
+        if (!item.accepted) return original(item, item.reason);
+        const id = cacheKey(binding, item); cache.delete(id); put(cooldown, id, now() + 30000);
+        return original(item, 'BackupFailureCooldown'); }
+      catch { return original({ primaryUrl: fallback(input) }, 'BackupBindingUnavailable'); }
+    },
+    clear() { cache.clear(); cooldown.clear(); }
+  });
+}
+
+/**
+ * DiyCommon 与真实批量解析器的桥接。配置只从当前租户的原生 Binding 回读，
+ * 不将 SaaS 私桶名/凭据塞入前端。首次 src 赋值必须等待 resolve。
+ */
+function createExactAliasRouter({ getBinding, post, now }) {
+  const cache = new Map(), pending = new Map(), cooldown = new Map(); let queue = [], scheduled = false;
+  const put = (map, id, value) => { map.delete(id); map.set(id, value); while (map.size > 512) map.delete(map.keys().next().value); };
+  function pick(input) {
+    try {
+      const raw = getBinding(), b = bindingSnapshot(raw);
+      if (input?.private !== false || raw.aliasUrlRoutingProtocol !== 'PublicSourceUrlRoutes/1'
+          || typeof input.path !== 'string' || !input.path.startsWith('https://') || /[\\?#@\u0000-\u0020\u007f]/.test(input.path)) return null;
+      const origin = new URL(input.path).origin;
+      if (!raw.aliasCandidates.includes(origin)) return null;
+      // Only parse the exact key here. Candidate membership is not authorization:
+      // the server must revalidate this complete SourceUrl before returning NAS.
+      const item = identify(input, { ...b, sourceMappings: [{ origin, pathPrefix: '' }] });
+      return item.accepted ? { ...item, input, origin, binding: b, id: b.identity + '\nURL:' + input.path } : null;
+    } catch { return null; }
+  }
+  async function flush() {
+    scheduled = false; const jobs = queue; queue = [];
+    while (jobs.length) {
+      const origins = new Set(), batch = [];
+      const identity = jobs[0].item.binding.identity;
+      for (let index = 0; index < jobs.length && batch.length < 100;) {
+        const job = jobs[index];
+        if (job.item.binding.identity !== identity) { index++; continue; }
+        if (!origins.has(job.item.origin) && origins.size === 2) { index++; continue; }
+        origins.add(job.item.origin); batch.push(...jobs.splice(index, 1));
+      }
+      let response, timer;
+      try { response = await Promise.race([post({ PublicUrls: batch.map(x => x.item.input.path), OsClient: batch[0].item.binding.tenant }),
+        new Promise((_, reject) => { timer = setTimeout(() => reject(Error('AliasResolverTimeout')), 5000); })]); }
+      catch { response = null; }
+      finally { clearTimeout(timer); }
+      for (const job of batch) {
+        const item = job.item, current = pick(item.input), time = now(), data = response?.Code === 1 ? response.Data : null;
+        const rows = data?.Protocol === 'PublicSourceUrlRoutes/1' && data.TargetConfigHash === item.binding.targetConfigHash
+          && Array.isArray(data.Routes) && data.Routes.length <= 100
+          ? data.Routes.filter(x => x && typeof x === 'object' && !Array.isArray(x) && x.SourceUrl === item.input.path) : [];
+        const row = rows.length === 1 ? rows[0] : null;
+        const accepted = current?.id === item.id && row?.SourceOrigin === item.origin && HASH.test(row.SourceRoutingFingerprint)
+          && row.ExpiresAtUtc * 1000 <= time + 60000 ? acceptedRoute(row, item, item.binding, time) : null;
+        const route = (cooldown.get(item.id) || 0) > time ? original(item, 'BackupFailureCooldown')
+          : accepted || original(item, 'VerifiedAliasRouteUnavailable');
+        put(cache, item.id, { route, until: route.useBackup ? route.expiresAt : time + 15000 });
+        pending.delete(item.id); job.done(route);
+      }
+    }
+  }
+  return {
+    eligible: input => !!pick(input),
+    async resolve(input) {
+      const item = pick(input); if (!item) return null;
+      if ((cooldown.get(item.id) || 0) > now()) return original(item, 'BackupFailureCooldown');
+      const old = cache.get(item.id); if (old && old.until > now()) return old.route;
+      if (pending.has(item.id)) return pending.get(item.id);
+      let done; const result = new Promise(resolve => { done = resolve; }); pending.set(item.id, result);
+      queue.push({ item, done }); if (!scheduled) { scheduled = true; queueMicrotask(flush); } return result;
+    },
+    reportFailure(input) { const item = pick(input); if (!item) return null;
+      cache.delete(item.id); put(cooldown, item.id, now() + 30000); return original(item, 'BackupFailureCooldown'); },
+    clear() { cache.clear(); cooldown.clear(); }
+  };
+}
+
+function createPublicResourceClient({ getContext, post, now = Date.now, fetchHead = globalThis.fetch }) {
+  let active = '', binding = null, bootstrap = null, expires = 0, generation = 0;
+  let queue = [], scheduled = false;
+  const context = () => {
+    const value = getContext() || {};
+    return { tenant: value.tenant, primaryBase: value.primaryBase?.replace(/\/+$/, ''),
+      backupOrigin: value.backupOrigin?.replace(/\/+$/, '') };
+  };
+  const signature = value => JSON.stringify(value);
+  const router = createPublicResourceRouter({ getBinding: () => binding || context(), resolveBatch: data => post(data), now });
+  const aliases = createExactAliasRouter({ getBinding: () => binding, post, now });
+  const fallback = input => Object.freeze({ useBackup: false,
+    url: legacyPublicFallback(input, context()), primaryUrl: legacyPublicFallback(input, context()), reason: 'BindingUnavailable' });
+  async function ensureBinding() {
+    const current = context(), id = signature(current);
+    if (active !== id) { active = id; binding = null; bootstrap = null; expires = 0; generation++; router.clear(); aliases.clear(); }
+    if (binding && expires > now()) return true;
+    if (!binding && expires > now()) return false;
+    if (bootstrap) return bootstrap;
+    if (!current.backupOrigin || !IDENTIFIER.test(current.tenant || '')) return false;
+    const revision = generation;
+    const run = (async () => {
+      let timer;
+      try {
+        const response = await Promise.race([post({ ObjectKeys: [], OsClient: current.tenant }),
+          new Promise((_, reject) => { timer = setTimeout(() => reject(Error('BindingTimeout')), 5000); })]);
+        const data = response?.Data, source = data?.Binding;
+        if (generation !== revision || signature(context()) !== id || response?.Code !== 1 || data?.Protocol !== 'GenericPublicResourceRoutes/1' || !source
+            || source.PrimaryBase?.replace(/\/+$/, '') !== current.primaryBase
+            || source.BackupOrigin?.replace(/\/+$/, '') !== current.backupOrigin
+            || source.TargetConfigHash !== data.TargetConfigHash) return false;
+        const candidate = { tenant: current.tenant, storageOwnerTenant: source.StorageOwnerTenant,
+          primaryBase: source.PrimaryBase, backupOrigin: source.BackupOrigin, publicBucket: source.PublicBucket,
+          privateBucket: '', targetConfigHash: source.TargetConfigHash,
+          aliasUrlRoutingProtocol: source.AliasUrlRoutingProtocol,
+          aliasCandidates: source.AliasUrlRoutingProtocol === 'PublicSourceUrlRoutes/1'
+            ? (source.AliasCandidates || []).map(row => plainBase(row.Origin, true)) : [],
+          sourceMappings: (source.SourceMappings || []).map(row => ({ origin: row.Origin, pathPrefix: row.PathPrefix || '' })) };
+        if (candidate.aliasCandidates.length > 50 || new Set(candidate.aliasCandidates).size !== candidate.aliasCandidates.length) return false;
+        bindingSnapshot(candidate);
+        binding = candidate; expires = now() + 60000; return true;
+      } catch { return false; }
+      finally { clearTimeout(timer); }
+    })();
+    bootstrap = run;
+    try { const ready = await run;
+      if (!ready && revision === generation && signature(context()) === id) { binding = null; expires = now() + 15000; }
+      return ready;
+    } finally { if (bootstrap === run) bootstrap = null; }
+  }
+  async function flush() {
+    scheduled = false; const jobs = queue; queue = [];
+    for (let start = 0; start < jobs.length; start += 100) {
+      const slice = jobs.slice(start, start + 100);
+      try { const routes = await router.resolveMany(slice.map(job => job.input));
+        slice.forEach((job, index) => job.done(signature(context()) === job.context ? routes[index] : fallback(job.input))); }
+      catch { slice.forEach(job => job.done(fallback(job.input))); }
+    }
+  }
+  async function resolve(input) {
+    // 只有明确公有输入才触发任何匿名解析；旧 Limit 缺失由调用者保持原兼容分支。
+    if (!input || input.private !== false) return Object.freeze({ useBackup: false, url: '', primaryUrl: '', reason: 'ExplicitPublicRequired' });
+    const id = signature(context());
+    if (!await ensureBinding() || id !== signature(context())) return fallback(input);
+    if (aliases.eligible(input)) {
+      const revision = generation, route = await aliases.resolve(input);
+      return revision === generation && id === signature(context()) ? route || fallback(input) : fallback(input);
+    }
+    return await new Promise(done => { queue.push({ input, done, context: id });
+      if (!scheduled) { scheduled = true; queueMicrotask(flush); } });
+  }
+  const reportFailure = input => input?.private === false ? aliases.reportFailure(input) || router.reportFailure(input) : fallback({ private: true });
+  return Object.freeze({ resolve,
+    resolveMany(inputs) { return Promise.all(inputs.map(resolve)); },
+    reportFailure,
+    async resolveForNavigation(input) {
+      const id = signature(context()), route = await resolve(input);
+      if (id !== signature(context())) return fallback(input);
+      if (!route.useBackup) return route;
+      const revision = generation;
+      if (!(route.expiresAt > now())) return fallback(input);
+      // 新窗口无法监听跨域导航失败。打开前只做一次有界 HEAD，失败回原地址，不循环重试。
+      const controller = new AbortController(), timer = setTimeout(() => controller.abort(), 3000);
+      try {
+        const response = await fetchHead(route.url, { method: 'HEAD', credentials: 'omit', redirect: 'error', signal: controller.signal });
+        if (id !== signature(context()) || revision !== generation || !(route.expiresAt > now())) return fallback(input);
+        return response.ok ? route : reportFailure(input);
+      } catch { return reportFailure(input); }
+      finally { clearTimeout(timer); }
+    },
+    clear() { generation++; binding = null; bootstrap = null; expires = 0; router.clear(); aliases.clear(); }
+  });
+}
+
+// 历史 Limit 缺失不是公开声明，不能据此新增匿名 NAS 访问。
+function isExplicitPublicResource(metadata, configuredLimit) {
+  return metadata && typeof metadata === 'object' && Object.hasOwn(metadata, 'Limit')
+    ? metadata.Limit === false : configuredLimit === false;
+}
+
+/** 表单实例、租户、记录、字段及文件身份共同限定异步地址赋值。 */
+function createPublicResourceAssignmentGuard({ getContext, contains }) {
+  const pending = new Map(); let disposed = false;
+  const current = ticket => {
+    if (disposed || pending.get(ticket.key) !== ticket) return false;
+    const context = getContext();
+    return Object.keys(ticket.context).every(name => context[name] === ticket.context[name])
+      && contains(ticket.path, ticket.fileId);
+  };
+  return Object.freeze({
+    begin(key, path, fileId = null) {
+      const ticket = { key, path, fileId, context: { ...getContext() }, route: null, fallbackUsed: false };
+      pending.set(key, ticket); return ticket;
+    },
+    current,
+    get(key) { return pending.get(key); },
+    tickets() { return [...pending.values()]; },
+    invalidate(key) { pending.delete(key); },
+    clear() { pending.clear(); },
+    dispose() { disposed = true; pending.clear(); }
+  });
+}
+
+return createPublicResourceClient;
+})();
+// END GENERATED PUBLIC RESOURCE ROUTER
+
 export function createMicroiV8(options = {}) {
   // 运行时配置可通过 createMicroiV8(options) 或 client.configure(next) 覆盖。
   let config = {
     apiBase: '',
     webBase: '',
     fileServer: '',
+    fileServerBak: '',
     osClient: '',
     token: '',
     clientType: getUni() ? 'Mobile' : 'PC',
@@ -606,6 +988,9 @@ export function createMicroiV8(options = {}) {
 
   // 更新配置后立即刷新并发队列，保证 maxConcurrent 热更新生效。
   function configure(next = {}) {
+    if (['apiBase','osClient','fileServer','fileServerBak'].some(key => Object.prototype.hasOwnProperty.call(next,key) && next[key] !== config[key])) {
+      sdkPublicResourceEpoch++; sdkPublicResourceClient?.clear();
+    }
     config = { ...config, ...next };
     if (Object.prototype.hasOwnProperty.call(next, 'maxConcurrent')) {
       runQueued = createQueue(config.maxConcurrent);
@@ -961,6 +1346,63 @@ export function createMicroiV8(options = {}) {
   }
 
   // 资源地址统一过滤占位图，并兼容 HDFS 私有文件、FileServer 和绝对地址。
+  // Public media selection is asynchronous. assetUrl remains a synchronous legacy API.
+  let sdkPublicResourceClient = null;
+  let sdkPublicResourceEpoch = 0;
+  function sdkPublicMetadata(value, path, depth = 0) {
+    if (depth > 8 || value == null) return null;
+    if (typeof value === 'string' && /^[\[{]/.test(value.trim())) {
+      try { return sdkPublicMetadata(JSON.parse(value), path, depth + 1); } catch { return null; }
+    }
+    if (Array.isArray(value)) {
+      for (const entry of value) { const selected = sdkPublicMetadata(entry, path, depth + 1); if (selected) return selected; }
+      return null;
+    }
+    return typeof value === 'object' && extractUploadPath(value) === path ? value : null;
+  }
+  function sdkPublicInputAllowed(value, options = {}) {
+    const path = extractUploadPath(value), meta = sdkPublicMetadata(value, path);
+    if (options.private === true || (meta && (
+      (Object.prototype.hasOwnProperty.call(meta, 'Limit') && meta.Limit !== false)
+      || meta.Private === true || meta.IsPrivate === true || meta.Public === false))) return false;
+    return options.private === false || meta?.Limit === false || meta?.Public === true;
+  }
+  function sdkPublicContext() {
+    return { tenant: config.osClient, primaryBase: config.fileServer || '',
+      backupOrigin: config.fileServerBak || client.SysConfig?.FileServerBak || '' };
+  }
+  function sdkPublicIdentity() {
+    return JSON.stringify([sdkPublicResourceEpoch, config.apiBase, sdkPublicContext()]);
+  }
+  function getSdkPublicResourceClient() {
+    if (!sdkPublicResourceClient) sdkPublicResourceClient = createSdkPublicResourceClient({
+      getContext: sdkPublicContext,
+      post: data => apiEngineRun('mci-file-resource-public-url', data, { checkCode: false, silentError: true, timeout: 5000 })
+    });
+    return sdkPublicResourceClient;
+  }
+  async function resolvePublicResource(value, options = {}) {
+    const path = extractUploadPath(value);
+    if (!path || isBlockedAsset(path) || !sdkPublicInputAllowed(value, options))
+      return { useBackup: false, url: '', primaryUrl: '', reason: 'ExplicitPublicRequired' };
+    // Local files and API-owned protected/runtime endpoints keep their existing transport.
+    if (/^(?:data:|blob:|file:|\.?\/static\/)/i.test(path) || /^\/?(?:file\/|micro-app\/v3(?:\/|$))/i.test(path))
+      return { useBackup: false, url: assetUrl(value), primaryUrl: assetUrl(value), reason: 'LocalOrApiResource' };
+    const identity = sdkPublicIdentity(), publicClient = getSdkPublicResourceClient();
+    const route = options.navigation === true
+      ? await publicClient.resolveForNavigation({ path, private: false })
+      : await publicClient.resolve({ path, private: false });
+    // The portable SDK also binds the API base, which is not a public storage binding field.
+    return identity === sdkPublicIdentity() ? route
+      : { useBackup: false, url: '', primaryUrl: '', reason: 'ClientContextChanged' };
+  }
+  function reportPublicResourceFailure(value, options = {}) {
+    if (!sdkPublicInputAllowed(value, options)) return { useBackup: false, url: '', primaryUrl: '', reason: 'ExplicitPublicRequired' };
+    const path = extractUploadPath(value);
+    return sdkPublicResourceClient?.reportFailure({ path, private: false })
+      || { useBackup: false, url: assetUrl(value), primaryUrl: assetUrl(value), reason: 'PrimaryFallback' };
+  }
+
   function assetUrl(value) {
     const picked = extractUploadPath(value);
     if (!picked || isBlockedAsset(picked)) return '';
@@ -999,6 +1441,7 @@ export function createMicroiV8(options = {}) {
   async function resolveFileUrl(filePathName, options = {}) {
     const path = extractUploadPath(filePathName);
     if (!path || isBlockedAsset(path)) return '';
+    if (sdkPublicInputAllowed(filePathName, options)) return (await resolvePublicResource(filePathName, options)).url;
     if (/^(https?:|blob:|data:|file:)/i.test(path)) return assetUrl(path);
     // 文件实际私有标记和私有字段上下文优先，禁止因字段曾改为公有而错误降级 CDN。
     const privateAccess = options.private === true || hasPrivateUploadFlag(filePathName);
@@ -1534,6 +1977,8 @@ export function createMicroiV8(options = {}) {
     setCurrentUser: setUser,
     getCurrentUser: getUser,
     assetUrl,
+    resolvePublicResource,
+    reportPublicResourceFailure,
     sanitizeAssetUrl: assetUrl,
     resolveAssetUrl: assetUrl,
     resolveAvatarUrl: resolveFileUrl,

package/skills/scripts/sync-public-resource-router.mjs

@@ -0,0 +1,29 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+
+// Single-file SDKs retain their delivery contract; only this generated router block is synchronized.
+const args = process.argv.slice(2), write = args.includes('--write');
+function option(name, fallback) { const at = args.indexOf(name); return at < 0 ? fallback : args[at + 1] || (() => { throw Error('Missing ' + name); })(); }
+const root = path.resolve(option('--root', path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..')));
+const routerPath = path.resolve(option('--router', path.join(root, 'Microi.Client/src/utils/public-resource-router.mjs')));
+const bytes = fs.readFileSync(routerPath), router = bytes.toString('utf8');
+if (/^import\s/m.test(router) || /^export (?!function )/m.test(router)) throw Error('RouterModuleShapeChanged');
+const sha = crypto.createHash('sha256').update(bytes).digest('hex');
+const generated = '// BEGIN GENERATED PUBLIC RESOURCE ROUTER; source SHA256 ' + sha + '\n'
+  + 'const createSdkPublicResourceClient = (() => {\n' + router.replace(/^export function /gm, 'function ')
+  + '\nreturn createPublicResourceClient;\n})();\n// END GENERATED PUBLIC RESOURCE ROUTER';
+const marker = /\/\/ BEGIN GENERATED PUBLIC RESOURCE ROUTER; source SHA256 [a-f0-9]{64}\r?\n[\s\S]*?\/\/ END GENERATED PUBLIC RESOURCE ROUTER/g;
+const paths = ['microi.skills/microi.v8.js', 'microi.uniapp/src/utils/microi.v8.js', 'Microi.Server/OfficialApplications/PlatformService/src/utils/microi.v8.js'];
+const pending = paths.map(relative => {
+  const full = path.join(root, relative), text = fs.readFileSync(full, 'utf8');
+  const blocks = [...text.matchAll(marker)]; if (blocks.length !== 1) throw Error('ExpectedSingleRouterBlock:' + relative);
+  const nl = text.includes('\r\n') ? '\r\n' : '\n';
+  const block = generated.replace(/\r?\n/g, nl);
+  return { path: relative, full, text, next: text.replace(marker, () => block) };
+});
+const changed = pending.filter(item => item.text !== item.next);
+if (!write && changed.length) throw Error('SdkRouterOutOfDate:' + changed.map(item => item.path).join(','));
+if (write) for (const item of changed) fs.writeFileSync(item.full, item.next);
+console.log(JSON.stringify({ mode: write ? 'write' : 'check', routerSha256: sha, sdkCount: paths.length, changed: changed.map(item => item.path) }));

package/skills/system-observability/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: system-observability
-description: Microi 系统日志/监控查询、诊断与治理规范。用于分析系统日志、Trace、热点接口、CPU/内存吃满、OOM、异常分配、接口引擎/V8 事件归因、重启事故恢复、网络流量、安全事件和监控性能成本。
+description: Microi 系统日志/监控查询、诊断与治理规范。用于日志、Trace、CPU/内存/OOM、网络流量、安全事件，以及 OSS/CDN 高下载文件归因、NAS 热点分流与完整日费用验收。
 ---
 
 > **Microi吾码基础规范（强制）：** 任何 AI 模型与宿主每次新建或接续吾码任务，先完整读取 `../workspace-conventions/SKILL.md`，必须执行版本播报、`@microi.net/cli` 后台自动升级、Skills/MCP 同步和进度播报。安装与诊断读取 `../microi-codex-installer/SKILL.md`；更新失败延后重试，不阻断当前工作。
@@ -201,6 +201,12 @@ UnblockIp:<ip>
 
 ## 接口引擎归因规范
 
+OSS/CDN 高费用、文件下载榜单和 NAS 分流还须读取
+[文件资源分流操作流程](../v8-file-upload/references/hotspot-offload-operations.md)。
+通过受管 `mci-cdn-manager` 核对流量来源及账单，通过 `mci-file-resource-runtime`
+检查资格、复制及实际路由；完整自然日、当天部分账单和一次性复制成本分开记录。
+已有通用 `microi_run_engine` 复用当前租户鉴权，不另建云凭据或旁路 HTTP 工具。
+
 - PC、UniApp、内置微服务、MCP 和应用包中的固定接口必须调用 `/apiengine/{ApiEngineKey}` 或该引擎唯一 `ApiAddress`；新增代码禁止调用 `/api/ApiEngine/Run`。
 - SDK 的普通 `ApiEngine.Run` 必须自动生成真实引擎路径；旧通用入口只能封装在显式 `RunLegacy` 中，供不能立即升级的历史客户端使用。
 - 监控中保留通用入口的兼容识别，但不能依赖读取请求正文才能知道 Key；真实路由、访问日志、限流和流量排行应直接显示接口引擎 Key。
@@ -231,8 +237,16 @@ UnblockIp:<ip>
 
 ### CDN 模块
 
+- 官方 Chromium 分流仅限 `static.itdos.com/openclaw/chromium/` 的 137.0.7151.68 三平台精确 ZIP。先核三份真实 native Ready/raw SHA/大小/SourceRevision/TargetConfigHash 与独立公有回退，再以 `ChromiumRedirectState` 和逐平台 `Preview → Submit` 安装；各平台保留原 RequestKey/Id/ConfigId/RequestId。Unknown 只回读，回滚必须使用本平台原成功操作 Id，禁止同形认领或全域改写。外部云控制台写者不受域租约约束；真实旧 URL 两跳、NAS HEAD/Range 和完整日账单分别验收。
+- 七种官方空库的 `mci-file-resource-empty-database-download` 只映射固定 Database 枚举和公开 `install/microi_empty_*.sql.zip`，当前可信原生副本可用才返回 NAS 与完整性 Header，否则回官方 CDN。它不复制、不签私链、不接收任意 URL。MCP 复用 run/save/官方包发布工具，不新增通用代理。
+
+- 回源路径只读诊断使用管理员入口 `mci-cdn-manager` 的固定 `OriginRouting` 动作，仅传 `Provider:aliyun` 与一个精确 `Domain`；先确认 `Capabilities.Providers` 内阿里云 `Features.OriginRouting=true`。旧 `Configs` 五项不变，禁止开放云 Action、FunctionNames、Endpoint、凭据或分页任意覆盖。
+- `ConfigurationReadComplete` 只表示固定配置集合读取完整；缺失、云失败、分页/截断或超限不能解释成零规则。保留规则 `ConfigId/ParentId/Status/Index/sequence`。条件、源站组、EdgeScript/EdgeRoutine 与未知参数作为待审证据，绝不回传脚本、敏感 Header/查询值或原始 IP。
+- 同一 OSS 源不代表同对象路径；`EffectiveObjectMappingVerified/AutomaticAliasRoutingAuthorized` 固定为 false。必须另验 Host、路径、条件关联、当前公开权限及内容身份后才可能配置别名；本动作不复制、不公开、不分流。三条 Managed 引擎经系统日志应用包交付，通用 MCP 已可调用，不为诊断另发 C#、npm 或后端镜像。
+
+
 - 现有 `microi-platform-service` 的系统日志页增加 CDN Tab；不另建同名应用。固定管理员入口为 `mci-cdn-manager`，内部 `mci-cdn-core / mci-cdn-aliyun / mci-cdn-worker` 均 `StopHttp=1`，四个引擎归 `app.microi.sys-log` 的 Managed 资源。
-- 通过当前租户 MCP 的 `microi_run_engine` 先查 `Capabilities`，再使用 `Domains / Trend / Usage / CacheHit / OriginTraffic / Billing / StorageHealth / StorageLogs / Logs / LogDelivery / ReportList / Reports / Sls / Configs / Config / Rules / Operations`。现有执行、源码、元数据及发布工具已覆盖此模块，不为 CDN 新增旁路鉴权或通用 HTTP 代理。
+- 通过当前租户 MCP 的 `microi_run_engine` 先查 `Capabilities`，再使用 `OriginRouting / Domains / Trend / Usage / CacheHit / OriginTraffic / Billing / StorageHealth / StorageLogs / Logs / LogDelivery / ReportList / Reports / Sls / Configs / Config / Rules / Operations`。现有执行、源码、元数据及发布工具已覆盖此模块，不为 CDN 新增旁路鉴权或通用 HTTP 代理。
 - 凭据优先级为当前租户 `Integration.Cdn.Aliyun.*` 完整私密组 → `Integration.Dns.Aliyun.*` 私密组 → 当前租户 SaaS 的兼容 DNS 字段。半组配置必须失败，不能混组或回退主租户。新增密钥写 `mci_system_setting` Secret，由可信后端解密到后端 `ServerPrivateSettings`；不返回原文。
 - 用量与金额分开：`Trend` 带宽点不能按小时积分冒充流量；`Usage(Field=traf)` 的字节量才用于流量合计，金额读取 `Billing`，禁止统一乘固定单价标为实际费用。`Usage` 接受 `UsageType`（不是平台保留参数 `Type`）、`DataProtocol`、`Field`、`Area`；流量/带宽只允许 all 类型与协议，请求数只允许 all 地区。UTC 起止时间与实际 `DataInterval` 必须保留；300/3600/86400 秒的 Usage 单次跨度分别不超过3/7/31天。`CacheHit/OriginTraffic` 同粒度跨度为3/31/366天，不传 Area，单位分别为百分比/字节。
 - `Billing.Kind` 固定为 `Overview/Instance/Packages/PackageUsage`，返回 `Data.Result`。先用 `BillingCycle=YYYY-MM` 概览发现产品代码，再按 `ProductCode` 查 `Instance` 的 MONTHLY/DAILY 计费项；DAILY 的 BillingDate 必须属于账期。MaxResults不超过300，完整消费NextToken；Packages用Page/PageSize，PackageUsage绑定InstanceId、以中国站账单时间格式原样查询并将NextToken映射LastToken。应付PretaxAmount、原价PretaxGrossAmount、实付PaymentAmount和资源包抵扣不混用；当前包列表不证明历史抵扣，当月暂计、数据延迟、权限失败不伪造为零。
@@ -269,3 +283,5 @@ UnblockIp:<ip>
 - 对请求热路径做开关前后压测，确认观测开启后 P95/P99、CPU、内存和分配率没有不可接受回退；故障 Mongo 不得阻塞业务请求。
 - 多节点、网卡重置/回绕、服务重启、匿名/登录、大上传/下载、敏感字段脱敏、时间桶幂等和缓存失效均有验证证据。
 - 内存专项至少覆盖：V8 限制关闭的复杂执行、真实 Kestrel TraceId、500 个活动请求、异步嵌套归属、独立采集栈、Mongo 故障、执行中强杀、改名重启、跨节点补传、旧快照重放和租户隔离。
+
+- 原生签名状态必须先对原始 UTF-8 JSON 字节验 HMAC，再以保留小数精度及字符串日期的设置解析；禁止先解析重序列化后验签，否则 SaaS decimal 阈值 1.000000 变为 1.0 会使后台泵停摆。修复读取器时保留既有回执，不手工改写状态或 Ready。

package/skills/v8-file-upload/SKILL.md

@@ -1,12 +1,21 @@
 ---
 name: v8-file-upload
-description: Microi V8 与 MCP 文件上传下载指南。用于处理流式 AI 应用发布、V8.FilesByteBase64、V8.Method.Upload、私有文件 URL、文件响应、HDFS、OSS、MinIO 和 S3 存储。
+description: Microi V8 与 MCP 文件上传下载指南。用于流式发布、私有文件、HDFS/OSS/MinIO/S3，以及 OSS/CDN 费用治理、FileServerBak 热点自动复制与持续 NAS 分流、实际消费验收。
 ---
 
 > **Microi吾码基础规范（强制）：** 任何 AI 模型与宿主每次新建或接续吾码任务，先完整读取 `../workspace-conventions/SKILL.md`，必须执行版本播报、`@microi.net/cli` 后台自动升级、Skills/MCP 同步和进度播报。安装与诊断读取 `../microi-codex-installer/SKILL.md`；更新失败延后重试，不阻断当前工作。
 
 # Microi V8 文件上传下载
 
+## OSS / CDN 费用与 NAS 分流入口
+
+用户要求降低 OSS/CDN 流量费用、把高下载模型/JS/图片/视频转到 NAS，或询问
+“1 GiB / 24 小时配置在哪里”时，使用已有热点分流能力。先读
+[热点分流操作流程](references/hotspot-offload-operations.md)，再核对本文的原生权限和依赖边界。
+系统设置 `/system-config` 的 `FileServerBakThresholdGiB`、`FileServerBakWindowHours`
+控制初次资格；`FileServerBak` 是备用 HTTPS origin。可信达标后低流量不撤回 NAS 偏好。
+只复制、保存配置或发布页面都不等于实际入口已走 NAS，也不等于完整日费用已下降。
+
 ## 源码仓库资源隔离（默认强制）
 
 截图、配图、PDF/PPT、音视频、压缩包、模型、安装包和其它大体积交付资源统一通过 MCP 上传 CDN，禁止提交到 Gitee/GitHub 源码历史，即使压缩到小于 1 MB 也不能把截图或附件改放源码仓库。官方资源使用已校验的 `microi_itdos`（`https://api.microi.net + OsClient=iTdos`）公有桶与 `https://file.microi.net` 前缀；私有资料按租户实际权限保持私有。源码只存 URL、字节数、SHA-256、MIME 等轻量清单。上传后独立回读实际字节和类型，PDF 验证 Range；超过 Base64 协议容量使用流式/分片工具。暂存区及每个待推送提交都须排除资源本体，详细门禁遵循 [工作区默认 CDN 规范](../workspace-conventions/SKILL.md#截图与大体积资源必须走-cdn默认强制)。
@@ -21,12 +30,9 @@ description: Microi V8 与 MCP 文件上传下载指南。用于处理流式 AI
 
 ## MCP stdio 与完整包的传输边界
 
-- 标准 MCP 服务的 stdio 使用固定 `128 MiB`（`134217728` 字节）未解析 JSON-RPC 缓冲，超过边界立即拒绝并关闭连接；不读取动态环境变量放大。SDK 调用端若仍使用
-  默认 `10 MiB` 缓冲，大响应仍可能关闭客户端，必须核对调用端支持的真实边界。
-- 该限制计算 UTF-8 wire 字节，包含完整 JSON 信封、Base64 和重复 `Data/Result` 正文。单个 Base64 字段的理论原始字节上限约 `96 MiB` 减信封，不能据此保证
-  任意 `64 MiB` 包响应都通过，也不能把它当成 HDFS `256 MiB` 应用包能力的新上限。
-- 已存在的正规完整包协议仍可使用 `PreparedPersistPackageByteBase64`；先按精确正文计算编码和整个请求/响应字节数，保留版本、CAS、哈希、HDFS 回读及快照 finalize。
-  连接关闭属于结果未知，先回读同版本、同请求身份，不能换请求键盲重传。
+- 标准 MCP 服务的 stdio 使用固定 `128 MiB`（`134217728` 字节）未解析 JSON-RPC 缓冲，超过边界立即拒绝并关闭连接；不读取动态环境变量放大。SDK 调用端若仍使用默认 `10 MiB` 缓冲，大响应仍可能关闭客户端，必须核对调用端支持的真实边界。
+- 该限制计算 UTF-8 wire 字节，包含完整 JSON 信封、Base64 和重复 `Data/Result` 正文。单个 Base64 字段的理论原始字节上限约 `96 MiB` 减信封，不能据此保证任意 `64 MiB` 包响应都通过，也不能把它当成 HDFS `256 MiB` 应用包能力的新上限。
+- 已存在的正规完整包协议仍可使用 `PreparedPersistPackageByteBase64`；先按精确正文计算编码和整个请求/响应字节数，保留版本、CAS、哈希、HDFS 回读及快照 finalize。连接关闭属于结果未知，先回读同版本、同请求身份，不能换请求键盲重传。
 - 超过 wire 能力的源码、运行资产优先使用已有目录/文件 stream 或分片协议及其
   小型指针/回执，不把私有源码、超大资产常态化塞入 JSON/Jint；支持更大正文的其它
   连接也须有明确边界。不能用增大stdio缓冲绕过能力鉴权、业务配额或包完整性检查。
@@ -249,27 +255,8 @@ Unity `Data`、WASM、Windows 安装包、视频模型等发布资产不得进
 - 生产 H5 不能只依赖 `uni.uploadFile`。页面从 `uni.chooseImage` 得到的 `tempFiles[0].file`、`tempFiles[0]`、`blob:` / `data:` 临时路径都要传给 `V8.uploadFile`，并设置 `preferFetch:true`；SDK 必须能用 `fetch + FormData` 兜底，否则线上可能报 `未找到 MicroiV8 上传适配器。`。
 
 <!-- /microi-progressive:chunk -->
-<!-- microi-progressive:chunk id=v8-file-upload-003 sha256=9d8f1e54ec058d9624a051cc55270019fa1b4a88dadc20f03b2cfa1b856a5bc3 -->
-## 跨平台文件同步登录会话
-
-文件柜、文件同步等需要连接另一套 Microi API 的工具，必须把远程平台视为独立登录会话：
-
-- 用户必须先完成远程登录，登录成功后显示远程用户名称、帐号、ApiBase、OsClient 和登录状态，并提供明确的退出登录操作。
-- 历史远程连接通过 `mci_` 前缀表保存，并按 `V8.CurrentUser.Id` 做行级隔离；不得把帐号、密码或 Token 放入 `localStorage`。
-- 密码和 Token 只能由受保护的接口引擎写入、读取和清理。数据库必须保存可校验的加密密文，普通 FormEngine 列表不得返回密文字段。
-- 密码和 Token 使用 `V8.Method.ProtectApiEngineSecret/UnprotectApiEngineSecret`，由宿主把密文绑定当前 `OsClient + ApiEngineKey`；不得从已脱敏的 `V8.OsClientModel` 读取 `AuthSecret/DbConn`，也不得使用进程级临时密钥。接口引擎 Key 必须稳定，确保服务重启和应用升级后仍能解密历史连接。
-- 历史连接列表只返回脱敏元数据；一键重连时再按记录 Id 和当前用户读取凭据。删除连接必须同时清除保存的密码和 Token。
-- 远程目标登录后必须调用文件柜能力探针 `mci_file_sync_capability` 检查同步协议版本，并使用其 `Data.FileManagerSysMenuId` 作为目标租户权威文件柜菜单；禁止硬编码发布端菜单 Id。接口不存在、未返回菜单 Id、返回 404/非标准结果或协议版本过低时，提示目标平台更新【文件柜】应用，不得继续同步。
-- 验收至少覆盖：登录成功显示身份、退出后 Token 清空、历史连接一键重连、删除连接、密文落库、服务重启后仍可解密、目标平台缺少能力接口时的升级提示。
-
-### 热点公开资源的可信分流
-
-- `PublicResourceOffload/2` 与旧目录/路由第一版分别验收。系统日志应用拥有 `mci-file-resource-runtime`（管理员控制面）与 `mci-file-resource-public-url`（匿名只读公开选择）；目录的 Ready、流量和副本行不作为运行授权，不能通过普通 CRUD 制造成功。
-- 从当前 SaaS 引擎读取 MinIO 凭据，第二版 FileServerBak 使用 HTTPS origin 加后端绑定的公有桶。主 HDFS 保留 Aliyun；不全桶迁移、不删源文件、不把私有桶改公开。只复制当前已发布公开运行清单，JS/CSS/模型依赖完整成组；复制、签名回读与匿名 SHA/MIME/Range/CORS 全部成功后才允许消费者采用 NAS。
-- 完整北京时间自然日的 CDN 运营报表及已接入 SDK 的实际响应字节可证明超过阈值的正向下界；榜单缺行、计量缺失和空报表不是零。迁移验证单独排除；历史人工指定单独记录，不能伪造当前24小时阈值通过。阈值触发后的同版本副本持续保留，避免源流量下降反复切回。
-- HTTP/MCP只登记复制意图；共享签名状态、租约栅栏、逐文件回读恢复与退避负责副作用。未知上传先对账，异内容不覆盖。当前版本/完整清单或配置变化、撤为私有、NAS健康失效均回退原地址；先确认真正消费路径，再分别验收实际下载下降与完整日账单节省。主壳预配置 JS、旧绝对 CDN 书签和非受管资源须明确列出未接入范围，不能声称所有资源自动切换。
-
-<!-- /microi-progressive:chunk -->
+热点分流与跨平台会话的完整规则见
+[操作与原生边界](references/hotspot-offload-operations.md)。
 ## 详细参考路由（渐进披露）
 仅在当前任务涉及对应主题时读取；下列文件合计保留了原 SKILL.md 的全部详细知识。
 - [references/progressive-01-公有桶-vs-私有桶.md](references/progressive-01-公有桶-vs-私有桶.md)：公有桶 vs 私有桶；接口直接响应文件（下载/导出）；通过 URL 列表批量下载并入库