@microi.net/cli 6.1.7 → 6.1.9

package/skills/microi.v8.js

@@ -569,12 +569,394 @@ function installDatePrototypeCompat() {
   }
 }
 
+// BEGIN GENERATED PUBLIC RESOURCE ROUTER; source SHA256 d90207991f19b46429dc21a654e2915e1b4fd6e96f191cede20485d823f3a975
+const createSdkPublicResourceClient = (() => {
+// 公有资源路由的纯校验器与实际消费者桥接；私有分支继续走既有授权接口。
+const HASH = /^[a-f0-9]{64}$/;
+const IDENTIFIER = /^[a-zA-Z0-9_-]{1,64}$/;
+const BLOCKED = /^(?:\.git|\.env|private|private-source|privatesource|source|_origin)$/i;
+
+function key(value) {
+  if (typeof value !== 'string' || !value || value.length > 1000 || /[\\%?#:\u0000-\u001f\u007f]/.test(value)
+      || value.split('/').some(part => !part || part === '.' || part === '..' || BLOCKED.test(part)) || /\.map$/i.test(value)) throw Error('InvalidPublicObjectKey');
+  encodeURIComponent(value); // Reject malformed UTF-16 rather than changing the key.
+  return value;
+}
+const encodeKey = value => value.split('/').map(encodeURIComponent).join('/');
+function plainBase(value, originOnly = false) {
+  if (typeof value !== 'string' || /[\\%?#@\u0000-\u0020\u007f]/.test(value)) throw Error('InvalidPublicBinding');
+  const parsed = new URL(value);
+  if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.search || parsed.hash
+      || (originOnly && parsed.pathname !== '/')) throw Error('InvalidPublicBinding');
+  return value.replace(/\/+$/, '');
+}
+function bindingSnapshot(binding) {
+  if (!binding || !IDENTIFIER.test(binding.tenant) || !IDENTIFIER.test(binding.storageOwnerTenant)
+      || !HASH.test(binding.targetConfigHash) || !/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(binding.publicBucket)
+      || binding.publicBucket.includes('..') || binding.publicBucket === binding.privateBucket) throw Error('InvalidPublicBinding');
+  const value = { tenant: binding.tenant, storageOwnerTenant: binding.storageOwnerTenant.toLowerCase(),
+    primaryBase: plainBase(binding.primaryBase), backupOrigin: plainBase(binding.backupOrigin, true),
+    publicBucket: binding.publicBucket, targetConfigHash: binding.targetConfigHash,
+    sourceMappings: (binding.sourceMappings || []).map(item => ({ origin: plainBase(item.origin, true),
+      pathPrefix: item.pathPrefix ? key(item.pathPrefix.replace(/\/+$/, '')) + '/' : '' })) };
+  if (!value.sourceMappings.length || value.sourceMappings.length > 20) throw Error('InvalidPublicBinding');
+  return { ...value, identity: JSON.stringify(value) };
+}
+function legacyPublicFallback(input, binding) {
+  if (!input || input.private === true || typeof input.path !== 'string') return '';
+  const path = input.path;
+  try {
+    if (/^https?:/i.test(path)) {
+      const url = new URL(path);
+      return !/[\\\u0000-\u0020\u007f]/.test(path) && !url.username && !url.password ? path : '';
+    }
+    if (path.startsWith('//') || path.startsWith('.')) return '';
+    if (/[\\\u0000-\u001f\u007f]/.test(path)) return '';
+    const relative = path.startsWith('/') ? path.slice(1) : path;
+    const decoratedAt = relative.search(/[?#]/);
+    const rawKey = decoratedAt < 0 ? relative : relative.slice(0, decoratedAt);
+    const suffix = decoratedAt < 0 ? '' : relative.slice(decoratedAt);
+    const objectKey = key(rawKey.split('/').map(part => decodeURIComponent(part)).join('/'));
+    return plainBase(binding?.primaryBase) + '/' + encodeKey(objectKey) + suffix;
+  } catch { return ''; }
+}
+function identify(input, binding) {
+  if (!input || input.private === true) return { input, accepted: false, reason: 'PrivateRoutingNotSupported', primaryUrl: '' };
+  const path = input.path;
+  try {
+    if (typeof path !== 'string' || !path) throw Error('InvalidInput');
+    if (/^https?:/i.test(path)) {
+      if (/[\\?#@\u0000-\u001f\u007f]/.test(path)) throw Error('SignedOrDecoratedUrlNotEligible');
+      const parsed = new URL(path);
+      const mapping = binding.sourceMappings.find(value => new URL(value.origin).origin === parsed.origin);
+      if (!mapping || parsed.protocol !== 'https:') throw Error('UnmanagedOrigin');
+      // Check raw path before URL() can normalize dot segments.
+      const begin = path.indexOf('/', path.indexOf('://') + 3);
+      if (begin < 0) throw Error('ObjectKeyMissing');
+      const objectKey = key(path.slice(begin + 1).split('/').map(part => {
+        const decoded = decodeURIComponent(part);
+        if (/[\/%\\?#:\u0000-\u001f\u007f]/.test(decoded)) throw Error('InvalidEncodedPath');
+        return decoded;
+      }).join('/'));
+      if (!objectKey.startsWith(mapping.pathPrefix)) throw Error('BucketPrefixMismatch');
+      return { accepted: true, objectKey: key(objectKey.slice(mapping.pathPrefix.length)), primaryUrl: path };
+    }
+    // Protocol-relative, traversal and double-slash paths are never interpreted
+    // as the configured public bucket. A single leading slash is legacy input.
+    if (path.startsWith('//') || path.startsWith('.')) throw Error('UnmanagedRelativePath');
+    const objectKey = key(path.startsWith('/') ? path.slice(1) : path);
+    return { accepted: true, objectKey, primaryUrl: binding.primaryBase + '/' + encodeKey(objectKey) };
+  } catch (error) { return { accepted: false, reason: error.message, primaryUrl: legacyPublicFallback(input, binding) }; }
+}
+function original(item, reason) {
+  return Object.freeze({ useBackup: false, url: item.primaryUrl, primaryUrl: item.primaryUrl,
+    objectKey: item.objectKey || null, reason });
+}
+function acceptedRoute(row, item, binding, time) {
+  if (!row || row.UseBackup !== true || row.ObjectKey !== item.objectKey || !HASH.test(row.SourceRevision)
+      || !HASH.test(row.ResourceId) || row.TargetConfigHash !== binding.targetConfigHash
+      || !Number.isSafeInteger(row.ExpiresAtUtc) || row.ExpiresAtUtc * 1000 <= time
+      || row.ExpiresAtUtc * 1000 > time + 300000 || typeof row.Url !== 'string' || /[?#@\\]/.test(row.Url)) return null;
+  const prefix = binding.backupOrigin + '/' + binding.publicBucket + '/_microi-hotspot/public/v3/'
+    + binding.storageOwnerTenant + '/' + row.ResourceId + '/' + row.SourceRevision + '/';
+  if (!row.Url.startsWith(prefix)) return null;
+  const rest = row.Url.slice(prefix.length), slash = rest.indexOf('/');
+  if (!/^[a-f0-9]{32}$/.test(rest.slice(0, slash)) || rest.slice(slash + 1) !== encodeKey(item.objectKey)) return null;
+  return Object.freeze({ useBackup: true, url: row.Url, primaryUrl: item.primaryUrl, objectKey: item.objectKey,
+    expiresAt: row.ExpiresAtUtc * 1000, reason: 'VerifiedPublicReplica' });
+}
+
+function createPublicResourceRouter({ getBinding, resolveBatch, now = Date.now, maxEntries = 512, timeoutMs = 5000 }) {
+  if (typeof getBinding !== 'function' || typeof resolveBatch !== 'function' || !Number.isInteger(maxEntries)
+      || maxEntries < 1 || maxEntries > 10000 || !Number.isInteger(timeoutMs)
+      || timeoutMs < 1 || timeoutMs > 30000) throw Error('InvalidRouterDependencies');
+  const cache = new Map(), pending = new Map(), cooldown = new Map();
+  const cacheKey = (binding, item) => binding.identity + '\n' + item.objectKey;
+  const put = (map, id, value) => { map.delete(id); map.set(id, value); while (map.size > maxEntries) map.delete(map.keys().next().value); };
+  function cached(binding, item) {
+    const id = cacheKey(binding, item), time = now();
+    if ((cooldown.get(id) || 0) > time) return original(item, 'BackupFailureCooldown');
+    const hit = cache.get(id);
+    if (hit && hit.until > time) return hit.route.useBackup ? Object.freeze({ ...hit.route, primaryUrl: item.primaryUrl }) : original(item, hit.route.reason);
+    cache.delete(id); cooldown.delete(id); return null;
+  }
+  function snapshot() { return bindingSnapshot(getBinding()); }
+  function fallback(input) { try { return legacyPublicFallback(input, getBinding()); } catch { return legacyPublicFallback(input, null); } }
+
+  async function resolveMany(inputs) {
+    if (!Array.isArray(inputs) || inputs.length > 100) throw Error('ResourceBatchLimitExceeded');
+    let binding;
+    try { binding = snapshot(); }
+    catch { return inputs.map(item => original({ primaryUrl: fallback(item) }, 'BackupBindingUnavailable')); }
+    const work = [], created = [];
+    const tasks = inputs.map(input => {
+      const item = identify(input, binding);
+      if (!item.accepted) return Promise.resolve(original(item, item.reason));
+      const known = cached(binding, item); if (known) return Promise.resolve(known);
+      const id = cacheKey(binding, item);
+      if (pending.has(id)) return pending.get(id).then(route => Object.freeze({ ...route, primaryUrl: item.primaryUrl,
+        url: route.useBackup ? route.url : item.primaryUrl }));
+      let done; const promise = new Promise(resolve => { done = resolve; });
+      pending.set(id, promise); work.push(item); created.push({ item, id, done, promise }); return promise;
+    });
+    if (work.length) {
+      // Do not pass secrets, arbitrary URLs or a caller-selected storage endpoint.
+      const controller = new AbortController(); let timer;
+      Promise.race([
+        Promise.resolve().then(() => resolveBatch({ ObjectKeys: work.map(item => item.objectKey), OsClient: binding.tenant }, { signal: controller.signal })),
+        new Promise((_, reject) => { timer = setTimeout(() => reject(Error('ResolverTimeout')), timeoutMs); })
+      ])
+        .then(response => {
+          let current; try { current = snapshot(); } catch { current = null; }
+          const data = response?.Code === 1 ? response.Data : null;
+          const valid = current?.identity === binding.identity && data?.Protocol === 'GenericPublicResourceRoutes/1'
+            && data.TargetConfigHash === binding.targetConfigHash && Array.isArray(data.Routes) && data.Routes.length <= 100;
+          const rows = new Map(), duplicates = new Set();
+          if (valid) for (const row of data.Routes) {
+            if (rows.has(row?.ObjectKey)) duplicates.add(row.ObjectKey);
+            rows.set(row?.ObjectKey, row);
+          }
+          for (const job of created) {
+            const time = now();
+            const route = valid && !duplicates.has(job.item.objectKey)
+              ? acceptedRoute(rows.get(job.item.objectKey), job.item, binding, time) : null;
+            const selected = (cooldown.get(job.id) || 0) > time ? original(job.item, 'BackupFailureCooldown')
+              : route || original(job.item, current?.identity !== binding.identity ? 'TenantOrBindingChanged' : 'VerifiedRouteUnavailable');
+            put(cache, job.id, { route: selected, until: selected.useBackup ? selected.expiresAt : time + 15000 });
+            job.done(selected);
+          }
+        })
+        .catch(() => {
+          for (const job of created) { const route = original(job.item, 'ResolverUnavailable');
+            put(cache, job.id, { route, until: now() + 15000 }); job.done(route); }
+        })
+        .finally(() => { clearTimeout(timer); controller.abort();
+          for (const job of created) if (pending.get(job.id) === job.promise) pending.delete(job.id); });
+    }
+    return Promise.all(tasks);
+  }
+  return Object.freeze({
+    resolveMany,
+    async resolve(input) { return (await resolveMany([input]))[0]; },
+    // Sync compatibility is cache-only. Callers must pre-resolve before assigning
+    // src/href if their FIRST request must avoid the original CDN/OSS endpoint.
+    peek(input) {
+      try { const binding = snapshot(), item = identify(input, binding);
+        return item.accepted ? cached(binding, item) || original(item, 'NotResolvedYet') : original(item, item.reason); }
+      catch { return original({ primaryUrl: fallback(input) }, 'BackupBindingUnavailable'); }
+    },
+    reportFailure(input) {
+      try { const binding = snapshot(), item = identify(input, binding);
+        if (!item.accepted) return original(item, item.reason);
+        const id = cacheKey(binding, item); cache.delete(id); put(cooldown, id, now() + 30000);
+        return original(item, 'BackupFailureCooldown'); }
+      catch { return original({ primaryUrl: fallback(input) }, 'BackupBindingUnavailable'); }
+    },
+    clear() { cache.clear(); cooldown.clear(); }
+  });
+}
+
+/**
+ * DiyCommon 与真实批量解析器的桥接。配置只从当前租户的原生 Binding 回读，
+ * 不将 SaaS 私桶名/凭据塞入前端。首次 src 赋值必须等待 resolve。
+ */
+function createExactAliasRouter({ getBinding, post, now }) {
+  const cache = new Map(), pending = new Map(), cooldown = new Map(); let queue = [], scheduled = false;
+  const put = (map, id, value) => { map.delete(id); map.set(id, value); while (map.size > 512) map.delete(map.keys().next().value); };
+  function pick(input) {
+    try {
+      const raw = getBinding(), b = bindingSnapshot(raw);
+      if (input?.private !== false || raw.aliasUrlRoutingProtocol !== 'PublicSourceUrlRoutes/1'
+          || typeof input.path !== 'string' || !input.path.startsWith('https://') || /[\\?#@\u0000-\u0020\u007f]/.test(input.path)) return null;
+      const origin = new URL(input.path).origin;
+      if (!raw.aliasCandidates.includes(origin)) return null;
+      // Only parse the exact key here. Candidate membership is not authorization:
+      // the server must revalidate this complete SourceUrl before returning NAS.
+      const item = identify(input, { ...b, sourceMappings: [{ origin, pathPrefix: '' }] });
+      return item.accepted ? { ...item, input, origin, binding: b, id: b.identity + '\nURL:' + input.path } : null;
+    } catch { return null; }
+  }
+  async function flush() {
+    scheduled = false; const jobs = queue; queue = [];
+    while (jobs.length) {
+      const origins = new Set(), batch = [];
+      const identity = jobs[0].item.binding.identity;
+      for (let index = 0; index < jobs.length && batch.length < 100;) {
+        const job = jobs[index];
+        if (job.item.binding.identity !== identity) { index++; continue; }
+        if (!origins.has(job.item.origin) && origins.size === 2) { index++; continue; }
+        origins.add(job.item.origin); batch.push(...jobs.splice(index, 1));
+      }
+      let response, timer;
+      try { response = await Promise.race([post({ PublicUrls: batch.map(x => x.item.input.path), OsClient: batch[0].item.binding.tenant }),
+        new Promise((_, reject) => { timer = setTimeout(() => reject(Error('AliasResolverTimeout')), 5000); })]); }
+      catch { response = null; }
+      finally { clearTimeout(timer); }
+      for (const job of batch) {
+        const item = job.item, current = pick(item.input), time = now(), data = response?.Code === 1 ? response.Data : null;
+        const rows = data?.Protocol === 'PublicSourceUrlRoutes/1' && data.TargetConfigHash === item.binding.targetConfigHash
+          && Array.isArray(data.Routes) && data.Routes.length <= 100
+          ? data.Routes.filter(x => x && typeof x === 'object' && !Array.isArray(x) && x.SourceUrl === item.input.path) : [];
+        const row = rows.length === 1 ? rows[0] : null;
+        const accepted = current?.id === item.id && row?.SourceOrigin === item.origin && HASH.test(row.SourceRoutingFingerprint)
+          && row.ExpiresAtUtc * 1000 <= time + 60000 ? acceptedRoute(row, item, item.binding, time) : null;
+        const route = (cooldown.get(item.id) || 0) > time ? original(item, 'BackupFailureCooldown')
+          : accepted || original(item, 'VerifiedAliasRouteUnavailable');
+        put(cache, item.id, { route, until: route.useBackup ? route.expiresAt : time + 15000 });
+        pending.delete(item.id); job.done(route);
+      }
+    }
+  }
+  return {
+    eligible: input => !!pick(input),
+    async resolve(input) {
+      const item = pick(input); if (!item) return null;
+      if ((cooldown.get(item.id) || 0) > now()) return original(item, 'BackupFailureCooldown');
+      const old = cache.get(item.id); if (old && old.until > now()) return old.route;
+      if (pending.has(item.id)) return pending.get(item.id);
+      let done; const result = new Promise(resolve => { done = resolve; }); pending.set(item.id, result);
+      queue.push({ item, done }); if (!scheduled) { scheduled = true; queueMicrotask(flush); } return result;
+    },
+    reportFailure(input) { const item = pick(input); if (!item) return null;
+      cache.delete(item.id); put(cooldown, item.id, now() + 30000); return original(item, 'BackupFailureCooldown'); },
+    clear() { cache.clear(); cooldown.clear(); }
+  };
+}
+
+function createPublicResourceClient({ getContext, post, now = Date.now, fetchHead = globalThis.fetch }) {
+  let active = '', binding = null, bootstrap = null, expires = 0, generation = 0;
+  let queue = [], scheduled = false;
+  const context = () => {
+    const value = getContext() || {};
+    return { tenant: value.tenant, primaryBase: value.primaryBase?.replace(/\/+$/, ''),
+      backupOrigin: value.backupOrigin?.replace(/\/+$/, '') };
+  };
+  const signature = value => JSON.stringify(value);
+  const router = createPublicResourceRouter({ getBinding: () => binding || context(), resolveBatch: data => post(data), now });
+  const aliases = createExactAliasRouter({ getBinding: () => binding, post, now });
+  const fallback = input => Object.freeze({ useBackup: false,
+    url: legacyPublicFallback(input, context()), primaryUrl: legacyPublicFallback(input, context()), reason: 'BindingUnavailable' });
+  async function ensureBinding() {
+    const current = context(), id = signature(current);
+    if (active !== id) { active = id; binding = null; bootstrap = null; expires = 0; generation++; router.clear(); aliases.clear(); }
+    if (binding && expires > now()) return true;
+    if (!binding && expires > now()) return false;
+    if (bootstrap) return bootstrap;
+    if (!current.backupOrigin || !IDENTIFIER.test(current.tenant || '')) return false;
+    const revision = generation;
+    const run = (async () => {
+      let timer;
+      try {
+        const response = await Promise.race([post({ ObjectKeys: [], OsClient: current.tenant }),
+          new Promise((_, reject) => { timer = setTimeout(() => reject(Error('BindingTimeout')), 5000); })]);
+        const data = response?.Data, source = data?.Binding;
+        if (generation !== revision || signature(context()) !== id || response?.Code !== 1 || data?.Protocol !== 'GenericPublicResourceRoutes/1' || !source
+            || source.PrimaryBase?.replace(/\/+$/, '') !== current.primaryBase
+            || source.BackupOrigin?.replace(/\/+$/, '') !== current.backupOrigin
+            || source.TargetConfigHash !== data.TargetConfigHash) return false;
+        const candidate = { tenant: current.tenant, storageOwnerTenant: source.StorageOwnerTenant,
+          primaryBase: source.PrimaryBase, backupOrigin: source.BackupOrigin, publicBucket: source.PublicBucket,
+          privateBucket: '', targetConfigHash: source.TargetConfigHash,
+          aliasUrlRoutingProtocol: source.AliasUrlRoutingProtocol,
+          aliasCandidates: source.AliasUrlRoutingProtocol === 'PublicSourceUrlRoutes/1'
+            ? (source.AliasCandidates || []).map(row => plainBase(row.Origin, true)) : [],
+          sourceMappings: (source.SourceMappings || []).map(row => ({ origin: row.Origin, pathPrefix: row.PathPrefix || '' })) };
+        if (candidate.aliasCandidates.length > 50 || new Set(candidate.aliasCandidates).size !== candidate.aliasCandidates.length) return false;
+        bindingSnapshot(candidate);
+        binding = candidate; expires = now() + 60000; return true;
+      } catch { return false; }
+      finally { clearTimeout(timer); }
+    })();
+    bootstrap = run;
+    try { const ready = await run;
+      if (!ready && revision === generation && signature(context()) === id) { binding = null; expires = now() + 15000; }
+      return ready;
+    } finally { if (bootstrap === run) bootstrap = null; }
+  }
+  async function flush() {
+    scheduled = false; const jobs = queue; queue = [];
+    for (let start = 0; start < jobs.length; start += 100) {
+      const slice = jobs.slice(start, start + 100);
+      try { const routes = await router.resolveMany(slice.map(job => job.input));
+        slice.forEach((job, index) => job.done(signature(context()) === job.context ? routes[index] : fallback(job.input))); }
+      catch { slice.forEach(job => job.done(fallback(job.input))); }
+    }
+  }
+  async function resolve(input) {
+    // 只有明确公有输入才触发任何匿名解析；旧 Limit 缺失由调用者保持原兼容分支。
+    if (!input || input.private !== false) return Object.freeze({ useBackup: false, url: '', primaryUrl: '', reason: 'ExplicitPublicRequired' });
+    const id = signature(context());
+    if (!await ensureBinding() || id !== signature(context())) return fallback(input);
+    if (aliases.eligible(input)) {
+      const revision = generation, route = await aliases.resolve(input);
+      return revision === generation && id === signature(context()) ? route || fallback(input) : fallback(input);
+    }
+    return await new Promise(done => { queue.push({ input, done, context: id });
+      if (!scheduled) { scheduled = true; queueMicrotask(flush); } });
+  }
+  const reportFailure = input => input?.private === false ? aliases.reportFailure(input) || router.reportFailure(input) : fallback({ private: true });
+  return Object.freeze({ resolve,
+    resolveMany(inputs) { return Promise.all(inputs.map(resolve)); },
+    reportFailure,
+    async resolveForNavigation(input) {
+      const id = signature(context()), route = await resolve(input);
+      if (id !== signature(context())) return fallback(input);
+      if (!route.useBackup) return route;
+      const revision = generation;
+      if (!(route.expiresAt > now())) return fallback(input);
+      // 新窗口无法监听跨域导航失败。打开前只做一次有界 HEAD，失败回原地址，不循环重试。
+      const controller = new AbortController(), timer = setTimeout(() => controller.abort(), 3000);
+      try {
+        const response = await fetchHead(route.url, { method: 'HEAD', credentials: 'omit', redirect: 'error', signal: controller.signal });
+        if (id !== signature(context()) || revision !== generation || !(route.expiresAt > now())) return fallback(input);
+        return response.ok ? route : reportFailure(input);
+      } catch { return reportFailure(input); }
+      finally { clearTimeout(timer); }
+    },
+    clear() { generation++; binding = null; bootstrap = null; expires = 0; router.clear(); aliases.clear(); }
+  });
+}
+
+// 历史 Limit 缺失不是公开声明，不能据此新增匿名 NAS 访问。
+function isExplicitPublicResource(metadata, configuredLimit) {
+  return metadata && typeof metadata === 'object' && Object.hasOwn(metadata, 'Limit')
+    ? metadata.Limit === false : configuredLimit === false;
+}
+
+/** 表单实例、租户、记录、字段及文件身份共同限定异步地址赋值。 */
+function createPublicResourceAssignmentGuard({ getContext, contains }) {
+  const pending = new Map(); let disposed = false;
+  const current = ticket => {
+    if (disposed || pending.get(ticket.key) !== ticket) return false;
+    const context = getContext();
+    return Object.keys(ticket.context).every(name => context[name] === ticket.context[name])
+      && contains(ticket.path, ticket.fileId);
+  };
+  return Object.freeze({
+    begin(key, path, fileId = null) {
+      const ticket = { key, path, fileId, context: { ...getContext() }, route: null, fallbackUsed: false };
+      pending.set(key, ticket); return ticket;
+    },
+    current,
+    get(key) { return pending.get(key); },
+    tickets() { return [...pending.values()]; },
+    invalidate(key) { pending.delete(key); },
+    clear() { pending.clear(); },
+    dispose() { disposed = true; pending.clear(); }
+  });
+}
+
+return createPublicResourceClient;
+})();
+// END GENERATED PUBLIC RESOURCE ROUTER
+
 export function createMicroiV8(options = {}) {
   // 运行时配置可通过 createMicroiV8(options) 或 client.configure(next) 覆盖。
   let config = {
     apiBase: '',
     webBase: '',
     fileServer: '',
+    fileServerBak: '',
     osClient: '',
     token: '',
     clientType: getUni() ? 'Mobile' : 'PC',
@@ -606,6 +988,9 @@ export function createMicroiV8(options = {}) {
 
   // 更新配置后立即刷新并发队列，保证 maxConcurrent 热更新生效。
   function configure(next = {}) {
+    if (['apiBase','osClient','fileServer','fileServerBak'].some(key => Object.prototype.hasOwnProperty.call(next,key) && next[key] !== config[key])) {
+      sdkPublicResourceEpoch++; sdkPublicResourceClient?.clear();
+    }
     config = { ...config, ...next };
     if (Object.prototype.hasOwnProperty.call(next, 'maxConcurrent')) {
       runQueued = createQueue(config.maxConcurrent);
@@ -961,6 +1346,63 @@ export function createMicroiV8(options = {}) {
   }
 
   // 资源地址统一过滤占位图，并兼容 HDFS 私有文件、FileServer 和绝对地址。
+  // Public media selection is asynchronous. assetUrl remains a synchronous legacy API.
+  let sdkPublicResourceClient = null;
+  let sdkPublicResourceEpoch = 0;
+  function sdkPublicMetadata(value, path, depth = 0) {
+    if (depth > 8 || value == null) return null;
+    if (typeof value === 'string' && /^[\[{]/.test(value.trim())) {
+      try { return sdkPublicMetadata(JSON.parse(value), path, depth + 1); } catch { return null; }
+    }
+    if (Array.isArray(value)) {
+      for (const entry of value) { const selected = sdkPublicMetadata(entry, path, depth + 1); if (selected) return selected; }
+      return null;
+    }
+    return typeof value === 'object' && extractUploadPath(value) === path ? value : null;
+  }
+  function sdkPublicInputAllowed(value, options = {}) {
+    const path = extractUploadPath(value), meta = sdkPublicMetadata(value, path);
+    if (options.private === true || (meta && (
+      (Object.prototype.hasOwnProperty.call(meta, 'Limit') && meta.Limit !== false)
+      || meta.Private === true || meta.IsPrivate === true || meta.Public === false))) return false;
+    return options.private === false || meta?.Limit === false || meta?.Public === true;
+  }
+  function sdkPublicContext() {
+    return { tenant: config.osClient, primaryBase: config.fileServer || '',
+      backupOrigin: config.fileServerBak || client.SysConfig?.FileServerBak || '' };
+  }
+  function sdkPublicIdentity() {
+    return JSON.stringify([sdkPublicResourceEpoch, config.apiBase, sdkPublicContext()]);
+  }
+  function getSdkPublicResourceClient() {
+    if (!sdkPublicResourceClient) sdkPublicResourceClient = createSdkPublicResourceClient({
+      getContext: sdkPublicContext,
+      post: data => apiEngineRun('mci-file-resource-public-url', data, { checkCode: false, silentError: true, timeout: 5000 })
+    });
+    return sdkPublicResourceClient;
+  }
+  async function resolvePublicResource(value, options = {}) {
+    const path = extractUploadPath(value);
+    if (!path || isBlockedAsset(path) || !sdkPublicInputAllowed(value, options))
+      return { useBackup: false, url: '', primaryUrl: '', reason: 'ExplicitPublicRequired' };
+    // Local files and API-owned protected/runtime endpoints keep their existing transport.
+    if (/^(?:data:|blob:|file:|\.?\/static\/)/i.test(path) || /^\/?(?:file\/|micro-app\/v3(?:\/|$))/i.test(path))
+      return { useBackup: false, url: assetUrl(value), primaryUrl: assetUrl(value), reason: 'LocalOrApiResource' };
+    const identity = sdkPublicIdentity(), publicClient = getSdkPublicResourceClient();
+    const route = options.navigation === true
+      ? await publicClient.resolveForNavigation({ path, private: false })
+      : await publicClient.resolve({ path, private: false });
+    // The portable SDK also binds the API base, which is not a public storage binding field.
+    return identity === sdkPublicIdentity() ? route
+      : { useBackup: false, url: '', primaryUrl: '', reason: 'ClientContextChanged' };
+  }
+  function reportPublicResourceFailure(value, options = {}) {
+    if (!sdkPublicInputAllowed(value, options)) return { useBackup: false, url: '', primaryUrl: '', reason: 'ExplicitPublicRequired' };
+    const path = extractUploadPath(value);
+    return sdkPublicResourceClient?.reportFailure({ path, private: false })
+      || { useBackup: false, url: assetUrl(value), primaryUrl: assetUrl(value), reason: 'PrimaryFallback' };
+  }
+
   function assetUrl(value) {
     const picked = extractUploadPath(value);
     if (!picked || isBlockedAsset(picked)) return '';
@@ -999,6 +1441,7 @@ export function createMicroiV8(options = {}) {
   async function resolveFileUrl(filePathName, options = {}) {
     const path = extractUploadPath(filePathName);
     if (!path || isBlockedAsset(path)) return '';
+    if (sdkPublicInputAllowed(filePathName, options)) return (await resolvePublicResource(filePathName, options)).url;
     if (/^(https?:|blob:|data:|file:)/i.test(path)) return assetUrl(path);
     // 文件实际私有标记和私有字段上下文优先，禁止因字段曾改为公有而错误降级 CDN。
     const privateAccess = options.private === true || hasPrivateUploadFlag(filePathName);
@@ -1534,6 +1977,8 @@ export function createMicroiV8(options = {}) {
     setCurrentUser: setUser,
     getCurrentUser: getUser,
     assetUrl,
+    resolvePublicResource,
+    reportPublicResourceFailure,
     sanitizeAssetUrl: assetUrl,
     resolveAssetUrl: assetUrl,
     resolveAvatarUrl: resolveFileUrl,

package/skills/module-engine/SKILL.md

@@ -72,6 +72,8 @@ PC 卡片优先选择当前终端 Card 视图，没有时复用 Mobile Card；
 - 主后台侧栏读取 `sys_menu.IconClass`（CSS/组件图标），不是图片字段 `Icon`。优先填写当前前端已注册的 Element Plus 图标名；使用 FontAwesome/CSS 名称时先核对兼容映射，不能填入不存在的类名后让全部菜单回退为 `Document`。
 - 没有贴切图标时，从实际可用图标集合中随机选一个，并将选择结果保存；可以按稳定菜单 Id 生成确定的随机分配，避免每次刷新或重新发布都变图标。同组菜单应有适当差异，不强求不同业务绝对不重复。
 - 通过 `microi_create_module` / `microi_update_module` 或 Manifest 的模块配置写入，并把图标纳入应用包。只修改图片字段、只检查数据库字符串或只改本地 Manifest 不算完成；必须回读 `IconClass`，在真实侧栏检查图标可见且有区别。
+- 创建菜单优先显式传 `iconClass`（Manifest 同名，保存为 `IconClass`）；`icon`/`Icon` 保留桌面图片地址语义。历史调用把CSS图标传入 `icon` 时仅作为兼容输入，不能因此漏写侧栏字段。未指定时生成器按业务语义或稳定名称哈希从实际注册图标中补齐，禁止统一退为 `Document`。
+- 同一父菜单下逐项检查图标与功能对应，分类、客户、产品、商机、报价、合同、回款等应可辨识；无法精确匹配时使用稳定差异图标，不追求全系统绝对唯一。幂等重跑保留既有正确图标，只有明确授权修复空值/错误值时才更新。工具成功后独立回读，旧MCP缺参数时先升级工具，不能把不存在的字段当作已经生效。
 
 ### 新模块表单打开方式（强制默认）
 
@@ -102,11 +104,8 @@ PC 卡片优先选择当前终端 Card 视图，没有时复用 Mobile Card；
   记录版本限制并保留可用页面，不写不存在的组件路径，不擅自升级客户容器。占位页填满
   可用内容区，持续动画表达等待，支持明暗主题、
   窄屏及减少动态效果；没有真实任务状态时禁止伪造开发百分比、倒计时或完成量。
-- 候选真实页面先在已授权入口独立完成业务、权限、数据和截图预验收，回读真实资源 Id 后，
-  在同一 `sys_menu.Id` 更新最终 `OpenType/ComponentPath/IsMicroiService` 或已发布资源绑定；保持
-  `Id/ParentId/Url/Sort`、角色/按钮权限和其它关联。刷新菜单、移除旧占位缓存并回读，
-  从原菜单和原 URL 最终验收；失败仅恢复该菜单记录的占位/原正确绑定并列为未完成。
-  不要求仍占位的原 URL 提前展示候选页面。MicroService 绑定仍遵守四字段完整性。
+- 页面可运行后立即回读资源 Id，在同一 sys_menu.Id 绑定真实页面，供用户从原菜单预览；保留 Id/ParentId/Url/Sort、角色/按钮权限和关联。刷新菜单与旧占位缓存，从原入口边开发边验收，不能只开放候选 URL 而原菜单仍显示开发中。MicroService 先发布并验证运行产物，绑定仍遵守四字段完整性。
+- 蓝图区分可预览/待验收与验收通过。局部缺陷继续修复；白屏、资源不可达或越权时优先恢复最近可运行且授权正确的绑定，确无可运行版本才恢复占位，不将预览可见当成交付完成。
 - 用 `microi_get_module` 回读，再用真实用户逐菜单点击、切换、刷新检查标题、访问标签、
   权限与缓存；开发中或失败菜单列为未完成，不以占位页、隐藏菜单或修改状态文案冒充交付。