diff --git a/.trae/skills/fast-crud-page-dev/SKILL.md b/.trae/skills/fast-crud-page-dev/SKILL.md
new file mode 100644
index 000000000..a5b48bf2f
--- /dev/null
+++ b/.trae/skills/fast-crud-page-dev/SKILL.md
@@ -0,0 +1,55 @@
+---
+name: fast-crud-page-dev
+description: 用于开发或重构 Certd 前端列表管理、后台管理、记录查询、CRUD 表格页面，优先使用 Fast Crud（@fast-crud/fast-crud、fs-crud、useFs、createCrudOptions）实现。当用户要求列表页、管理页、审核页、记录页或表格 CRUD 页面时触发。
+version: 1.0.0
+---
+
+# Fast Crud 页面开发技能
+
+## 角色定义
+
+你是一名 Certd 前端列表管理页面开发专家，熟悉 Vue 3、Ant Design Vue、Fast Crud 和本仓库现有页面拆分方式。你的目标是让管理页面保持统一的表格、搜索、分页、操作列和弹窗体验。
+
+## 核心规则
+
+- 列表管理、后台管理、记录查询、审核记录、CRUD 表格类页面，默认优先使用 Fast Crud 实现。
+- 只有轻量只读展示、强交互自定义界面、复杂可视化或已有页面模式明确不适合 Fast Crud 时，才手写 `a-table` / 自定义列表，并在回复中说明原因。
+- 设置表单、概览卡片、向导流程等非列表主体可以保留自定义 Vue；如果同一功能同时包含设置和列表，优先拆成独立页面，或把设置放入对话框。
+
+## 推荐文件拆分
+
+- `api.ts`：封装接口请求，保持页面和 CRUD 配置里不直接散落 URL。
+- `crud.tsx` / `crud-*.tsx`：导出 `createCrudOptions`，集中定义请求映射、搜索项、列、表单、操作列、工具栏和字典。
+- `index.vue`：承载 `fs-page`、`fs-crud`、页面头部、弹窗和生命周期，使用 `useFs({ createCrudOptions, context })` 创建绑定。
+
+## 实现流程
+
+1. 先在 `packages/ui/certd-client/src/views` 下找 1-2 个相近 Fast Crud 页面，沿用它们的导入、布局、命名和权限写法。
+2. 在 `index.vue` 中使用 `fs-crud ref="crudRef" v-bind="crudBinding"`，并在 `onMounted` / `onActivated` 时调用 `crudExpose.doRefresh()`。
+3. 在 `crud.tsx` 中配置 `request.pageRequest`、`columns`、`search`、`form`、`rowHandle`、`actionbar`、`toolbar` 等，接口分页参数和返回值按现有页面适配。
+4. 操作按钮优先放在 Fast Crud 的 `rowHandle.buttons` 或 `actionbar.buttons` 中；审核、保存设置、批量操作等复杂交互可通过 `context` 调用 `index.vue` 中的方法。
+5. 金额、状态、时间、枚举等字段优先复用项目已有组件、字典和格式化工具；避免在模板里重复堆格式化逻辑。
+6. 表格查询条件使用 Fast Crud 的 `search` 配置；新增/编辑表单使用 Fast Crud 的 `form` 配置，复杂设置项可以用 Ant Design Vue 对话框承载。
+7. 删除、审核通过、拒绝等危险操作必须保留确认弹窗和错误提示，成功后刷新当前 CRUD 列表。
+8. 对话框里只做纯确认时可以使用 `Modal.confirm`；只要需要字段输入、表单校验或提交字段，统一使用 `useFormDialog` / `openFormDialog`，不要在 `Modal.confirm` 的 `content` 里手写输入框。
+
+## 布局高度
+
+- Fast Crud 表格依赖外部容器高度计算。虽然表格本身有默认约 200px 高度，但页面内嵌 `fs-crud` 时，为了获得稳定可用的列表区域，必须让外层容器提供明确高度或剩余高度。
+- 独立列表页通常可直接让 `fs-page` / 页面内容区撑满；如果表格嵌在 tabs、详情页、上下分区或弹窗里，要从页面根容器到 `fs-crud` 建立完整的 flex 高度链路：父容器 `display: flex; flex-direction: column; min-height: 0`，中间内容区和 tab pane 使用 `flex: 1; min-height: 0`，`fs-crud` 本身也使用 `flex: 1; min-height: 0`。
+- 有固定操作栏、统计区、说明区时，这些区域应 `flex: none`，把剩余空间交给表格区域。
+- 修改嵌入式 Fast Crud 页面后，要检查空数据、少量数据和多页数据时表格高度、分页器和空状态是否仍在预期区域内。
+
+## 代码习惯
+
+- 页面命名、API 命名、权限标识和路由结构要贴近同目录已有页面。
+- CRUD 配置中不要写大段业务流程；复杂逻辑放回 `index.vue` 方法或 `api.ts`。
+- 能用 `dict`、`compute`、`valueBuilder`、`valueResolve`、`component` 配置表达的表格/表单行为，不要改成手写模板。
+- 保持列表页密度和操作入口克制，不要做营销式布局、嵌套卡片或大块说明文字。
+- 如果页面有“设置 + 列表”，管理端优先拆成两个路由页面；用户端提现设置这类低频配置优先使用对话框保存。
+
+## 验证方式
+
+- 前端改动后，只对本次改动的 Vue / TS / TSX / locale 文件运行项目现有 Prettier / ESLint。
+- 不运行 `vue-tsc` / `pnpm tsc`，因为当前依赖组合下 `vue-tsc` 已知会抛内部错误。
+- 若只是新增或修改本 skill / 文档，不需要运行前端格式化和测试。
diff --git a/AGENTS.md b/AGENTS.md
index e878d1064..3a008f4ec 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -105,7 +105,7 @@ Certd 是一个支持私有化部署的 SSL/TLS 证书自动化管理平台。
 
 - 前端 `pnpm dev`：启动 Vite 开发服务
 - 前端 `pnpm build`：生产构建
-- 前端 `pnpm tsc`：类型检查
+- 不要运行前端 `pnpm tsc` / `vue-tsc`：当前依赖组合中 `vue-tsc@1.8.27` 会直接抛内部错误 `Search string not found: "/supportedTSExtensions = .*(?=;)/"`，不是有效的项目类型检查结果。
 - 前端暂不跑单元测试；当前 `test:unit` 只是占位脚本
 
 ## 流水线与插件模型
@@ -216,5 +216,5 @@ Get-ChildItem packages\ui\certd-client\src\views\certd
 - 后端纯单元测试用例放在 `src` 目录内，并尽量与被测文件相邻，例如 `src/utils/random.test.ts`；对应 `test:unit` 只跑 `src/**/*.test.ts`，构建/打包配置应排除这些 `*.test.ts` 文件。
 - 单元测试需要 mock ESM 静态 import 时，优先使用 `esmock`，不要为了测试把业务代码改成构造函数注入或把逻辑挪到调用方；各包 `test:unit` 脚本应显式设置 `NODE_ENV=unittest`。
 - 单个 monorepo 包运行单元测试时，优先使用 `corepack pnpm --dir <包目录> test:unit`，例如 `corepack pnpm --dir packages\ui\certd-server test:unit`、`corepack pnpm --dir packages\core\basic test:unit`、`corepack pnpm --dir packages\plugins\plugin-lib test:unit`；也可以用包名过滤，例如 `corepack pnpm --filter @certd/ui-server test:unit`。前端 `packages\ui\certd-client` 暂时不跑单元测试。
-- 前端 TS/Vue/locale 等文件改动后，优先只对本次改动文件运行项目现有自动格式化/修复；Windows/PowerShell 下 Prettier 已验证可用命令为 `packages\ui\certd-client\node_modules\.bin\prettier.cmd --write <files>`，ESLint 可用命令为 `packages\ui\certd-client\node_modules\.bin\eslint.cmd --fix <files>`；不要为了格式化无关文件而扩大 diff。项目保留了 `tslint` 依赖，但当前主要使用 ESLint + Prettier。
-- 优先对改动包运行聚焦的测试或类型检查；只有跨包影响明显时再考虑全 monorepo 构建。
+- 前端 TS/Vue/locale 等文件改动后，优先只对本次改动文件运行项目现有自动格式化/修复；Windows/PowerShell 下 Prettier 已验证可用命令为 `packages\ui\certd-client\node_modules\.bin\prettier.cmd --write <files>`，ESLint 可用命令为 `packages\ui\certd-client\node_modules\.bin\eslint.cmd --fix <files>`；不要运行 `vue-tsc` / `pnpm tsc`；不要为了格式化无关文件而扩大 diff。项目保留了 `tslint` 依赖，但当前主要使用 ESLint + Prettier。
+- 优先对改动包运行聚焦的测试；后端可按包运行单元测试，前端优先使用 Prettier/ESLint 做改动文件验证。只有跨包影响明显时再考虑全 monorepo 构建。
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f3fe3de4c..1a843cdbe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,47 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.40.2](https://github.com/certd/certd/compare/v1.40.1...v1.40.2) (2026-05-19)
+
+### Bug Fixes
+
+* **certd-server:** 调整首页缓存控制头的判断逻辑 ([0499347](https://github.com/certd/certd/commit/0499347588ee544862420ab9a5afd2546d61bc6c))
+
+### Performance Improvements
+
+* **controller:** 更换版本获取源并添加版本标准化处理 ([cb08e06](https://github.com/certd/certd/commit/cb08e061d257ba23a0fefdbfb046a8c759def828))
+
+## [1.40.1](https://github.com/certd/certd/compare/v1.40.0...v1.40.1) (2026-05-18)
+
+### Bug Fixes
+
+* 固化华为云sdk版本，避免华为云调用报错 ([59b9ffa](https://github.com/certd/certd/commit/59b9ffadd05faf3982151c48f8d83cbd97419865))
+* **email-service:** 优化商业版测试邮件内容中带的url链接 ([667e7b1](https://github.com/certd/certd/commit/667e7b185bf26558972be01720872f48352b5876))
+
+### Performance Improvements
+
+* 商业版支持限制泛域名数量 ([c63745d](https://github.com/certd/certd/commit/c63745d1ba30904428ba6b13ab0785298baa5cae))
+* **suite:** 商业版用户已购套餐支持修改 ([bdb3d09](https://github.com/certd/certd/commit/bdb3d09c09fc73e7e5e3401f6ef5588bf8ad5088))
+
+# [1.40.0](https://github.com/certd/certd/compare/v1.39.16...v1.40.0) (2026-05-14)
+
+### Bug Fixes
+
+* 修复第三方登录丢失state时无法在用户信息页面绑定第三方账号的bug ([45dedf5](https://github.com/certd/certd/commit/45dedf5bc779fea852e1f33dda4f31db2765633c))
+* 修复群晖授权没有显示设备id输入框的bug ([2f172b5](https://github.com/certd/certd/commit/2f172b56e9411303ca15138d827bdb9bafdae4d1))
+* 修复自动注册后没有跳转到控制台的bug ([4681ec9](https://github.com/certd/certd/commit/4681ec90088a3eb665427b2ac4047ec5ccefd7b3))
+* 修复clogin登录丢失state问题 ([22f5cfc](https://github.com/certd/certd/commit/22f5cfcfd8462ca74128329eefb3f48b3ee0b7ea))
+* 修复clogin多选类型登录失败的bug ([9f878a3](https://github.com/certd/certd/commit/9f878a353cd49b7b10bb0a95610ad236bc920dd2))
+
+### Features
+
+* 彩虹登录支持选择多种登录方式 ([7aa0c7e](https://github.com/certd/certd/commit/7aa0c7e491fe660abb62e68792ff5474f19bd5b8))
+
+### Performance Improvements
+
+* 第三方登录自动注册的用户支持设置初始化密码 ([a815d02](https://github.com/certd/certd/commit/a815d0245b97efbb948b33d6fc9d49862ce06889))
+* 头像增加缓存时间 ([7015b1b](https://github.com/certd/certd/commit/7015b1b232602e5168a3eb8bee6d7f1776ae1e74))
+
 ## [1.39.16](https://github.com/certd/certd/compare/v1.39.15...v1.39.16) (2026-05-13)
 
 **Note:** Version bump only for package root
diff --git a/README.md b/README.md
index 79987d561..d132d8a6b 100644
--- a/README.md
+++ b/README.md
@@ -34,10 +34,11 @@ Certd® 是一个免费的全自动证书管理系统，让你的网站证书永
 * **多种通知方式**: 邮件通知、webhook通知、企微、钉钉、飞书、anpush等多种通知方式
 * **私有化部署**: 数据保存本地，安装简单快捷，镜像由Github Actions构建，过程公开透明
 * **多重安全保障**: 授权加密，站点隐藏，2FA，密码防爆破等多重安全保障
-* **多数据库支持**：支持SQLite、PostgreSQL、MySQL
+* **多数据库支持**：支持SQLite、PostgreSQL、MySQL、MariaDB
 * **开放接口支持**： 提供RESTful API接口，方便集成到其他系统
 * **站点证书监控**： 定时监控网站证书的过期时间
 * **多用户管理**： 用户可以管理自己的证书流水线
+* **项目管理**： 企业级项目管理模式
 * **多语言支持**： 中英双语切换
 * **无忧升级**： 版本向下兼容
 
diff --git a/README_en.md b/README_en.md
index 5fb2f9870..521e41980 100644
--- a/README_en.md
+++ b/README_en.md
@@ -31,7 +31,7 @@ This project not only supports automated certificate application but also automa
 * Multiple notification methods, including email, webhook, WeChat Work, DingTalk, Lark, and anpush.
 * On-premises deployment, local data storage, simple and quick installation. Images are built by Github Actions, with a transparent process.
 * Multiple security measures, including authorization encryption, site hiding, 2FA, and password brute-force protection.
-* Supports multiple databases such as SQLite, PostgreSQL, and MySQL.
+* Supports multiple databases such as SQLite, PostgreSQL, MySQL, and MariaDB.
 * Open API support.
 * Site certificate monitoring.
 * Multi-user management.
diff --git a/docker/auto/docker-compose.yaml b/docker/auto/docker-compose.yaml
new file mode 100644
index 000000000..7a5e93ddd
--- /dev/null
+++ b/docker/auto/docker-compose.yaml
@@ -0,0 +1,95 @@
+version: '3.3' # 兼容旧版docker-compose
+services:
+  certd:
+    # 镜像                                                  #  ↓↓↓↓↓ ---- 镜像版本号，建议改成固定版本号,例如：certd:1.29.0
+    image: registry.cn-shenzhen.aliyuncs.com/handsfree/certd:latest
+    # image: ghcr.io/certd/certd:latest                    #   --------- 如果 报镜像not found，可以尝试其他镜像源
+    # image: greper/certd:latest
+    container_name: certd # 容器名
+    restart: unless-stopped # 自动重启
+    volumes:
+      #   ↓↓↓↓↓ -------------------------------------------------------- 数据库以及证书存储路径,默认存在宿主机的/data/certd/目录下，【您需要定时备份此目录，以保障数据容灾】
+      - /data/certd:/app/data # 只要修改冒号前面的，冒号后面的/app/data切记切记不要动
+      #- /volume1/docker/certd:/app/data:delegated  #群晖使用这个配置
+      #   ↓↓↓↓↓ -------------------------------------------------------- 如果走时不准，考虑挂载localtime文件
+      #- /etc/localtime:/etc/localtime
+      #- /etc/timezone:/etc/timezone
+    ports: # 端口映射
+      #  ↓↓↓↓ ---------------------------------------------------------- 如果端口有冲突，可以修改第一个7001为其他不冲突的端口号，第二个7001不要动
+      - "7001:7001"
+      #  ↓↓↓↓ ---------------------------------------------------------- https端口，可以根据实际情况，是否暴露该端口
+      - "7002:7002"
+    #↓↓↓↓ -------------------------------------------------------------- 如果出现getaddrinfo EAI_AGAIN 或 getaddrinfo ENOTFOUND 错误，可以尝试设置dns
+#    dns:
+#      - 223.5.5.5      # 阿里云公共dns
+#      - 223.6.6.6
+#       # ↓↓↓↓ --------------------------------------------------------- 如果你服务器在腾讯云，可以用这个替换上面阿里云的公共dns
+#      - 119.29.29.29  # 腾讯云公共dns
+#      - 182.254.116.116
+#       # ↓↓↓↓ --------------------------------------------------------- 如果你服务器部署在国外，可以用这个替换上面阿里云的公共dns
+#      - 8.8.8.8       # 谷歌公共dns
+#      - 8.8.4.4
+#    extra_hosts:
+#        # ↓↓↓↓ -------------------------------------------------------- 这里可以配置自定义hosts，外网域名可以指向本地局域网ip地址
+#      - "localdomain.com:192.168.1.3"
+#        #         ↓↓↓↓ ------------------------------------------------ 直接使用主机的网络，如果网络问题实在找不到原因，可以尝试打开此参数
+#    network_mode: host
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+#    ↓↓↓↓ -------------------------------------------------------------- 启用ipv6网络，还需要把下面networks的注释放开
+#    networks:
+#      - ip6net
+    environment:
+#             ↓↓↓↓ ----------------------------------------------------- 使用上海东八时区
+      - TZ=Asia/Shanghai
+#     设置环境变量即可自定义certd配置
+#     配置项见： packages/ui/certd-server/src/config/config.default.ts
+#     配置规则： certd_ + 配置项, 点号用_代替
+#                                    #↓↓↓↓ ----------------------------- 如果忘记管理员密码，可以设置为true，docker compose up -d 重建容器之后，管理员密码将改成123456，然后请及时修改回false
+      - certd_system_resetAdminPasswd=false
+                        # ↓↓↓ 要使用ipv6，将此配置修改为::
+      - certd_koa_hostname=0.0.0.0
+
+#     默认使用sqlite文件数据库，如果需要使用其他数据库，请设置以下环境变量
+#     注意： 选定使用一种数据库之后，不支持更换数据库。
+#     数据库迁移方法：1、使用新数据库重新部署一套，然后将旧数据同步过去，注意flyway_history表的数据不要同步
+#                                    #↓↓↓↓ ----------------------------- 使用postgresql数据库，需要提前创建数据库
+#      - certd_flyway_scriptDir=./db/migration-pg                        # 升级脚本目录
+#      - certd_typeorm_dataSource_default_type=postgres                  # 数据库类型
+#      - certd_typeorm_dataSource_default_host=localhost                 # 数据库地址
+#      - certd_typeorm_dataSource_default_port=5433                      # 数据库端口
+#      - certd_typeorm_dataSource_default_username=postgres              # 用户名
+#      - certd_typeorm_dataSource_default_password=yourpasswd            # 密码
+#      - certd_typeorm_dataSource_default_database=certd                 # 数据库名
+
+#                                    #↓↓↓↓ ----------------------------- 使用mysql8数据库，需要提前创建数据库 charset=utf8mb4, collation=utf8mb4_bin
+#      - certd_flyway_scriptDir=./db/migration-mysql                     # 升级脚本目录
+#      - certd_typeorm_dataSource_default_type=mysql                     # 数据库类型， 或者 mariadb
+#      - certd_typeorm_dataSource_default_host=localhost                 # 数据库地址
+#      - certd_typeorm_dataSource_default_port=3306                      # 数据库端口
+#      - certd_typeorm_dataSource_default_username=root                  # 用户名
+#      - certd_typeorm_dataSource_default_password=yourpasswd            # 密码
+#      - certd_typeorm_dataSource_default_database=certd                 # 数据库名
+
+#         ↓↓↓↓ ---------------------------------------------------------  自动升级，上面certd的版本号要保持为latest
+ certd-updater:  # 添加 Watchtower 服务
+   image: containrrr/watchtower:latest
+   container_name: certd-updater
+   restart: unless-stopped
+   volumes:
+     - /var/run/docker.sock:/var/run/docker.sock
+   # 配置 自动更新
+   environment:
+     - WATCHTOWER_CLEANUP=true            # 自动清理旧版本容器
+     - WATCHTOWER_INCLUDE_STOPPED=false   # 不更新已停止的容器
+     - WATCHTOWER_LABEL_ENABLE=true       # 根据容器标签进行更新
+     - WATCHTOWER_POLL_INTERVAL=600       # 每 10 分钟检查一次更新
+
+
+#    ↓↓↓↓ -------------------------------------------------------------- 启用ipv6网络，还需要把上面networks的注释放开
+#networks:
+#  ip6net:
+#    enable_ipv6: true
+#    ipam:
+#      config:
+#        - subnet: 2001:db8::/64
diff --git a/docs/guide/changelogs/CHANGELOG.md b/docs/guide/changelogs/CHANGELOG.md
index f3fe3de4c..1a843cdbe 100644
--- a/docs/guide/changelogs/CHANGELOG.md
+++ b/docs/guide/changelogs/CHANGELOG.md
@@ -3,6 +3,47 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.40.2](https://github.com/certd/certd/compare/v1.40.1...v1.40.2) (2026-05-19)
+
+### Bug Fixes
+
+* **certd-server:** 调整首页缓存控制头的判断逻辑 ([0499347](https://github.com/certd/certd/commit/0499347588ee544862420ab9a5afd2546d61bc6c))
+
+### Performance Improvements
+
+* **controller:** 更换版本获取源并添加版本标准化处理 ([cb08e06](https://github.com/certd/certd/commit/cb08e061d257ba23a0fefdbfb046a8c759def828))
+
+## [1.40.1](https://github.com/certd/certd/compare/v1.40.0...v1.40.1) (2026-05-18)
+
+### Bug Fixes
+
+* 固化华为云sdk版本，避免华为云调用报错 ([59b9ffa](https://github.com/certd/certd/commit/59b9ffadd05faf3982151c48f8d83cbd97419865))
+* **email-service:** 优化商业版测试邮件内容中带的url链接 ([667e7b1](https://github.com/certd/certd/commit/667e7b185bf26558972be01720872f48352b5876))
+
+### Performance Improvements
+
+* 商业版支持限制泛域名数量 ([c63745d](https://github.com/certd/certd/commit/c63745d1ba30904428ba6b13ab0785298baa5cae))
+* **suite:** 商业版用户已购套餐支持修改 ([bdb3d09](https://github.com/certd/certd/commit/bdb3d09c09fc73e7e5e3401f6ef5588bf8ad5088))
+
+# [1.40.0](https://github.com/certd/certd/compare/v1.39.16...v1.40.0) (2026-05-14)
+
+### Bug Fixes
+
+* 修复第三方登录丢失state时无法在用户信息页面绑定第三方账号的bug ([45dedf5](https://github.com/certd/certd/commit/45dedf5bc779fea852e1f33dda4f31db2765633c))
+* 修复群晖授权没有显示设备id输入框的bug ([2f172b5](https://github.com/certd/certd/commit/2f172b56e9411303ca15138d827bdb9bafdae4d1))
+* 修复自动注册后没有跳转到控制台的bug ([4681ec9](https://github.com/certd/certd/commit/4681ec90088a3eb665427b2ac4047ec5ccefd7b3))
+* 修复clogin登录丢失state问题 ([22f5cfc](https://github.com/certd/certd/commit/22f5cfcfd8462ca74128329eefb3f48b3ee0b7ea))
+* 修复clogin多选类型登录失败的bug ([9f878a3](https://github.com/certd/certd/commit/9f878a353cd49b7b10bb0a95610ad236bc920dd2))
+
+### Features
+
+* 彩虹登录支持选择多种登录方式 ([7aa0c7e](https://github.com/certd/certd/commit/7aa0c7e491fe660abb62e68792ff5474f19bd5b8))
+
+### Performance Improvements
+
+* 第三方登录自动注册的用户支持设置初始化密码 ([a815d02](https://github.com/certd/certd/commit/a815d0245b97efbb948b33d6fc9d49862ce06889))
+* 头像增加缓存时间 ([7015b1b](https://github.com/certd/certd/commit/7015b1b232602e5168a3eb8bee6d7f1776ae1e74))
+
 ## [1.39.16](https://github.com/certd/certd/compare/v1.39.15...v1.39.16) (2026-05-13)
 
 **Note:** Version bump only for package root
diff --git a/docs/guide/install/auto.md b/docs/guide/install/auto.md
new file mode 100644
index 000000000..393d5b34e
--- /dev/null
+++ b/docs/guide/install/auto.md
@@ -0,0 +1,60 @@
+
+## 自动升级配置
+
+### 1. 方法一：使用watchtower监控自动升级【推荐】
+
+1. 修改docker-compose.yaml文件增加如下配置       
+或 [下载完整的自动升级docker-compose.yaml配置](https://gitee.com/certd/certd/raw/v2/docker/auto/docker-compose.yaml)
+```yaml
+services:
+  certd:
+     # 镜像                                                  #  ↓↓↓↓↓ ---- 镜像版本号 这里要保持为latest
+    image: registry.cn-shenzhen.aliyuncs.com/handsfree/certd:latest
+    ... # 这里是你原来的docker-compose.yaml配置
+
+    # ↓↓↓↓ ---------------------------------------------------------  增加一个标签，表示certd需要自动升级
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
+
+#         ↓↓↓↓ ---------------------------------------------------------  自动升级watchtower配置，注意：上面certd的版本号要保持为latest
+  certd-updater:  # 添加 Watchtower 服务
+    image: containrrr/watchtower:latest
+    container_name: certd-updater
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    # 配置 自动更新
+    environment:
+      - WATCHTOWER_CLEANUP=true            # 自动清理旧版本容器
+      - WATCHTOWER_INCLUDE_STOPPED=false   # 不更新已停止的容器
+      - WATCHTOWER_LABEL_ENABLE=true       # 根据容器标签进行更新
+      - WATCHTOWER_POLL_INTERVAL=600       # 每 10 分钟检查一次更新
+
+```
+
+2. 重启certd容器
+```shell
+cd certd
+docker compose down
+docker compose up -d
+```
+
+
+### 2. 方法二：使用Certd版本监控功能【不太稳定】
+
+1. 选择Github-检查Release版本插件
+![](./images/github-release.png)
+按如下图填写配置
+![](./images/github-release-2.png)
+
+
+2. 检测到新版本后执行宿主机升级命令：
+
+```shell
+# 拉取最新镜像
+docker pull registry.cn-shenzhen.aliyuncs.com/handsfree/certd:latest
+# 升级容器命令， 替换成你自己的certd更新命令
+export RESTART_CERT='sleep 10; cd ~/deploy/certd/ ; docker compose down; docker compose up -d'
+# 构造一个脚本10s后在后台执行，避免容器销毁时执行太快，导致流水线任务无法结束
+nohup sh -c '$RESTART_CERT' >/dev/null  2>&1 & echo '10秒后重启' && exit
+```
\ No newline at end of file
diff --git a/docs/guide/install/upgrade.md b/docs/guide/install/upgrade.md
index cfa38b245..ef930fd17 100644
--- a/docs/guide/install/upgrade.md
+++ b/docs/guide/install/upgrade.md
@@ -22,51 +22,3 @@
 可以查看最新版本号，以及所有版本的更新日志     
 [CHANGELOG](../changelogs/CHANGELOG.md)
 
-
-## 自动升级配置
-
-### 1. 方法一：使用watchtower监控
-
-修改docker-compose.yaml文件增加如下配置， 使用watchtower监控自动升级
-```yaml
-services:
-  certd:
-    ...
-    labels:
-      com.centurylinklabs.watchtower.enable: "true"
-
-#         ↓↓↓↓ ---------------------------------------------------------  自动升级，上面certd的版本号要保持为latest
-  certd-updater:  # 添加 Watchtower 服务
-    image: containrrr/watchtower:latest
-    container_name: certd-updater
-    restart: unless-stopped
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-    # 配置 自动更新
-    environment:
-      - WATCHTOWER_CLEANUP=true            # 自动清理旧版本容器
-      - WATCHTOWER_INCLUDE_STOPPED=false   # 不更新已停止的容器
-      - WATCHTOWER_LABEL_ENABLE=true       # 根据容器标签进行更新
-      - WATCHTOWER_POLL_INTERVAL=600       # 每 10 分钟检查一次更新
-
-```
-
-
-### 2. 方法二：使用Certd版本监控功能
-
-选择Github-检查Release版本插件
-![](./images/github-release.png)
-按如下图填写配置
-![](./images/github-release-2.png)
-
-
-检测到新版本后执行宿主机升级命令：
-
-```shell
-# 拉取最新镜像
-docker pull registry.cn-shenzhen.aliyuncs.com/handsfree/certd:latest
-# 升级容器命令， 替换成你自己的certd更新命令
-export RESTART_CERT='sleep 10; cd ~/deploy/certd/ ; docker compose down; docker compose up -d'
-# 构造一个脚本10s后在后台执行，避免容器销毁时执行太快，导致流水线任务无法结束
-nohup sh -c '$RESTART_CERT' >/dev/null  2>&1 & echo '10秒后重启' && exit
-```
\ No newline at end of file
diff --git a/lerna.json b/lerna.json
index 2a104497f..c60e9b7a6 100644
--- a/lerna.json
+++ b/lerna.json
@@ -9,5 +9,5 @@
     }
   },
   "npmClient": "pnpm",
-  "version": "1.39.16"
+  "version": "1.40.2"
 }
diff --git a/packages/core/acme-client/CHANGELOG.md b/packages/core/acme-client/CHANGELOG.md
index ecbfab08c..8c173ed81 100644
--- a/packages/core/acme-client/CHANGELOG.md
+++ b/packages/core/acme-client/CHANGELOG.md
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.40.2](https://github.com/publishlab/node-acme-client/compare/v1.40.1...v1.40.2) (2026-05-19)
+
+**Note:** Version bump only for package @certd/acme-client
+
+## [1.40.1](https://github.com/publishlab/node-acme-client/compare/v1.40.0...v1.40.1) (2026-05-18)
+
+**Note:** Version bump only for package @certd/acme-client
+
+# [1.40.0](https://github.com/publishlab/node-acme-client/compare/v1.39.16...v1.40.0) (2026-05-14)
+
+**Note:** Version bump only for package @certd/acme-client
+
 ## [1.39.16](https://github.com/publishlab/node-acme-client/compare/v1.39.15...v1.39.16) (2026-05-13)
 
 **Note:** Version bump only for package @certd/acme-client
diff --git a/packages/core/acme-client/package.json b/packages/core/acme-client/package.json
index 07f67bb86..7d6a77ffc 100644
--- a/packages/core/acme-client/package.json
+++ b/packages/core/acme-client/package.json
@@ -3,7 +3,7 @@
     "description": "Simple and unopinionated ACME client",
     "private": false,
     "author": "nmorsman",
-    "version": "1.39.16",
+    "version": "1.40.2",
     "type": "module",
     "module": "./dist/index.js",
     "main": "./dist/index.js",
@@ -18,7 +18,7 @@
         "types"
     ],
     "dependencies": {
-        "@certd/basic": "^1.39.16",
+        "@certd/basic": "^1.40.2",
         "@peculiar/x509": "^1.11.0",
         "asn1js": "^3.0.5",
         "axios": "^1.9.0",
@@ -50,7 +50,7 @@
     },
     "scripts": {
         "before-build": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true});fs.rmSync('tsconfig.tsbuildinfo',{force:true});\"",
-        "build": "npm run before-build && tsc --skipLibCheck",
+        "build": "npm run before-build && tsc -p tsconfig.build.json --skipLibCheck",
         "build-docs": "jsdoc2md dist/client.js > docs/client.md && jsdoc2md dist/crypto/index.js > docs/crypto.md && jsdoc2md dist/crypto/forge.js > docs/forge.md",
         "lint": "eslint \"src/**/*.ts\" \"types/**/*.ts\"",
         "lint-types": "tsd --files \"types/index.test-d.ts\"",
@@ -76,5 +76,5 @@
     "bugs": {
         "url": "https://github.com/publishlab/node-acme-client/issues"
     },
-    "gitHead": "1c6dc169ac04fd09ef94404a912a15cbb17e1452"
+    "gitHead": "678b70cee8510a2b5217788c5db9469f49cbd439"
 }
diff --git a/packages/core/acme-client/tsconfig.build.json b/packages/core/acme-client/tsconfig.build.json
new file mode 100644
index 000000000..bcca8fcc1
--- /dev/null
+++ b/packages/core/acme-client/tsconfig.build.json
@@ -0,0 +1,7 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "sourceMap": false,
+    "inlineSourceMap": false
+  }
+}
diff --git a/packages/core/acme-client/tsconfig.json b/packages/core/acme-client/tsconfig.json
index 6326967ce..017154eec 100644
--- a/packages/core/acme-client/tsconfig.json
+++ b/packages/core/acme-client/tsconfig.json
@@ -6,7 +6,7 @@
     "moduleResolution": "node",
     "esModuleInterop": true,
     "inlineSourceMap": false,
-    "sourceMap": false,
+    "sourceMap": true,
     "noImplicitThis": false,
     "noUnusedLocals": false,
     "stripInternal": true,
diff --git a/packages/core/basic/CHANGELOG.md b/packages/core/basic/CHANGELOG.md
index f856f1839..ea95a5f08 100644
--- a/packages/core/basic/CHANGELOG.md
+++ b/packages/core/basic/CHANGELOG.md
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.40.2](https://github.com/certd/certd/compare/v1.40.1...v1.40.2) (2026-05-19)
+
+**Note:** Version bump only for package @certd/basic
+
+## [1.40.1](https://github.com/certd/certd/compare/v1.40.0...v1.40.1) (2026-05-18)
+
+**Note:** Version bump only for package @certd/basic
+
+# [1.40.0](https://github.com/certd/certd/compare/v1.39.16...v1.40.0) (2026-05-14)
+
+**Note:** Version bump only for package @certd/basic
+
 ## [1.39.16](https://github.com/certd/certd/compare/v1.39.15...v1.39.16) (2026-05-13)
 
 **Note:** Version bump only for package @certd/basic
diff --git a/packages/core/basic/build.md b/packages/core/basic/build.md
index 629b97a7d..299942935 100644
--- a/packages/core/basic/build.md
+++ b/packages/core/basic/build.md
@@ -1 +1 @@
-14:13
+00:35
diff --git a/packages/core/basic/package.json b/packages/core/basic/package.json
index 585ee1cf8..d5afe9821 100644
--- a/packages/core/basic/package.json
+++ b/packages/core/basic/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@certd/basic",
   "private": false,
-  "version": "1.39.16",
+  "version": "1.40.2",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -9,7 +9,7 @@
   "scripts": {
     "dev": "vite",
     "before-build": "rimraf dist && rimraf tsconfig.tsbuildinfo && rimraf .rollup.cache",
-    "build": "npm run before-build && tsc --skipLibCheck",
+    "build": "npm run before-build && tsc -p tsconfig.build.json --skipLibCheck",
     "dev-build": "npm run build",
     "preview": "vite preview",
     "test": "mocha   --loader=ts-node/esm",
@@ -52,5 +52,5 @@
     "tslib": "^2.8.1",
     "typescript": "^5.4.2"
   },
-  "gitHead": "1c6dc169ac04fd09ef94404a912a15cbb17e1452"
+  "gitHead": "678b70cee8510a2b5217788c5db9469f49cbd439"
 }
diff --git a/packages/core/basic/src/utils/util.cache.ts b/packages/core/basic/src/utils/util.cache.ts
index 460e16732..b10a2c128 100644
--- a/packages/core/basic/src/utils/util.cache.ts
+++ b/packages/core/basic/src/utils/util.cache.ts
@@ -11,9 +11,10 @@ export class LocalCache<V = any> {
   cache: Map<string, { value: V; expiresAt: number }>;
   constructor(opts: { clearInterval?: number } = {}) {
     this.cache = new Map();
-    setInterval(() => {
+    const intervalId = setInterval(() => {
       this.clearExpires();
     }, opts.clearInterval ?? 5 * 60 * 1000);
+    intervalId.unref?.();
   }
 
   get(key: string): V | undefined {
diff --git a/packages/core/basic/tsconfig.build.json b/packages/core/basic/tsconfig.build.json
new file mode 100644
index 000000000..bcca8fcc1
--- /dev/null
+++ b/packages/core/basic/tsconfig.build.json
@@ -0,0 +1,7 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "sourceMap": false,
+    "inlineSourceMap": false
+  }
+}
diff --git a/packages/core/basic/tsconfig.json b/packages/core/basic/tsconfig.json
index 4a0b70f77..8bf8cd59a 100644
--- a/packages/core/basic/tsconfig.json
+++ b/packages/core/basic/tsconfig.json
@@ -8,7 +8,7 @@
     "experimentalDecorators": true,
     "emitDecoratorMetadata": true,
     "inlineSourceMap": false,
-    "sourceMap": false,
+    "sourceMap": true,
     "noImplicitThis": true,
     "noUnusedLocals": true,
     "stripInternal": true,
diff --git a/packages/core/pipeline/CHANGELOG.md b/packages/core/pipeline/CHANGELOG.md
index d2fbe0a4d..0d7f62dfb 100644
--- a/packages/core/pipeline/CHANGELOG.md
+++ b/packages/core/pipeline/CHANGELOG.md
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.40.2](https://github.com/certd/certd/compare/v1.40.1...v1.40.2) (2026-05-19)
+
+**Note:** Version bump only for package @certd/pipeline
+
+## [1.40.1](https://github.com/certd/certd/compare/v1.40.0...v1.40.1) (2026-05-18)
+
+**Note:** Version bump only for package @certd/pipeline
+
+# [1.40.0](https://github.com/certd/certd/compare/v1.39.16...v1.40.0) (2026-05-14)
+
+**Note:** Version bump only for package @certd/pipeline
+
 ## [1.39.16](https://github.com/certd/certd/compare/v1.39.15...v1.39.16) (2026-05-13)
 
 **Note:** Version bump only for package @certd/pipeline
diff --git a/packages/core/pipeline/package.json b/packages/core/pipeline/package.json
index 910fff5eb..81b17c05e 100644
--- a/packages/core/pipeline/package.json
+++ b/packages/core/pipeline/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@certd/pipeline",
   "private": false,
-  "version": "1.39.16",
+  "version": "1.40.2",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -9,7 +9,7 @@
   "scripts": {
     "dev": "vite",
     "before-build": "rimraf dist && rimraf tsconfig.tsbuildinfo && rimraf .rollup.cache",
-    "build": "npm run before-build && tsc --skipLibCheck",
+    "build": "npm run before-build && tsc -p tsconfig.build.json --skipLibCheck",
     "dev-build": "npm run build",
     "build3": "rollup -c",
     "preview": "vite preview",
@@ -19,8 +19,8 @@
     "compile": "tsc --skipLibCheck --watch"
   },
   "dependencies": {
-    "@certd/basic": "^1.39.16",
-    "@certd/plus-core": "^1.39.16",
+    "@certd/basic": "^1.40.2",
+    "@certd/plus-core": "^1.40.2",
     "dayjs": "^1.11.7",
     "lodash-es": "^4.17.21",
     "reflect-metadata": "^0.1.13"
@@ -49,5 +49,5 @@
     "tslib": "^2.8.1",
     "typescript": "^5.4.2"
   },
-  "gitHead": "1c6dc169ac04fd09ef94404a912a15cbb17e1452"
+  "gitHead": "678b70cee8510a2b5217788c5db9469f49cbd439"
 }
diff --git a/packages/core/pipeline/tsconfig.build.json b/packages/core/pipeline/tsconfig.build.json
new file mode 100644
index 000000000..bcca8fcc1
--- /dev/null
+++ b/packages/core/pipeline/tsconfig.build.json
@@ -0,0 +1,7 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "sourceMap": false,
+    "inlineSourceMap": false
+  }
+}
diff --git a/packages/core/pipeline/tsconfig.json b/packages/core/pipeline/tsconfig.json
index a373edbd8..712b58f0d 100644
--- a/packages/core/pipeline/tsconfig.json
+++ b/packages/core/pipeline/tsconfig.json
@@ -8,7 +8,7 @@
     "experimentalDecorators": true,
     "emitDecoratorMetadata": true,
     "inlineSourceMap": false,
-    "sourceMap": false,
+    "sourceMap": true,
     "noImplicitThis": true,
     "noUnusedLocals": true,
     "importHelpers": true,
diff --git a/packages/libs/lib-huawei/CHANGELOG.md b/packages/libs/lib-huawei/CHANGELOG.md
index 2787e400a..84c7f7854 100644
--- a/packages/libs/lib-huawei/CHANGELOG.md
+++ b/packages/libs/lib-huawei/CHANGELOG.md
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.40.2](https://github.com/certd/certd/compare/v1.40.1...v1.40.2) (2026-05-19)
+
+**Note:** Version bump only for package @certd/lib-huawei
+
+## [1.40.1](https://github.com/certd/certd/compare/v1.40.0...v1.40.1) (2026-05-18)
+
+**Note:** Version bump only for package @certd/lib-huawei
+
+# [1.40.0](https://github.com/certd/certd/compare/v1.39.16...v1.40.0) (2026-05-14)
+
+**Note:** Version bump only for package @certd/lib-huawei
+
 ## [1.39.15](https://github.com/certd/certd/compare/v1.39.14...v1.39.15) (2026-05-13)
 
 **Note:** Version bump only for package @certd/lib-huawei
diff --git a/packages/libs/lib-huawei/package.json b/packages/libs/lib-huawei/package.json
index 3a17e48f5..63f906d00 100644
--- a/packages/libs/lib-huawei/package.json
+++ b/packages/libs/lib-huawei/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@certd/lib-huawei",
   "private": false,
-  "version": "1.39.16",
+  "version": "1.40.2",
   "main": "./dist/bundle.js",
   "module": "./dist/bundle.js",
   "types": "./dist/d/index.d.ts",
@@ -27,5 +27,5 @@
     "prettier": "^2.8.8",
     "tslib": "^2.8.1"
   },
-  "gitHead": "bae5a04dcc0a679c290a9805c3ac4a6020eb6ec0"
+  "gitHead": "678b70cee8510a2b5217788c5db9469f49cbd439"
 }
diff --git a/packages/libs/lib-huawei/rollup.config.js b/packages/libs/lib-huawei/rollup.config.js
index d452ab890..f0bfac5cd 100644
--- a/packages/libs/lib-huawei/rollup.config.js
+++ b/packages/libs/lib-huawei/rollup.config.js
@@ -9,6 +9,7 @@ module.exports = {
   output: {
     file: "dist/bundle.js",
     format: "cjs",
+    sourcemap: false,
   },
   plugins: [
     // 解析第三方依赖
@@ -22,10 +23,13 @@ module.exports = {
       // ],
     }),
     Typescript({
+      tsconfig: "./tsconfig.build.json",
       target: "esnext",
       rootDir: "src",
       declaration: true,
       declarationDir: "dist/d",
+      sourceMap: false,
+      inlineSourceMap: false,
       exclude: ["./node_modules/**", "./src/**/*.vue", "./src/**/*.spec.ts"],
       allowSyntheticDefaultImports: true,
     }),
diff --git a/packages/libs/lib-huawei/tsconfig.build.json b/packages/libs/lib-huawei/tsconfig.build.json
new file mode 100644
index 000000000..bcca8fcc1
--- /dev/null
+++ b/packages/libs/lib-huawei/tsconfig.build.json
@@ -0,0 +1,7 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "sourceMap": false,
+    "inlineSourceMap": false
+  }
+}
diff --git a/packages/libs/lib-huawei/tsconfig.json b/packages/libs/lib-huawei/tsconfig.json
index 30ce7bdc3..0e44e9aa1 100644
--- a/packages/libs/lib-huawei/tsconfig.json
+++ b/packages/libs/lib-huawei/tsconfig.json
@@ -21,7 +21,7 @@
     "composite": false,
     "useDefineForClassFields": true,
     "strict": false,
-    "sourceMap": false,
+    "sourceMap": true,
     "inlineSourceMap": false,
     "resolveJsonModule": true,
     "isolatedModules": false,
diff --git a/packages/libs/lib-iframe/CHANGELOG.md b/packages/libs/lib-iframe/CHANGELOG.md
index 4ae4cb0a0..4a1335d05 100644
--- a/packages/libs/lib-iframe/CHANGELOG.md
+++ b/packages/libs/lib-iframe/CHANGELOG.md
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.40.2](https://github.com/certd/certd/compare/v1.40.1...v1.40.2) (2026-05-19)
+
+**Note:** Version bump only for package @certd/lib-iframe
+
+## [1.40.1](https://github.com/certd/certd/compare/v1.40.0...v1.40.1) (2026-05-18)
+
+**Note:** Version bump only for package @certd/lib-iframe
+
+# [1.40.0](https://github.com/certd/certd/compare/v1.39.16...v1.40.0) (2026-05-14)
+
+**Note:** Version bump only for package @certd/lib-iframe
+
 ## [1.39.15](https://github.com/certd/certd/compare/v1.39.14...v1.39.15) (2026-05-13)
 
 **Note:** Version bump only for package @certd/lib-iframe
diff --git a/packages/libs/lib-iframe/package.json b/packages/libs/lib-iframe/package.json
index 808b94725..1c981ff05 100644
--- a/packages/libs/lib-iframe/package.json
+++ b/packages/libs/lib-iframe/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@certd/lib-iframe",
   "private": false,
-  "version": "1.39.16",
+  "version": "1.40.2",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -9,7 +9,7 @@
   "scripts": {
     "dev": "vite",
     "before-build": "rimraf dist && rimraf tsconfig.tsbuildinfo && rimraf .rollup.cache",
-    "build": "npm run before-build && tsc --skipLibCheck",
+    "build": "npm run before-build && tsc -p tsconfig.build.json --skipLibCheck",
     "dev-build": "npm run build",
     "build3": "rollup -c",
     "build2": "vue-tsc --noEmit && vite build",
@@ -34,5 +34,5 @@
     "tslib": "^2.8.1",
     "typescript": "^5.4.2"
   },
-  "gitHead": "bae5a04dcc0a679c290a9805c3ac4a6020eb6ec0"
+  "gitHead": "678b70cee8510a2b5217788c5db9469f49cbd439"
 }
diff --git a/packages/libs/lib-iframe/tsconfig.build.json b/packages/libs/lib-iframe/tsconfig.build.json
new file mode 100644
index 000000000..bcca8fcc1
--- /dev/null
+++ b/packages/libs/lib-iframe/tsconfig.build.json
@@ -0,0 +1,7 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "sourceMap": false,
+    "inlineSourceMap": false
+  }
+}
diff --git a/packages/libs/lib-iframe/tsconfig.json b/packages/libs/lib-iframe/tsconfig.json
index 08eacac0a..941a89e90 100644
--- a/packages/libs/lib-iframe/tsconfig.json
+++ b/packages/libs/lib-iframe/tsconfig.json
@@ -8,6 +8,7 @@
     "experimentalDecorators": true,
     "emitDecoratorMetadata": true,
     "inlineSourceMap":false,
+    "sourceMap": true,
     "noImplicitThis": true,
     "noUnusedLocals": true,
     "stripInternal": true,
@@ -22,7 +23,6 @@
     "composite": false,
     "useDefineForClassFields": true,
     "strict": false,
-//    "sourceMap": true,
     "resolveJsonModule": true,
     "isolatedModules": true,
     "lib": ["ESNext", "DOM"],
diff --git a/packages/libs/lib-jdcloud/CHANGELOG.md b/packages/libs/lib-jdcloud/CHANGELOG.md
index 131bd36c8..0fe96e5ba 100644
--- a/packages/libs/lib-jdcloud/CHANGELOG.md
+++ b/packages/libs/lib-jdcloud/CHANGELOG.md
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.40.2](https://github.com/certd/certd/compare/v1.40.1...v1.40.2) (2026-05-19)
+
+**Note:** Version bump only for package @certd/jdcloud
+
+## [1.40.1](https://github.com/certd/certd/compare/v1.40.0...v1.40.1) (2026-05-18)
+
+**Note:** Version bump only for package @certd/jdcloud
+
+# [1.40.0](https://github.com/certd/certd/compare/v1.39.16...v1.40.0) (2026-05-14)
+
+**Note:** Version bump only for package @certd/jdcloud
+
 ## [1.39.15](https://github.com/certd/certd/compare/v1.39.14...v1.39.15) (2026-05-13)
 
 **Note:** Version bump only for package @certd/jdcloud
diff --git a/packages/libs/lib-jdcloud/package.json b/packages/libs/lib-jdcloud/package.json
index d047f0979..571a8a2bb 100644
--- a/packages/libs/lib-jdcloud/package.json
+++ b/packages/libs/lib-jdcloud/package.json
@@ -1,12 +1,13 @@
 {
   "name": "@certd/jdcloud",
-  "version": "1.39.16",
+  "version": "1.40.2",
   "description": "jdcloud openApi sdk",
   "main": "./dist/bundle.js",
   "module": "./dist/bundle.js",
   "types": "./dist/d/index.d.ts",
   "scripts": {
-    "build": "rollup -c ",
+    "before-build": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true});fs.rmSync('tsconfig.tsbuildinfo',{force:true});fs.rmSync('.rollup.cache',{recursive:true,force:true});\"",
+    "build": "npm run before-build && rollup -c ",
     "dev-build": "npm run build",
     "test:unit": "cross-env NODE_ENV=unittest echo no unit tests",
     "pub": "npm publish"
@@ -58,5 +59,5 @@
       "fetch"
     ]
   },
-  "gitHead": "bae5a04dcc0a679c290a9805c3ac4a6020eb6ec0"
+  "gitHead": "678b70cee8510a2b5217788c5db9469f49cbd439"
 }
diff --git a/packages/libs/lib-jdcloud/rollup.config.js b/packages/libs/lib-jdcloud/rollup.config.js
index d452ab890..f0bfac5cd 100644
--- a/packages/libs/lib-jdcloud/rollup.config.js
+++ b/packages/libs/lib-jdcloud/rollup.config.js
@@ -9,6 +9,7 @@ module.exports = {
   output: {
     file: "dist/bundle.js",
     format: "cjs",
+    sourcemap: false,
   },
   plugins: [
     // 解析第三方依赖
@@ -22,10 +23,13 @@ module.exports = {
       // ],
     }),
     Typescript({
+      tsconfig: "./tsconfig.build.json",
       target: "esnext",
       rootDir: "src",
       declaration: true,
       declarationDir: "dist/d",
+      sourceMap: false,
+      inlineSourceMap: false,
       exclude: ["./node_modules/**", "./src/**/*.vue", "./src/**/*.spec.ts"],
       allowSyntheticDefaultImports: true,
     }),
diff --git a/packages/libs/lib-jdcloud/tsconfig.build.json b/packages/libs/lib-jdcloud/tsconfig.build.json
new file mode 100644
index 000000000..bcca8fcc1
--- /dev/null
+++ b/packages/libs/lib-jdcloud/tsconfig.build.json
@@ -0,0 +1,7 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "sourceMap": false,
+    "inlineSourceMap": false
+  }
+}
diff --git a/packages/libs/lib-jdcloud/tsconfig.json b/packages/libs/lib-jdcloud/tsconfig.json
index 30ce7bdc3..0e44e9aa1 100644
--- a/packages/libs/lib-jdcloud/tsconfig.json
+++ b/packages/libs/lib-jdcloud/tsconfig.json
@@ -21,7 +21,7 @@
     "composite": false,
     "useDefineForClassFields": true,
     "strict": false,
-    "sourceMap": false,
+    "sourceMap": true,
     "inlineSourceMap": false,
     "resolveJsonModule": true,
     "isolatedModules": false,
diff --git a/packages/libs/lib-k8s/CHANGELOG.md b/packages/libs/lib-k8s/CHANGELOG.md
index 096831196..0255cb3e7 100644
--- a/packages/libs/lib-k8s/CHANGELOG.md
+++ b/packages/libs/lib-k8s/CHANGELOG.md
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.40.2](https://github.com/certd/certd/compare/v1.40.1...v1.40.2) (2026-05-19)
+
+**Note:** Version bump only for package @certd/lib-k8s
+
+## [1.40.1](https://github.com/certd/certd/compare/v1.40.0...v1.40.1) (2026-05-18)
+
+**Note:** Version bump only for package @certd/lib-k8s
+
+# [1.40.0](https://github.com/certd/certd/compare/v1.39.16...v1.40.0) (2026-05-14)
+
+**Note:** Version bump only for package @certd/lib-k8s
+
 ## [1.39.16](https://github.com/certd/certd/compare/v1.39.15...v1.39.16) (2026-05-13)
 
 **Note:** Version bump only for package @certd/lib-k8s
diff --git a/packages/libs/lib-k8s/package.json b/packages/libs/lib-k8s/package.json
index 2b0f5f2d1..d6b23fa00 100644
--- a/packages/libs/lib-k8s/package.json
+++ b/packages/libs/lib-k8s/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@certd/lib-k8s",
   "private": false,
-  "version": "1.39.16",
+  "version": "1.40.2",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -9,7 +9,7 @@
   "scripts": {
     "dev": "vite",
     "before-build": "rimraf dist && rimraf tsconfig.tsbuildinfo && rimraf .rollup.cache",
-    "build": "npm run before-build && tsc --skipLibCheck",
+    "build": "npm run before-build && tsc -p tsconfig.build.json --skipLibCheck",
     "dev-build": "npm run build",
     "build3": "rollup -c",
     "build2": "vue-tsc --noEmit && vite build",
@@ -19,7 +19,7 @@
     "compile": "tsc --skipLibCheck --watch"
   },
   "dependencies": {
-    "@certd/basic": "^1.39.16",
+    "@certd/basic": "^1.40.2",
     "@kubernetes/client-node": "0.21.0"
   },
   "devDependencies": {
@@ -36,5 +36,5 @@
     "tslib": "^2.8.1",
     "typescript": "^5.4.2"
   },
-  "gitHead": "1c6dc169ac04fd09ef94404a912a15cbb17e1452"
+  "gitHead": "678b70cee8510a2b5217788c5db9469f49cbd439"
 }
diff --git a/packages/libs/lib-k8s/tsconfig.build.json b/packages/libs/lib-k8s/tsconfig.build.json
new file mode 100644
index 000000000..bcca8fcc1
--- /dev/null
+++ b/packages/libs/lib-k8s/tsconfig.build.json
@@ -0,0 +1,7 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "sourceMap": false,
+    "inlineSourceMap": false
+  }
+}
diff --git a/packages/libs/lib-k8s/tsconfig.json b/packages/libs/lib-k8s/tsconfig.json
index 08eacac0a..941a89e90 100644
--- a/packages/libs/lib-k8s/tsconfig.json
+++ b/packages/libs/lib-k8s/tsconfig.json
@@ -8,6 +8,7 @@
     "experimentalDecorators": true,
     "emitDecoratorMetadata": true,
     "inlineSourceMap":false,
+    "sourceMap": true,
     "noImplicitThis": true,
     "noUnusedLocals": true,
     "stripInternal": true,
@@ -22,7 +23,6 @@
     "composite": false,
     "useDefineForClassFields": true,
     "strict": false,
-//    "sourceMap": true,
     "resolveJsonModule": true,
     "isolatedModules": true,
     "lib": ["ESNext", "DOM"],
diff --git a/packages/libs/lib-server/CHANGELOG.md b/packages/libs/lib-server/CHANGELOG.md
index 9971d6c17..aef51d69a 100644
--- a/packages/libs/lib-server/CHANGELOG.md
+++ b/packages/libs/lib-server/CHANGELOG.md
@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.40.2](https://github.com/certd/certd/compare/v1.40.1...v1.40.2) (2026-05-19)
+
+**Note:** Version bump only for package @certd/lib-server
+
+## [1.40.1](https://github.com/certd/certd/compare/v1.40.0...v1.40.1) (2026-05-18)
+
+**Note:** Version bump only for package @certd/lib-server
+
+# [1.40.0](https://github.com/certd/certd/compare/v1.39.16...v1.40.0) (2026-05-14)
+
+### Features
+
+* 彩虹登录支持选择多种登录方式 ([7aa0c7e](https://github.com/certd/certd/commit/7aa0c7e491fe660abb62e68792ff5474f19bd5b8))
+
 ## [1.39.16](https://github.com/certd/certd/compare/v1.39.15...v1.39.16) (2026-05-13)
 
 **Note:** Version bump only for package @certd/lib-server
diff --git a/packages/libs/lib-server/package.json b/packages/libs/lib-server/package.json
index 04fd5d532..70b27afae 100644
--- a/packages/libs/lib-server/package.json
+++ b/packages/libs/lib-server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@certd/lib-server",
-  "version": "1.39.16",
+  "version": "1.40.2",
   "description": "midway with flyway, sql upgrade way ",
   "private": false,
   "type": "module",
@@ -9,7 +9,7 @@
   "types": "./dist/index.d.ts",
   "scripts": {
     "before-build": "rimraf dist && rimraf tsconfig.tsbuildinfo && rimraf .rollup.cache",
-    "build": "npm run before-build && tsc --skipLibCheck",
+    "build": "npm run before-build && tsc -p tsconfig.build.json --skipLibCheck",
     "dev-build": "npm run build",
     "test": "midway-bin test --ts -V",
     "test:unit": "cross-env NODE_ENV=unittest mocha --no-config --node-option no-warnings --node-option loader=ts-node/esm \"src/**/*.test.ts\"",
@@ -29,11 +29,11 @@
   ],
   "license": "AGPL",
   "dependencies": {
-    "@certd/acme-client": "^1.39.16",
-    "@certd/basic": "^1.39.16",
-    "@certd/pipeline": "^1.39.16",
-    "@certd/plugin-lib": "^1.39.16",
-    "@certd/plus-core": "^1.39.16",
+    "@certd/acme-client": "^1.40.2",
+    "@certd/basic": "^1.40.2",
+    "@certd/pipeline": "^1.40.2",
+    "@certd/plugin-lib": "^1.40.2",
+    "@certd/plus-core": "^1.40.2",
     "@midwayjs/cache": "3.14.0",
     "@midwayjs/core": "3.20.11",
     "@midwayjs/i18n": "3.20.13",
@@ -69,5 +69,5 @@
     "typeorm": "^0.3.11",
     "typescript": "^5.4.2"
   },
-  "gitHead": "1c6dc169ac04fd09ef94404a912a15cbb17e1452"
+  "gitHead": "678b70cee8510a2b5217788c5db9469f49cbd439"
 }
diff --git a/packages/libs/lib-server/src/system/settings/service/models.ts b/packages/libs/lib-server/src/system/settings/service/models.ts
index c8daffbaf..d81e897ff 100644
--- a/packages/libs/lib-server/src/system/settings/service/models.ts
+++ b/packages/libs/lib-server/src/system/settings/service/models.ts
@@ -253,6 +253,14 @@ export class SysSuiteSetting extends BaseSettings {
   intro?: string;
 }
 
+export class SysAutoFixSetting extends BaseSettings {
+  static __title__ = '自动修复记录';
+  static __key__ = 'sys.auto.fix';
+  static __access__ = 'private';
+
+  fixed: Record<string, boolean> = {};
+}
+
 
 export type SiteHidden = {
   enabled: boolean;
diff --git a/packages/libs/lib-server/tsconfig.build.json b/packages/libs/lib-server/tsconfig.build.json
new file mode 100644
index 000000000..bcca8fcc1
--- /dev/null
+++ b/packages/libs/lib-server/tsconfig.build.json
@@ -0,0 +1,7 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "sourceMap": false,
+    "inlineSourceMap": false
+  }
+}
diff --git a/packages/libs/lib-server/tsconfig.json b/packages/libs/lib-server/tsconfig.json
index eb9e15f0a..d3e3b5798 100644
--- a/packages/libs/lib-server/tsconfig.json
+++ b/packages/libs/lib-server/tsconfig.json
@@ -9,7 +9,7 @@
     "experimentalDecorators": true,
     "emitDecoratorMetadata": true,
     "inlineSourceMap": false,
-    "sourceMap": false,
+    "sourceMap": true,
     "noImplicitThis": true,
     "noUnusedLocals": true,
     "stripInternal": true,
diff --git a/packages/libs/midway-flyway-js/CHANGELOG.md b/packages/libs/midway-flyway-js/CHANGELOG.md
index d88d7d2ac..70e28700c 100644
--- a/packages/libs/midway-flyway-js/CHANGELOG.md
+++ b/packages/libs/midway-flyway-js/CHANGELOG.md
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.40.2](https://github.com/certd/certd/compare/v1.40.1...v1.40.2) (2026-05-19)
+
+**Note:** Version bump only for package @certd/midway-flyway-js
+
+## [1.40.1](https://github.com/certd/certd/compare/v1.40.0...v1.40.1) (2026-05-18)
+
+**Note:** Version bump only for package @certd/midway-flyway-js
+
+# [1.40.0](https://github.com/certd/certd/compare/v1.39.16...v1.40.0) (2026-05-14)
+
+**Note:** Version bump only for package @certd/midway-flyway-js
+
 ## [1.39.15](https://github.com/certd/certd/compare/v1.39.14...v1.39.15) (2026-05-13)
 
 **Note:** Version bump only for package @certd/midway-flyway-js
diff --git a/packages/libs/midway-flyway-js/package.json b/packages/libs/midway-flyway-js/package.json
index 3a49d67ad..b75df64f0 100644
--- a/packages/libs/midway-flyway-js/package.json
+++ b/packages/libs/midway-flyway-js/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@certd/midway-flyway-js",
-  "version": "1.39.16",
+  "version": "1.40.2",
   "description": "midway with flyway, sql upgrade way ",
   "private": false,
   "type": "module",
@@ -9,7 +9,7 @@
   "types": "./dist/index.d.ts",
   "scripts": {
     "before-build": "rimraf dist && rimraf tsconfig.tsbuildinfo && rimraf .rollup.cache",
-    "build": "npm run before-build && tsc --skipLibCheck",
+    "build": "npm run before-build && tsc -p tsconfig.build.json --skipLibCheck",
     "dev-build": "npm run build",
     "test": "midway-bin test --ts -V",
     "test1": "midway-bin test --ts -V -f test/blank.test.ts -t 'hash-check'",
@@ -49,5 +49,5 @@
     "typeorm": "^0.3.11",
     "typescript": "^5.4.2"
   },
-  "gitHead": "bae5a04dcc0a679c290a9805c3ac4a6020eb6ec0"
+  "gitHead": "678b70cee8510a2b5217788c5db9469f49cbd439"
 }
diff --git a/packages/libs/midway-flyway-js/tsconfig.build.json b/packages/libs/midway-flyway-js/tsconfig.build.json
new file mode 100644
index 000000000..bcca8fcc1
--- /dev/null
+++ b/packages/libs/midway-flyway-js/tsconfig.build.json
@@ -0,0 +1,7 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "sourceMap": false,
+    "inlineSourceMap": false
+  }
+}
diff --git a/packages/libs/midway-flyway-js/tsconfig.json b/packages/libs/midway-flyway-js/tsconfig.json
index b58913cf7..ef1f93865 100644
--- a/packages/libs/midway-flyway-js/tsconfig.json
+++ b/packages/libs/midway-flyway-js/tsconfig.json
@@ -8,6 +8,7 @@
     "experimentalDecorators": true,
     "emitDecoratorMetadata": true,
     "inlineSourceMap":false,
+    "sourceMap": true,
     "noImplicitThis": true,
     "noUnusedLocals": true,
     "stripInternal": true,
@@ -21,7 +22,6 @@
     "composite": false,
     "useDefineForClassFields": true,
     "strict": false,
-//    "sourceMap": true,
     "resolveJsonModule": true,
     "isolatedModules": true,
     "lib": ["ESNext", "DOM"],
diff --git a/packages/plugins/plugin-cert/CHANGELOG.md b/packages/plugins/plugin-cert/CHANGELOG.md
index 3854a8d88..9b8ba5351 100644
--- a/packages/plugins/plugin-cert/CHANGELOG.md
+++ b/packages/plugins/plugin-cert/CHANGELOG.md
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.40.2](https://github.com/certd/certd/compare/v1.40.1...v1.40.2) (2026-05-19)
+
+**Note:** Version bump only for package @certd/plugin-cert
+
+## [1.40.1](https://github.com/certd/certd/compare/v1.40.0...v1.40.1) (2026-05-18)
+
+**Note:** Version bump only for package @certd/plugin-cert
+
+# [1.40.0](https://github.com/certd/certd/compare/v1.39.16...v1.40.0) (2026-05-14)
+
+**Note:** Version bump only for package @certd/plugin-cert
+
 ## [1.39.16](https://github.com/certd/certd/compare/v1.39.15...v1.39.16) (2026-05-13)
 
 **Note:** Version bump only for package @certd/plugin-cert
diff --git a/packages/plugins/plugin-cert/package.json b/packages/plugins/plugin-cert/package.json
index b36e0ba7d..31f02fea9 100644
--- a/packages/plugins/plugin-cert/package.json
+++ b/packages/plugins/plugin-cert/package.json
@@ -1,14 +1,14 @@
 {
   "name": "@certd/plugin-cert",
   "private": false,
-  "version": "1.39.16",
+  "version": "1.40.2",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "scripts": {
     "dev": "vite",
     "before-build": "rimraf dist && rimraf tsconfig.tsbuildinfo && rimraf .rollup.cache",
-    "build": "tsc --skipLibCheck",
+    "build": "tsc -p tsconfig.build.json --skipLibCheck",
     "dev-build": "npm run build",
     "build3": "rollup -c",
     "build2": "vue-tsc --noEmit && vite build",
@@ -18,10 +18,10 @@
     "compile": "tsc --skipLibCheck --watch"
   },
   "dependencies": {
-    "@certd/acme-client": "^1.39.16",
-    "@certd/basic": "^1.39.16",
-    "@certd/pipeline": "^1.39.16",
-    "@certd/plugin-lib": "^1.39.16",
+    "@certd/acme-client": "^1.40.2",
+    "@certd/basic": "^1.40.2",
+    "@certd/pipeline": "^1.40.2",
+    "@certd/plugin-lib": "^1.40.2",
     "psl": "^1.9.0",
     "punycode.js": "^2.3.1"
   },
@@ -41,5 +41,5 @@
     "tslib": "^2.8.1",
     "typescript": "^5.4.2"
   },
-  "gitHead": "1c6dc169ac04fd09ef94404a912a15cbb17e1452"
+  "gitHead": "678b70cee8510a2b5217788c5db9469f49cbd439"
 }
diff --git a/packages/plugins/plugin-cert/tsconfig.build.json b/packages/plugins/plugin-cert/tsconfig.build.json
new file mode 100644
index 000000000..bcca8fcc1
--- /dev/null
+++ b/packages/plugins/plugin-cert/tsconfig.build.json
@@ -0,0 +1,7 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "sourceMap": false,
+    "inlineSourceMap": false
+  }
+}
diff --git a/packages/plugins/plugin-cert/tsconfig.json b/packages/plugins/plugin-cert/tsconfig.json
index 1bbe778b5..412cf45b7 100644
--- a/packages/plugins/plugin-cert/tsconfig.json
+++ b/packages/plugins/plugin-cert/tsconfig.json
@@ -8,7 +8,7 @@
     "experimentalDecorators": true,
     "emitDecoratorMetadata": true,
     "inlineSourceMap":false,
-    "sourceMap": false,
+    "sourceMap": true,
     "noImplicitThis": true,
     "noUnusedLocals": true,
     "stripInternal": true,
diff --git a/packages/plugins/plugin-lib/CHANGELOG.md b/packages/plugins/plugin-lib/CHANGELOG.md
index 84dc54f42..0ef88d7d1 100644
--- a/packages/plugins/plugin-lib/CHANGELOG.md
+++ b/packages/plugins/plugin-lib/CHANGELOG.md
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.40.2](https://github.com/certd/certd/compare/v1.40.1...v1.40.2) (2026-05-19)
+
+**Note:** Version bump only for package @certd/plugin-lib
+
+## [1.40.1](https://github.com/certd/certd/compare/v1.40.0...v1.40.1) (2026-05-18)
+
+**Note:** Version bump only for package @certd/plugin-lib
+
+# [1.40.0](https://github.com/certd/certd/compare/v1.39.16...v1.40.0) (2026-05-14)
+
+**Note:** Version bump only for package @certd/plugin-lib
+
 ## [1.39.16](https://github.com/certd/certd/compare/v1.39.15...v1.39.16) (2026-05-13)
 
 **Note:** Version bump only for package @certd/plugin-lib
diff --git a/packages/plugins/plugin-lib/package.json b/packages/plugins/plugin-lib/package.json
index 867cf2467..027c65207 100644
--- a/packages/plugins/plugin-lib/package.json
+++ b/packages/plugins/plugin-lib/package.json
@@ -1,14 +1,14 @@
 {
   "name": "@certd/plugin-lib",
   "private": false,
-  "version": "1.39.16",
+  "version": "1.40.2",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "scripts": {
     "dev": "vite",
     "before-build": "rimraf dist && rimraf tsconfig.tsbuildinfo && rimraf .rollup.cache",
-    "build": "npm run before-build &&tsc --skipLibCheck",
+    "build": "npm run before-build && tsc -p tsconfig.build.json --skipLibCheck",
     "dev-build": "npm run build",
     "build3": "rollup -c",
     "build2": "vue-tsc --noEmit && vite build",
@@ -23,10 +23,10 @@
     "@alicloud/pop-core": "^1.7.10",
     "@alicloud/tea-util": "^1.4.11",
     "@aws-sdk/client-s3": "^3.964.0",
-    "@certd/acme-client": "^1.39.16",
-    "@certd/basic": "^1.39.16",
-    "@certd/pipeline": "^1.39.16",
-    "@certd/plus-core": "^1.39.16",
+    "@certd/acme-client": "^1.40.2",
+    "@certd/basic": "^1.40.2",
+    "@certd/pipeline": "^1.40.2",
+    "@certd/plus-core": "^1.40.2",
     "@kubernetes/client-node": "0.21.0",
     "ali-oss": "^6.22.0",
     "basic-ftp": "^5.0.5",
@@ -61,5 +61,5 @@
     "tslib": "^2.8.1",
     "typescript": "^5.4.2"
   },
-  "gitHead": "1c6dc169ac04fd09ef94404a912a15cbb17e1452"
+  "gitHead": "678b70cee8510a2b5217788c5db9469f49cbd439"
 }
diff --git a/packages/plugins/plugin-lib/tsconfig.build.json b/packages/plugins/plugin-lib/tsconfig.build.json
new file mode 100644
index 000000000..bcca8fcc1
--- /dev/null
+++ b/packages/plugins/plugin-lib/tsconfig.build.json
@@ -0,0 +1,7 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "sourceMap": false,
+    "inlineSourceMap": false
+  }
+}
diff --git a/packages/plugins/plugin-lib/tsconfig.json b/packages/plugins/plugin-lib/tsconfig.json
index 5c89236a6..47b6febd0 100644
--- a/packages/plugins/plugin-lib/tsconfig.json
+++ b/packages/plugins/plugin-lib/tsconfig.json
@@ -8,7 +8,7 @@
     "experimentalDecorators": true,
     "emitDecoratorMetadata": true,
     "inlineSourceMap": false,
-    "sourceMap": false,
+    "sourceMap": true,
     "noImplicitThis": true,
     "noUnusedLocals": true,
     "stripInternal": true,
diff --git a/packages/ui/certd-client/CHANGELOG.md b/packages/ui/certd-client/CHANGELOG.md
index 1df7467f1..bdaa197da 100644
--- a/packages/ui/certd-client/CHANGELOG.md
+++ b/packages/ui/certd-client/CHANGELOG.md
@@ -3,6 +3,33 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.40.2](https://github.com/certd/certd/compare/v1.40.1...v1.40.2) (2026-05-19)
+
+**Note:** Version bump only for package @certd/ui-client
+
+## [1.40.1](https://github.com/certd/certd/compare/v1.40.0...v1.40.1) (2026-05-18)
+
+### Performance Improvements
+
+* 商业版支持限制泛域名数量 ([c63745d](https://github.com/certd/certd/commit/c63745d1ba30904428ba6b13ab0785298baa5cae))
+* **suite:** 商业版用户已购套餐支持修改 ([bdb3d09](https://github.com/certd/certd/commit/bdb3d09c09fc73e7e5e3401f6ef5588bf8ad5088))
+
+# [1.40.0](https://github.com/certd/certd/compare/v1.39.16...v1.40.0) (2026-05-14)
+
+### Bug Fixes
+
+* 修复第三方登录丢失state时无法在用户信息页面绑定第三方账号的bug ([45dedf5](https://github.com/certd/certd/commit/45dedf5bc779fea852e1f33dda4f31db2765633c))
+* 修复群晖授权没有显示设备id输入框的bug ([2f172b5](https://github.com/certd/certd/commit/2f172b56e9411303ca15138d827bdb9bafdae4d1))
+* 修复自动注册后没有跳转到控制台的bug ([4681ec9](https://github.com/certd/certd/commit/4681ec90088a3eb665427b2ac4047ec5ccefd7b3))
+
+### Features
+
+* 彩虹登录支持选择多种登录方式 ([7aa0c7e](https://github.com/certd/certd/commit/7aa0c7e491fe660abb62e68792ff5474f19bd5b8))
+
+### Performance Improvements
+
+* 头像增加缓存时间 ([7015b1b](https://github.com/certd/certd/commit/7015b1b232602e5168a3eb8bee6d7f1776ae1e74))
+
 ## [1.39.16](https://github.com/certd/certd/compare/v1.39.15...v1.39.16) (2026-05-13)
 
 **Note:** Version bump only for package @certd/ui-client
diff --git a/packages/ui/certd-client/package.json b/packages/ui/certd-client/package.json
index 8876e98be..ace0670d5 100644
--- a/packages/ui/certd-client/package.json
+++ b/packages/ui/certd-client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@certd/ui-client",
-  "version": "1.39.16",
+  "version": "1.40.2",
   "private": true,
   "scripts": {
     "dev": "vite --open",
@@ -106,8 +106,8 @@
     "zod-defaults": "^0.1.3"
   },
   "devDependencies": {
-    "@certd/lib-iframe": "^1.39.16",
-    "@certd/pipeline": "^1.39.16",
+    "@certd/lib-iframe": "^1.40.2",
+    "@certd/pipeline": "^1.40.2",
     "@rollup/plugin-commonjs": "^25.0.7",
     "@rollup/plugin-node-resolve": "^15.2.3",
     "@types/chai": "^4.3.12",
diff --git a/packages/ui/certd-client/src/locales/langs/en-US/authentication.ts b/packages/ui/certd-client/src/locales/langs/en-US/authentication.ts
index aba15f531..77a08fb85 100644
--- a/packages/ui/certd-client/src/locales/langs/en-US/authentication.ts
+++ b/packages/ui/certd-client/src/locales/langs/en-US/authentication.ts
@@ -78,8 +78,13 @@ export default {
   passkeyRegisterFailed: "Passkey registration failed",
   title: "Change Password",
   weakPasswordWarning: "For your account security, please change your password immediately",
+  initPasswordWarning: "This account does not have a login password yet. Please set one first",
+  initPasswordTitle: "Set Password",
   changeNow: "Change Now",
+  setNow: "Set Now",
+  notNow: "Not Now",
   successMessage: "Changed successfully",
+  initPasswordSuccessMessage: "Set successfully",
   oldPassword: "Old Password",
   oldPasswordRequired: "Please enter the old password",
   newPassword: "New Password",
diff --git a/packages/ui/certd-client/src/locales/langs/en-US/certd/common.ts b/packages/ui/certd-client/src/locales/langs/en-US/certd/common.ts
index a9401229a..39c78dac4 100644
--- a/packages/ui/certd-client/src/locales/langs/en-US/certd/common.ts
+++ b/packages/ui/certd-client/src/locales/langs/en-US/certd/common.ts
@@ -40,6 +40,9 @@ export default {
   basicInfo: "Basic Information",
   disabled: "Disabled",
   enabled: "Enabled",
+  enabledLabel: "Enabled",
+  normal: "Normal",
+  used_up: "Used up",
   default: "Default",
   success: "Success",
   test: "Test",
diff --git a/packages/ui/certd-client/src/locales/langs/en-US/certd/suite.ts b/packages/ui/certd-client/src/locales/langs/en-US/certd/suite.ts
index 5fa3e3692..984315eac 100644
--- a/packages/ui/certd-client/src/locales/langs/en-US/certd/suite.ts
+++ b/packages/ui/certd-client/src/locales/langs/en-US/certd/suite.ts
@@ -6,6 +6,9 @@ export default {
     specifications: "Specifications",
     pipeline: "Pipeline",
     domain: "Domain",
+    totalDomain: "Total Domain Count",
+    wildcardDomain: "Wildcard Domain",
+    includedWildcardDomain: "Included Wildcard Domain Count",
     deployTimes: "Deployments",
     monitorCount: "DomainMonitors",
     duration: "Duration",
@@ -24,11 +27,13 @@ export default {
   please_select_package: "Please select a package",
   package: "Package",
   addon_package: "Addon Package",
-  domain_count: "Domain Count",
+  domain_count: "Total Domain Count",
+  wildcard_domain_count: "Wildcard Domain Count",
   unit_count: "pcs",
   pipeline_count: "Pipeline Count",
   unit_item: "items",
   deploy_count: "Deploy Count",
+  deploy_count_used: "Used Deploy Count",
   unit_times: "times",
   monitor_count: "Certificate Monitor Count",
   duration: "Duration",
@@ -42,6 +47,7 @@ export default {
   intro: "Introduction",
   packageContent: "Package Content",
   maxDomainCount: "Max Domain Count",
+  maxWildcardDomainCount: "Max Wildcard Domain Count",
   maxPipelineCount: "Max Pipeline Count",
   maxDeployCount: "Max Deploy Count",
   maxMonitorCount: "Max Monitor Count",
@@ -51,6 +57,10 @@ export default {
   addon: "Addon",
   typeHelper: "Suite: Only the most recently purchased one is active at a time\nAddon: Multiple can be purchased, effective immediately without affecting the suite\nThe quantities of suite and addon can be accumulated",
   pipelineCount: "Pipeline Count",
+  wildcardDomainCount: "Wildcard Domain Count",
+  wildcardDomainCountPart: "Included Wildcard Domain Count",
+  wildcardDomainCountSub: "- Wildcard Domain Count",
+  wildcardDomainCountHelper: "Wildcard domains are also limited by the total domain count: each wildcard domain consumes both domain count and wildcard domain count quota.",
   unitPipeline: "pipelines",
   deployCount: "Deployment Count",
   unitDeploy: "times",
diff --git a/packages/ui/certd-client/src/locales/langs/zh-CN/authentication.ts b/packages/ui/certd-client/src/locales/langs/zh-CN/authentication.ts
index 4ec2f109f..f4e23f5ef 100644
--- a/packages/ui/certd-client/src/locales/langs/zh-CN/authentication.ts
+++ b/packages/ui/certd-client/src/locales/langs/zh-CN/authentication.ts
@@ -79,8 +79,13 @@ export default {
 
   title: "修改密码",
   weakPasswordWarning: "为了您的账户安全，请立即修改密码",
+  initPasswordWarning: "当前账号还未设置登录密码，请先设置密码",
+  initPasswordTitle: "设置密码",
   changeNow: "立即修改",
+  setNow: "立即设置",
+  notNow: "暂不设置",
   successMessage: "修改成功",
+  initPasswordSuccessMessage: "设置成功",
   oldPassword: "旧密码",
   oldPasswordRequired: "请输入旧密码",
   newPassword: "新密码",
diff --git a/packages/ui/certd-client/src/locales/langs/zh-CN/certd/common.ts b/packages/ui/certd-client/src/locales/langs/zh-CN/certd/common.ts
index 76874ac62..c68b5d3fb 100644
--- a/packages/ui/certd-client/src/locales/langs/zh-CN/certd/common.ts
+++ b/packages/ui/certd-client/src/locales/langs/zh-CN/certd/common.ts
@@ -44,6 +44,9 @@ export default {
   basicInfo: "基础信息",
   disabled: "禁用",
   enabled: "启用",
+  enabledLabel: "启用",
+  normal: "正常",
+  used_up: "已用完",
   default: "默认",
   success: "成功",
   test: "测试",
diff --git a/packages/ui/certd-client/src/locales/langs/zh-CN/certd/suite.ts b/packages/ui/certd-client/src/locales/langs/zh-CN/certd/suite.ts
index 76f0795bc..12186ea6e 100644
--- a/packages/ui/certd-client/src/locales/langs/zh-CN/certd/suite.ts
+++ b/packages/ui/certd-client/src/locales/langs/zh-CN/certd/suite.ts
@@ -6,6 +6,9 @@ export default {
     specifications: "规格",
     pipeline: "流水线",
     domain: "域名",
+    totalDomain: "域名总数量",
+    wildcardDomain: "泛域名",
+    includedWildcardDomain: "其中泛域名数量",
     deployTimes: "部署次数",
     monitorCount: "域名监控数",
     duration: "时长",
@@ -24,11 +27,13 @@ export default {
   please_select_package: "请选择套餐",
   package: "套餐",
   addon_package: "加量包",
-  domain_count: "域名数量",
+  domain_count: "域名总数量",
+  wildcard_domain_count: "泛域名数量",
   unit_count: "个",
   pipeline_count: "流水线数量",
   unit_item: "条",
   deploy_count: "部署次数",
+  deploy_count_used: "已用部署次数",
   unit_times: "次",
   monitor_count: "证书监控数量",
   duration: "时长",
@@ -42,6 +47,7 @@ export default {
   intro: "介绍",
   packageContent: "套餐内容",
   maxDomainCount: "最大域名数",
+  maxWildcardDomainCount: "最大泛域名数",
   maxPipelineCount: "最大流水线数",
   maxDeployCount: "最大部署数",
   maxMonitorCount: "最大监控数",
@@ -51,6 +57,10 @@ export default {
   addon: "加量包",
   typeHelper: "套餐：同一时间只有最新购买的一个生效\n加量包：可购买多个，购买后立即生效，不影响套餐\n套餐和加量包数量可叠加",
   pipelineCount: "流水线数量",
+  wildcardDomainCount: "泛域名数量",
+  wildcardDomainCountPart: "其中泛域名数量",
+  wildcardDomainCountSub: "- 泛域名数量",
+  wildcardDomainCountHelper: "泛域名数量受域名总数量限制：泛域名会同时占用域名总数量和泛域名数量额度；注意：如果域名总数有限制，泛域名数量不要设置为无限制。",
   unitPipeline: "条",
   deployCount: "部署次数",
   unitDeploy: "次",
diff --git a/packages/ui/certd-client/src/store/user/api.user.ts b/packages/ui/certd-client/src/store/user/api.user.ts
index e358c760c..498c08abe 100644
--- a/packages/ui/certd-client/src/store/user/api.user.ts
+++ b/packages/ui/certd-client/src/store/user/api.user.ts
@@ -38,6 +38,7 @@ export interface UserInfoRes {
   avatar?: string;
   roleIds: number[];
   isWeak?: boolean;
+  needInitPassword?: boolean;
   validTime?: number;
   status?: number;
 }
diff --git a/packages/ui/certd-client/src/use/use-refrence.tsx b/packages/ui/certd-client/src/use/use-refrence.tsx
index 709318236..e756b7a55 100644
--- a/packages/ui/certd-client/src/use/use-refrence.tsx
+++ b/packages/ui/certd-client/src/use/use-refrence.tsx
@@ -13,7 +13,6 @@ export function useReference(formItem: any) {
     const ctx = {
       compute: (opts: any) => {
         const func = (context: any) => {
-          debugger;
           let form = context.form || {};
           form = form.input || form.body || form; // form.access去掉，历史原因，access的mergeScript会处理form.access
           return opts({
diff --git a/packages/ui/certd-client/src/views/certd/mine/api.ts b/packages/ui/certd-client/src/views/certd/mine/api.ts
index 5cabbd16c..04bcd69fd 100644
--- a/packages/ui/certd-client/src/views/certd/mine/api.ts
+++ b/packages/ui/certd-client/src/views/certd/mine/api.ts
@@ -15,6 +15,14 @@ export async function changePassword(form: any) {
   });
 }
 
+export async function initPassword(form: any) {
+  return await request({
+    url: "/mine/initPassword",
+    method: "POST",
+    data: form,
+  });
+}
+
 export async function UpdateProfile(form: any) {
   return await request({
     url: "/mine/updateProfile",
diff --git a/packages/ui/certd-client/src/views/certd/mine/change-password-button.vue b/packages/ui/certd-client/src/views/certd/mine/change-password-button.vue
index a1b530de6..ed2f2ec3c 100644
--- a/packages/ui/certd-client/src/views/certd/mine/change-password-button.vue
+++ b/packages/ui/certd-client/src/views/certd/mine/change-password-button.vue
@@ -9,7 +9,7 @@ import { ref } from "vue";
 import { useI18n } from "/src/locales";
 
 const { t } = useI18n();
-import { CrudOptions, useColumns, useFormWrapper } from "@fast-crud/fast-crud";
+import { compute, CrudOptions, useColumns, useFormWrapper } from "@fast-crud/fast-crud";
 import * as api from "/@/views/certd/mine/api";
 import { notification } from "ant-design-vue";
 import { useUserStore } from "/@/store/user";
@@ -20,6 +20,11 @@ defineProps<{
 
 let passwordFormRef = ref();
 
+type OpenOptions = {
+  password?: string;
+  init?: boolean;
+};
+
 const validatePass1 = async (rule: any, value: any) => {
   if (value === "") {
     throw new Error(t("authentication.enterPassword"));
@@ -53,19 +58,33 @@ const passwordFormOptions: CrudOptions = {
       width: "500px",
     },
     async doSubmit({ form }) {
-      await api.changePassword(form);
+      if (form.init) {
+        await api.initPassword(form);
+      } else {
+        await api.changePassword(form);
+      }
       //重新加载用户信息
       await userStore.loadUserInfo();
     },
     async afterSubmit() {
-      notification.success({ message: t("authentication.successMessage") });
+      const formData = passwordFormRef.value?.getFormData?.();
+      const message = formData?.init ? t("authentication.initPasswordSuccessMessage") : t("authentication.successMessage");
+      notification.success({ message });
     },
   },
   columns: {
+    init: {
+      title: "init",
+      type: "text",
+      form: {
+        show: false,
+      },
+    },
     password: {
       title: t("authentication.oldPassword"),
       type: "password",
       form: {
+        show: compute(({ form }) => form.init !== true),
         rules: [{ required: true, message: t("authentication.oldPasswordRequired") }],
       },
     },
@@ -97,12 +116,16 @@ const passwordFormOptions: CrudOptions = {
   },
 };
 
-async function open(opts: { password: "" }) {
+async function open(opts: OpenOptions = {}) {
   const formOptions = buildFormOptions(passwordFormOptions);
   formOptions.newInstance = true; //新实例打开
+  if (opts.init) {
+    formOptions.wrapper.title = t("authentication.initPasswordTitle");
+  }
   passwordFormRef.value = await openDialog(formOptions);
   passwordFormRef.value.setFormData({
-    password: opts.password,
+    init: opts.init === true,
+    password: opts.password || "",
   });
   console.log(passwordFormRef.value);
 }
diff --git a/packages/ui/certd-client/src/views/certd/mine/user-profile.vue b/packages/ui/certd-client/src/views/certd/mine/user-profile.vue
index 8fb3e8145..08f624945 100644
--- a/packages/ui/certd-client/src/views/certd/mine/user-profile.vue
+++ b/packages/ui/certd-client/src/views/certd/mine/user-profile.vue
@@ -48,7 +48,7 @@
               </div>
             </div>
             <div class="action-buttons gap-2">
-              <change-password-button :show-button="true" />
+              <change-password-button ref="changePasswordButtonRef" :show-button="true" />
 
               <a-button type="primary" class="action-btn" @click="goSecuritySetting">
                 {{ t("authentication.securitySettingTip") }}
@@ -387,6 +387,7 @@ const checkPasskeySupport = () => {
   }
 };
 const userStore = useUserStore();
+const changePasswordButtonRef = ref();
 const userAvatar = computed(() => {
   if (isEmpty(userInfo.value.avatar)) {
     return "";
@@ -395,11 +396,26 @@ const userAvatar = computed(() => {
     return userInfo.value.avatar;
   }
 
-  return `api/basic/file/download?token=${userStore.getToken}&key=${userInfo.value.avatar}`;
+  return `api/basic/file/download?key=${userInfo.value.avatar}`;
 });
 
 onMounted(async () => {
   await getUserInfo();
+  userStore.setUserInfo(userInfo.value);
+  if (userInfo.value.needInitPassword === true) {
+    Modal.confirm({
+      title: t("authentication.initPasswordTitle"),
+      content: t("authentication.initPasswordWarning"),
+      okText: t("authentication.setNow"),
+      cancelText: t("authentication.notNow"),
+      closable: true,
+      onOk: () => {
+        changePasswordButtonRef.value.open({
+          init: true,
+        });
+      },
+    });
+  }
   await loadContactCapability();
   await loadOauthBounds();
   await loadOauthProviders();
diff --git a/packages/ui/certd-client/src/views/certd/pipeline/utils.ts b/packages/ui/certd-client/src/views/certd/pipeline/utils.ts
index 7e5ad599f..52878d57c 100644
--- a/packages/ui/certd-client/src/views/certd/pipeline/utils.ts
+++ b/packages/ui/certd-client/src/views/certd/pipeline/utils.ts
@@ -56,6 +56,10 @@ export function findStep(pipeline: any, id: string) {
 
 export async function checkPipelineLimit() {
   const settingsStore = useSettingStore();
+  if (settingsStore.isEnterprise) {
+    //企业模式不限制
+    return;
+  }
   if (settingsStore.isComm && settingsStore.suiteSetting.enabled) {
     //检查数量是否超限
 
diff --git a/packages/ui/certd-client/src/views/certd/suite/mine/api.ts b/packages/ui/certd-client/src/views/certd/suite/mine/api.ts
index 1e1faa42b..64a09f5c7 100644
--- a/packages/ui/certd-client/src/views/certd/suite/mine/api.ts
+++ b/packages/ui/certd-client/src/views/certd/suite/mine/api.ts
@@ -14,6 +14,7 @@ export type SuiteDetail = {
   expiresTime?: number;
   pipelineCount?: SuiteValue;
   domainCount?: SuiteValue;
+  wildcardDomainCount?: SuiteValue;
   deployCount?: SuiteValue;
   monitorCount?: SuiteValue;
 };
diff --git a/packages/ui/certd-client/src/views/certd/suite/mine/crud.tsx b/packages/ui/certd-client/src/views/certd/suite/mine/crud.tsx
index 1076630a7..f8ed1d21f 100644
--- a/packages/ui/certd-client/src/views/certd/suite/mine/crud.tsx
+++ b/packages/ui/certd-client/src/views/certd/suite/mine/crud.tsx
@@ -147,7 +147,7 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
           },
         },
         "content.maxDomainCount": {
-          title: "域名数量",
+          title: "域名总数量",
           type: "text",
           form: {
             key: ["content", "maxDomainCount"],
@@ -168,6 +168,28 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
             align: "center",
           },
         },
+        "content.maxWildcardDomainCount": {
+          title: "其中泛域名数量",
+          type: "text",
+          form: {
+            key: ["content", "maxWildcardDomainCount"],
+            component: {
+              name: SuiteValueEdit,
+              vModel: "modelValue",
+              unit: "个",
+            },
+            rules: [{ required: true, message: "此项必填" }],
+          },
+          column: {
+            width: 120,
+            component: {
+              name: SuiteValue,
+              vModel: "modelValue",
+              unit: "个",
+            },
+            align: "center",
+          },
+        },
         "content.maxPipelineCount": {
           title: "流水线数量",
           type: "text",
diff --git a/packages/ui/certd-client/src/views/certd/suite/order-modal.vue b/packages/ui/certd-client/src/views/certd/suite/order-modal.vue
index ad0ab1adf..ac195f127 100644
--- a/packages/ui/certd-client/src/views/certd/suite/order-modal.vue
+++ b/packages/ui/certd-client/src/views/certd/suite/order-modal.vue
@@ -11,7 +11,10 @@
         <span class="label">{{ $t("certd.order.specifications") }}：</span>
         <span class="flex-o flex-wrap">
           <span class="flex-o"> {{ $t("certd.order.pipeline") }}<suite-value class="ml-5" :model-value="product.content.maxPipelineCount" :unit="$t('certd.order.unit.pieces')" />； </span>
-          <span class="flex-o"> {{ $t("certd.order.domain") }}<suite-value class="ml-5" :model-value="product.content.maxDomainCount" :unit="$t('certd.order.unit.count')" />； </span>
+          <span class="flex-o"> {{ $t("certd.order.totalDomain") }}<suite-value class="ml-5" :model-value="product.content.maxDomainCount" :unit="$t('certd.order.unit.count')" />； </span>
+          <span class="flex-o" style="padding-left: 2em">
+            - {{ $t("certd.order.includedWildcardDomain") }}<suite-value class="ml-5" :model-value="product.content.maxWildcardDomainCount" :unit="$t('certd.order.unit.count')" />；
+          </span>
           <span class="flex-o"> {{ $t("certd.order.deployTimes") }}<suite-value class="ml-5" :model-value="product.content.maxDeployCount" :unit="$t('certd.order.unit.times')" />； </span>
           <span class="flex-o"> {{ $t("certd.order.monitorCount") }}<suite-value class="ml-5" :model-value="product.content.maxMonitorCount" :unit="$t('certd.order.unit.times')" />； </span>
         </span>
diff --git a/packages/ui/certd-client/src/views/certd/suite/product-info.vue b/packages/ui/certd-client/src/views/certd/suite/product-info.vue
index 96699c9bd..917330a61 100644
--- a/packages/ui/certd-client/src/views/certd/suite/product-info.vue
+++ b/packages/ui/certd-client/src/views/certd/suite/product-info.vue
@@ -1,7 +1,7 @@
 <template>
   <a-card :title="product.title" class="product-card">
     <template #extra>
-      <fs-values-format v-model="product.type" :dict="productTypeDictRef"></fs-values-format>
+      <fs-values-format :model-value="product.type" :dict="productTypeDictRef"></fs-values-format>
     </template>
 
     <div class="product-intro">{{ product.intro || "暂无介绍" }}</div>
@@ -12,9 +12,13 @@
         <suite-value :model-value="product.content.maxPipelineCount" unit="条" />
       </div>
       <div class="flex-between mt-5">
-        <div class="flex-o"><fs-icon icon="ant-design:check-outlined" class="color-green mr-5" />域名数量：</div>
+        <div class="flex-o"><fs-icon icon="ant-design:check-outlined" class="color-green mr-5" />域名总数量：</div>
         <suite-value :model-value="product.content.maxDomainCount" unit="个" />
       </div>
+      <div class="flex-between mt-5">
+        <div class="flex-o" style="padding-left: 2em">- 其中泛域名数量：</div>
+        <suite-value :model-value="product.content.maxWildcardDomainCount" unit="个" />
+      </div>
       <div class="flex-between mt-5">
         <div class="flex-o">
           <fs-icon icon="ant-design:check-outlined" class="color-green mr-5" />
diff --git a/packages/ui/certd-client/src/views/framework/home/dashboard/index.vue b/packages/ui/certd-client/src/views/framework/home/dashboard/index.vue
index a607b262a..c815434ff 100644
--- a/packages/ui/certd-client/src/views/framework/home/dashboard/index.vue
+++ b/packages/ui/certd-client/src/views/framework/home/dashboard/index.vue
@@ -204,6 +204,7 @@ const hasNewVersion = computed(() => {
   return isNewVersion(version.value, latestVersion.value);
 });
 async function loadLatestVersion() {
+  // version.value = settingsStore.app.version;  //前端有缓存 可能不准确
   latestVersion.value = await api.GetLatestVersion();
   console.log("latestVersion", latestVersion.value);
 
diff --git a/packages/ui/certd-client/src/views/framework/home/dashboard/suite-card.vue b/packages/ui/certd-client/src/views/framework/home/dashboard/suite-card.vue
index d62ef16f4..c944d5bf7 100644
--- a/packages/ui/certd-client/src/views/framework/home/dashboard/suite-card.vue
+++ b/packages/ui/certd-client/src/views/framework/home/dashboard/suite-card.vue
@@ -20,10 +20,14 @@
             <div class="flex-between mt-5">
               <div class="flex-o">
                 <fs-icon icon="ant-design:check-outlined" class="color-green mr-5" />
-                域名数量：
+                域名总数量：
               </div>
               <suite-value :model-value="detail.domainCount.max" :used="detail.domainCount.used" unit="个" />
             </div>
+            <div class="flex-between mt-5">
+              <div class="flex-o ml-20">- 其中泛域名数量：</div>
+              <suite-value :model-value="detail.wildcardDomainCount.max" :used="detail.wildcardDomainCount.used" unit="个" />
+            </div>
             <div class="flex-between mt-5">
               <div class="flex-o">
                 <fs-icon icon="ant-design:check-outlined" class="color-green mr-5" />
diff --git a/packages/ui/certd-client/src/views/sys/suite/product/crud.tsx b/packages/ui/certd-client/src/views/sys/suite/product/crud.tsx
index 16ad6e1f1..def049621 100644
--- a/packages/ui/certd-client/src/views/sys/suite/product/crud.tsx
+++ b/packages/ui/certd-client/src/views/sys/suite/product/crud.tsx
@@ -59,7 +59,7 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
             },
             content: {
               header: t("certd.packageContent"),
-              columns: ["content.maxDomainCount", "content.maxPipelineCount", "content.maxDeployCount", "content.maxMonitorCount"],
+              columns: ["content.maxDomainCount", "content.maxWildcardDomainCount", "content.maxPipelineCount", "content.maxDeployCount", "content.maxMonitorCount"],
             },
             price: {
               header: t("certd.price"),
@@ -154,6 +154,28 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
             },
           },
         },
+        "content.maxWildcardDomainCount": {
+          title: t("certd.wildcardDomainCountPart"),
+          type: "text",
+          form: {
+            key: ["content", "maxWildcardDomainCount"],
+            helper: t("certd.wildcardDomainCountHelper"),
+            component: {
+              name: SuiteValueEdit,
+              vModel: "modelValue",
+              unit: t("certd.unitCount"),
+            },
+            rules: [{ required: true, message: t("certd.requiredField") }],
+          },
+          column: {
+            width: 120,
+            component: {
+              name: SuiteValue,
+              vModel: "modelValue",
+              unit: t("certd.unitCount"),
+            },
+          },
+        },
         "content.maxPipelineCount": {
           title: t("certd.pipelineCount"),
           type: "text",
diff --git a/packages/ui/certd-client/src/views/sys/suite/setting/index.vue b/packages/ui/certd-client/src/views/sys/suite/setting/index.vue
index 9b69ad141..3e0577958 100644
--- a/packages/ui/certd-client/src/views/sys/suite/setting/index.vue
+++ b/packages/ui/certd-client/src/views/sys/suite/setting/index.vue
@@ -17,6 +17,7 @@
             <div style="height: 400px">
               <ProductManager @refreshed="onTableRefresh"></ProductManager>
             </div>
+            <div class="helper">泛域名数量受域名总数量限制：泛域名会同时占用域名总数量和泛域名数量额度。</div>
             <div class="helper">不建议设置免费套餐，可以在下方配置注册赠送套餐，或者在用户套餐管理中手动赠送套餐</div>
           </a-form-item>
 
diff --git a/packages/ui/certd-client/src/views/sys/suite/user-suite/crud.tsx b/packages/ui/certd-client/src/views/sys/suite/user-suite/crud.tsx
index e370d4be1..96a3cdf1b 100644
--- a/packages/ui/certd-client/src/views/sys/suite/user-suite/crud.tsx
+++ b/packages/ui/certd-client/src/views/sys/suite/user-suite/crud.tsx
@@ -1,6 +1,5 @@
 import { AddReq, compute, CreateCrudOptionsProps, CreateCrudOptionsRet, DelReq, dict, EditReq, UserPageQuery, UserPageRes } from "@fast-crud/fast-crud";
 import { sysUserSuiteApi } from "./api";
-import { useRouter } from "vue-router";
 import SuiteValueEdit from "/@/views/sys/suite/product/suite-value-edit.vue";
 import SuiteValue from "/@/views/sys/suite/product/suite-value.vue";
 import DurationValue from "/@/views/sys/suite/product/duration-value.vue";
@@ -33,8 +32,6 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
     return res;
   };
 
-  const router = useRouter();
-
   return {
     crudOptions: {
       request: {
@@ -71,7 +68,7 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
         buttons: {
           view: { show: true },
           copy: { show: false },
-          edit: { show: false },
+          edit: { show: true },
           remove: { show: true },
           // continue:{
           //   text:"续期",
@@ -107,7 +104,7 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
             show: true,
           },
           form: {
-            show: false,
+            rules: [{ required: true, message: t("certd.field_required") }],
           },
           column: {
             width: 200,
@@ -127,7 +124,9 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
             label: "nickName",
           }),
           form: {
+            show: true,
             component: {
+              disabled: true,
               crossPage: true,
               multiple: false,
               select: {
@@ -183,7 +182,10 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
             ],
           }),
           form: {
-            show: false,
+            show: true,
+            component: {
+              disabled: true,
+            },
           },
           column: {
             width: 80,
@@ -204,7 +206,6 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
           title: t("certd.domain_count"),
           type: "text",
           form: {
-            show: false,
             key: ["content", "maxDomainCount"],
             component: {
               name: SuiteValueEdit,
@@ -223,11 +224,32 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
             align: "center",
           },
         },
+        "content.maxWildcardDomainCount": {
+          title: t("certd.wildcardDomainCountPart"),
+          type: "text",
+          form: {
+            key: ["content", "maxWildcardDomainCount"],
+            component: {
+              name: SuiteValueEdit,
+              vModel: "modelValue",
+              unit: t("certd.unit_count"),
+            },
+            rules: [{ required: true, message: t("certd.field_required") }],
+          },
+          column: {
+            width: 120,
+            component: {
+              name: SuiteValue,
+              vModel: "modelValue",
+              unit: t("certd.unit_count"),
+            },
+            align: "center",
+          },
+        },
         "content.maxPipelineCount": {
           title: t("certd.pipeline_count"),
           type: "text",
           form: {
-            show: false,
             key: ["content", "maxPipelineCount"],
             component: {
               name: SuiteValueEdit,
@@ -250,7 +272,6 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
           title: t("certd.deploy_count"),
           type: "text",
           form: {
-            show: false,
             key: ["content", "maxDeployCount"],
             component: {
               name: SuiteValueEdit,
@@ -276,7 +297,6 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
           title: t("certd.monitor_count"),
           type: "text",
           form: {
-            show: false,
             key: ["content", "maxMonitorCount"],
             component: {
               name: SuiteValueEdit,
@@ -298,7 +318,9 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
         duration: {
           title: t("certd.duration"),
           type: "text",
-          form: { show: false },
+          form: {
+            rules: [{ required: true, message: t("certd.field_required") }],
+          },
           column: {
             component: {
               name: DurationValue,
@@ -342,7 +364,13 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
           title: t("certd.expires_time"),
           type: "date",
           form: {
-            show: false,
+            valueBuilder: ({ value }) => {
+              return dayjs(value);
+            },
+            valueResolve: ({ value }) => {
+              //今天的最后一秒
+              return dayjs(value).endOf("day").valueOf();
+            },
           },
           column: {
             width: 150,
@@ -367,13 +395,56 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
           }),
           form: {
             value: true,
-            show: false,
           },
           column: {
             width: 100,
             align: "center",
           },
         },
+        deployCountUsed: {
+          title: t("certd.deploy_count_used"),
+          type: "number",
+          form: {
+            value: 0,
+            rules: [{ required: true, message: t("certd.field_required") }],
+          },
+          column: {
+            show: false,
+          },
+        },
+        disabled: {
+          title: t("certd.disabled"),
+          type: "dict-switch",
+          dict: dict({
+            data: [
+              { label: t("certd.enabledLabel"), value: false, color: "success" },
+              { label: t("certd.disabledLabel"), value: true, color: "error" },
+            ],
+          }),
+          form: {
+            value: false,
+          },
+          column: {
+            width: 100,
+            align: "center",
+          },
+        },
+        isEmpty: {
+          title: t("certd.status"),
+          type: "dict-switch",
+          dict: dict({
+            data: [
+              { label: t("certd.normal"), value: false, color: "success" },
+              { label: t("certd.used_up"), value: true, color: "gray" },
+            ],
+          }),
+          form: {
+            value: false,
+          },
+          column: {
+            show: false,
+          },
+        },
         createTime: {
           title: t("certd.createTime"),
           type: "datetime",
diff --git a/packages/ui/certd-server/CHANGELOG.md b/packages/ui/certd-server/CHANGELOG.md
index 24a715a50..b6444c0e1 100644
--- a/packages/ui/certd-server/CHANGELOG.md
+++ b/packages/ui/certd-server/CHANGELOG.md
@@ -3,6 +3,44 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.40.2](https://github.com/certd/certd/compare/v1.40.1...v1.40.2) (2026-05-19)
+
+### Bug Fixes
+
+* **certd-server:** 调整首页缓存控制头的判断逻辑 ([0499347](https://github.com/certd/certd/commit/0499347588ee544862420ab9a5afd2546d61bc6c))
+
+### Performance Improvements
+
+* **controller:** 更换版本获取源并添加版本标准化处理 ([cb08e06](https://github.com/certd/certd/commit/cb08e061d257ba23a0fefdbfb046a8c759def828))
+
+## [1.40.1](https://github.com/certd/certd/compare/v1.40.0...v1.40.1) (2026-05-18)
+
+### Bug Fixes
+
+* 固化华为云sdk版本，避免华为云调用报错 ([59b9ffa](https://github.com/certd/certd/commit/59b9ffadd05faf3982151c48f8d83cbd97419865))
+* **email-service:** 优化商业版测试邮件内容中带的url链接 ([667e7b1](https://github.com/certd/certd/commit/667e7b185bf26558972be01720872f48352b5876))
+
+### Performance Improvements
+
+* 商业版支持限制泛域名数量 ([c63745d](https://github.com/certd/certd/commit/c63745d1ba30904428ba6b13ab0785298baa5cae))
+
+# [1.40.0](https://github.com/certd/certd/compare/v1.39.16...v1.40.0) (2026-05-14)
+
+### Bug Fixes
+
+* 修复群晖授权没有显示设备id输入框的bug ([2f172b5](https://github.com/certd/certd/commit/2f172b56e9411303ca15138d827bdb9bafdae4d1))
+* 修复clogin登录丢失state问题 ([22f5cfc](https://github.com/certd/certd/commit/22f5cfcfd8462ca74128329eefb3f48b3ee0b7ea))
+* 修复clogin多选类型登录失败的bug ([9f878a3](https://github.com/certd/certd/commit/9f878a353cd49b7b10bb0a95610ad236bc920dd2))
+
+### Features
+
+* 彩虹登录支持选择多种登录方式 ([7aa0c7e](https://github.com/certd/certd/commit/7aa0c7e491fe660abb62e68792ff5474f19bd5b8))
+
+### Performance Improvements
+
+* 第三方登录自动注册的用户支持设置初始化密码 ([a815d02](https://github.com/certd/certd/commit/a815d0245b97efbb948b33d6fc9d49862ce06889))
+* 头像增加缓存时间 ([7015b1b](https://github.com/certd/certd/commit/7015b1b232602e5168a3eb8bee6d7f1776ae1e74))
+
 ## [1.39.16](https://github.com/certd/certd/compare/v1.39.15...v1.39.16) (2026-05-13)
 
 **Note:** Version bump only for package @certd/ui-server
diff --git a/packages/ui/certd-server/db/migration-mysql/v10044__cert_wildcard_domain_count.sql b/packages/ui/certd-server/db/migration-mysql/v10044__cert_wildcard_domain_count.sql
new file mode 100644
index 000000000..ffc067d23
--- /dev/null
+++ b/packages/ui/certd-server/db/migration-mysql/v10044__cert_wildcard_domain_count.sql
@@ -0,0 +1 @@
+ALTER TABLE cd_cert_info ADD COLUMN wildcard_domain_count bigint NOT NULL DEFAULT 0;
diff --git a/packages/ui/certd-server/db/migration-pg/v10044__cert_wildcard_domain_count.sql b/packages/ui/certd-server/db/migration-pg/v10044__cert_wildcard_domain_count.sql
new file mode 100644
index 000000000..ffc067d23
--- /dev/null
+++ b/packages/ui/certd-server/db/migration-pg/v10044__cert_wildcard_domain_count.sql
@@ -0,0 +1 @@
+ALTER TABLE cd_cert_info ADD COLUMN wildcard_domain_count bigint NOT NULL DEFAULT 0;
diff --git a/packages/ui/certd-server/db/migration/v10044__cert_wildcard_domain_count.sql b/packages/ui/certd-server/db/migration/v10044__cert_wildcard_domain_count.sql
new file mode 100644
index 000000000..6b99e4c95
--- /dev/null
+++ b/packages/ui/certd-server/db/migration/v10044__cert_wildcard_domain_count.sql
@@ -0,0 +1 @@
+ALTER TABLE cd_cert_info ADD COLUMN wildcard_domain_count integer NOT NULL DEFAULT 0;
diff --git a/packages/ui/certd-server/metadata/access_synology.yaml b/packages/ui/certd-server/metadata/access_synology.yaml
index e6dd4cc99..aebff3861 100644
--- a/packages/ui/certd-server/metadata/access_synology.yaml
+++ b/packages/ui/certd-server/metadata/access_synology.yaml
@@ -39,6 +39,8 @@ input:
     component:
       name: a-switch
       vModel: checked
+    col:
+      span: 24
     helper: 是否启用了双重认证
     required: true
   deviceId:
@@ -48,6 +50,8 @@ input:
       name: synology-device-id-getter
       type: access
       typeName: synology
+    col:
+      span: 24
     mergeScript: |2-
 
            return {
diff --git a/packages/ui/certd-server/metadata/addon_oauth_clogin.yaml b/packages/ui/certd-server/metadata/addon_oauth_clogin.yaml
index ed3fc9d6c..c79e9fe2e 100644
--- a/packages/ui/certd-server/metadata/addon_oauth_clogin.yaml
+++ b/packages/ui/certd-server/metadata/addon_oauth_clogin.yaml
@@ -21,28 +21,28 @@ input:
       options:
         - label: QQ
           value: qq
-          icon: logos:tencent-qq
+          icon: cib:tencent-qq:#007AFF
         - label: 微信
           value: wx
-          icon: logos:wechat-icon
+          icon: simple-icons:wechat:#34C759
         - label: 支付宝
           value: alipay
-          icon: logos:alipay
+          icon: simple-icons:alipay:#0099ff
         - label: 微博
           value: sina
-          icon: logos:sina-weibo
+          icon: uiw:weibo:#FF3B30
         - label: 百度
           value: baidu
-          icon: logos:baidu
+          icon: simple-icons:baidu:#007AFF
         - label: 华为
           value: huawei
           icon: simple-icons:huawei:#ff0000
         - label: 小米
           value: xiaomi
-          icon: logos:xiaomi-icon
+          icon: simple-icons:xiaomi:#FF9500
         - label: 谷歌
           value: google
-          icon: logos:google-icon
+          icon: flat-color-icons:google
         - label: 微软
           value: microsoft
           icon: logos:microsoft-icon
@@ -54,7 +54,7 @@ input:
           icon: logos:twitter
         - label: 钉钉
           value: dingtalk
-          icon: logos:dingtalk
+          icon: ant-design:dingding-outlined:#007AFF
         - label: Gitee
           value: gitee
           icon: simple-icons:gitee:#c71d23
diff --git a/packages/ui/certd-server/package.json b/packages/ui/certd-server/package.json
index c044474b1..5f600ea0f 100644
--- a/packages/ui/certd-server/package.json
+++ b/packages/ui/certd-server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@certd/ui-server",
-  "version": "1.39.16",
+  "version": "1.40.2",
   "description": "fast-server base midway",
   "private": true,
   "type": "module",
@@ -24,7 +24,7 @@
     "lint": "mwts check",
     "lint:fix": "mwts fix",
     "ci": "pnpm run cov",
-    "build-only": "cross-env NODE_ENV=production mwtsc --cleanOutDir --skipLibCheck",
+    "build-only": "cross-env NODE_ENV=production mwtsc -p tsconfig.build.json --cleanOutDir --skipLibCheck",
     "build": "pnpm run build-only && pnpm run export-metadata",
     "export-metadata": "node export-plugin-yaml.js",
     "export-metadata-only": "node export-plugin-yaml.js docoff",
@@ -53,26 +53,26 @@
     "@aws-sdk/client-sts": "^3.990.0",
     "@azure/arm-dns": "^5.1.0",
     "@azure/identity": "^4.13.1",
-    "@certd/acme-client": "^1.39.16",
-    "@certd/basic": "^1.39.16",
-    "@certd/commercial-core": "^1.39.16",
+    "@certd/acme-client": "^1.40.2",
+    "@certd/basic": "^1.40.2",
+    "@certd/commercial-core": "^1.40.2",
     "@certd/cv4pve-api-javascript": "^8.4.2",
-    "@certd/jdcloud": "^1.39.16",
-    "@certd/lib-huawei": "^1.39.16",
-    "@certd/lib-k8s": "^1.39.16",
-    "@certd/lib-server": "^1.39.16",
-    "@certd/midway-flyway-js": "^1.39.16",
-    "@certd/pipeline": "^1.39.16",
-    "@certd/plugin-cert": "^1.39.16",
-    "@certd/plugin-lib": "^1.39.16",
-    "@certd/plugin-plus": "^1.39.16",
-    "@certd/plus-core": "^1.39.16",
+    "@certd/jdcloud": "^1.40.2",
+    "@certd/lib-huawei": "^1.40.2",
+    "@certd/lib-k8s": "^1.40.2",
+    "@certd/lib-server": "^1.40.2",
+    "@certd/midway-flyway-js": "^1.40.2",
+    "@certd/pipeline": "^1.40.2",
+    "@certd/plugin-cert": "^1.40.2",
+    "@certd/plugin-lib": "^1.40.2",
+    "@certd/plugin-plus": "^1.40.2",
+    "@certd/plus-core": "^1.40.2",
     "@google-cloud/dns": "^5.3.1",
     "@google-cloud/publicca": "^1.3.0",
-    "@huaweicloud/huaweicloud-sdk-cdn": "^3.1.185",
-    "@huaweicloud/huaweicloud-sdk-core": "^3.1.185",
-    "@huaweicloud/huaweicloud-sdk-elb": "^3.1.185",
-    "@huaweicloud/huaweicloud-sdk-iam": "^3.1.185",
+    "@huaweicloud/huaweicloud-sdk-cdn": "3.1.185",
+    "@huaweicloud/huaweicloud-sdk-core": "3.1.185",
+    "@huaweicloud/huaweicloud-sdk-elb": "3.1.185",
+    "@huaweicloud/huaweicloud-sdk-iam": "3.1.185",
     "@koa/cors": "^5.0.0",
     "@midwayjs/bootstrap": "3.20.11",
     "@midwayjs/cache": "3.14.0",
diff --git a/packages/ui/certd-server/src/configuration-cache.ts b/packages/ui/certd-server/src/configuration-cache.ts
new file mode 100644
index 000000000..7b1091800
--- /dev/null
+++ b/packages/ui/certd-server/src/configuration-cache.ts
@@ -0,0 +1,6 @@
+export function shouldSetDefaultNoCache(path: string, cacheControl?: string) {
+  if (cacheControl) {
+    return false;
+  }
+  return path === '/' || path === '/index.html' || path.startsWith('/api');
+}
diff --git a/packages/ui/certd-server/src/configuration.test.ts b/packages/ui/certd-server/src/configuration.test.ts
new file mode 100644
index 000000000..9b1266f81
--- /dev/null
+++ b/packages/ui/certd-server/src/configuration.test.ts
@@ -0,0 +1,22 @@
+/// <reference types="mocha" />
+/// <reference types="node" />
+
+import assert from "node:assert/strict";
+
+import { shouldSetDefaultNoCache } from "./configuration-cache.js";
+
+describe("shouldSetDefaultNoCache", () => {
+  it("sets default no-cache for html and api responses without cache headers", () => {
+    assert.equal(shouldSetDefaultNoCache("/"), true);
+    assert.equal(shouldSetDefaultNoCache("/index.html"), true);
+    assert.equal(shouldSetDefaultNoCache("/api/basic/file/download"), true);
+  });
+
+  it("keeps explicit cache headers from file responses", () => {
+    assert.equal(shouldSetDefaultNoCache("/api/basic/file/download", "public,max-age=259200"), false);
+  });
+
+  it("ignores non-html and non-api paths", () => {
+    assert.equal(shouldSetDefaultNoCache("/static/images/logo.svg"), false);
+  });
+});
diff --git a/packages/ui/certd-server/src/configuration.ts b/packages/ui/certd-server/src/configuration.ts
index a3450eaa3..26f9e6473 100644
--- a/packages/ui/certd-server/src/configuration.ts
+++ b/packages/ui/certd-server/src/configuration.ts
@@ -20,6 +20,7 @@ import * as commercial from '@certd/commercial-core';
 import * as upload from '@midwayjs/upload';
 import { setLogger } from '@certd/acme-client';
 import {HiddenMiddleware} from "./middleware/hidden.js";
+import { shouldSetDefaultNoCache } from './configuration-cache.js';
 // import * as swagger from '@midwayjs/swagger';
 //@ts-ignore
 // process.env.UV_THREADPOOL_SIZE = 2
@@ -123,7 +124,9 @@ export class MainConfiguration {
 
     this.app.getMiddleware().insertFirst(async (ctx: IMidwayKoaContext, next: NextFunction) => {
       await next();
-      if (ctx.path === '/' || ctx.path === '/index.html' || ctx.path.startsWith("/api")) {
+      const path = ctx.path;
+      // 如果是首页则强制设置为不缓存
+      if (path === '/' || path === '/index.html' || shouldSetDefaultNoCache(path, ctx.response.get('Cache-Control')) ) {
         ctx.response.set('Cache-Control', 'public,max-age=0');
       }
     });
diff --git a/packages/ui/certd-server/src/controller/basic/app-controller.test.ts b/packages/ui/certd-server/src/controller/basic/app-controller.test.ts
new file mode 100644
index 000000000..95cd7f21c
--- /dev/null
+++ b/packages/ui/certd-server/src/controller/basic/app-controller.test.ts
@@ -0,0 +1,17 @@
+/// <reference types="mocha" />
+/// <reference types="node" />
+
+import assert from "node:assert/strict";
+
+import { normalizeReleaseVersion } from "./app-controller.js";
+
+describe("AppController.normalizeReleaseVersion", () => {
+  it("normalizes AtomGit release tag names", () => {
+    assert.equal(normalizeReleaseVersion({ tag_name: "v1.40.0" }), "1.40.0");
+    assert.equal(normalizeReleaseVersion({ tag_name: "1.40.0" }), "1.40.0");
+  });
+
+  it("falls back to release name when tag_name is empty", () => {
+    assert.equal(normalizeReleaseVersion({ name: "v1.40.0" }), "1.40.0");
+  });
+});
diff --git a/packages/ui/certd-server/src/controller/basic/app-controller.ts b/packages/ui/certd-server/src/controller/basic/app-controller.ts
index b77ac5c50..cf8aaf93a 100644
--- a/packages/ui/certd-server/src/controller/basic/app-controller.ts
+++ b/packages/ui/certd-server/src/controller/basic/app-controller.ts
@@ -3,6 +3,11 @@ import { BaseController, Constants, FileService, SysSettingsService, SysSiteInfo
 import { http, logger } from '@certd/basic';
 import { isComm } from '@certd/plus-core';
 
+export function normalizeReleaseVersion(release: { tag_name?: string; name?: string }) {
+  const version = release?.tag_name || release?.name || '';
+  return version.replace(/^v/i, '');
+}
+
 /**
  */
 @Provide()
@@ -17,12 +22,12 @@ export class AppController extends BaseController {
   async latest(): Promise<any> {
     try {
       const res = await http.request({
-        url: 'https://registry.npmmirror.com/@certd/pipeline',
+        url: 'https://api.atomgit.com/api/v5/repos/certd/certd/releases/latest',
         method: 'get',
         logRes: false,
         timeout: 5000,
       });
-      const latest = res['dist-tags'].latest;
+      const latest = normalizeReleaseVersion(res);
       return this.ok(latest);
     } catch (e: any) {
       logger.error(e);
diff --git a/packages/ui/certd-server/src/controller/basic/file-controller.test.ts b/packages/ui/certd-server/src/controller/basic/file-controller.test.ts
new file mode 100644
index 000000000..f968d1c15
--- /dev/null
+++ b/packages/ui/certd-server/src/controller/basic/file-controller.test.ts
@@ -0,0 +1,39 @@
+/// <reference types="mocha" />
+/// <reference types="node" />
+
+import assert from "node:assert/strict";
+
+import { getImageDownloadOptions, isImageFile } from "./file-controller.js";
+
+describe("FileController.isImageFile", () => {
+  it("detects uploaded logo image files", () => {
+    assert.equal(isImageFile("data/upload/public/user/logo.PNG"), true);
+    assert.equal(isImageFile("data/upload/public/user/logo.svg"), true);
+    assert.equal(isImageFile("data/upload/public/user/logo.webp"), true);
+  });
+
+  it("does not treat non-image downloads as logo images", () => {
+    assert.equal(isImageFile("data/upload/public/user/archive.zip"), false);
+    assert.equal(isImageFile("data/upload/public/user/cert.pem"), false);
+    assert.equal(isImageFile("data/upload/public/user/logo"), false);
+  });
+
+  it("builds koa-send options that keep image cache headers at 3 days", () => {
+    const options = getImageDownloadOptions("data/upload/public/user/logo.png");
+
+    assert.equal(options?.maxage, 259200000);
+
+    const headers: Record<string, string> = {};
+    options?.setHeaders({
+      setHeader(key: string, value: string) {
+        headers[key] = value;
+      },
+    });
+
+    assert.equal(headers["Cache-Control"], "public,max-age=259200");
+  });
+
+  it("does not build cache options for non-image files", () => {
+    assert.equal(getImageDownloadOptions("data/upload/private/user/cert.pem"), undefined);
+  });
+});
diff --git a/packages/ui/certd-server/src/controller/basic/file-controller.ts b/packages/ui/certd-server/src/controller/basic/file-controller.ts
index d2dca2acd..1fb6bd203 100644
--- a/packages/ui/certd-server/src/controller/basic/file-controller.ts
+++ b/packages/ui/certd-server/src/controller/basic/file-controller.ts
@@ -5,6 +5,25 @@ import { nanoid } from 'nanoid';
 import { cache } from '@certd/basic';
 import { UploadFileInfo } from '@midwayjs/upload';
 
+const imageExtSet = new Set(['.apng', '.avif', '.bmp', '.gif', '.ico', '.jpeg', '.jpg', '.png', '.svg', '.webp']);
+const imageCacheSeconds = 3 * 24 * 60 * 60;
+
+export function isImageFile(filePath: string) {
+  return imageExtSet.has(filePath.substring(filePath.lastIndexOf('.')).toLowerCase());
+}
+
+export function getImageDownloadOptions(filePath: string) {
+  if (!isImageFile(filePath)) {
+    return undefined;
+  }
+  return {
+    maxage: imageCacheSeconds * 1000,
+    setHeaders(res: any) {
+      res.setHeader('Cache-Control', `public,max-age=${imageCacheSeconds}`);
+    },
+  };
+}
+
 /**
  */
 @Provide()
@@ -40,8 +59,10 @@ export class FileController extends BaseController {
       userId = this.getUserId();
     }
     const filePath = this.fileService.getFile(key, userId);
-    this.ctx.response.attachment(filePath);
-    this.ctx.response.set('Cache-Control', 'public,max-age=2592000');
-    await send(this.ctx, filePath);
+    const sendOptions = getImageDownloadOptions(filePath);
+    if (!sendOptions) {
+      this.ctx.response.attachment(filePath);
+    }
+    await send(this.ctx, filePath, sendOptions);
   }
 }
diff --git a/packages/ui/certd-server/src/controller/basic/login/oauth-controller.ts b/packages/ui/certd-server/src/controller/basic/login/oauth-controller.ts
index 86201ac4f..f312a1847 100644
--- a/packages/ui/certd-server/src/controller/basic/login/oauth-controller.ts
+++ b/packages/ui/certd-server/src/controller/basic/login/oauth-controller.ts
@@ -82,14 +82,22 @@ export class ConnectController extends BaseController {
     const bindUrl = installInfo?.bindUrl || "";
     //构造登录url
     const redirectUrl = `${bindUrl}api/oauth/callback/${body.type}`;
+
+    let stateObj = {
+      forType: body.forType || 'login',
+    }
+    const state = utils.hash.base64(JSON.stringify(stateObj))
     const { loginUrl, ticketValue } = await oauthProvider.addon.buildLoginUrl({
       redirectUri: redirectUrl,
       forType: body.forType,
       from: body.from || "web",
       subtype: body.subtype,
+      state,
     });
+    
     const ticket = this.codeService.setValidationValue({
       ...ticketValue,
+      state,
       subtype: body.subtype,
     })
     this.ctx.cookies.set("oauth_ticket", ticket, {
diff --git a/packages/ui/certd-server/src/controller/user/mine/mine-controller.ts b/packages/ui/certd-server/src/controller/user/mine/mine-controller.ts
index 95f7c96da..fde30a218 100644
--- a/packages/ui/certd-server/src/controller/user/mine/mine-controller.ts
+++ b/packages/ui/certd-server/src/controller/user/mine/mine-controller.ts
@@ -1,16 +1,16 @@
-import { BaseController, Constants, SysSettingsService } from '@certd/lib-server';
-import { ALL, Body, Controller, Inject, Post, Provide } from '@midwayjs/core';
-import { PasskeyService } from '../../../modules/login/service/passkey-service.js';
-import { RoleService } from '../../../modules/sys/authority/service/role-service.js';
-import { UserService } from '../../../modules/sys/authority/service/user-service.js';
-import { ApiTags } from '@midwayjs/swagger';
-import { CodeService } from '../../../modules/basic/service/code-service.js';
+import { BaseController, Constants, SysSettingsService } from "@certd/lib-server";
+import { ALL, Body, Controller, Inject, Post, Provide } from "@midwayjs/core";
+import { PasskeyService } from "../../../modules/login/service/passkey-service.js";
+import { RoleService } from "../../../modules/sys/authority/service/role-service.js";
+import { UserService } from "../../../modules/sys/authority/service/user-service.js";
+import { ApiTags } from "@midwayjs/swagger";
+import { CodeService } from "../../../modules/basic/service/code-service.js";
 
 /**
  */
 @Provide()
-@Controller('/api/mine')
-@ApiTags(['mine'])
+@Controller("/api/mine")
+@ApiTags(["mine"])
 export class MineController extends BaseController {
   @Inject()
   userService: UserService;
@@ -27,28 +27,38 @@ export class MineController extends BaseController {
   @Inject()
   sysSettingsService: SysSettingsService;
 
-  @Post('/info', { description: Constants.per.authOnly, summary: '查询用户信息' })
+  @Post("/info", { description: Constants.per.authOnly, summary: "查询用户信息" })
   public async info() {
     const userId = this.getUserId();
     const user = await this.userService.info(userId);
-    const isWeak = await this.userService.checkPassword('123456', user.password, user.passwordVersion);
+    const isWeak = await this.userService.checkPassword("123456", user.password, user.passwordVersion);
     if (isWeak) {
       //@ts-ignore
       user.isWeak = true;
     }
+    const needInitPassword = user.password === "changeme";
     user.roleIds = await this.roleService.getRoleIdsByUserId(userId);
     delete user.password;
+    //@ts-ignore
+    user.needInitPassword = needInitPassword;
     return this.ok(user);
   }
 
-  @Post('/changePassword', { description: Constants.per.authOnly, summary: '修改密码' })
+  @Post("/changePassword", { description: Constants.per.authOnly, summary: "修改密码" })
   public async changePassword(@Body(ALL) body: any) {
     const userId = this.getUserId();
     await this.userService.changePassword(userId, body);
     return this.ok({});
   }
 
-  @Post('/updateProfile', { description: Constants.per.authOnly, summary: '更新用户资料' })
+  @Post("/initPassword", { description: Constants.per.authOnly, summary: "初始化密码" })
+  public async initPassword(@Body(ALL) body: any) {
+    const userId = this.getUserId();
+    await this.userService.initPassword(userId, body);
+    return this.ok({});
+  }
+
+  @Post("/updateProfile", { description: Constants.per.authOnly, summary: "更新用户资料" })
   public async updateProfile(@Body(ALL) body: any) {
     const userId = this.getUserId();
 
@@ -59,7 +69,7 @@ export class MineController extends BaseController {
     return this.ok({});
   }
 
-  @Post('/contact/capability', { description: Constants.per.authOnly, summary: '查询联系方式绑定能力' })
+  @Post("/contact/capability", { description: Constants.per.authOnly, summary: "查询联系方式绑定能力" })
   public async contactCapability() {
     const settings = await this.sysSettingsService.getPrivateSettings();
     return this.ok({
@@ -67,27 +77,27 @@ export class MineController extends BaseController {
     });
   }
 
-  @Post('/contact/verifyIdentity', { description: Constants.per.authOnly, summary: '验证本人操作' })
-  public async verifyContactIdentity(@Body(ALL) body: { identityType: 'password' | 'email' | 'mobile'; identityPassword?: string; identityValidateCode?: string }) {
+  @Post("/contact/verifyIdentity", { description: Constants.per.authOnly, summary: "验证本人操作" })
+  public async verifyContactIdentity(@Body(ALL) body: { identityType: "password" | "email" | "mobile"; identityPassword?: string; identityValidateCode?: string }) {
     const userId = this.getUserId();
     await this.userService.verifyIdentity(userId, body, this.codeService);
     const validationCode = this.codeService.setValidationValue({
-      type: 'contactIdentity',
+      type: "contactIdentity",
       userId,
       identityType: body.identityType,
     });
     return this.ok({ validationCode });
   }
 
-  @Post('/contact/mobile', { description: Constants.per.authOnly, summary: '绑定或修改手机号' })
+  @Post("/contact/mobile", { description: Constants.per.authOnly, summary: "绑定或修改手机号" })
   public async updateMobile(@Body(ALL) body: { phoneCode?: string; mobile: string; validateCode: string; identityValidationCode: string }) {
     const userId = this.getUserId();
     this.userService.checkContactIdentityValidation(userId, body.identityValidationCode, this.codeService);
     await this.codeService.checkSmsCode({
       mobile: body.mobile,
-      phoneCode: body.phoneCode || '86',
+      phoneCode: body.phoneCode || "86",
       smsCode: body.validateCode,
-      verificationType: 'bindMobile',
+      verificationType: "bindMobile",
       throwError: true,
     });
     await this.userService.updateMobile(userId, {
@@ -97,14 +107,14 @@ export class MineController extends BaseController {
     return this.ok({});
   }
 
-  @Post('/contact/email', { description: Constants.per.authOnly, summary: '绑定或修改邮箱' })
+  @Post("/contact/email", { description: Constants.per.authOnly, summary: "绑定或修改邮箱" })
   public async updateEmail(@Body(ALL) body: { email: string; validateCode: string; identityValidationCode: string }) {
     const userId = this.getUserId();
     this.userService.checkContactIdentityValidation(userId, body.identityValidationCode, this.codeService);
     this.codeService.checkEmailCode({
       email: body.email,
       validateCode: body.validateCode,
-      verificationType: 'bindEmail',
+      verificationType: "bindEmail",
       throwError: true,
     });
     await this.userService.updateEmail(userId, {
diff --git a/packages/ui/certd-server/src/modules/auto/auto-a-register.ts b/packages/ui/certd-server/src/modules/auto/auto-a-register.ts
index 08488b620..2df4846ac 100644
--- a/packages/ui/certd-server/src/modules/auto/auto-a-register.ts
+++ b/packages/ui/certd-server/src/modules/auto/auto-a-register.ts
@@ -4,7 +4,7 @@ import { AutoLoadPlugins } from "./auto-load-plugins.js";
 import { AutoCron } from "./auto-cron.js";
 import { AutoMitterRegister } from "./auto-mitter-register.js";
 import { AutoPipelineEmitterRegister } from "./auto-pipeline-emitter-register.js";
-import { AutoFix } from "./auto-fix.js";
+import { AutoFix } from "./fix/auto-fix.js";
 import { AutoPrint } from "./auto-print.js";
 
 @Autoload()
diff --git a/packages/ui/certd-server/src/modules/auto/auto-fix.test.ts b/packages/ui/certd-server/src/modules/auto/auto-fix.test.ts
deleted file mode 100644
index a542aea24..000000000
--- a/packages/ui/certd-server/src/modules/auto/auto-fix.test.ts
+++ /dev/null
@@ -1,301 +0,0 @@
-import assert from "assert";
-import esmock from "esmock";
-import { AutoFix, buildEabAccountKeyValue, buildLegacyGoogleAccountConfigWhere, buildOauthBoundType, parseStorageValue } from "./auto-fix.js";
-
-function createAutoFix(options: { pluginConfigService?: any; accessService?: any; storageService?: any; sysSettingsService?: any; oauthBoundService?: any }) {
-  const autoFix = new AutoFix();
-  autoFix.pluginConfigService = options.pluginConfigService;
-  autoFix.accessService = options.accessService;
-  autoFix.storageService = options.storageService;
-  autoFix.sysSettingsService = options.sysSettingsService;
-  autoFix.oauthBoundService = options.oauthBoundService;
-  return autoFix;
-}
-
-describe("AutoFix", () => {
-  it("parses legacy storage values", () => {
-    const config = parseStorageValue(
-      JSON.stringify({
-        value: {
-          key: "legacy-private-key",
-          accountUrl: "https://example.com/acct/1",
-        },
-      })
-    );
-
-    assert.equal(config.key, "legacy-private-key");
-  });
-
-  it("builds the EAB account key payload", () => {
-    const payload = JSON.parse(buildEabAccountKeyValue("kid-1", "private-key"));
-
-    assert.deepEqual(payload, {
-      kid: "kid-1",
-      privateKey: "private-key",
-    });
-  });
-
-  it("builds legacy Google account config query by exact email key only", () => {
-    assert.deepEqual(buildLegacyGoogleAccountConfigWhere("user@example.com"), {
-      userId: 1,
-      scope: "user",
-      namespace: "1",
-      key: "acme.config.google.user@example.com",
-    });
-  });
-
-  it("builds OAuth subtype bound type", () => {
-    assert.equal(buildOauthBoundType("clogin", "alipay"), "clogin:alipay");
-    assert.equal(buildOauthBoundType("github"), "github");
-  });
-
-  it("finds legacy Google account config by exact email key only", async () => {
-    let findOneWhere: any;
-    let findCalled = false;
-    const autoFix = createAutoFix({
-      pluginConfigService: null as any,
-      accessService: null as any,
-      storageService: {
-        getRepository() {
-          return {
-            async findOne(options: any) {
-              findOneWhere = options.where;
-              return {
-                value: JSON.stringify({
-                  value: {
-                    privateKey: "legacy-private-key",
-                  },
-                }),
-              };
-            },
-            async find() {
-              findCalled = true;
-              return [];
-            },
-          };
-        },
-      } as any,
-    });
-
-    const config = await autoFix.getLegacyGoogleAccountConfig("user@example.com");
-
-    assert.equal(config.privateKey, "legacy-private-key");
-    assert.deepEqual(findOneWhere, buildLegacyGoogleAccountConfigWhere("user@example.com"));
-    assert.equal(findCalled, false);
-  });
-
-  it("does not query legacy Google account config without email", async () => {
-    let repositoryCalled = false;
-    const autoFix = createAutoFix({
-      pluginConfigService: null as any,
-      accessService: null as any,
-      storageService: {
-        getRepository() {
-          repositoryCalled = true;
-          return {};
-        },
-      } as any,
-    });
-
-    const config = await autoFix.getLegacyGoogleAccountConfig();
-
-    assert.equal(config, null);
-    assert.equal(repositoryCalled, false);
-  });
-
-  it("skips Google common EAB account key fix outside commercial edition", async () => {
-    let pluginConfigCalled = false;
-    const autoFix = createAutoFix({
-      pluginConfigService: {
-        async getPluginConfig() {
-          pluginConfigCalled = true;
-          return null;
-        },
-      } as any,
-      accessService: null as any,
-      storageService: null as any,
-      sysSettingsService: {
-        async getPublicSettings() {
-          return {
-            oauthProviders: {},
-          };
-        },
-      },
-      oauthBoundService: {
-        async transaction(callback: any) {
-          return await callback({
-            async findOne() {
-              return null;
-            },
-            async update() {
-              return { affected: 0 };
-            },
-          });
-        },
-      },
-    });
-
-    await autoFix.init();
-
-    assert.equal(pluginConfigCalled, false);
-  });
-
-  it("fixes Google common EAB account key in commercial edition", async () => {
-    const { AutoFix: MockedAutoFix } = await esmock("./auto-fix.js", {
-      "@certd/plus-core": {
-        isComm: () => true,
-      },
-    });
-    let getAccessByIdArgs: any[] = [];
-    let findOneWhere: any;
-    let updateAccessParam: any;
-    const autoFix = new MockedAutoFix();
-    autoFix.pluginConfigService = {
-      async getPluginConfig(options: any) {
-        assert.deepEqual(options, {
-          name: "CertApply",
-          type: "builtIn",
-        });
-        return {
-          sysSetting: {
-            input: {
-              googleCommonEabAccessId: 12,
-            },
-          },
-        };
-      },
-    };
-    autoFix.accessService = {
-      async getAccessById(...args: any[]) {
-        getAccessByIdArgs = args;
-        return {
-          kid: "kid-1",
-          email: "user@example.com",
-        };
-      },
-      async updateAccess(param: any) {
-        updateAccessParam = param;
-      },
-    };
-    autoFix.storageService = {
-      getRepository() {
-        return {
-          async findOne(options: any) {
-            findOneWhere = options.where;
-            return {
-              value: JSON.stringify({
-                value: {
-                  privateKey: "legacy-private-key",
-                },
-              }),
-            };
-          },
-        };
-      },
-    };
-
-    await autoFix.fixGoogleCommonEabAccountKey();
-
-    assert.deepEqual(getAccessByIdArgs, [12, false]);
-    assert.deepEqual(findOneWhere, buildLegacyGoogleAccountConfigWhere("user@example.com"));
-    assert.deepEqual(updateAccessParam, {
-      id: 12,
-      eabType: "google",
-      accountKey: buildEabAccountKeyValue("kid-1", "legacy-private-key"),
-    });
-  });
-
-  it("fixes legacy OAuth bound type from string addon loginType and converts loginType to array", async () => {
-    const updates: any[] = [];
-    const autoFix = createAutoFix({
-      pluginConfigService: null as any,
-      accessService: null as any,
-      storageService: null as any,
-      sysSettingsService: {
-        async getPublicSettings() {
-          return {
-            oauthProviders: {
-              clogin: {
-                addonId: 1,
-              },
-            },
-          };
-        },
-      },
-      oauthBoundService: {
-        async transaction(callback: any) {
-          return await callback({
-            async findOne(entity: any, options: any) {
-              assert.equal(entity.name, "AddonEntity");
-              assert.deepEqual(options, { where: { id: 1 } });
-              return {
-                id: 1,
-                setting: JSON.stringify({
-                  loginType: "alipay",
-                }),
-              };
-            },
-            async update(entity: any, where: any, value: any) {
-              updates.push({ entity: entity.name, where, value });
-              return { affected: entity.name === "OauthBoundEntity" ? 1 : 0 };
-            },
-          });
-        },
-      },
-    });
-
-    await autoFix.fixOauthSubtypeBoundType();
-
-    assert.deepEqual(updates[0], {
-      entity: "OauthBoundEntity",
-      where: { type: "clogin" },
-      value: { type: "clogin:alipay" },
-    });
-    assert.equal(updates[1].entity, "AddonEntity");
-    assert.deepEqual(updates[1].where, { id: 1 });
-    assert.deepEqual(JSON.parse(updates[1].value.setting).loginType, ["alipay"]);
-  });
-
-  it("skips OAuth subtype fix when addon loginType is already not legacy string", async () => {
-    let updateCalled = false;
-    const autoFix = createAutoFix({
-      pluginConfigService: null as any,
-      accessService: null as any,
-      storageService: null as any,
-      sysSettingsService: {
-        async getPublicSettings() {
-          return {
-            oauthProviders: {
-              clogin: {
-                addonId: 1,
-              },
-            },
-          };
-        },
-      },
-      oauthBoundService: {
-        async transaction(callback: any) {
-          return await callback({
-            async findOne() {
-              return {
-                id: 1,
-                setting: JSON.stringify({
-                  loginType: ["alipay", "github"],
-                }),
-              };
-            },
-            async update() {
-              updateCalled = true;
-              return { affected: 0 };
-            },
-          });
-        },
-      },
-    });
-
-    await autoFix.fixOauthSubtypeBoundType();
-
-    assert.equal(updateCalled, false);
-  });
-
-});
diff --git a/packages/ui/certd-server/src/modules/auto/fix/auto-fix.test.ts b/packages/ui/certd-server/src/modules/auto/fix/auto-fix.test.ts
new file mode 100644
index 000000000..c0760cfbb
--- /dev/null
+++ b/packages/ui/certd-server/src/modules/auto/fix/auto-fix.test.ts
@@ -0,0 +1,68 @@
+import assert from "assert";
+import { AutoFix } from "./auto-fix.js";
+
+describe("AutoFix", () => {
+  it("runs unfinished fix tasks in order and marks them fixed", async () => {
+    const calls: string[] = [];
+    let savedSetting: any;
+    const autoFix = new AutoFix();
+    autoFix.sysSettingsService = {
+      async getSetting() {
+        return {
+          fixed: {
+            "oauth-subtype-bound-type": true,
+          },
+        };
+      },
+      async saveSetting(setting: any) {
+        savedSetting = {
+          fixed: { ...setting.fixed },
+        };
+      },
+    } as any;
+    autoFix.googleCommonEabAccountKeyFix = {
+      async init() {
+        calls.push("google");
+      },
+    } as any;
+    autoFix.oauthSubtypeBoundTypeFix = {
+      async init() {
+        calls.push("oauth");
+      },
+    } as any;
+    autoFix.certInfoWildcardDomainCountFix = {
+      async init() {
+        calls.push("cert");
+      },
+    } as any;
+    autoFix.suiteContentWildcardDomainCountFix = {
+      async init() {
+        calls.push("suite");
+      },
+    } as any;
+
+    await autoFix.init();
+
+    assert.deepEqual(calls, ["google", "cert", "suite"]);
+    assert.equal(savedSetting.fixed["google-common-eab-account-key"], true);
+    assert.equal(savedSetting.fixed["oauth-subtype-bound-type"], true);
+    assert.equal(savedSetting.fixed["cert-info-wildcard-domain-count"], true);
+    assert.equal(savedSetting.fixed["suite-content-wildcard-domain-count"], true);
+  });
+
+  it("initializes missing fixed map", async () => {
+    const autoFix = new AutoFix();
+    autoFix.sysSettingsService = {
+      async getSetting() {
+        return {};
+      },
+      async saveSetting() {},
+    } as any;
+    autoFix.googleCommonEabAccountKeyFix = { async init() {} } as any;
+    autoFix.oauthSubtypeBoundTypeFix = { async init() {} } as any;
+    autoFix.certInfoWildcardDomainCountFix = { async init() {} } as any;
+    autoFix.suiteContentWildcardDomainCountFix = { async init() {} } as any;
+
+    await autoFix.init();
+  });
+});
diff --git a/packages/ui/certd-server/src/modules/auto/fix/auto-fix.ts b/packages/ui/certd-server/src/modules/auto/fix/auto-fix.ts
new file mode 100644
index 000000000..9e981461a
--- /dev/null
+++ b/packages/ui/certd-server/src/modules/auto/fix/auto-fix.ts
@@ -0,0 +1,64 @@
+import { Inject, Provide, Scope, ScopeEnum } from "@midwayjs/core";
+import { SysAutoFixSetting, SysSettingsService } from "@certd/lib-server";
+import { GoogleCommonEabAccountKeyFix } from "./google-common-eab-account-key-fix.js";
+import { OauthSubtypeBoundTypeFix } from "./oauth-subtype-bound-type-fix.js";
+import { CertInfoWildcardDomainCountFix } from "./cert-info-wildcard-domain-count-fix.js";
+import { SuiteContentWildcardDomainCountFix } from "./suite-content-wildcard-domain-count-fix.js";
+
+type AutoFixTask = {
+  key: string;
+  fix: {
+    init(): Promise<void>;
+  };
+};
+
+@Provide()
+@Scope(ScopeEnum.Request, { allowDowngrade: true })
+export class AutoFix {
+  @Inject()
+  sysSettingsService: SysSettingsService;
+
+  @Inject()
+  googleCommonEabAccountKeyFix: GoogleCommonEabAccountKeyFix;
+
+  @Inject()
+  oauthSubtypeBoundTypeFix: OauthSubtypeBoundTypeFix;
+
+  @Inject()
+  certInfoWildcardDomainCountFix: CertInfoWildcardDomainCountFix;
+
+  @Inject()
+  suiteContentWildcardDomainCountFix: SuiteContentWildcardDomainCountFix;
+
+  async init() {
+    const setting = await this.sysSettingsService.getSetting<SysAutoFixSetting>(SysAutoFixSetting);
+    setting.fixed = setting.fixed || {};
+    const tasks: AutoFixTask[] = [
+      {
+        key: "google-common-eab-account-key",
+        fix: this.googleCommonEabAccountKeyFix,
+      },
+      {
+        key: "oauth-subtype-bound-type",
+        fix: this.oauthSubtypeBoundTypeFix,
+      },
+      {
+        key: "cert-info-wildcard-domain-count",
+        fix: this.certInfoWildcardDomainCountFix,
+      },
+      {
+        key: "suite-content-wildcard-domain-count",
+        fix: this.suiteContentWildcardDomainCountFix,
+      },
+    ];
+
+    for (const task of tasks) {
+      if (setting.fixed?.[task.key]) {
+        continue;
+      }
+      await task.fix.init();
+      setting.fixed[task.key] = true;
+      await this.sysSettingsService.saveSetting(setting);
+    }
+  }
+}
diff --git a/packages/ui/certd-server/src/modules/auto/fix/cert-info-wildcard-domain-count-fix.test.ts b/packages/ui/certd-server/src/modules/auto/fix/cert-info-wildcard-domain-count-fix.test.ts
new file mode 100644
index 000000000..732b7c25b
--- /dev/null
+++ b/packages/ui/certd-server/src/modules/auto/fix/cert-info-wildcard-domain-count-fix.test.ts
@@ -0,0 +1,37 @@
+import assert from "assert";
+import { CertInfoWildcardDomainCountFix } from "./cert-info-wildcard-domain-count-fix.js";
+
+describe("CertInfoWildcardDomainCountFix", () => {
+  it("fixes cert info wildcard domain count only when value changed", async () => {
+    const updated: any[] = [];
+    const rows = [
+      { id: 1, domains: "*.a.com,a.com, *.b.com ", wildcardDomainCount: 0 },
+      { id: 2, domains: "c.com", wildcardDomainCount: 0 },
+      { id: 3, domains: "*.d.com", wildcardDomainCount: 1 },
+    ];
+    const fix = new CertInfoWildcardDomainCountFix();
+    fix.certInfoService = {
+      countWildcardDomains(domains: string[]) {
+        return domains.filter(item => item.trim().toLowerCase().startsWith("*.")).length;
+      },
+      async find() {
+        return rows;
+      },
+      async update(value: any) {
+        updated.push(value);
+        const row = rows.find(item => item.id === value.id);
+        Object.assign(row, value);
+      },
+    } as any;
+
+    await fix.init();
+    await fix.init();
+
+    assert.deepEqual(updated, [
+      {
+        id: 1,
+        wildcardDomainCount: 2,
+      },
+    ]);
+  });
+});
diff --git a/packages/ui/certd-server/src/modules/auto/fix/cert-info-wildcard-domain-count-fix.ts b/packages/ui/certd-server/src/modules/auto/fix/cert-info-wildcard-domain-count-fix.ts
new file mode 100644
index 000000000..46689a093
--- /dev/null
+++ b/packages/ui/certd-server/src/modules/auto/fix/cert-info-wildcard-domain-count-fix.ts
@@ -0,0 +1,45 @@
+import { Inject, Provide, Scope, ScopeEnum } from "@midwayjs/core";
+import { logger } from "@certd/basic";
+import { CertInfoService } from "../../monitor/service/cert-info-service.js";
+
+@Provide()
+@Scope(ScopeEnum.Request, { allowDowngrade: true })
+export class CertInfoWildcardDomainCountFix {
+  @Inject()
+  certInfoService: CertInfoService;
+
+  async init() {
+    if (!this.certInfoService) {
+      return;
+    }
+    try {
+      const list = await this.certInfoService.find({
+        select: {
+          id: true,
+          domains: true,
+          wildcardDomainCount: true,
+        },
+      });
+      let fixedCount = 0;
+      for (const item of list) {
+        if (!item.domains) {
+          continue;
+        }
+        const wildcardDomainCount = this.certInfoService.countWildcardDomains(item.domains.split(","));
+        if ((item.wildcardDomainCount ?? 0) === wildcardDomainCount) {
+          continue;
+        }
+        await this.certInfoService.update({
+          id: item.id,
+          wildcardDomainCount,
+        });
+        fixedCount++;
+      }
+      if (fixedCount > 0) {
+        logger.info(`已修复证书泛域名数量历史数据，数量=${fixedCount}`);
+      }
+    } catch (e: any) {
+      logger.error("修复证书泛域名数量历史数据失败", e);
+    }
+  }
+}
diff --git a/packages/ui/certd-server/src/modules/auto/fix/google-common-eab-account-key-fix.test.ts b/packages/ui/certd-server/src/modules/auto/fix/google-common-eab-account-key-fix.test.ts
new file mode 100644
index 000000000..88d0f0c3e
--- /dev/null
+++ b/packages/ui/certd-server/src/modules/auto/fix/google-common-eab-account-key-fix.test.ts
@@ -0,0 +1,169 @@
+import assert from "assert";
+import esmock from "esmock";
+import { buildEabAccountKeyValue, buildLegacyGoogleAccountConfigWhere, GoogleCommonEabAccountKeyFix, parseStorageValue } from "./google-common-eab-account-key-fix.js";
+
+describe("GoogleCommonEabAccountKeyFix", () => {
+  it("parses legacy storage values", () => {
+    const config = parseStorageValue(
+      JSON.stringify({
+        value: {
+          key: "legacy-private-key",
+          accountUrl: "https://example.com/acct/1",
+        },
+      })
+    );
+
+    assert.equal(config.key, "legacy-private-key");
+  });
+
+  it("builds the EAB account key payload", () => {
+    const payload = JSON.parse(buildEabAccountKeyValue("kid-1", "private-key"));
+
+    assert.deepEqual(payload, {
+      kid: "kid-1",
+      privateKey: "private-key",
+    });
+  });
+
+  it("builds legacy Google account config query by exact email key only", () => {
+    assert.deepEqual(buildLegacyGoogleAccountConfigWhere("user@example.com"), {
+      userId: 1,
+      scope: "user",
+      namespace: "1",
+      key: "acme.config.google.user@example.com",
+    });
+  });
+
+  it("finds legacy Google account config by exact email key only", async () => {
+    let findOneWhere: any;
+    let findCalled = false;
+    const fix = new GoogleCommonEabAccountKeyFix();
+    fix.storageService = {
+      getRepository() {
+        return {
+          async findOne(options: any) {
+            findOneWhere = options.where;
+            return {
+              value: JSON.stringify({
+                value: {
+                  privateKey: "legacy-private-key",
+                },
+              }),
+            };
+          },
+          async find() {
+            findCalled = true;
+            return [];
+          },
+        };
+      },
+    } as any;
+
+    const config = await fix.getLegacyGoogleAccountConfig("user@example.com");
+
+    assert.equal(config.privateKey, "legacy-private-key");
+    assert.deepEqual(findOneWhere, buildLegacyGoogleAccountConfigWhere("user@example.com"));
+    assert.equal(findCalled, false);
+  });
+
+  it("does not query legacy Google account config without email", async () => {
+    let repositoryCalled = false;
+    const fix = new GoogleCommonEabAccountKeyFix();
+    fix.storageService = {
+      getRepository() {
+        repositoryCalled = true;
+        return {};
+      },
+    } as any;
+
+    const config = await fix.getLegacyGoogleAccountConfig();
+
+    assert.equal(config, null);
+    assert.equal(repositoryCalled, false);
+  });
+
+  it("skips Google common EAB account key fix outside commercial edition", async () => {
+    const { GoogleCommonEabAccountKeyFix: MockedFix } = await esmock("./google-common-eab-account-key-fix.js", {
+      "@certd/plus-core": {
+        isComm: () => false,
+      },
+    });
+    let pluginConfigCalled = false;
+    const fix = new MockedFix();
+    fix.pluginConfigService = {
+      async getPluginConfig() {
+        pluginConfigCalled = true;
+        return null;
+      },
+    };
+
+    await fix.init();
+
+    assert.equal(pluginConfigCalled, false);
+  });
+
+  it("fixes Google common EAB account key in commercial edition", async () => {
+    const { GoogleCommonEabAccountKeyFix: MockedFix } = await esmock("./google-common-eab-account-key-fix.js", {
+      "@certd/plus-core": {
+        isComm: () => true,
+      },
+    });
+    let getAccessByIdArgs: any[] = [];
+    let findOneWhere: any;
+    let updateAccessParam: any;
+    const fix = new MockedFix();
+    fix.pluginConfigService = {
+      async getPluginConfig(options: any) {
+        assert.deepEqual(options, {
+          name: "CertApply",
+          type: "builtIn",
+        });
+        return {
+          sysSetting: {
+            input: {
+              googleCommonEabAccessId: 12,
+            },
+          },
+        };
+      },
+    };
+    fix.accessService = {
+      async getAccessById(...args: any[]) {
+        getAccessByIdArgs = args;
+        return {
+          kid: "kid-1",
+          email: "user@example.com",
+        };
+      },
+      async updateAccess(param: any) {
+        updateAccessParam = param;
+      },
+    };
+    fix.storageService = {
+      getRepository() {
+        return {
+          async findOne(options: any) {
+            findOneWhere = options.where;
+            return {
+              value: JSON.stringify({
+                value: {
+                  privateKey: "legacy-private-key",
+                },
+              }),
+            };
+          },
+        };
+      },
+    };
+
+    await fix.init();
+
+    assert.deepEqual(getAccessByIdArgs, [12, false]);
+    assert.deepEqual(findOneWhere, buildLegacyGoogleAccountConfigWhere("user@example.com"));
+    assert.deepEqual(updateAccessParam, {
+      id: 12,
+      eabType: "google",
+      accountKey: buildEabAccountKeyValue("kid-1", "legacy-private-key"),
+    });
+  });
+});
diff --git a/packages/ui/certd-server/src/modules/auto/auto-fix.ts b/packages/ui/certd-server/src/modules/auto/fix/google-common-eab-account-key-fix.ts
similarity index 51%
rename from packages/ui/certd-server/src/modules/auto/auto-fix.ts
rename to packages/ui/certd-server/src/modules/auto/fix/google-common-eab-account-key-fix.ts
index cd37e550e..24f1a4e22 100644
--- a/packages/ui/certd-server/src/modules/auto/auto-fix.ts
+++ b/packages/ui/certd-server/src/modules/auto/fix/google-common-eab-account-key-fix.ts
@@ -1,11 +1,9 @@
 import { Inject, Provide, Scope, ScopeEnum } from "@midwayjs/core";
 import { logger } from "@certd/basic";
-import { AccessService, AddonEntity, SysSettingsService } from "@certd/lib-server";
+import { AccessService } from "@certd/lib-server";
 import { isComm } from "@certd/plus-core";
-import { PluginConfigService } from "../plugin/service/plugin-config-service.js";
-import { StorageService } from "../pipeline/service/storage-service.js";
-import { OauthBoundService } from "../login/service/oauth-bound-service.js";
-import { OauthBoundEntity } from "../login/entity/oauth-bound.js";
+import { PluginConfigService } from "../../plugin/service/plugin-config-service.js";
+import { StorageService } from "../../pipeline/service/storage-service.js";
 
 export function parseStorageValue(value?: string) {
   if (!value) {
@@ -35,13 +33,9 @@ export function buildLegacyGoogleAccountConfigWhere(email: string) {
   };
 }
 
-export function buildOauthBoundType(type: string, subtype?: string) {
-  return subtype ? `${type}:${subtype}` : type;
-}
-
 @Provide()
 @Scope(ScopeEnum.Request, { allowDowngrade: true })
-export class AutoFix {
+export class GoogleCommonEabAccountKeyFix {
   @Inject()
   pluginConfigService: PluginConfigService;
 
@@ -51,67 +45,7 @@ export class AutoFix {
   @Inject()
   storageService: StorageService;
 
-  @Inject()
-  sysSettingsService: SysSettingsService;
-
-  @Inject()
-  oauthBoundService: OauthBoundService;
-
   async init() {
-    await this.fixGoogleCommonEabAccountKey();
-    await this.fixOauthSubtypeBoundType();
-  }
-
-  async fixOauthSubtypeBoundType() {
-    try {
-      const publicSettings = await this.sysSettingsService.getPublicSettings();
-      const oauthProviders = publicSettings.oauthProviders || {};
-      await this.oauthBoundService.transaction(async manager => {
-        for (const [type, provider] of Object.entries(oauthProviders)) {
-          if (!provider.addonId) {
-            continue;
-          }
-
-          const addonEntity = await manager.findOne(AddonEntity, { where: { id: provider.addonId } });
-          const legacyLoginType = this.getLegacyAddonLoginType(addonEntity?.setting);
-          if (!legacyLoginType) {
-            continue;
-          }
-
-          const newType = buildOauthBoundType(type, legacyLoginType);
-          const res = await manager.update(OauthBoundEntity, { type }, { type: newType });
-          if (res.affected) {
-            logger.info(`已修复OAuth绑定历史数据，${type} -> ${newType}，数量=${res.affected}`);
-          }
-          await this.convertLegacyAddonLoginTypeToArray(addonEntity, legacyLoginType, manager);
-        }
-      });
-    } catch (e: any) {
-      logger.error("修复OAuth subtype绑定历史数据失败", e);
-    }
-  }
-
-  private getLegacyAddonLoginType(settingValue?: string) {
-    if (!settingValue) {
-      return null;
-    }
-    const setting = JSON.parse(settingValue);
-    return typeof setting.loginType === "string" && setting.loginType ? setting.loginType : null;
-  }
-
-  private async convertLegacyAddonLoginTypeToArray(addonEntity: AddonEntity | null, loginType: string, manager: any) {
-    if (!addonEntity?.setting) {
-      return;
-    }
-    const setting = JSON.parse(addonEntity.setting);
-    if (typeof setting.loginType !== "string") {
-      return;
-    }
-    setting.loginType = [loginType];
-    await manager.update(AddonEntity, { id: addonEntity.id }, { setting: JSON.stringify(setting) });
-  }
-
-  async fixGoogleCommonEabAccountKey() {
     if (!isComm()) {
       return;
     }
@@ -163,7 +97,7 @@ export class AutoFix {
     }
     return null;
   }
-  
+
   parseStorageValue(value?: string) {
     return parseStorageValue(value);
   }
diff --git a/packages/ui/certd-server/src/modules/auto/fix/oauth-subtype-bound-type-fix.test.ts b/packages/ui/certd-server/src/modules/auto/fix/oauth-subtype-bound-type-fix.test.ts
new file mode 100644
index 000000000..53feffff5
--- /dev/null
+++ b/packages/ui/certd-server/src/modules/auto/fix/oauth-subtype-bound-type-fix.test.ts
@@ -0,0 +1,94 @@
+import assert from "assert";
+import { buildOauthBoundType, OauthSubtypeBoundTypeFix } from "./oauth-subtype-bound-type-fix.js";
+
+describe("OauthSubtypeBoundTypeFix", () => {
+  it("builds OAuth subtype bound type", () => {
+    assert.equal(buildOauthBoundType("clogin", "alipay"), "clogin:alipay");
+    assert.equal(buildOauthBoundType("github"), "github");
+  });
+
+  it("fixes legacy OAuth bound type from string addon loginType and converts loginType to array", async () => {
+    const updates: any[] = [];
+    const fix = new OauthSubtypeBoundTypeFix();
+    fix.sysSettingsService = {
+      async getPublicSettings() {
+        return {
+          oauthProviders: {
+            clogin: {
+              addonId: 1,
+            },
+          },
+        };
+      },
+    } as any;
+    fix.oauthBoundService = {
+      async transaction(callback: any) {
+        return await callback({
+          async findOne(entity: any, options: any) {
+            assert.equal(entity.name, "AddonEntity");
+            assert.deepEqual(options, { where: { id: 1 } });
+            return {
+              id: 1,
+              setting: JSON.stringify({
+                loginType: "alipay",
+              }),
+            };
+          },
+          async update(entity: any, where: any, value: any) {
+            updates.push({ entity: entity.name, where, value });
+            return { affected: entity.name === "OauthBoundEntity" ? 1 : 0 };
+          },
+        });
+      },
+    } as any;
+
+    await fix.init();
+
+    assert.deepEqual(updates[0], {
+      entity: "OauthBoundEntity",
+      where: { type: "clogin" },
+      value: { type: "clogin:alipay" },
+    });
+    assert.equal(updates[1].entity, "AddonEntity");
+    assert.deepEqual(updates[1].where, { id: 1 });
+    assert.deepEqual(JSON.parse(updates[1].value.setting).loginType, ["alipay"]);
+  });
+
+  it("skips OAuth subtype fix when addon loginType is already not legacy string", async () => {
+    let updateCalled = false;
+    const fix = new OauthSubtypeBoundTypeFix();
+    fix.sysSettingsService = {
+      async getPublicSettings() {
+        return {
+          oauthProviders: {
+            clogin: {
+              addonId: 1,
+            },
+          },
+        };
+      },
+    } as any;
+    fix.oauthBoundService = {
+      async transaction(callback: any) {
+        return await callback({
+          async findOne() {
+            return {
+              id: 1,
+              setting: JSON.stringify({
+                loginType: ["alipay", "github"],
+              }),
+            };
+          },
+          async update() {
+            updateCalled = true;
+            return { affected: 0 };
+          },
+        });
+      },
+    } as any;
+
+    await fix.init();
+
+    assert.equal(updateCalled, false);
+  });
+});
diff --git a/packages/ui/certd-server/src/modules/auto/fix/oauth-subtype-bound-type-fix.ts b/packages/ui/certd-server/src/modules/auto/fix/oauth-subtype-bound-type-fix.ts
new file mode 100644
index 000000000..a44ce8d85
--- /dev/null
+++ b/packages/ui/certd-server/src/modules/auto/fix/oauth-subtype-bound-type-fix.ts
@@ -0,0 +1,68 @@
+import { Inject, Provide, Scope, ScopeEnum } from "@midwayjs/core";
+import { logger } from "@certd/basic";
+import { AddonEntity, SysSettingsService } from "@certd/lib-server";
+import { OauthBoundService } from "../../login/service/oauth-bound-service.js";
+import { OauthBoundEntity } from "../../login/entity/oauth-bound.js";
+
+export function buildOauthBoundType(type: string, subtype?: string) {
+  return subtype ? `${type}:${subtype}` : type;
+}
+
+@Provide()
+@Scope(ScopeEnum.Request, { allowDowngrade: true })
+export class OauthSubtypeBoundTypeFix {
+  @Inject()
+  sysSettingsService: SysSettingsService;
+
+  @Inject()
+  oauthBoundService: OauthBoundService;
+
+  async init() {
+    try {
+      const publicSettings = await this.sysSettingsService.getPublicSettings();
+      const oauthProviders = publicSettings.oauthProviders || {};
+      await this.oauthBoundService.transaction(async manager => {
+        for (const [type, provider] of Object.entries(oauthProviders)) {
+          if (!provider.addonId) {
+            continue;
+          }
+
+          const addonEntity = await manager.findOne(AddonEntity, { where: { id: provider.addonId } });
+          const legacyLoginType = this.getLegacyAddonLoginType(addonEntity?.setting);
+          if (!legacyLoginType) {
+            continue;
+          }
+
+          const newType = buildOauthBoundType(type, legacyLoginType);
+          const res = await manager.update(OauthBoundEntity, { type }, { type: newType });
+          if (res.affected) {
+            logger.info(`已修复OAuth绑定历史数据，${type} -> ${newType}，数量=${res.affected}`);
+          }
+          await this.convertLegacyAddonLoginTypeToArray(addonEntity, legacyLoginType, manager);
+        }
+      });
+    } catch (e: any) {
+      logger.error("修复OAuth subtype绑定历史数据失败", e);
+    }
+  }
+
+  private getLegacyAddonLoginType(settingValue?: string) {
+    if (!settingValue) {
+      return null;
+    }
+    const setting = JSON.parse(settingValue);
+    return typeof setting.loginType === "string" && setting.loginType ? setting.loginType : null;
+  }
+
+  private async convertLegacyAddonLoginTypeToArray(addonEntity: AddonEntity | null, loginType: string, manager: any) {
+    if (!addonEntity?.setting) {
+      return;
+    }
+    const setting = JSON.parse(addonEntity.setting);
+    if (typeof setting.loginType !== "string") {
+      return;
+    }
+    setting.loginType = [loginType];
+    await manager.update(AddonEntity, { id: addonEntity.id }, { setting: JSON.stringify(setting) });
+  }
+}
diff --git a/packages/ui/certd-server/src/modules/auto/fix/suite-content-wildcard-domain-count-fix.test.ts b/packages/ui/certd-server/src/modules/auto/fix/suite-content-wildcard-domain-count-fix.test.ts
new file mode 100644
index 000000000..58c8f3f81
--- /dev/null
+++ b/packages/ui/certd-server/src/modules/auto/fix/suite-content-wildcard-domain-count-fix.test.ts
@@ -0,0 +1,72 @@
+import assert from "assert";
+import { fixSuiteContentWildcardDomainCount, SuiteContentWildcardDomainCountFix } from "./suite-content-wildcard-domain-count-fix.js";
+
+describe("SuiteContentWildcardDomainCountFix", () => {
+  it("fills missing suite wildcard domain count from total domain count", () => {
+    const fixed = fixSuiteContentWildcardDomainCount(
+      JSON.stringify({
+        maxDomainCount: 10,
+      })
+    );
+
+    assert.equal(JSON.parse(fixed).maxWildcardDomainCount, 10);
+    assert.equal(
+      JSON.parse(
+        fixSuiteContentWildcardDomainCount(
+          JSON.stringify({
+            maxDomainCount: -1,
+          })
+        )
+      ).maxWildcardDomainCount,
+      -1
+    );
+    assert.equal(
+      fixSuiteContentWildcardDomainCount(
+        JSON.stringify({
+          maxDomainCount: 10,
+          maxWildcardDomainCount: 3,
+        })
+      ),
+      null
+    );
+  });
+
+  it("fixes suite content wildcard domain count in product and user suite tables", async () => {
+    const rows = {
+      cd_product: [
+        { id: 1, content: JSON.stringify({ maxDomainCount: 1 }) },
+        { id: 2, content: JSON.stringify({ maxDomainCount: 1, maxWildcardDomainCount: 0 }) },
+      ],
+      cd_user_suite: [{ id: 3, content: JSON.stringify({ maxDomainCount: 2 }) }],
+    };
+    const updates: any[] = [];
+    const entityManager = {
+      async query(sql: string) {
+        const table = sql.includes("cd_product") ? "cd_product" : "cd_user_suite";
+        return rows[table];
+      },
+      async update(tableName: string, where: any, value: any) {
+        updates.push({ tableName, where, value });
+        const row = rows[tableName].find((item: any) => item.id === where.id);
+        Object.assign(row, value);
+      },
+    };
+    const fix = new SuiteContentWildcardDomainCountFix();
+    fix.dataSourceManager = {
+      getDataSource() {
+        return {
+          manager: entityManager,
+        };
+      },
+    } as any;
+
+    await fix.init();
+    await fix.init();
+
+    assert.equal(updates.length, 2);
+    assert.equal(updates[0].tableName, "cd_product");
+    assert.equal(JSON.parse(updates[0].value.content).maxWildcardDomainCount, 1);
+    assert.equal(updates[1].tableName, "cd_user_suite");
+    assert.equal(JSON.parse(updates[1].value.content).maxWildcardDomainCount, 2);
+  });
+});
diff --git a/packages/ui/certd-server/src/modules/auto/fix/suite-content-wildcard-domain-count-fix.ts b/packages/ui/certd-server/src/modules/auto/fix/suite-content-wildcard-domain-count-fix.ts
new file mode 100644
index 000000000..aeb650a94
--- /dev/null
+++ b/packages/ui/certd-server/src/modules/auto/fix/suite-content-wildcard-domain-count-fix.ts
@@ -0,0 +1,54 @@
+import { Inject, Provide, Scope, ScopeEnum } from "@midwayjs/core";
+import { logger } from "@certd/basic";
+import { TypeORMDataSourceManager } from "@midwayjs/typeorm";
+
+export function fixSuiteContentWildcardDomainCount(contentValue?: string) {
+  if (!contentValue) {
+    return null;
+  }
+  const content = JSON.parse(contentValue);
+  if (content.maxWildcardDomainCount != null) {
+    return null;
+  }
+  content.maxWildcardDomainCount = content.maxDomainCount == null || content.maxDomainCount === -1 ? -1 : content.maxDomainCount;
+  return JSON.stringify(content);
+}
+
+
+@Provide()
+@Scope(ScopeEnum.Request, { allowDowngrade: true })
+export class SuiteContentWildcardDomainCountFix {
+  @Inject()
+  dataSourceManager: TypeORMDataSourceManager;
+
+  async init() {
+    if (!this.dataSourceManager) {
+      return;
+    }
+    try {
+      const entityManager = this.dataSourceManager.getDataSource("default").manager;
+      let fixedCount = 0;
+      fixedCount += await this.fixSuiteContentWildcardDomainCountByTable(entityManager, "cd_product");
+      fixedCount += await this.fixSuiteContentWildcardDomainCountByTable(entityManager, "cd_user_suite");
+      if (fixedCount > 0) {
+        logger.info(`已修复套餐最大泛域名数量历史数据，数量=${fixedCount}`);
+      }
+    } catch (e: any) {
+      logger.error("修复套餐最大泛域名数量历史数据失败", e);
+    }
+  }
+
+  private async fixSuiteContentWildcardDomainCountByTable(entityManager: any, tableName: string) {
+    const list = await entityManager.query(`select id, content from ${tableName}`);
+    let fixedCount = 0;
+    for (const item of list) {
+      const content = fixSuiteContentWildcardDomainCount(item.content);
+      if (!content) {
+        continue;
+      }
+      await entityManager.update(tableName, { id: item.id }, { content });
+      fixedCount++;
+    }
+    return fixedCount;
+  }
+}
diff --git a/packages/ui/certd-server/src/modules/basic/service/email-service.ts b/packages/ui/certd-server/src/modules/basic/service/email-service.ts
index fb2955060..428bb26ef 100644
--- a/packages/ui/certd-server/src/modules/basic/service/email-service.ts
+++ b/packages/ui/certd-server/src/modules/basic/service/email-service.ts
@@ -8,7 +8,7 @@ import { isComm, isPlus } from '@certd/plus-core';
 import nodemailer from 'nodemailer';
 import { SendMailOptions } from 'nodemailer';
 import { UserSettingsService } from '../../mine/service/user-settings-service.js';
-import { AddonService, PlusService, SysEmailConf, SysSettingsService, SysSiteInfo } from '@certd/lib-server';
+import { AddonService, PlusService, SysEmailConf, SysInstallInfo, SysSettingsService, SysSiteInfo } from '@certd/lib-server';
 import { getEmailSettings } from '../../sys/settings/fix.js';
 import { UserEmailSetting } from "../../mine/service/models.js";
 import { AddonGetterService } from '../../pipeline/service/addon-getter-service.js';
@@ -131,12 +131,21 @@ export class EmailService implements IEmailService {
       data: {
         title: '测试邮件,from certd',
         content: '测试邮件,from certd',
-        url: "https://certd.handfree.work",
+        url: await this.getTestEmailUrl(),
       },
       receivers: [receiver],
     });
   }
 
+  private async getTestEmailUrl() {
+    const defaultUrl = "https://certd.docmirror.cn";
+    if (!isComm()) {
+      return defaultUrl;
+    }
+    const installInfo = await this.sysSettingsService.getSetting<SysInstallInfo>(SysInstallInfo);
+    return installInfo?.bindUrl || installInfo?.bindUrl2 || defaultUrl;
+  }
+
   async list(userId: any) {
     const userEmailSetting = await this.settingsService.getSetting<UserEmailSetting>(userId,null, UserEmailSetting)
     return userEmailSetting.list;
@@ -157,7 +166,6 @@ export class EmailService implements IEmailService {
     await this.settingsService.saveSetting(userId, null, userEmailSetting)
   }
 
-
   async sendByTemplate(req: EmailSendByTemplateReq) {
     let content = null
     const emailConf = await this.sysSettingsService.getSetting<SysEmailConf>(SysEmailConf);
diff --git a/packages/ui/certd-server/src/modules/monitor/entity/cert-info.ts b/packages/ui/certd-server/src/modules/monitor/entity/cert-info.ts
index 1f1234ffb..d47d19138 100644
--- a/packages/ui/certd-server/src/modules/monitor/entity/cert-info.ts
+++ b/packages/ui/certd-server/src/modules/monitor/entity/cert-info.ts
@@ -18,6 +18,9 @@ export class CertInfoEntity {
   @Column({ name: 'domain_count', comment: '域名数量' })
   domainCount: number;
 
+  @Column({ name: 'wildcard_domain_count', comment: '泛域名数量', default: 0 })
+  wildcardDomainCount: number;
+
   @Column({ name: 'pipeline_id', comment: '关联流水线id' })
   pipelineId: number;
 
diff --git a/packages/ui/certd-server/src/modules/monitor/service/cert-info-service.test.ts b/packages/ui/certd-server/src/modules/monitor/service/cert-info-service.test.ts
new file mode 100644
index 000000000..2b2fadd92
--- /dev/null
+++ b/packages/ui/certd-server/src/modules/monitor/service/cert-info-service.test.ts
@@ -0,0 +1,29 @@
+import assert from "assert";
+import { CertInfoService } from "./cert-info-service.js";
+
+describe("CertInfoService", () => {
+  it("counts wildcard domains by normalized prefix", () => {
+    const service = new CertInfoService();
+
+    assert.equal(service.countWildcardDomains(["*.a.com", "a.com", " *.B.com "]), 2);
+  });
+
+  it("saves wildcard domain count when updating pipeline domains", async () => {
+    const service = new CertInfoService();
+    let saved: any;
+    service.repository = {
+      async findOne() {
+        return null;
+      },
+    } as any;
+    service.addOrUpdate = async (bean: any) => {
+      saved = bean;
+      return bean;
+    };
+
+    await service.updateDomains(1, 2, null, ["*.a.com", "a.com", "*.b.com"], "pipeline");
+
+    assert.equal(saved.domainCount, 3);
+    assert.equal(saved.wildcardDomainCount, 2);
+  });
+});
diff --git a/packages/ui/certd-server/src/modules/monitor/service/cert-info-service.ts b/packages/ui/certd-server/src/modules/monitor/service/cert-info-service.ts
index 190840966..4c7c2852d 100644
--- a/packages/ui/certd-server/src/modules/monitor/service/cert-info-service.ts
+++ b/packages/ui/certd-server/src/modules/monitor/service/cert-info-service.ts
@@ -40,6 +40,22 @@ export class CertInfoService extends BaseService<CertInfoEntity> {
     });
   }
 
+  async getUserWildcardDomainCount(userId: number) {
+    if (userId == null) {
+      throw new Error('userId is required');
+    }
+    return await this.repository.sum('wildcardDomainCount', {
+      userId,
+    });
+  }
+
+  countWildcardDomains(domains?: string[]) {
+    if (!domains) {
+      return 0;
+    }
+    return domains.filter(domain => domain?.trim().toLowerCase().startsWith("*.")).length;
+  }
+
   async updateDomains(pipelineId: number, userId: number, projectId: number, domains: string[],fromType?:string) {
     const found = await this.repository.findOne({
       where: {
@@ -67,10 +83,12 @@ export class CertInfoService extends BaseService<CertInfoEntity> {
       bean.domain = '';
       bean.domains = '';
       bean.domainCount = 0;
+      bean.wildcardDomainCount = 0;
     } else {
       bean.domain = domains[0];
       bean.domains = domains.join(',');
       bean.domainCount = domains.length;
+      bean.wildcardDomainCount = this.countWildcardDomains(domains);
     }
 
     await this.addOrUpdate(bean);
@@ -171,6 +189,7 @@ export class CertInfoService extends BaseService<CertInfoEntity> {
     bean.domains = domains.join(',');
     bean.domain = domains[0];
     bean.domainCount = domains.length;
+    bean.wildcardDomainCount = this.countWildcardDomains(domains);
     bean.effectiveTime = certReader.effective;
     bean.expiresTime = certReader.expires;
     bean.certProvider = certReader.detail.issuer.commonName;
diff --git a/packages/ui/certd-server/src/modules/monitor/service/site-info-service.ts b/packages/ui/certd-server/src/modules/monitor/service/site-info-service.ts
index 1c17f7ab8..c3b2b618d 100644
--- a/packages/ui/certd-server/src/modules/monitor/service/site-info-service.ts
+++ b/packages/ui/certd-server/src/modules/monitor/service/site-info-service.ts
@@ -1,5 +1,5 @@
 import {Inject, Provide, Scope, ScopeEnum} from "@midwayjs/core";
-import {BaseService, Constants, NeedSuiteException, NeedVIPException, SysSettingsService} from "@certd/lib-server";
+import {BaseService, Constants, isEnterprise, NeedSuiteException, NeedVIPException, SysSettingsService} from "@certd/lib-server";
 import {InjectEntityModel} from "@midwayjs/typeorm";
 import {In, Repository} from "typeorm";
 import {SiteInfoEntity} from "../entity/site-info.js";
@@ -59,25 +59,35 @@ export class SiteInfoService extends BaseService<SiteInfoEntity> {
     return this.repository;
   }
 
-  async add(data: SiteInfoEntity) {
-    if (data.userId == null) {
-      throw new Error("userId is required");
+  async checkMonitorLimit(userId: number) {
+    if (isEnterprise()) {
+      //企业模式不限制
+      return;
     }
 
     if (isComm()) {
       const suiteSetting = await this.userSuiteService.getSuiteSetting();
       if (suiteSetting.enabled) {
-        const userSuite = await this.userSuiteService.getMySuiteDetail(data.userId);
+        const userSuite = await this.userSuiteService.getMySuiteDetail(userId);
         if (userSuite.monitorCount.max != -1 && userSuite.monitorCount.max <= userSuite.monitorCount.used) {
           throw new NeedSuiteException("站点监控数量已达上限，请购买或升级套餐");
         }
       }
     } else if (!isPlus()) {
-      const count = await this.getUserMonitorCount(data.userId);
+      const count = await this.getUserMonitorCount(userId);
       if (count >= 1) {
         throw new NeedVIPException("站点监控数量已达上限，请升级专业版");
       }
     }
+  }
+
+  async add(data: SiteInfoEntity) {
+    if (data.userId == null) {
+      throw new Error("userId is required");
+    }
+
+    await this.checkMonitorLimit(data.userId);
+   
     data.disabled = false;
 
     const found = await this.repository.findOne({
diff --git a/packages/ui/certd-server/src/modules/pipeline/service/pipeline-service.ts b/packages/ui/certd-server/src/modules/pipeline/service/pipeline-service.ts
index c29a7c898..1c6835e3e 100644
--- a/packages/ui/certd-server/src/modules/pipeline/service/pipeline-service.ts
+++ b/packages/ui/certd-server/src/modules/pipeline/service/pipeline-service.ts
@@ -53,6 +53,7 @@ import { executorQueue } from "@certd/lib-server";
 import parser from "cron-parser";
 import { ProjectService } from "../../sys/enterprise/service/project-service.js";
 import { CertApplyStepInputPatch, updateCertApplyStepInputs } from "./pipeline-batch-update.js";
+import { calcNextSuiteCountUsed } from "./pipeline-suite-limit.js";
 const runningTasks: Map<string | number, Executor> = new Map();
 
 
@@ -76,7 +77,6 @@ export class PipelineService extends BaseService<PipelineEntity> {
   historyService: HistoryService;
   @Inject()
   historyLogService: HistoryLogService;
-
   @Inject()
   pluginConfigGetter: PluginConfigGetter;
 
@@ -287,10 +287,7 @@ export class PipelineService extends BaseService<PipelineEntity> {
       });
     }
 
-    if (!isUpdate) {
-      //如果是添加，校验数量
-      await this.checkMaxPipelineCount(bean, pipeline, domains);
-    }
+    await this.checkMaxPipelineCount(bean, pipeline, domains, old);
 
     if (!bean.status) {
       bean.status = ResultType.none;
@@ -345,7 +342,7 @@ export class PipelineService extends BaseService<PipelineEntity> {
     return bean
   }
 
-  private async checkMaxPipelineCount(bean: PipelineEntity, pipeline: Pipeline, domains: string[]) {
+  private async checkMaxPipelineCount(bean: PipelineEntity, pipeline: Pipeline, domains: string[], old?: PipelineEntity) {
     // if (!isPlus()) {
     //   const count = await this.repository.count();
     //   if (count >= freeCount) {
@@ -363,15 +360,31 @@ export class PipelineService extends BaseService<PipelineEntity> {
       const suiteSetting = await this.userSuiteService.getSuiteSetting();
       if (suiteSetting.enabled) {
         const userSuite = await this.userSuiteService.getMySuiteDetail(bean.userId);
-        if (userSuite?.pipelineCount.max != -1 && userSuite?.pipelineCount.used + 1 > userSuite?.pipelineCount.max) {
+        if (!old && userSuite?.pipelineCount.max != -1 && userSuite?.pipelineCount.used + 1 > userSuite?.pipelineCount.max) {
           throw new NeedSuiteException(`对不起，您最多只能创建${userSuite?.pipelineCount.max}条流水线，请购买或升级套餐`);
         }
 
-        if (userSuite.domainCount.max != -1 && userSuite.domainCount.used + domains.length > userSuite.domainCount.max) {
+        let oldDomainCount = 0;
+        let oldWildcardDomainCount = 0;
+        if (old?.id) {
+          const oldCertInfo = await this.certInfoService.getByPipelineId(old.id);
+          oldDomainCount = oldCertInfo?.domainCount ?? 0;
+          oldWildcardDomainCount = oldCertInfo?.wildcardDomainCount ?? 0;
+        }
+
+        const nextDomainCountUsed = calcNextSuiteCountUsed(userSuite.domainCount.used, oldDomainCount, domains.length);
+        if (userSuite.domainCount.max != -1 && nextDomainCountUsed > userSuite.domainCount.max) {
           throw new NeedSuiteException(`对不起，您最多只能添加${userSuite.domainCount.max}个域名，请购买或升级套餐`);
         }
+
+        const suiteWildcardDomainCount = userSuite.wildcardDomainCount;
+        const wildcardDomainCount = this.certInfoService.countWildcardDomains(domains);
+        const nextWildcardDomainCountUsed = calcNextSuiteCountUsed(suiteWildcardDomainCount.used, oldWildcardDomainCount, wildcardDomainCount);
+        if (suiteWildcardDomainCount.max != -1 && nextWildcardDomainCountUsed > suiteWildcardDomainCount.max) {
+          throw new NeedSuiteException(`对不起，您最多只能添加${suiteWildcardDomainCount.max}个泛域名，请购买或升级套餐`);
+        }
       }
-    } else {
+    } else if (!old) {
       //非商业版校验用户最大流水线数量
       const userId = bean.userId;
       const userIsAdmin = await this.userService.isAdmin(userId);
@@ -1332,7 +1345,6 @@ export class PipelineService extends BaseService<PipelineEntity> {
   }
 
   async createAutoPipeline(req: { domains: string[]; email: string; userId: number, projectId?: number, from: string }) {
-
     const randomHour = Math.floor(Math.random() * 6);
     const randomMin = Math.floor(Math.random() * 60);
     const randomCron = `0 ${randomMin} ${randomHour} * * *`;
diff --git a/packages/ui/certd-server/src/modules/pipeline/service/pipeline-suite-limit.test.ts b/packages/ui/certd-server/src/modules/pipeline/service/pipeline-suite-limit.test.ts
new file mode 100644
index 000000000..a774c471c
--- /dev/null
+++ b/packages/ui/certd-server/src/modules/pipeline/service/pipeline-suite-limit.test.ts
@@ -0,0 +1,9 @@
+import assert from "assert";
+import { calcNextSuiteCountUsed } from "./pipeline-suite-limit.js";
+
+describe("Pipeline suite limits", () => {
+  it("calculates next usage by subtracting current pipeline usage on update", () => {
+    assert.equal(calcNextSuiteCountUsed(2, 1, 1), 2);
+    assert.equal(calcNextSuiteCountUsed(2, 1, 2), 3);
+  });
+});
diff --git a/packages/ui/certd-server/src/modules/pipeline/service/pipeline-suite-limit.ts b/packages/ui/certd-server/src/modules/pipeline/service/pipeline-suite-limit.ts
new file mode 100644
index 000000000..165863e60
--- /dev/null
+++ b/packages/ui/certd-server/src/modules/pipeline/service/pipeline-suite-limit.ts
@@ -0,0 +1,3 @@
+export function calcNextSuiteCountUsed(used: number, oldCount: number, newCount: number) {
+  return (used ?? 0) - (oldCount ?? 0) + (newCount ?? 0);
+}
diff --git a/packages/ui/certd-server/src/modules/suite/service/my-count-service.ts b/packages/ui/certd-server/src/modules/suite/service/my-count-service.ts
index 9faa2f14b..cedef6bf5 100644
--- a/packages/ui/certd-server/src/modules/suite/service/my-count-service.ts
+++ b/packages/ui/certd-server/src/modules/suite/service/my-count-service.ts
@@ -21,10 +21,12 @@ export class MyCountService implements IUsedCountService {
     }
     const pipelineCountUsed = await this.pipelineService.getUserPipelineCount(userId);
     const domainCountUsed = await this.certInfoService.getUserDomainCount(userId);
+    const wildcardDomainCountUsed = await this.certInfoService.getUserWildcardDomainCount(userId);
     const monitorCountUsed = await this.siteInfoService.getUserMonitorCount(userId);
     return {
       pipelineCountUsed,
       domainCountUsed,
+      wildcardDomainCountUsed,
       monitorCountUsed,
     };
   }
diff --git a/packages/ui/certd-server/src/modules/sys/authority/service/user-password-init.test.ts b/packages/ui/certd-server/src/modules/sys/authority/service/user-password-init.test.ts
new file mode 100644
index 000000000..96fa3f77e
--- /dev/null
+++ b/packages/ui/certd-server/src/modules/sys/authority/service/user-password-init.test.ts
@@ -0,0 +1,51 @@
+/// <reference types="mocha" />
+
+import assert from "node:assert/strict";
+import { UserService } from "./user-service.js";
+
+describe("UserService.initPassword", () => {
+  function createService(user: any) {
+    const service = new UserService();
+    service.info = async () => user;
+    let updatedParam: any;
+    service.update = async (param: any) => {
+      updatedParam = param;
+    };
+    return { service, getUpdatedParam: () => updatedParam };
+  }
+
+  it("sets a new password when current password is changeme", async () => {
+    const { service, getUpdatedParam } = createService({
+      id: 12,
+      password: "changeme",
+      passwordVersion: 2,
+    });
+
+    await service.initPassword(12, {
+      newPassword: "new-password",
+      confirmNewPassword: "new-password",
+    });
+
+    assert.deepEqual(getUpdatedParam(), {
+      id: 12,
+      password: "new-password",
+    });
+  });
+
+  it("rejects initPassword after password has already been set", async () => {
+    const { service } = createService({
+      id: 12,
+      password: "$2a$10$already-hashed",
+      passwordVersion: 2,
+    });
+
+    await assert.rejects(
+      () =>
+        service.initPassword(12, {
+          newPassword: "new-password",
+          confirmNewPassword: "new-password",
+        }),
+      /当前账号已设置密码/
+    );
+  });
+});
diff --git a/packages/ui/certd-server/src/modules/sys/authority/service/user-service.ts b/packages/ui/certd-server/src/modules/sys/authority/service/user-service.ts
index 750f2d769..ac931a48f 100644
--- a/packages/ui/certd-server/src/modules/sys/authority/service/user-service.ts
+++ b/packages/ui/certd-server/src/modules/sys/authority/service/user-service.ts
@@ -1,22 +1,22 @@
-import { Inject, Provide, Scope, ScopeEnum } from '@midwayjs/core';
-import { InjectEntityModel } from '@midwayjs/typeorm';
-import { EntityManager, In, MoreThan, Not, Repository } from 'typeorm';
-import { UserEntity } from '../entity/user.js';
-import * as _ from 'lodash-es';
-import { BaseService, CommonException, Constants, FileService, SysInstallInfo, SysSettingsService } from '@certd/lib-server';
-import { RoleService } from './role-service.js';
-import { PermissionService } from './permission-service.js';
-import { UserRoleService } from './user-role-service.js';
-import { UserRoleEntity } from '../entity/user-role.js';
-import bcrypt from 'bcryptjs';
-import { RandomUtil } from '../../../../utils/random.js';
-import dayjs from 'dayjs';
-import { DbAdapter } from '../../../db/index.js';
-import { simpleNanoId, utils } from '@certd/basic';
-import { OauthBoundService } from '../../../login/service/oauth-bound-service.js';
+import { Inject, Provide, Scope, ScopeEnum } from "@midwayjs/core";
+import { InjectEntityModel } from "@midwayjs/typeorm";
+import { EntityManager, In, MoreThan, Not, Repository } from "typeorm";
+import { UserEntity } from "../entity/user.js";
+import * as _ from "lodash-es";
+import { BaseService, CommonException, Constants, FileService, SysInstallInfo, SysSettingsService } from "@certd/lib-server";
+import { RoleService } from "./role-service.js";
+import { PermissionService } from "./permission-service.js";
+import { UserRoleService } from "./user-role-service.js";
+import { UserRoleEntity } from "../entity/user-role.js";
+import bcrypt from "bcryptjs";
+import { RandomUtil } from "../../../../utils/random.js";
+import dayjs from "dayjs";
+import { DbAdapter } from "../../../db/index.js";
+import { simpleNanoId, utils } from "@certd/basic";
+import { OauthBoundService } from "../../../login/service/oauth-bound-service.js";
 
-export type RegisterType = 'username' | 'mobile' | 'email';
-export type ForgotPasswordType = 'mobile' | 'email';
+export type RegisterType = "username" | "mobile" | "email";
+export type ForgotPasswordType = "mobile" | "email";
 
 export const AdminRoleId = 1;
 
@@ -83,14 +83,14 @@ export class UserService extends BaseService<UserEntity> {
       },
     });
     if (!_.isEmpty(exists)) {
-      throw new CommonException('用户名已经存在');
+      throw new CommonException("用户名已经存在");
     }
     const plainPassword = param.password ?? RandomUtil.randomStr(6);
     param.passwordVersion = 2;
     param.password = await this.genPassword(plainPassword, param.passwordVersion); // 默认密码  建议未改密码不能登陆
 
     if (param.avatar) {
-      param.avatar = await this.fileService.saveFile(0, param.avatar, 'public');
+      param.avatar = await this.fileService.saveFile(0, param.avatar, "public");
     }
 
     await super.add(param);
@@ -107,13 +107,13 @@ export class UserService extends BaseService<UserEntity> {
    */
   async update(param) {
     if (param.id == null) {
-      throw new CommonException('id不能为空');
+      throw new CommonException("id不能为空");
     }
     const userInfo = await this.repository.findOne({
       where: { id: param.id },
     });
     if (!userInfo) {
-      throw new CommonException('用户不存在');
+      throw new CommonException("用户不存在");
     }
 
     if (param.username) {
@@ -125,7 +125,7 @@ export class UserService extends BaseService<UserEntity> {
         { email: username, id: Not(id) },
       ]);
       if (old != null) {
-        throw new CommonException('用户名已被占用');
+        throw new CommonException("用户名已被占用");
       }
     }
     if (!_.isEmpty(param.password)) {
@@ -136,7 +136,7 @@ export class UserService extends BaseService<UserEntity> {
     }
 
     if (param.avatar) {
-      param.avatar = await this.fileService.saveFile(userInfo.id, param.avatar, 'public');
+      param.avatar = await this.fileService.saveFile(userInfo.id, param.avatar, "public");
     }
     await super.update(param);
     await this.roleService.updateRoles(param.id, param.roles);
@@ -168,7 +168,7 @@ export class UserService extends BaseService<UserEntity> {
   async buildPlainPassword(rawPassword: string) {
     const setting: SysInstallInfo = await this.sysSettingsService.getSetting(SysInstallInfo);
     if (!setting.siteId) {
-      throw new CommonException('站点ID还未初始化');
+      throw new CommonException("站点ID还未初始化");
     }
     const prefixSiteId = setting.siteId.substring(1, 5);
     return rawPassword + prefixSiteId;
@@ -184,54 +184,55 @@ export class UserService extends BaseService<UserEntity> {
   }
 
   async register(type: string, user: UserEntity, withTx?: (tx: EntityManager) => Promise<void>) {
-    if (!user.password) {
-      user.password = simpleNanoId();
-    }
+    // if (!user.password) {
+    //   user.password = simpleNanoId();
+    // }
 
     if (user.username) {
       const username = user.username;
       const old = await this.findOne([{ username: username }, { mobile: username }, { email: username }]);
       if (old != null) {
-        throw new CommonException('用户名已被注册');
+        throw new CommonException("用户名已被注册");
       }
     }
 
     if (user.mobile) {
       const mobile = user.mobile;
 
-      user.nickName = user.username || mobile.substring(0, 3) + '****' + mobile.substring(7);
+      user.nickName = user.username || mobile.substring(0, 3) + "****" + mobile.substring(7);
       const old = await this.findOne([{ username: mobile }, { mobile: mobile }, { email: mobile }]);
       if (old != null) {
-        throw new CommonException('手机号已被注册');
+        throw new CommonException("手机号已被注册");
       }
     }
     if (user.email) {
       const email = user.email;
       const old = await this.findOne([{ username: email }, { mobile: email }, { email: email }]);
       if (old != null) {
-        throw new CommonException('邮箱已被注册');
+        throw new CommonException("邮箱已被注册");
       }
     }
 
     if (!user.username) {
-      user.username = 'user_' + simpleNanoId();
+      user.username = "user_" + simpleNanoId();
     }
 
     let newUser: UserEntity = UserEntity.of({
       username: user.username,
       password: user.password,
-      email: user.email || '',
-      mobile: user.mobile || '',
+      email: user.email || "",
+      mobile: user.mobile || "",
       nickName: user.nickName || user.username,
-      avatar: user.avatar || '',
-      phoneCode: user.phoneCode || '86',
+      avatar: user.avatar || "",
+      phoneCode: user.phoneCode || "86",
       status: 1,
       passwordVersion: 2,
     });
     if (!newUser.password) {
-      newUser.password = RandomUtil.randomStr(6);
+      newUser.password = "changeme";
+    } else {
+      newUser.password = await this.genPassword(newUser.password, newUser.passwordVersion);
     }
-    newUser.password = await this.genPassword(newUser.password, newUser.passwordVersion);
 
     await this.transaction(async txManager => {
       newUser = await txManager.save(newUser);
@@ -246,28 +247,28 @@ export class UserService extends BaseService<UserEntity> {
 
     delete newUser.password;
 
-    utils.mitter.emit('register', { userId: newUser.id });
+    utils.mitter.emit("register", { userId: newUser.id });
 
     return newUser;
   }
 
   async forgotPassword(data: { type: ForgotPasswordType; input?: string; phoneCode?: string; validateCode: string; password: string; confirmPassword: string }) {
     if (!data.type) {
-      throw new CommonException('找回类型不能为空');
+      throw new CommonException("找回类型不能为空");
     }
     if (data.password !== data.confirmPassword) {
-      throw new CommonException('两次输入的密码不一致');
+      throw new CommonException("两次输入的密码不一致");
     }
     const where: any = {
       [data.type]: data.input,
     };
-    if (data.type === 'mobile') {
-      where.phoneCode = data.phoneCode ?? '86';
+    if (data.type === "mobile") {
+      where.phoneCode = data.phoneCode ?? "86";
     }
     const user = await this.findOne({ [data.type]: data.input });
-    console.log('user', user);
+    console.log("user", user);
     if (!user) {
-      throw new CommonException('用户不存在');
+      throw new CommonException("用户不存在");
       // return;
     }
     await this.resetPassword(user.id, data.password);
@@ -282,7 +283,7 @@ export class UserService extends BaseService<UserEntity> {
     const user = await this.info(userId);
     const passwordChecked = await this.checkPassword(form.password, user.password, user.passwordVersion);
     if (!passwordChecked) {
-      throw new CommonException('原密码错误');
+      throw new CommonException("原密码错误");
     }
     const param = {
       id: userId,
@@ -292,9 +293,26 @@ export class UserService extends BaseService<UserEntity> {
     await this.update(param);
   }
 
+  async initPassword(userId: any, form: any) {
+    const user = await this.info(userId);
+    if (user.password !== "changeme") {
+      throw new CommonException("当前账号已设置密码");
+    }
+    if (!form.newPassword) {
+      throw new CommonException("新密码不能为空");
+    }
+    if (form.newPassword !== form.confirmNewPassword) {
+      throw new CommonException("两次输入的密码不一致");
+    }
+    await this.update({
+      id: userId,
+      password: form.newPassword,
+    });
+  }
+
   async resetPassword(userId: any, newPasswd: string) {
     if (!userId) {
-      throw new CommonException('userId不能为空');
+      throw new CommonException("userId不能为空");
     }
     const param = {
       id: userId,
@@ -305,15 +323,15 @@ export class UserService extends BaseService<UserEntity> {
 
   //@ts-ignore
   async delete(ids: any) {
-    if (typeof ids === 'string') {
-      ids = ids.split(',');
+    if (typeof ids === "string") {
+      ids = ids.split(",");
       ids = ids.map(id => parseInt(id));
     }
     if (ids.length === 0) {
       return;
     }
     if (ids.includes(1)) {
-      throw new CommonException('不能删除管理员');
+      throw new CommonException("不能删除管理员");
     }
     await super.delete(ids);
     await this.oauthBoundService.deleteWhere({
@@ -323,7 +341,7 @@ export class UserService extends BaseService<UserEntity> {
 
   async isAdmin(userId: any) {
     if (!userId) {
-      throw new CommonException('userId不能为空');
+      throw new CommonException("userId不能为空");
     }
     const userRoles = await this.userRoleService.find({
       where: {
@@ -338,7 +356,7 @@ export class UserService extends BaseService<UserEntity> {
 
   async updateStatus(id: number, status: number) {
     if (!id) {
-      throw new CommonException('userId不能为空');
+      throw new CommonException("userId不能为空");
     }
     await this.repository.update(id, {
       status,
@@ -355,16 +373,16 @@ export class UserService extends BaseService<UserEntity> {
   }
 
   async registerCountPerDay(param: { days: number } = { days: 7 }) {
-    const todayEnd = dayjs().endOf('day');
+    const todayEnd = dayjs().endOf("day");
     const result = await this.getRepository()
-      .createQueryBuilder('main')
-      .select(`${this.dbAdapter.date('main.createTime')}  AS date`) // 将UNIX时间戳转换为日期
-      .addSelect('COUNT(1) AS count')
+      .createQueryBuilder("main")
+      .select(`${this.dbAdapter.date("main.createTime")}  AS date`) // 将UNIX时间戳转换为日期
+      .addSelect("COUNT(1) AS count")
       .where({
         // 0点
-        createTime: MoreThan(todayEnd.add(-param.days, 'day').toDate()),
+        createTime: MoreThan(todayEnd.add(-param.days, "day").toDate()),
       })
-      .groupBy('date')
+      .groupBy("date")
       .getRawMany();
 
     return result;
@@ -384,7 +402,7 @@ export class UserService extends BaseService<UserEntity> {
         status: 1,
       },
       order: {
-        updateTime: 'DESC',
+        updateTime: "DESC",
       },
     });
   }
@@ -396,61 +414,61 @@ export class UserService extends BaseService<UserEntity> {
     });
   }
 
-  async verifyIdentity(userId: number, body: { identityType: 'password' | 'email' | 'mobile'; identityPassword?: string; identityValidateCode?: string }, codeService: any) {
+  async verifyIdentity(userId: number, body: { identityType: "password" | "email" | "mobile"; identityPassword?: string; identityValidateCode?: string }, codeService: any) {
     const user = await this.info(userId);
-    if (body.identityType === 'password') {
+    if (body.identityType === "password") {
       const passwordChecked = await this.checkPassword(body.identityPassword, user.password, user.passwordVersion);
       if (!passwordChecked) {
-        throw new CommonException('密码错误');
+        throw new CommonException("密码错误");
       }
       return;
     }
-    if (body.identityType === 'email') {
+    if (body.identityType === "email") {
       if (!user.email) {
-        throw new CommonException('当前账号未绑定邮箱');
+        throw new CommonException("当前账号未绑定邮箱");
       }
       codeService.checkEmailCode({
         email: user.email,
         validateCode: body.identityValidateCode,
-        verificationType: 'contactIdentity',
+        verificationType: "contactIdentity",
         throwError: true,
       });
       return;
     }
-    if (body.identityType === 'mobile') {
+    if (body.identityType === "mobile") {
       if (!user.mobile) {
-        throw new CommonException('当前账号未绑定手机号');
+        throw new CommonException("当前账号未绑定手机号");
       }
       await codeService.checkSmsCode({
         mobile: user.mobile,
-        phoneCode: user.phoneCode || '86',
+        phoneCode: user.phoneCode || "86",
         smsCode: body.identityValidateCode,
-        verificationType: 'contactIdentity',
+        verificationType: "contactIdentity",
         throwError: true,
       });
       return;
     }
-    throw new CommonException('不支持的验证方式');
+    throw new CommonException("不支持的验证方式");
   }
 
   checkContactIdentityValidation(userId: number, validationCode: string, codeService: any) {
     const validationValue = codeService.getValidationValue(validationCode);
-    if (!validationValue || validationValue.type !== 'contactIdentity' || validationValue.userId !== userId) {
-      throw new CommonException('请先验证本人操作');
+    if (!validationValue || validationValue.type !== "contactIdentity" || validationValue.userId !== userId) {
+      throw new CommonException("请先验证本人操作");
     }
   }
 
   async updateMobile(userId: number, body: { phoneCode?: string; mobile: string }) {
     const mobile = body.mobile?.trim();
     if (!mobile) {
-      throw new CommonException('手机号不能为空');
+      throw new CommonException("手机号不能为空");
     }
     const old = await this.findOne(buildUserContactConflictWhere(mobile, userId));
     if (old != null) {
-      throw new CommonException('手机号已被占用');
+      throw new CommonException("手机号已被占用");
     }
     await this.repository.update(userId, {
-      phoneCode: body.phoneCode || '86',
+      phoneCode: body.phoneCode || "86",
       mobile,
     });
   }
@@ -458,11 +476,11 @@ export class UserService extends BaseService<UserEntity> {
   async updateEmail(userId: number, body: { email: string }) {
     const email = body.email?.trim();
     if (!email) {
-      throw new CommonException('邮箱不能为空');
+      throw new CommonException("邮箱不能为空");
     }
     const old = await this.findOne(buildUserContactConflictWhere(email, userId));
     if (old != null) {
-      throw new CommonException('邮箱已被占用');
+      throw new CommonException("邮箱已被占用");
     }
     await this.repository.update(userId, {
       email,
@@ -471,7 +489,7 @@ export class UserService extends BaseService<UserEntity> {
 
   async getAllUserIds() {
     const users = await this.repository.find({
-      select: ['id'],
+      select: ["id"],
       where: {
         status: 1,
       },
diff --git a/packages/ui/certd-server/src/plugins/plugin-oauth/api.ts b/packages/ui/certd-server/src/plugins/plugin-oauth/api.ts
index be97b6a5d..89ee026d7 100644
--- a/packages/ui/certd-server/src/plugins/plugin-oauth/api.ts
+++ b/packages/ui/certd-server/src/plugins/plugin-oauth/api.ts
@@ -42,6 +42,7 @@ export type BuildLoginUrlReq = {
     forType?: string;
     from?:string;
     subtype?: string;
+    state?: string;
 }
 
 export type BuildLogoutUrlReq = {
diff --git a/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-clogin.ts b/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-clogin.ts
index 8499a2e8d..165fd84a3 100644
--- a/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-clogin.ts
+++ b/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-clogin.ts
@@ -94,16 +94,14 @@ export class CloginOauthProvider extends BaseAddon implements IOauthProvider {
     //   redirectUri = redirectUri.replace("localhost:3008", "certd.handfree.work")
     // }
     const res = await this.ctx.http.request({
-      url: `${this.endpoint}/connect.php?act=login&appid=${this.appId}&appkey=${this.appKey}&type=${loginType}&redirect_uri=${redirectUri}`
+      url: `${this.endpoint}/connect.php?act=login&appid=${this.appId}&appkey=${this.appKey}&type=${loginType}&redirect_uri=${redirectUri}&state=${params.state}`
     })
 
     this.checkRes(res)
 
     return {
       loginUrl: res.url,
-      ticketValue: {
-        state: "",
-      },
+      ticketValue: {},
     };
   }
 
diff --git a/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-gitee.ts b/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-gitee.ts
index c93745ae7..0f5a61961 100644
--- a/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-gitee.ts
+++ b/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-gitee.ts
@@ -79,19 +79,13 @@ gitee.userInfo = https://gitee.com/api/v5/user
   async buildLoginUrl(params: BuildLoginUrlReq) {
 
     let scope = "user_info" // Scope of the access request
-    let state:any = {
-      forType: params.forType || 'login',
-    }
-    state = this.ctx.utils.hash.base64(JSON.stringify(state))
-
     const authorizeEndpoint = "https://gitee.com/oauth/authorize"
     const redirectUrl = encodeURIComponent(params.redirectUri)
     // https://gitee.com/oauth/authorize?client_id=5bb5f4158af41c50c7a17b5d9068244e97d3ee572def6a57ed32fd8c9d760ad1&redirect_uri=http%3A%2F%2Fcasdoor.docmirror.cn%3A8000%2Fcallback&response_type=code
-    const loginUrl = `${authorizeEndpoint}?client_id=${this.clientId}&redirect_uri=${redirectUrl}&response_type=code&scope=${scope}&state=${state}`
+    const loginUrl = `${authorizeEndpoint}?client_id=${this.clientId}&redirect_uri=${redirectUrl}&response_type=code&scope=${scope}&state=${params.state}`
     return {
       loginUrl,
       ticketValue: {
-        state,
       },
     };
   }
diff --git a/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-github.ts b/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-github.ts
index 0cf9958d3..019b6dc70 100644
--- a/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-github.ts
+++ b/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-github.ts
@@ -30,19 +30,12 @@ export class GithubOauthProvider extends BaseAddon implements IOauthProvider {
   async buildLoginUrl(params: BuildLoginUrlReq) {
 
     let scope = "user:email" // Scope of the access request
-    let state:any = {
-      forType: params.forType || 'login',
-    }
-    state = this.ctx.utils.hash.base64(JSON.stringify(state))
-
     const authorizeEndpoint = "https://github.com/login/oauth/authorize"
     const redirectUrl = encodeURIComponent(params.redirectUri)
-    const loginUrl = `${authorizeEndpoint}?client_id=${this.clientId}&redirect_uri=${redirectUrl}&response_type=code&scope=${scope}&state=${state}`
+    const loginUrl = `${authorizeEndpoint}?client_id=${this.clientId}&redirect_uri=${redirectUrl}&response_type=code&scope=${scope}&state=${params.state}`
     return {
       loginUrl,
-      ticketValue: {
-        state,
-      },
+      ticketValue: {  },
     };
   }
 
diff --git a/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-google.ts b/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-google.ts
index 6d1c12241..59aea2ad6 100644
--- a/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-google.ts
+++ b/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-google.ts
@@ -30,18 +30,13 @@ export class GoogleOauthProvider extends BaseAddon implements IOauthProvider {
   async buildLoginUrl(params: BuildLoginUrlReq) {
 
     let scope = "email profile" // Scope of the access request
-    let state:any = {
-      forType: params.forType || 'login',
-    }
-    state = this.ctx.utils.hash.base64(JSON.stringify(state))
 
     const authorizeEndpoint = "https://accounts.google.com/o/oauth2/auth"
     const redirectUrl = encodeURIComponent(params.redirectUri)
-    const loginUrl = `${authorizeEndpoint}?client_id=${this.clientId}&redirect_uri=${redirectUrl}&response_type=code&scope=${scope}&state=${state}`
+    const loginUrl = `${authorizeEndpoint}?client_id=${this.clientId}&redirect_uri=${redirectUrl}&response_type=code&scope=${scope}&state=${params.state}`
     return {
       loginUrl,
       ticketValue: {
-        state,
       },
     };
   }
diff --git a/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-microsoft.ts b/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-microsoft.ts
index a5773cf95..63a39c877 100644
--- a/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-microsoft.ts
+++ b/packages/ui/certd-server/src/plugins/plugin-oauth/oauth2/plugin-microsoft.ts
@@ -42,18 +42,12 @@ export class MicrosoftOauthProvider extends BaseAddon implements IOauthProvider
   async buildLoginUrl(params: BuildLoginUrlReq) {
 
     let scope = "openid profile email User.Read" // Scope of the access request
-    let state:any = {
-      forType: params.forType || 'login',
-    }
-    state = this.ctx.utils.hash.base64(JSON.stringify(state))
-
     const authorizeEndpoint = `https://login.microsoftonline.com/${this.tenantId}/oauth2/v2.0/authorize`
     const redirectUrl = encodeURIComponent(params.redirectUri)
-    const loginUrl = `${authorizeEndpoint}?client_id=${this.clientId}&redirect_uri=${redirectUrl}&response_type=code&scope=${scope}&state=${state}`
+    const loginUrl = `${authorizeEndpoint}?client_id=${this.clientId}&redirect_uri=${redirectUrl}&response_type=code&scope=${scope}&state=${params.state}`
     return {
       loginUrl,
       ticketValue: {
-        state,
       },
     };
   }
diff --git a/packages/ui/certd-server/tsconfig.build.json b/packages/ui/certd-server/tsconfig.build.json
new file mode 100644
index 000000000..bcca8fcc1
--- /dev/null
+++ b/packages/ui/certd-server/tsconfig.build.json
@@ -0,0 +1,7 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "sourceMap": false,
+    "inlineSourceMap": false
+  }
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index d481396cf..9da3358d5 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -52,7 +52,7 @@ importers:
   packages/core/acme-client:
     dependencies:
       '@certd/basic':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../basic
       '@peculiar/x509':
         specifier: ^1.11.0
@@ -234,10 +234,10 @@ importers:
   packages/core/pipeline:
     dependencies:
       '@certd/basic':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../basic
       '@certd/plus-core':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../pro/plus-core
       dayjs:
         specifier: ^1.11.7
@@ -457,7 +457,7 @@ importers:
   packages/libs/lib-k8s:
     dependencies:
       '@certd/basic':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/basic
       '@kubernetes/client-node':
         specifier: 0.21.0
@@ -503,19 +503,19 @@ importers:
   packages/libs/lib-server:
     dependencies:
       '@certd/acme-client':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/acme-client
       '@certd/basic':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/basic
       '@certd/pipeline':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/pipeline
       '@certd/plugin-lib':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../plugins/plugin-lib
       '@certd/plus-core':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../pro/plus-core
       '@midwayjs/cache':
         specifier: 3.14.0
@@ -679,16 +679,16 @@ importers:
   packages/plugins/plugin-cert:
     dependencies:
       '@certd/acme-client':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/acme-client
       '@certd/basic':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/basic
       '@certd/pipeline':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/pipeline
       '@certd/plugin-lib':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../plugin-lib
       psl:
         specifier: ^1.9.0
@@ -758,16 +758,16 @@ importers:
         specifier: ^3.964.0
         version: 3.964.0(aws-crt@1.26.2)
       '@certd/acme-client':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/acme-client
       '@certd/basic':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/basic
       '@certd/pipeline':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/pipeline
       '@certd/plus-core':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../pro/plus-core
       '@kubernetes/client-node':
         specifier: 0.21.0
@@ -867,16 +867,16 @@ importers:
   packages/pro/commercial-core:
     dependencies:
       '@certd/basic':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/basic
       '@certd/lib-server':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../libs/lib-server
       '@certd/pipeline':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/pipeline
       '@certd/plus-core':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../plus-core
       '@midwayjs/core':
         specifier: 3.20.11
@@ -967,16 +967,16 @@ importers:
   packages/pro/plugin-plus:
     dependencies:
       '@certd/basic':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/basic
       '@certd/pipeline':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/pipeline
       '@certd/plugin-lib':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../plugins/plugin-lib
       '@certd/plus-core':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../plus-core
       crypto-js:
         specifier: ^4.2.0
@@ -1061,7 +1061,7 @@ importers:
   packages/pro/plus-core:
     dependencies:
       '@certd/basic':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/basic
       dayjs:
         specifier: ^1.11.7
@@ -1363,10 +1363,10 @@ importers:
         version: 0.1.3(zod@3.24.4)
     devDependencies:
       '@certd/lib-iframe':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../libs/lib-iframe
       '@certd/pipeline':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/pipeline
       '@rollup/plugin-commonjs':
         specifier: ^25.0.7
@@ -1573,46 +1573,46 @@ importers:
         specifier: ^4.13.1
         version: 4.13.1
       '@certd/acme-client':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/acme-client
       '@certd/basic':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/basic
       '@certd/commercial-core':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../pro/commercial-core
       '@certd/cv4pve-api-javascript':
         specifier: ^8.4.2
         version: 8.4.2
       '@certd/jdcloud':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../libs/lib-jdcloud
       '@certd/lib-huawei':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../libs/lib-huawei
       '@certd/lib-k8s':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../libs/lib-k8s
       '@certd/lib-server':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../libs/lib-server
       '@certd/midway-flyway-js':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../libs/midway-flyway-js
       '@certd/pipeline':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../core/pipeline
       '@certd/plugin-cert':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../plugins/plugin-cert
       '@certd/plugin-lib':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../plugins/plugin-lib
       '@certd/plugin-plus':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../pro/plugin-plus
       '@certd/plus-core':
-        specifier: ^1.39.16
+        specifier: ^1.40.0
         version: link:../../pro/plus-core
       '@google-cloud/dns':
         specifier: ^5.3.1
@@ -1621,16 +1621,16 @@ importers:
         specifier: ^1.3.0
         version: 1.3.0(encoding@0.1.13)
       '@huaweicloud/huaweicloud-sdk-cdn':
-        specifier: ^3.1.185
+        specifier: 3.1.185
         version: 3.1.185
       '@huaweicloud/huaweicloud-sdk-core':
-        specifier: ^3.1.185
+        specifier: 3.1.185
         version: 3.1.185
       '@huaweicloud/huaweicloud-sdk-elb':
-        specifier: ^3.1.185
+        specifier: 3.1.185
         version: 3.1.185
       '@huaweicloud/huaweicloud-sdk-iam':
-        specifier: ^3.1.185
+        specifier: 3.1.185
         version: 3.1.185
       '@koa/cors':
         specifier: ^5.0.0
diff --git a/trigger/build.trigger b/trigger/build.trigger
index 66d5fdc1a..99d5a6a88 100644
--- a/trigger/build.trigger
+++ b/trigger/build.trigger
@@ -1 +1 @@
-14:22
+00:40
diff --git a/trigger/release.trigger b/trigger/release.trigger
index f852c9ed3..0be59df10 100644
--- a/trigger/release.trigger
+++ b/trigger/release.trigger
@@ -1 +1 @@
-17:29
+01:06