From 1170f4398837068f67b3ab5e783be9529b0d9974 Mon Sep 17 00:00:00 2001
From: PiEgg <marksz@teamsz.xyz>
Date: Thu, 21 May 2026 20:33:46 +0800
Subject: [PATCH] feat(plugin-verification): migrate client to client-v2
 (#9515)

---
 .../client-v2/src/PluginSettingsManager.ts    |   3 +-
 .../__tests__/PluginSettingsManager.test.ts   |  19 +
 .../src/__tests__/PoweredBy.test.tsx}         |  31 +-
 .../nocobase-buildin-plugin-auth.test.tsx     | 147 ++--
 .../src/__tests__/useCurrentRoles.test.tsx    | 100 +++
 .../client-v2/src/components/PoweredBy.tsx    |  71 ++
 .../core/client-v2/src/components/README.md   | 314 ++++++++
 .../client-v2/src/components/README.zh-CN.md  | 312 ++++++++
 .../src}/components/SwitchLanguage.tsx        |  30 +-
 .../src/components/form/DialogFormLayout.tsx  | 111 +++
 .../src/components/form/DrawerFormLayout.tsx  |  45 +-
 .../src/components/form/PasswordInput.tsx     | 211 ++++++
 .../src/components/form/RemoteSelect.tsx      | 137 ++++
 .../client-v2/src/components/form/index.tsx   |   3 +
 .../src/components/form/table/Table.tsx       |   3 +-
 .../src/components/form/table/styles.ts       |  19 +
 .../core/client-v2/src/components/index.ts    |   2 +
 .../admin-layout/AdminLayoutComponent.tsx     |   5 +-
 .../src/nocobase-buildin-plugin/index.tsx     |  86 ++-
 packages/core/flow-engine/src/utils/index.ts  |   3 +
 .../core/flow-engine/src/utils/randomId.ts    |  48 ++
 .../@nocobase/plugin-api-keys/client-v2.d.ts  |   2 +
 .../@nocobase/plugin-api-keys/client-v2.js    |   1 +
 .../@nocobase/plugin-api-keys/package.json    |   2 +
 .../client-v2/__tests__/ApiKeysPage.test.ts   | 111 +++
 .../plugin-api-keys/src/client-v2/index.tsx   |  10 +
 .../plugin-api-keys/src/client-v2/locale.ts   |  21 +
 .../src/client-v2/pages/ApiKeysPage.tsx       | 307 ++++++++
 .../src/client-v2/pages/ExpiresField.tsx      |  91 +++
 .../plugin-api-keys/src/client-v2/plugin.tsx  |  33 +
 .../@nocobase/plugin-auth-sms/client-v2.d.ts  |   2 +
 .../@nocobase/plugin-auth-sms/client-v2.js    |   1 +
 .../@nocobase/plugin-auth-sms/package.json    |   2 +
 .../client-v2/__tests__/SmsSignInForm.test.ts |  57 ++
 .../src/client-v2/forms/SmsAdminSettings.tsx  |  44 ++
 .../src/client-v2/forms/SmsSignInForm.tsx     |  96 +++
 .../plugin-auth-sms/src/client-v2/index.tsx   |  10 +
 .../plugin-auth-sms/src/client-v2/locale.ts   |  27 +
 .../plugin-auth-sms/src/client-v2/plugin.tsx  |  24 +
 .../src/client-v2/__tests__/hooks.test.tsx    | 128 +++-
 .../src/client-v2/__tests__/plugin.test.tsx   |  73 +-
 .../client-v2/components/PoweredByLite.tsx    |  45 --
 .../plugin-auth/src/client-v2/hooks.ts        |  45 +-
 .../src/client-v2/pages/AuthLayout.tsx        |   6 +-
 .../client-v2/pages/AuthenticatorsPage.tsx    |  42 +-
 .../plugin-auth/src/client-v2/plugin.tsx      |  12 +-
 .../src/client-v2/pages/FileStoragePage.tsx   |   9 +-
 .../plugin-users/src/client-v2/plugin.tsx     |   2 +
 .../user-center/ChangePasswordItemModel.tsx   | 134 ++++
 .../plugin-verification/client-v2.d.ts        |   2 +
 .../plugin-verification/client-v2.js          |   1 +
 .../plugin-verification/package.json          |   2 +
 .../client-v2/__tests__/VerifiersPage.test.ts | 188 +++++
 .../client-v2/components/VerificationCode.tsx | 130 ++++
 .../client-v2/components/VerifierSelect.tsx   | 102 +++
 .../src/client-v2/index.ts                    |  20 +
 .../src/client-v2/locale.ts                   |  35 +
 .../src/client-v2/otp-sms-provider-manager.ts |  43 ++
 .../sms/AdminSettingsForm.tsx                 |  73 ++
 .../otp-verification/sms/BindForm.tsx         |  44 ++
 .../otp-verification/sms/VerificationForm.tsx |  50 ++
 .../client-v2/otp-verification/sms/index.ts   |  28 +
 .../sms/providers/AliyunSettings.tsx          |  65 ++
 .../sms/providers/TencentSettings.tsx         |  75 ++
 .../src/client-v2/pages/VerifiersPage.tsx     | 415 +++++++++++
 .../src/client-v2/plugin.tsx                  |  71 ++
 .../src/client-v2/user-center/MyVerifiers.tsx | 305 ++++++++
 .../VerificationUserCenterItemModel.tsx       |  53 ++
 .../src/client-v2/verification-manager.ts     |  56 ++
 yarn.lock                                     | 694 ++----------------
 70 files changed, 4530 insertions(+), 959 deletions(-)
 rename packages/{plugins/@nocobase/plugin-auth/src/client-v2/__tests__/PoweredByLite.test.tsx => core/client-v2/src/__tests__/PoweredBy.test.tsx} (74%)
 create mode 100644 packages/core/client-v2/src/__tests__/useCurrentRoles.test.tsx
 create mode 100644 packages/core/client-v2/src/components/PoweredBy.tsx
 create mode 100644 packages/core/client-v2/src/components/README.md
 create mode 100644 packages/core/client-v2/src/components/README.zh-CN.md
 rename packages/{plugins/@nocobase/plugin-auth/src/client-v2 => core/client-v2/src}/components/SwitchLanguage.tsx (56%)
 create mode 100644 packages/core/client-v2/src/components/form/DialogFormLayout.tsx
 create mode 100644 packages/core/client-v2/src/components/form/PasswordInput.tsx
 create mode 100644 packages/core/client-v2/src/components/form/RemoteSelect.tsx
 create mode 100644 packages/core/flow-engine/src/utils/randomId.ts
 create mode 100644 packages/plugins/@nocobase/plugin-api-keys/client-v2.d.ts
 create mode 100644 packages/plugins/@nocobase/plugin-api-keys/client-v2.js
 create mode 100644 packages/plugins/@nocobase/plugin-api-keys/src/client-v2/__tests__/ApiKeysPage.test.ts
 create mode 100644 packages/plugins/@nocobase/plugin-api-keys/src/client-v2/index.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-api-keys/src/client-v2/locale.ts
 create mode 100644 packages/plugins/@nocobase/plugin-api-keys/src/client-v2/pages/ApiKeysPage.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-api-keys/src/client-v2/pages/ExpiresField.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-api-keys/src/client-v2/plugin.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-auth-sms/client-v2.d.ts
 create mode 100644 packages/plugins/@nocobase/plugin-auth-sms/client-v2.js
 create mode 100644 packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/__tests__/SmsSignInForm.test.ts
 create mode 100644 packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/forms/SmsAdminSettings.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/forms/SmsSignInForm.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/index.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/locale.ts
 create mode 100644 packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/plugin.tsx
 delete mode 100644 packages/plugins/@nocobase/plugin-auth/src/client-v2/components/PoweredByLite.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-users/src/client-v2/user-center/ChangePasswordItemModel.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-verification/client-v2.d.ts
 create mode 100644 packages/plugins/@nocobase/plugin-verification/client-v2.js
 create mode 100644 packages/plugins/@nocobase/plugin-verification/src/client-v2/__tests__/VerifiersPage.test.ts
 create mode 100644 packages/plugins/@nocobase/plugin-verification/src/client-v2/components/VerificationCode.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-verification/src/client-v2/components/VerifierSelect.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-verification/src/client-v2/index.ts
 create mode 100644 packages/plugins/@nocobase/plugin-verification/src/client-v2/locale.ts
 create mode 100644 packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-sms-provider-manager.ts
 create mode 100644 packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/AdminSettingsForm.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/BindForm.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/VerificationForm.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/index.ts
 create mode 100644 packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/providers/AliyunSettings.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/providers/TencentSettings.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-verification/src/client-v2/pages/VerifiersPage.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-verification/src/client-v2/plugin.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-verification/src/client-v2/user-center/MyVerifiers.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-verification/src/client-v2/user-center/VerificationUserCenterItemModel.tsx
 create mode 100644 packages/plugins/@nocobase/plugin-verification/src/client-v2/verification-manager.ts

diff --git a/packages/core/client-v2/src/PluginSettingsManager.ts b/packages/core/client-v2/src/PluginSettingsManager.ts
index 9f209b6c5b4..82b95c40937 100644
--- a/packages/core/client-v2/src/PluginSettingsManager.ts
+++ b/packages/core/client-v2/src/PluginSettingsManager.ts
@@ -432,7 +432,7 @@ export class PluginSettingsManager<TApp extends BaseApplication<any> = BaseAppli
       return null;
     }
 
-    const { title, aclSnippet, key, menuKey, name, ...others } = page;
+    const { title, aclSnippet, key, menuKey, name, icon, ...others } = page;
 
     return {
       ...others,
@@ -443,6 +443,7 @@ export class PluginSettingsManager<TApp extends BaseApplication<any> = BaseAppli
       name,
       title,
       label: title,
+      icon: this.renderIcon(icon),
       path: this.getRoutePath(name),
       sort: page.sort,
       isAllow,
diff --git a/packages/core/client-v2/src/__tests__/PluginSettingsManager.test.ts b/packages/core/client-v2/src/__tests__/PluginSettingsManager.test.ts
index 9bc5edf51a4..e6abf3c4740 100644
--- a/packages/core/client-v2/src/__tests__/PluginSettingsManager.test.ts
+++ b/packages/core/client-v2/src/__tests__/PluginSettingsManager.test.ts
@@ -76,6 +76,25 @@ describe('PluginSettingsManager v2', () => {
     expect(app.router.get('admin.settings.demo.advanced')).toMatchObject({ path: 'advanced' });
   });
 
+  it('should render string icon on both menu and page tab via renderIcon', () => {
+    // Previously `renderPage` spread the raw `icon` string straight to the antd
+    // Menu item, which displayed "LockOutlinedTitle" as text. Both `renderMenuItem`
+    // and `renderPage` must coerce string icon names to React elements.
+    const app = createMockClient();
+
+    app.pluginSettingsManager.addMenuItem({ key: 'demo', title: 'Demo', icon: 'TeamOutlined' });
+    app.pluginSettingsManager.addPageTabItem({
+      menuKey: 'demo',
+      key: 'index',
+      title: 'Overview',
+      icon: 'LockOutlined',
+    });
+
+    const list = app.pluginSettingsManager.getList();
+    expect(React.isValidElement(list[0].icon)).toBe(true);
+    expect(React.isValidElement(list[0].children?.[0].icon)).toBe(true);
+  });
+
   it('should support componentLoader on page item', () => {
     const app = createMockClient();
     const componentLoader = async () => ({
diff --git a/packages/plugins/@nocobase/plugin-auth/src/client-v2/__tests__/PoweredByLite.test.tsx b/packages/core/client-v2/src/__tests__/PoweredBy.test.tsx
similarity index 74%
rename from packages/plugins/@nocobase/plugin-auth/src/client-v2/__tests__/PoweredByLite.test.tsx
rename to packages/core/client-v2/src/__tests__/PoweredBy.test.tsx
index 39cc94b4eba..12aa30775d2 100644
--- a/packages/plugins/@nocobase/plugin-auth/src/client-v2/__tests__/PoweredByLite.test.tsx
+++ b/packages/core/client-v2/src/__tests__/PoweredBy.test.tsx
@@ -7,26 +7,26 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 
-import { createMockClient, Plugin } from '@nocobase/client-v2';
 import { render, screen, waitFor } from '@testing-library/react';
 import React from 'react';
+import { createMockClient } from '../MockApplication';
+import { Plugin } from '../Plugin';
+import PoweredBy from '../components/PoweredBy';
 
-import PoweredByLite from '../components/PoweredByLite';
-
-class PoweredByLiteRoutePlugin extends Plugin {
+class PoweredByRoutePlugin extends Plugin {
   async load() {
     this.router.add('root', {
       path: '/',
-      Component: PoweredByLite,
+      Component: PoweredBy,
     });
   }
 }
 
 class MockCustomBrandPlugin extends Plugin {}
 
-const renderPoweredByLite = async (plugins: any[] = [], appInfoData: Record<string, any> = { version: '1.2.3' }) => {
+const renderPoweredBy = async (plugins: any[] = [], appInfoData: Record<string, any> = { version: '1.2.3' }) => {
   const app = createMockClient({
-    plugins: [PoweredByLiteRoutePlugin as any, ...plugins],
+    plugins: [PoweredByRoutePlugin as any, ...plugins],
   });
 
   app.apiMock.onGet('app:getInfo').reply(200, {
@@ -43,21 +43,24 @@ const renderPoweredByLite = async (plugins: any[] = [], appInfoData: Record<stri
   return result;
 };
 
-describe('PoweredByLite', () => {
+describe('PoweredBy', () => {
   afterEach(() => {
     vi.restoreAllMocks();
   });
 
   it('should render the default brand when custom-brand is not installed', async () => {
-    const { container } = await renderPoweredByLite();
+    const { container } = await renderPoweredBy();
 
     expect(screen.getByRole('link', { name: 'NocoBase' })).toHaveAttribute('href', 'https://www.nocobase.com');
     expect(container).toHaveTextContent('Powered by NocoBase');
+    // The `.nb-brand` className is reserved for the custom-brand HTML branch
+    // so downstream stylesheets can selectively target customised content
+    // without leaking onto the default footer.
     expect(container.querySelector('.nb-brand')).not.toBeInTheDocument();
   });
 
   it('should render custom-brand HTML and replace appVersion', async () => {
-    const { container } = await renderPoweredByLite([
+    const { container } = await renderPoweredBy([
       [
         MockCustomBrandPlugin,
         {
@@ -77,7 +80,7 @@ describe('PoweredByLite', () => {
   });
 
   it('should not render undefined appVersion when app version is unavailable', async () => {
-    const { container } = await renderPoweredByLite(
+    const { container } = await renderPoweredBy(
       [
         [
           MockCustomBrandPlugin,
@@ -98,7 +101,11 @@ describe('PoweredByLite', () => {
   });
 
   it('should escape custom-brand appVersion placeholder', async () => {
-    const { container } = await renderPoweredByLite(
+    // Defence in depth: even if the back-end ever returns a tampered
+    // `app:getInfo` payload, the version string must be HTML-escaped
+    // before being interpolated into the custom-brand template — never
+    // produce a live `<script>` node in the DOM.
+    const { container } = await renderPoweredBy(
       [
         [
           MockCustomBrandPlugin,
diff --git a/packages/core/client-v2/src/__tests__/nocobase-buildin-plugin-auth.test.tsx b/packages/core/client-v2/src/__tests__/nocobase-buildin-plugin-auth.test.tsx
index 443a63cd926..4408dca5ded 100644
--- a/packages/core/client-v2/src/__tests__/nocobase-buildin-plugin-auth.test.tsx
+++ b/packages/core/client-v2/src/__tests__/nocobase-buildin-plugin-auth.test.tsx
@@ -39,30 +39,18 @@ describe('nocobase buildin plugin auth redirect', () => {
     vi.restoreAllMocks();
   });
 
-  it('should redirect unauthenticated admin access to v2 signin with replace', async () => {
-    const replace = vi.fn();
-    Object.defineProperty(globalThis.window, 'location', {
-      configurable: true,
-      value: {
-        ...originalLocation,
-        pathname: '/v2/admin/7vu4c2sdk6h',
-        search: '',
-        hash: '',
-        replace,
-      },
-    });
-
+  it('should navigate to v2 signin when /auth:check returns no user', async () => {
+    // Aligns with v1: use react-router navigate (virtual) rather than
+    // `window.location.replace`, so a `window.location.href` queued elsewhere
+    // (e.g. 2FA's `code:302` response interceptor) can commit instead of being
+    // overridden.
     const app = createMockClient({
       publicPath: '/v2/',
       plugins: [NocoBaseBuildInPlugin as any],
       router: { type: 'memory', initialEntries: ['/v2/admin/7vu4c2sdk6h'] },
     });
     app.apiMock.onGet('app:getLang').reply(200, {
-      data: {
-        lang: 'en-US',
-        resources: { client: {} },
-        cron: {},
-      },
+      data: { lang: 'en-US', resources: { client: {} }, cron: {} },
     });
     app.apiMock.onGet('/auth:check').reply(200, { data: {} });
 
@@ -70,68 +58,63 @@ describe('nocobase buildin plugin auth redirect', () => {
     render(<Root />);
 
     await waitFor(() => {
-      expect(replace).toHaveBeenCalledWith('/v2/signin?redirect=%2Fv2%2Fadmin%2F7vu4c2sdk6h');
+      expect(app.router.router.state.location.pathname).toBe('/v2/signin');
+      expect(app.router.router.state.location.search).toBe('?redirect=%2Fv2%2Fadmin%2F7vu4c2sdk6h');
     });
   });
 
-  it('should redirect unauthenticated v2 root access to v2 signin with default admin redirect', async () => {
-    const replace = vi.fn();
-    Object.defineProperty(globalThis.window, 'location', {
-      configurable: true,
-      value: {
-        ...originalLocation,
-        pathname: '/nocobase/v2/',
-        search: '',
-        hash: '',
-        replace,
-      },
-    });
-
-    const app = createMockClient({
-      publicPath: '/nocobase/v2/',
-      plugins: [NocoBaseBuildInPlugin as any],
-      router: { type: 'memory', initialEntries: ['/nocobase/v2/'] },
-    });
-    app.apiMock.onGet('app:getLang').reply(200, {
-      data: {
-        lang: 'en-US',
-        resources: { client: {} },
-        cron: {},
-      },
-    });
-
-    const Root = app.getRootComponent();
-    render(<Root />);
-
-    await waitFor(() => {
-      expect(replace).toHaveBeenCalledWith('/nocobase/v2/signin?redirect=%2Fnocobase%2Fv2%2Fadmin');
-    });
-  });
-
-  it('should render v2 admin root without redirecting away', async () => {
-    const replace = vi.fn();
-    Object.defineProperty(globalThis.window, 'location', {
-      configurable: true,
-      value: {
-        ...originalLocation,
-        pathname: '/v2/admin',
-        search: '',
-        hash: '',
-        replace,
-      },
-    });
-
+  it('should short-circuit /auth:check when server returns code:302 instead of redirecting to signin', async () => {
+    // When the server signals an intermediate redirect (typically 2FA verify),
+    // CurrentUserProvider must NOT treat the missing `user.id` as "logged out"
+    // and race the 2FA response interceptor with its own signin redirect.
     const app = createMockClient({
       publicPath: '/v2/',
       plugins: [NocoBaseBuildInPlugin as any],
       router: { type: 'memory', initialEntries: ['/v2/admin'] },
     });
     app.apiMock.onGet('app:getLang').reply(200, {
-      data: {
-        lang: 'en-US',
-        resources: { client: {} },
-        cron: {},
-      },
+      data: { lang: 'en-US', resources: { client: {} }, cron: {} },
+    });
+    app.apiMock.onGet('/auth:check').reply(200, {
+      data: { code: 302, redirect: '/2fa?redirect=/admin' },
+    });
+
+    const Root = app.getRootComponent();
+    render(<Root />);
+
+    // Give CurrentUserProvider time to process the response.
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    expect(app.router.router.state.location.pathname).toBe('/v2/admin');
+    expect(app.router.router.state.location.search).toBe('');
+  });
+
+  it('should redirect unauthenticated v2 root access to v2 signin via <Navigate />', async () => {
+    const app = createMockClient({
+      publicPath: '/nocobase/v2/',
+      plugins: [NocoBaseBuildInPlugin as any],
+      router: { type: 'memory', initialEntries: ['/nocobase/v2/'] },
+    });
+    app.apiMock.onGet('app:getLang').reply(200, {
+      data: { lang: 'en-US', resources: { client: {} }, cron: {} },
+    });
+
+    const Root = app.getRootComponent();
+    render(<Root />);
+
+    await waitFor(() => {
+      expect(app.router.router.state.location.pathname).toBe('/nocobase/v2/signin');
+      expect(app.router.router.state.location.search).toBe('?redirect=%2Fnocobase%2Fv2%2Fadmin');
+    });
+  });
+
+  it('should render v2 admin root without redirecting away', async () => {
+    const app = createMockClient({
+      publicPath: '/v2/',
+      plugins: [NocoBaseBuildInPlugin as any],
+      router: { type: 'memory', initialEntries: ['/v2/admin'] },
+    });
+    app.apiMock.onGet('app:getLang').reply(200, {
+      data: { lang: 'en-US', resources: { client: {} }, cron: {} },
     });
     app.apiMock.onGet('/auth:check').reply(200, { data: { id: 1 } });
     app.apiMock.onGet('systemSettings:get').reply(200, { data: {} });
@@ -152,36 +135,20 @@ describe('nocobase buildin plugin auth redirect', () => {
     await waitFor(() => {
       expect(container.innerHTML).toContain('No pages yet, please configure first');
     });
-    expect(replace).not.toHaveBeenCalled();
+    expect(app.router.router.state.location.pathname).toBe('/v2/admin');
     expect(container.innerHTML).not.toContain('Legacy page');
   });
 
   it.each(['/v2/admin/legacy-page/tab/tab-1', '/v2/admin/legacy-page/view/detail'])(
     'should show 404 for authenticated direct v1-style v2 page access: %s',
     async (pathname) => {
-      const replace = vi.fn();
-      Object.defineProperty(globalThis.window, 'location', {
-        configurable: true,
-        value: {
-          ...originalLocation,
-          pathname,
-          search: '?from=direct',
-          hash: '#dialog',
-          replace,
-        },
-      });
-
       const app = createMockClient({
         publicPath: '/v2/',
         plugins: [NocoBaseBuildInPlugin as any],
         router: { type: 'memory', initialEntries: [pathname] },
       });
       app.apiMock.onGet('app:getLang').reply(200, {
-        data: {
-          lang: 'en-US',
-          resources: { client: {} },
-          cron: {},
-        },
+        data: { lang: 'en-US', resources: { client: {} }, cron: {} },
       });
       app.apiMock.onGet('/auth:check').reply(200, { data: { id: 1 } });
       app.apiMock.onGet('systemSettings:get').reply(200, { data: {} });
@@ -200,7 +167,7 @@ describe('nocobase buildin plugin auth redirect', () => {
       render(<Root />);
 
       expect(await screen.findByText('404')).toBeInTheDocument();
-      expect(replace).not.toHaveBeenCalled();
+      expect(app.router.router.state.location.pathname).toBe(pathname);
     },
   );
 });
diff --git a/packages/core/client-v2/src/__tests__/useCurrentRoles.test.tsx b/packages/core/client-v2/src/__tests__/useCurrentRoles.test.tsx
new file mode 100644
index 00000000000..b33d5ddf719
--- /dev/null
+++ b/packages/core/client-v2/src/__tests__/useCurrentRoles.test.tsx
@@ -0,0 +1,100 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { FlowEngine, FlowEngineProvider } from '@nocobase/flow-engine';
+import { renderHook } from '@testing-library/react';
+import React from 'react';
+import { describe, expect, it } from 'vitest';
+import { ACLContext } from '../acl';
+import { useCurrentRoles } from '../nocobase-buildin-plugin';
+
+type AclContextValue = React.ContextType<typeof ACLContext>;
+
+function makeAclValue(allowAnonymous: boolean): AclContextValue {
+  return {
+    loading: false,
+    data: {
+      data: { allowAnonymous },
+      meta: {},
+    },
+    refresh: async () => undefined,
+  };
+}
+
+function makeEngineWithUser(user: { roles?: Array<{ name: string; title?: string }> } | null): FlowEngine {
+  const engine = new FlowEngine();
+  if (user != null) {
+    engine.context.defineProperty('user', { value: user });
+  }
+  return engine;
+}
+
+function makeWrapper(opts: { engine: FlowEngine; acl: AclContextValue }) {
+  const Wrapper: React.FC = ({ children }) => (
+    <FlowEngineProvider engine={opts.engine}>
+      <ACLContext.Provider value={opts.acl}>{children}</ACLContext.Provider>
+    </FlowEngineProvider>
+  );
+  return Wrapper;
+}
+
+describe('useCurrentRoles', () => {
+  it('returns roles from flowEngine.context.user, dropping the synthetic __union__ entry', () => {
+    // `__union__` is a server-side marker for the merged-roles pseudo role and
+    // must never appear in user-facing role pickers — guards against a regression
+    // that broke role assignment in API Keys / SwitchRole pages.
+    const wrapper = makeWrapper({
+      engine: makeEngineWithUser({
+        roles: [
+          { name: '__union__', title: 'Union' },
+          { name: 'root', title: 'Root' },
+          { name: 'member', title: 'Member' },
+        ],
+      }),
+      acl: makeAclValue(false),
+    });
+    const { result } = renderHook(() => useCurrentRoles(), { wrapper });
+    expect(result.current).toEqual([
+      { name: 'root', title: 'Root' },
+      { name: 'member', title: 'Member' },
+    ]);
+  });
+
+  it('appends an anonymous role when ACL allowAnonymous is true', () => {
+    const wrapper = makeWrapper({
+      engine: makeEngineWithUser({ roles: [{ name: 'root', title: 'Root' }] }),
+      acl: makeAclValue(true),
+    });
+    const { result } = renderHook(() => useCurrentRoles(), { wrapper });
+    expect(result.current).toEqual([
+      { name: 'root', title: 'Root' },
+      { name: 'anonymous', title: 'Anonymous' },
+    ]);
+  });
+
+  it('compiles {{t(...)}} templates in role.title via flowEngine.context.t', () => {
+    const engine = makeEngineWithUser({ roles: [{ name: 'admin', title: '{{t("Admin")}}' }] });
+    engine.context.defineProperty('t', { value: () => 'Compiled Title' });
+    const wrapper = makeWrapper({ engine, acl: makeAclValue(false) });
+    const { result } = renderHook(() => useCurrentRoles(), { wrapper });
+    expect(result.current).toEqual([{ name: 'admin', title: 'Compiled Title' }]);
+  });
+
+  it('returns an empty array when no user has been written to engine.context', () => {
+    const wrapper = makeWrapper({ engine: makeEngineWithUser(null), acl: makeAclValue(false) });
+    const { result } = renderHook(() => useCurrentRoles(), { wrapper });
+    expect(result.current).toEqual([]);
+  });
+
+  it('returns just anonymous when no user is set but allowAnonymous is true', () => {
+    const wrapper = makeWrapper({ engine: makeEngineWithUser(null), acl: makeAclValue(true) });
+    const { result } = renderHook(() => useCurrentRoles(), { wrapper });
+    expect(result.current).toEqual([{ name: 'anonymous', title: 'Anonymous' }]);
+  });
+});
diff --git a/packages/core/client-v2/src/components/PoweredBy.tsx b/packages/core/client-v2/src/components/PoweredBy.tsx
new file mode 100644
index 00000000000..6e84b4b95de
--- /dev/null
+++ b/packages/core/client-v2/src/components/PoweredBy.tsx
@@ -0,0 +1,71 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { css, cx } from '@emotion/css';
+import { parseHTML } from '@nocobase/utils/client';
+import { theme } from 'antd';
+import React from 'react';
+import { useTranslation } from 'react-i18next';
+import { useCurrentAppInfo } from '../hooks/useCurrentAppInfo';
+import { usePlugin } from '../hooks/usePlugin';
+import { getAppVersionHTML } from '../utils/appVersionHTML';
+
+const homePageUrls: Record<string, string> = {
+  'en-US': 'https://www.nocobase.com',
+  'zh-CN': 'https://www.nocobase.com/cn/',
+};
+
+/**
+ * Footer brand rendered on auth pages and other layout entry points. Falls
+ * back to "Powered by NocoBase" when `@nocobase/plugin-custom-brand` is not
+ * installed; otherwise renders the plugin's HTML template with the
+ * `{{appVersion}}` placeholder substituted. The version is escaped via
+ * `getAppVersionHTML` so a malicious app version cannot inject script tags.
+ */
+export function PoweredBy() {
+  const { i18n } = useTranslation();
+  const { token } = theme.useToken();
+  const customBrandPlugin: any = usePlugin('@nocobase/plugin-custom-brand');
+  const appInfo = useCurrentAppInfo();
+  const appVersion = getAppVersionHTML(appInfo?.version);
+  const homePage = homePageUrls[i18n.language] || homePageUrls['en-US'];
+  const brandStyle = css`
+    text-align: center;
+    color: ${token.colorTextDescription};
+    a {
+      color: ${token.colorTextDescription};
+      &:hover {
+        color: ${token.colorText};
+      }
+    }
+  `;
+  const customBrand = customBrandPlugin?.options?.options?.brand;
+
+  if (customBrand) {
+    return (
+      <div
+        className={cx(brandStyle, 'nb-brand')}
+        dangerouslySetInnerHTML={{
+          __html: parseHTML(customBrand, { appVersion }),
+        }}
+      />
+    );
+  }
+
+  return (
+    <div className={brandStyle}>
+      Powered by{' '}
+      <a href={homePage} target="_blank" rel="noreferrer">
+        NocoBase
+      </a>
+    </div>
+  );
+}
+
+export default PoweredBy;
diff --git a/packages/core/client-v2/src/components/README.md b/packages/core/client-v2/src/components/README.md
new file mode 100644
index 00000000000..032a5c88a85
--- /dev/null
+++ b/packages/core/client-v2/src/components/README.md
@@ -0,0 +1,314 @@
+# client-v2 components
+
+This folder collects the React components that `@nocobase/client-v2` exposes to downstream plugins. Components are organized by directory — at the moment the main one is `form/`, which targets settings pages and form-shaped UIs.
+
+Skim this before writing a new plugin so you don't reinvent the wheel. Components are mostly orthogonal — import only what you need.
+
+## form/
+
+Components under `form/` cover the "settings page + form" shape. The typical recipe: open a form container with `ctx.viewer.drawer` / `ctx.viewer.dialog`, host an antd `Form` + `Form.Item` tree inside, and pick standard field controls from this folder.
+
+Grouped by purpose: form containers, form fields, data table, utilities.
+
+### Form containers
+
+#### DrawerFormLayout
+
+Drawer-style form layout. Pair with `ctx.viewer.drawer({ content })`.
+
+- Top: a close icon next to the title. Clicking close fires `onCancel` and dismisses the drawer
+- Bottom: default Cancel / Submit buttons; override the whole footer with `footer`
+- Middle: caller-supplied `<Form>` instance + fields
+
+```tsx
+import { DrawerFormLayout } from '@nocobase/client-v2';
+
+ctx.viewer.drawer({
+  width: '50%',
+  content: () => (
+    <DrawerFormLayout
+      title={t('Add authenticator')}
+      onSubmit={handleSubmit}
+      submitting={submitting}
+    >
+      <Form form={form} layout="vertical">
+        {/* fields */}
+      </Form>
+    </DrawerFormLayout>
+  ),
+});
+```
+
+Key props:
+
+- `title`: title node (rendered next to the close icon)
+- `onCancel` / `onSubmit`: callbacks; the drawer closes automatically once they resolve. Throw from `onSubmit` to keep the drawer open (e.g. on a validation error)
+- `submitting`: drives the Submit button's loading state
+- `submitText` / `cancelText`: button labels
+- `footer`: full override of the footer content (replaces the default Cancel + Submit pair)
+
+#### DialogFormLayout
+
+Dialog-style form layout, the centered counterpart of `DrawerFormLayout`. Pair with `ctx.viewer.dialog({ closable: true, content })`.
+
+The only visual difference from the drawer version: the title is a bare string (no inline close icon), relying on antd Modal's native top-right X. Note that `viewer.dialog` disables antd's native X by default — you have to pass `closable: true` explicitly for it to appear.
+
+```tsx
+import { DialogFormLayout } from '@nocobase/client-v2';
+
+ctx.viewer.dialog({
+  closable: true,  // restore antd Modal's native top-right X
+  content: () => (
+    <DialogFormLayout title={t('Bind verifier')} onSubmit={handleSubmit}>
+      <Form form={form} layout="vertical">
+        {/* fields */}
+      </Form>
+    </DialogFormLayout>
+  ),
+});
+```
+
+When to pick which:
+
+- **Drawer**: long forms with lots of fields that benefit from a full-height side panel (settings-page "Add / Edit")
+- **Dialog**: short forms that ask for quick confirmation (bind, change password, two-factor verify)
+
+Props are identical to `DrawerFormLayout` — they're drop-in replacements at the API level.
+
+### Form fields
+
+#### RemoteSelect
+
+A Select bound to an async option source. Framework-level — it knows nothing about NocoBase business resources; the caller passes a `request` function that fetches whatever it needs.
+
+```tsx
+import { RemoteSelect } from '@nocobase/client-v2';
+
+<Form.Item name="provider" label={t('Provider')}>
+  <RemoteSelect<{ name: string; title: string }>
+    request={async () => {
+      const response = await ctx.api.resource('smsOTPProviders').list();
+      return response?.data?.data || [];
+    }}
+    cacheKey="@nocobase/plugin-verification:smsOTPProviders:list"
+    mapOptions={(item) => ({ label: compileT(item.title), value: item.name })}
+  />
+</Form.Item>
+```
+
+Key props:
+
+- `request: () => Promise`: fetch function, required. Returns either an array of items or an envelope object (combine with `selectItems` to pluck the array out)
+- `selectItems`: extractor that takes the `request` result and returns the option array. Use when the response is `{ items, meta }`-shaped
+- `fieldNames`: defaults to `{ label, value }` mapping; override with `mapOptions` when the raw item doesn't match
+- `mapOptions: (item, index) => ({ label, value })`: full override of option mapping
+- `cacheKey` / `refreshDeps` / `ready`: forwarded to ahooks `useRequest`; control caching and refresh timing
+- `onLoaded: (items, response) => void`: fires after data arrives; receives both the mapped item array and the raw response
+
+All other antd `Select` props (`mode` / `placeholder` / `disabled` / `value` / `onChange` / etc.) are passed through.
+
+`showSearch` + `allowClear` are on by default; search is local (filters by label). For server-side search, drive the search input through external state and pass it via `refreshDeps`, then read it inside `request`.
+
+#### EnvVariableInput
+
+A variable input restricted to the `$env` namespace. Designed for secret / credential fields — supports environment-variable references and adds password masking for plain literal values.
+
+```tsx
+import { EnvVariableInput } from '@nocobase/client-v2';
+
+<Form.Item name={['options', 'accessKeySecret']} label={t('Access Key Secret')}>
+  <EnvVariableInput password />
+</Form.Item>
+```
+
+Key props:
+
+- `password`: when enabled, non-variable literal values render through `Input.Password` so they're masked. Variable expressions like `{{ $env.X }}` stay visible and editable
+- `placeholder` / `disabled` / `value` / `onChange`: standard controlled-input props
+
+The persisted value is always a string: either a literal (`'literal'`) or a server-template reference (`'{{ $env.foo.bar }}'`). The server expands the reference at use time.
+
+#### VariableInput / VariableTextArea
+
+General-purpose variable inputs. Can reference any namespace registered on `flowEngine.context` — `$env`, `$user`, plus ad-hoc business namespaces like `$resetLink`.
+
+The two differ in shape:
+
+- `VariableInput`: single-line. Variables render as colored pills (compact "chips")
+- `VariableTextArea`: multi-line. Variables stay as raw `{{ ... }}` text — better for email templates and other long-form content where the literal `{{ ... }}` is the intended display (the server expands them at render time)
+
+```tsx
+import { VariableInput, VariableTextArea } from '@nocobase/client-v2';
+
+// Email subject — single line, pills
+<Form.Item name={['options', 'emailSubject']} label={t('Subject')}>
+  <VariableInput
+    namespaces={['$env']}
+    extraNodes={[
+      { name: '$resetLink', title: t('Reset password link'), type: 'string', paths: ['$resetLink'] },
+    ]}
+  />
+</Form.Item>
+
+// Email body — multi-line, literal
+<Form.Item name={['options', 'emailContentHTML']} label={t('Content')}>
+  <VariableTextArea namespaces={['$env']} rows={10} />
+</Form.Item>
+```
+
+Key props:
+
+- `namespaces`: restrict the picker to specific top-level namespaces. Omit to expose every registered top-level property
+- `extraNodes`: static leaves appended after the namespace-filtered nodes. Use for variables that only make sense in the current page (e.g. `$resetLink`)
+- `converters`: override the default path ↔ string converters. `EnvVariableInput` uses this hook to lock its output to `$env`
+- `value` / `onChange` / `placeholder` / `disabled`: standard controlled-input props
+
+Under the hood `VariableInput` wraps `VariableHybridInput` (inline pills), `VariableTextArea` wraps `TextAreaWithContextSelector` (textarea + variable button). Both share the same MetaTree.
+
+#### FileSizeInput
+
+A byte-valued size input paired with a unit selector (Byte / KB / MB / GB). The persisted value is always in bytes; the displayed number is derived from the picked unit.
+
+```tsx
+import { FileSizeInput } from '@nocobase/client-v2';
+
+<Form.Item name="maxFileSize" label={t('Max file size')}>
+  <FileSizeInput min={1} max={1024 * 1024 * 1024} defaultValue={20 * 1024 * 1024} />
+</Form.Item>
+```
+
+Key props:
+
+- `min` / `max`: allowed byte range; values out of range snap back on blur. Defaults: `min=1`, `max=Infinity`
+- `defaultValue`: drives the initial unit when the field is empty (e.g. 20 MB starts in the "MB" unit)
+- `value` / `onChange`: controlled-input contract; the value type is `number` (bytes)
+
+#### PasswordInput
+
+`antd Input.Password` plus an optional strength meter, ported from v1's
+`Password` component. Use for any "set / change password" form when you want
+to give the user the same visual signal they had in v1.
+
+```tsx
+import { PasswordInput } from '@nocobase/client-v2';
+
+<Form.Item name="newPassword" label={t('New password')} rules={[{ required: true }]}>
+  <PasswordInput autoComplete="new-password" checkStrength />
+</Form.Item>
+```
+
+Key props:
+
+- `checkStrength`: render a strength bar beneath the input. Defaults to `false`. The score is bucketed `[20, 40, 60, 80, 100]` and shown via a clipped gradient (orange) inside a grey track, matching v1
+- All other antd `Input.Password` props are passed through unchanged: `value` / `onChange` / `disabled` / `placeholder` / `autoComplete` / etc.
+
+The strength meter is purely a UX hint, NOT validation. Submitting a weak password is still allowed unless the server (or a separately installed password-policy plugin) rejects it. Wire up real password rules through `Form.Item.rules` or — when the open-source ↔ commercial extension point lands — the project's shared password-validator hook.
+
+#### JsonTextArea
+
+JSON input. The stored value is a JS object (not a string) — parsing happens live while typing and is finalized on blur.
+
+```tsx
+import { JsonTextArea } from '@nocobase/client-v2';
+
+<Form.Item name="customConfig" label={t('Custom config')}>
+  <JsonTextArea rows={6} json5 />
+</Form.Item>
+```
+
+Key props:
+
+- `space`: serialization indent. Defaults to `2`
+- `json5`: parse with JSON5 (tolerates trailing commas, comments, single quotes, etc.). Defaults to `false`
+- `showError`: render the parse error inline below the textarea. Defaults to `true`
+- All other antd `Input.TextArea` props are passed through
+
+`value` / `onChange` are typed as `unknown` because JSON values can be any shape. Tighten the contract with validators in `Form.Item.rules`.
+
+### Data table
+
+#### Table
+
+The standard settings-page table, built on antd `Table` with two additions:
+
+1. **Row index ↔ checkbox swap**: by default each row shows its ordinal ("1 / 2 / 3"); on hover or when selected the cell flips to a checkbox. The two elements are absolute-positioned in the same cell so neither steals layout space. Requires `rowSelection` to be present
+2. **Drag-and-drop reorder**: pass `isDraggable` to enable. Each row gets a drag handle on the left; `onSortEnd` fires when a row is dropped. The component does NOT mutate `dataSource` — the caller persists the move (`resource.move(...)`) and `refresh()`s
+
+```tsx
+import { Table, DEFAULT_PAGE_SIZE } from '@nocobase/client-v2';
+
+<Table<AuthenticatorRecord>
+  rowKey="id"
+  loading={loading}
+  columns={columns}
+  dataSource={data?.records || []}
+  isDraggable
+  onSortEnd={async (from, to) => {
+    await resource.move({ sourceId: from.id, targetId: to.id });
+    refresh();
+  }}
+  rowSelection={{ selectedRowKeys, onChange: setSelectedRowKeys }}
+  pagination={{
+    current: page,
+    pageSize,
+    total: data?.total || 0,
+    onChange: (next, nextSize) => { /* ... */ },
+  }}
+/>
+```
+
+Key props:
+
+- `rowKey`: required. Drag-sort and row-identity both depend on it
+- `showIndex`: defaults to `true`; disable to keep the cell at checkbox-only
+- `isDraggable`: drag-and-drop toggle. Defaults to `false` — when off the component is a thin antd `Table` superset
+- `onSortEnd: (from, to) => void | Promise`: fired when a row is dropped. Caller persists
+- `showSortHandle`: defaults to `true`; set false when you want the handle off (or embedded into a custom column via `<SortHandle />`)
+- All other antd `Table` props are passed through
+
+Companion exports:
+
+- `DEFAULT_PAGE_SIZE` (value `50`): suggested default page size
+- `PAGE_SIZE_OPTIONS`: suggested page-size dropdown values `[5, 10, 20, 50, 100, 200]`
+- `SortHandle`: standalone handle component, exported from `@nocobase/client-v2` for embedding into custom columns
+
+### Utilities
+
+#### createFormRegistry
+
+Factory for a namespaced "entry registry". Each call returns an independent registry instance backed by its own closure `Map`.
+
+```ts
+import { createFormRegistry, type FormRegistryEntry } from '@nocobase/client-v2';
+
+interface StorageType extends FormRegistryEntry {
+  // FormRegistryEntry requires at least `name: string`
+  title: string;
+  Component: React.ComponentType;
+}
+
+const storageTypes = createFormRegistry<StorageType>('file-manager/storage-types');
+
+storageTypes.register({ name: 'local', title: 'Local storage', Component: LocalStorageForm });
+storageTypes.register({ name: 's3', title: 'Amazon S3', Component: S3StorageForm });
+
+storageTypes.get('s3');
+storageTypes.list();
+storageTypes.has('local');
+storageTypes.unregister('local');
+```
+
+Use this when a plugin needs an extension point for "same name + same shape + different implementation" things (the file-manager's storage types, the verification plugin's OTP providers, etc.). It's a thin wrapper around `Map` that adds a namespace label and an HMR-friendly overwrite warning.
+
+Re-registering the same `name` overwrites the previous entry and emits a `console.warn` — HMR doesn't throw, and unintended duplicates surface in dev.
+
+## When to add a new component here
+
+- Two or more plugins need the same field or container shape — promote it to this folder
+- Cross-plugin reusable, but the abstraction couples to a specific business domain (e.g. "pick a verifier", "pick a data source") — keep it inside the producing plugin and export from that plugin's `client-v2/`
+- Before reaching for abstraction, check whether an existing component can be improved instead. `RemoteSelect.selectItems` is an example — it landed so envelope responses don't need their own component
+
+Two follow-ups after adding a new component:
+
+1. Add `export * from './XxxComponent'` to `form/index.tsx`
+2. Document it here so the next plugin migration finds it
diff --git a/packages/core/client-v2/src/components/README.zh-CN.md b/packages/core/client-v2/src/components/README.zh-CN.md
new file mode 100644
index 00000000000..ed7f0c90dac
--- /dev/null
+++ b/packages/core/client-v2/src/components/README.zh-CN.md
@@ -0,0 +1,312 @@
+# client-v2 components
+
+这里收纳 `@nocobase/client-v2` 暴露给业务插件复用的一组 React 组件。组件按目录组织——目前主要是 `form/`，给设置页和表单场景用。
+
+写新插件前先翻一遍这份说明，能省下不少重复造轮子的功夫。组件之间互相耦合很少，按需 import 就行。
+
+## form/
+
+`form/` 目录下的组件围绕「设置页 + 表单」这一类场景。常见用法是配合 `ctx.viewer.drawer` / `ctx.viewer.dialog` 打开一个表单容器，里面放 antd 的 `Form` + `Form.Item`，字段用这里提供的标准控件。
+
+下面按用途分四组：表单容器、表单字段、数据表、工具。
+
+### 表单容器
+
+#### DrawerFormLayout
+
+抽屉形态的表单 layout。配合 `ctx.viewer.drawer({ content })` 用。
+
+- 顶部 Header：左上角一个 close 图标 + 标题。点击 close 会触发 `onCancel` 然后关闭抽屉
+- 底部 Footer：默认 Cancel / Submit 两个按钮；可以用 `footer` 完全替换
+- 中间 children：调用方自己放 `<Form>` 实例 + 字段
+
+```tsx
+import { DrawerFormLayout } from '@nocobase/client-v2';
+
+ctx.viewer.drawer({
+  width: '50%',
+  content: () => (
+    <DrawerFormLayout
+      title={t('添加认证器')}
+      onSubmit={handleSubmit}
+      submitting={submitting}
+    >
+      <Form form={form} layout="vertical">
+        {/* 字段 */}
+      </Form>
+    </DrawerFormLayout>
+  ),
+});
+```
+
+主要属性：
+
+- `title`：标题节点（旁边带 close 图标）
+- `onCancel` / `onSubmit`：回调，resolve 后会自动关闭抽屉。Submit 里 throw 可以让抽屉保持打开（比如校验失败）
+- `submitting`：驱动 Submit 按钮的 loading
+- `submitText` / `cancelText`：按钮文字
+- `footer`：完全自定义 Footer 内容（覆盖默认两个按钮）
+
+#### DialogFormLayout
+
+弹窗形态的表单 layout，跟 `DrawerFormLayout` 是同源对偶。配合 `ctx.viewer.dialog({ closable: true, content })` 用。
+
+跟 Drawer 版本的差异只有一点：title 是裸字符串（不带 close 图标），依赖 antd Modal 自带的右上角 X。注意 `viewer.dialog` 默认会禁用 antd 的原生 X——必须显式传 `closable: true` 才会出现。
+
+```tsx
+import { DialogFormLayout } from '@nocobase/client-v2';
+
+ctx.viewer.dialog({
+  closable: true,  // 关键：开启 antd Modal 原生右上角 X
+  content: () => (
+    <DialogFormLayout title={t('绑定验证码')} onSubmit={handleSubmit}>
+      <Form form={form} layout="vertical">
+        {/* 字段 */}
+      </Form>
+    </DialogFormLayout>
+  ),
+});
+```
+
+什么时候选哪个？
+
+- **Drawer**：长表单、字段多、需要从一侧滑出占用整面（比如设置页的「添加 / 编辑」）
+- **Dialog**：短表单、需要快速确认（比如绑定、修改密码、二次验证）
+
+属性跟 `DrawerFormLayout` 完全一致，可以直接换。
+
+### 表单字段
+
+#### RemoteSelect
+
+异步拉数据的 Select。框架级组件——不感知 NocoBase 业务，调用方传一个 `request` 函数自己拉数据。
+
+```tsx
+import { RemoteSelect } from '@nocobase/client-v2';
+
+<Form.Item name="provider" label={t('服务商')}>
+  <RemoteSelect<{ name: string; title: string }>
+    request={async () => {
+      const response = await ctx.api.resource('smsOTPProviders').list();
+      return response?.data?.data || [];
+    }}
+    cacheKey="@nocobase/plugin-verification:smsOTPProviders:list"
+    mapOptions={(item) => ({ label: compileT(item.title), value: item.name })}
+  />
+</Form.Item>
+```
+
+主要属性：
+
+- `request: () => Promise`：拉数据，必填。可以返回数组，也可以返回带元数据的对象（搭配 `selectItems` 取出数组）
+- `selectItems`：从 `request` 返回值中抽出数组的函数。响应体是 `{ items, meta }` 形态时用
+- `fieldNames`：默认按 `{ label, value }` 字段映射；不匹配的时候用 `mapOptions` 完全自定义
+- `mapOptions: (item, index) => ({ label, value })`：完整覆盖映射逻辑
+- `cacheKey` / `refreshDeps` / `ready`：透传给 ahooks `useRequest`，控制缓存和 refresh 时机
+- `onLoaded: (items, response) => void`：拉到数据后的回调，能拿到原始响应
+
+剩下的 antd `Select` props（`mode` / `placeholder` / `disabled` / `value` / `onChange` 等）都原样透传。
+
+默认开启 `showSearch` + `allowClear`，搜索是本地模式（按 label 匹配）。要做服务端搜索，把搜索词放进 `refreshDeps`，在 `request` 里读出来发请求。
+
+#### EnvVariableInput
+
+`$env` 命名空间的变量输入器。专门给「密钥 / 凭证」这类字段用——支持环境变量引用，同时给纯字面值加 password mask。
+
+```tsx
+import { EnvVariableInput } from '@nocobase/client-v2';
+
+<Form.Item name={['options', 'accessKeySecret']} label={t('Access Key Secret')}>
+  <EnvVariableInput password />
+</Form.Item>
+```
+
+主要属性：
+
+- `password`：开启后，非变量的字面值会用 `Input.Password` 形态遮盖。变量表达式（比如 `{{ $env.X }}`）依然可见可编辑
+- `placeholder` / `disabled` / `value` / `onChange`：标准受控字段属性
+
+值的形态是字符串：`'literal'` 或 `'{{ $env.foo.bar }}'`。服务端在使用时再展开成实际值。
+
+#### VariableInput / VariableTextArea
+
+通用变量输入器。可以引用任意 `flowEngine.context` 注册的命名空间（`$env` / `$user` / 业务自定义的 `$resetLink` 等）。
+
+两者差异：
+
+- `VariableInput`：单行，变量渲染成彩色 pill（视觉上是「短标签」）
+- `VariableTextArea`：多行，变量保留 `{{ ... }}` 字面——适合邮件模板这种「字面 + 变量」混排的长文本
+
+```tsx
+import { VariableInput, VariableTextArea } from '@nocobase/client-v2';
+
+// 邮件主题：单行 pill 形态
+<Form.Item name={['options', 'emailSubject']} label={t('主题')}>
+  <VariableInput
+    namespaces={['$env']}
+    extraNodes={[
+      { name: '$resetLink', title: t('重置密码链接'), type: 'string', paths: ['$resetLink'] },
+    ]}
+  />
+</Form.Item>
+
+// 邮件正文：多行字面
+<Form.Item name={['options', 'emailContentHTML']} label={t('正文')}>
+  <VariableTextArea namespaces={['$env']} rows={10} />
+</Form.Item>
+```
+
+主要属性：
+
+- `namespaces`：限定可选的顶层命名空间。不传就用 `flowEngine.context` 里全部已注册的
+- `extraNodes`：在命名空间过滤后追加几条静态变量（用于 `$resetLink` 这类只在当前页面有意义的局部变量）
+- `converters`：覆盖默认的 path ↔ string 转换器。`EnvVariableInput` 就是用这个钩子把输出锁定到 `$env`
+- `value` / `onChange` / `placeholder` / `disabled`：标准受控字段属性
+
+底层共用 `VariableHybridInput`（`VariableInput`）和 `TextAreaWithContextSelector`（`VariableTextArea`），用同一套 MetaTree 数据。
+
+#### FileSizeInput
+
+文件大小输入器。值统一存字节数，UI 上配一个单位选择器（Byte / KB / MB / GB）。
+
+```tsx
+import { FileSizeInput } from '@nocobase/client-v2';
+
+<Form.Item name="maxFileSize" label={t('单文件大小上限')}>
+  <FileSizeInput min={1} max={1024 * 1024 * 1024} defaultValue={20 * 1024 * 1024} />
+</Form.Item>
+```
+
+主要属性：
+
+- `min` / `max`：允许的字节数区间，blur 时会自动 clamp 回界内。默认 `min=1`、`max=Infinity`
+- `defaultValue`：用来决定初次显示的单位（比如默认 20 MB 就会以 MB 单位起始）
+- `value` / `onChange`：受控字段，值类型是 `number`（字节）
+
+#### PasswordInput
+
+antd `Input.Password` 加一个可选的强度提示条，从 v1 的 `Password` 组件移植过来。用于「设置 / 修改密码」类表单——v1 → v2 迁移过来后视觉信号保持一致。
+
+```tsx
+import { PasswordInput } from '@nocobase/client-v2';
+
+<Form.Item name="newPassword" label={t('新密码')} rules={[{ required: true }]}>
+  <PasswordInput autoComplete="new-password" checkStrength />
+</Form.Item>
+```
+
+主要属性：
+
+- `checkStrength`：在输入框下方渲染一条强度提示。默认 `false`。强度评分按 `[20, 40, 60, 80, 100]` 分桶，用裁剪的橙色渐变填充在灰色底条上，配色跟 v1 保持一致
+- 其他 antd `Input.Password` 属性原样透传：`value` / `onChange` / `disabled` / `placeholder` / `autoComplete` 等
+
+强度条只是 UX 提示，**不是表单校验**。弱密码仍然能提交，除非 server（或单独安装的 password-policy 商业插件）拒绝。真正的密码规则通过 `Form.Item.rules` 或——等开源 ↔ 商业的 extension point 落地之后——项目共享的 password validator hook 接入。
+
+#### JsonTextArea
+
+JSON 输入器。存的值是 JS 对象（不是字符串），编辑时实时解析、blur 时校验。
+
+```tsx
+import { JsonTextArea } from '@nocobase/client-v2';
+
+<Form.Item name="customConfig" label={t('自定义配置')}>
+  <JsonTextArea rows={6} json5 />
+</Form.Item>
+```
+
+主要属性：
+
+- `space`：序列化缩进，默认 `2`
+- `json5`：开启后用 JSON5 解析（容忍尾逗号、注释、单引号等）。默认关
+- `showError`：解析失败时是否在下方显示错误消息。默认 `true`
+- 其他 antd `Input.TextArea` 的属性都透传
+
+`value` / `onChange` 的类型是 `unknown`——因为 JSON 可以是任意结构。调用方按业务约束在 `Form.Item.rules` 里加 validator 收紧类型。
+
+### 数据表
+
+#### Table
+
+设置页表格的标准组件，基于 antd `Table` 扩展了两点：
+
+1. **行索引和复选框切换**：默认状态显示「1 / 2 / 3」行号，悬停或选中时切换成 checkbox。两个元素绝对定位在同一格内，不会抢空间。需要 `rowSelection` 才生效
+2. **拖拽排序**：传 `isDraggable` 开启，每行左侧出现拖拽手柄；放下时触发 `onSortEnd`。组件不动 `dataSource`，由调用方在回调里跑 `resource.move(...)` 再 `refresh()`
+
+```tsx
+import { Table, DEFAULT_PAGE_SIZE } from '@nocobase/client-v2';
+
+<Table<AuthenticatorRecord>
+  rowKey="id"
+  loading={loading}
+  columns={columns}
+  dataSource={data?.records || []}
+  isDraggable
+  onSortEnd={async (from, to) => {
+    await resource.move({ sourceId: from.id, targetId: to.id });
+    refresh();
+  }}
+  rowSelection={{ selectedRowKeys, onChange: setSelectedRowKeys }}
+  pagination={{
+    current: page,
+    pageSize,
+    total: data?.total || 0,
+    onChange: (next, nextSize) => { /* ... */ },
+  }}
+/>
+```
+
+主要属性：
+
+- `rowKey`：必填。拖拽和行身份识别都依赖它
+- `showIndex`：默认 `true`，关掉就只显示 checkbox
+- `isDraggable`：开关拖拽。默认 `false`，关掉就是个加强版 antd Table
+- `onSortEnd: (from, to) => void | Promise`：拖拽放下时触发。调用方负责持久化
+- `showSortHandle`：默认 `true`，需要时可以隐藏手柄，自己在某列里嵌 `<SortHandle />`
+- 其他 antd `Table` props 全部透传
+
+附带导出：
+
+- `DEFAULT_PAGE_SIZE`（值 `50`）：建议的默认分页大小
+- `PAGE_SIZE_OPTIONS`：建议的分页选项 `[5, 10, 20, 50, 100, 200]`
+- `SortHandle`：从 `@nocobase/client-v2` 导出的独立手柄组件，可以嵌进自定义列
+
+### 工具
+
+#### createFormRegistry
+
+带命名空间的「条目注册表」工厂。每次调用返回一个独立的 registry 实例，闭包持有自己的 `Map`。
+
+```ts
+import { createFormRegistry, type FormRegistryEntry } from '@nocobase/client-v2';
+
+interface StorageType extends FormRegistryEntry {
+  // FormRegistryEntry 要求至少有 `name: string`
+  title: string;
+  Component: React.ComponentType;
+}
+
+const storageTypes = createFormRegistry<StorageType>('file-manager/storage-types');
+
+storageTypes.register({ name: 'local', title: '本地存储', Component: LocalStorageForm });
+storageTypes.register({ name: 's3', title: 'Amazon S3', Component: S3StorageForm });
+
+storageTypes.get('s3');
+storageTypes.list();
+storageTypes.has('local');
+storageTypes.unregister('local');
+```
+
+主要用在：插件需要给「同名 + 同形 + 不同实现」的东西做扩展点（比如 file-manager 的存储类型、verification 的 OTP provider）。比 `Map` 多了 namespace 标识和 HMR 友好的覆盖警告。
+
+`name` 重复注册会用新条目覆盖旧的，同时打 `console.warn`——HMR 时不抛错，开发期能看到意外的重复。
+
+## 怎么决定加不加新组件
+
+- 出现两个及以上插件需要同一形态的字段或容器——抽到这里
+- 跨插件复用、但耦合到具体业务领域（比如「选一个 verifier」「选一个数据源」）——留在业务插件里，从插件的 `client-v2/` 自己 export
+- 抽象前先看现有组件能不能改进：比如 `RemoteSelect` 的 `selectItems` 就是为了让带元数据的响应不需要再开新组件
+
+新增组件后别忘记两件事：
+
+1. 在 `form/index.tsx` 加一行 `export * from './XxxComponent'`
+2. 回来这份 README 补一节，方便后续插件迁移时找到
diff --git a/packages/plugins/@nocobase/plugin-auth/src/client-v2/components/SwitchLanguage.tsx b/packages/core/client-v2/src/components/SwitchLanguage.tsx
similarity index 56%
rename from packages/plugins/@nocobase/plugin-auth/src/client-v2/components/SwitchLanguage.tsx
rename to packages/core/client-v2/src/components/SwitchLanguage.tsx
index 693f2ede75a..3d88f7b1cf8 100644
--- a/packages/plugins/@nocobase/plugin-auth/src/client-v2/components/SwitchLanguage.tsx
+++ b/packages/core/client-v2/src/components/SwitchLanguage.tsx
@@ -8,41 +8,41 @@
  */
 
 import { TranslationOutlined } from '@ant-design/icons';
-import { Dropdown } from 'antd';
+import { Dropdown, theme } from 'antd';
 import React from 'react';
-import { useApp } from '@nocobase/client-v2';
-import { useSystemSettings } from '@nocobase/client-v2';
+import { useApp } from '../hooks/useApp';
+import { useSystemSettings } from '../flow/system-settings';
+import languageCodes from '../locale/languageCodes';
 
-const languageLabels: Record<string, string> = {
-  'en-US': 'English',
-  'zh-CN': '简体中文',
-};
-
-export default function SwitchLanguage() {
+export function SwitchLanguage() {
   const app = useApp();
+  const { token } = theme.useToken();
   const { data } = useSystemSettings() || {};
-  const enabledLanguages = data?.data?.enabledLanguages || [];
+  const enabledLanguages: string[] = data?.data?.enabledLanguages || [];
 
   if (enabledLanguages.length <= 1) {
     return null;
   }
 
+  const items = enabledLanguages
+    .filter((code) => languageCodes[code])
+    .map((code) => ({ key: code, label: languageCodes[code].label }));
+
   return (
     <Dropdown
       menu={{
         selectable: true,
         defaultSelectedKeys: [app.apiClient.auth.locale],
-        items: enabledLanguages.map((code: string) => ({
-          key: code,
-          label: languageLabels[code] || code,
-        })),
+        items,
         onClick: ({ key }) => {
           app.apiClient.auth.setLocale(String(key));
           window.location.reload();
         },
       }}
     >
-      <TranslationOutlined style={{ fontSize: 20, color: 'inherit' }} />
+      <TranslationOutlined style={{ fontSize: token.fontSizeXL, color: 'inherit' }} />
     </Dropdown>
   );
 }
+
+export default SwitchLanguage;
diff --git a/packages/core/client-v2/src/components/form/DialogFormLayout.tsx b/packages/core/client-v2/src/components/form/DialogFormLayout.tsx
new file mode 100644
index 00000000000..0ea0d2075f1
--- /dev/null
+++ b/packages/core/client-v2/src/components/form/DialogFormLayout.tsx
@@ -0,0 +1,111 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { useFlowView } from '@nocobase/flow-engine';
+import { Button, Space } from 'antd';
+import React, { useCallback } from 'react';
+
+export interface DialogFormLayoutProps {
+  /** Header title rendered in the dialog's title slot. */
+  title: React.ReactNode;
+  /** Form body — typically a `<Form>` wrapping `<Form.Item>` fields. */
+  children: React.ReactNode;
+  /**
+   * Called before the dialog is closed by the Cancel button or the
+   * top-right close (X) icon. Use for "discard changes" confirmations.
+   */
+  onCancel?: () => void | Promise<void>;
+  /**
+   * Called when the Submit button is clicked. Caller owns validation
+   * + the actual API call; the dialog is closed automatically when
+   * `onSubmit` resolves. Throw from `onSubmit` to keep the dialog open
+   * (e.g. on a validation error).
+   */
+  onSubmit?: () => void | Promise<void>;
+  /** Drives the Submit button's loading state. */
+  submitting?: boolean;
+  /** Override the Submit button label. Defaults to "Submit". */
+  submitText?: React.ReactNode;
+  /** Override the Cancel button label. Defaults to "Cancel". */
+  cancelText?: React.ReactNode;
+  /**
+   * Full override of the footer content. When provided, the default
+   * Cancel + Submit buttons are replaced. Useful for forms that need
+   * extra actions (e.g. Preview, Save draft).
+   */
+  footer?: React.ReactNode;
+}
+
+/**
+ * Standard layout for dialog-hosted forms — the dialog counterpart of
+ * `DrawerFormLayout`. Title sits left-aligned in the dialog's native
+ * header (no inline close icon — the dialog provides its own X in the
+ * top-right when opened with `viewer.dialog({ closable: true, ... })`),
+ * the form body fills the middle, and a Cancel + Submit footer sits
+ * at the bottom.
+ *
+ * Why not just reuse `DrawerFormLayout`? `DrawerFormLayout` injects a
+ * `<CloseOutlined>` button next to the title — that's the drawer
+ * visual contract (close lives near the title in a side panel). In a
+ * centered dialog the native top-right close button is the expected
+ * affordance, so a separate layout keeps the visual contract clean.
+ *
+ * Callers own the `<Form>` instance, validation, and the actual API
+ * call. This component only handles the chrome and close behaviour.
+ *
+ * Example:
+ *
+ * ```tsx
+ * ctx.viewer.dialog({
+ *   closable: true,                       // native top-right X
+ *   content: () => (
+ *     <DialogFormLayout
+ *       title={t('Bind verifier')}
+ *       onSubmit={handleSubmit}
+ *       submitting={submitting}
+ *       submitText={t('Bind')}
+ *     >
+ *       <Form form={form} layout="vertical">...</Form>
+ *     </DialogFormLayout>
+ *   ),
+ * });
+ * ```
+ */
+export function DialogFormLayout(props: DialogFormLayoutProps) {
+  const view = useFlowView();
+
+  const handleCancel = useCallback(async () => {
+    await props.onCancel?.();
+    await view.close();
+  }, [props, view]);
+
+  const handleSubmit = useCallback(async () => {
+    await props.onSubmit?.();
+    await view.close();
+  }, [props, view]);
+
+  return (
+    <div>
+      {view.Header ? <view.Header title={props.title} /> : null}
+      {props.children}
+      {view.Footer ? (
+        <view.Footer>
+          {props.footer ?? (
+            <Space>
+              <Button onClick={handleCancel}>{props.cancelText ?? 'Cancel'}</Button>
+              <Button type="primary" loading={props.submitting} onClick={handleSubmit}>
+                {props.submitText ?? 'Submit'}
+              </Button>
+            </Space>
+          )}
+        </view.Footer>
+      ) : null}
+    </div>
+  );
+}
diff --git a/packages/core/client-v2/src/components/form/DrawerFormLayout.tsx b/packages/core/client-v2/src/components/form/DrawerFormLayout.tsx
index 2d30c162874..df853cab026 100644
--- a/packages/core/client-v2/src/components/form/DrawerFormLayout.tsx
+++ b/packages/core/client-v2/src/components/form/DrawerFormLayout.tsx
@@ -7,22 +7,15 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 
-import { CloseOutlined } from '@ant-design/icons';
-import { css } from '@emotion/css';
 import { useFlowView } from '@nocobase/flow-engine';
 import { Button, Space } from 'antd';
 import React, { useCallback } from 'react';
 
 export interface DrawerFormLayoutProps {
-  /** Header title rendered next to the close (X) button. */
+  /** Header title rendered next to antd Drawer's native close (X) icon. */
   title: React.ReactNode;
   /** Form body — typically a `<Form>` wrapping `<Form.Item>` fields. */
   children: React.ReactNode;
-  /**
-   * Called before the drawer is closed by either the Cancel button or the
-   * header's X icon. Use for "discard changes" confirmations.
-   */
-  onCancel?: () => void | Promise<void>;
   /**
    * Called when the Submit button is clicked. Caller owns validation + the
    * actual API call; the drawer is closed automatically when `onSubmit`
@@ -44,29 +37,26 @@ export interface DrawerFormLayoutProps {
   footer?: React.ReactNode;
 }
 
-const titleClassName = css`
-  display: inline-flex;
-  align-items: center;
-  gap: 8px;
-  margin-left: -8px;
-`;
-
 /**
- * Standard layout for drawer-hosted forms: a close-icon + title header on
- * top, the caller-provided form body in the middle, and a Cancel + Submit
- * footer at the bottom. Wraps `useFlowView()`'s `Header` / `Footer` slots
- * so the drawer chrome stays consistent across plugins.
+ * Standard layout for drawer-hosted forms: a title-only header on top
+ * (caller must open the drawer with `viewer.drawer({ closable: true })`
+ * so antd Drawer renders its native left-side X next to the title),
+ * the caller-provided form body in the middle, and a Cancel + Submit
+ * footer at the bottom. Wraps `useFlowView()`'s `Header` / `Footer`
+ * slots so the drawer chrome stays consistent across plugins.
+ *
+ * To intercept close (e.g. dirty-form confirmation), use the lower-level
+ * `viewer.drawer({ preventClose, beforeClose, ... })` hooks — this
+ * layout no longer wraps a custom close handler.
  *
  * Callers own the `<Form>` instance, validation, and the actual API call.
- * This component only handles the chrome and the close behaviour.
  */
 export function DrawerFormLayout(props: DrawerFormLayoutProps) {
   const view = useFlowView();
 
   const handleCancel = useCallback(async () => {
-    await props.onCancel?.();
     await view.close();
-  }, [props, view]);
+  }, [view]);
 
   const handleSubmit = useCallback(async () => {
     await props.onSubmit?.();
@@ -75,16 +65,7 @@ export function DrawerFormLayout(props: DrawerFormLayoutProps) {
 
   return (
     <div>
-      {view.Header ? (
-        <view.Header
-          title={
-            <span className={titleClassName}>
-              <Button type="text" size="small" icon={<CloseOutlined />} onClick={handleCancel} />
-              <span>{props.title}</span>
-            </span>
-          }
-        />
-      ) : null}
+      {view.Header ? <view.Header title={props.title} /> : null}
       {props.children}
       {view.Footer ? (
         <view.Footer>
diff --git a/packages/core/client-v2/src/components/form/PasswordInput.tsx b/packages/core/client-v2/src/components/form/PasswordInput.tsx
new file mode 100644
index 00000000000..9a201dd9ebb
--- /dev/null
+++ b/packages/core/client-v2/src/components/form/PasswordInput.tsx
@@ -0,0 +1,211 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Input, type InputProps } from 'antd';
+import type { PasswordProps as AntdPasswordProps } from 'antd/es/input';
+import React from 'react';
+
+// --- Strength scoring -------------------------------------------------------
+// Pure scoring function ported from the v1 client's password utils. Returns a
+// bucketed score in `[20, 40, 60, 80, 100]` based on character-class diversity,
+// length, repeated / sequential / consecutive character penalties, and a
+// "middle non-letter / non-symbol" bonus. No external dependencies — safe to
+// run on any string.
+//
+// Kept private to this module on purpose. Callers consume the visual strength
+// bar via `<PasswordInput checkStrength>`; they shouldn't need to compute the
+// raw score themselves.
+
+const isNum = (c: number) => c >= 48 && c <= 57;
+const isLower = (c: number) => c >= 97 && c <= 122;
+const isUpper = (c: number) => c >= 65 && c <= 90;
+const isSymbol = (c: number) => !(isLower(c) || isUpper(c) || isNum(c));
+const isLetter = (c: number) => isLower(c) || isUpper(c);
+
+function getStrength(val: string): number {
+  if (!val) return 0;
+  let num = 0;
+  let lower = 0;
+  let upper = 0;
+  let symbol = 0;
+  let MNS = 0;
+  let rep = 0;
+  let repC = 0;
+  let consecutive = 0;
+  let sequential = 0;
+  const len = () => num + lower + upper + symbol;
+  const callMe = () => {
+    let re = num > 0 ? 1 : 0;
+    re += lower > 0 ? 1 : 0;
+    re += upper > 0 ? 1 : 0;
+    re += symbol > 0 ? 1 : 0;
+    return re > 2 && len() >= 8 ? re + 1 : 0;
+  };
+  for (let i = 0; i < val.length; i++) {
+    const c = val.charCodeAt(i);
+    if (isNum(c)) {
+      num++;
+      if (i !== 0 && i !== val.length - 1) MNS++;
+      if (i > 0 && isNum(val.charCodeAt(i - 1))) consecutive++;
+    } else if (isLower(c)) {
+      lower++;
+      if (i > 0 && isLower(val.charCodeAt(i - 1))) consecutive++;
+    } else if (isUpper(c)) {
+      upper++;
+      if (i > 0 && isUpper(val.charCodeAt(i - 1))) consecutive++;
+    } else {
+      symbol++;
+      if (i !== 0 && i !== val.length - 1) MNS++;
+    }
+    let exists = false;
+    for (let j = 0; j < val.length; j++) {
+      if (val[i] === val[j] && i !== j) {
+        exists = true;
+        repC += Math.abs(val.length / (j - i));
+      }
+    }
+    if (exists) {
+      rep++;
+      const unique = val.length - rep;
+      repC = unique ? Math.ceil(repC / unique) : Math.ceil(repC);
+    }
+    if (i > 1) {
+      const last1 = val.charCodeAt(i - 1);
+      const last2 = val.charCodeAt(i - 2);
+      if (isLetter(c)) {
+        if (isLetter(last1) && isLetter(last2)) {
+          const v = val.toLowerCase();
+          const vi = v.charCodeAt(i);
+          const vi1 = v.charCodeAt(i - 1);
+          const vi2 = v.charCodeAt(i - 2);
+          if (vi - vi1 === vi1 - vi2 && Math.abs(vi - vi1) === 1) sequential++;
+        }
+      } else if (isNum(c)) {
+        if (isNum(last1) && isNum(last2)) {
+          if (c - last1 === last1 - last2 && Math.abs(c - last1) === 1) sequential++;
+        }
+      } else if (isSymbol(last1) && isSymbol(last2)) {
+        if (c - last1 === last1 - last2 && Math.abs(c - last1) === 1) sequential++;
+      }
+    }
+  }
+  let sum = 0;
+  const length = len();
+  sum += 4 * length;
+  if (lower > 0) sum += 2 * (length - lower);
+  if (upper > 0) sum += 2 * (length - upper);
+  if (num !== length) sum += 4 * num;
+  sum += 6 * symbol;
+  sum += 2 * MNS;
+  sum += 2 * callMe();
+  if (length === lower + upper) sum -= length;
+  if (length === num) sum -= num;
+  sum -= repC;
+  sum -= 2 * consecutive;
+  sum -= 3 * sequential;
+  sum = Math.max(0, Math.min(100, sum));
+
+  if (sum >= 80) return 100;
+  if (sum >= 60) return 80;
+  if (sum >= 40) return 60;
+  if (sum >= 20) return 40;
+  return 20;
+}
+
+// --- Strength bar UI --------------------------------------------------------
+// Colours and pixel sizes are intentionally kept identical to v1's
+// `PasswordStrength` so the visual remains unchanged across the v1 → v2
+// migration. When the design system formalises tokens for "strength signal"
+// colours, swap these literals for the matching token expressions.
+
+const segmentDividerStyle: React.CSSProperties = {
+  position: 'absolute',
+  zIndex: 1,
+  height: 8,
+  top: 0,
+  background: '#fff',
+  width: 1,
+  transform: 'translate(-50%, 0)',
+};
+
+function StrengthBar({ score }: { score: number }) {
+  return (
+    <div
+      style={{
+        background: '#e0e0e0',
+        marginBottom: 3,
+        position: 'relative',
+      }}
+    >
+      {/* Four white dividers split the bar into five strength brackets that
+          line up with the bucketed scoring in `getStrength`. */}
+      <div style={{ ...segmentDividerStyle, left: '20%' }} />
+      <div style={{ ...segmentDividerStyle, left: '40%' }} />
+      <div style={{ ...segmentDividerStyle, left: '60%' }} />
+      <div style={{ ...segmentDividerStyle, left: '80%' }} />
+      {/* The full gradient is always laid down, then `clip-path` trims it back
+          to the current score percentage — gives a smooth fill animation on
+          value change without re-painting the gradient on every render. */}
+      <div
+        style={{
+          position: 'relative',
+          backgroundImage: '-webkit-linear-gradient(left, #ff5500, #ff9300)',
+          transition: 'all 0.35s ease-in-out',
+          height: 8,
+          width: '100%',
+          marginTop: 5,
+          clipPath: `polygon(0 0,${score}% 0,${score}% 100%,0 100%)`,
+        }}
+      />
+    </div>
+  );
+}
+
+// --- Public component -------------------------------------------------------
+
+export interface PasswordInputProps extends AntdPasswordProps {
+  /**
+   * Render a visual strength bar beneath the input. Defaults to `false`. The
+   * score is computed locally — opting in does NOT add any form validation;
+   * use a separate `Form.Item.rules` entry for that (or wire the entry up to
+   * a cross-plugin password-validator extension point if your project
+   * provides one).
+   */
+  checkStrength?: boolean;
+}
+
+/**
+ * `Input.Password` plus an optional strength meter, ported from the v1
+ * `Password` component. The strength scoring and bar UI are identical to v1,
+ * so users who switch from a v1 page to a v2 page see the same visual signal.
+ *
+ * The component is value-shape compatible with antd `Input.Password` — drop
+ * it into any existing `Form.Item<password>` and toggle the meter with
+ * `checkStrength`.
+ *
+ * Caveats:
+ *
+ * - Strength scoring is purely a UX hint, not validation. Submitting a weak
+ *   password is still allowed unless the server (or a separately installed
+ *   password-policy plugin) rejects it.
+ * - The meter swallows the gap between `<Input.Password>` and the next form
+ *   element. If your `Form.Item` already adds vertical rhythm, the meter
+ *   inherits it; no extra spacing is added.
+ */
+export function PasswordInput(props: PasswordInputProps) {
+  const { value, checkStrength, ...rest } = props;
+  return (
+    <span>
+      <Input.Password {...(rest as InputProps)} value={value} />
+      {checkStrength ? <StrengthBar score={getStrength(String(value || ''))} /> : null}
+    </span>
+  );
+}
+
+export default PasswordInput;
diff --git a/packages/core/client-v2/src/components/form/RemoteSelect.tsx b/packages/core/client-v2/src/components/form/RemoteSelect.tsx
new file mode 100644
index 00000000000..f21e7328acc
--- /dev/null
+++ b/packages/core/client-v2/src/components/form/RemoteSelect.tsx
@@ -0,0 +1,137 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { useRequest } from 'ahooks';
+import { Select, type SelectProps } from 'antd';
+import React, { useMemo } from 'react';
+
+export interface RemoteSelectFieldNames {
+  label?: string;
+  value?: string;
+}
+
+export interface RemoteSelectProps<RawItem = any, Resp = RawItem[], V = any>
+  extends Omit<SelectProps<V>, 'options' | 'loading'> {
+  /**
+   * Fetch the option source. Receives no arguments; caller closes over the
+   * `ctx.api.resource(...)` (or any other source) it needs. May resolve
+   * with either an array of raw items (the common case) or an arbitrary
+   * envelope object — in the latter case, supply `selectItems` to pluck
+   * the array out.
+   */
+  request: () => Promise<Resp | undefined>;
+  /**
+   * When `request` returns an envelope (object with metadata around the
+   * list), use this to extract the array of items that drives the
+   * dropdown. Defaults to identity, i.e. `request` itself returns the
+   * array.
+   */
+  selectItems?: (response: Resp) => RawItem[] | undefined;
+  /**
+   * Names of the raw item properties that hold the display label and the
+   * persisted value. Defaults to `{ label: 'label', value: 'value' }`.
+   * Ignored when `mapOptions` is supplied.
+   */
+  fieldNames?: RemoteSelectFieldNames;
+  /**
+   * Full custom mapping from a raw item to an antd `OptionType`. When
+   * provided, overrides `fieldNames`.
+   */
+  mapOptions?: (item: RawItem, index: number) => { label: React.ReactNode; value: any };
+  /**
+   * Stable cache key for ahooks `useRequest` so the dropdown doesn't re-fetch
+   * on every re-mount. Pass a value tied to the request's effective inputs.
+   */
+  cacheKey?: string;
+  /**
+   * Re-run the request when any of these values changes. Forwarded to
+   * `useRequest`'s `refreshDeps`.
+   */
+  refreshDeps?: unknown[];
+  /**
+   * Skip the auto-fetch on mount when `false`. Defaults to `true`.
+   */
+  ready?: boolean;
+  /**
+   * Notified once the request resolves. Receives both the mapped item
+   * array and the raw response envelope — useful when callers need to
+   * read sibling metadata (counts, availability hints, etc.) without
+   * issuing a second request.
+   */
+  onLoaded?: (items: RawItem[], response: Resp) => void;
+}
+
+/**
+ * Generic settings-page Select bound to an async option source. The
+ * component itself stays framework-agnostic — it knows nothing about
+ * NocoBase resources, data sources, or Formily. Pass any async `request`
+ * that resolves with an array, and supply `fieldNames` (or `mapOptions`)
+ * to map raw items to antd option shape.
+ *
+ * Search is local-only (antd's default `optionFilterProp="label"`). For
+ * server-side search, drive `request` from external state and pass the
+ * search input via `refreshDeps`.
+ */
+export function RemoteSelect<RawItem = any, Resp = RawItem[], V = any>(props: RemoteSelectProps<RawItem, Resp, V>) {
+  const {
+    request,
+    selectItems,
+    fieldNames,
+    mapOptions,
+    cacheKey,
+    refreshDeps,
+    ready = true,
+    onLoaded,
+    showSearch = true,
+    allowClear = true,
+    ...selectProps
+  } = props;
+
+  const { data: response, loading } = useRequest<Resp | undefined, []>(request, {
+    cacheKey,
+    refreshDeps,
+    ready,
+    onSuccess: (resp) => {
+      if (resp === undefined) return;
+      const items = (selectItems ? selectItems(resp) : (resp as unknown as RawItem[])) || [];
+      onLoaded?.(items, resp);
+    },
+  });
+
+  const items = useMemo<RawItem[]>(() => {
+    if (response === undefined) return [];
+    return (selectItems ? selectItems(response) : (response as unknown as RawItem[])) || [];
+  }, [response, selectItems]);
+
+  const labelKey = fieldNames?.label ?? 'label';
+  const valueKey = fieldNames?.value ?? 'value';
+
+  const options = useMemo(() => {
+    if (mapOptions) {
+      return items.map((item, index) => mapOptions(item, index));
+    }
+    return items.map((item: any) => ({
+      label: item?.[labelKey],
+      value: item?.[valueKey],
+    }));
+  }, [items, mapOptions, labelKey, valueKey]);
+
+  return (
+    <Select
+      {...selectProps}
+      showSearch={showSearch}
+      allowClear={allowClear}
+      optionFilterProp="label"
+      loading={loading}
+      options={options}
+    />
+  );
+}
+
+export default RemoteSelect;
diff --git a/packages/core/client-v2/src/components/form/index.tsx b/packages/core/client-v2/src/components/form/index.tsx
index 8fb2d1ba255..58c04c5b571 100644
--- a/packages/core/client-v2/src/components/form/index.tsx
+++ b/packages/core/client-v2/src/components/form/index.tsx
@@ -8,8 +8,11 @@
  */
 
 export * from './createFormRegistry';
+export * from './DialogFormLayout';
 export * from './DrawerFormLayout';
 export * from './EnvVariableInput';
 export * from './FileSizeInput';
 export * from './JsonTextArea';
+export * from './PasswordInput';
+export * from './RemoteSelect';
 export * from './VariableInput';
diff --git a/packages/core/client-v2/src/components/form/table/Table.tsx b/packages/core/client-v2/src/components/form/table/Table.tsx
index 90956136cbc..bbac82435cb 100644
--- a/packages/core/client-v2/src/components/form/table/Table.tsx
+++ b/packages/core/client-v2/src/components/form/table/Table.tsx
@@ -19,7 +19,7 @@ import React, { useMemo, useState } from 'react';
 import { SortableRow, SortHandle } from './dnd/SortableRow';
 import { RowOverlayPreview } from './RowOverlayPreview';
 import { SelectionCell } from './SelectionCell';
-import { indexSwapClassName, selectionGutterClassName } from './styles';
+import { indexSwapClassName, selectionGutterClassName, tableScrollClassName } from './styles';
 import { readRowKey, snapshotSourceRow, type RowKey, type RowSnapshot } from './utils';
 
 type RowSelectionRenderCellResult<RecordType> = React.ReactNode | RenderedCell<RecordType>;
@@ -227,6 +227,7 @@ export function Table<RecordType extends object = any>(props: TableProps<RecordT
 
   const tableClassName = cx(
     className,
+    tableScrollClassName,
     showHandleInSelection && selectionGutterClassName,
     showIndex && rowSelection && indexSwapClassName,
   );
diff --git a/packages/core/client-v2/src/components/form/table/styles.ts b/packages/core/client-v2/src/components/form/table/styles.ts
index f8fcdc31a73..aef185df18c 100644
--- a/packages/core/client-v2/src/components/form/table/styles.ts
+++ b/packages/core/client-v2/src/components/form/table/styles.ts
@@ -10,6 +10,25 @@
 import { css } from '@emotion/css';
 import { SORT_HANDLE_GUTTER } from './constants';
 
+/**
+ * Restore horizontal scrolling on `.ant-table-content` so wide tables in
+ * narrow containers (drawer / settings panel) scroll their inner `<table>`
+ * instead of getting clipped or forcing the outer container to grow.
+ *
+ * `width: max-content` on the inner `<table>` lets columns size to their
+ * natural width; `min-width: 100%` keeps the table filling the viewport
+ * when total column width is smaller than the container.
+ */
+export const tableScrollClassName = css`
+  &.ant-table-wrapper .ant-table-content {
+    overflow: auto hidden;
+  }
+  &.ant-table-wrapper .ant-table-content > table {
+    width: max-content;
+    min-width: 100%;
+  }
+`;
+
 /**
  * Reserve a `SORT_HANDLE_GUTTER`-wide gap on the left of the rowSelection
  * column so the handle's `left:0` lands inside a `position:relative` cell.
diff --git a/packages/core/client-v2/src/components/index.ts b/packages/core/client-v2/src/components/index.ts
index b593915ed31..29638b1da32 100644
--- a/packages/core/client-v2/src/components/index.ts
+++ b/packages/core/client-v2/src/components/index.ts
@@ -12,5 +12,7 @@ export * from './BlankComponent';
 export * from './form/table/dnd';
 export * from './form';
 export * from './Icon';
+export * from './PoweredBy';
 export * from './RouterContextCleaner';
+export * from './SwitchLanguage';
 export * from './form/table';
diff --git a/packages/core/client-v2/src/flow/admin-shell/admin-layout/AdminLayoutComponent.tsx b/packages/core/client-v2/src/flow/admin-shell/admin-layout/AdminLayoutComponent.tsx
index b94e2c75113..707eb6d9bb3 100644
--- a/packages/core/client-v2/src/flow/admin-shell/admin-layout/AdminLayoutComponent.tsx
+++ b/packages/core/client-v2/src/flow/admin-shell/admin-layout/AdminLayoutComponent.tsx
@@ -371,15 +371,12 @@ export const AdminLayoutComponent = observer((props: any) => {
   const [allAccessRoutes, setAllAccessRoutes] = useState<NocoBaseDesktopRoute[]>(
     () => flowEngine.context.routeRepository?.listAccessible?.() || [],
   );
-  const screens = Grid.useBreakpoint();
-  const isMobileViewport =
-    screens.md === false || (screens.md === undefined && typeof window !== 'undefined' && window.innerWidth < 768);
   const location = useLocation();
   const { token } = antdTheme.useToken();
   const customToken = token as CustomToken;
   const isMobileLayout = !!adminLayoutModel?.isMobileLayout;
   const menuRouteRefreshVersion = adminLayoutModel?.menuRouteRefreshVersion || 0;
-  const isMobileSider = isMobileLayout || isMobileViewport;
+  const isMobileSider = isMobileLayout;
   const [collapsed, setCollapsed] = useState(isMobileSider);
   const [preferredFlowSettingsEnabled, setPreferredFlowSettingsEnabled] = useState(() => readFlowSettingsPreference());
   const [route, setRoute] = useState<{ path: string; children: AdminLayoutMenuNode[] }>({
diff --git a/packages/core/client-v2/src/nocobase-buildin-plugin/index.tsx b/packages/core/client-v2/src/nocobase-buildin-plugin/index.tsx
index 474f46f5cca..7698c6cc1cb 100644
--- a/packages/core/client-v2/src/nocobase-buildin-plugin/index.tsx
+++ b/packages/core/client-v2/src/nocobase-buildin-plugin/index.tsx
@@ -7,11 +7,12 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 
-import { createCollectionContextMeta } from '@nocobase/flow-engine';
-import React, { createContext, type FC, useEffect, useRef, useState } from 'react';
-import { Navigate, Outlet, useLocation } from 'react-router-dom';
+import { createCollectionContextMeta, useFlowEngine } from '@nocobase/flow-engine';
+import React, { createContext, type FC, useContext, useEffect, useMemo, useRef, useState } from 'react';
+import { Navigate, Outlet, useLocation, useNavigate } from 'react-router-dom';
+import { useACLRoleContext } from '../acl';
 import type { Application } from '../Application';
-import { getCurrentV2RedirectPath, getDefaultV2AdminRedirectPath, redirectToV2Signin } from '../authRedirect';
+import { getCurrentV2RedirectPath, getDefaultV2AdminRedirectPath } from '../authRedirect';
 import { AppNotFound } from '../components';
 import { PluginFlowEngine } from '../flow';
 import { AdminLayoutMenuItemModel, AdminLayoutModel } from '../flow/admin-shell/admin-layout';
@@ -20,13 +21,18 @@ import { Plugin } from '../Plugin';
 import { AdminSettingsLayoutModel } from '../settings-center';
 import { LocalePlugin } from './plugins/LocalePlugin';
 
-type CurrentUserState = {
+export type CurrentUserState = {
   data?: {
     data?: any;
   };
   loading: boolean;
 };
 
+export type CurrentRoleOption = {
+  name: string;
+  title: string;
+};
+
 const AUTH_ROUTE_PREFIXES = ['/signin', '/signup', '/forgot-password', '/reset-password'];
 
 function removeBasename(pathname: string, basename?: string) {
@@ -50,9 +56,42 @@ function isAdminRuntimeRoute(pathname: string, basename?: string) {
   return normalizedPathname === '/admin' || normalizedPathname.startsWith('/admin/');
 }
 
-const CurrentUserContext = createContext<CurrentUserState | null>(null);
+export const CurrentUserContext = createContext<CurrentUserState | null>(null);
 CurrentUserContext.displayName = 'CurrentUserContext';
 
+export function useCurrentUserContext() {
+  return useContext(CurrentUserContext);
+}
+
+/**
+ * 返回当前用户在 v2 应用上下文中可选的角色列表，等价于 v1 `useCurrentRoles`：
+ * 从 FlowEngine 全局上下文 `engine.context.user.roles` 派生（CurrentUserProvider 在
+ * `/auth:check` 成功后通过 `defineProperty('user', { value })` 写入），按需追加匿名角色，
+ * 并去掉合并角色 `__union__`。v2 中角色 title 可能含有 `{{t('...')}}` 模板，因此用
+ * flowEngine.context.t 解析。
+ *
+ * 不读 React `CurrentUserContext`：FlowEngine 的 dialog/drawer/popover 内容通过 `ctx.viewer`
+ * 渲染到独立的 ElementsHolder，部分场景会脱离原 Provider 树；FlowEngine 全局上下文是同一份
+ * 数据但不受 React 树位置影响。
+ */
+export function useCurrentRoles(): CurrentRoleOption[] {
+  const { allowAnonymous } = useACLRoleContext();
+  const engine = useFlowEngine();
+  const rolesRaw = engine?.context?.user?.roles as Array<{ name: string; title?: string }> | undefined;
+
+  return useMemo(() => {
+    const compile = (value: string | undefined): string =>
+      value == null ? '' : engine?.context?.t ? engine.context.t(value) : value;
+    const roles: CurrentRoleOption[] = (rolesRaw || [])
+      .filter((role) => role?.name !== '__union__')
+      .map((role) => ({ name: role.name, title: compile(role.title) }));
+    if (allowAnonymous) {
+      roles.push({ name: 'anonymous', title: 'Anonymous' });
+    }
+    return roles;
+  }, [allowAnonymous, engine, rolesRaw]);
+}
+
 const DataSourceBootstrapProvider: FC = ({ children }) => {
   const app = useApp();
   const location = useLocation();
@@ -115,6 +154,7 @@ const DataSourceBootstrapProvider: FC = ({ children }) => {
 const CurrentUserProvider: FC = ({ children }) => {
   const app = useApp();
   const location = useLocation();
+  const navigate = useNavigate();
   const [state, setState] = useState<CurrentUserState>({ loading: true });
   const pathnameRef = useRef(location.pathname);
   pathnameRef.current = location.pathname;
@@ -143,8 +183,23 @@ const CurrentUserProvider: FC = ({ children }) => {
         });
 
         const user = res?.data?.data;
+        // 服务端通过 `{ code: 302, redirect }` 通知客户端先去某个中间页(例如 2FA 验证页)。
+        // 这类响应没有 user.id,但也不能视为未登录——否则会和处理 302 的全局响应拦截器
+        // (例如 plugin-two-factor-authentication 注册的那一个)竞态,而 `window.location.replace`
+        // 会覆盖更早发出的 `window.location.href`,把用户错误地弹回登录页。让响应拦截器接管跳转。
+        if (user?.code === 302) {
+          if (mounted) {
+            setState({ loading: false });
+          }
+          return;
+        }
         if (user?.id == null) {
-          redirectToV2Signin(app, getCurrentV2RedirectPath(app, locationRef.current), { replace: true });
+          // 用 react-router navigate (虚拟跳转)而不是 location.replace, 这样如果有其他响应拦截器
+          // 已经发起了 window.location.href 整页跳转(例如 2FA 插件接收到服务端 302 重定向),
+          // 真实跳转可以胜出 navigate, 不会被这里的 signin 重定向覆盖。
+          navigate(`/signin?redirect=${encodeURIComponent(getCurrentV2RedirectPath(app, locationRef.current))}`, {
+            replace: true,
+          });
           return;
         }
 
@@ -169,7 +224,9 @@ const CurrentUserProvider: FC = ({ children }) => {
       } catch (error: any) {
         const isAuthError = error?.response?.status === 401 || error?.status === 401;
         if (isAuthError) {
-          redirectToV2Signin(app, getCurrentV2RedirectPath(app, locationRef.current), { replace: true });
+          navigate(`/signin?redirect=${encodeURIComponent(getCurrentV2RedirectPath(app, locationRef.current))}`, {
+            replace: true,
+          });
           return;
         }
         if (mounted) {
@@ -184,7 +241,7 @@ const CurrentUserProvider: FC = ({ children }) => {
     return () => {
       mounted = false;
     };
-  }, [app]);
+  }, [app, navigate]);
 
   if (state.loading) {
     return app.renderComponent('AppSpin');
@@ -196,15 +253,12 @@ const CurrentUserProvider: FC = ({ children }) => {
 const RootRedirect: FC = () => {
   const app = useApp();
   const hasToken = !!app?.apiClient?.auth?.token;
-
-  useEffect(() => {
-    if (!hasToken) {
-      redirectToV2Signin(app, getDefaultV2AdminRedirectPath(app), { replace: true });
-    }
-  }, [app, hasToken]);
+  const targetPath = getDefaultV2AdminRedirectPath(app);
 
   if (!hasToken) {
-    return app.renderComponent('AppSpin');
+    // 用 react-router <Navigate /> 而非 location.replace, 避免覆盖同时段其它响应拦截器
+    // 触发的 window.location.href (例如 2FA 接收到服务端 302 时设置的整页跳转)。
+    return <Navigate replace to={`/signin?redirect=${encodeURIComponent(targetPath)}`} />;
   }
 
   return <Navigate replace to="/admin" />;
diff --git a/packages/core/flow-engine/src/utils/index.ts b/packages/core/flow-engine/src/utils/index.ts
index 38226bbc932..c1804c45bb1 100644
--- a/packages/core/flow-engine/src/utils/index.ts
+++ b/packages/core/flow-engine/src/utils/index.ts
@@ -104,3 +104,6 @@ export { isBeforeRenderFlow } from './flows';
 
 // Module URL resolver
 export { resolveModuleUrl, isCssFile } from './resolveModuleUrl';
+
+// Random base36 identifier with optional semantic prefix
+export { randomId } from './randomId';
diff --git a/packages/core/flow-engine/src/utils/randomId.ts b/packages/core/flow-engine/src/utils/randomId.ts
new file mode 100644
index 00000000000..49b5e46b4fd
--- /dev/null
+++ b/packages/core/flow-engine/src/utils/randomId.ts
@@ -0,0 +1,48 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+const CHARSET = '0123456789abcdefghijklmnopqrstuvwxyz';
+
+/**
+ * Generate a random base36 identifier with an optional semantic prefix.
+ *
+ * Equivalent in shape to v1's `uid()` from `@formily/shared` (11 chars
+ * of `[0-9a-z]`), with an opt-in prefix appended at the front. v2 forbids
+ * direct `@formily/*` imports in `src/client-v2/`, so this helper is the
+ * single substitute the rest of the codebase should reach for.
+ *
+ * Common semantic prefixes observed across the codebase — pass the one
+ * that matches your domain rather than relying on a default, so the
+ * intent is explicit at the call site:
+ *
+ *   - `s_` — service / settings record (authenticators, channels, …)
+ *   - `v_` — verifier / variable / LLM service
+ *   - `f_` — field
+ *   - `t_` — through table
+ *
+ * Example:
+ *
+ * ```ts
+ * import { randomId } from '@nocobase/flow-engine';
+ *
+ * name: randomId('s_'),  // → 's_keeoaui1ubi'
+ * name: randomId('v_'),  // → 'v_a8f3kp2x9qm'
+ * name: randomId(),      // → 'a8f3kp2x9qm'
+ * ```
+ *
+ * Not cryptographically secure — uses `Math.random()`. Good enough for
+ * unique form names / schema keys, NOT for security tokens.
+ */
+export function randomId(prefix = '', length = 11): string {
+  let id = '';
+  for (let i = 0; i < length; i++) {
+    id += CHARSET[(Math.random() * CHARSET.length) | 0];
+  }
+  return `${prefix}${id}`;
+}
diff --git a/packages/plugins/@nocobase/plugin-api-keys/client-v2.d.ts b/packages/plugins/@nocobase/plugin-api-keys/client-v2.d.ts
new file mode 100644
index 00000000000..f12b5649835
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-api-keys/client-v2.d.ts
@@ -0,0 +1,2 @@
+export * from './dist/client-v2';
+export { default } from './dist/client-v2';
diff --git a/packages/plugins/@nocobase/plugin-api-keys/client-v2.js b/packages/plugins/@nocobase/plugin-api-keys/client-v2.js
new file mode 100644
index 00000000000..59d89708039
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-api-keys/client-v2.js
@@ -0,0 +1 @@
+module.exports = require('./dist/client-v2/index.js');
diff --git a/packages/plugins/@nocobase/plugin-api-keys/package.json b/packages/plugins/@nocobase/plugin-api-keys/package.json
index c84d891a9ed..17dd95eed85 100644
--- a/packages/plugins/@nocobase/plugin-api-keys/package.json
+++ b/packages/plugins/@nocobase/plugin-api-keys/package.json
@@ -29,7 +29,9 @@
   "peerDependencies": {
     "@nocobase/actions": "2.x",
     "@nocobase/client": "2.x",
+    "@nocobase/client-v2": "2.x",
     "@nocobase/database": "2.x",
+    "@nocobase/flow-engine": "2.x",
     "@nocobase/resourcer": "2.x",
     "@nocobase/server": "2.x",
     "@nocobase/test": "2.x",
diff --git a/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/__tests__/ApiKeysPage.test.ts b/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/__tests__/ApiKeysPage.test.ts
new file mode 100644
index 00000000000..d2f1dd7d8cd
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/__tests__/ApiKeysPage.test.ts
@@ -0,0 +1,111 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import dayjs from 'dayjs';
+import { describe, expect, it, vi } from 'vitest';
+import { type ApiKeyFormValues, type ApiKeyResource, deleteApiKey, submitApiKeyForm } from '../pages/ApiKeysPage';
+import { diffToExpiresIn, formatExpiresReadOnly } from '../pages/ExpiresField';
+
+function makeResource(overrides: Partial<ApiKeyResource> = {}): ApiKeyResource {
+  return {
+    create: vi.fn().mockResolvedValue({ data: { data: { token: 'tok_test' } } }),
+    destroy: vi.fn().mockResolvedValue(undefined),
+    ...overrides,
+  };
+}
+
+describe('plugin-api-keys submit pipeline', () => {
+  it('should fire resource.create with the form values and surface the returned token', async () => {
+    const resource = makeResource();
+    const onCreated = vi.fn();
+
+    await submitApiKeyForm({
+      values: { name: 'k1', role: { name: 'admin' }, expiresIn: '30d' },
+      resource,
+      onCreated,
+    });
+
+    expect(resource.create).toHaveBeenCalledTimes(1);
+    expect(resource.create).toHaveBeenCalledWith({
+      values: { name: 'k1', role: { name: 'admin' }, expiresIn: '30d' },
+    });
+    // Token from `response.data.data.token` must reach the caller so the post-
+    // create success modal can show the one-time copyable token to the user.
+    expect(onCreated).toHaveBeenCalledTimes(1);
+    expect(onCreated).toHaveBeenCalledWith('tok_test');
+  });
+
+  it('should not invoke onCreated when resource.create rejects', async () => {
+    const resource = makeResource({ create: vi.fn().mockRejectedValue(new Error('boom')) });
+    const onCreated = vi.fn();
+
+    await expect(
+      submitApiKeyForm({
+        values: { name: 'k', expiresIn: '30d' } as ApiKeyFormValues,
+        resource,
+        onCreated,
+      }),
+    ).rejects.toThrow(/boom/);
+    expect(onCreated).not.toHaveBeenCalled();
+  });
+
+  it('should fire resource.destroy with the numeric `id` as filterByTk on row delete', async () => {
+    // Pin the filterByTk source. `apiKeys` collection's primary key is the
+    // bigInt `id`, NOT `name` — guarding against the silent-fallthrough class
+    // of regression documented in references/settings-page-crud.md.
+    const resource = makeResource();
+    const onDeleted = vi.fn();
+
+    await deleteApiKey({ resource, filterByTk: 42, onDeleted });
+
+    expect(resource.destroy).toHaveBeenCalledTimes(1);
+    expect(resource.destroy).toHaveBeenCalledWith({ filterByTk: 42 });
+    expect(onDeleted).toHaveBeenCalledTimes(1);
+  });
+
+  it('should not invoke onDeleted when resource.destroy rejects', async () => {
+    const resource = makeResource({ destroy: vi.fn().mockRejectedValue(new Error('nope')) });
+    const onDeleted = vi.fn();
+
+    await expect(deleteApiKey({ resource, filterByTk: 1, onDeleted })).rejects.toThrow(/nope/);
+    expect(onDeleted).not.toHaveBeenCalled();
+  });
+});
+
+describe('plugin-api-keys ExpiresField helpers', () => {
+  it('formats `never` as the localized "Never expires" label', () => {
+    expect(formatExpiresReadOnly({ expiresIn: 'never', createdAt: '2026-01-01T00:00:00Z' }, 'Never expires')).toBe(
+      'Never expires',
+    );
+  });
+
+  it('adds the day delta to createdAt and formats it as YYYY-MM-DD HH:mm:ss', () => {
+    // 30 days after 2026-01-01 00:00:00 UTC.
+    const out = formatExpiresReadOnly({ expiresIn: '30d', createdAt: '2026-01-01T00:00:00Z' }, 'never');
+    expect(out).toBe(dayjs('2026-01-01T00:00:00Z').add(30, 'days').format('YYYY-MM-DD HH:mm:ss'));
+  });
+
+  it('returns "" when createdAt is missing (e.g. unsaved row in test fixtures)', () => {
+    expect(formatExpiresReadOnly({ expiresIn: '30d' }, 'never')).toBe('');
+  });
+
+  it('diffToExpiresIn converts a future dayjs date into "Xd" relative to now', () => {
+    const now = dayjs('2026-05-01T12:00:00Z');
+    const target = dayjs('2026-05-11T12:00:00Z');
+    expect(diffToExpiresIn(target, now)).toBe('10d');
+  });
+
+  it('diffToExpiresIn zeroes out second/ms to match the v1 day rounding rule', () => {
+    // Without the millisecond/second strip, dayjs.diff(unit:'d') would round
+    // sub-day deltas down differently depending on the wall clock at submit time.
+    const now = dayjs('2026-05-01T12:00:30.500Z');
+    const target = dayjs('2026-05-02T12:00:00.000Z');
+    expect(diffToExpiresIn(target, now)).toBe('1d');
+  });
+});
diff --git a/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/index.tsx b/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/index.tsx
new file mode 100644
index 00000000000..be989de7c3c
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/index.tsx
@@ -0,0 +1,10 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+export { default } from './plugin';
diff --git a/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/locale.ts b/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/locale.ts
new file mode 100644
index 00000000000..a6742626b00
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/locale.ts
@@ -0,0 +1,21 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { tExpr as flowTExpr, useFlowEngine } from '@nocobase/flow-engine';
+import { NAMESPACE } from '../constants';
+
+export function useT() {
+  const engine = useFlowEngine();
+  return (key: string, options?: Record<string, any>) =>
+    engine.context.t(key, { ns: [NAMESPACE, 'client'], ...options });
+}
+
+export function tExpr(key: string) {
+  return flowTExpr(key, { ns: [NAMESPACE, 'client'] });
+}
diff --git a/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/pages/ApiKeysPage.tsx b/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/pages/ApiKeysPage.tsx
new file mode 100644
index 00000000000..e9eed35c3b9
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/pages/ApiKeysPage.tsx
@@ -0,0 +1,307 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { PlusOutlined, ReloadOutlined } from '@ant-design/icons';
+import { Table, useCurrentRoles } from '@nocobase/client-v2';
+import { useFlowContext, useFlowEngine, useFlowView } from '@nocobase/flow-engine';
+import { useRequest } from 'ahooks';
+import { Alert, App, Button, Card, Flex, Form, Input, Select, Space, Tag, theme, Typography } from 'antd';
+import type { ColumnsType } from 'antd/es/table';
+import dayjs from 'dayjs';
+import React, { useCallback, useMemo, useState } from 'react';
+import { useT } from '../locale';
+import { ExpiresEditor, formatExpiresReadOnly, useExpiresOptions } from './ExpiresField';
+
+type Role = { name: string; title?: string };
+
+/**
+ * Internal form shape: `role` is the selected role's name (string).
+ * On submit we wrap it into `{ name }` so the request body matches v1's payload
+ * (the server reads `values.role.name`).
+ */
+type ApiKeyFormState = {
+  name: string;
+  role?: string;
+  expiresIn: string;
+};
+
+export type ApiKeyFormValues = {
+  name: string;
+  role?: Role;
+  expiresIn: string;
+};
+
+export type ApiKeyRecord = {
+  id: number;
+  name: string;
+  role?: Role;
+  roleName?: string;
+  expiresIn: string;
+  createdAt?: string;
+};
+
+type CreateResponse = { data?: { data?: { token?: string } } };
+
+type ListMeta = {
+  count?: number;
+  pageSize?: number;
+  page?: number;
+};
+
+type ListBody = {
+  data: ApiKeyRecord[];
+  meta?: ListMeta;
+};
+
+export type ApiKeyResource = {
+  create: (params: { values: ApiKeyFormValues }) => Promise<CreateResponse>;
+  destroy: (params: { filterByTk: number | number[] }) => Promise<unknown>;
+};
+
+/**
+ * Pure submit pipeline so tests can pin the resource call shape (create →
+ * extract token → onCreated) and a future refactor cannot silently skip the
+ * POST while still closing the drawer. Mirrors the prevention rule documented
+ * in references/settings-page-crud.md (`No silent fallthrough on submit branches`).
+ */
+export async function submitApiKeyForm(args: {
+  values: ApiKeyFormValues;
+  resource: ApiKeyResource;
+  onCreated: (token: string | undefined) => void;
+}): Promise<void> {
+  const response = await args.resource.create({ values: args.values });
+  args.onCreated(response?.data?.data?.token);
+}
+
+export async function deleteApiKey(args: {
+  resource: ApiKeyResource;
+  filterByTk: number;
+  onDeleted: () => void;
+}): Promise<void> {
+  await args.resource.destroy({ filterByTk: args.filterByTk });
+  args.onDeleted();
+}
+
+const ApiKeysPage: React.FC = () => {
+  const t = useT();
+  const ctx = useFlowContext();
+  const engine = useFlowEngine();
+  const { token } = theme.useToken();
+  const { modal } = App.useApp();
+  const resource = useMemo(() => ctx.api.resource('apiKeys') as ApiKeyResource, [ctx.api]);
+
+  const listRequest = useRequest(async (): Promise<ListBody> => {
+    const response = await ctx.api.request<ListBody>({
+      url: 'apiKeys:list',
+      method: 'get',
+      params: {
+        pageSize: 20,
+        appends: ['role'],
+        sort: ['-createdAt'],
+      },
+      skipNotify: true,
+    });
+    return response?.data ?? { data: [] };
+  });
+
+  const { data: listResp, loading } = listRequest;
+  const records: ApiKeyRecord[] = useMemo(() => {
+    const list = listResp?.data;
+    return Array.isArray(list) ? list : [];
+  }, [listResp]);
+  const pagination = useMemo(() => {
+    const meta = listResp?.meta;
+    if (!meta) return false as const;
+    return {
+      total: meta.count ?? records.length,
+      pageSize: meta.pageSize ?? 20,
+      current: meta.page ?? 1,
+    };
+  }, [listResp, records.length]);
+
+  const handleDelete = useCallback(
+    (record: ApiKeyRecord) => {
+      modal.confirm({
+        title: t('Delete API key'),
+        content: t('Are you sure you want to delete it?'),
+        async onOk() {
+          await deleteApiKey({
+            resource,
+            filterByTk: record.id,
+            onDeleted: () => listRequest.refresh(),
+          });
+        },
+      });
+    },
+    [listRequest, modal, resource, t],
+  );
+
+  const openCreateDialog = useCallback(() => {
+    ctx.viewer.dialog({
+      title: t('Add API key'),
+      width: 520,
+      maskClosable: false,
+      closable: true,
+      content: () => (
+        <CreateApiKeyForm
+          onCreated={(tokenValue) => {
+            listRequest.refresh();
+            modal.success({
+              title: t('API key created successfully'),
+              content: (
+                <Space direction="vertical" style={{ width: '100%' }}>
+                  <Alert
+                    type="warning"
+                    message={t(
+                      'Make sure to copy your personal access key now as you will not be able to see this again.',
+                    )}
+                  />
+                  <Typography.Text copyable>{tokenValue}</Typography.Text>
+                </Space>
+              ),
+            });
+          }}
+        />
+      ),
+    });
+  }, [ctx.viewer, listRequest, modal, t]);
+
+  const neverLabel = t('Never expires');
+
+  const columns = useMemo<ColumnsType<ApiKeyRecord>>(
+    () => [
+      { title: t('Key name'), dataIndex: 'name', ellipsis: true },
+      {
+        title: t('Role'),
+        dataIndex: ['role', 'title'],
+        // Role titles in the `roles` collection are stored as `{{t("Admin")}}` i18n
+        // macros — expand them through flowEngine.context.t before display.
+        // Wrap in <Tag> to match v1's read-pretty rendering of a belongsTo role.
+        render: (_: unknown, record) => {
+          const title = record.role?.title;
+          if (!title) return record.roleName ?? '-';
+          return <Tag>{engine.context.t(title)}</Tag>;
+        },
+      },
+      {
+        title: t('Expiration'),
+        render: (_: unknown, record) =>
+          formatExpiresReadOnly({ expiresIn: record.expiresIn, createdAt: record.createdAt }, neverLabel),
+      },
+      {
+        title: t('Created at'),
+        dataIndex: 'createdAt',
+        render: (value: string | undefined) => (value ? dayjs(value).format('YYYY-MM-DD HH:mm:ss') : '-'),
+      },
+      {
+        title: t('Actions'),
+        width: 160,
+        render: (_: unknown, record) => <a onClick={() => handleDelete(record)}>{t('Delete')}</a>,
+      },
+    ],
+    [engine, handleDelete, neverLabel, t],
+  );
+
+  return (
+    <Card>
+      <Flex justify="flex-end" style={{ marginBottom: token.marginMD }}>
+        <Space>
+          <Button icon={<ReloadOutlined />} onClick={() => listRequest.refresh()}>
+            {t('Refresh')}
+          </Button>
+          <Button type="primary" icon={<PlusOutlined />} onClick={openCreateDialog}>
+            {t('Add API key')}
+          </Button>
+        </Space>
+      </Flex>
+      <Table<ApiKeyRecord>
+        rowKey="id"
+        loading={loading}
+        dataSource={records}
+        columns={columns}
+        pagination={pagination}
+      />
+    </Card>
+  );
+};
+
+function CreateApiKeyForm(props: { onCreated: (token: string | undefined) => void }) {
+  const { onCreated } = props;
+  const t = useT();
+  const ctx = useFlowContext();
+  const view = useFlowView();
+  const expiresOptions = useExpiresOptions();
+  const currentRoles = useCurrentRoles();
+  const [form] = Form.useForm<ApiKeyFormState>();
+  const [submitting, setSubmitting] = useState(false);
+  const resource = useMemo(() => ctx.api.resource('apiKeys') as ApiKeyResource, [ctx.api]);
+
+  const handleSubmit = useCallback(async () => {
+    const state = await form.validateFields();
+    setSubmitting(true);
+    try {
+      await submitApiKeyForm({
+        values: {
+          name: state.name,
+          role: state.role ? { name: state.role } : undefined,
+          expiresIn: state.expiresIn,
+        },
+        resource,
+        onCreated: (tokenValue) => {
+          form.resetFields();
+          onCreated(tokenValue);
+        },
+      });
+      await view.close();
+    } finally {
+      setSubmitting(false);
+    }
+  }, [form, onCreated, resource, view]);
+
+  return (
+    <>
+      <Form form={form} layout="vertical" initialValues={{ expiresIn: '30d' }}>
+        <Form.Item
+          name="name"
+          label={t('Key name')}
+          rules={[{ required: true, message: t('The field value is required') }]}
+        >
+          <Input />
+        </Form.Item>
+        <Form.Item
+          name="role"
+          label={t('Role')}
+          tooltip={t('Allow only your own roles to be selected')}
+          rules={[{ required: true, message: t('The field value is required') }]}
+        >
+          <Select fieldNames={{ label: 'title', value: 'name' }} options={currentRoles} />
+        </Form.Item>
+        <Form.Item
+          name="expiresIn"
+          label={t('Expiration')}
+          rules={[{ required: true, message: t('The field value is required') }]}
+        >
+          <ExpiresEditor options={expiresOptions} />
+        </Form.Item>
+      </Form>
+      {view.Footer ? (
+        <view.Footer>
+          <Space>
+            <Button onClick={async () => view.close()}>{t('Cancel')}</Button>
+            <Button type="primary" loading={submitting} onClick={handleSubmit}>
+              {t('Submit')}
+            </Button>
+          </Space>
+        </view.Footer>
+      ) : null}
+    </>
+  );
+}
+
+export default ApiKeysPage;
diff --git a/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/pages/ExpiresField.tsx b/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/pages/ExpiresField.tsx
new file mode 100644
index 00000000000..677f830522f
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/pages/ExpiresField.tsx
@@ -0,0 +1,91 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { useBoolean } from 'ahooks';
+import { DatePicker, Select, Space } from 'antd';
+import dayjs from 'dayjs';
+import isSameOrBefore from 'dayjs/plugin/isSameOrBefore';
+import React from 'react';
+import { useT } from '../locale';
+
+dayjs.extend(isSameOrBefore);
+
+export type ExpiresOption = { label: string; value: string };
+
+const TOMORROW = () => dayjs().add(1, 'days');
+
+/**
+ * Convert a future `dayjs` date into the `Xd` shape persisted by the apiKeys
+ * collection. Mirrors the v1 ExpiresSelect: zero out seconds/milliseconds on
+ * both ends and report the day difference.
+ */
+export function diffToExpiresIn(target: dayjs.Dayjs, now: dayjs.Dayjs = dayjs()): string {
+  const targetNorm = target.millisecond(0).second(0);
+  const nowNorm = now.millisecond(0).second(0);
+  return `${targetNorm.diff(nowNorm, 'd')}d`;
+}
+
+export function formatExpiresReadOnly(record: { expiresIn?: string; createdAt?: string }, neverLabel: string): string {
+  if (record.expiresIn === 'never') return neverLabel;
+  const days = parseInt(String(record.expiresIn ?? '').replace('d', ''), 10) || 0;
+  if (!record.createdAt) return '';
+  return dayjs(record.createdAt).add(days, 'days').format('YYYY-MM-DD HH:mm:ss');
+}
+
+export function ExpiresEditor(props: { value?: string; onChange?: (next: string) => void; options: ExpiresOption[] }) {
+  const { value, onChange, options } = props;
+  const [isCustom, { toggle: toggleShowDatePicker, setFalse }] = useBoolean(false);
+
+  const onSelectChange = (v: string) => {
+    if (v === 'custom') {
+      onChange?.('1d');
+      toggleShowDatePicker();
+      return;
+    }
+    setFalse();
+    onChange?.(v);
+  };
+
+  const onDatePickerChange = (next: dayjs.Dayjs | null) => {
+    if (!next) return;
+    onChange?.(diffToExpiresIn(next));
+  };
+
+  return (
+    <Space style={{ width: '100%' }} styles={{ item: { flex: 1 } }}>
+      <Select
+        style={{ width: '100%' }}
+        options={options}
+        value={isCustom ? 'custom' : value}
+        onChange={onSelectChange}
+      />
+      {isCustom ? (
+        <DatePicker
+          style={{ width: '100%' }}
+          disabledDate={(date) => date.isSameOrBefore(dayjs())}
+          defaultValue={TOMORROW()}
+          onChange={onDatePickerChange}
+          allowClear={false}
+        />
+      ) : null}
+    </Space>
+  );
+}
+
+export function useExpiresOptions(): ExpiresOption[] {
+  const t = useT();
+  return [
+    { label: t('1 Day'), value: '1d' },
+    { label: t('7 Days'), value: '7d' },
+    { label: t('30 Days'), value: '30d' },
+    { label: t('90 Days'), value: '90d' },
+    { label: t('Custom'), value: 'custom' },
+    { label: t('Never'), value: 'never' },
+  ];
+}
diff --git a/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/plugin.tsx b/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/plugin.tsx
new file mode 100644
index 00000000000..5bed83dfdc0
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-api-keys/src/client-v2/plugin.tsx
@@ -0,0 +1,33 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import type { Application } from '@nocobase/client-v2';
+import { Plugin } from '@nocobase/client-v2';
+
+export class PluginAPIKeysClientV2 extends Plugin<Record<string, never>, Application> {
+  async load() {
+    const title = this.t('API keys') as unknown as string;
+
+    this.pluginSettingsManager.addMenuItem({
+      key: 'api-keys',
+      title,
+      icon: 'KeyOutlined',
+      aclSnippet: 'pm.api-keys.configuration',
+    });
+
+    this.pluginSettingsManager.addPageTabItem({
+      menuKey: 'api-keys',
+      key: 'index',
+      title,
+      componentLoader: () => import('./pages/ApiKeysPage'),
+    });
+  }
+}
+
+export default PluginAPIKeysClientV2;
diff --git a/packages/plugins/@nocobase/plugin-auth-sms/client-v2.d.ts b/packages/plugins/@nocobase/plugin-auth-sms/client-v2.d.ts
new file mode 100644
index 00000000000..f12b5649835
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-auth-sms/client-v2.d.ts
@@ -0,0 +1,2 @@
+export * from './dist/client-v2';
+export { default } from './dist/client-v2';
diff --git a/packages/plugins/@nocobase/plugin-auth-sms/client-v2.js b/packages/plugins/@nocobase/plugin-auth-sms/client-v2.js
new file mode 100644
index 00000000000..59d89708039
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-auth-sms/client-v2.js
@@ -0,0 +1 @@
+module.exports = require('./dist/client-v2/index.js');
diff --git a/packages/plugins/@nocobase/plugin-auth-sms/package.json b/packages/plugins/@nocobase/plugin-auth-sms/package.json
index 29b4b622443..8c19574d699 100644
--- a/packages/plugins/@nocobase/plugin-auth-sms/package.json
+++ b/packages/plugins/@nocobase/plugin-auth-sms/package.json
@@ -22,7 +22,9 @@
     "@nocobase/actions": "2.x",
     "@nocobase/auth": "2.x",
     "@nocobase/client": "2.x",
+    "@nocobase/client-v2": "2.x",
     "@nocobase/database": "2.x",
+    "@nocobase/flow-engine": "2.x",
     "@nocobase/plugin-auth": ">=0.17.0-alpha.7",
     "@nocobase/plugin-verification": "2.x",
     "@nocobase/server": "2.x",
diff --git a/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/__tests__/SmsSignInForm.test.ts b/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/__tests__/SmsSignInForm.test.ts
new file mode 100644
index 00000000000..4a77b96597f
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/__tests__/SmsSignInForm.test.ts
@@ -0,0 +1,57 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import type { Authenticator } from '@nocobase/plugin-auth/client-v2';
+import { describe, expect, it } from 'vitest';
+import { pickSmsPublicOptions } from '../forms/SmsSignInForm';
+
+function makeAuthenticator(options: Record<string, unknown>): Authenticator {
+  return {
+    name: 'sms',
+    authType: 'SMS',
+    authTypeTitle: 'SMS',
+    options,
+  };
+}
+
+describe('SmsSignInForm pickSmsPublicOptions', () => {
+  it('reads verifier directly off authenticator.options (the flattened public shape)', () => {
+    // `/authenticators:publicList` flattens server-side `options.public.*` into
+    // `options.*`. Reading from `options.public.verifier` here yields undefined
+    // and the form silently sends `verifier: ''` to `smsOTP:publicCreate`,
+    // making the login flow fail with the wrong verifier binding. Pin the
+    // source so a future refactor cannot regress to the deeper path.
+    const out = pickSmsPublicOptions(makeAuthenticator({ verifier: 'v_ciq3sc898pu', autoSignup: true }));
+    expect(out).toEqual({ verifier: 'v_ciq3sc898pu', autoSignup: true });
+  });
+
+  it('returns autoSignup=false when the option is missing or falsy', () => {
+    expect(pickSmsPublicOptions(makeAuthenticator({ verifier: 'v_x' })).autoSignup).toBe(false);
+    expect(pickSmsPublicOptions(makeAuthenticator({ verifier: 'v_x', autoSignup: 0 })).autoSignup).toBe(false);
+  });
+
+  it('returns verifier=undefined when the authenticator has no options at all', () => {
+    expect(pickSmsPublicOptions(null)).toEqual({ verifier: undefined, autoSignup: false });
+    expect(pickSmsPublicOptions(undefined)).toEqual({ verifier: undefined, autoSignup: false });
+    expect(pickSmsPublicOptions({ name: 'sms', authType: 'SMS', authTypeTitle: 'SMS' })).toEqual({
+      verifier: undefined,
+      autoSignup: false,
+    });
+  });
+
+  it('does NOT read from authenticator.options.public — that path is server-side storage only', () => {
+    // Explicit anti-regression: even if the deeper shape is provided, we
+    // ignore it. Only the flattened `options.*` from publicList is the API
+    // contract for the sign-in form.
+    const out = pickSmsPublicOptions(
+      makeAuthenticator({ public: { verifier: 'v_should_be_ignored', autoSignup: true } }),
+    );
+    expect(out).toEqual({ verifier: undefined, autoSignup: false });
+  });
+});
diff --git a/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/forms/SmsAdminSettings.tsx b/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/forms/SmsAdminSettings.tsx
new file mode 100644
index 00000000000..258a7529aff
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/forms/SmsAdminSettings.tsx
@@ -0,0 +1,44 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { VerifierSelect } from '@nocobase/plugin-verification/client-v2';
+import { Checkbox, Form } from 'antd';
+import React from 'react';
+import { useAuthSMSTranslation } from '../locale';
+
+/**
+ * Admin-side configuration for an SMS authenticator. Rendered inside the
+ * Authenticators page drawer below the common fields (`name`, `authType`,
+ * `title`, `description`, `enabled`). Persists to
+ * `options.public.verifier` / `options.public.autoSignup`, matching the
+ * server-side reads in `sms-auth.ts` (`this.options.public?.verifier` /
+ * `this.authenticator.options?.public?.autoSignup`).
+ */
+export default function SmsAdminSettings() {
+  const { t } = useAuthSMSTranslation();
+
+  return (
+    <>
+      <Form.Item
+        name={['options', 'public', 'verifier']}
+        label={t('Verifier')}
+        rules={[{ required: true, message: t('Please select a verifier') }]}
+      >
+        <VerifierSelect scene="auth-sms" />
+      </Form.Item>
+      <Form.Item
+        name={['options', 'public', 'autoSignup']}
+        label={t('Sign up automatically when the user does not exist')}
+        valuePropName="checked"
+      >
+        <Checkbox />
+      </Form.Item>
+    </>
+  );
+}
diff --git a/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/forms/SmsSignInForm.tsx b/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/forms/SmsSignInForm.tsx
new file mode 100644
index 00000000000..9c2a470d90e
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/forms/SmsSignInForm.tsx
@@ -0,0 +1,96 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { type Authenticator, useSignIn } from '@nocobase/plugin-auth/client-v2';
+import { VerificationCode } from '@nocobase/plugin-verification/client-v2';
+import { Alert, Button, Form, Input, Typography } from 'antd';
+import React, { useState } from 'react';
+import { useAuthSMSTranslation } from '../locale';
+
+export type SmsPublicOptions = {
+  verifier?: string;
+  autoSignup: boolean;
+};
+
+/**
+ * Extract sign-in–facing options from an authenticator returned by
+ * `/authenticators:publicList`. That endpoint already flattens server-side
+ * `options.public.*` into `options.*` (see plugin-auth server
+ * actions/authenticators.ts `publicList`), so reading
+ * `authenticator.options.public.verifier` always yields `undefined` and silently
+ * sends `verifier: ''` to `smsOTP:publicCreate`. Centralising the unpacking
+ * here lets tests pin the contract.
+ */
+export function pickSmsPublicOptions(authenticator: Authenticator | null | undefined): SmsPublicOptions {
+  return {
+    verifier: authenticator?.options?.verifier,
+    autoSignup: !!authenticator?.options?.autoSignup,
+  };
+}
+
+/**
+ * SMS sign-in form rendered on the v2 `/signin` page when the user picks
+ * an SMS authenticator tab. Two fields — phone number + OTP code — paired
+ * with `<VerificationCode>` from `@nocobase/plugin-verification/client-v2`,
+ * which owns the "send code / countdown" button and talks to the
+ * `smsOTP:publicCreate` endpoint.
+ *
+ * Submission goes through `useSignIn` from `plugin-auth/client-v2`, the
+ * same hook the password sign-in form uses — `auth:signIn` plus the
+ * standard post-login redirect.
+ */
+export default function SmsSignInForm({ authenticator }: { authenticator: Authenticator }) {
+  const { t } = useAuthSMSTranslation();
+  const [form] = Form.useForm();
+  const [errorMessage, setErrorMessage] = useState('');
+  const [loading, setLoading] = useState(false);
+  const signIn = useSignIn(authenticator.name);
+
+  const { autoSignup, verifier } = pickSmsPublicOptions(authenticator);
+  const phone = Form.useWatch('uuid', form);
+
+  return (
+    <Form
+      form={form}
+      layout="vertical"
+      onFinish={async (values) => {
+        setErrorMessage('');
+        setLoading(true);
+        try {
+          await signIn.run(values);
+        } catch (error: any) {
+          setErrorMessage(error?.response?.data?.errors?.[0]?.message || error?.message || String(error));
+        } finally {
+          setLoading(false);
+        }
+      }}
+    >
+      {errorMessage ? <Alert style={{ marginBottom: 16 }} type="error" showIcon message={errorMessage} /> : null}
+      <Form.Item name="uuid" rules={[{ required: true, message: t('Please enter a phone number') }]}>
+        <Input autoComplete="tel" placeholder={t('Phone')} />
+      </Form.Item>
+      <Form.Item name="code" rules={[{ required: true, message: t('Please enter the verification code') }]}>
+        <VerificationCode
+          actionType="auth:signIn"
+          verifier={verifier ?? ''}
+          phone={phone}
+          placeholder={t('Verification code')}
+        />
+      </Form.Item>
+      <Form.Item style={{ marginBottom: 12 }}>
+        <Button loading={loading} htmlType="submit" type="primary" block>
+          {t('Sign in')}
+        </Button>
+      </Form.Item>
+      {autoSignup ? (
+        <Typography.Text type="secondary">{t('User will be registered automatically if not exists.')}</Typography.Text>
+      ) : null}
+    </Form>
+  );
+}
diff --git a/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/index.tsx b/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/index.tsx
new file mode 100644
index 00000000000..62bb00c6934
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/index.tsx
@@ -0,0 +1,10 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+export { default, PluginAuthSMSClientV2 } from './plugin';
diff --git a/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/locale.ts b/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/locale.ts
new file mode 100644
index 00000000000..57ddd6f7b71
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/locale.ts
@@ -0,0 +1,27 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { useFlowEngine } from '@nocobase/flow-engine';
+import { useTranslation } from 'react-i18next';
+
+export const NAMESPACE = 'auth-sms';
+
+export function useAuthSMSTranslation() {
+  return useTranslation([NAMESPACE, 'client'], { nsMode: 'fallback' });
+}
+
+/**
+ * v2-style translator. Routes through `flowEngine.context.t`, which natively
+ * expands legacy `{{t("…")}}` Schema templates and falls back to the `client`
+ * namespace if a key is not defined in `auth-sms`.
+ */
+export function useT() {
+  const engine = useFlowEngine();
+  return (key: string) => engine.context.t(key, { ns: [NAMESPACE, 'client'], nsMode: 'fallback' });
+}
diff --git a/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/plugin.tsx b/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/plugin.tsx
new file mode 100644
index 00000000000..db10f24cc98
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-auth-sms/src/client-v2/plugin.tsx
@@ -0,0 +1,24 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Plugin } from '@nocobase/client-v2';
+import PluginAuthClientV2 from '@nocobase/plugin-auth/client-v2';
+import { authType } from '../constants';
+
+export class PluginAuthSMSClientV2 extends Plugin {
+  async load() {
+    const auth = this.app.pm.get(PluginAuthClientV2);
+    auth.registerType(authType, {
+      signInFormLoader: () => import('./forms/SmsSignInForm'),
+      adminSettingsFormLoader: () => import('./forms/SmsAdminSettings'),
+    });
+  }
+}
+
+export default PluginAuthSMSClientV2;
diff --git a/packages/plugins/@nocobase/plugin-auth/src/client-v2/__tests__/hooks.test.tsx b/packages/plugins/@nocobase/plugin-auth/src/client-v2/__tests__/hooks.test.tsx
index e770badc330..bfa4b81dc4d 100644
--- a/packages/plugins/@nocobase/plugin-auth/src/client-v2/__tests__/hooks.test.tsx
+++ b/packages/plugins/@nocobase/plugin-auth/src/client-v2/__tests__/hooks.test.tsx
@@ -10,9 +10,14 @@
 import { renderHook } from '@testing-library/react';
 import React from 'react';
 import { MemoryRouter } from 'react-router-dom';
-import { useRedirect } from '../hooks';
+import { useRedirect, useSignIn } from '../hooks';
 
 const navigateMock = vi.fn();
+const mockState = vi.hoisted(() => ({
+  basename: undefined as string | undefined,
+  signIn: vi.fn().mockResolvedValue(undefined) as ReturnType<typeof vi.fn>,
+  request: vi.fn().mockResolvedValue({ data: {} }) as ReturnType<typeof vi.fn>,
+}));
 
 vi.mock('react-router-dom', async () => {
   const actual = await vi.importActual<typeof import('react-router-dom')>('react-router-dom');
@@ -22,19 +27,20 @@ vi.mock('react-router-dom', async () => {
   };
 });
 
-describe('plugin-auth client-v2 useRedirect', () => {
-  const originalLocation = globalThis.window.location;
+vi.mock('@nocobase/client-v2', () => ({
+  useApp: () => ({
+    router: { getBasename: () => mockState.basename },
+    apiClient: {
+      auth: { signIn: (...args: unknown[]) => mockState.signIn(...args) },
+      request: (...args: unknown[]) => mockState.request(...args),
+    },
+  }),
+}));
 
+describe('plugin-auth client-v2 useRedirect', () => {
   beforeEach(() => {
     navigateMock.mockReset();
-  });
-
-  afterEach(() => {
-    Object.defineProperty(globalThis.window, 'location', {
-      configurable: true,
-      value: originalLocation,
-    });
-    vi.restoreAllMocks();
+    mockState.basename = undefined;
   });
 
   function wrap(initialEntries: string[]) {
@@ -44,34 +50,102 @@ describe('plugin-auth client-v2 useRedirect', () => {
   }
 
   it('should navigate to default next when no redirect param is present', () => {
-    const replace = vi.fn();
-    Object.defineProperty(globalThis.window, 'location', {
-      configurable: true,
-      value: { ...originalLocation, replace },
-    });
-
+    mockState.basename = '/nocobase/v2';
     const { result } = renderHook(() => useRedirect('/admin'), {
       wrapper: wrap(['/signin']),
     });
     result.current();
 
     expect(navigateMock).toHaveBeenCalledWith('/admin', { replace: true });
-    expect(replace).not.toHaveBeenCalled();
   });
 
-  it('should hard-redirect with window.location.replace when redirect param is set', () => {
-    const replace = vi.fn();
-    Object.defineProperty(globalThis.window, 'location', {
-      configurable: true,
-      value: { ...originalLocation, replace },
-    });
-
+  it('should strip v2 basename from redirect param and navigate relative', () => {
+    // Aligns with v1: an in-app redirect target uses react-router navigate (virtual),
+    // not window.location.replace. The basename prefix carried on the redirect query
+    // (so the server can echo a root-relative path) is stripped before handing off
+    // to react-router, which will prepend it again on its own.
+    mockState.basename = '/nocobase/v2';
     const { result } = renderHook(() => useRedirect('/admin'), {
       wrapper: wrap(['/signin?redirect=%2Fnocobase%2Fv2%2Fadmin%2Fxyz']),
     });
     result.current();
 
-    expect(replace).toHaveBeenCalledWith('/nocobase/v2/admin/xyz');
-    expect(navigateMock).not.toHaveBeenCalled();
+    expect(navigateMock).toHaveBeenCalledWith('/admin/xyz', { replace: true });
+  });
+
+  it('should pass redirect param through as-is when not prefixed with basename', () => {
+    // Server's 2FA middleware returns a bare path like `/admin` in its redirect
+    // template; react-router navigate prepends the basename automatically.
+    mockState.basename = '/nocobase/v2';
+    const { result } = renderHook(() => useRedirect('/fallback'), {
+      wrapper: wrap(['/signin?redirect=%2Fadmin']),
+    });
+    result.current();
+
+    expect(navigateMock).toHaveBeenCalledWith('/admin', { replace: true });
+  });
+
+  it('should treat exact basename match as root', () => {
+    mockState.basename = '/nocobase/v2';
+    const { result } = renderHook(() => useRedirect('/fallback'), {
+      wrapper: wrap(['/signin?redirect=%2Fnocobase%2Fv2']),
+    });
+    result.current();
+
+    expect(navigateMock).toHaveBeenCalledWith('/', { replace: true });
+  });
+
+  it('should accept relative target when basename is unset', () => {
+    mockState.basename = undefined;
+    const { result } = renderHook(() => useRedirect('/admin'), {
+      wrapper: wrap(['/signin']),
+    });
+    result.current();
+
+    expect(navigateMock).toHaveBeenCalledWith('/admin', { replace: true });
+  });
+});
+
+describe('plugin-auth client-v2 useSignIn', () => {
+  beforeEach(() => {
+    mockState.basename = '/nocobase/v2';
+    mockState.signIn = vi.fn().mockResolvedValue(undefined);
+    mockState.request = vi.fn().mockResolvedValue({ data: {} });
+    navigateMock.mockReset();
+  });
+
+  it('should call signIn then yield to a /auth:check request before redirecting', async () => {
+    // Mirrors v1's `await refreshAsync()` after sign-in: the actual user data isn't
+    // consumed, but awaiting a real network round-trip gives the browser time to
+    // commit any queued `window.location.href` from response interceptors (e.g. the
+    // 2FA plugin's `code:302` handler). Without it, the synchronous `redirect()`
+    // virtual navigate would let the wrong page flash before the full reload.
+    const { result } = renderHook(() => useSignIn('basic'), {
+      wrapper: ({ children }) => <MemoryRouter initialEntries={['/signin']}>{children}</MemoryRouter>,
+    });
+
+    await result.current.run({ account: 'admin', password: 'admin' });
+
+    expect(mockState.signIn).toHaveBeenCalledWith({ account: 'admin', password: 'admin' }, 'basic');
+    expect(mockState.request).toHaveBeenCalledWith(
+      expect.objectContaining({ url: '/auth:check', skipAuth: true, skipNotify: true }),
+    );
+    // Order matters: signIn → request → redirect/navigate.
+    expect(mockState.signIn.mock.invocationCallOrder[0]).toBeLessThan(mockState.request.mock.invocationCallOrder[0]);
+    expect(mockState.request.mock.invocationCallOrder[0]).toBeLessThan(navigateMock.mock.invocationCallOrder[0]);
+  });
+
+  it('should swallow /auth:check rejection so redirect still runs', async () => {
+    // /auth:check may legitimately reject (e.g. server returns 401 mid-2FA flow).
+    // The redirect must still proceed — the catch keeps the chain alive.
+    mockState.request = vi.fn().mockRejectedValue(new Error('boom'));
+
+    const { result } = renderHook(() => useSignIn('basic'), {
+      wrapper: ({ children }) => <MemoryRouter initialEntries={['/signin']}>{children}</MemoryRouter>,
+    });
+
+    await expect(result.current.run({ account: 'admin', password: 'admin' })).resolves.toBeUndefined();
+    expect(mockState.request).toHaveBeenCalled();
+    expect(navigateMock).toHaveBeenCalled();
   });
 });
diff --git a/packages/plugins/@nocobase/plugin-auth/src/client-v2/__tests__/plugin.test.tsx b/packages/plugins/@nocobase/plugin-auth/src/client-v2/__tests__/plugin.test.tsx
index 8bc0b2a9e49..af19d7dd113 100644
--- a/packages/plugins/@nocobase/plugin-auth/src/client-v2/__tests__/plugin.test.tsx
+++ b/packages/plugins/@nocobase/plugin-auth/src/client-v2/__tests__/plugin.test.tsx
@@ -21,18 +21,12 @@ describe('plugin-auth client-v2', () => {
     vi.restoreAllMocks();
   });
 
-  it('should redirect runtime 401 to v2 signin with replace', async () => {
-    const replace = vi.fn();
-    Object.defineProperty(globalThis.window, 'location', {
-      configurable: true,
-      value: {
-        ...originalLocation,
-        pathname: '/v2/admin/7vu4c2sdk6h',
-        search: '?tab=overview',
-        hash: '#panel',
-        replace,
-      },
-    });
+  it('should navigate to v2 signin on runtime 401 with EXPIRED_SESSION', async () => {
+    // Aligns with v1: use react-router (data router) `navigate` rather than
+    // `window.location.replace`, so a `window.location.href` queued by a sibling
+    // response interceptor (e.g. plugin-two-factor-authentication's `code:302`
+    // handler) can win the race instead of being clobbered.
+    const navigateSpy = vi.fn();
 
     const app = createMockClient({
       publicPath: '/v2/',
@@ -42,6 +36,7 @@ describe('plugin-auth client-v2', () => {
     await app.load();
     app.router.router = {
       basename: '/v2',
+      navigate: navigateSpy,
       state: {
         location: {
           pathname: '/v2/admin/7vu4c2sdk6h',
@@ -65,23 +60,48 @@ describe('plugin-auth client-v2', () => {
     app.apiClient.axios.interceptors.response.handlers[0].rejected(error);
 
     await vi.waitFor(() => {
-      expect(replace).toHaveBeenCalledWith('/v2/signin?redirect=%2Fv2%2Fadmin%2F7vu4c2sdk6h%3Ftab%3Doverview%23panel');
+      expect(navigateSpy).toHaveBeenCalledWith(
+        '/signin?redirect=%2Fv2%2Fadmin%2F7vu4c2sdk6h%3Ftab%3Doverview%23panel',
+        {
+          replace: true,
+        },
+      );
+    });
+  });
+
+  it('should clear auth token on runtime 401 with EXPIRED_SESSION', async () => {
+    // The redirect uses navigate (no full-page reload), so the auth token must be
+    // wiped explicitly — otherwise downstream requests on the in-memory page would
+    // re-send the now-invalid token before the signin page mounts.
+    const navigateSpy = vi.fn();
+    const app = createMockClient({
+      publicPath: '/v2/',
+      plugins: [PluginAuthClientV2 as any],
+      router: { type: 'memory', initialEntries: ['/v2/admin/anywhere'] },
+    });
+    await app.load();
+    app.apiClient.auth.setToken('stale-token');
+    app.router.router = {
+      basename: '/v2',
+      navigate: navigateSpy,
+      state: { location: { pathname: '/v2/admin/anywhere', search: '', hash: '' } },
+    } as any;
+
+    const error = {
+      response: { status: 401, data: { errors: [{ code: 'EXPIRED_SESSION' }] } },
+      config: {},
+    } as any;
+
+    // @ts-ignore
+    app.apiClient.axios.interceptors.response.handlers[0].rejected(error);
+
+    await vi.waitFor(() => {
+      expect(app.apiClient.auth.token).toBe('');
     });
   });
 
   it('should not redirect skipped auth routes on runtime 401', async () => {
-    const replace = vi.fn();
-    Object.defineProperty(globalThis.window, 'location', {
-      configurable: true,
-      value: {
-        ...originalLocation,
-        pathname: '/v2/signin',
-        search: '',
-        hash: '',
-        replace,
-      },
-    });
-
+    const navigateSpy = vi.fn();
     const app = createMockClient({
       publicPath: '/v2/',
       plugins: [PluginAuthClientV2 as any],
@@ -90,6 +110,7 @@ describe('plugin-auth client-v2', () => {
     await app.load();
     app.router.router = {
       basename: '/v2',
+      navigate: navigateSpy,
       state: {
         location: {
           pathname: '/v2/signin',
@@ -116,6 +137,6 @@ describe('plugin-auth client-v2', () => {
     } catch (thrownError) {
       expect(thrownError).toBe(error);
     }
-    expect(replace).not.toHaveBeenCalled();
+    expect(navigateSpy).not.toHaveBeenCalled();
   });
 });
diff --git a/packages/plugins/@nocobase/plugin-auth/src/client-v2/components/PoweredByLite.tsx b/packages/plugins/@nocobase/plugin-auth/src/client-v2/components/PoweredByLite.tsx
deleted file mode 100644
index 7524af1151a..00000000000
--- a/packages/plugins/@nocobase/plugin-auth/src/client-v2/components/PoweredByLite.tsx
+++ /dev/null
@@ -1,45 +0,0 @@
-/**
- * This file is part of the NocoBase (R) project.
- * Copyright (c) 2020-2024 NocoBase Co., Ltd.
- * Authors: NocoBase Team.
- *
- * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
- * For more information, please refer to: https://www.nocobase.com/agreement.
- */
-
-import { getAppVersionHTML, useCurrentAppInfo, usePlugin } from '@nocobase/client-v2';
-import { parseHTML } from '@nocobase/utils/client';
-import React from 'react';
-import { theme as antdTheme } from 'antd';
-import { useTranslation } from 'react-i18next';
-
-export default function PoweredByLite() {
-  const { token } = antdTheme.useToken();
-  const { i18n } = useTranslation();
-  const customBrandPlugin: any = usePlugin('@nocobase/plugin-custom-brand');
-  const appInfo = useCurrentAppInfo();
-  const homePage = i18n.language === 'zh-CN' ? 'https://www.nocobase.com/cn/' : 'https://www.nocobase.com';
-  const customBrand = customBrandPlugin?.options?.options?.brand;
-
-  if (customBrand) {
-    const appVersion = getAppVersionHTML(appInfo?.version);
-
-    return (
-      <div
-        className="nb-brand"
-        dangerouslySetInnerHTML={{
-          __html: parseHTML(customBrand, { appVersion }),
-        }}
-      />
-    );
-  }
-
-  return (
-    <div style={{ color: token.colorTextDescription }}>
-      Powered by{' '}
-      <a href={homePage} target="_blank" rel="noreferrer" style={{ color: token.colorTextDescription }}>
-        NocoBase
-      </a>
-    </div>
-  );
-}
diff --git a/packages/plugins/@nocobase/plugin-auth/src/client-v2/hooks.ts b/packages/plugins/@nocobase/plugin-auth/src/client-v2/hooks.ts
index fb7df876b7f..e861c48a4a1 100644
--- a/packages/plugins/@nocobase/plugin-auth/src/client-v2/hooks.ts
+++ b/packages/plugins/@nocobase/plugin-auth/src/client-v2/hooks.ts
@@ -11,19 +11,38 @@ import { useCallback, useEffect } from 'react';
 import { useNavigate, useSearchParams } from 'react-router-dom';
 import { useApp } from '@nocobase/client-v2';
 
+/**
+ * 把 `?redirect=` 上带 v2 basename 的目标(例如 `/nocobase/v2/admin`)规约成 react-router
+ * 接受的、相对 basename 的路径(`/admin`)。如果 target 已经是相对路径(不带 basename,
+ * 例如服务端 2FA 中间件返回的 `/admin`),原样返回——react-router `navigate` 会自动加上
+ * basename。
+ */
+function stripV2Basename(target: string, basename?: string): string {
+  if (!basename || basename === '/') {
+    return target.startsWith('/') ? target : `/${target}`;
+  }
+  const normalized = basename.endsWith('/') ? basename.slice(0, -1) : basename;
+  if (target === normalized) {
+    return '/';
+  }
+  if (target.startsWith(`${normalized}/`)) {
+    return target.slice(normalized.length) || '/';
+  }
+  // target 不在 v2 basename 下,当作相对路径,交给 react-router 自动 prepend basename。
+  return target;
+}
+
 export function useRedirect(next = '/admin') {
+  const app = useApp();
   const navigate = useNavigate();
   const [searchParams] = useSearchParams();
 
   return useCallback(() => {
     const redirect = searchParams.get('redirect');
-    if (redirect) {
-      // redirect 是根相对完整路径,与 v2 router basename 直接相加会重复前缀,因此整页跳转
-      window.location.replace(redirect);
-      return;
-    }
-    navigate(next, { replace: true });
-  }, [navigate, next, searchParams]);
+    const target = redirect || next;
+    const basename = app.router.getBasename?.();
+    navigate(stripV2Basename(target, basename), { replace: true });
+  }, [app.router, navigate, next, searchParams]);
 }
 
 export function useDocumentTitle(title: string) {
@@ -39,6 +58,18 @@ export function useSignIn(authenticator: string) {
   return {
     async run(values: Record<string, any>) {
       await app.apiClient.auth.signIn(values, authenticator);
+      // v1 在 signIn 之后会 `await refreshAsync()` 触发 `/auth:check`。表面上是刷新用户信息,
+      // 实际更关键的副作用:借这次网络往返让出 JS 任务,给浏览器机会提交其它响应拦截器(例如
+      // plugin-two-factor-authentication 收到 `code:302` 时)排队的 `window.location.href`
+      // 整页跳转。如果不等,下面 `redirect()` 会同步 react-router `navigate`,虽然不会覆盖
+      // `location.href`,但会让目标页(例如 /admin)闪现一下才被整页跳转替换。复用同款手法。
+      await app.apiClient
+        .request({
+          url: '/auth:check',
+          skipAuth: true,
+          skipNotify: true,
+        })
+        .catch(() => undefined);
       redirect();
     },
   };
diff --git a/packages/plugins/@nocobase/plugin-auth/src/client-v2/pages/AuthLayout.tsx b/packages/plugins/@nocobase/plugin-auth/src/client-v2/pages/AuthLayout.tsx
index 1f43aa6f2dd..a0ceb4a9f70 100644
--- a/packages/plugins/@nocobase/plugin-auth/src/client-v2/pages/AuthLayout.tsx
+++ b/packages/plugins/@nocobase/plugin-auth/src/client-v2/pages/AuthLayout.tsx
@@ -11,10 +11,8 @@ import { theme as antdTheme } from 'antd';
 import React from 'react';
 import { Outlet } from 'react-router-dom';
 import { useTranslation } from 'react-i18next';
-import { useSystemSettings } from '@nocobase/client-v2';
+import { PoweredBy, SwitchLanguage, useSystemSettings } from '@nocobase/client-v2';
 import AuthenticatorsContextProvider from '../providers/AuthenticatorsContextProvider';
-import SwitchLanguage from '../components/SwitchLanguage';
-import PoweredByLite from '../components/PoweredByLite';
 
 export default function AuthLayout() {
   const { token } = antdTheme.useToken();
@@ -48,7 +46,7 @@ export default function AuthLayout() {
           backgroundColor: token.colorBgContainer,
         }}
       >
-        <PoweredByLite />
+        <PoweredBy />
       </div>
     </div>
   );
diff --git a/packages/plugins/@nocobase/plugin-auth/src/client-v2/pages/AuthenticatorsPage.tsx b/packages/plugins/@nocobase/plugin-auth/src/client-v2/pages/AuthenticatorsPage.tsx
index c35460e2d65..86776f30d80 100644
--- a/packages/plugins/@nocobase/plugin-auth/src/client-v2/pages/AuthenticatorsPage.tsx
+++ b/packages/plugins/@nocobase/plugin-auth/src/client-v2/pages/AuthenticatorsPage.tsx
@@ -9,7 +9,7 @@
 
 import { CheckOutlined, DeleteOutlined, DownOutlined, PlusOutlined } from '@ant-design/icons';
 import { DEFAULT_PAGE_SIZE, DrawerFormLayout, Table } from '@nocobase/client-v2';
-import { useFlowContext } from '@nocobase/flow-engine';
+import { randomId, useFlowContext } from '@nocobase/flow-engine';
 import { useMemoizedFn, useRequest } from 'ahooks';
 import { App, Button, Card, Checkbox, Dropdown, Form, Input, Select, Space, Spin, Tag, theme } from 'antd';
 import type { ColumnsType } from 'antd/es/table';
@@ -31,10 +31,6 @@ type AuthenticatorRecord = {
 
 type AuthTypeOption = { name: string; title?: string };
 
-function createAuthenticatorName() {
-  return `s_${Math.random().toString(36).slice(2, 12)}`;
-}
-
 function recursiveTrim(value: any): any {
   if (typeof value === 'string') return value.trim();
   if (Array.isArray(value)) return value.map(recursiveTrim);
@@ -67,7 +63,7 @@ function AuthenticatorFormView(props: {
   mode: 'create' | 'edit';
   authType: string;
   authTypeOptions: AuthTypeOption[];
-  adminSettingsFormLoader?: AuthOptions['adminSettingsFormLoader'];
+  plugin: PluginAuthClientV2;
   record?: AuthenticatorRecord;
   onSubmitted: () => void;
 }) {
@@ -88,7 +84,7 @@ function AuthenticatorFormView(props: {
   const initialValues = useMemo(() => {
     if (props.mode === 'edit') return cloneDeep(props.record || {});
     return {
-      name: createAuthenticatorName(),
+      name: randomId('s_'),
       authType: props.authType,
       enabled: false,
       options: {},
@@ -99,11 +95,31 @@ function AuthenticatorFormView(props: {
     form.setFieldsValue(initialValues);
   }, [form, initialValues]);
 
-  const AdminSettingsBody = useMemo(
-    () => (props.adminSettingsFormLoader ? lazy(props.adminSettingsFormLoader) : null),
-    [props.adminSettingsFormLoader],
+  // Watch the form's authType so the admin-settings body swaps in sync with
+  // the Select. Falls back to props.authType for the first render before
+  // the form has settled (avoids a flash of "no settings body").
+  const watchedAuthType = Form.useWatch('authType', form);
+  const currentAuthType = watchedAuthType ?? props.authType;
+
+  const currentAdminSettingsFormLoader = useMemo<AuthOptions['adminSettingsFormLoader']>(
+    () => props.plugin.authTypes.get(currentAuthType)?.adminSettingsFormLoader,
+    [props.plugin, currentAuthType],
   );
 
+  const AdminSettingsBody = useMemo(
+    () => (currentAdminSettingsFormLoader ? lazy(currentAdminSettingsFormLoader) : null),
+    [currentAdminSettingsFormLoader],
+  );
+
+  // Switching auth type discards the previous type's `options` payload —
+  // each auth type owns its own option shape (e.g. SMS needs `verifier`,
+  // OIDC needs `clientId/clientSecret`) and leaking unrelated keys into
+  // the new submission would either fail server validation or persist
+  // ghost config. v1 had the same reset behavior via Formily's onTypeChange.
+  const handleAuthTypeChange = useMemoizedFn(() => {
+    form.setFieldValue('options', {});
+  });
+
   const handleSubmit = useMemoizedFn(async () => {
     const raw = await form.validateFields();
     const trimmedOptions = recursiveTrim(raw.options || {});
@@ -155,7 +171,7 @@ function AuthenticatorFormView(props: {
           <Input disabled={props.mode === 'edit'} />
         </Form.Item>
         <Form.Item name="authType" label={t('Auth Type')} rules={[{ required: true }]}>
-          <Select options={compiledTypeOptions} disabled />
+          <Select options={compiledTypeOptions} onChange={handleAuthTypeChange} />
         </Form.Item>
         <Form.Item name="title" label={t('Title')}>
           <Input />
@@ -233,15 +249,15 @@ export default function AuthenticatorsPage() {
   const authTypeOptions = useMemo<AuthTypeOption[]>(() => authTypes || [], [authTypes]);
 
   const openForm = useMemoizedFn((mode: 'create' | 'edit', authType: string, record?: AuthenticatorRecord) => {
-    const adminSettingsFormLoader = plugin.authTypes.get(authType)?.adminSettingsFormLoader;
     ctx.viewer.drawer({
       width: '50%',
+      closable: true,
       content: () => (
         <AuthenticatorFormView
           mode={mode}
           authType={authType}
           authTypeOptions={authTypeOptions}
-          adminSettingsFormLoader={adminSettingsFormLoader}
+          plugin={plugin}
           record={record}
           onSubmitted={() => refresh()}
         />
diff --git a/packages/plugins/@nocobase/plugin-auth/src/client-v2/plugin.tsx b/packages/plugins/@nocobase/plugin-auth/src/client-v2/plugin.tsx
index ce124a4c0dd..2c67136b30d 100644
--- a/packages/plugins/@nocobase/plugin-auth/src/client-v2/plugin.tsx
+++ b/packages/plugins/@nocobase/plugin-auth/src/client-v2/plugin.tsx
@@ -9,13 +9,7 @@
 
 import { Registry } from '@nocobase/utils/client';
 import type { ComponentType } from 'react';
-import {
-  getCurrentV2RedirectPath,
-  Plugin,
-  redirectToV2Signin,
-  UserCenterSelectItemModel,
-  languageCodes,
-} from '@nocobase/client-v2';
+import { getCurrentV2RedirectPath, Plugin, UserCenterSelectItemModel, languageCodes } from '@nocobase/client-v2';
 import debounce from 'lodash/debounce';
 import { presetAuthType } from '../preset';
 import type { Authenticator as AuthenticatorType } from './authenticator';
@@ -221,7 +215,9 @@ export class PluginAuthClientV2 extends Plugin {
           const redirectPath = getCurrentV2RedirectPath(this.app, locationLike);
           debouncedRedirect(() => {
             this.app.apiClient.auth.setToken('');
-            redirectToV2Signin(this.app, redirectPath, { replace: true });
+            // 用 react-router navigate (虚拟跳转)而不是 location.replace, 避免覆盖同时段其它
+            // 响应拦截器触发的 window.location.href 整页跳转 (例如 2FA 接收到服务端 302 时)。
+            this.app.router.navigate(`/signin?redirect=${encodeURIComponent(redirectPath)}`, { replace: true });
           });
           return new Promise<never>(() => undefined);
         }
diff --git a/packages/plugins/@nocobase/plugin-file-manager/src/client-v2/pages/FileStoragePage.tsx b/packages/plugins/@nocobase/plugin-file-manager/src/client-v2/pages/FileStoragePage.tsx
index 621f6a53d08..02f6db6174e 100644
--- a/packages/plugins/@nocobase/plugin-file-manager/src/client-v2/pages/FileStoragePage.tsx
+++ b/packages/plugins/@nocobase/plugin-file-manager/src/client-v2/pages/FileStoragePage.tsx
@@ -10,7 +10,7 @@
 import { CheckOutlined, DeleteOutlined, DownOutlined, PlusOutlined } from '@ant-design/icons';
 import { css } from '@emotion/css';
 import { DEFAULT_PAGE_SIZE, DrawerFormLayout, Table } from '@nocobase/client-v2';
-import { useFlowContext } from '@nocobase/flow-engine';
+import { randomId, useFlowContext } from '@nocobase/flow-engine';
 import { useMemoizedFn, useRequest } from 'ahooks';
 import { App, Button, Card, Dropdown, Form, Input, Space, Spin, theme } from 'antd';
 import type { ColumnsType } from 'antd/es/table';
@@ -47,10 +47,6 @@ function useStorageFormClassName() {
   );
 }
 
-function createStorageName() {
-  return `s_${Math.random().toString(36).slice(2, 12)}`;
-}
-
 function getInitialValues(options: { mode: 'create' | 'edit'; storageType: StorageType; record?: StorageRecord }) {
   if (options.mode === 'edit') {
     return cloneDeep(options.record || {});
@@ -58,7 +54,7 @@ function getInitialValues(options: { mode: 'create' | 'edit'; storageType: Stora
   return {
     ...cloneDeep(options.storageType.defaultValues || {}),
     type: options.storageType.name,
-    name: createStorageName(),
+    name: randomId('s_'),
   };
 }
 
@@ -179,6 +175,7 @@ export default function FileStoragePage() {
     (mode: 'create' | 'edit', storageType: StorageType, record?: StorageRecord) => {
       ctx.viewer.drawer({
         width: '50%',
+        closable: true,
         content: () => (
           <StorageFormView mode={mode} storageType={storageType} record={record} onSubmitted={() => refresh()} />
         ),
diff --git a/packages/plugins/@nocobase/plugin-users/src/client-v2/plugin.tsx b/packages/plugins/@nocobase/plugin-users/src/client-v2/plugin.tsx
index ea1ea243afc..7a3629ea73f 100644
--- a/packages/plugins/@nocobase/plugin-users/src/client-v2/plugin.tsx
+++ b/packages/plugins/@nocobase/plugin-users/src/client-v2/plugin.tsx
@@ -16,6 +16,7 @@ import {
   UserCenterTextItemModel,
 } from '@nocobase/client-v2';
 import { usersLocaleResources } from './locale';
+import { ChangePasswordItemModel } from './user-center/ChangePasswordItemModel';
 
 class CurrentUserSummaryItemModel extends UserCenterTextItemModel {
   static itemId = 'current-user-summary';
@@ -61,6 +62,7 @@ export class PluginUsersClientV2 extends Plugin {
     });
 
     this.app.flowEngine.registerModels({
+      ChangePasswordItemModel,
       CurrentUserSummaryItemModel,
       SignOutItemModel,
     });
diff --git a/packages/plugins/@nocobase/plugin-users/src/client-v2/user-center/ChangePasswordItemModel.tsx b/packages/plugins/@nocobase/plugin-users/src/client-v2/user-center/ChangePasswordItemModel.tsx
new file mode 100644
index 00000000000..ca3e4ea8a34
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-users/src/client-v2/user-center/ChangePasswordItemModel.tsx
@@ -0,0 +1,134 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { DrawerFormLayout, PasswordInput, UserCenterActionItemModel } from '@nocobase/client-v2';
+import { useFlowContext } from '@nocobase/flow-engine';
+import { useMemoizedFn } from 'ahooks';
+import { Alert, Form } from 'antd';
+import React, { useState } from 'react';
+import { useNavigate } from 'react-router-dom';
+import { useUsersTranslation } from '../locale';
+
+/**
+ * Drawer body for "Change password". Three antd `Form.Item`s, with
+ * `confirmPassword` cross-validating against `newPassword`. On success,
+ * the drawer closes and the user is redirected to `/signin` so they
+ * sign back in with the new credentials.
+ *
+ * Server-side validation (`auth:changePassword`) catches the heavier
+ * checks — mismatch / wrong old password / disabled by system setting —
+ * and the error message is surfaced inline via an antd `<Alert>`.
+ */
+function ChangePasswordDrawerContent() {
+  const { t } = useUsersTranslation();
+  const ctx = useFlowContext();
+  const navigate = useNavigate();
+  const [form] = Form.useForm();
+  const [submitting, setSubmitting] = useState(false);
+  const [errorMessage, setErrorMessage] = useState('');
+
+  const handleSubmit = useMemoizedFn(async () => {
+    const values = await form.validateFields();
+    setErrorMessage('');
+    setSubmitting(true);
+    try {
+      await ctx.api.resource('auth').changePassword({ values });
+      form.resetFields();
+      navigate('/signin');
+    } catch (error: any) {
+      const message = error?.response?.data?.errors?.[0]?.message || error?.message || String(error);
+      setErrorMessage(message);
+      throw error;
+    } finally {
+      setSubmitting(false);
+    }
+  });
+
+  return (
+    <DrawerFormLayout
+      title={t('Change password')}
+      onSubmit={handleSubmit}
+      submitting={submitting}
+      submitText={t('Submit')}
+      cancelText={t('Cancel')}
+    >
+      <Form form={form} layout="vertical">
+        {errorMessage ? <Alert type="error" showIcon message={errorMessage} style={{ marginBottom: 16 }} /> : null}
+        <Form.Item
+          name="oldPassword"
+          label={t('Old password')}
+          rules={[{ required: true, message: t('Please enter the old password') }]}
+        >
+          <PasswordInput autoComplete="current-password" />
+        </Form.Item>
+        <Form.Item
+          name="newPassword"
+          label={t('New password')}
+          rules={[{ required: true, message: t('Please enter the new password') }]}
+        >
+          <PasswordInput autoComplete="new-password" checkStrength />
+        </Form.Item>
+        <Form.Item
+          name="confirmPassword"
+          label={t('Confirm password')}
+          dependencies={['newPassword']}
+          rules={[
+            { required: true, message: t('Please confirm the new password') },
+            // antd's validator with closure access to other field values —
+            // mirrors v1's `x-reactions` based cross-field comparison.
+            ({ getFieldValue }) => ({
+              validator(_, value) {
+                if (!value || getFieldValue('newPassword') === value) {
+                  return Promise.resolve();
+                }
+                return Promise.reject(new Error(t('Password mismatch')));
+              },
+            }),
+          ]}
+        >
+          <PasswordInput autoComplete="new-password" checkStrength />
+        </Form.Item>
+      </Form>
+    </DrawerFormLayout>
+  );
+}
+
+/**
+ * "Change password" entry in the User Center dropdown. Section `profile`
+ * with sort 100 puts it between `CurrentUserSummaryItemModel` (sort 0)
+ * and `SignOutItemModel` (sort 1000) — same neighborhood as v1.
+ *
+ * `prepare()` reads `systemSettings.enableChangePassword`; when the
+ * admin has explicitly disabled it, `ready = false` removes the entry
+ * from the dropdown. Undefined / true both leave the entry visible
+ * (matches v1: only an explicit `=== false` hides it).
+ */
+export class ChangePasswordItemModel extends UserCenterActionItemModel {
+  static itemId = 'change-password';
+
+  section = 'profile' as const;
+  sort = 100;
+  label = 'Change password';
+
+  async prepare() {
+    const systemSettings = await this.context.systemSettings.load();
+    const enableChangePassword = systemSettings?.data?.enableChangePassword;
+    this.ready = enableChangePassword !== false;
+  }
+
+  async onClick() {
+    this.context.viewer.drawer({
+      width: '50%',
+      closable: true,
+      content: () => <ChangePasswordDrawerContent />,
+    });
+  }
+}
+
+export default ChangePasswordItemModel;
diff --git a/packages/plugins/@nocobase/plugin-verification/client-v2.d.ts b/packages/plugins/@nocobase/plugin-verification/client-v2.d.ts
new file mode 100644
index 00000000000..f12b5649835
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/client-v2.d.ts
@@ -0,0 +1,2 @@
+export * from './dist/client-v2';
+export { default } from './dist/client-v2';
diff --git a/packages/plugins/@nocobase/plugin-verification/client-v2.js b/packages/plugins/@nocobase/plugin-verification/client-v2.js
new file mode 100644
index 00000000000..59d89708039
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/client-v2.js
@@ -0,0 +1 @@
+module.exports = require('./dist/client-v2/index.js');
diff --git a/packages/plugins/@nocobase/plugin-verification/package.json b/packages/plugins/@nocobase/plugin-verification/package.json
index 3822abf5e31..5dbaeb9c25b 100644
--- a/packages/plugins/@nocobase/plugin-verification/package.json
+++ b/packages/plugins/@nocobase/plugin-verification/package.json
@@ -28,7 +28,9 @@
   "peerDependencies": {
     "@nocobase/actions": "2.x",
     "@nocobase/client": "2.x",
+    "@nocobase/client-v2": "2.x",
     "@nocobase/database": "2.x",
+    "@nocobase/flow-engine": "2.x",
     "@nocobase/resourcer": "2.x",
     "@nocobase/server": "2.x",
     "@nocobase/test": "2.x",
diff --git a/packages/plugins/@nocobase/plugin-verification/src/client-v2/__tests__/VerifiersPage.test.ts b/packages/plugins/@nocobase/plugin-verification/src/client-v2/__tests__/VerifiersPage.test.ts
new file mode 100644
index 00000000000..0f5fd6f4a32
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/src/client-v2/__tests__/VerifiersPage.test.ts
@@ -0,0 +1,188 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { describe, expect, it, vi } from 'vitest';
+import {
+  recursiveTrim,
+  submitVerifierForm,
+  type VerifierFormValues,
+  type VerifierResource,
+} from '../pages/VerifiersPage';
+
+function makeResource(overrides: Partial<VerifierResource> = {}): VerifierResource {
+  return {
+    create: vi.fn().mockResolvedValue(undefined),
+    update: vi.fn().mockResolvedValue(undefined),
+    ...overrides,
+  };
+}
+
+function readUpdateArgs(resource: VerifierResource): { filterByTk: string; values: VerifierFormValues } {
+  const updateMock = resource.update as ReturnType<typeof vi.fn>;
+  return updateMock.mock.calls[0]?.[0] as { filterByTk: string; values: VerifierFormValues };
+}
+
+describe('plugin-verification VerifiersPage submit pipeline', () => {
+  it('should fire resource.create with trimmed options in create mode', async () => {
+    const resource = makeResource();
+    const onSubmitted = vi.fn();
+
+    await submitVerifierForm({
+      raw: {
+        name: 'v_new',
+        title: 'New verifier',
+        verificationType: 'sms-otp',
+        options: { provider: 'sms-aliyun', settings: { sign: '  foo  ', endpoint: 'x' } },
+      },
+      mode: 'create',
+      resource,
+      onSubmitted,
+    });
+
+    expect(resource.create).toHaveBeenCalledTimes(1);
+    expect(resource.create).toHaveBeenCalledWith({
+      values: {
+        name: 'v_new',
+        title: 'New verifier',
+        verificationType: 'sms-otp',
+        // Whitespace around literal credentials is stripped to match v1; env-var
+        // references (e.g. `{{ $env.X }}`) survive untouched because they are
+        // matched verbatim by `recursiveTrim`.
+        options: { provider: 'sms-aliyun', settings: { sign: 'foo', endpoint: 'x' } },
+      },
+    });
+    expect(resource.update).not.toHaveBeenCalled();
+    expect(onSubmitted).toHaveBeenCalledTimes(1);
+  });
+
+  it('should fire resource.update with record.name as filterByTk in edit mode', async () => {
+    // Pin the filterByTk value so a regression to `record.id` (which is
+    // undefined for `verifiers` because the collection is `autoGenId: false`
+    // with `name` as PK) would fail loud here instead of silently no-op'ing.
+    const resource = makeResource();
+    const onSubmitted = vi.fn();
+
+    await submitVerifierForm({
+      raw: {
+        name: 'v_abc',
+        title: 'Edited',
+        verificationType: 'sms-otp',
+        options: {
+          provider: 'sms-aliyun',
+          settings: { sign: 'NewSign', endpoint: 'dysmsapi.aliyuncs.com' },
+        },
+      },
+      mode: 'edit',
+      record: {
+        name: 'v_abc',
+        title: 'Old',
+        verificationType: 'sms-otp',
+        // `extraInternalKey` lives at the top of `options` and is not part of
+        // any admin-settings form's declared paths — must survive the round
+        // trip via the shallow merge on `options`.
+        options: {
+          provider: 'sms-aliyun',
+          settings: { sign: 'OldSign', endpoint: 'old' },
+          extraInternalKey: 'keep-me',
+        },
+      },
+      resource,
+      onSubmitted,
+    });
+
+    expect(resource.update).toHaveBeenCalledTimes(1);
+    const updateArgs = readUpdateArgs(resource);
+    expect(updateArgs.filterByTk).toBe('v_abc');
+    const updatedOptions = updateArgs.values.options as Record<string, unknown>;
+    const updatedSettings = updatedOptions.settings as Record<string, unknown>;
+    // Top-level options keys not owned by the form are preserved.
+    expect(updatedOptions.extraInternalKey).toBe('keep-me');
+    // Fields the form owns are overwritten.
+    expect(updatedSettings.sign).toBe('NewSign');
+    expect(updatedSettings.endpoint).toBe('dysmsapi.aliyuncs.com');
+    expect(resource.create).not.toHaveBeenCalled();
+    expect(onSubmitted).toHaveBeenCalledTimes(1);
+  });
+
+  it('should throw rather than silently skip when edit mode has no record.name', async () => {
+    // Guards against the silent-fallthrough class of bug. Previously the
+    // submit handler had `else if (record?.id != null)` and would just
+    // `return` past the API call when record had no `id`, calling
+    // `onSubmitted()` anyway — the page LOOKED successful while no update
+    // request had fired.
+    const resource = makeResource();
+    const onSubmitted = vi.fn();
+
+    await expect(
+      submitVerifierForm({
+        raw: { title: 'Edited' },
+        mode: 'edit',
+        record: { title: 'Old' }, // no `name` field at all
+        resource,
+        onSubmitted,
+      }),
+    ).rejects.toThrow(/Edit mode requires record\.name/);
+
+    expect(resource.create).not.toHaveBeenCalled();
+    expect(resource.update).not.toHaveBeenCalled();
+    expect(onSubmitted).not.toHaveBeenCalled();
+  });
+
+  it('should not invoke onSubmitted when resource.create rejects', async () => {
+    // Failure path: a failed API call must bubble up so the drawer stays open
+    // and the user can retry, instead of closing on a falsely-successful state.
+    const resource = makeResource({ create: vi.fn().mockRejectedValue(new Error('boom')) });
+    const onSubmitted = vi.fn();
+
+    await expect(
+      submitVerifierForm({
+        raw: { name: 'v', verificationType: 'sms-otp', options: {} },
+        mode: 'create',
+        resource,
+        onSubmitted,
+      }),
+    ).rejects.toThrow(/boom/);
+    expect(onSubmitted).not.toHaveBeenCalled();
+  });
+
+  it('should not invoke onSubmitted when resource.update rejects', async () => {
+    const resource = makeResource({ update: vi.fn().mockRejectedValue(new Error('nope')) });
+    const onSubmitted = vi.fn();
+
+    await expect(
+      submitVerifierForm({
+        raw: { title: 'Edited' },
+        mode: 'edit',
+        record: { name: 'v_abc' },
+        resource,
+        onSubmitted,
+      }),
+    ).rejects.toThrow(/nope/);
+    expect(onSubmitted).not.toHaveBeenCalled();
+  });
+});
+
+describe('plugin-verification recursiveTrim', () => {
+  it('trims string leaves', () => {
+    expect(recursiveTrim('  hello  ')).toBe('hello');
+  });
+
+  it('walks objects and arrays', () => {
+    expect(recursiveTrim({ a: '  x ', b: ['  y ', { c: '  z  ' }] })).toEqual({
+      a: 'x',
+      b: ['y', { c: 'z' }],
+    });
+  });
+
+  it('leaves non-string primitives intact', () => {
+    expect(recursiveTrim(42)).toBe(42);
+    expect(recursiveTrim(true)).toBe(true);
+    expect(recursiveTrim(null)).toBe(null);
+  });
+});
diff --git a/packages/plugins/@nocobase/plugin-verification/src/client-v2/components/VerificationCode.tsx b/packages/plugins/@nocobase/plugin-verification/src/client-v2/components/VerificationCode.tsx
new file mode 100644
index 00000000000..3bb31a2ce68
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/src/client-v2/components/VerificationCode.tsx
@@ -0,0 +1,130 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { useFlowContext } from '@nocobase/flow-engine';
+import { useMemoizedFn } from 'ahooks';
+import { App, Button, Input, Space } from 'antd';
+import React, { useEffect, useRef, useState } from 'react';
+import { useVerificationTranslation } from '../locale';
+
+export interface VerificationCodeProps {
+  /** Persisted OTP value. Controlled by the parent `Form.Item`. */
+  value?: string;
+  onChange?: (next: string) => void;
+  /**
+   * Server-side action the OTP grants (e.g. `auth:signIn`,
+   * `verifiers:bind`, `twoFactorAuth:verify`). Forwarded to the
+   * `smsOTP:*` endpoint so the OTP is bound to a specific action.
+   */
+  actionType: string;
+  /** Verifier name (a row in the `verifiers` collection). */
+  verifier: string;
+  /**
+   * The phone number the OTP is sent to. Parent reads it via
+   * `Form.useWatch('uuid', form)` and forwards it here. Required at send
+   * time — the send button is disabled until it has a value.
+   */
+  phone?: string;
+  /**
+   * Whether the user is already signed in. Drives the choice between
+   * `smsOTP:create` (logged-in) and `smsOTP:publicCreate` (anonymous).
+   * Defaults to `false` (anonymous).
+   */
+  isLogged?: boolean;
+  disabled?: boolean;
+  placeholder?: string;
+}
+
+/**
+ * Verification-code input + "Send code / Retry in N s" button pair.
+ *
+ * Rewrite of v1's `VerificationCode`:
+ * - No `withDynamicSchemaProps`, no `useForm()` — the parent owns the
+ *   phone value via `Form.useWatch` and passes it in as a prop.
+ * - Countdown starts from the server-reported `expiresAt` so the UI
+ *   tracks the same window the server enforces.
+ * - Clearing the code on resend matches v1 behaviour so the user has
+ *   to type the new code rather than reusing the stale one.
+ */
+export function VerificationCode(props: VerificationCodeProps) {
+  const { value, onChange, actionType, verifier, phone, isLogged, disabled, placeholder } = props;
+  const { t } = useVerificationTranslation();
+  const ctx = useFlowContext();
+  const { message, notification } = App.useApp();
+
+  const [count, setCount] = useState(0);
+  const timerRef = useRef<ReturnType<typeof setInterval> | null>(null);
+
+  useEffect(() => {
+    if (count <= 0 && timerRef.current) {
+      clearInterval(timerRef.current);
+      timerRef.current = null;
+    }
+  }, [count]);
+
+  useEffect(() => {
+    return () => {
+      if (timerRef.current) {
+        clearInterval(timerRef.current);
+        timerRef.current = null;
+      }
+    };
+  }, []);
+
+  const onGetCode = useMemoizedFn(async () => {
+    if (count > 0) return;
+    if (!phone) {
+      message.error(t('Please enter a phone number first'));
+      return;
+    }
+    const method = isLogged ? 'create' : 'publicCreate';
+    try {
+      const response = await ctx.api.resource('smsOTP')[method]({
+        values: {
+          action: actionType,
+          verifier,
+          uuid: phone,
+        },
+      });
+      const data = response?.data?.data || {};
+      message.success(t('Operation succeeded'));
+      if (value) onChange?.('');
+      const expiresIn = data.expiresAt ? Math.max(1, Math.ceil((Date.parse(data.expiresAt) - Date.now()) / 1000)) : 60;
+      setCount(expiresIn);
+      timerRef.current = setInterval(() => {
+        setCount((c) => c - 1);
+      }, 1000);
+    } catch (error: any) {
+      // v1 surfaces SMS send failures through a top-right notification —
+      // the underlying provider (Aliyun / Tencent) commonly fails with a
+      // misconfigured sign / template / endpoint, and a silent console
+      // swallow leaves the user clicking "Send code" with no feedback.
+      const serverMessage = error?.response?.data?.errors?.[0]?.message || error?.message;
+      notification.error({
+        message: serverMessage || t('Verification send failed, please try later or contact to administrator'),
+      });
+    }
+  });
+
+  return (
+    <Space.Compact style={{ width: '100%' }}>
+      <Input
+        value={value}
+        onChange={(event) => onChange?.(event.target.value)}
+        disabled={disabled}
+        placeholder={placeholder}
+      />
+      <Button onClick={onGetCode} disabled={disabled || count > 0}>
+        {count > 0 ? t('Retry after {{count}} seconds', { count }) : t('Send code')}
+      </Button>
+    </Space.Compact>
+  );
+}
+
+export default VerificationCode;
diff --git a/packages/plugins/@nocobase/plugin-verification/src/client-v2/components/VerifierSelect.tsx b/packages/plugins/@nocobase/plugin-verification/src/client-v2/components/VerifierSelect.tsx
new file mode 100644
index 00000000000..ec6beede363
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/src/client-v2/components/VerifierSelect.tsx
@@ -0,0 +1,102 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { RemoteSelect } from '@nocobase/client-v2';
+import { useFlowContext } from '@nocobase/flow-engine';
+import { Typography } from 'antd';
+import React, { useMemo, useState } from 'react';
+import { Link } from 'react-router-dom';
+import { useT, useVerificationTranslation } from '../locale';
+
+export interface VerifierSelectProps {
+  /**
+   * Verification scene name passed to `verifiers:listByScene`. Each
+   * consumer plugin uses its own scene (e.g. `auth-sms`, `two-factor`,
+   * `unbind-verifier`) so different scenes can opt different verifier
+   * types in or out via server config.
+   */
+  scene: string;
+  value?: string | string[];
+  onChange?: (next: string | string[]) => void;
+  /** Default false. */
+  multiple?: boolean;
+  placeholder?: string;
+  disabled?: boolean;
+  /**
+   * antd `Select` style passthrough. Keep this open in case a caller
+   * needs to size the dropdown explicitly inside a constrained form.
+   */
+  style?: React.CSSProperties;
+  /**
+   * Suppress the helper text rendered under the Select. Defaults to
+   * `false`; pass `true` when the caller wants to host its own hint
+   * (e.g. inside a `Form.Item.extra` slot).
+   */
+  hideHint?: boolean;
+}
+
+type VerifierItem = { name: string; title: string };
+type VerifiersListResponse = {
+  verifiers?: VerifierItem[];
+  availableTypes?: Array<{ name: string; title?: string }>;
+};
+
+/**
+ * Domain wrapper around the framework-level `RemoteSelect`. Loads the
+ * verifiers configured for `scene` from `/verifiers:listByScene` and
+ * binds them to a single- or multi-select. The helper text underneath
+ * mirrors the v1 affordance: a list of available verifier types and a
+ * deep link into the admin settings page. The list of available types
+ * comes from the same response, so no extra request is needed.
+ */
+export function VerifierSelect(props: VerifierSelectProps) {
+  const { scene, value, onChange, multiple, placeholder, disabled, style, hideHint } = props;
+  const { t } = useVerificationTranslation();
+  const compileT = useT();
+  const ctx = useFlowContext();
+
+  const cacheKey = useMemo(() => `@nocobase/plugin-verification:verifiers:listByScene:${scene}`, [scene]);
+
+  const [availableTypeNames, setAvailableTypeNames] = useState<string[]>([]);
+
+  return (
+    <>
+      <RemoteSelect<VerifierItem, VerifiersListResponse, string | string[]>
+        request={async () => {
+          const response = await ctx.api.resource('verifiers').listByScene({ scene });
+          return (response?.data?.data ?? {}) as VerifiersListResponse;
+        }}
+        selectItems={(resp) => resp?.verifiers || []}
+        onLoaded={(_, resp) => {
+          setAvailableTypeNames((resp?.availableTypes || []).map((item) => compileT(item.title || item.name)));
+        }}
+        cacheKey={cacheKey}
+        refreshDeps={[scene]}
+        // Server titles can arrive as legacy `{{t("…")}}` Schema templates;
+        // useT() compiles them via flowEngine.context.t.
+        mapOptions={(item) => ({ label: compileT(item.title || item.name), value: item.name })}
+        mode={multiple ? 'multiple' : undefined}
+        value={value as any}
+        onChange={onChange as any}
+        placeholder={placeholder}
+        disabled={disabled}
+        style={style}
+      />
+      {hideHint ? null : (
+        <Typography.Text type="secondary">
+          {t('The following types of verifiers are available:')} {availableTypeNames.join(', ')}
+          {'. '}
+          {t('Go to')} <Link to="/admin/settings/verification">{t('create verifiers')}</Link>
+        </Typography.Text>
+      )}
+    </>
+  );
+}
+
+export default VerifierSelect;
diff --git a/packages/plugins/@nocobase/plugin-verification/src/client-v2/index.ts b/packages/plugins/@nocobase/plugin-verification/src/client-v2/index.ts
new file mode 100644
index 00000000000..edc527ef824
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/src/client-v2/index.ts
@@ -0,0 +1,20 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+export { PROVIDER_TYPE_SMS_ALIYUN, PROVIDER_TYPE_SMS_TENCENT, SMS_OTP_VERIFICATION_TYPE } from '../constants';
+export { default, PluginVerificationClientV2 } from './plugin';
+export { NAMESPACE, useT, useVerificationTranslation } from './locale';
+export { VerificationManager } from './verification-manager';
+export type { BindFormProps, VerificationFormProps, VerificationTypeOptions } from './verification-manager';
+export { SMSOTPProviderManager } from './otp-sms-provider-manager';
+export type { SMSOTPProviderOptions } from './otp-sms-provider-manager';
+export { VerifierSelect } from './components/VerifierSelect';
+export type { VerifierSelectProps } from './components/VerifierSelect';
+export { VerificationCode } from './components/VerificationCode';
+export type { VerificationCodeProps } from './components/VerificationCode';
diff --git a/packages/plugins/@nocobase/plugin-verification/src/client-v2/locale.ts b/packages/plugins/@nocobase/plugin-verification/src/client-v2/locale.ts
new file mode 100644
index 00000000000..0dccd3bfc3f
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/src/client-v2/locale.ts
@@ -0,0 +1,35 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { useFlowEngine } from '@nocobase/flow-engine';
+import { useTranslation } from 'react-i18next';
+import enUS from '../locale/en-US.json';
+import zhCN from '../locale/zh-CN.json';
+
+export const NAMESPACE = 'verification';
+
+export const verificationLocaleResources = {
+  'en-US': enUS,
+  'zh-CN': zhCN,
+};
+
+export function useVerificationTranslation() {
+  return useTranslation([NAMESPACE, 'client'], { nsMode: 'fallback' });
+}
+
+/**
+ * v2-style translator. Routes through `flowEngine.context.t`, which natively
+ * expands legacy Formily Schema templates (e.g. `{{t("Phone")}}`) — useful
+ * when the value comes from a server payload that still contains the
+ * `{{t("…")}}` wrapper.
+ */
+export function useT() {
+  const engine = useFlowEngine();
+  return (key: string) => engine.context.t(key, { ns: [NAMESPACE, 'client'], nsMode: 'fallback' });
+}
diff --git a/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-sms-provider-manager.ts b/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-sms-provider-manager.ts
new file mode 100644
index 00000000000..0cb20e5f747
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-sms-provider-manager.ts
@@ -0,0 +1,43 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Registry } from '@nocobase/utils/client';
+import type { ComponentType } from 'react';
+
+type LoaderOf<P = Record<string, never>> = () => Promise<{ default: ComponentType<P> }>;
+
+export type SMSOTPProviderOptions = {
+  components: {
+    /**
+     * Loader for the provider-specific admin-settings form. Stored as an
+     * async `() => import(...)` so third-party SMS providers contributed
+     * via `registerProvider()` come in as their own webpack chunk,
+     * fetched only when the corresponding provider is picked in the
+     * verifier configuration drawer.
+     */
+    AdminSettingsFormLoader: LoaderOf;
+  };
+};
+
+/**
+ * Registry of SMS OTP providers (Aliyun, Tencent, …). Each entry only
+ * needs to contribute its admin settings form — the runtime side is
+ * handled server-side.
+ */
+export class SMSOTPProviderManager {
+  providers = new Registry<SMSOTPProviderOptions>();
+
+  registerProvider(type: string, options: SMSOTPProviderOptions) {
+    this.providers.register(type, options);
+  }
+
+  getProvider(type: string) {
+    return this.providers.get(type);
+  }
+}
diff --git a/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/AdminSettingsForm.tsx b/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/AdminSettingsForm.tsx
new file mode 100644
index 00000000000..e0f119413e9
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/AdminSettingsForm.tsx
@@ -0,0 +1,73 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { RemoteSelect, useApp } from '@nocobase/client-v2';
+import { useFlowContext } from '@nocobase/flow-engine';
+import { Form } from 'antd';
+import React, { lazy, Suspense, useMemo } from 'react';
+import { useT, useVerificationTranslation } from '../../locale';
+import PluginVerificationClientV2 from '../../plugin';
+
+/**
+ * Admin settings form for an SMS-OTP verifier:
+ * 1. `options.provider` selects which configured SMS provider (Aliyun /
+ *    Tencent / …) sends the OTP. The list is the server resource
+ *    `smsOTPProviders:list`.
+ * 2. `options.settings.*` is the provider-specific configuration form,
+ *    looked up from the plugin's `smsOTPProviderManager` at runtime so
+ *    third-party providers contributed via `registerProvider()` slot in
+ *    automatically.
+ */
+export function AdminSettingsForm() {
+  const { t } = useVerificationTranslation();
+  const compileT = useT();
+  const ctx = useFlowContext();
+  const app = useApp();
+  // Avoid a hard import of the plugin class to keep the SMS module
+  // tree-shake friendly; resolve it at runtime via the plugin registry.
+  const plugin = app.pm.get(PluginVerificationClientV2);
+  const form = Form.useFormInstance();
+  const providerType: string | undefined = Form.useWatch(['options', 'provider'], form);
+
+  const ProviderSettings = useMemo(() => {
+    if (!providerType) return null;
+    const loader = plugin?.smsOTPProviderManager.getProvider(providerType)?.components?.AdminSettingsFormLoader;
+    return loader ? lazy(loader) : null;
+  }, [plugin, providerType]);
+
+  return (
+    <>
+      <Form.Item
+        name={['options', 'provider']}
+        label={t('Provider')}
+        rules={[{ required: true, message: t('Please select a provider') }]}
+      >
+        <RemoteSelect<{ name: string; title: string }>
+          request={async () => {
+            const response = await ctx.api.resource('smsOTPProviders').list();
+            const data = response?.data?.data;
+            return Array.isArray(data) ? data : [];
+          }}
+          cacheKey="@nocobase/plugin-verification:smsOTPProviders:list"
+          // Server titles are stored as legacy schema templates
+          // (e.g. `{{t("Aliyun SMS", {"ns":"…"})}}`); useT() routes through
+          // flowEngine.context.t which expands those templates natively.
+          mapOptions={(item) => ({ label: compileT(item.title || item.name), value: item.name })}
+        />
+      </Form.Item>
+      {ProviderSettings ? (
+        <Suspense fallback={null}>
+          <ProviderSettings />
+        </Suspense>
+      ) : null}
+    </>
+  );
+}
+
+export default AdminSettingsForm;
diff --git a/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/BindForm.tsx b/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/BindForm.tsx
new file mode 100644
index 00000000000..b05f0ba99cb
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/BindForm.tsx
@@ -0,0 +1,44 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Form, Input } from 'antd';
+import React from 'react';
+import { VerificationCode } from '../../components/VerificationCode';
+import { useVerificationTranslation } from '../../locale';
+import type { BindFormProps } from '../../verification-manager';
+
+/**
+ * SMS-OTP bind form. Same shape as `VerificationForm` minus the bound
+ * publicInfo path — when binding, the user is always typing in a new
+ * phone number. Hosted inside the parent `<Form>` so `uuid` / `code`
+ * land on the parent's `form.values`.
+ */
+export function BindForm(props: BindFormProps) {
+  const { verifier, actionType, isLogged } = props;
+  const { t } = useVerificationTranslation();
+  const form = Form.useFormInstance();
+  const phone = Form.useWatch('uuid', form);
+
+  return (
+    <>
+      <Form.Item name="uuid" label={t('Phone')} rules={[{ required: true, message: t('Please enter a phone number') }]}>
+        <Input />
+      </Form.Item>
+      <Form.Item
+        name="code"
+        label={t('Verification code')}
+        rules={[{ required: true, message: t('Please enter the verification code') }]}
+      >
+        <VerificationCode actionType={actionType} verifier={verifier} phone={phone} isLogged={isLogged} />
+      </Form.Item>
+    </>
+  );
+}
+
+export default BindForm;
diff --git a/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/VerificationForm.tsx b/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/VerificationForm.tsx
new file mode 100644
index 00000000000..d19677716ba
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/VerificationForm.tsx
@@ -0,0 +1,50 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Form, Input } from 'antd';
+import React from 'react';
+import { VerificationCode } from '../../components/VerificationCode';
+import { useVerificationTranslation } from '../../locale';
+import type { VerificationFormProps } from '../../verification-manager';
+
+/**
+ * SMS-OTP verify form: phone number (read-only when bound) + verification
+ * code field paired with a "send code" button. Hosted inside a parent
+ * `<Form>` — antd Form.Item paths land on `uuid` (phone) and `code`,
+ * matching the v1 schema so server-side handlers are unchanged.
+ */
+export function VerificationForm(props: VerificationFormProps) {
+  const { verifier, actionType, boundInfo, isLogged } = props;
+  const { t } = useVerificationTranslation();
+  const form = Form.useFormInstance();
+  const phone = Form.useWatch('uuid', form);
+  const isPhoneBound = !!boundInfo?.publicInfo;
+
+  return (
+    <>
+      <Form.Item
+        name="uuid"
+        label={t('Phone')}
+        rules={[{ required: true, message: t('Please enter a phone number') }]}
+        initialValue={boundInfo?.publicInfo}
+      >
+        <Input disabled={isPhoneBound} />
+      </Form.Item>
+      <Form.Item
+        name="code"
+        label={t('Verification code')}
+        rules={[{ required: true, message: t('Please enter the verification code') }]}
+      >
+        <VerificationCode actionType={actionType} verifier={verifier} phone={phone} isLogged={isLogged} />
+      </Form.Item>
+    </>
+  );
+}
+
+export default VerificationForm;
diff --git a/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/index.ts b/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/index.ts
new file mode 100644
index 00000000000..44e45de71f9
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/index.ts
@@ -0,0 +1,28 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+export const smsOTPVerificationOptions = {
+  components: {
+    VerificationFormLoader: () => import('./VerificationForm'),
+    AdminSettingsFormLoader: () => import('./AdminSettingsForm'),
+    BindFormLoader: () => import('./BindForm'),
+  },
+};
+
+export const smsAliyunProviderOptions = {
+  components: {
+    AdminSettingsFormLoader: () => import('./providers/AliyunSettings'),
+  },
+};
+
+export const smsTencentProviderOptions = {
+  components: {
+    AdminSettingsFormLoader: () => import('./providers/TencentSettings'),
+  },
+};
diff --git a/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/providers/AliyunSettings.tsx b/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/providers/AliyunSettings.tsx
new file mode 100644
index 00000000000..74db538b2f8
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/providers/AliyunSettings.tsx
@@ -0,0 +1,65 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { EnvVariableInput } from '@nocobase/client-v2';
+import { Form } from 'antd';
+import React from 'react';
+import { useVerificationTranslation } from '../../../locale';
+
+/**
+ * Aliyun SMS provider settings. Field names match the v1 schema 1:1, so
+ * the persisted shape on the server is unchanged. Each value can be a
+ * literal credential or an `{{ $env.X }}` reference; secret fields use
+ * `EnvVariableInput`'s `password` mode to mask non-variable values.
+ */
+export function AliyunSettings() {
+  const { t } = useVerificationTranslation();
+
+  return (
+    <>
+      <Form.Item
+        name={['options', 'settings', 'accessKeyId']}
+        label={t('Access Key ID')}
+        rules={[{ required: true, message: t('Please enter the Access Key ID') }]}
+      >
+        <EnvVariableInput />
+      </Form.Item>
+      <Form.Item
+        name={['options', 'settings', 'accessKeySecret']}
+        label={t('Access Key Secret')}
+        rules={[{ required: true, message: t('Please enter the Access Key Secret') }]}
+      >
+        <EnvVariableInput password />
+      </Form.Item>
+      <Form.Item
+        name={['options', 'settings', 'endpoint']}
+        label={t('Endpoint')}
+        rules={[{ required: true, message: t('Please enter the endpoint') }]}
+      >
+        <EnvVariableInput />
+      </Form.Item>
+      <Form.Item
+        name={['options', 'settings', 'sign']}
+        label={t('Sign')}
+        rules={[{ required: true, message: t('Please enter the sign') }]}
+      >
+        <EnvVariableInput />
+      </Form.Item>
+      <Form.Item
+        name={['options', 'settings', 'template']}
+        label={t('Template code')}
+        rules={[{ required: true, message: t('Please enter the template code') }]}
+      >
+        <EnvVariableInput />
+      </Form.Item>
+    </>
+  );
+}
+
+export default AliyunSettings;
diff --git a/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/providers/TencentSettings.tsx b/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/providers/TencentSettings.tsx
new file mode 100644
index 00000000000..878d866badc
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/src/client-v2/otp-verification/sms/providers/TencentSettings.tsx
@@ -0,0 +1,75 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { EnvVariableInput } from '@nocobase/client-v2';
+import { Form } from 'antd';
+import React from 'react';
+import { useVerificationTranslation } from '../../../locale';
+
+/**
+ * Tencent SMS provider settings. Mirror of v1 schema; persisted payload
+ * keys are unchanged. Secret credentials use `EnvVariableInput`'s
+ * `password` mode so literal values are masked but `{{ $env.X }}`
+ * references stay editable through the picker.
+ */
+export function TencentSettings() {
+  const { t } = useVerificationTranslation();
+
+  return (
+    <>
+      <Form.Item
+        name={['options', 'settings', 'secretId']}
+        label={t('Secret Id')}
+        rules={[{ required: true, message: t('Please enter the Secret Id') }]}
+      >
+        <EnvVariableInput />
+      </Form.Item>
+      <Form.Item
+        name={['options', 'settings', 'secretKey']}
+        label={t('Secret Key')}
+        rules={[{ required: true, message: t('Please enter the Secret Key') }]}
+      >
+        <EnvVariableInput password />
+      </Form.Item>
+      <Form.Item
+        name={['options', 'settings', 'region']}
+        label={t('Region')}
+        rules={[{ required: true, message: t('Please enter the region') }]}
+      >
+        <EnvVariableInput />
+      </Form.Item>
+      <Form.Item
+        name={['options', 'settings', 'endpoint']}
+        label={t('Endpoint')}
+        initialValue="sms.tencentcloudapi.com"
+      >
+        <EnvVariableInput />
+      </Form.Item>
+      <Form.Item name={['options', 'settings', 'SignName']} label={t('Sign name')}>
+        <EnvVariableInput />
+      </Form.Item>
+      <Form.Item
+        name={['options', 'settings', 'SmsSdkAppId']}
+        label={t('Sms sdk app id')}
+        rules={[{ required: true, message: t('Please enter the Sms sdk app id') }]}
+      >
+        <EnvVariableInput />
+      </Form.Item>
+      <Form.Item
+        name={['options', 'settings', 'TemplateId']}
+        label={t('Template Id')}
+        rules={[{ required: true, message: t('Please enter the Template Id') }]}
+      >
+        <EnvVariableInput />
+      </Form.Item>
+    </>
+  );
+}
+
+export default TencentSettings;
diff --git a/packages/plugins/@nocobase/plugin-verification/src/client-v2/pages/VerifiersPage.tsx b/packages/plugins/@nocobase/plugin-verification/src/client-v2/pages/VerifiersPage.tsx
new file mode 100644
index 00000000000..40d5c852e64
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/src/client-v2/pages/VerifiersPage.tsx
@@ -0,0 +1,415 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { DeleteOutlined, DownOutlined, PlusOutlined } from '@ant-design/icons';
+import { DrawerFormLayout, Table, useApp } from '@nocobase/client-v2';
+import { randomId, useFlowContext } from '@nocobase/flow-engine';
+import { useMemoizedFn, useRequest } from 'ahooks';
+import { App, Button, Card, Dropdown, Form, Input, Space, Tag, theme } from 'antd';
+import type { ColumnsType } from 'antd/es/table';
+import { cloneDeep } from 'lodash';
+import React, { lazy, Suspense, useEffect, useMemo, useState } from 'react';
+import { useT, useVerificationTranslation } from '../locale';
+import PluginVerificationClientV2 from '../plugin';
+
+export type VerifierOptions = Record<string, unknown>;
+
+export type VerifierRecord = {
+  name?: string;
+  title?: string | null;
+  description?: string | null;
+  verificationType?: string;
+  options?: VerifierOptions;
+};
+
+export type VerifierFormValues = {
+  name?: string;
+  title?: string | null;
+  description?: string | null;
+  verificationType?: string;
+  options?: VerifierOptions;
+};
+
+type VerificationTypeOption = { name: string; title?: string };
+
+const PAGE_SIZE = 50;
+
+export function recursiveTrim<T>(value: T): T {
+  if (typeof value === 'string') return value.trim() as T;
+  if (Array.isArray(value)) {
+    return value.map((item) => recursiveTrim(item)) as unknown as T;
+  }
+  if (value && typeof value === 'object') {
+    const entries = Object.entries(value as Record<string, unknown>).map(
+      ([key, v]) => [key, recursiveTrim(v)] as const,
+    );
+    return Object.fromEntries(entries) as T;
+  }
+  return value;
+}
+
+/**
+ * Submit pipeline for the create/edit verifier drawer.
+ *
+ * Extracted from the React component so the request layer can be tested
+ * directly without spinning up the full FlowEngine + viewer stack.
+ *
+ * The fallthrough `else` is deliberate — it converts what used to be a
+ * silent no-op (when `record.name` was undefined because we read the
+ * wrong primary key) into a loud error. The `verifiers` collection uses
+ * `name` as its primary key (`autoGenId: false`), so `filterByTk` must
+ * be the name string.
+ */
+export type VerifierResource = {
+  create(params: { values: VerifierFormValues }): Promise<unknown>;
+  update(params: { filterByTk: string; values: VerifierFormValues }): Promise<unknown>;
+};
+
+/**
+ * Wider shape consumed by the page (list + destroy + listTypes). Kept
+ * separate from `VerifierResource` so the test surface for `submitVerifierForm`
+ * stays minimal — tests only mock `create`/`update`.
+ */
+type VerifiersResource = VerifierResource & {
+  list(params?: Record<string, unknown>): Promise<{ data?: { data?: VerifierRecord[]; meta?: ListMeta } }>;
+  // `filterByTk` accepts a single PK or a bulk-delete batch. Use React.Key
+  // here so the antd Table's `selectedRowKeys` (Key[] = (string|number)[])
+  // assigns without a cast — server-side it is still the verifier's `name`.
+  destroy(params: { filterByTk: React.Key | React.Key[] }): Promise<unknown>;
+  listTypes(): Promise<{ data?: { data?: VerificationTypeOption[] } | VerificationTypeOption[] }>;
+};
+
+export async function submitVerifierForm(args: {
+  raw: VerifierFormValues;
+  mode: 'create' | 'edit';
+  record?: VerifierRecord;
+  resource: VerifierResource;
+  onSubmitted: () => void;
+}): Promise<void> {
+  const trimmedOptions = recursiveTrim(args.raw.options || {});
+  if (args.mode === 'create') {
+    await args.resource.create({ values: { ...args.raw, options: trimmedOptions } });
+    args.onSubmitted();
+    return;
+  }
+  if (args.record?.name != null) {
+    // antd Form.validateFields only returns DECLARED paths, so any options
+    // sub-keys the current admin-settings form doesn't render would silently
+    // disappear on update. Merge the original record's top-level fields and
+    // existing `options` so unrelated keys survive — only paths this form
+    // owns get overwritten.
+    const merged: VerifierFormValues = {
+      ...cloneDeep(args.record),
+      ...args.raw,
+      options: { ...(args.record.options || {}), ...trimmedOptions },
+    };
+    await args.resource.update({ filterByTk: args.record.name, values: merged });
+    args.onSubmitted();
+    return;
+  }
+  throw new Error(`Edit mode requires record.name; got ${JSON.stringify(args.record)}`);
+}
+
+function useVerifiersResource(): VerifiersResource {
+  const ctx = useFlowContext();
+  // `IResource` from the SDK is `{ [key: string]: ResourceAction }` — every
+  // action is typed as possibly-undefined under `tsc -d`. The `verifiers`
+  // resource is known to expose create/update/list/destroy/listTypes
+  // server-side, so we narrow once here instead of casting at every call site.
+  return ctx.api.resource('verifiers') as unknown as VerifiersResource;
+}
+
+function useVerificationTypesFromServer() {
+  const resource = useVerifiersResource();
+  return useRequest(
+    async () => {
+      const response = await resource.listTypes();
+      // Server has shipped two response shapes over time: the modern
+      // `{ data: [...] }` envelope and an older bare-array body. Narrow via
+      // `Array.isArray` so TS can index `.data` only when the body is the
+      // object form.
+      const body = response?.data;
+      const list = Array.isArray(body) ? body : body?.data;
+      return Array.isArray(list) ? list : [];
+    },
+    {
+      cacheKey: '@nocobase/plugin-verification:verifiers:listTypes',
+    },
+  );
+}
+
+function VerifierFormView(props: {
+  mode: 'create' | 'edit';
+  verificationType: string;
+  verificationTypeOptions: VerificationTypeOption[];
+  record?: VerifierRecord;
+  onSubmitted: () => void;
+}) {
+  const { t } = useVerificationTranslation();
+  const compileT = useT();
+  const app = useApp();
+  const plugin = app.pm.get(PluginVerificationClientV2);
+  const resource = useVerifiersResource();
+  const [form] = Form.useForm();
+  const [submitting, setSubmitting] = useState(false);
+
+  const compiledTypeOptions = useMemo(
+    () =>
+      props.verificationTypeOptions.map((option) => ({
+        value: option.name,
+        label: compileT(option.title || option.name),
+      })),
+    [props.verificationTypeOptions, compileT],
+  );
+
+  const initialValues = useMemo(() => {
+    if (props.mode === 'edit') return cloneDeep(props.record || {});
+    return {
+      name: randomId('v_'),
+      verificationType: props.verificationType,
+      options: {},
+    };
+  }, [props.mode, props.record, props.verificationType]);
+
+  useEffect(() => {
+    form.setFieldsValue(initialValues);
+  }, [form, initialValues]);
+
+  // Type-specific admin settings are pulled from the registry at render
+  // time as an async loader, so third-party verification types contributed
+  // via `registerVerificationType()` come in as their own webpack chunk.
+  const AdminSettingsForm = useMemo(() => {
+    const loader = plugin?.verificationManager.getVerification(props.verificationType)?.components
+      ?.AdminSettingsFormLoader;
+    return loader ? lazy(loader) : null;
+  }, [plugin, props.verificationType]);
+
+  const handleSubmit = useMemoizedFn(async () => {
+    const raw = await form.validateFields();
+    setSubmitting(true);
+    try {
+      await submitVerifierForm({
+        raw,
+        mode: props.mode,
+        record: props.record,
+        resource,
+        onSubmitted: props.onSubmitted,
+      });
+    } finally {
+      setSubmitting(false);
+    }
+  });
+
+  return (
+    <DrawerFormLayout
+      title={props.mode === 'create' ? t('Add new') : t('Edit')}
+      onSubmit={handleSubmit}
+      submitting={submitting}
+      submitText={t('Submit')}
+      cancelText={t('Cancel')}
+    >
+      <Form form={form} layout="vertical" initialValues={initialValues}>
+        <Form.Item
+          name="name"
+          label={t('UID')}
+          rules={[
+            { required: true, message: t('Please enter a UID') },
+            { pattern: /^[a-zA-Z0-9_-]+$/, message: t('a-z, A-Z, 0-9, _, -') },
+          ]}
+        >
+          <Input disabled={props.mode === 'edit'} />
+        </Form.Item>
+        <Form.Item name="title" label={t('Title')}>
+          <Input />
+        </Form.Item>
+        <Form.Item name="description" label={t('Description')}>
+          <Input.TextArea />
+        </Form.Item>
+        {/* Hidden so the value is included in the payload even though the
+            field is not user-editable. */}
+        <Form.Item name="verificationType" hidden>
+          <Input />
+        </Form.Item>
+        {props.mode === 'edit' ? (
+          <Form.Item label={t('Verification type')}>
+            <Tag>{compiledTypeOptions.find((option) => option.value === props.verificationType)?.label}</Tag>
+          </Form.Item>
+        ) : null}
+        {AdminSettingsForm ? (
+          <Suspense fallback={null}>
+            <AdminSettingsForm />
+          </Suspense>
+        ) : null}
+      </Form>
+    </DrawerFormLayout>
+  );
+}
+
+type ListMeta = { count?: number; total?: number };
+type ListBody = { data?: VerifierRecord[] | { data?: VerifierRecord[]; meta?: ListMeta }; meta?: ListMeta };
+type ListResponse = { data?: ListBody };
+
+function normalizeListResponse(response: ListResponse | undefined): { records: VerifierRecord[]; total: number } {
+  const body = response?.data;
+  const payload = body?.data;
+  const records: VerifierRecord[] = Array.isArray(payload) ? payload : Array.isArray(payload?.data) ? payload.data : [];
+  const nestedMeta = !Array.isArray(payload) ? payload?.meta : undefined;
+  const meta = body?.meta || nestedMeta || {};
+  return {
+    records,
+    total: meta.count ?? meta.total ?? records.length,
+  };
+}
+
+/**
+ * Admin settings page for the Verification plugin. Lists all configured
+ * verifiers with create / edit / delete + bulk delete. Per-type fields
+ * are injected from `verificationManager` registered via the plugin
+ * registry so third-party verifier types (TOTP, future biometric, …)
+ * plug in without touching this page.
+ */
+export default function VerifiersPage() {
+  const { t } = useVerificationTranslation();
+  const compileT = useT();
+  const ctx = useFlowContext();
+  const { token } = theme.useToken();
+  const { modal } = App.useApp();
+  const resource = useVerifiersResource();
+  const [page, setPage] = useState(1);
+  const [selectedRowKeys, setSelectedRowKeys] = useState<React.Key[]>([]);
+
+  const { data: typesData } = useVerificationTypesFromServer();
+  const verificationTypeOptions = useMemo<VerificationTypeOption[]>(() => typesData || [], [typesData]);
+
+  const { data, loading, refresh } = useRequest(
+    async () => {
+      const response = await resource.list({
+        page,
+        pageSize: PAGE_SIZE,
+        appends: [],
+      });
+      return normalizeListResponse(response);
+    },
+    {
+      refreshDeps: [page],
+    },
+  );
+
+  const openForm = useMemoizedFn((mode: 'create' | 'edit', verificationType: string, record?: VerifierRecord) => {
+    ctx.viewer.drawer({
+      width: '50%',
+      closable: true,
+      content: () => (
+        <VerifierFormView
+          mode={mode}
+          verificationType={verificationType}
+          verificationTypeOptions={verificationTypeOptions}
+          record={record}
+          onSubmitted={() => refresh()}
+        />
+      ),
+    });
+  });
+
+  const handleDelete = useMemoizedFn((filterByTk: React.Key | React.Key[]) => {
+    modal.confirm({
+      title: t('Delete'),
+      content: t('Are you sure you want to delete it?'),
+      async onOk() {
+        await resource.destroy({ filterByTk });
+        setSelectedRowKeys([]);
+        refresh();
+      },
+    });
+  });
+
+  const typeLabelOf = useMemoizedFn((typeName?: string) => {
+    const match = verificationTypeOptions.find((option) => option.name === typeName);
+    const raw = match?.title || typeName || '';
+    return compileT(raw);
+  });
+
+  const columns = useMemo<ColumnsType<VerifierRecord>>(
+    () => [
+      { title: t('UID'), dataIndex: 'name' },
+      { title: t('Title'), dataIndex: 'title' },
+      {
+        title: t('Verification type'),
+        dataIndex: 'verificationType',
+        render: (value) => (value ? <Tag>{typeLabelOf(value)}</Tag> : null),
+      },
+      { title: t('Description'), dataIndex: 'description' },
+      {
+        title: t('Actions'),
+        width: 160,
+        render: (_, record) => (
+          <Space>
+            <a
+              onClick={() => {
+                if (!record.verificationType) return;
+                openForm('edit', record.verificationType, record);
+              }}
+            >
+              {t('Edit')}
+            </a>
+            <a onClick={() => record.name != null && handleDelete(record.name)}>{t('Delete')}</a>
+          </Space>
+        ),
+      },
+    ],
+    [handleDelete, openForm, t, typeLabelOf],
+  );
+
+  return (
+    <Card variant="borderless">
+      <div style={{ display: 'flex', justifyContent: 'flex-end', gap: token.marginSM, marginBottom: token.margin }}>
+        <Button
+          icon={<DeleteOutlined />}
+          disabled={!selectedRowKeys.length}
+          onClick={() => handleDelete(selectedRowKeys)}
+        >
+          {t('Delete')}
+        </Button>
+        <Dropdown
+          menu={{
+            items: verificationTypeOptions.map((option) => ({
+              key: option.name,
+              label: compileT(option.title || option.name),
+            })),
+            onClick(info) {
+              openForm('create', info.key as string);
+            },
+          }}
+          disabled={!verificationTypeOptions.length}
+        >
+          <Button type="primary" icon={<PlusOutlined />}>
+            {t('Add new')} <DownOutlined />
+          </Button>
+        </Dropdown>
+      </div>
+      <Table<VerifierRecord>
+        rowKey="name"
+        loading={loading}
+        columns={columns}
+        dataSource={data?.records || []}
+        rowSelection={{
+          selectedRowKeys,
+          onChange: setSelectedRowKeys,
+        }}
+        pagination={{
+          current: page,
+          pageSize: PAGE_SIZE,
+          total: data?.total || 0,
+          showSizeChanger: false,
+          onChange: setPage,
+        }}
+      />
+    </Card>
+  );
+}
diff --git a/packages/plugins/@nocobase/plugin-verification/src/client-v2/plugin.tsx b/packages/plugins/@nocobase/plugin-verification/src/client-v2/plugin.tsx
new file mode 100644
index 00000000000..e5cbcc5ff5b
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/src/client-v2/plugin.tsx
@@ -0,0 +1,71 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Plugin } from '@nocobase/client-v2';
+import { PROVIDER_TYPE_SMS_ALIYUN, PROVIDER_TYPE_SMS_TENCENT, SMS_OTP_VERIFICATION_TYPE } from '../constants';
+import { NAMESPACE, verificationLocaleResources } from './locale';
+import { smsAliyunProviderOptions, smsOTPVerificationOptions, smsTencentProviderOptions } from './otp-verification/sms';
+import { SMSOTPProviderManager } from './otp-sms-provider-manager';
+import { VerificationUserCenterItemModel } from './user-center/VerificationUserCenterItemModel';
+import { VerificationManager } from './verification-manager';
+
+/**
+ * v2 entry for the Verification plugin. Mirrors the v1 surface
+ * (`verificationManager` and `smsOTPProviderManager` instances exposed
+ * to downstream plugins) but plugs into the v2 lifecycle:
+ *
+ * - `pluginSettingsManager.addMenuItem` / `addPageTabItem` register the
+ *   admin settings page with a lazy `componentLoader`.
+ * - `flowEngine.registerModels` contributes the User Center entry.
+ * - The legacy `src/client/` entry is intentionally left in place so
+ *   downstream v1-only plugins (TOTP authenticator, 2FA pro plugin)
+ *   keep working until they migrate independently.
+ */
+export class PluginVerificationClientV2 extends Plugin {
+  verificationManager = new VerificationManager();
+  smsOTPProviderManager = new SMSOTPProviderManager();
+
+  async load() {
+    Object.entries(verificationLocaleResources).forEach(([lang, resource]) => {
+      this.app.i18n.addResources(lang, NAMESPACE, resource);
+    });
+
+    this.app.flowEngine.registerModels({ VerificationUserCenterItemModel });
+
+    this.registerSettingsPages();
+
+    // Built-in SMS-OTP verification type and its two stock providers.
+    // Third-party providers can call `smsOTPProviderManager.registerProvider`
+    // after `app.pm.get(...)` to slot in additional vendors.
+    this.verificationManager.registerVerificationType(SMS_OTP_VERIFICATION_TYPE, smsOTPVerificationOptions);
+    this.smsOTPProviderManager.registerProvider(PROVIDER_TYPE_SMS_ALIYUN, smsAliyunProviderOptions);
+    this.smsOTPProviderManager.registerProvider(PROVIDER_TYPE_SMS_TENCENT, smsTencentProviderOptions);
+  }
+
+  private registerSettingsPages() {
+    const t = (key: string) => this.app.i18n.t(key, { ns: NAMESPACE });
+    this.pluginSettingsManager.addMenuItem({
+      key: NAMESPACE,
+      title: t('Verification'),
+      icon: 'CheckCircleOutlined',
+      aclSnippet: 'pm.verification',
+    });
+    this.pluginSettingsManager.addPageTabItem({
+      menuKey: NAMESPACE,
+      key: 'index',
+      title: t('Verifiers'),
+      icon: 'CheckCircleOutlined',
+      aclSnippet: 'pm.verification.verifiers',
+      sort: 1,
+      componentLoader: () => import('./pages/VerifiersPage'),
+    });
+  }
+}
+
+export default PluginVerificationClientV2;
diff --git a/packages/plugins/@nocobase/plugin-verification/src/client-v2/user-center/MyVerifiers.tsx b/packages/plugins/@nocobase/plugin-verification/src/client-v2/user-center/MyVerifiers.tsx
new file mode 100644
index 00000000000..c1d2c307462
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/src/client-v2/user-center/MyVerifiers.tsx
@@ -0,0 +1,305 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { DialogFormLayout, useApp } from '@nocobase/client-v2';
+import { useFlowContext } from '@nocobase/flow-engine';
+import { useMemoizedFn, useRequest } from 'ahooks';
+import { Alert, App, Form, List, Spin, Tabs, Tag } from 'antd';
+import React, { lazy, Suspense, useMemo, useState } from 'react';
+import { useT, useVerificationTranslation } from '../locale';
+import PluginVerificationClientV2 from '../plugin';
+import type { BindFormProps, VerificationFormProps } from '../verification-manager';
+
+/**
+ * `React.lazy` returns a brand-new component each call; calling it inside
+ * render would re-mount the Suspense boundary on every paint. Cache per
+ * verification type so the same lazy wrapper is reused across renders.
+ */
+function createLazyByType<P>() {
+  const cache = new Map<string, React.LazyExoticComponent<React.ComponentType<P>>>();
+  return (type: string, loader: () => Promise<{ default: React.ComponentType<P> }>) => {
+    const cached = cache.get(type);
+    if (cached) return cached;
+    const wrapped = lazy(loader);
+    cache.set(type, wrapped);
+    return wrapped;
+  };
+}
+
+type UserVerifier = {
+  name: string;
+  title?: string;
+  description?: string;
+  verificationType: string;
+  verificationTypeTitle?: string;
+  boundInfo?: {
+    bound?: boolean;
+    publicInfo?: string;
+  };
+};
+
+const lazyBindFormByType = createLazyByType<BindFormProps>();
+
+function BindDialogContent(props: { verifier: UserVerifier; onSubmitted: () => void }) {
+  const { t } = useVerificationTranslation();
+  const compileT = useT();
+  const ctx = useFlowContext();
+  const app = useApp();
+  const plugin = app.pm.get(PluginVerificationClientV2);
+  const bindFormLoader = plugin?.verificationManager.getVerification(props.verifier.verificationType)?.components
+    ?.BindFormLoader;
+  const BindForm = useMemo(
+    () => (bindFormLoader ? lazyBindFormByType(props.verifier.verificationType, bindFormLoader) : null),
+    [bindFormLoader, props.verifier.verificationType],
+  );
+  const [form] = Form.useForm();
+  const [submitting, setSubmitting] = useState(false);
+  // Server returns titles as raw `{{ t("…", { ns: "…" }) }}` schema
+  // templates. Compile through FlowI18n so the dialog title shows the
+  // human-readable label instead of the literal expression.
+  const dialogTitle = compileT(props.verifier.title || '') || t('Bind');
+
+  const handleSubmit = useMemoizedFn(async () => {
+    const values = await form.validateFields();
+    setSubmitting(true);
+    try {
+      await ctx.api.resource('verifiers').bind({
+        values: {
+          verifier: props.verifier.name,
+          ...values,
+        },
+      });
+      props.onSubmitted();
+    } finally {
+      setSubmitting(false);
+    }
+  });
+
+  // When the verifier's type has no v2-registered BindForm (e.g. TOTP
+  // — still v1-only at the time of writing), fall back to a friendly
+  // warning. Otherwise the drawer renders an empty body and the user
+  // sees nothing actionable.
+  if (!BindForm) {
+    return (
+      <DialogFormLayout
+        title={dialogTitle}
+        onSubmit={async () => undefined}
+        submitText={t('Close')}
+        cancelText={t('Cancel')}
+      >
+        <Alert
+          type="warning"
+          showIcon
+          message={t(
+            'This verifier type ({{type}}) is not yet supported in the new client. Please switch to the legacy client to bind it.',
+            { type: props.verifier.verificationType },
+          )}
+        />
+      </DialogFormLayout>
+    );
+  }
+
+  return (
+    <DialogFormLayout
+      title={dialogTitle}
+      onSubmit={handleSubmit}
+      submitting={submitting}
+      submitText={t('Bind')}
+      cancelText={t('Cancel')}
+    >
+      <Form form={form} layout="vertical">
+        <Suspense fallback={<Spin />}>
+          <BindForm verifier={props.verifier.name} actionType="verifiers:bind" isLogged />
+        </Suspense>
+      </Form>
+    </DialogFormLayout>
+  );
+}
+
+const lazyVerificationFormByType = createLazyByType<VerificationFormProps>();
+
+function UnbindDialogContent(props: {
+  targetVerifier: UserVerifier;
+  availableVerifiers: UserVerifier[];
+  onSubmitted: () => void;
+}) {
+  const compileT = useT();
+  const { t } = useVerificationTranslation();
+  const ctx = useFlowContext();
+  const app = useApp();
+  const plugin = app.pm.get(PluginVerificationClientV2);
+  // The user picks WHICH verifier to authenticate with on this drawer's
+  // tab strip — `selectedVerifier` is the auth source, while
+  // `targetVerifier` is the one being unbound.
+  const initial = props.availableVerifiers[0]?.name;
+  const [selectedVerifier, setSelectedVerifier] = useState<string | undefined>(initial);
+  const [form] = Form.useForm();
+  const [submitting, setSubmitting] = useState(false);
+
+  const handleSubmit = useMemoizedFn(async () => {
+    if (!selectedVerifier) return;
+    const values = await form.validateFields();
+    setSubmitting(true);
+    try {
+      await ctx.api.resource('verifiers').unbind({
+        values: {
+          verifier: selectedVerifier,
+          unbindVerifier: props.targetVerifier.name,
+          ...values,
+        },
+      });
+      props.onSubmitted();
+    } finally {
+      setSubmitting(false);
+    }
+  });
+
+  const tabItems = props.availableVerifiers
+    .map((verifier) => {
+      const verificationFormLoader = plugin?.verificationManager.getVerification(verifier.verificationType)?.components
+        ?.VerificationFormLoader;
+      if (!verificationFormLoader) return null;
+      const VerificationForm = lazyVerificationFormByType(verifier.verificationType, verificationFormLoader);
+      const tabTitle =
+        compileT(verifier.title || '') || compileT(verifier.verificationTypeTitle || verifier.verificationType);
+      return {
+        key: verifier.name,
+        label: tabTitle,
+        children: (
+          // The form instance is shared across tabs but values are reset
+          // when the user switches tabs (see onChange below). Each tab
+          // re-renders a fresh VerificationForm bound to its own verifier.
+          <Suspense fallback={<Spin />}>
+            <VerificationForm
+              verifier={verifier.name}
+              actionType="verifiers:unbind"
+              boundInfo={verifier.boundInfo}
+              isLogged
+            />
+          </Suspense>
+        ),
+      };
+    })
+    .filter(Boolean) as { key: string; label: React.ReactNode; children: React.ReactNode }[];
+
+  return (
+    <DialogFormLayout
+      title={t('Unbind verifier')}
+      onSubmit={handleSubmit}
+      submitting={submitting}
+      submitText={t('Unbind')}
+      cancelText={t('Cancel')}
+    >
+      <Form form={form} layout="vertical">
+        {tabItems.length ? (
+          <Tabs
+            activeKey={selectedVerifier}
+            onChange={(key) => {
+              form.resetFields();
+              setSelectedVerifier(key);
+            }}
+            destroyInactiveTabPane
+            items={tabItems}
+          />
+        ) : (
+          <span>{t('No verifier available to verify your identity.')}</span>
+        )}
+      </Form>
+    </DialogFormLayout>
+  );
+}
+
+function VerifierActions(props: { verifier: UserVerifier; onChanged: () => void }) {
+  const { t } = useVerificationTranslation();
+  const ctx = useFlowContext();
+  const bound = !!props.verifier.boundInfo?.bound;
+
+  // Match v1 UX: bind/unbind opens an antd Modal (dialog) with title
+  // left + native top-right X close. `closable: true` overrides the
+  // platform-level `closable={false}` default in `DialogComponent` so
+  // antd Modal's built-in close button is restored.
+  const openBind = useMemoizedFn(() => {
+    ctx.viewer.dialog({
+      closable: true,
+      content: () => <BindDialogContent verifier={props.verifier} onSubmitted={() => props.onChanged()} />,
+    });
+  });
+
+  const openUnbind = useMemoizedFn(async () => {
+    const response = await ctx.api.resource('verifiers').listForVerify({ scene: 'unbind-verifier' });
+    const verifiers: UserVerifier[] = response?.data?.data || [];
+    ctx.viewer.dialog({
+      closable: true,
+      content: () => (
+        <UnbindDialogContent
+          targetVerifier={props.verifier}
+          availableVerifiers={verifiers}
+          onSubmitted={() => props.onChanged()}
+        />
+      ),
+    });
+  });
+
+  return bound ? <a onClick={openUnbind}>{t('Unbind')}</a> : <a onClick={openBind}>{t('Bind')}</a>;
+}
+
+/**
+ * Drawer content for the User Center's "Verification" entry. Lists
+ * every verifier the current user can bind/unbind, with a Configured /
+ * Not configured tag and a per-row action. Bind opens a type-specific
+ * sub-drawer; Unbind opens a Tabs-based confirmation drawer that
+ * authenticates the user with any other bound verifier before removing
+ * the target.
+ */
+export function MyVerifiers() {
+  const compileT = useT();
+  const { t } = useVerificationTranslation();
+  const ctx = useFlowContext();
+  const { message } = App.useApp();
+  const { data, loading, refresh } = useRequest(async () => {
+    const response = await ctx.api.resource('verifiers').listByUser();
+    return (response?.data?.data || []) as UserVerifier[];
+  });
+
+  const onChanged = useMemoizedFn(() => {
+    refresh();
+    message.success(t('Operation succeeded'));
+  });
+
+  if (loading) {
+    return <Spin />;
+  }
+
+  return (
+    <List
+      bordered
+      dataSource={data || []}
+      renderItem={(item) => (
+        <List.Item actions={[<VerifierActions key="action" verifier={item} onChanged={onChanged} />]}>
+          <List.Item.Meta
+            title={
+              <>
+                {compileT(item.title || '')}{' '}
+                {item.boundInfo?.bound ? (
+                  <Tag color="success">{t('Configured')}</Tag>
+                ) : (
+                  <Tag color="warning">{t('Not configured')}</Tag>
+                )}
+              </>
+            }
+            description={compileT(item.description || '')}
+          />
+          <div>{item.boundInfo?.publicInfo}</div>
+        </List.Item>
+      )}
+    />
+  );
+}
+
+export default MyVerifiers;
diff --git a/packages/plugins/@nocobase/plugin-verification/src/client-v2/user-center/VerificationUserCenterItemModel.tsx b/packages/plugins/@nocobase/plugin-verification/src/client-v2/user-center/VerificationUserCenterItemModel.tsx
new file mode 100644
index 00000000000..875791064af
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/src/client-v2/user-center/VerificationUserCenterItemModel.tsx
@@ -0,0 +1,53 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { UserCenterActionItemModel } from '@nocobase/client-v2';
+import React from 'react';
+import { NAMESPACE } from '../locale';
+import { MyVerifiers } from './MyVerifiers';
+
+const VERIFICATION_LABEL_NS = [NAMESPACE, 'client'];
+
+/**
+ * User Center entry that opens the "My verifiers" drawer. Section is
+ * `profile` so it sits next to language / theme controls. Sort is
+ * tightened to 150 to match v1's ordering, where Verification lived
+ * between Profile (100) and Theme (200).
+ *
+ * The base `UserCenterTextItemView` renders `getLabelNode()`, which by
+ * default routes through `this.context.t(label)` with no namespace —
+ * that would never resolve the verification-namespaced key. Override
+ * the node directly so the verification i18n namespace is consulted.
+ */
+export class VerificationUserCenterItemModel extends UserCenterActionItemModel {
+  static itemId = 'verification';
+
+  section = 'profile' as const;
+  sort = 150;
+  label = 'Verification';
+
+  getLabelNode() {
+    return this.context.t('Verification', { ns: VERIFICATION_LABEL_NS, nsMode: 'fallback' });
+  }
+
+  async onClick() {
+    // `closable: true` overrides DrawerComponent's `closable={false}`
+    // default so antd Drawer renders its native left-side X next to the
+    // title — matches the v1 user-center drawer and the form-style
+    // drawers that inject a close icon via DrawerFormLayout.
+    this.context.viewer.drawer({
+      title: this.context.t('Verification', { ns: VERIFICATION_LABEL_NS, nsMode: 'fallback' }),
+      width: '50%',
+      closable: true,
+      content: () => <MyVerifiers />,
+    });
+  }
+}
+
+export default VerificationUserCenterItemModel;
diff --git a/packages/plugins/@nocobase/plugin-verification/src/client-v2/verification-manager.ts b/packages/plugins/@nocobase/plugin-verification/src/client-v2/verification-manager.ts
new file mode 100644
index 00000000000..7a6240a4e2e
--- /dev/null
+++ b/packages/plugins/@nocobase/plugin-verification/src/client-v2/verification-manager.ts
@@ -0,0 +1,56 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { Registry } from '@nocobase/utils/client';
+import type { ComponentType } from 'react';
+
+export type VerificationFormProps = {
+  verifier: string;
+  actionType: string;
+  boundInfo?: { bound?: boolean; publicInfo?: any };
+  isLogged?: boolean;
+};
+
+export type BindFormProps = {
+  verifier: string;
+  actionType: string;
+  isLogged?: boolean;
+};
+
+type LoaderOf<P = Record<string, never>> = () => Promise<{ default: ComponentType<P> }>;
+
+export type VerificationTypeOptions = {
+  /**
+   * Async loaders for the type-specific forms. The manager stores loaders
+   * rather than direct component references so each verifier type
+   * contributes its own webpack chunk and is only fetched when a verifier
+   * of that type is actually shown.
+   *
+   * Consumers wrap each loader with `React.lazy` (cached via `useMemo` or
+   * a per-type cache to avoid re-creating the lazy wrapper) and render it
+   * under `<Suspense>`.
+   */
+  components: {
+    AdminSettingsFormLoader?: LoaderOf;
+    VerificationFormLoader?: LoaderOf<VerificationFormProps>;
+    BindFormLoader?: LoaderOf<BindFormProps>;
+  };
+};
+
+export class VerificationManager {
+  verifications = new Registry<VerificationTypeOptions>();
+
+  registerVerificationType(type: string, options: VerificationTypeOptions) {
+    this.verifications.register(type, options);
+  }
+
+  getVerification(type: string) {
+    return this.verifications.get(type);
+  }
+}
diff --git a/yarn.lock b/yarn.lock
index 9084644efde..53895a03303 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1782,25 +1782,11 @@
   dependencies:
     "@azure/msal-common" "16.6.1"
 
-"@azure/msal-common@14.16.1":
-  version "14.16.1"
-  resolved "https://registry.npmjs.org/@azure/msal-common/-/msal-common-14.16.1.tgz#d23ecce40823a4d03ad74160dc819d62e0c0a787"
-  integrity sha512-nyxsA6NA4SVKh5YyRpbSXiMr7oQbwark7JU9LMeg6tJYTSPyAGkdx61wPT4gyxZfxlSxMMEyAsWaubBlNyIa1w==
-
 "@azure/msal-common@16.6.1":
   version "16.6.1"
   resolved "https://registry.npmjs.org/@azure/msal-common/-/msal-common-16.6.1.tgz#6e0a8d601e3aca60f6fd34a037eb29c10225c597"
   integrity sha512-VxKdEtUwDuLD0F1hOQP7kye0YadZxFJfv37Em440geEf/w9uggKnHpRrqwZJOdxmPUOdhZ9kyRtKuAJW8wUcRg==
 
-"@azure/msal-node@^2.15.0":
-  version "2.16.3"
-  resolved "https://registry.npmjs.org/@azure/msal-node/-/msal-node-2.16.3.tgz#8b805152ad780b048d6c2b33b1d4e26d7b463368"
-  integrity sha512-CO+SE4weOsfJf+C5LM8argzvotrXw252/ZU6SM2Tz63fEblhH1uuVaaO4ISYFuN4Q6BhTo7I3qIdi8ydUQCqhw==
-  dependencies:
-    "@azure/msal-common" "14.16.1"
-    jsonwebtoken "^9.0.0"
-    uuid "^8.3.0"
-
 "@azure/msal-node@^5.1.0":
   version "5.2.1"
   resolved "https://registry.npmjs.org/@azure/msal-node/-/msal-node-5.2.1.tgz#1f7cc578f30167d24d0812a71c934c8a0438d2d8"
@@ -3144,13 +3130,6 @@
   resolved "https://registry.npmmirror.com/@babel/regjsgen/-/regjsgen-0.8.0.tgz#f0ba69b075e1f05fb2825b7fad991e7adbb18310"
   integrity sha512-x/rqGMdzj+fWZvCOYForTghzbtqPDZ5gPwaoNGHdgDfF2QA/XZbCBp4Moo5scrkAMPhB7z26XM/AaHuIJdgauA==
 
-"@babel/runtime-corejs3@^7.15.4":
-  version "7.29.2"
-  resolved "https://registry.npmjs.org/@babel/runtime-corejs3/-/runtime-corejs3-7.29.2.tgz#cb86ad06e7a1d39224afb12a874301085e071846"
-  integrity sha512-Lc94FOD5+0aXhdb0Tdg3RUtqT6yWbI/BbFWvlaSJ3gAb9Ks+99nHRDKADVqC37er4eCB0fHyWT+y+K3QOvJKbw==
-  dependencies:
-    core-js-pure "^3.48.0"
-
 "@babel/runtime@7.23.2":
   version "7.23.2"
   resolved "https://registry.npmmirror.com/@babel/runtime/-/runtime-7.23.2.tgz#062b0ac103261d68a966c4c7baf2ae3e62ec3885"
@@ -5394,13 +5373,6 @@
   resolved "https://registry.npmjs.org/@google/generative-ai/-/generative-ai-0.24.0.tgz#4d27af7d944c924a27a593c17ad1336535d53846"
   integrity sha512-fnEITCGEB7NdX0BhoYZ/cq/7WPZ1QS5IzJJfC3Tg/OwkvBetMiVJciyaan297OvE4B9Jg1xvo0zIazX/9sGu1Q==
 
-"@googleapis/gmail@^12.0.0":
-  version "12.0.1"
-  resolved "https://registry.npmjs.org/@googleapis/gmail/-/gmail-12.0.1.tgz#953a51e0a25a55e06b490c3640602ab4c084ed95"
-  integrity sha512-74KIG6Ks3/mrjLwz5omate5N6drrJdZSCjwQr1hkPrXQ7LAvHST8bG8+L7O1NrHE+oddPgZ9XP4X5xwX5K1tPg==
-  dependencies:
-    googleapis-common "^7.0.0"
-
 "@googlemaps/js-api-loader@^1.16.1":
   version "1.16.2"
   resolved "https://registry.npmmirror.com/@googlemaps/js-api-loader/-/js-api-loader-1.16.2.tgz#3fe748e21243f8e8322c677a5525c569ae9cdbe9"
@@ -6002,77 +5974,6 @@
   dependencies:
     "@langchain/openai" "1.2.7"
 
-"@ldapjs/asn1@2.0.0", "@ldapjs/asn1@^2.0.0":
-  version "2.0.0"
-  resolved "https://registry.npmjs.org/@ldapjs/asn1/-/asn1-2.0.0.tgz#e25fa38fcf0b4310275d6a5a05fe4603efef5eb4"
-  integrity sha512-G9+DkEOirNgdPmD0I8nu57ygQJKOOgFEMKknEuQvIHbGLwP3ny1mY+OTUYLCbCaGJP4sox5eYgBJRuSUpnAddA==
-
-"@ldapjs/asn1@^1.2.0":
-  version "1.2.0"
-  resolved "https://registry.npmjs.org/@ldapjs/asn1/-/asn1-1.2.0.tgz#5e99338fb39ff518c205827bec0fd9a6bf6b42db"
-  integrity sha512-KX/qQJ2xxzvO2/WOvr1UdQ+8P5dVvuOLk/C9b1bIkXxZss8BaR28njXdPgFCpj5aHaf1t8PmuVnea+N9YG9YMw==
-
-"@ldapjs/attribute@1.0.0", "@ldapjs/attribute@^1.0.0":
-  version "1.0.0"
-  resolved "https://registry.npmjs.org/@ldapjs/attribute/-/attribute-1.0.0.tgz#d81d626080584c1c80ef300a214458f9f78a8abb"
-  integrity sha512-ptMl2d/5xJ0q+RgmnqOi3Zgwk/TMJYG7dYMC0Keko+yZU6n+oFM59MjQOUht5pxJeS4FWrImhu/LebX24vJNRQ==
-  dependencies:
-    "@ldapjs/asn1" "2.0.0"
-    "@ldapjs/protocol" "^1.2.1"
-    process-warning "^2.1.0"
-
-"@ldapjs/change@^1.0.0":
-  version "1.0.0"
-  resolved "https://registry.npmjs.org/@ldapjs/change/-/change-1.0.0.tgz#34818a3a31cb337d3b90ab853bb7fa90517c2c4f"
-  integrity sha512-EOQNFH1RIku3M1s0OAJOzGfAohuFYXFY4s73wOhRm4KFGhmQQ7MChOh2YtYu9Kwgvuq1B0xKciXVzHCGkB5V+Q==
-  dependencies:
-    "@ldapjs/asn1" "2.0.0"
-    "@ldapjs/attribute" "1.0.0"
-
-"@ldapjs/controls@^2.1.0":
-  version "2.1.0"
-  resolved "https://registry.npmjs.org/@ldapjs/controls/-/controls-2.1.0.tgz#28449cd4352f9389fb52fbf699cfa62f3e8762e6"
-  integrity sha512-2pFdD1yRC9V9hXfAWvCCO2RRWK9OdIEcJIos/9cCVP9O4k72BY1bLDQQ4KpUoJnl4y/JoD4iFgM+YWT3IfITWw==
-  dependencies:
-    "@ldapjs/asn1" "^1.2.0"
-    "@ldapjs/protocol" "^1.2.1"
-
-"@ldapjs/dn@^1.1.0":
-  version "1.1.0"
-  resolved "https://registry.npmjs.org/@ldapjs/dn/-/dn-1.1.0.tgz#3687c86d658d2e10aedc2c65a1ef40155dd7370b"
-  integrity sha512-R72zH5ZeBj/Fujf/yBu78YzpJjJXG46YHFo5E4W1EqfNpo1UsVPqdLrRMXeKIsJT3x9dJVIfR6OpzgINlKpi0A==
-  dependencies:
-    "@ldapjs/asn1" "2.0.0"
-    process-warning "^2.1.0"
-
-"@ldapjs/filter@^2.1.1":
-  version "2.1.1"
-  resolved "https://registry.npmjs.org/@ldapjs/filter/-/filter-2.1.1.tgz#34f4774aa17086ed0186afe11c698f13dd586d56"
-  integrity sha512-TwPK5eEgNdUO1ABPBUQabcZ+h9heDORE4V9WNZqCtYLKc06+6+UAJ3IAbr0L0bYTnkkWC/JEQD2F+zAFsuikNw==
-  dependencies:
-    "@ldapjs/asn1" "2.0.0"
-    "@ldapjs/protocol" "^1.2.1"
-    process-warning "^2.1.0"
-
-"@ldapjs/messages@^1.3.0":
-  version "1.3.0"
-  resolved "https://registry.npmjs.org/@ldapjs/messages/-/messages-1.3.0.tgz#dea3c35de6e768e54abd3c7fbaee151d3d01f386"
-  integrity sha512-K7xZpXJ21bj92jS35wtRbdcNrwmxAtPwy4myeh9duy/eR3xQKvikVycbdWVzkYEAVE5Ce520VXNOwCHjomjCZw==
-  dependencies:
-    "@ldapjs/asn1" "^2.0.0"
-    "@ldapjs/attribute" "^1.0.0"
-    "@ldapjs/change" "^1.0.0"
-    "@ldapjs/controls" "^2.1.0"
-    "@ldapjs/dn" "^1.1.0"
-    "@ldapjs/filter" "^2.1.1"
-    "@ldapjs/protocol" "^1.2.1"
-    process-warning "^2.2.0"
-
-"@ldapjs/protocol@^1.2.1":
-  version "1.2.1"
-  resolved "https://registry.npmjs.org/@ldapjs/protocol/-/protocol-1.2.1.tgz#d58d371d6958f28095e8de23b35341bcaba55cf3"
-  integrity sha512-O89xFDLW2gBoZWNXuXpBSM32/KealKCTb3JGtJdtUQc7RjAk8XzrRgyz02cPAwGKwKPxy0ivuC7UP9bmN87egQ==
-
 "@lerna/add@4.0.0":
   version "4.0.0"
   resolved "https://registry.npmmirror.com/@lerna/add/-/add-4.0.0.tgz#c36f57d132502a57b9e7058d1548b7a565ef183f"
@@ -6851,19 +6752,6 @@
   resolved "https://registry.npmjs.org/@marijn/find-cluster-break/-/find-cluster-break-1.0.2.tgz#775374306116d51c0c500b8c4face0f9a04752d8"
   integrity sha512-l0h88YhZFyKdXIFNfSWpyjStDjGHwZ/U7iobcK1cQQD8sejsONdQtTVU+1wVN1PBw40PiiHB1vA5S7VTfQiP9g==
 
-"@microsoft/microsoft-graph-client@^3.0.7":
-  version "3.0.7"
-  resolved "https://registry.npmjs.org/@microsoft/microsoft-graph-client/-/microsoft-graph-client-3.0.7.tgz#535507df2db40bd7ed24a670dc68c87c628177a4"
-  integrity sha512-/AazAV/F+HK4LIywF9C+NYHcJo038zEnWkteilcxC1FM/uK/4NVGDKGrxx7nNq1ybspAroRKT4I1FHfxQzxkUw==
-  dependencies:
-    "@babel/runtime" "^7.12.5"
-    tslib "^2.2.0"
-
-"@microsoft/microsoft-graph-types@^2.40.0":
-  version "2.43.1"
-  resolved "https://registry.npmjs.org/@microsoft/microsoft-graph-types/-/microsoft-graph-types-2.43.1.tgz#4fa178a9d1b1372a5cb648013ac9eed4b1184725"
-  integrity sha512-7r3FiJYW2qTWnl+Li8GV5MzJqPiJp27hvY98kH5V/ZMzGuIOkcJqOfIpusoIQrskLDfYk5kFT8AjpeW713qcIg==
-
 "@mixmark-io/domino@^2.2.0":
   version "2.2.0"
   resolved "https://registry.npmjs.org/@mixmark-io/domino/-/domino-2.2.0.tgz#4e8ec69bf1afeb7a14f0628b7e2c0f35bdb336c3"
@@ -7133,6 +7021,27 @@
     "@nocobase/license-kit-win32-ia32-msvc" "0.3.8"
     "@nocobase/license-kit-win32-x64-msvc" "0.3.8"
 
+"@nocobase/utils@2.1.0-beta.33":
+  version "2.1.0-beta.33"
+  resolved "https://registry.npmjs.org/@nocobase/utils/-/utils-2.1.0-beta.33.tgz#0d63924af362b3a1df20b4eef812e2ebd81c6b97"
+  integrity sha512-R4mtEsedOG3WjPZB/jPEZMGPBTPTEoR/blD7pk6/CNZJjfnVDOJgUCogikHDKyDSDAs0mf5vq3MbwoynBSqhCA==
+  dependencies:
+    "@budibase/handlebars-helpers" "0.14.0"
+    "@hapi/topo" "^6.0.0"
+    "@rc-component/mini-decimal" "^1.1.0"
+    axios "^1.7.0"
+    dayjs "^1.11.9"
+    deepmerge "^4.2.2"
+    flat-to-nested "^1.1.1"
+    fs-extra "^11.1.1"
+    graphlib "^2.1.8"
+    handlebars "^4.7.8"
+    ipaddr.js "^1.9.1"
+    liquidjs "^10.23.0"
+    multer "^1.4.5-lts.2"
+    object-path "^0.11.8"
+    ses "^1.14.0"
+
 "@node-saml/node-saml@^4.0.2":
   version "4.0.5"
   resolved "https://registry.npmjs.org/@node-saml/node-saml/-/node-saml-4.0.5.tgz#039e387095b54639b06df62b1b4a6d8941c6d907"
@@ -9527,18 +9436,6 @@
   dependencies:
     "@types/node" "*"
 
-"@types/ali-oss@^6.16.11":
-  version "6.23.3"
-  resolved "https://registry.npmjs.org/@types/ali-oss/-/ali-oss-6.23.3.tgz#3a46cbd63384bdd2df7f0540baac3ccb9a584465"
-  integrity sha512-huSf6njkqhSeR37OMJTGMCyUg2d9Zp2AioefhYuUMeh0vNM+WybctrBor7bO/RcCbLCQI6sHn6NtPBIWALYVJg==
-
-"@types/amqplib@^0.10.7":
-  version "0.10.8"
-  resolved "https://registry.npmjs.org/@types/amqplib/-/amqplib-0.10.8.tgz#23f2945d055e9fd583da672aa5ec0c7350b9e4e6"
-  integrity sha512-vtDp8Pk1wsE/AuQ8/Rgtm6KUZYqcnTgNvEHwzCkX8rL7AGsC6zqAfKAAJhUZXFhM/Pp++tbnUHiam/8vVpPztA==
-  dependencies:
-    "@types/node" "*"
-
 "@types/archiver@^5.3.1":
   version "5.3.4"
   resolved "https://registry.npmmirror.com/@types/archiver/-/archiver-5.3.4.tgz#32172d5a56f165b5b4ac902e366248bf03d3ae84"
@@ -9597,13 +9494,6 @@
     "@types/connect" "*"
     "@types/node" "*"
 
-"@types/carbone@^3.2.5":
-  version "3.2.5"
-  resolved "https://registry.npmjs.org/@types/carbone/-/carbone-3.2.5.tgz#3adc4c70a9c5f28e071363cb11bcf44243a4befb"
-  integrity sha512-qApQQTj87OrULWkMHZVhf370KM2egpV5/W1Xrr0dCDTkVMNJKjD0yw3WlNftel5Co2Pv/E3BvqO8RQzRCtnBTw==
-  dependencies:
-    "@types/node" "*"
-
 "@types/connect@*", "@types/connect@3.4.38":
   version "3.4.38"
   resolved "https://registry.npmmirror.com/@types/connect/-/connect-3.4.38.tgz#5ba7f3bc4fbbdeaff8dded952e5ff2cc53f8d858"
@@ -9947,11 +9837,6 @@
     "@types/qs" "*"
     "@types/serve-static" "*"
 
-"@types/file-saver@^2.0.7":
-  version "2.0.7"
-  resolved "https://registry.npmjs.org/@types/file-saver/-/file-saver-2.0.7.tgz#8dbb2f24bdc7486c54aa854eb414940bbd056f7d"
-  integrity sha512-dNKVfHd/jk0SkR/exKGj2ggkB45MAkzvWCaqLUUgkyjITkGNzH8H+yUwr+BLJUBjZOe9w8X3wgmXhZDRg1ED6A==
-
 "@types/fs-extra@11.0.1":
   version "11.0.1"
   resolved "https://registry.npmmirror.com/@types/fs-extra/-/fs-extra-11.0.1.tgz#f542ec47810532a8a252127e6e105f487e0a6ea5"
@@ -10177,13 +10062,6 @@
     "@types/koa-compose" "*"
     "@types/node" "*"
 
-"@types/ldapjs@^3.0.6":
-  version "3.0.6"
-  resolved "https://registry.npmjs.org/@types/ldapjs/-/ldapjs-3.0.6.tgz#63aec9036c2acfb0e0b7322df336cda2c37f8bbe"
-  integrity sha512-E2Tn1ltJDYBsidOT9QG4engaQeQzRQ9aYNxVmjCkD33F7cIeLPgrRDXAYs0O35mK2YDU20c/+ZkNjeAPRGLM0Q==
-  dependencies:
-    "@types/node" "*"
-
 "@types/lerna__package@*":
   version "5.1.3"
   resolved "https://registry.npmmirror.com/@types/lerna__package/-/lerna__package-5.1.3.tgz#3604531e882229dee8e3f2bd8c819c405e2fcb43"
@@ -11395,11 +11273,6 @@
     loupe "^2.3.7"
     pretty-format "^29.7.0"
 
-"@wecom/crypto@1.0.1":
-  version "1.0.1"
-  resolved "https://registry.npmjs.org/@wecom/crypto/-/crypto-1.0.1.tgz#6918ed9829043b06075eaa8cff84de2475476a58"
-  integrity sha512-K4Ilkl1l64ceJDbj/kflx8ND/J88pcl8tKx4Ivp7IiCrshRJU+Uo5uWCjAa+PjUiLIdcQSZ4m4d0t1npMPCX5A==
-
 "@xmldom/xmldom@^0.8.10", "@xmldom/xmldom@^0.8.6":
   version "0.8.11"
   resolved "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.11.tgz#b79de2d67389734c57c52595f7a7305e30c2d608"
@@ -11464,11 +11337,6 @@ abort-controller@^3.0.0:
   dependencies:
     event-target-shim "^5.0.0"
 
-abstract-logging@^2.0.1:
-  version "2.0.1"
-  resolved "https://registry.npmjs.org/abstract-logging/-/abstract-logging-2.0.1.tgz#6b0c371df212db7129b57d2e7fcf282b8bf1c839"
-  integrity sha512-2BjRTZxTPvheOvGbBslFSYOUkr+SjPtOnrLP33f+VIWLzezQpZcqVg7ja3L4dBXmzzgwT+a029jRx5PCi3JuiA==
-
 accepts@^1.3.8, accepts@~1.3.4, accepts@~1.3.5, accepts@~1.3.8:
   version "1.3.8"
   resolved "https://registry.npmmirror.com/accepts/-/accepts-1.3.8.tgz#0bf0be125b67014adcb0b0921e62db7bffe16b2e"
@@ -11560,11 +11428,6 @@ adler-32@~1.3.0:
   resolved "https://registry.npmmirror.com/adler-32/-/adler-32-1.3.1.tgz#1dbf0b36dda0012189a32b3679061932df1821e2"
   integrity sha512-ynZ4w/nUUv5rrsR8UUGoe1VC9hZj6V5hU9Qw1HlMDJGEJw5S7TfTErWTjMys6M7vr0YWcPqs3qAr4ss0nDfP+A==
 
-adm-zip@0.5.16:
-  version "0.5.16"
-  resolved "https://registry.npmjs.org/adm-zip/-/adm-zip-0.5.16.tgz#0b5e4c779f07dedea5805cdccb1147071d94a909"
-  integrity sha512-TGw5yVi4saajsSEgz25grObGHEUaDrniwvA2qwSC060KfqGPdglhvPMA2lPIoxs3PQIItj2iag35fONcQqgUaQ==
-
 adm-zip@^0.5.10:
   version "0.5.17"
   resolved "https://registry.npmjs.org/adm-zip/-/adm-zip-0.5.17.tgz#5c0b65f37aeec5c2a94995c024f931f62e4bbc5a"
@@ -11794,14 +11657,6 @@ amp@0.3.1, amp@~0.3.1:
   resolved "https://registry.npmmirror.com/amp/-/amp-0.3.1.tgz#6adf8d58a74f361e82c1fa8d389c079e139fc47d"
   integrity sha512-OwIuC4yZaRogHKiuU5WlMR5Xk/jAcpPtawWL05Gj8Lvm2F6mwoJt4O/bHI+DHwG79vWd+8OFYM4/BzYqyRd3qw==
 
-amqplib@^0.10.7:
-  version "0.10.9"
-  resolved "https://registry.npmjs.org/amqplib/-/amqplib-0.10.9.tgz#5b744c21d624f9307d0399e4d339b7354675831c"
-  integrity sha512-jwSftI4QjS3mizvnSnOrPGYiUnm1vI2OP1iXeOUz5pb74Ua0nbf6nPyyTzuiCLEE3fMpaJORXh2K/TQ08H5xGA==
-  dependencies:
-    buffer-more-ints "~1.0.0"
-    url-parse "~1.5.10"
-
 animated-scroll-to@^2.3.0:
   version "2.3.0"
   resolved "https://registry.npmmirror.com/animated-scroll-to/-/animated-scroll-to-2.3.0.tgz#01d7a82db7ace7017eae11c5ebbafd3b0270bced"
@@ -11909,13 +11764,6 @@ ansi-styles@^6.0.0, ansi-styles@^6.1.0:
   resolved "https://registry.npmmirror.com/ansi-styles/-/ansi-styles-6.2.1.tgz#0e62320cf99c21afff3b3012192546aacbfb05c5"
   integrity sha512-bN798gFfQX+viw3R7yrGWRqnrN2oRkEkUjjl4JNn4E8GxxbjtG3FbrEIIY3l8/hrwUwIeCZvi4QuOTP4MErVug==
 
-ansi-to-html@^0.7.2:
-  version "0.7.2"
-  resolved "https://registry.npmjs.org/ansi-to-html/-/ansi-to-html-0.7.2.tgz#a92c149e4184b571eb29a0135ca001a8e2d710cb"
-  integrity sha512-v6MqmEpNlxF+POuyhKkidusCHWWkaLcGRURzivcU3I9tv7k4JVhFcnukrM5Rlk2rUywdZuzYAZ+kbZqWCnfN3g==
-  dependencies:
-    entities "^2.2.0"
-
 ansis@^3.17.0:
   version "3.17.0"
   resolved "https://registry.npmjs.org/ansis/-/ansis-3.17.0.tgz#fa8d9c2a93fe7d1177e0c17f9eeb562a58a832d7"
@@ -12135,31 +11983,6 @@ archiver-utils@^3.0.4:
     normalize-path "^3.0.0"
     readable-stream "^3.6.0"
 
-archiver-utils@^4.0.1:
-  version "4.0.1"
-  resolved "https://registry.npmjs.org/archiver-utils/-/archiver-utils-4.0.1.tgz#66ad15256e69589a77f706c90c6dbcc1b2775d2a"
-  integrity sha512-Q4Q99idbvzmgCTEAAhi32BkOyq8iVI5EwdO0PmBDSGIzzjYNdcFn7Q7k3OzbLy4kLUPXfJtG6fO2RjftXbobBg==
-  dependencies:
-    glob "^8.0.0"
-    graceful-fs "^4.2.0"
-    lazystream "^1.0.0"
-    lodash "^4.17.15"
-    normalize-path "^3.0.0"
-    readable-stream "^3.6.0"
-
-archiver@6.0.1:
-  version "6.0.1"
-  resolved "https://registry.npmjs.org/archiver/-/archiver-6.0.1.tgz#d56968d4c09df309435adb5a1bbfc370dae48133"
-  integrity sha512-CXGy4poOLBKptiZH//VlWdFuUC1RESbdZjGjILwBuZ73P7WkAUN0htfSfBq/7k6FRFlpu7bg4JOkj1vU9G6jcQ==
-  dependencies:
-    archiver-utils "^4.0.1"
-    async "^3.2.4"
-    buffer-crc32 "^0.2.1"
-    readable-stream "^3.6.0"
-    readdir-glob "^1.1.2"
-    tar-stream "^3.0.0"
-    zip-stream "^5.0.1"
-
 archiver@^5.0.0, archiver@^5.3.1:
   version "5.3.2"
   resolved "https://registry.npmmirror.com/archiver/-/archiver-5.3.2.tgz#99991d5957e53bd0303a392979276ac4ddccf3b0"
@@ -12805,13 +12628,6 @@ babel-runtime@^6.26.0:
     core-js "^2.4.0"
     regenerator-runtime "^0.11.0"
 
-backoff@^2.5.0:
-  version "2.5.0"
-  resolved "https://registry.npmjs.org/backoff/-/backoff-2.5.0.tgz#f616eda9d3e4b66b8ca7fca79f695722c5f8e26f"
-  integrity sha512-wC5ihrnUXmR2douXmXLCe5O3zg3GKIyvRi/hi58a/XyRxVI+3/yM0PYueQOZXPXQ9pxBislYkw+sF9b7C/RuMA==
-  dependencies:
-    precond "0.2"
-
 bail@^2.0.0:
   version "2.0.2"
   resolved "https://registry.npmmirror.com/bail/-/bail-2.0.2.tgz#d26f5cd8fe5d6f832a31517b9f7c356040ba6d5d"
@@ -12827,55 +12643,12 @@ balanced-match@^4.0.2:
   resolved "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz#bfb10662feed8196a2c62e7c68e17720c274179a"
   integrity sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==
 
-bare-events@^2.5.4, bare-events@^2.7.0:
-  version "2.8.3"
-  resolved "https://registry.npmjs.org/bare-events/-/bare-events-2.8.3.tgz#ed26c87a24ece41c69dd4d2d0891c2c04a949e13"
-  integrity sha512-HdUm8EMQBLaJvGUdidNNbqpA1kYkwNcb+MYxkxCLAPJGQzlv9J0C24h8V65Z4c5GLd/JEALDvpFCQgpLJqc0zw==
-
-bare-fs@^4.5.5:
-  version "4.7.1"
-  resolved "https://registry.npmjs.org/bare-fs/-/bare-fs-4.7.1.tgz#6e81f784761102867c13f0823aa48c942d160f00"
-  integrity sha512-WDRsyVN52eAx/lBamKD6uyw8H4228h/x0sGGGegOamM2cd7Pag88GfMQalobXI+HaEUxpCkbKQUDOQqt9wawRw==
-  dependencies:
-    bare-events "^2.5.4"
-    bare-path "^3.0.0"
-    bare-stream "^2.6.4"
-    bare-url "^2.2.2"
-    fast-fifo "^1.3.2"
-
-bare-os@^3.0.1:
-  version "3.9.1"
-  resolved "https://registry.npmjs.org/bare-os/-/bare-os-3.9.1.tgz#660228ca7ffc47a72e96b6047cdd9d8342994e2f"
-  integrity sha512-6M5XjcnsygQNPMCMPXSK379xrJFiZ/AEMNBmFEmQW8d/789VQATvriyi5r0HYTL9TkQ26rn3kgdTG3aisbrXkQ==
-
-bare-path@^3.0.0:
-  version "3.0.0"
-  resolved "https://registry.npmjs.org/bare-path/-/bare-path-3.0.0.tgz#b59d18130ba52a6af9276db3e96a2e3d3ea52178"
-  integrity sha512-tyfW2cQcB5NN8Saijrhqn0Zh7AnFNsnczRcuWODH0eYAXBsJ5gVxAUuNr7tsHSC6IZ77cA0SitzT+s47kot8Mw==
-  dependencies:
-    bare-os "^3.0.1"
-
-bare-stream@^2.6.4:
-  version "2.13.1"
-  resolved "https://registry.npmjs.org/bare-stream/-/bare-stream-2.13.1.tgz#acfd787a2983f5feb182ffe4c37ecc2c55b6ec85"
-  integrity sha512-Vp0cnjYyrEC4whYTymQ+YZi6pBpfiICZO3cfRG8sy67ZNWe951urv1x4eW1BKNngw3U+3fPYb5JQvHbCtxH7Ow==
-  dependencies:
-    streamx "^2.25.0"
-    teex "^1.0.1"
-
-bare-url@^2.2.2:
-  version "2.4.3"
-  resolved "https://registry.npmjs.org/bare-url/-/bare-url-2.4.3.tgz#99aedf87519225669f15ecc0b910db11cad46930"
-  integrity sha512-Kccpc7ACfXaxfeInfqKcZtW4pT5YBn1mesc4sCsun6sRwtbJ4h+sNOaksUpYEJUKfN65YWC6Bw2OJEFiKxq8nQ==
-  dependencies:
-    bare-path "^3.0.0"
-
 base64-arraybuffer@^1.0.2:
   version "1.0.2"
   resolved "https://registry.npmmirror.com/base64-arraybuffer/-/base64-arraybuffer-1.0.2.tgz#1c37589a7c4b0746e34bd1feb951da2df01c1bdc"
   integrity sha512-I3yl4r9QB5ZRY3XuJVEPfc2XhZO6YweFPI+UovAzn+8/hb3oJ6lnysaFcjVpkCPfVWFUDvoZ8kmVDP7WyRtYtQ==
 
-base64-js@^1.0.2, base64-js@^1.3.0, base64-js@^1.3.1, base64-js@^1.5.1:
+base64-js@^1.0.2, base64-js@^1.3.1, base64-js@^1.5.1:
   version "1.5.1"
   resolved "https://registry.npmmirror.com/base64-js/-/base64-js-1.5.1.tgz#1b1b440160a5bf7ad40b650f095963481903930a"
   integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==
@@ -13342,11 +13115,6 @@ buffer-indexof-polyfill@~1.0.0:
   resolved "https://registry.npmmirror.com/buffer-indexof-polyfill/-/buffer-indexof-polyfill-1.0.2.tgz#d2732135c5999c64b277fcf9b1abe3498254729c"
   integrity sha512-I7wzHwA3t1/lwXQh+A5PbNvJxgfo5r3xulgpYDB5zckTu/Z9oUK9biouBKQUjEqzaz3HnAT6TYoovmE+GqSf7A==
 
-buffer-more-ints@~1.0.0:
-  version "1.0.0"
-  resolved "https://registry.npmjs.org/buffer-more-ints/-/buffer-more-ints-1.0.0.tgz#ef4f8e2dddbad429ed3828a9c55d44f05c611422"
-  integrity sha512-EMetuGFz5SLsT0QTnXzINh4Ksr+oo4i+UGTXEshiGCQWnsgSs7ZhJ8fzlwQ+OzEMs0MpDAMr1hxnblp5a4vcHg==
-
 buffer-writer@2.0.0:
   version "2.0.0"
   resolved "https://registry.npmmirror.com/buffer-writer/-/buffer-writer-2.0.0.tgz#ce7eb81a38f7829db09c873f2fbb792c0c98ec04"
@@ -13694,17 +13462,6 @@ capture-stack-trace@^1.0.0:
   resolved "https://registry.npmmirror.com/capture-stack-trace/-/capture-stack-trace-1.0.2.tgz#1c43f6b059d4249e7f3f8724f15f048b927d3a8a"
   integrity sha512-X/WM2UQs6VMHUtjUDnZTRI+i1crWteJySFzr9UpGoQa4WQffXVTTXuekjl7TjZRlcF2XfjgITT0HxZ9RnxeT0w==
 
-carbone@^3.5.6:
-  version "3.8.2"
-  resolved "https://registry.npmjs.org/carbone/-/carbone-3.8.2.tgz#6e39b457b1e9b266cf77713fdf3e4646a62b9b73"
-  integrity sha512-ejuZ//MywH4uTIhWPIqSOEWLq9y2s3kPadoOh92rZZCNkYg31y8mpPaQT4rZb6oGmaclLDvOW6Ye0iACVH+c+w==
-  dependencies:
-    dayjs "=1.11.20"
-    debug "=4.4.3"
-    which "=6.0.1"
-    yauzl "=2.10.0"
-    yazl "=2.5.1"
-
 caseless@~0.12.0:
   version "0.12.0"
   resolved "https://registry.npmmirror.com/caseless/-/caseless-0.12.0.tgz#1b681c21ff84033c826543090689420d187151dc"
@@ -14492,16 +14249,6 @@ compress-commons@^4.1.2:
     normalize-path "^3.0.0"
     readable-stream "^3.6.0"
 
-compress-commons@^5.0.1:
-  version "5.0.3"
-  resolved "https://registry.npmjs.org/compress-commons/-/compress-commons-5.0.3.tgz#36b6572fdfc220c88c9c939b48667818806667e9"
-  integrity sha512-/UIcLWvwAQyVibgpQDPtfNM3SvqN7G9elAPAV7GM0L53EbNWwWiCsWtK8Fwed/APEbptPHXs5PuW+y8Bq8lFTA==
-  dependencies:
-    crc-32 "^1.2.0"
-    crc32-stream "^5.0.0"
-    normalize-path "^3.0.0"
-    readable-stream "^3.6.0"
-
 compressible@~2.0.16, compressible@~2.0.18:
   version "2.0.18"
   resolved "https://registry.npmmirror.com/compressible/-/compressible-2.0.18.tgz#af53cca6b070d4c3c0750fbd77286a6d7cc46fba"
@@ -14896,11 +14643,6 @@ core-js-pure@^3.23.3:
   resolved "https://registry.npmmirror.com/core-js-pure/-/core-js-pure-3.34.0.tgz#981e462500708664c91b827a75b011f04a8134a0"
   integrity sha512-pmhivkYXkymswFfbXsANmBAewXx86UBfmagP+w0wkK06kLsLlTK5oQmsURPivzMkIBQiYq2cjamcZExIwlFQIg==
 
-core-js-pure@^3.48.0:
-  version "3.49.0"
-  resolved "https://registry.npmjs.org/core-js-pure/-/core-js-pure-3.49.0.tgz#ff8436b7251a3832f5fdbbe3e10f7f2e58e51fb1"
-  integrity sha512-XM4RFka59xATyJv/cS3O3Kml72hQXUeGRuuTmMYFxwzc9/7C8OYTaIR/Ji+Yt8DXzsFLNhat15cE/JP15HrCgw==
-
 core-js@3.28.0:
   version "3.28.0"
   resolved "https://registry.npmmirror.com/core-js/-/core-js-3.28.0.tgz#ed8b9e99c273879fdfff0edfc77ee709a5800e4a"
@@ -15011,14 +14753,6 @@ crc32-stream@^4.0.2:
     crc-32 "^1.2.0"
     readable-stream "^3.4.0"
 
-crc32-stream@^5.0.0:
-  version "5.0.1"
-  resolved "https://registry.npmjs.org/crc32-stream/-/crc32-stream-5.0.1.tgz#bc1581c9a9022a9242605dc91b14e069e3aa87a5"
-  integrity sha512-lO1dFui+CEUh/ztYIpgpKItKW9Bb4NWakCRJrnqAbFIYD+OZAwb2VfD5T5eXMw2FNcsDHkQcNl/Wh3iVXYwU6g==
-  dependencies:
-    crc-32 "^1.2.0"
-    readable-stream "^3.4.0"
-
 create-ecdh@^4.0.0, create-ecdh@^4.0.4:
   version "4.0.4"
   resolved "https://registry.npmmirror.com/create-ecdh/-/create-ecdh-4.0.4.tgz#d6e7f4bffa66736085a0762fd3a632684dabcc4e"
@@ -15907,12 +15641,7 @@ dateformat@^3.0.0:
   resolved "https://registry.npmmirror.com/dateformat/-/dateformat-3.0.3.tgz#a6e37499a4d9a9cf85ef5872044d62901c9889ae"
   integrity sha512-jyCETtSl3VMZMWeRo7iY1FL19ges1t55hMo5yaam4Jrsm5EPL89UQkoQRyiI+Yf4k8r2ZpdngkV8hr1lIdjb3Q==
 
-dayjs-timezone-iana-plugin@0.1.0:
-  version "0.1.0"
-  resolved "https://registry.npmjs.org/dayjs-timezone-iana-plugin/-/dayjs-timezone-iana-plugin-0.1.0.tgz#216613f6ec80106ab8be025cf5935018c901e997"
-  integrity sha512-xc8cIZmi4oKr2nfu41I/FDWZKa8n8YaRMxSz9MrpXTNo8c6ZsjZuIoy5RPNmLXPqntFuITWI8obB7lUA+CdzGQ==
-
-dayjs@1.11.13, dayjs@=1.11.20, dayjs@^1.11.10, dayjs@^1.11.11, dayjs@^1.11.7, dayjs@^1.11.8, dayjs@^1.11.9, dayjs@^1.8.34, dayjs@^1.9.1, dayjs@~1.11.13, dayjs@~1.8.24:
+dayjs@1.11.13, dayjs@^1.11.10, dayjs@^1.11.11, dayjs@^1.11.7, dayjs@^1.11.8, dayjs@^1.11.9, dayjs@^1.8.34, dayjs@^1.9.1, dayjs@~1.11.13, dayjs@~1.8.24:
   version "1.11.13"
   resolved "https://registry.npmmirror.com/dayjs/-/dayjs-1.11.13.tgz#92430b0139055c3ebb60150aa13e860a4b5a366c"
   integrity sha512-oaMBel6gjolK862uaPQOVTA7q3TZhuSvuMQAAglQDOWYO9A91IrAOUJEyKVlqJlHE0vq5p5UXxzdPfMH/x6xNg==
@@ -15957,13 +15686,6 @@ debug@4.3.4:
   dependencies:
     ms "2.1.2"
 
-debug@=4.4.3, debug@^4.4.3:
-  version "4.4.3"
-  resolved "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz#c6ae432d9bd9662582fce08709b038c58e9e3d6a"
-  integrity sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==
-  dependencies:
-    ms "^2.1.3"
-
 debug@^3.1.0, debug@^3.2.6, debug@^3.2.7:
   version "3.2.7"
   resolved "https://registry.npmmirror.com/debug/-/debug-3.2.7.tgz#72580b7e9145fb39b6676f9c5e5fb100b934179a"
@@ -15985,6 +15707,13 @@ debug@^4.4.0:
   dependencies:
     ms "^2.1.3"
 
+debug@^4.4.3:
+  version "4.4.3"
+  resolved "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz#c6ae432d9bd9662582fce08709b038c58e9e3d6a"
+  integrity sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==
+  dependencies:
+    ms "^2.1.3"
+
 debug@~4.3.2, debug@~4.3.4:
   version "4.3.7"
   resolved "https://registry.npmmirror.com/debug/-/debug-4.3.7.tgz#87945b4151a011d76d95a198d7111c865c360a52"
@@ -16435,13 +16164,6 @@ dingbat-to-unicode@^1.0.1:
   resolved "https://registry.npmjs.org/dingbat-to-unicode/-/dingbat-to-unicode-1.0.1.tgz#5091dd673241453e6b5865e26e5a4452cdef5c83"
   integrity sha512-98l0sW87ZT58pU4i61wa2OHwxbiYSbuxsCBozaVnYX2iCnr3bLM3fIes1/ej7h1YdOKuKt/MLs706TVnALA65w==
 
-dingtalk-jsapi@3.1.1:
-  version "3.1.1"
-  resolved "https://registry.npmjs.org/dingtalk-jsapi/-/dingtalk-jsapi-3.1.1.tgz#bf0f978aa9f23efc0140845f0f010f3662e1311b"
-  integrity sha512-Xwt4kv6EZEf5MZWR42yzIHKI95e+Hlqz6X6tcjCiLIyTN8crA87lgs5s3beN7epwCRHcPUyQ7vVm5Q/H3hiUCQ==
-  dependencies:
-    promise-polyfill "^7.1.0"
-
 dir-glob@^3.0.1:
   version "3.0.1"
   resolved "https://registry.npmmirror.com/dir-glob/-/dir-glob-3.0.1.tgz#56dbf73d992a4a93ba1584f4534063fd2e41717f"
@@ -16529,7 +16251,7 @@ domain-browser@^5.7.0:
   resolved "https://registry.npmjs.org/domain-browser/-/domain-browser-5.7.0.tgz#81b942459672e3c7ed8f721fe31135a5628f31cf"
   integrity sha512-edTFu0M/7wO1pXY6GDxVNVW086uqwWYIHP98txhcPyV995X21JIH2DtYp33sQJOupYoXKe9RwTw2Ya2vWaquTQ==
 
-domelementtype@1, domelementtype@^1.3.1:
+domelementtype@1:
   version "1.3.1"
   resolved "https://registry.npmmirror.com/domelementtype/-/domelementtype-1.3.1.tgz#d048c44b37b0d10a7f2a3d5fee3f4333d790481f"
   integrity sha512-BSKB+TSpMpFI/HOxCNr1O8aMOTZ8hT3pM3GQ0w/mWRmkhEDSFJkkyzz4XQsBV44BChwGkrDfMyjVD0eA2aFV3w==
@@ -16546,13 +16268,6 @@ domhandler@2.3:
   dependencies:
     domelementtype "1"
 
-domhandler@^2.3.0:
-  version "2.4.2"
-  resolved "https://registry.npmjs.org/domhandler/-/domhandler-2.4.2.tgz#8805097e933d65e85546f726d60f5eb88b44f803"
-  integrity sha512-JiK04h0Ht5u/80fdLMCEmV4zkNh2BcoMFBmZ/91WtYZ8qVXSKjiw7fXMgFPnHcSZgOo3XdinHvmnDUeMf5R4wA==
-  dependencies:
-    domelementtype "1"
-
 domhandler@^4.0.0, domhandler@^4.2.0, domhandler@^4.3.1:
   version "4.3.1"
   resolved "https://registry.npmmirror.com/domhandler/-/domhandler-4.3.1.tgz#8d792033416f59d68bc03a5aa7b018c1ca89279c"
@@ -16587,7 +16302,7 @@ domutils@1.5:
     dom-serializer "0"
     domelementtype "1"
 
-domutils@^1.5.1, domutils@^1.7.0:
+domutils@^1.7.0:
   version "1.7.0"
   resolved "https://registry.npmmirror.com/domutils/-/domutils-1.7.0.tgz#56ea341e834e06e6748af7a1cb25da67ea9f8c2a"
   integrity sha512-Lgd2XcJ/NjEw+7tFvfKxOzCYKZsdct5lczQ2ZaQY8Djz7pfAD3Gbp8ySJWtreII/vDlMVmxwa6pHmdxIYgttDg==
@@ -16825,7 +16540,7 @@ ecc-jsbn@~0.1.1:
     jsbn "~0.1.0"
     safer-buffer "^2.1.0"
 
-ecdsa-sig-formatter@1.0.11, ecdsa-sig-formatter@^1.0.11:
+ecdsa-sig-formatter@1.0.11:
   version "1.0.11"
   resolved "https://registry.npmmirror.com/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.11.tgz#ae0f0fa2d85045ef14a817daa3ce9acd0489e5bf"
   integrity sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ==
@@ -17062,12 +16777,7 @@ entities@1.0:
   resolved "https://registry.npmjs.org/entities/-/entities-1.0.0.tgz#b2987aa3821347fcde642b24fdfc9e4fb712bf26"
   integrity sha512-LbLqfXgJMmy81t+7c14mnulFHJ170cM6E+0vMXR9k/ZiZwgX8i5pNgjTCX3SO4VeUsFLV+8InixoretwU+MjBQ==
 
-entities@^1.1.1:
-  version "1.1.2"
-  resolved "https://registry.npmjs.org/entities/-/entities-1.1.2.tgz#bdfa735299664dfafd34529ed4f8522a275fea56"
-  integrity sha512-f2LZMYl1Fzu7YSBKg+RoROelpOaNrcGmE9AZubeDfrCEia483oW4MI4VyFd5VNHIgQ/7qm1I0wUHK1eJnn2y2w==
-
-entities@^2.0.0, entities@^2.2.0:
+entities@^2.0.0:
   version "2.2.0"
   resolved "https://registry.npmmirror.com/entities/-/entities-2.2.0.tgz#098dc90ebb83d8dffa089d55256b351d34c4da55"
   integrity sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A==
@@ -18103,13 +17813,6 @@ eventemitter3@^5.0.1:
   resolved "https://registry.npmmirror.com/eventemitter3/-/eventemitter3-5.0.1.tgz#53f5ffd0a492ac800721bb42c66b841de96423c4"
   integrity sha512-GWkBvjiSZK87ELrYOSESUYeVIc9mvLLf/nXalMOS5dYrgZq9o5OVkbZAVM06CVxYsCwH9BDZFPlQTlPA1j4ahA==
 
-events-universal@^1.0.0:
-  version "1.0.1"
-  resolved "https://registry.npmjs.org/events-universal/-/events-universal-1.0.1.tgz#b56a84fd611b6610e0a2d0f09f80fdf931e2dfe6"
-  integrity sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw==
-  dependencies:
-    bare-events "^2.7.0"
-
 events@3.3.0, events@^3.0.0, events@^3.3.0:
   version "3.3.0"
   resolved "https://registry.npmmirror.com/events/-/events-3.3.0.tgz#31a95ad0a924e2d2c419a813aeb2c4e878ea7400"
@@ -18389,13 +18092,6 @@ extsprintf@^1.2.0:
   resolved "https://registry.npmmirror.com/extsprintf/-/extsprintf-1.4.1.tgz#8d172c064867f235c0c84a596806d279bf4bcc07"
   integrity sha512-Wrk35e8ydCKDj/ArClo1VrPVmN8zph5V4AtHwIuHhvMXsKf73UT3BOD+azBIW+3wOJ4FhEH7zyaJCFvChjYvMA==
 
-fast-check@^3.15.0:
-  version "3.23.2"
-  resolved "https://registry.npmjs.org/fast-check/-/fast-check-3.23.2.tgz#0129f1eb7e4f500f58e8290edc83c670e4a574a2"
-  integrity sha512-h5+1OzzfCC3Ef7VbtKdcv7zsstUQwUDlYpUTvjeUsJAssPgLn7QzbboPtL5ro04Mq0rPOsMzl7q5hIbRs2wD1A==
-  dependencies:
-    pure-rand "^6.1.0"
-
 fast-csv@^4.3.1:
   version "4.3.6"
   resolved "https://registry.npmmirror.com/fast-csv/-/fast-csv-4.3.6.tgz#70349bdd8fe4d66b1130d8c91820b64a21bc4a63"
@@ -18419,7 +18115,7 @@ fast-diff@^1.1.2:
   resolved "https://registry.npmmirror.com/fast-diff/-/fast-diff-1.3.0.tgz#ece407fa550a64d638536cd727e129c61616e0f0"
   integrity sha512-VxPP4NqbUjj6MaAOafWeUn2cXWLcCtljklUtZf0Ind4XQ+QPtmA0b18zZy0jIQx+ExRVCR/ZQpBmik5lXshNsw==
 
-fast-fifo@^1.1.0, fast-fifo@^1.2.0, fast-fifo@^1.3.2:
+fast-fifo@^1.1.0, fast-fifo@^1.2.0:
   version "1.3.2"
   resolved "https://registry.npmmirror.com/fast-fifo/-/fast-fifo-1.3.2.tgz#286e31de96eb96d38a97899815740ba2a4f3640c"
   integrity sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==
@@ -19288,26 +18984,6 @@ gauge@~2.7.3:
     strip-ansi "^3.0.1"
     wide-align "^1.1.0"
 
-gaxios@^6.0.0, gaxios@^6.0.3, gaxios@^6.1.1:
-  version "6.7.1"
-  resolved "https://registry.npmjs.org/gaxios/-/gaxios-6.7.1.tgz#ebd9f7093ede3ba502685e73390248bb5b7f71fb"
-  integrity sha512-LDODD4TMYx7XXdpwxAVRAIAuB0bzv0s+ywFonY46k126qzQHT9ygyoa9tncmOiQmmDrik65UYsEkv3lbfqQ3yQ==
-  dependencies:
-    extend "^3.0.2"
-    https-proxy-agent "^7.0.1"
-    is-stream "^2.0.0"
-    node-fetch "^2.6.9"
-    uuid "^9.0.1"
-
-gcp-metadata@^6.1.0:
-  version "6.1.1"
-  resolved "https://registry.npmjs.org/gcp-metadata/-/gcp-metadata-6.1.1.tgz#f65aa69f546bc56e116061d137d3f5f90bdec494"
-  integrity sha512-a4tiq7E0/5fTjxPAaH4jpjkSv/uCaU2p5KC6HVGrvl0cDjA8iBZv4vv1gyzlmK0ZUKqwpOyQMKzZQe3lTit77A==
-  dependencies:
-    gaxios "^6.1.1"
-    google-logging-utils "^0.0.2"
-    json-bigint "^1.0.0"
-
 generate-function@^2.3.1:
   version "2.3.1"
   resolved "https://registry.npmmirror.com/generate-function/-/generate-function-2.3.1.tgz#f069617690c10c868e73b8465746764f97c3479f"
@@ -19692,7 +19368,7 @@ glob@^7.1.1, glob@^7.1.2, glob@^7.1.3, glob@^7.1.4, glob@^7.1.6, glob@^7.2.3, gl
     once "^1.3.0"
     path-is-absolute "^1.0.0"
 
-glob@^8.0.0, glob@^8.0.3:
+glob@^8.0.3:
   version "8.1.0"
   resolved "https://registry.npmmirror.com/glob/-/glob-8.1.0.tgz#d388f656593ef708ee3e34640fdfb99a9fd1c33e"
   integrity sha512-r8hpEjiQEYlF2QU0df3dS+nxxSIreXQS1qRhMJM0Q5NDdR386C7jb7Hwwod8Fgiuex+k0GFjgft18yvxm5XoCQ==
@@ -19783,35 +19459,6 @@ globby@^13.1.2:
     merge2 "^1.4.1"
     slash "^4.0.0"
 
-google-auth-library@^9.14.2, google-auth-library@^9.7.0:
-  version "9.15.1"
-  resolved "https://registry.npmjs.org/google-auth-library/-/google-auth-library-9.15.1.tgz#0c5d84ed1890b2375f1cd74f03ac7b806b392928"
-  integrity sha512-Jb6Z0+nvECVz+2lzSMt9u98UsoakXxA2HGHMCxh+so3n90XgYWkq5dur19JAJV7ONiJY22yBTyJB1TSkvPq9Ng==
-  dependencies:
-    base64-js "^1.3.0"
-    ecdsa-sig-formatter "^1.0.11"
-    gaxios "^6.1.1"
-    gcp-metadata "^6.1.0"
-    gtoken "^7.0.0"
-    jws "^4.0.0"
-
-google-logging-utils@^0.0.2:
-  version "0.0.2"
-  resolved "https://registry.npmjs.org/google-logging-utils/-/google-logging-utils-0.0.2.tgz#5fd837e06fa334da450433b9e3e1870c1594466a"
-  integrity sha512-NEgUnEcBiP5HrPzufUkBzJOD/Sxsco3rLNo1F1TNf7ieU8ryUzBhqba8r756CjLX7rn3fHl6iLEwPYuqpoKgQQ==
-
-googleapis-common@^7.0.0:
-  version "7.2.0"
-  resolved "https://registry.npmjs.org/googleapis-common/-/googleapis-common-7.2.0.tgz#5c19102c9af1e5d27560be5e69ee2ccf68755d42"
-  integrity sha512-/fhDZEJZvOV3X5jmD+fKxMqma5q2Q9nZNSF3kn1F18tpxmA86BcTxAGBQdM0N89Z3bEaIs+HVznSmFJEAmMTjA==
-  dependencies:
-    extend "^3.0.2"
-    gaxios "^6.0.3"
-    google-auth-library "^9.7.0"
-    qs "^6.7.0"
-    url-template "^2.0.8"
-    uuid "^9.0.0"
-
 gopd@^1.0.1:
   version "1.0.1"
   resolved "https://registry.npmmirror.com/gopd/-/gopd-1.0.1.tgz#29ff76de69dac7489b7c0918a5788e56477c332c"
@@ -19890,14 +19537,6 @@ gray-matter@^4.0.3:
     section-matter "^1.0.0"
     strip-bom-string "^1.0.0"
 
-gtoken@^7.0.0:
-  version "7.1.0"
-  resolved "https://registry.npmjs.org/gtoken/-/gtoken-7.1.0.tgz#d61b4ebd10132222817f7222b1e6064bd463fc26"
-  integrity sha512-pCcEwRi+TKpMlxAQObHDQ56KawURgyAf6jtIY046fJ5tIv3zDe/LEIubckAO8fj6JnAxLdmWkUfNyulQ2iKdEw==
-  dependencies:
-    gaxios "^6.0.0"
-    jws "^4.0.0"
-
 gzip-size@^6.0.0:
   version "6.0.0"
   resolved "https://registry.npmmirror.com/gzip-size/-/gzip-size-6.0.0.tgz#065367fd50c239c0671cbcbad5be3e2eeb10e462"
@@ -20616,18 +20255,6 @@ htmlparser2@3.8.x:
     entities "1.0"
     readable-stream "1.1"
 
-htmlparser2@^3.9.0:
-  version "3.10.1"
-  resolved "https://registry.npmjs.org/htmlparser2/-/htmlparser2-3.10.1.tgz#bd679dc3f59897b6a34bb10749c855bb53a9392f"
-  integrity sha512-IgieNijUMbkDovyoKObU1DUhm1iwNYE/fuifEoEHfd1oZKZDaONBSkal7Y01shxsM49R4XaMdGez3WnF9UfiCQ==
-  dependencies:
-    domelementtype "^1.3.1"
-    domhandler "^2.3.0"
-    domutils "^1.5.1"
-    entities "^1.1.1"
-    inherits "^2.0.1"
-    readable-stream "^3.1.1"
-
 htmlparser2@^6.1.0:
   version "6.1.0"
   resolved "https://registry.npmmirror.com/htmlparser2/-/htmlparser2-6.1.0.tgz#c4d762b6c3371a05dbe65e94ae43a9f845fb8fb7"
@@ -20786,7 +20413,7 @@ https-proxy-agent@^5.0.0:
     agent-base "6"
     debug "4"
 
-https-proxy-agent@^7.0.0, https-proxy-agent@^7.0.1, https-proxy-agent@^7.0.3:
+https-proxy-agent@^7.0.0, https-proxy-agent@^7.0.3:
   version "7.0.6"
   resolved "https://registry.npmmirror.com/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz#da8dfeac7da130b05c2ba4b59c9b6cd66611a6b9"
   integrity sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==
@@ -22028,11 +21655,6 @@ isexe@^2.0.0:
   resolved "https://registry.npmmirror.com/isexe/-/isexe-2.0.0.tgz#e8fbf374dc556ff8947a10dcb0572d633f2cfa10"
   integrity sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==
 
-isexe@^4.0.0:
-  version "4.0.0"
-  resolved "https://registry.npmjs.org/isexe/-/isexe-4.0.0.tgz#48f6576af8e87a18feb796b7ed5e2e5903b43dca"
-  integrity sha512-FFUtZMpoZ8RqHS3XeXEmHWLA4thH+ZxCv2lOiPIn1Xc7CxrqhWzNSDzD+/chS/zbYezmiwWLdQC09JdQKmthOw==
-
 isobject@^0.2.0:
   version "0.2.0"
   resolved "https://registry.npmmirror.com/isobject/-/isobject-0.2.0.tgz#a3432192f39b910b5f02cc989487836ec70aa85e"
@@ -22295,11 +21917,6 @@ joi@^17.13.3:
     "@sideway/formula" "^3.0.1"
     "@sideway/pinpoint" "^2.0.0"
 
-jose@^4.15.9:
-  version "4.15.9"
-  resolved "https://registry.npmjs.org/jose/-/jose-4.15.9.tgz#9b68eda29e9a0614c042fa29387196c7dd800100"
-  integrity sha512-1vUQX+IdDMVPj4k8kOxgUqlcK518yluMuGZwqlr44FS1ppZB/5GWh4rZG89erpOBOJjU/OBsnCVFfapsRz6nEA==
-
 jose@^6.1.3, jose@^6.2.0, jose@^6.2.1:
   version "6.2.2"
   resolved "https://registry.npmjs.org/jose/-/jose-6.2.2.tgz#d6b5279b89b3e88d531c202e3fbe351f39a44aac"
@@ -22315,11 +21932,6 @@ js-base64@^2.5.2:
   resolved "https://registry.npmmirror.com/js-base64/-/js-base64-2.6.4.tgz#f4e686c5de1ea1f867dbcad3d46d969428df98c4"
   integrity sha512-pZe//GGmwJndub7ZghVHz7vjb2LgC1m8B07Au3eYqeqv9emhESByMXxaEgkUkEqJe87oBbSniGYoQNIBklc7IQ==
 
-js-base64@^3.7.5:
-  version "3.7.8"
-  resolved "https://registry.npmjs.org/js-base64/-/js-base64-3.7.8.tgz#af44496bc09fa178ed9c4adf67eb2b46f5c6d2a4"
-  integrity sha512-hNngCeKxIUQiEUN3GPJOkz4wF/YvdUdbNL9hsBcMQTkKzboD7T/q3OYOuuPZLUE6dBxSGpwhk5mwuDud7JVAow==
-
 js-cookie@^2.x.x:
   version "2.2.1"
   resolved "https://registry.npmmirror.com/js-cookie/-/js-cookie-2.2.1.tgz#69e106dc5d5806894562902aa5baec3744e9b2b8"
@@ -22772,7 +22384,7 @@ jws@^3.2.2:
     jwa "^1.4.1"
     safe-buffer "^5.0.1"
 
-jws@^4.0.0, jws@^4.0.1:
+jws@^4.0.1:
   version "4.0.1"
   resolved "https://registry.npmjs.org/jws/-/jws-4.0.1.tgz#07edc1be8fac20e677b283ece261498bd38f0690"
   integrity sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==
@@ -22999,26 +22611,6 @@ lazystream@^1.0.0:
   dependencies:
     readable-stream "^2.0.5"
 
-ldapjs@^3.0.7:
-  version "3.0.7"
-  resolved "https://registry.npmjs.org/ldapjs/-/ldapjs-3.0.7.tgz#c69fe2965bc50a747bce834f8183f1f77c3be75d"
-  integrity sha512-1ky+WrN+4CFMuoekUOv7Y1037XWdjKpu0xAPwSP+9KdvmV9PG+qOKlssDV6a+U32apwxdD3is/BZcWOYzN30cg==
-  dependencies:
-    "@ldapjs/asn1" "^2.0.0"
-    "@ldapjs/attribute" "^1.0.0"
-    "@ldapjs/change" "^1.0.0"
-    "@ldapjs/controls" "^2.1.0"
-    "@ldapjs/dn" "^1.1.0"
-    "@ldapjs/filter" "^2.1.1"
-    "@ldapjs/messages" "^1.3.0"
-    "@ldapjs/protocol" "^1.2.1"
-    abstract-logging "^2.0.1"
-    assert-plus "^1.0.0"
-    backoff "^2.5.0"
-    once "^1.4.0"
-    vasync "^2.2.1"
-    verror "^1.10.1"
-
 leac@^0.6.0:
   version "0.6.0"
   resolved "https://registry.npmmirror.com/leac/-/leac-0.6.0.tgz#dcf136e382e666bd2475f44a1096061b70dc0912"
@@ -25206,16 +24798,6 @@ mimer@1.1.0:
   resolved "https://registry.npmmirror.com/mimer/-/mimer-1.1.0.tgz#2cb67f7093998e772a0e62c090f77daa1b8a2dbe"
   integrity sha512-y9dVfy2uiycQvDNiAYW6zp49ZhFlXDMr5wfdOiMbdzGM/0N5LNR6HTUn3un+WUQcM0koaw8FMTG1bt5EnHJdvQ==
 
-mimetext@3.0.24:
-  version "3.0.24"
-  resolved "https://registry.npmjs.org/mimetext/-/mimetext-3.0.24.tgz#128d08236c107f346cc8a250a37c2cb676eac554"
-  integrity sha512-UdG1KVfcxeEfo6el91lzFG2WLLTm8DxSK/rosxx5H2Pjla50+DSsjTgr9BRAfAkbQWaxvzcaTO+bHK5ZrdKdfA==
-  dependencies:
-    "@babel/runtime" "^7.15.4"
-    "@babel/runtime-corejs3" "^7.15.4"
-    js-base64 "^3.7.5"
-    mime-types "^2.1.35"
-
 mimic-fn@^1.0.0:
   version "1.2.0"
   resolved "https://registry.npmmirror.com/mimic-fn/-/mimic-fn-1.2.0.tgz#820c86a39334640e99516928bd03fca88057d022"
@@ -25724,11 +25306,6 @@ nano-memoize@^3.0.16:
   resolved "https://registry.npmmirror.com/nano-memoize/-/nano-memoize-3.0.16.tgz#454100602713973ac8639bde301e255dd54920ea"
   integrity sha512-JyK96AKVGAwVeMj3MoMhaSXaUNqgMbCRSQB3trUV8tYZfWEzqUBKdK1qJpfuNXgKeHOx1jv/IEYTM659ly7zUA==
 
-nanoid@3.3.4:
-  version "3.3.4"
-  resolved "https://registry.npmjs.org/nanoid/-/nanoid-3.3.4.tgz#730b67e3cd09e2deacf03c027c81c9d9dbc5e8ab"
-  integrity sha512-MqBkQh/OHTS2egovRtLk45wEyNXwF+cokD+1YPf9u5VfJiRdAiRwB2froX5Co9Rh20xs4siNPm8naNotSD6RBw==
-
 nanoid@^2.1.0:
   version "2.1.11"
   resolved "https://registry.npmmirror.com/nanoid/-/nanoid-2.1.11.tgz#ec24b8a758d591561531b4176a01e3ab4f0f0280"
@@ -25857,7 +25434,7 @@ node-fetch-npm@^2.0.2:
     json-parse-better-errors "^1.0.0"
     safe-buffer "^5.1.1"
 
-node-fetch@^2.2.0, node-fetch@^2.6.1, node-fetch@^2.6.12, node-fetch@^2.6.7, node-fetch@^2.6.9:
+node-fetch@^2.2.0, node-fetch@^2.6.1, node-fetch@^2.6.12, node-fetch@^2.6.7:
   version "2.7.0"
   resolved "https://registry.npmmirror.com/node-fetch/-/node-fetch-2.7.0.tgz#d0f0fa6e3e2dc1d27efcd8ad99d550bda94d187d"
   integrity sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==
@@ -26238,11 +25815,6 @@ object-assign@^4, object-assign@^4.0.1, object-assign@^4.1.0, object-assign@^4.1
   resolved "https://registry.npmmirror.com/object-assign/-/object-assign-4.1.1.tgz#2109adc7965887cfc05cbbd442cac8bfbb360863"
   integrity sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==
 
-object-hash@^2.2.0:
-  version "2.2.0"
-  resolved "https://registry.npmjs.org/object-hash/-/object-hash-2.2.0.tgz#5ad518581eefc443bd763472b8ff2e9c2c0d54a5"
-  integrity sha512-gScRMn0bS5fH+IuwyIFgnh9zBdo4DV+6GhygmWM9HyNJSgS0hScp1f5vjtm7oIIOiT9trXrShAkLFSc2IqKNgw==
-
 object-hash@^3.0.0:
   version "3.0.0"
   resolved "https://registry.npmmirror.com/object-hash/-/object-hash-3.0.0.tgz#73f97f753e7baffc0e2cc9d6e079079744ac82e9"
@@ -26431,11 +26003,6 @@ oidc-provider@~9.7.0:
     raw-body "^3.0.2"
     undici "^7.22.0"
 
-oidc-token-hash@^5.0.3:
-  version "5.2.0"
-  resolved "https://registry.npmjs.org/oidc-token-hash/-/oidc-token-hash-5.2.0.tgz#be8a8885c7e2478d21a674e15afa31f1bcc4a61f"
-  integrity sha512-6gj2m8cJZ+iSW8bm0FXdGF0YhIQbKrfP4yWTNzxc31U6MOjfEmB1rHvlYvxI1B7t7BCi1F2vYTT6YhtQRG4hxw==
-
 ollama@^0.6.3:
   version "0.6.3"
   resolved "https://registry.npmmirror.com/ollama/-/ollama-0.6.3.tgz#b188573dd0ccb3b4759c1f8fa85067cb17f6673c"
@@ -26600,16 +26167,6 @@ opener@^1.5.2:
   resolved "https://registry.npmmirror.com/opener/-/opener-1.5.2.tgz#5d37e1f35077b9dcac4301372271afdeb2a13598"
   integrity sha512-ur5UIdyw5Y7yEj9wLzhqXiy6GZ3Mwx0yGI+5sMn2r0N0v3cKJvUmFH5yPP+WXh9e0xfyzyJX95D8l088DNFj7A==
 
-openid-client@^5.4.2:
-  version "5.7.1"
-  resolved "https://registry.npmjs.org/openid-client/-/openid-client-5.7.1.tgz#34cace862a3e6472ed7d0a8616ef73b7fb85a9c3"
-  integrity sha512-jDBPgSVfTnkIh71Hg9pRvtJc6wTwqjRkN88+gCFtYWrlP4Yx2Dsrow8uPi3qLr/aeymPF3o2+dS+wOpglK04ew==
-  dependencies:
-    jose "^4.15.9"
-    lru-cache "^6.0.0"
-    object-hash "^2.2.0"
-    oidc-token-hash "^5.0.3"
-
 opt-cli@1.5.1:
   version "1.5.1"
   resolved "https://registry.npmjs.org/opt-cli/-/opt-cli-1.5.1.tgz#04db447b13c96b992eb31685266f4ed0d9736dc2"
@@ -26689,11 +26246,6 @@ ora@^8.2.0:
     string-width "^7.2.0"
     strip-ansi "^7.1.0"
 
-oracledb@6.10.0:
-  version "6.10.0"
-  resolved "https://registry.npmjs.org/oracledb/-/oracledb-6.10.0.tgz#a54f699547e7dfc1f2ecb8a72af0423b4e86e51d"
-  integrity sha512-kGUumXmrEWbSpBuKJyb9Ip3rXcNgKK6grunI3/cLPzrRvboZ6ZoLi9JQ+z6M/RIG924tY8BLflihL4CKKQAYMA==
-
 os-browserify@^0.3.0:
   version "0.3.0"
   resolved "https://registry.npmmirror.com/os-browserify/-/os-browserify-0.3.0.tgz#854373c7f5c2315914fc9bfc6bd8238fdda1ec27"
@@ -28511,11 +28063,6 @@ postgres-interval@^1.1.0:
   dependencies:
     xtend "^4.0.0"
 
-precond@0.2:
-  version "0.2.3"
-  resolved "https://registry.npmjs.org/precond/-/precond-0.2.3.tgz#aa9591bcaa24923f1e0f4849d240f47efc1075ac"
-  integrity sha512-QCYG84SgGyGzqJ/vlMsxeXd/pgL/I94ixdNFyh1PusWmTCyVfPJjZ1K1jvHtsbfnXQs2TSkEP2fR7QiMZAnKFQ==
-
 prelude-ls@^1.2.1:
   version "1.2.1"
   resolved "https://registry.npmmirror.com/prelude-ls/-/prelude-ls-1.2.1.tgz#debc6489d7a6e6b0e7611888cec880337d316396"
@@ -28654,11 +28201,6 @@ process-warning@^1.0.0:
   resolved "https://registry.npmmirror.com/process-warning/-/process-warning-1.0.0.tgz#980a0b25dc38cd6034181be4b7726d89066b4616"
   integrity sha512-du4wfLyj4yCZq1VupnVSZmRsPJsNuxoDQFdCFHLaYiEbFBD7QE0a+I4D7hOxrVnh78QE/YipFAj9lXHiXocV+Q==
 
-process-warning@^2.1.0, process-warning@^2.2.0:
-  version "2.3.2"
-  resolved "https://registry.npmjs.org/process-warning/-/process-warning-2.3.2.tgz#70d8a3251aab0eafe3a595d8ae2c5d2277f096a5"
-  integrity sha512-n9wh8tvBe5sFmsqlg+XQhaQLumwpqoAUruLwjCopgTmUBjJ/fjtBsJzKleCaIGBOMXYEhp1YfKl4d7rJ5ZKJGA==
-
 process-warning@^3.0.0:
   version "3.0.0"
   resolved "https://registry.npmmirror.com/process-warning/-/process-warning-3.0.0.tgz#96e5b88884187a1dce6f5c3166d611132058710b"
@@ -28684,11 +28226,6 @@ promise-inflight@^1.0.1:
   resolved "https://registry.npmmirror.com/promise-inflight/-/promise-inflight-1.0.1.tgz#98472870bf228132fcbdd868129bad12c3c029e3"
   integrity sha512-6zWPyEOFaQBJYcGMHBKTKJ3u6TBsnMFOIZSa6ce1e/ZrrsOlnHRHbabMjLiBYKp+n44X9eUI6VUPaukCXHuG4g==
 
-promise-polyfill@^7.1.0:
-  version "7.1.2"
-  resolved "https://registry.npmjs.org/promise-polyfill/-/promise-polyfill-7.1.2.tgz#ab05301d8c28536301622d69227632269a70ca3b"
-  integrity sha512-FuEc12/eKqqoRYIGBrUptCBRhobL19PS2U31vMNTfyck1FxPyMfgsXyW4Mav85y/ZN1hop3hOwRlUDok23oYfQ==
-
 promise-retry@^1.1.1:
   version "1.1.1"
   resolved "https://registry.npmmirror.com/promise-retry/-/promise-retry-1.1.1.tgz#6739e968e3051da20ce6497fb2b50f6911df3d6d"
@@ -28892,11 +28429,6 @@ punycode@^2.1.0, punycode@^2.1.1, punycode@^2.3.1:
   resolved "https://registry.npmmirror.com/punycode/-/punycode-2.3.1.tgz#027422e2faec0b25e1549c3e1bd8309b9133b6e5"
   integrity sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==
 
-pure-rand@^6.1.0:
-  version "6.1.0"
-  resolved "https://registry.npmjs.org/pure-rand/-/pure-rand-6.1.0.tgz#d173cf23258231976ccbdb05247c9787957604f2"
-  integrity sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA==
-
 q@^1.1.2, q@^1.5.1:
   version "1.5.1"
   resolved "https://registry.npmmirror.com/q/-/q-1.5.1.tgz#7e32f75b41381291d04611f1bf14109ac00651d7"
@@ -28932,7 +28464,7 @@ qs@^6.12.3, qs@^6.14.0, qs@^6.14.1:
   dependencies:
     side-channel "^1.1.0"
 
-qs@^6.7.0, qs@~6.15.1:
+qs@~6.15.1:
   version "6.15.2"
   resolved "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz#fd55426d710403ddccc45e0f9eab16db7727ece9"
   integrity sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==
@@ -28944,7 +28476,7 @@ qs@~6.5.2:
   resolved "https://registry.npmmirror.com/qs/-/qs-6.5.3.tgz#3aeeffc91967ef6e35c0e488ef46fb296ab76aad"
   integrity sha512-qxXIEh4pCGfHICj1mAJQ2/2XVZkjCDTcEgfoSQxc/fYivUZxTkk7L3bDBJSoNrEzXI17oUO5Dp07ktqE5KzczA==
 
-query-string@6.14.1, query-string@^6.13.6, query-string@^6.13.8, query-string@^6.9.0:
+query-string@^6.13.6, query-string@^6.13.8, query-string@^6.9.0:
   version "6.14.1"
   resolved "https://registry.npmmirror.com/query-string/-/query-string-6.14.1.tgz#7ac2dca46da7f309449ba0f86b1fd28255b0c86a"
   integrity sha512-XDxAeVmpfu1/6IjyT/gXHOl+S0vQ9owggJ30hhWKdHAsNPOcasn5o9BW0eejZqL2e4vMjhAxoW3jVHcD6mbcYw==
@@ -28959,11 +28491,6 @@ querystring-es3@^0.2.0, querystring-es3@^0.2.1:
   resolved "https://registry.npmmirror.com/querystring-es3/-/querystring-es3-0.2.1.tgz#9ec61f79049875707d69414596fd907a4d711e73"
   integrity sha512-773xhDQnZBMFobEiztv8LIl70ch5MSF/jUQVlhwFyBILqq96anmoctVIYz+ZRp0qbCKATTn6ev02M3r7Ga5vqA==
 
-querystringify@^2.1.1:
-  version "2.2.0"
-  resolved "https://registry.npmjs.org/querystringify/-/querystringify-2.2.0.tgz#3345941b4153cb9d082d8eee4cda2016a9aef7f6"
-  integrity sha512-FIqgj2EUvTa7R50u0rGsyTftzjYmv/a3hO345bZNrqabNqjtgiDMgmo4mkUjd+nzU5oF3dClKqFIPUKybUyqoQ==
-
 queue-microtask@^1.2.2:
   version "1.2.3"
   resolved "https://registry.npmmirror.com/queue-microtask/-/queue-microtask-1.2.3.tgz#4929228bbc724dfac43e0efb058caf7b6cfb6243"
@@ -29094,16 +28621,6 @@ raw-body@2.5.2, raw-body@^2.3.3:
     iconv-lite "0.4.24"
     unpipe "1.0.0"
 
-raw-body@3.0.0:
-  version "3.0.0"
-  resolved "https://registry.npmjs.org/raw-body/-/raw-body-3.0.0.tgz#25b3476f07a51600619dae3fe82ddc28a36e5e0f"
-  integrity sha512-RmkhL8CAyCRPXCE28MMH0z2PNWQBNk2Q09ZdxM9IOOXwxwZbN+qbWaatPkdkWIKL2ZVDImrN/pK5HTRz2PcS4g==
-  dependencies:
-    bytes "3.1.2"
-    http-errors "2.0.0"
-    iconv-lite "0.6.3"
-    unpipe "1.0.0"
-
 raw-body@^3.0.0, raw-body@^3.0.1, raw-body@^3.0.2:
   version "3.0.2"
   resolved "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz#3e3ada5ae5568f9095d84376fd3a49b8fb000a51"
@@ -29763,13 +29280,6 @@ react-hotkeys-hook@^3.4.7:
   dependencies:
     hotkeys-js "3.9.4"
 
-react-html-parser@^2.0.2:
-  version "2.0.2"
-  resolved "https://registry.npmjs.org/react-html-parser/-/react-html-parser-2.0.2.tgz#6dbe1ddd2cebc1b34ca15215158021db5fc5685e"
-  integrity sha512-XeerLwCVjTs3njZcgCOeDUqLgNIt/t+6Jgi5/qPsO/krUWl76kWKXMeVs2LhY2gwM6X378DkhLjur0zUQdpz0g==
-  dependencies:
-    htmlparser2 "^3.9.0"
-
 react-i18next@11.x, react-i18next@^11.15.1:
   version "11.18.6"
   resolved "https://registry.npmmirror.com/react-i18next/-/react-i18next-11.18.6.tgz#e159c2960c718c1314f1e8fcaa282d1c8b167887"
@@ -29927,11 +29437,6 @@ react-refresh@^0.18.0:
   resolved "https://registry.npmjs.org/react-refresh/-/react-refresh-0.18.0.tgz#2dce97f4fe932a4d8142fa1630e475c1729c8062"
   integrity sha512-QgT5//D3jfjJb6Gsjxv0Slpj23ip+HtOpnNgnb2S5zU3CB26G/IDPGoy4RJB42wzFE46DRsstbW6tKHoKbhAxw==
 
-react-resizable-panels@^2.1.6:
-  version "2.1.9"
-  resolved "https://registry.npmjs.org/react-resizable-panels/-/react-resizable-panels-2.1.9.tgz#874847710f4f122df749b5f08ebe9c72a1e338ca"
-  integrity sha512-z77+X08YDIrgAes4jl8xhnUu1LNIRp4+E7cv4xHmLOxxUPO/ML7PSrE813b90vj7xvQ1lcf7g2uA9GeMZonjhQ==
-
 react-router-dom@6.3.0, react-router-dom@6.x, react-router-dom@^6.11.2, react-router-dom@^6.30.1, react-router-dom@^6.x:
   version "6.30.1"
   resolved "https://registry.npmmirror.com/react-router-dom/-/react-router-dom-6.30.1.tgz#da2580c272ddb61325e435478566be9563a4a237"
@@ -29952,14 +29457,6 @@ react-side-effect@^2.1.0:
   resolved "https://registry.npmmirror.com/react-side-effect/-/react-side-effect-2.1.2.tgz#dc6345b9e8f9906dc2eeb68700b615e0b4fe752a"
   integrity sha512-PVjOcvVOyIILrYoyGEpDN3vmYNLdy1CajSFNt4TDsVQC5KpTijDvWVoR+/7Rz2xT978D8/ZtFceXxzsPwZEDvw==
 
-react-signature-canvas@^1.0.6:
-  version "1.0.7"
-  resolved "https://registry.npmjs.org/react-signature-canvas/-/react-signature-canvas-1.0.7.tgz#e1a8870c9f2e84cc9f58c0c4448fd3e7c0d2f256"
-  integrity sha512-yo0x0uTMVmcClaqryuQu6F8xEVapk5zdM9/nuQ7GalDJWccoVNZPMmCFGK7U5r3I0mrEHPB9E5/rFSYUgZcfmA==
-  dependencies:
-    signature_pad "^2.3.2"
-    trim-canvas "^0.1.0"
-
 react-sticky-box@^1.0.2:
   version "1.0.2"
   resolved "https://registry.npmmirror.com/react-sticky-box/-/react-sticky-box-1.0.2.tgz#7e72a0f237bdf8270cec9254337f49519a411174"
@@ -31733,11 +31230,6 @@ signal-exit@^4.0.1, signal-exit@^4.1.0:
   resolved "https://registry.npmmirror.com/signal-exit/-/signal-exit-4.1.0.tgz#952188c1cbd546070e2dd20d0f41c0ae0530cb04"
   integrity sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==
 
-signature_pad@^2.3.2:
-  version "2.3.2"
-  resolved "https://registry.npmjs.org/signature_pad/-/signature_pad-2.3.2.tgz#ca7230021c89cedeead27b33d8d16ff254e5f04a"
-  integrity sha512-peYXLxOsIY6MES2TrRLDiNg2T++8gGbpP2yaC+6Ohtxr+a2dzoaqWosWDY9sWqTAAk6E/TyQO+LJw9zQwyu5kA==
-
 simple-swizzle@^0.2.2:
   version "0.2.2"
   resolved "https://registry.npmmirror.com/simple-swizzle/-/simple-swizzle-0.2.2.tgz#a4da6b635ffcccca33f70d17cb92592de95e557a"
@@ -32358,15 +31850,6 @@ streamsearch@^1.1.0:
   resolved "https://registry.npmmirror.com/streamsearch/-/streamsearch-1.1.0.tgz#404dd1e2247ca94af554e841a8ef0eaa238da764"
   integrity sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==
 
-streamx@^2.12.5, streamx@^2.25.0:
-  version "2.25.0"
-  resolved "https://registry.npmjs.org/streamx/-/streamx-2.25.0.tgz#cc967e99390fda8b918b1eeaf3bc437637c8c7af"
-  integrity sha512-0nQuG6jf1w+wddNEEXCF4nTg3LtufWINB5eFEN+5TNZW7KWJp6x87+JFL43vaAUPyCfH1wID+mNVyW6OHtFamg==
-  dependencies:
-    events-universal "^1.0.0"
-    fast-fifo "^1.3.2"
-    text-decoder "^1.1.0"
-
 streamx@^2.15.0:
   version "2.15.1"
   resolved "https://registry.npmmirror.com/streamx/-/streamx-2.15.1.tgz#396ad286d8bc3eeef8f5cea3f029e81237c024c6"
@@ -33126,16 +32609,6 @@ tar-stream@^2.2.0:
     inherits "^2.0.3"
     readable-stream "^3.1.1"
 
-tar-stream@^3.0.0:
-  version "3.2.0"
-  resolved "https://registry.npmjs.org/tar-stream/-/tar-stream-3.2.0.tgz#0d0064d9b67ea3c9f5abde155e35faab0df37591"
-  integrity sha512-ojzvCvVaNp6aOTFmG7jaRD0meowIAuPc3cMMhSgKiVWws1GyHbGd/xvnyuRKcKlMpt3qvxx6r0hreCNITP9hIg==
-  dependencies:
-    b4a "^1.6.4"
-    bare-fs "^4.5.5"
-    fast-fifo "^1.2.0"
-    streamx "^2.15.0"
-
 tar-stream@^3.1.5:
   version "3.1.6"
   resolved "https://registry.npmmirror.com/tar-stream/-/tar-stream-3.1.6.tgz#6520607b55a06f4a2e2e04db360ba7d338cc5bab"
@@ -33170,18 +32643,6 @@ tar@^6.0.2, tar@^6.1.0:
     mkdirp "^1.0.3"
     yallist "^4.0.0"
 
-tar@^6.1.13:
-  version "6.2.1"
-  resolved "https://registry.npmjs.org/tar/-/tar-6.2.1.tgz#717549c541bc3c2af15751bea94b1dd068d4b03a"
-  integrity sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==
-  dependencies:
-    chownr "^2.0.0"
-    fs-minipass "^2.0.0"
-    minipass "^5.0.0"
-    minizlib "^2.1.1"
-    mkdirp "^1.0.3"
-    yallist "^4.0.0"
-
 tar@^7.4.3:
   version "7.4.3"
   resolved "https://registry.npmmirror.com/tar/-/tar-7.4.3.tgz#88bbe9286a3fcd900e94592cda7a22b192e80571"
@@ -33210,13 +32671,6 @@ tedious@^18.2.4:
     native-duplexpair "^1.0.0"
     sprintf-js "^1.1.3"
 
-teex@^1.0.1:
-  version "1.0.1"
-  resolved "https://registry.npmjs.org/teex/-/teex-1.0.1.tgz#b8fa7245ef8e8effa8078281946c85ab780a0b12"
-  integrity sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg==
-  dependencies:
-    streamx "^2.12.5"
-
 temp-dir@^1.0.0:
   version "1.0.0"
   resolved "https://registry.npmmirror.com/temp-dir/-/temp-dir-1.0.0.tgz#0a7c0ea26d3a39afa7e0ebea9c1fc0bc4daa011d"
@@ -33282,13 +32736,6 @@ test-exclude@^6.0.0:
     glob "^7.1.4"
     minimatch "^3.0.4"
 
-text-decoder@^1.1.0:
-  version "1.2.7"
-  resolved "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.7.tgz#5d073a9a74b9c0a9d28dfadcab96b604af57d8ba"
-  integrity sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ==
-  dependencies:
-    b4a "^1.6.4"
-
 text-extensions@^1.0.0:
   version "1.9.0"
   resolved "https://registry.npmmirror.com/text-extensions/-/text-extensions-1.9.0.tgz#1853e45fee39c945ce6f6c36b2d659b5aabc2a26"
@@ -33613,11 +33060,6 @@ tree-kill@^1.2.2:
   resolved "https://registry.npmmirror.com/tree-kill/-/tree-kill-1.2.2.tgz#4ca09a9092c88b73a7cdc5e8a01b507b0790a0cc"
   integrity sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A==
 
-trim-canvas@^0.1.0:
-  version "0.1.2"
-  resolved "https://registry.npmjs.org/trim-canvas/-/trim-canvas-0.1.2.tgz#620457f5fecf564b521d35c5fcd4da58304d6e45"
-  integrity sha512-nd4Ga3iLFV94mdhW9JFMLpQbHUyCQuhFOD71PEAt1NjtMD5wbZctzhX8c3agHNybMR5zXD1XTGoIEWk995E6pQ==
-
 trim-lines@^3.0.0:
   version "3.0.1"
   resolved "https://registry.npmmirror.com/trim-lines/-/trim-lines-3.0.1.tgz#d802e332a07df861c48802c04321017b1bd87338"
@@ -34652,19 +34094,6 @@ url-parse-lax@^3.0.0:
   dependencies:
     prepend-http "^2.0.0"
 
-url-parse@~1.5.10:
-  version "1.5.10"
-  resolved "https://registry.npmjs.org/url-parse/-/url-parse-1.5.10.tgz#9d3c2f736c1d75dd3bd2be507dcc111f1e2ea9c1"
-  integrity sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==
-  dependencies:
-    querystringify "^2.1.1"
-    requires-port "^1.0.0"
-
-url-template@^2.0.8:
-  version "2.0.8"
-  resolved "https://registry.npmjs.org/url-template/-/url-template-2.0.8.tgz#fc565a3cccbff7730c775f5641f9555791439f21"
-  integrity sha512-XdVKMF4SJ0nP/O7XIPB0JwAEuT9lDIYnNsK8yGVe43y0AWoKeJNdv3ZNWh7ksJ6KqQFjOO6ox/VEitLnaVNufw==
-
 url@^0.11.0, url@^0.11.1:
   version "0.11.3"
   resolved "https://registry.npmmirror.com/url/-/url-0.11.3.tgz#6f495f4b935de40ce4a0a52faee8954244f3d3ad"
@@ -34912,13 +34341,6 @@ vary@^1, vary@^1.1.2, vary@~1.1.2:
   resolved "https://registry.npmmirror.com/vary/-/vary-1.1.2.tgz#2299f02c6ded30d4a5961b0b9f74524a18f634fc"
   integrity sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==
 
-vasync@^2.2.1:
-  version "2.2.1"
-  resolved "https://registry.npmjs.org/vasync/-/vasync-2.2.1.tgz#d881379ff3685e4affa8e775cf0fd369262a201b"
-  integrity sha512-Hq72JaTpcTFdWiNA4Y22Amej2GH3BFmBaKPPlDZ4/oC8HNn2ISHLkFrJU4Ds8R3jcUi7oo5Y9jcMHKjES+N9wQ==
-  dependencies:
-    verror "1.10.0"
-
 vditor@^3.10.3:
   version "3.10.4"
   resolved "https://registry.npmmirror.com/vditor/-/vditor-3.10.4.tgz#df7e5cdf8c737b588152b2119942ff0e0904c9cd"
@@ -34935,15 +34357,6 @@ verror@1.10.0:
     core-util-is "1.0.2"
     extsprintf "^1.2.0"
 
-verror@^1.10.1:
-  version "1.10.1"
-  resolved "https://registry.npmjs.org/verror/-/verror-1.10.1.tgz#4bf09eeccf4563b109ed4b3d458380c972b0cdeb"
-  integrity sha512-veufcmxri4e3XSrT0xwfUR7kguIkaxBeosDg00yDWhk49wdwkSUrvvsm7nc75e1PUyvIeZj6nS8VQRYz2/S4Xg==
-  dependencies:
-    assert-plus "^1.0.0"
-    core-util-is "1.0.2"
-    extsprintf "^1.2.0"
-
 vfile-location@^4.0.0:
   version "4.1.0"
   resolved "https://registry.npmmirror.com/vfile-location/-/vfile-location-4.1.0.tgz#69df82fb9ef0a38d0d02b90dd84620e120050dd0"
@@ -35348,13 +34761,6 @@ which-typed-array@^1.1.16, which-typed-array@^1.1.19, which-typed-array@^1.1.2:
     gopd "^1.2.0"
     has-tostringtag "^1.0.2"
 
-which@=6.0.1:
-  version "6.0.1"
-  resolved "https://registry.npmjs.org/which/-/which-6.0.1.tgz#021642443a198fb93b784a5606721cb18cfcbfce"
-  integrity sha512-oGLe46MIrCRqX7ytPUf66EAYvdeMIZYn3WaocqqKZAxrBpkqHfL/qvTyJ/bTk5+AqHCjXmrv3CEWgy368zhRUg==
-  dependencies:
-    isexe "^4.0.0"
-
 which@^1.2.12, which@^1.2.9, which@^1.3.1:
   version "1.3.1"
   resolved "https://registry.npmjs.org/which/-/which-1.3.1.tgz#a45043d54f5805316da8d62f9f50918d3da70b0a"
@@ -35901,7 +35307,7 @@ yargs@~3.10.0:
     decamelize "^1.0.0"
     window-size "0.1.0"
 
-yauzl@2.10.0, yauzl@=2.10.0, yauzl@^2.10.0, yauzl@^2.4.2:
+yauzl@^2.10.0, yauzl@^2.4.2:
   version "2.10.0"
   resolved "https://registry.npmmirror.com/yauzl/-/yauzl-2.10.0.tgz#c7eb17c93e112cb1086fa6d8e51fb0667b79a5f9"
   integrity sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==
@@ -35925,13 +35331,6 @@ yauzl@^3.2.0:
     buffer-crc32 "~0.2.3"
     pend "~1.2.0"
 
-yazl@2.5.1, yazl@=2.5.1:
-  version "2.5.1"
-  resolved "https://registry.npmjs.org/yazl/-/yazl-2.5.1.tgz#a3d65d3dd659a5b0937850e8609f22fffa2b5c35"
-  integrity sha512-phENi2PLiHnHb6QBVot+dJnaAZ0xosj7p3fWl+znIjBDlnMI2PsZCJZ306BPTFOaHf5qdDEI8x5qFrSOBN5vrw==
-  dependencies:
-    buffer-crc32 "~0.2.3"
-
 yn@3.1.1:
   version "3.1.1"
   resolved "https://registry.npmmirror.com/yn/-/yn-3.1.1.tgz#1e87401a09d767c1d5eab26a6e4c185182d2eb50"
@@ -35956,15 +35355,6 @@ zip-stream@^4.1.0:
     compress-commons "^4.1.2"
     readable-stream "^3.6.0"
 
-zip-stream@^5.0.1:
-  version "5.0.2"
-  resolved "https://registry.npmjs.org/zip-stream/-/zip-stream-5.0.2.tgz#77b1dce7af291482d368a9203c9029f4eb52e12e"
-  integrity sha512-LfOdrUvPB8ZoXtvOBz6DlNClfvi//b5d56mSWyJi7XbH/HfhOHfUhOqxhT/rUiR7yiktlunqRo+jY6y/cWC/5g==
-  dependencies:
-    archiver-utils "^4.0.1"
-    compress-commons "^5.0.1"
-    readable-stream "^3.6.0"
-
 zod-to-json-schema@^3.23.5:
   version "3.25.1"
   resolved "https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.1.tgz#7f24962101a439ddade2bf1aeab3c3bfec7d84ba"