@axewo/fin-micro 1.0.0 → 2.0.1

package/scaffold/host/src/utils/request.ts

@@ -1,4 +1,6 @@
 import { AxiosHttpClient } from '@axewo/fin-core/http/axios'
+import { appConfig } from './appConfig'
+import { toSafeError, reportError } from './errorUtils'
 
 /**
  * 基座平台接口专属 Axios 请求实例；不与子应用公共 requestUtils.ts 共享可变配置或凭据。
@@ -9,7 +11,32 @@ import { AxiosHttpClient } from '@axewo/fin-core/http/axios'
  * 业务 code/data 解包、401 后的会话协调由业务适配层负责，本实例不弹窗或跳转。
  */
 export const http = new AxiosHttpClient({
-  baseURL: '/api/',
-  timeout: 30000,
-  withCredentials: false,
+  baseURL: appConfig.apiBase,
+  timeout: appConfig.timeout,
+  withCredentials: appConfig.withCredentials,
 })
+
+/**
+ * 为本轮平台会话安装 401 协调；请求发送时捕获宿主私有版本，旧请求不得退出新身份。
+ * @param capture 未登录/认证初始化返回 undefined，避免将登录拒绝误判成工作会话失效。
+ * @param invalidate 同步复核版本并撤销身份，不等待离页守卫或远程退出。
+ * @returns 幂等清理函数，卸载后旧响应不再触发副作用；失败始终保持原始拒绝。
+ */
+export function installPlatformExpiry(capture: () => number | undefined, invalidate: (revision: number) => void): () => void {
+  let active = true
+  const revisions = new WeakMap<object, number>()
+  const request = http.interceptors.request.use(config => {
+    const revision = capture()
+    if (revision !== undefined) revisions.set(config, revision)
+    return config
+  })
+  const response = http.interceptors.response.use(value => value, error => {
+    const config = error?.config ?? error?.response?.config
+    const revision = config && typeof config === 'object' ? revisions.get(config) : undefined
+    if (active && revision !== undefined && toSafeError(error).kind === 'unauthenticated') {
+      try { invalidate(revision) } catch (cause) { reportError(cause) }
+    }
+    return Promise.reject(error)
+  })
+  return () => { active = false; http.interceptors.request.eject(request); http.interceptors.response.eject(response) }
+}

package/scaffold/host/src/views/home/index.vue

@@ -0,0 +1,19 @@
+<script setup lang="ts">
+/** 主页只展示当前身份与真实可用入口，不依赖外部子应用，也不编造业务统计。 */
+defineProps<{ userName: string; demo: boolean; pending: boolean }>()
+const emit = defineEmits<{ profile: [] }>()
+</script>
+
+<template>
+  <div class="home-view" :inert="pending || undefined">
+    <section class="welcome-panel"><div><p class="eyebrow">FIN WORKSPACE</p><h1>{{ userName }}，欢迎来到 __PROJECT_NAME__</h1><p>这里是宿主本地主页，无需启动子应用即可使用。</p></div></section>
+    <el-alert v-if="demo" title="开发演示模式：固定演示身份，无真实认证与业务数据" type="warning" :closable="false" />
+    <section class="home-panel">
+      <div class="panel-heading"><h2>开始使用工作台</h2><span>本地入口已就绪</span></div>
+      <p>通过左侧菜单或顶部搜索打开主页、个人中心；使用页签切换、刷新、关闭当前页或批量关闭。</p>
+      <p>业务应用是可选远端入口，需要另行启动可信子应用；连接失败不会影响本地主页与个人中心。</p>
+      <el-button type="primary" @click="emit('profile')">查看个人信息</el-button>
+    </section>
+    <section class="home-panel"><h2>会话与安全边界</h2><p>{{ demo ? '刷新会恢复当前标签页的演示会话及已授权页签；退出登录会清除演示恢复标记和页签。' : '当前身份来自平台接口。刷新会重新验证身份与授权菜单，失败不会切换为演示模式。' }}</p><p>本地页面不签发 Token，真实业务权限与数据访问仍由服务端校验。</p></section>
+  </div>
+</template>

package/scaffold/host/src/views/login/components/LoginForm.vue

@@ -0,0 +1,83 @@
+<script setup lang="ts">
+import { ref } from 'vue'
+import { demoMode } from '../../../platform'
+
+// 表单只保留本地输入；会话恢复、取消与错误状态统一由上层会话组合函数管理。
+const props = defineProps<{
+  loading: boolean
+  error: string
+  signIn: (username: string, password: string) => Promise<void>
+}>()
+const emit = defineEmits<{ restore: [] }>()
+const username = ref(demoMode ? 'demo' : '')
+const password = ref(demoMode ? '123456' : '')
+async function submit(): Promise<void> {
+  if (props.loading) return
+  if (!username.value.trim() || !password.value) return
+  const credential = password.value
+  // 提交即清空密码输入，不在会话或全局状态中保存凭据。
+  password.value = ''
+  await props.signIn(username.value.trim(), credential)
+}
+</script>
+
+<template>
+  <main class="login-page">
+    <!-- 仅迁移品牌与表单外观，身份恢复与登录结果仍由上层会话控制器决定。 -->
+    <section class="login-brand" aria-label="平台介绍">
+      <div class="login-logo"><span class="login-logo-mark" aria-hidden="true">F</span> FIN WORKSPACE</div>
+      <div class="login-story"><p class="login-eyebrow">连接业务 · 协同向前</p><h1>一个工作空间，<br />让业务高效运转。</h1><p class="login-description">统一入口、按需协同，为团队打造清晰、可靠的企业工作台。</p>
+        <div class="login-features"><div><span aria-hidden="true">01</span><strong>统一业务入口</strong><p>集中访问业务应用，减少重复切换。</p></div><div><span aria-hidden="true">02</span><strong>连续工作体验</strong><p>多页签承载工作上下文，专注当前任务。</p></div></div>
+      </div><p class="login-brand-footer">FIN MICRO · 企业应用基座模板</p>
+    </section>
+    <section class="login-panel" aria-labelledby="login-title"><div class="login-card" :aria-busy="loading">
+    <p class="login-eyebrow">欢迎回来</p><h2 id="login-title">登录工作台</h2><p class="login-subtitle">{{ demoMode ? '仅开发模拟：使用 demo / 123456 登录本地主页。' : '使用你的工作账号，继续 __PROJECT_NAME__ 的工作。' }}</p>
+    <el-alert v-if="demoMode" title="仅演示登录，不提供生产身份认证" type="warning" :closable="false" />
+    <p>{{ demoMode ? '仅开发模拟，校验演示账号密码，不连接认证接口，请勿输入真实凭据；刷新仅恢复当前标签页的演示会话。' : '请接入 src/platform.ts 的真实平台接口；认证失败不会降级为演示身份。' }}</p>
+    <el-form class="login-form" label-position="top" size="large" @submit.prevent="submit">
+      <el-form-item label="用户名"><el-input v-model="username" autocomplete="username" placeholder="请输入你的工作账号" :disabled="loading" /></el-form-item>
+      <el-form-item label="密码"><el-input v-model="password" type="password" autocomplete="current-password" placeholder="请输入登录密码" show-password :disabled="loading" /></el-form-item>
+      <p v-if="error" class="login-error" role="alert">{{ error }}</p>
+      <div class="actions">
+        <el-button class="login-submit" type="primary" native-type="submit" :loading="loading" :disabled="loading">{{ demoMode ? '演示登录，进入主页' : '登录工作台' }}</el-button>
+        <el-button :disabled="loading" @click="emit('restore')">重试恢复会话</el-button>
+      </div>
+    </el-form>
+    <p class="login-help">{{ demoMode ? '生产构建始终使用真实认证，演示标记不具有任何认证效力。' : '如需开通账号或重置密码，请联系企业管理员。' }}</p>
+    </div><footer class="login-footer">统一工作空间 · 专注每一步</footer></section>
+  </main>
+</template>
+
+<style scoped>
+/* 双栏品牌区沿用示例外观；不依赖示例认证或表单实现。 */
+.login-page { min-height: 100vh; display: grid; grid-template-columns: minmax(0, 1.1fr) minmax(400px, 1fr); background: #fff; color: #1d2b43; }
+.login-brand { display: flex; flex-direction: column; padding: 42px 64px 28px; background: #f5f7fa; border-right: 1px solid #e6edf6; }
+.login-logo { display: inline-flex; align-items: center; gap: 12px; color: #243d66; font-size: 15px; font-weight: 750; letter-spacing: 1.6px; }
+.login-logo-mark { display: grid; place-items: center; width: 36px; height: 36px; border-radius: 11px; background: #2b62d9; color: #fff; font-size: 24px; }
+.login-story { margin: auto 0; padding: 65px 0; max-width: 480px; }
+.login-eyebrow { color: #526b96; font-size: 13px; font-weight: 600; letter-spacing: 2px; margin: 0 0 16px; }
+.login-story h1 { font-size: clamp(30px, 3.1vw, 46px); line-height: 1.5; letter-spacing: -1px; margin: 0 0 22px; }
+.login-description { font-size: 15px; color: #65758d; line-height: 1.9; max-width: 390px; }
+.login-features { margin-top: 45px; display: grid; gap: 24px; }
+.login-features > div { position: relative; padding-left: 46px; }
+.login-features span { position: absolute; left: 0; top: 0; font-size: 13px; color: #5479bd; background: #e3ecfb; border: 1px solid #d6e3fa; border-radius: 8px; padding: 7px; }
+.login-features strong { font-size: 14px; }
+.login-features p { font-size: 13px; color: #72809a; margin: 7px 0 0; line-height: 1.6; }
+.login-brand-footer { font-size: 11px; color: #8191aa; letter-spacing: 1px; }
+.login-panel { display: flex; flex-direction: column; align-items: center; justify-content: center; position: relative; padding: 64px 48px 76px; }
+.login-card { width: 100%; max-width: 390px; }
+.login-card h2 { font-size: 30px; margin: 0 0 12px; font-weight: 650; }
+.login-subtitle { color: #7a879b; font-size: 14px; margin: 0 0 30px; line-height: 1.8; }
+.login-card > p:not([class]) { font-size: 12px; color: #72809a; line-height: 1.8; }
+.login-error { padding: 12px 14px; margin-bottom: 18px; border: 1px solid #f4c6c6; border-radius: 8px; background: #fff3f3; color: #b43b3b; font-size: 13px; overflow-wrap: anywhere; }
+.login-form :deep(.el-form-item__label) { font-weight: 500; color: #394a64; }
+.login-form :deep(.el-form-item) { margin-bottom: 24px; }
+.login-form .actions { flex-direction: column; align-items: stretch; }
+.login-form .actions :deep(.el-button + .el-button) { margin-left: 0; }
+.login-submit { width: 100%; --el-button-bg-color: #2b62d9; --el-button-border-color: #2b62d9; border-radius: 7px; letter-spacing: 1px; }
+.login-help { text-align: center; color: #8792a4; font-size: 12px; line-height: 1.8; margin-top: 24px; }
+.login-footer { position: absolute; bottom: 26px; color: #a0a9b8; font-size: 11px; letter-spacing: 1px; }
+@media (max-width: 960px) { .login-brand { padding: 36px; } .login-panel { padding: 48px 32px 70px; } }
+@media (max-width: 720px) { .login-page { grid-template-columns: minmax(0, 1fr); } .login-brand { display: none; } .login-panel { padding: 38px 24px 72px; } .login-card h2 { font-size: 26px; } }
+@media (prefers-reduced-motion: reduce) { .login-page :deep(*) { transition: none !important; } }
+</style>

package/scaffold/host/src/views/login/index.vue

@@ -0,0 +1,16 @@
+<script setup lang="ts">
+import { watch } from 'vue'
+import { useRouter, useRoute } from 'vue-router'
+import LoginForm from './components/LoginForm.vue'
+import { usePlatformSession } from '../../hooks/usePlatformSession'
+import { authorizedRedirect } from '../../router/targets'
+import { reportError } from '../../utils/errorUtils'
+const controller = usePlatformSession()
+const { session, loading, error, signIn, restore } = controller
+const router = useRouter()
+const route = useRoute()
+watch(session, value => {
+  if (value) void router.replace(authorizedRedirect(router, value, route.query.redirect)).catch(reportError)
+})
+</script>
+<template><LoginForm :loading="loading" :error="error" :sign-in="signIn" @restore="restore" /></template>

package/scaffold/host/src/views/not-found/index.vue

@@ -0,0 +1 @@
+<template><main><h1>404：页面不存在</h1><p>请检查地址，或返回工作台。</p><RouterLink to="/home">返回主页</RouterLink><RouterLink to="/login">登录页</RouterLink></main></template>

package/scaffold/host/src/views/profile/index.vue

@@ -0,0 +1,24 @@
+<script setup lang="ts">
+import type { PlatformSession } from '../../types/platform'
+/** 仅展示平台公开会话字段，不读取、显示或持久化私有凭据。操作交回宿主统一导航与退出守卫。 */
+defineProps<{ session: PlatformSession; demo: boolean; pending: boolean }>()
+const emit = defineEmits<{ home: []; logout: [] }>()
+</script>
+
+<template>
+  <div class="home-view" :inert="pending || undefined">
+    <section class="home-panel">
+      <div class="panel-heading"><h1>个人中心</h1><span>{{ demo ? '开发演示身份' : '平台认证身份' }}</span></div>
+      <el-alert v-if="demo" title="以下为固定演示资料，不代表真实账号或平台权限" type="warning" :closable="false" />
+      <el-descriptions title="公开会话信息" :column="1" border>
+        <el-descriptions-item label="显示名称">{{ session.user.name }}</el-descriptions-item>
+        <el-descriptions-item label="用户标识">{{ session.user.id }}</el-descriptions-item>
+        <el-descriptions-item label="权限标识">{{ session.permissions.join('、') || '未分配业务权限' }}</el-descriptions-item>
+        <el-descriptions-item label="会话方式">{{ demo ? '当前标签页演示标记（非 Token）' : '平台真实认证' }}</el-descriptions-item>
+      </el-descriptions>
+      <p>这里只展示公开身份，不提供未接入的资料编辑、修改密码或其他虚假操作。</p>
+      <el-button type="primary" :disabled="pending" @click="emit('home')">回到主页</el-button>
+      <el-button :disabled="pending" @click="emit('logout')">退出登录</el-button>
+    </section>
+  </div>
+</template>

package/scaffold/host/src/views/workspace/index.vue

@@ -0,0 +1,11 @@
+<script setup lang="ts">
+import { watch } from 'vue'
+import { useRouter } from 'vue-router'
+import HostLayout from '../../layout/HostLayout.vue'
+import { usePlatformSession } from '../../hooks/usePlatformSession'
+import { reportError } from '../../utils/errorUtils'
+const { session, signOut, expire } = usePlatformSession()
+const router = useRouter()
+watch(session, value => { if (!value) void router.replace('/login').catch(reportError) }, { flush: 'sync' })
+</script>
+<template><HostLayout v-if="session" :key="session.user.id" :session="session" @logout="signOut" @expired="expire" /></template>

package/scaffold/layouts/standard/host/src/layout/HostLayout.vue

@@ -0,0 +1,116 @@
+<script setup lang="ts">
+import { computed, onBeforeUnmount, ref } from 'vue'
+import { createMicroHost, createWujieRuntime, useMicroHost, type MicroMenu, type NavigationOperation } from '@axewo/fin-micro'
+import { createTokenCapability, createAuthFailureCapabilities, type AuthCapabilities } from '@axewo/fin-micro/sdk'
+import { canOpenRoute, getAccessToken, getTokenRevision, publicSession } from '../platform'
+import type { PlatformSession } from '../types/platform'
+import { HostShell } from '@axewo/fin-micro/layout'
+import '@axewo/fin-micro/layout/style.css'
+import HostWorkspace from './HostWorkspace.vue'
+import { isHome, localApp, localTarget, workspaceOperation } from '../localPages'
+import { useRouter } from 'vue-router'
+import { connectWorkspaceBrowser, connectWorkspaceRouter } from '../router/workspace'
+import '../styles/shell.css'
+import { toSafeError, reportError } from '../utils/errorUtils'
+const props = defineProps<{ session: PlatformSession }>()
+const emit = defineEmits<{ logout: []; expired: [revision: number] }>()
+const shell = ref<InstanceType<typeof HostShell>>()
+const notice = ref('')
+const exiting = ref(false)
+let alive = true
+const sessionRevision = getTokenRevision()
+const authenticated = () => alive && getTokenRevision() === sessionRevision
+const report = (error: unknown) => { if (alive) notice.value = toSafeError(error).message }
+const trustedApps = props.session.apps.filter(app => app.appId === (import.meta.env.VITE_MICRO_APP_ID || 'business')).map(app => app.appId)
+const failureCapabilities = createAuthFailureCapabilities({
+  apps: trustedApps,
+  getRevision: getTokenRevision,
+  invalidate: () => {
+    if (!alive) return
+    // 立即撤销公开身份与新能力准入；父控制器同步清除私有凭据，不能被 beforeLeave 阻断。
+    host.updateSession({ authenticated: false, permissions: [] })
+    emit('expired', getTokenRevision())
+    alive = false
+  },
+})
+// 认证成功后才创建；只允许当前后台授权并经过可信注册表转换的应用。
+const host = createMicroHost<AuthCapabilities>([localApp, ...props.session.apps], {
+  capabilities: {
+    ...failureCapabilities,
+    getToken: createTokenCapability({
+      // 只授权当前已登录且出自本地可信注册表的业务应用，不使用接口传入的任意 appId。
+      apps: props.session.apps.filter(app => app.appId === (import.meta.env.VITE_MICRO_APP_ID || 'business')).map(app => app.appId),
+      // exiting 只是离页确认状态；守卫中的保存仍需凭据，确认退出后才由认证控制器清除。
+      getSession: () => ({ ...publicSession(props.session), authenticated: authenticated(), revision: getTokenRevision() }),
+      // 业务替换点：可改为接收 context.signal 的异步后台读取；helper 会复查会话版本与存活。
+      provider: () => getAccessToken(),
+    }),
+  },
+  onError: report,
+  canOpen: input => authenticated() && !exiting.value && canOpenRoute(props.session, input),
+  // 不开放任意请求代理；Token 仅由上面的显式白名单能力提供，跨应用导航另行制定白名单。
+  canNavigate: () => false,
+})
+host.updateSession(publicSession(props.session))
+// 身份与授权菜单就绪后才能恢复 URL；用户隔离存储，禁止恢复未通过 canOpen 的入口。
+const router = useRouter()
+// 源示例同样在恢复前登记主页：首位、去重并迁移缺少主页的旧快照，不先清空再补页。
+// 此时没有页面或业务守卫；交互切回主页仍须经过 operate 的离页确认。
+const browser = connectWorkspaceBrowser(host, router, { storageKey: `fin-micro:tabs:${props.session.user.id}`, onError: report })
+const workspaceRouter = connectWorkspaceRouter(host, router, () => authenticated() && !exiting.value, report)
+// 运行时只接收远端注册表，本地应用永远不会变成 Wujie 网络加载目标。
+const runtime = createWujieRuntime({ apps: host.apps.filter(app => app.kind !== 'local'), bridge: host.bridge })
+const state = useMicroHost(host)
+const active = computed(() => state.value.tabs.find(tab => tab.tabId === state.value.activeTabId))
+const epochs = ref<Record<string, number>>({})
+let previous = new Set<string>()
+const off = host.subscribe(snapshot => {
+  const present = new Set(snapshot.tabs.map(tab => tab.appId))
+  // 同 tick 关闭最后一页后重开，也不能复用已经失效的 bridge 和应用容器。
+  for (const appId of previous) if (!present.has(appId)) epochs.value[appId] = (epochs.value[appId] ?? 0) + 1
+  previous = present
+})
+
+/** 所有 UI 导航均走核心事务，携带原 key，避免异步操作误关重开后的新页签。 */
+async function operate(operation: NavigationOperation): Promise<void> {
+  if (exiting.value) return
+  try {
+    const result = await host.operate(workspaceOperation(operation, host.getState().tabs))
+    if (result.status === 'cancelled') notice.value = '操作已取消'
+    if (result.status === 'stale') notice.value = '目标页签已变化，请重试'
+  } catch (error) { report(error) }
+}
+function open(appId: string, menu: MicroMenu): void {
+  if (menu.target) void operate({ type: 'open', input: { appId, ...menu.target, title: menu.name, activeMenuId: menu.menuId } })
+}
+/** 退出先由核心统一确认全部页面；取消不注销，确认后由父组件撤销会话并卸载工作区。 */
+async function signOut(): Promise<void> {
+  if (exiting.value) return
+  shell.value?.closePopovers()
+  exiting.value = true
+  try {
+    const result = await host.operate({ type: 'closeMany', scope: 'all' })
+    if (result.status === 'committed' || result.status === 'noop') emit('logout')
+    else notice.value = '退出已取消，请先处理未保存页面'
+  } catch (error) { report(error) }
+  finally { exiting.value = false }
+}
+onBeforeUnmount(() => {
+  alive = false
+  off()
+  workspaceRouter.dispose()
+  browser.dispose()
+  // 先撤销公开身份，再释放沙箱和核心；立即 dispose 阻止任何旧 SDK 发起新动作。
+  host.updateSession({ authenticated: false, permissions: [] })
+  void runtime.dispose().catch(reportError)
+  host.dispose()
+})
+</script>
+
+<template>
+  <!-- 外壳只发事件；认证、导航守卫与生命周期仍由本项目唯一核心管理。 -->
+  <HostShell ref="shell" :brand="{ title: '__PROJECT_NAME__' }" :apps="host.apps" :tabs="state.tabs" :active-key="active?.key" :user-name="session.user.name" :pending="exiting" :notice="notice" :is-fixed-tab="isHome" @open="open" @operate="operate" @logout="signOut" @profile="operate({ type: 'open', input: localTarget('profile') })" @dismiss-notice="notice = ''" @error="report">
+    <!-- 业务替换点：主页/个人资料和每应用唯一容器仍属项目，不由外壳创建运行时。 -->
+    <HostWorkspace :apps="host.apps" :tabs="state.tabs" :active="active" :runtime="runtime" :epochs="epochs" :pending="exiting" :session="session" @home="operate({ type: 'open', input: localTarget('home') })" @profile="operate({ type: 'open', input: localTarget('profile') })" @logout="signOut" />
+  </HostShell>
+</template>

package/scaffold/layouts/standard/host/src/styles/shell.css

@@ -0,0 +1,168 @@
+/* 项目本地业务页面样式，公共外壳样式从 npm 子路径导入。 */
+.host-shell .home-view {
+  max-width: 1440px;
+  margin: 0 auto;
+}
+.host-shell .welcome-panel {
+  background: #f4f7fc;
+  border: 1px solid #e5ebf5;
+  border-radius: 10px;
+  padding: 28px 32px;
+  min-height: 152px;
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  margin-bottom: 22px;
+  overflow: hidden;
+}
+.host-shell .eyebrow {
+  color: #7f94b4 !important;
+  font-size: 10px !important;
+  letter-spacing: 1.8px;
+  margin: 0 0 10px !important;
+}
+.host-shell .welcome-panel h1 {
+  font-size: 23px;
+  letter-spacing: 0.3px;
+  margin: 0 0 9px;
+  font-weight: 600;
+  color: #25344e;
+}
+.host-shell .welcome-panel p {
+  font-size: 12px;
+  color: #8b97aa;
+  margin: 0;
+}
+.host-shell .home-panel {
+  background: #fff;
+  border: 1px solid var(--shell-border);
+  border-radius: 9px;
+  padding: 22px 24px;
+  margin-bottom: 22px;
+}
+.host-shell .panel-heading {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  gap: 12px;
+  margin-bottom: 20px;
+}
+.host-shell .panel-heading h2 {
+  margin: 0;
+  font-size: 14px;
+  font-weight: 600;
+}
+.host-shell .panel-heading > span {
+  color: #9ba4b4;
+  font-size: 11px;
+}
+.host-shell .shortcut-grid {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 16px;
+}
+.host-shell .shortcut-card {
+  display: flex;
+  align-items: center;
+  gap: 14px;
+  padding: 18px;
+  background: white;
+  border: 1px solid #e9edf5;
+  border-radius: 7px;
+  text-align: left;
+  transition:
+    border-color 0.15s,
+    background 0.15s;
+}
+.host-shell .shortcut-card:hover {
+  border-color: #acc2f5;
+  background: #fafcff;
+}
+.host-shell .entry-icon {
+  width: 40px;
+  height: 40px;
+  display: grid;
+  place-items: center;
+  border-radius: 9px;
+  background: #edf3ff;
+  color: #4c79dc;
+  font-size: 17px;
+}
+.host-shell .shortcut-card:nth-child(2) .entry-icon {
+  background: #edf8f5;
+  color: #4a9a88;
+}
+.host-shell .shortcut-card strong {
+  display: block;
+  font-size: 13px;
+  font-weight: 500;
+}
+.host-shell .shortcut-card small {
+  display: block;
+  color: #99a3b4;
+  font-size: 11px;
+  margin-top: 4px;
+}
+.host-shell .entry-arrow {
+  margin-left: auto;
+  color: #a0acbe;
+}
+.host-shell .home-columns {
+  display: grid;
+  grid-template-columns: 1.2fr 1fr;
+  gap: 22px;
+}
+.host-shell .home-columns .home-panel {
+  min-height: 266px;
+}
+.host-shell .empty-state {
+  text-align: center;
+  color: #9ba5b4;
+  padding: 25px 12px;
+  font-size: 12px;
+}
+.host-shell .empty-state strong {
+  display: block;
+  font-weight: 400;
+  color: #8491a6;
+  margin-bottom: 6px;
+}
+.host-shell .empty-state p {
+  margin: 0;
+  font-size: 11px;
+}
+.host-shell .empty-symbol {
+  display: block;
+  color: #ced7e5;
+  font-size: 32px;
+  line-height: 1.2;
+  margin-bottom: 13px;
+}
+.host-shell .recent-list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+.host-shell .recent-list li + li {
+  border-top: 1px solid #f1f3f7;
+}
+.host-shell .recent-list button {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 16px;
+  width: 100%;
+  border: 0;
+  background: white;
+  text-align: left;
+  padding: 12px 0;
+  font-size: 12px;
+}
+.host-shell .recent-list button:hover {
+  color: #3267e3;
+}
+.host-shell .recent-list small {
+  color: #99a5b5;
+  font-size: 11px;
+  white-space: nowrap;
+}

package/scaffold/layouts/standard/vue/src/layout/StandaloneLayout.vue

@@ -0,0 +1,26 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { FinWatermark } from '@axewo/fin-micro/watermark'
+import { watermarkConfig } from '../utils/watermarkConfig'
+import { useRoute, useRouter } from 'vue-router'
+import { StandaloneShell } from '@axewo/fin-micro/layout'
+import '@axewo/fin-micro/layout/style.css'
+import { createStandaloneMenus, standaloneActiveMenu } from '../router/menu'
+import { reportError } from '../utils/errorUtils'
+
+// 菜单映射与路由实例归项目；公共外壳不创建第二个 router 或读取后台权限。
+const router = useRouter()
+const route = useRoute()
+const menus = computed(() => createStandaloneMenus(router.options.routes))
+const activeMenu = computed(() => standaloneActiveMenu(route))
+/** 路由失败进入项目脱敏错误边界，不产生未处理 Promise；路由守卫仍由 router 执行。 */
+function navigate(path: string): void { void router.push(path).catch(reportError) }
+</script>
+<template>
+  <!-- 业务替换点：品牌、header-actions 等局部插槽不会接管其他默认区域。 -->
+  <StandaloneShell :brand="{ title: '__PROJECT_NAME__' }" :title="route.meta.title ?? '业务应用'" :menus="menus" :active-menu="activeMenu" @navigate="navigate">
+    <slot />
+    <!-- 公共外壳提供稳定业务视口；嵌入时 App 不挂载本布局。 -->
+    <template #workspace-overlay><FinWatermark :config="watermarkConfig" /></template>
+  </StandaloneShell>
+</template>

package/scaffold/vue/src/App.vue

@@ -1,24 +1,30 @@
 <script setup lang="ts">
 import { computed, provide } from 'vue'
 import AppProviders from './components/AppProviders.vue'
+import StandaloneLayout from './layout/StandaloneLayout.vue'
+import { isMicroFrontend } from '@axewo/fin-micro/runtime'
 import { RouterView } from 'vue-router'
 import { MicroTabCache, MicroRouteView, useMicroHost } from '@axewo/fin-micro'
 import { sessionKey, type BridgeSession } from './bridge/session'
 const props = defineProps<{ session: BridgeSession }>()
 provide(sessionKey, props.session)
 const { bridge, status, identity } = props.session
+// 环境与连接状态分开：嵌入但未取得 bridge 时也不能显示第二套头部菜单。
+const embedded = isMicroFrontend()
 const state = bridge ? useMicroHost(bridge) : undefined
 const tabs = computed(() => state?.value.tabs.filter(tab => tab.appId === bridge?.appId) ?? [])
 const activeKey = computed(() => state?.value.tabs.find(tab => tab.tabId === state.value.activeTabId)?.key)
 </script>
 <template>
   <AppProviders>
-    <main class="page">
-      <small role="status">{{ status }} · {{ identity?.user?.name ?? '未连接公开身份' }}</small>
-      <!-- 缓存以核心 tab.key 为身份；关闭、刷新和淘汰销毁实例，切换只停用。
-           LRU 不是持久化，重要草稿需要业务另行保存，不能依赖守卫阻止浏览器刷新。 -->
-      <MicroTabCache v-if="bridge && state" :tabs="tabs" :active-key="activeKey" :max="20"><MicroRouteView /></MicroTabCache>
-      <RouterView v-else />
-    </main>
+    <component :is="embedded ? 'main' : StandaloneLayout">
+      <div class="page">
+        <small role="status">{{ status }} · {{ identity?.user?.name ?? '未连接公开身份' }}</small>
+        <!-- 缓存以核心 tab.key 为身份；关闭、刷新和淘汰销毁实例，切换只停用。
+             LRU 不是持久化，重要草稿需要业务另行保存，不能依赖守卫阻止浏览器刷新。 -->
+        <MicroTabCache v-if="bridge && state" :tabs="tabs" :active-key="activeKey" :max="20"><MicroRouteView /></MicroTabCache>
+        <RouterView v-else />
+      </div>
+    </component>
   </AppProviders>
 </template>

package/scaffold/vue/src/bootstrap.ts

@@ -1,12 +1,15 @@
 import { createApp } from 'vue'
+import { disposePinia } from 'pinia'
 import ElementPlus from 'element-plus'
 import { connectMicroRouter } from '@axewo/fin-micro'
-import { getToken } from '@axewo/fin-micro/sdk'
-import { installRequestTokenProvider } from './utils/requestUtils'
+import { isMicroFrontend } from '@axewo/fin-micro/runtime'
+import { installBridgeAuth } from './bridge/auth'
+import { reportError, toSafeError, cleanupAll } from './utils/errorUtils'
 import App from './App.vue'
 import { installAppLocale } from './locales'
 import { createBridgeSession } from './bridge/session'
 import { createMicroRouter } from './router'
+import { createAppPinia } from './stores'
 let cleanup: (() => void) | undefined
 
 /** 幂等卸载，停止路由握手和会话订阅；晚到的初始化不得再挂载旧实例。 */
@@ -17,8 +20,11 @@ export async function mount(): Promise<void> {
   unmount()
   const session = createBridgeSession()
   const { bridge } = session
-  const router = createMicroRouter(Boolean(bridge))
+  // history 与布局使用同一 SDK 环境标识，缺桥不应争用宿主 URL。
+  const embedded = isMicroFrontend()
+  const router = createMicroRouter(embedded)
   const app = createApp(App, { session })
+  const pinia = createAppPinia()
   let stopped = false
   let mounted = false
   let offRouter: (() => void) | undefined
@@ -27,45 +33,40 @@ export async function mount(): Promise<void> {
   cleanup = () => {
     stopped = true
     // 先取消挂起的 Token 读取并还原 provider，避免旧 bridge 被后续请求复用。
-    offToken?.()
-    offRouter?.()
-    offSession?.()
-    if (mounted) app.unmount()
-    // 初始化在 app.mount 前取消/失败时，Vue 尚未接管销毁，仍须释放 history 的浏览器监听。
-    router.options.history.destroy()
+    cleanupAll([
+      () => offToken?.(), () => offRouter?.(), () => offSession?.(),
+      () => { if (mounted) app.unmount() },
+      () => router.options.history.destroy(), () => disposePinia(pinia),
+    ])
   }
   try {
     // 每轮挂载安装独立 i18n，重试/重挂载不复用上一轮语言实例。
+    app.config.errorHandler = reportError
     installAppLocale(app)
     app.use(ElementPlus)
+    // 每轮挂载安装独立 Pinia，不与基座或其他子应用共享状态。
+    app.use(pinia)
     app.use(router)
     await router.isReady()
     if (stopped) return
     if (bridge) {
       if (bridge.appId !== '__APP_ID__') throw new Error('宿主 appId 与子应用 __APP_ID__ 配置不一致')
-      if (!bridge.negotiate({ version: '1.0', capabilities: ['getToken'] }).compatible) throw new Error('宿主协议不兼容')
+      if (!bridge.negotiate({ version: '1.0', capabilities: ['getToken', 'beginAuthRequest', 'reportAuthFailure'] }).compatible) throw new Error('宿主协议不兼容')
       // 只在已验证的嵌入生命周期安装；独立模式与基座请求不会隐式探测 window bridge。
-      offToken = installRequestTokenProvider(signal => getToken({ bridge, signal }))
+      offToken = installBridgeAuth(bridge)
       offSession = bridge.subscribeSession(value => { if (!stopped) session.identity.value = value })
       // MicroRouteView 按固定页签快照解析真实路由，不全局 router.replace 污染其他缓存页面。
       offRouter = connectMicroRouter(bridge, { async replace() { if (!stopped) session.status.value = '宿主已连接' } },
-        error => { if (!stopped) session.status.value = String(error) })
-    } else session.status.value = '独立演示：宿主命令不可用，CRUD 数据仅保存在当前页面内存'
+        error => { if (!stopped) session.status.value = toSafeError(error).message })
+    } else session.status.value = embedded
+      ? '嵌入运行：未连接宿主'
+      : '独立演示：宿主命令不可用，CRUD 数据仅保存在当前页面内存'
     app.mount('#app')
     mounted = true
   } catch (error) {
     if (stopped) return
     unmount()
-    const container = document.getElementById('app')
-    if (container) {
-      // 不插入错误 HTML，避免异常消息进入 innerHTML；重试只重建当前应用。
-      container.replaceChildren()
-      const text = document.createElement('p')
-      text.textContent = `应用启动失败：${String(error)}`
-      const retry = document.createElement('button')
-      retry.textContent = '重试启动'
-      retry.onclick = () => { void mount() }
-      container.append(text, retry)
-    }
+    // 交由 main 的启动代次保护展示安全边界，不能在卸载后用旧按钮重新挂载。
+    throw error
   }
 }