@fulgurjs/federation 6.11.7 → 6.12.1

package/docs/en/reference/api.md

@@ -344,6 +344,8 @@ export const pageProviders: RemoteSetupModule['pageProviders'] = [
 
 `RemoteSetupContext`: `{ appContext: Readonly<AppContext>, sessionKey?: string, signal: AbortSignal }`. `appContext` is the snapshot taken from the page-level AppContext **at call time** (never a saved stale reference); `signal` is invalidated when the login generation changes or on logout cleanup.
 
+A module with only pageProviders/globalComponents/onSession can omit the default function. Empty modules and non-function defaults remain invalid.
+
 Fixed contract:
 
 | Dimension | Semantics |
@@ -355,7 +357,7 @@ Fixed contract:
 | Execution count (pageProviders) | Declaration is extracted once with setup; **wrapping applies on every component render** (the declared array is cached by reference, successful loader results are reused; rejected loaders evict the cache so same-page retries execute them again). Vue `remoteComponent`/`createHostPages` and React `remoteComponent`/`createReactHostPages` apply it automatically (outer→inner wrap; attrs/slots pass through to the innermost business component; providers receive no props); manual `loadRemote` and `useLoadRemote` (returning the module for self-rendering) do not — wrap yourself there |
 | Execution count (onSession) | Deduplicated by the non-sensitive `sessionKey`: once per login generation; a new generation first invalidates the old `signal`, then chains the old call and the new call **serially** per remote (preventing two accounts' async writes from interleaving); `clearAppContext()` invalidates the dedup state, forcing a rerun on the next login. App-level setup does not re-run on logout/generation switch |
 | sessionKey | The host login flow generates a new generation on every successful login/re-login (non-sensitive ID, never a token); kept when a token refreshes but the session does not. **onSession present but sessionKey missing → MFU-013**; identity is never guessed from a user object reference; remotes without onSession need no sessionKey |
-| Export validation | Must default-export a function; the named `onSession` is optional and must be a function; `globalComponents` is optional and must be an object (key = registered name, value = component); `pageProviders` is optional and must be an array (entries = component objects or zero-arg loaders; functions with parameters or `displayName`/`props`/`emits` metadata remain static components; wrap unmarked zero-argument components with `defineComponent`; entry contents are validated at consumer-side resolution). Violations → MFU-011 (reports actual type / expected signature / fix) |
+| Export validation | At least one of default/onSession/globalComponents/pageProviders must be declared; any provided default must be a function; the named `onSession` is optional and must be a function; `globalComponents` is optional and must be an object (key = registered name, value = component); `pageProviders` is optional and must be an array (entries = component objects or zero-arg loaders; functions with parameters or `displayName`/`props`/`emits` metadata remain static components; wrap unmarked zero-argument components with `defineComponent`; entry contents are validated at consumer-side resolution). Violations → MFU-011 (reports actual type / expected signature / fix) |
 | Failure and retry | setup/onSession throwing → that `loadRemote` rejects (MFU-012); **only the failed stage's cache is cleared** (after a setup failure the retry starts at setup; an onSession failure only reruns the session segment); already-successful stages are not repeated. `fallbackModule` never masks an initialization failure |
 | Self-recursion | `loadRemote(same remote/…)` inside setup/onSession's synchronous segment → MFU-014 (the call waits on itself, deadlocking). Same-remote recursion inside the async segment cannot be attributed precisely and shows up as a hang — never load same-remote modules inside initialization |
 | dev/prod parity | The dev container (middleware-served) and the prod container (build artifact) carry the same setup metadata (the container's `__fulgurjsSetup` field + the manifest's `setup` field); the internal expose key `./__fulgurjs_setup__` never appears in type artifacts or public exposes lists |
@@ -444,7 +446,7 @@ export default defineBridgeApp(async (props, ctx) => {
 // Vue host (/vue)
 import { createVueBridgeApp } from '@fulgurjs/federation/vue'
 const RemoteReactApp = createVueBridgeApp<P>('react-remote/bridge', {
-  loadingComponent?, errorComponent?, retries?, timeout?, getContext?,
+  loadingComponent?, errorComponent?, retries?, timeout?, getContext?, session?, sessionStorageKey?,
 })
 // Template: <RemoteReactApp :session-key="loginKey" :app-props="{ userId, onReady }" />
 
@@ -471,12 +473,21 @@ const RemoteVueApp = createReactBridgeApp<P>('vue-remote/bridge', {
 - **DOM ownership**: the wrapper component only creates and keeps a stable empty mount container; host re-renders never patch inside the child app's root. React host StrictMode double effects are safe. Vue `<KeepAlive>` deactivate is not unmount — a child app in a cached page keeps its root and state.
 - **Old requests never pretend to be cancelled**: work already inside `loadRemote` is not cancelled because the bridge layer invalidates it — late old results are discarded by generation; the remote's `onSession` must honor the `signal.aborted` contract.
 
+### Automatic Vue session options
+
+| Option | Type / default | Behavior |
+|---|---|---|
+| `session` | `() => string \| number \| null \| undefined` / disabled | Synchronous reactive identity getter in createVueBridgeApp: stable ID=ready, null=logout, undefined=restoring. The plugin owns generation/context; do not also pass sessionKey. |
+| `sessionStorageKey` | `string` / `fulgurjs-bridge-session` | Records use this namespace plus `:auto`. All remotes of one host share it. Only meaningful with session enabled. |
+
+The same identity restores its generation on reentry/reload; a changed identity generates a new one. Never use credentials or sensitive data. localStorage updates must be reflected in reactive state. Omit session to disable, provide a getter to enable, add sessionStorageKey to customize. getContext need not return sessionKey; explicit conflicts remain errors. Getter errors/illegal results appear as MFU-016 (getContext); invalid option types throw TypeError immediately. See [automatic sessions](../guide/app-bridge.md).
+
 ### Host-side helper: `createBridgeSession` (Vue)
 
-`createBridgeSession(options?)` (`/vue`) — moves the **contract semantics** of sessionKey (non-sensitive login generation, never the token itself, null = logged out, unchanged across reloads within one session) into the plugin; the host only decides when to call it:
+`createBridgeSession(options?)` (`/vue`) — moves the **contract semantics** of sessionKey (non-sensitive login generation, never the token itself, null = logged out, unchanged across reloads within one session) into the plugin; this is the explicit-control helper. Normal Vue bridges should use the factory session identity getter instead of manual calls:
 
 ```ts
-// src/fulgurjs/host/session.ts (create once at module level)
+// src/fulgurjs/host/context.ts (create once at module level)
 import { createBridgeSession } from '@fulgurjs/federation/vue'
 export const bridgeSession = createBridgeSession()
 // on successful login → bridgeSession.renew(); on logout → bridgeSession.clear()

package/docs/en/reference/errors.md

@@ -66,7 +66,7 @@
 | `MFU-008` | Runtime reports an unknown remote | The remote name in the spec/call is not in `remotes`/the runtime registry | Check the remote name spelling; for dynamic remotes call `registerRemote`/`registerRemotes` first |
 | `MFU-009` | Runtime reports the loaded module has no exports | The expose target file has no exports (an empty module / side effects only) | Add exports to the expose target file; confirm the expected file is what got loaded |
 | `MFU-010` | Runtime warns the selected shared singleton version fails some consumer's requirement (lists candidate versions, the provider, impact, and fixes; the same combination warns once) | The version singleton converged on is outside some consumer's requiredVersion; or a bridge host/child app missing singleton causes double-instance symptoms (Invalid hook call) | Align dependency versions; confirm the warning is acceptable or adjust requiredVersion; three singleton keys for cross-framework hosts |
-| `MFU-011` | Runtime reports an illegal setup lifecycle entry export shape (reports actual type / expected signature / fix) | The setup module's default export or named `onSession` is not a function (other exports are not entries) | Default-export a `setup(context)` function from the setup file; optionally a named `onSession(context)` function |
+| `MFU-011` | Runtime reports an illegal setup lifecycle entry export shape (reports actual type / expected signature / fix) | Empty setup module, non-function default/onSession, or invalid component/Provider declarations | Export an initialization function or valid onSession/globalComponents/pageProviders; no empty function is required and an empty module is invalid |
 | `MFU-012` | That `loadRemote` rejects, reporting setup/onSession threw (cause carries the original exception) | The initialization code itself threw | Fix the error inside setup/onSession and retry directly — only the failed stage's cache is cleared (after a setup failure the retry starts at setup; an onSession failure only reruns the session segment); already-successful stages are not repeated |
 | `MFU-013` | Runtime reports the remote declares onSession but the host AppContext lacks sessionKey | The host did not provide a non-sensitive login generation ID (never use a token as one) | In the host login flow call `provideAppContext({ sessionKey })` — generate a new value on every successful login/re-login; token refreshes keep it |
 | `MFU-014` | Runtime reports a recursive loadRemote of the same remote inside setup/onSession's synchronous segment | Loading a module of the same remote inside the initialization's synchronous segment — the call waits on itself, deadlocking | Do not load same-remote modules inside initialization; put cross-remote loads in the async segment |

package/docs/en/reference/types.md

@@ -213,10 +213,9 @@ Import from: `@fulgurjs/federation/react`, `@fulgurjs/federation/runtime`, `@ful
 
 | Field | Optional | Type | Contract |
 |---|---|---|---|
-| `default` | no | `(ctx: RemoteSetupContext) => void \| Promise<void>` | See the owning API for lifecycle and runtime defaults. |
+| `default` | yes | `(ctx: RemoteSetupContext) => void \| Promise<void>` | See the owning API for lifecycle and runtime defaults. |
 | `onSession` | yes | `(ctx: RemoteSetupContext) => void \| Promise<void>` | See the owning API for lifecycle and runtime defaults. |
 | `globalComponents` | yes | `Record<string, unknown>` | Static components retain their identity. Zero-argument functions with displayName/props/emits metadata are components; unmarked zero-argument functions are lazy loaders. See the setup API for installation and retry semantics. |
-
 | `pageProviders` | yes | `unknown[]` | Ancestor Providers required by remote components; each item is a component or zero-argument loader. Adapters wrap the actual consumer tree without copying the provider application. |
 
 ## AppContext
@@ -433,6 +432,9 @@ Import from: `@fulgurjs/federation/vue`.
 | `retries` | yes | `number` | See the owning API for lifecycle and runtime defaults. |
 | `timeout` | yes | `number` | See the owning API for lifecycle and runtime defaults. |
 | `getContext` | yes | `() => Partial<AppContext> & Record<string, unknown>` | See the owning API for lifecycle and runtime defaults. |
+| `session` | yes | `() => string \| number \| null \| undefined` | Reactive non-sensitive identity; managed generations. null=logout, undefined=restoring; do not combine with sessionKey. |
+| `sessionStorageKey` | yes | `string` | Automatic session namespace; defaults to fulgurjs-bridge-session and is shared by one host. |
+
 
 ## VueBridgeRouterConnection
 

package/docs/zh/reference/api.md

@@ -339,6 +339,8 @@ export const pageProviders: RemoteSetupModule['pageProviders'] = [
 
 `RemoteSetupContext`：`{ appContext: Readonly<AppContext>, sessionKey?: string, signal: AbortSignal }`。`appContext` 是**调用时**从页面级 AppContext 取得的快照（不保存永不更新的旧引用）；`signal` 在登录代次变化或退出清理时失效。
 
+没有应用级副作用时可只导出 pageProviders/globalComponents/onSession，省略默认函数；模块至少有一项有效声明，不为通过校验写空函数。
+
 固定契约：
 
 | 维度 | 语义 |
@@ -348,10 +350,9 @@ export const pageProviders: RemoteSetupModule['pageProviders'] = [
 | 执行次数（setup） | 每容器一次；并发调用共享同一 Promise；成功后不重复。`preloadRemote` 只预取资源不执行 |
 | 执行次数（globalComponents） | 声明提取随 setup 一次；**安装随每次 `loadRemote` 执行**（幂等，`app.component` 同名覆盖，后注册生效）——桥接子应用每次挂载新建 app 实例也能拿到注册。Vue `remoteComponent` 和 `createHostPages` 自动捕获消费方 app；手动 `loadRemote` 与 React 侧不自动传入（React 无 Vue 全局注册表）——跳过安装，不报错。注册随消费方 app 生命周期驻留，无独立卸载 API |
 | 执行次数（pageProviders） | 声明提取随 setup 一次；**包裹随每次组件渲染生效**（声明数组按引用缓存，成功的 loader 结果复用，失败清缓存允许同页重试；setup 重跑换新数组时也重新解析）。Vue `remoteComponent`/`createHostPages` 与 React `remoteComponent`/`createReactHostPages` 自动应用（按 外→内 包裹，attrs/slots 透传给最内层业务组件，Provider 不收 props）；手动 `loadRemote` 与 `useLoadRemote`（返回模块自行渲染）不自动应用——这类消费自行包裹 |
-| 导出校验 | 必须默认导出函数；具名 `onSession` 可选且必须是函数；`globalComponents` 可选且必须是对象（键=注册名，值=组件）；`pageProviders` 可选且必须是数组（项=组件对象或零参 loader，带参函数或带 `displayName`/`props`/`emits` 元数据的函数视为静态函数组件；无元数据的零参组件请用 `defineComponent` 包装；项内容在消费方解析时校验）。违反 → MFU-011（报实际类型/预期签名/修法） |
+| 导出校验 | 默认函数可省略，但必须声明 default/onSession/globalComponents/pageProviders 中至少一项；已有默认导出必须为函数，具名 `onSession` 可选且必须是函数；`globalComponents` 可选且必须是对象（键=注册名，值=组件）；`pageProviders` 可选且必须是数组（项=组件对象或零参 loader，带参函数或带 `displayName`/`props`/`emits` 元数据的函数视为静态函数组件；无元数据的零参组件请用 `defineComponent` 包装；项内容在消费方解析时校验）。违反 → MFU-011（报实际类型/预期签名/修法） |
 | 执行次数（onSession） | 按非敏感 `sessionKey` 去重：同一登录代次一次；新代次先作废旧 `signal`，再按远程**串行**衔接旧调用与新调用（防两账号异步写入交错）；`clearAppContext()` 失效去重状态，下次登录必须重跑。应用级 setup 不因退出/换代重复执行 |
 | sessionKey | 宿主登录流程每次成功登录/重登生成新代次（非敏感 ID，禁止用 token）；token 刷新但会话未变时沿用。**有 onSession 却缺 sessionKey → MFU-013**，不凭用户对象引用猜测身份；无 onSession 的远程无需 sessionKey |
-| 导出校验 | 必须默认导出函数；具名 `onSession` 可选且必须是函数；`globalComponents` 可选且必须是对象（键=注册名，值=组件）。违反 → MFU-011（报实际类型/预期签名/修法） |
 | 失败与重试 | setup/onSession 抛错 → 该次 `loadRemote` 拒绝（MFU-012）；**只清失败阶段的缓存**（setup 失败重试从 setup 开始；onSession 失败只重跑会话段），已成功的阶段不重复。`fallbackModule` 不掩盖初始化失败 |
 | 自递归 | setup/onSession 同步段内 `loadRemote(同 remote/…)` → MFU-014（该调用会等待自身形成死锁）。异步段内的同远程递归无法精确归因，表现为挂起——不要在初始化内加载同远程模块 |
 | dev/prod 一致 | dev 容器（中间件直出）与 prod 容器（构建产物）携带同一 setup 元数据（容器上的 `__fulgurjsSetup` 字段 + manifest 的 `setup` 字段）；内部 expose 键 `./__fulgurjs_setup__` 不出现在类型产物与公开文档 exposes 清单中 |
@@ -440,7 +441,7 @@ export default defineBridgeApp(async (props, ctx) => {
 // Vue 宿主（/vue）
 import { createVueBridgeApp } from '@fulgurjs/federation/vue'
 const RemoteReactApp = createVueBridgeApp<P>('react-remote/bridge', {
-  loadingComponent?, errorComponent?, retries?, timeout?, getContext?,
+  loadingComponent?, errorComponent?, retries?, timeout?, getContext?, session?, sessionStorageKey?,
 })
 // 模板：<RemoteReactApp :session-key="loginKey" :app-props="{ userId, onReady }" />
 
@@ -454,7 +455,7 @@ const RemoteVueApp = createReactBridgeApp<P>('vue-remote/bridge', {
 
 | 项 | `createVueBridgeApp`（Vue 宿主） | `createReactBridgeApp`（React 宿主） |
 |---|---|---|
-| 工厂选项 | `loadingComponent?` `errorComponent?`（收到 `error` prop，完全接管） `retries?`（0–10 整数） `timeout?`（正有限 ms） `getContext?` | `fallback?`（pending 占位） `error?`（节点或 `(error, retry) => ReactNode`） `retries?` `timeout?` `getContext?` |
+| 工厂选项 | `loadingComponent?` `errorComponent?`（收到 `error` prop，完全接管） `retries?`（0–10 整数） `timeout?`（正有限 ms） `getContext?` `session?` `sessionStorageKey?` | `fallback?`（pending 占位） `error?`（节点或 `(error, retry) => ReactNode`） `retries?` `timeout?` `getContext?` |
 | 返回组件 props | `appProps: P`（业务数据）+ `sessionKey?: string \| null`（控制参数，不混入业务 props） | 同左，`ComponentType<{ appProps: P; sessionKey?: string \| null }>` |
 | 泛型 | `createVueBridgeApp<P>(spec, options?)`，P 只约束 `appProps` | 同左 |
 | spec | 完整 `<remote>/<expose>`，与 `remoteComponent` 同一解析规则；无 remotePrefixes/schema/deriveSpec | 同左 |
@@ -467,12 +468,21 @@ const RemoteVueApp = createReactBridgeApp<P>('vue-remote/bridge', {
 - **DOM 所有权**：包装组件只创建并保持稳定的空挂载容器；宿主重渲染不 patch 子应用 root 内部。React 宿主 StrictMode 双 effect 安全。Vue `<KeepAlive>` 的 deactivate 不是卸载——缓存页中的子应用保有 root 与状态。
 - **旧请求不冒充取消**：已进入 `loadRemote` 的工作不因桥接层作废而被取消——迟到的旧结果按代次丢弃；远程 `onSession` 必须遵守 `signal.aborted` 契约。
 
+### Vue 自动会话选项
+
+| 选项 | 类型 / 默认 | 配置与效果 |
+|---|---|---|
+| `session` | `() => string \| number \| null \| undefined` / 不启用 | createVueBridgeApp 的同步响应式身份 getter；非空标识=登录就绪，null=退出，undefined=恢复中。插件管理代次与AppContext，不能同时传sessionKey prop。 |
+| `sessionStorageKey` | `string` / `fulgurjs-bridge-session` | 自动记录写入此命名空间的 `:auto` 键。同一宿主的远程使用相同命名空间；只在 session 启用时有意义。 |
+
+同身份重进/刷新恢复同代次，身份变化新建代次，token不参与身份判断。身份记录不能包含凭据或敏感资料；localStorage变化必须反映到响应式状态。关闭：省略session；开启：在工厂提供身份getter；自定义：同时提供sessionStorageKey。getContext不需要返回sessionKey；显式矛盾仍拒绝。getter非法返回值/抛错显示MFU-016（getContext），配置类型错误立即抛出TypeError。详见[自动会话](../guide/app-bridge.md)。
+
 ### 宿主侧辅助：`createBridgeSession`（Vue）
 
-`createBridgeSession(options?)`（`/vue`）——把 sessionKey 的**契约语义**（非敏感登录代次、禁用 token 充当、null=登出、同会话刷新不变）收进插件，宿主只决定调用时机：
+`createBridgeSession(options?)`（`/vue`）——把 sessionKey 的**契约语义**（非敏感登录代次、禁用 token 充当、null=登出、同会话刷新不变）收进插件，这是显式控制工具；常规Vue桥接推荐配置工厂 `session` 身份 getter，由插件自动管理，不必调用下方方法：
 
 ```ts
-// src/fulgurjs/host/session.ts（模块级创建一次）
+// src/fulgurjs/host/context.ts（模块级创建一次）
 import { createBridgeSession } from '@fulgurjs/federation/vue'
 export const bridgeSession = createBridgeSession()
 // 登录成功 → bridgeSession.renew()；退出登录 → bridgeSession.clear()

package/docs/zh/reference/errors.md

@@ -65,7 +65,7 @@
 | `MFU-008` | 运行时报未知远程 | spec/调用里的远程名不在 `remotes`/运行时注册表里 | 核对远程名拼写；动态远程先 `registerRemote`/`registerRemotes` |
 | `MFU-009` | 运行时报加载到的模块没有任何导出 | expose 目标文件没有导出（空模块/只有副作用） | 给 expose 目标文件补导出；确认加载的是预期文件 |
 | `MFU-010` | 运行时警告选中的共享单例版本不满足某消费方要求（列出候选版本、提供方、影响与修法；同一组合只告警一次） | singleton 收敛到的版本不在某消费方 requiredVersion 内；或桥接宿主/子应用缺 singleton 导致双实例症状（Invalid hook call） | 统一依赖版本；确认告警可接受或调整 requiredVersion；跨框架宿主三键 singleton |
-| `MFU-011` | 运行时报 setup 生命周期入口导出形态非法（报实际类型/预期签名/修法） | setup 模块的默认导出或具名 `onSession` 不是函数（其他导出不作为入口） | setup 文件默认导出 `setup(context)` 函数；可选具名导出 `onSession(context)` 函数 |
+| `MFU-011` | 运行时报 setup 生命周期入口导出形态非法（报实际类型/预期签名/修法） | setup模块为空、已有默认导出/onSession不是函数，或组件/Provider声明形态非法 | 默认导出初始化函数，或声明有效onSession/globalComponents/pageProviders；无需空函数，不接受空模块 |
 | `MFU-012` | 该次 `loadRemote` 拒绝，报 setup/onSession 执行抛错（cause 含原始异常） | 初始化代码自身抛错 | 修复 setup/onSession 内部错误后直接重试——只清失败阶段缓存（setup 失败重试从 setup 开始；onSession 失败只重跑会话段），已成功阶段不重复 |
 | `MFU-013` | 运行时报远程声明 onSession 但宿主 AppContext 缺 sessionKey | 宿主未提供非敏感登录代次 ID（禁止用 token 充当） | 宿主登录流程 `provideAppContext({ sessionKey })`——每次成功登录/重登生成新值，token 刷新沿用 |
 | `MFU-014` | 运行时报 setup/onSession 同步段内递归 loadRemote 同一远程 | 初始化同步段内加载同远程模块——该调用会等待自身形成死锁 | 初始化内不要加载同远程模块；跨远程加载放异步段 |

package/docs/zh/reference/types.md

@@ -213,10 +213,9 @@ setup/onSession 收到的上下文.
 
 | 字段 | 可省略 | 类型 | 说明 |
 |---|---|---|---|
-| `default` | no | `(ctx: RemoteSetupContext) => void \| Promise<void>` | 见对应 API 合同。 |
+| `default` | yes | `(ctx: RemoteSetupContext) => void \| Promise<void>` | 见对应 API 合同。 |
 | `onSession` | yes | `(ctx: RemoteSetupContext) => void \| Promise<void>` | 见对应 API 合同。 |
 | `globalComponents` | yes | `Record<string, unknown>` | 远程暴露面依赖的「宿主全局注册组件」声明（键=组件注册名，值=组件对象或零参 loader）： 组件联邦（remoteComponent）把远程组件渲染进消费方 app 上下文，模板里的 字符串标签（如 <a-divider>）按消费方 app 的全局注册表解析——消费方没注册就 渲染成死元素。提供方在此声明后，运行时在每次 loadRemote 时把它们幂等注册到 当次传入的 consumerApp 上；无 consumerApp（无组件上下文的手动加载）时静默跳过。 值推荐「零参 loader（() => import('./X.vue')）」：setup 模块保持零重依赖， 组件只在本框架消费方真实渲染时才加载——Vue 适配器注册时自动包 defineAsyncComponent； 静态组件值仍支持；带 displayName/props/emits 的零参函数保留组件身份，未标记零参函数作 loader。运行时对值原样透传。 |
-
 | `pageProviders` | yes | `unknown[]` | 远程组件所需的祖先 Provider；元素为组件或零参 loader。由组件适配器包裹实际消费树，不复制提供方整个 app。 |
 
 ## AppContext
@@ -419,6 +418,9 @@ Vue 宿主桥接的加载与上下文选项.
 | `retries` | yes | `number` | 透传现行 loadRemote 的重试选项（0-10 整数），不另叠自动重试 |
 | `timeout` | yes | `number` | 本次桥接加载等待上限 ms；不取消已发出的共享请求，迟到结果一律丢弃 |
 | `getContext` | yes | `() => Partial<AppContext> & Record<string, unknown>` | 无副作用的同步 getter：首次、重试及换会话的实际加载前返回本次所需上下文快照 |
+| `session` | yes | `() => string \| number \| null \| undefined` | 响应式非敏感身份；插件自动管理代次。null退出、undefined恢复中；不与sessionKey prop并用。 |
+| `sessionStorageKey` | yes | `string` | 自动会话命名空间，默认fulgurjs-bridge-session；同一宿主的远程一致。 |
+
 
 ## VueBridgeRouterConnection
 

package/examples/templates/README.md

@@ -1,5 +1,7 @@
 # fulgurjs-federation 模板（examples/templates/）
 
+> **本分支为待验收源码候选**：Vue宿主自动会话示例需要本分支候选包。锁文件仍保留既有正式包作为发布前基线；验收先构建候选并在隔离副本安装覆盖，正式交付必须完成发布、模板升钉与干净冻结安装后移除此提示。不要把当前旧锁直接运行的结果记作新功能通过。
+
 > 五个模板统一使用 defineApplication 装配。按各模板 README 的冻结安装命令安装 registry 正式包。
 
 

package/examples/templates/react-host-vue-remote/pnpm-lock.yaml

@@ -11,8 +11,8 @@ importers:
   react-host:
     dependencies:
       '@fulgurjs/federation':
-        specifier: 6.11.4
-        version: 6.11.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue-router@4.6.4(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))
+        specifier: 6.12.0
+        version: 6.12.0(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue-router@4.6.4(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))
       react:
         specifier: ^19.1.0
         version: 19.3.0
@@ -42,8 +42,8 @@ importers:
   vue-remote:
     dependencies:
       '@fulgurjs/federation':
-        specifier: 6.11.4
-        version: 6.11.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue-router@4.6.4(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))
+        specifier: 6.12.0
+        version: 6.12.0(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue-router@4.6.4(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))
       vue:
         specifier: ^3.5.13
         version: 3.5.44(typescript@5.9.3)
@@ -461,8 +461,8 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@fulgurjs/federation@6.11.4':
-    resolution: {integrity: sha512-FyBLpBwRbMcLY7tlUIGl2HJBCa+U1GmpQvhTITdJun8pFWfW+9uyNVf3CxZB8S1WizhbXgVuPeWyOgujdsF7rw==}
+  '@fulgurjs/federation@6.12.0':
+    resolution: {integrity: sha512-l37+A1drLgzIztZBTthhQKWuLXUwtsjfv5WQ2cqOHwMxVu/2qYwaacAk4OgDcN/6M4Vyjj8hMGNQL6Hd3Zr46Q==}
     engines: {node: '>=18'}
     hasBin: true
     peerDependencies:
@@ -1259,7 +1259,7 @@ snapshots:
   '@esbuild/win32-x64@0.27.7':
     optional: true
 
-  '@fulgurjs/federation@6.11.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue-router@4.6.4(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))':
+  '@fulgurjs/federation@6.12.0(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue-router@4.6.4(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))':
     dependencies:
       es-module-lexer: 1.7.0
       esbuild: 0.27.7

package/examples/templates/react-host-vue-remote/pnpm-workspace.yaml

@@ -2,7 +2,7 @@ packages:
   - react-host
   - vue-remote
 minimumReleaseAgeExclude:
-  - '@fulgurjs/federation@6.11.4'
+  - '@fulgurjs/federation@6.11.4 || 6.12.0'
 # pnpm >=12 构建脚本批准（12 起弃用 onlyBuiltDependencies；pnpm 9-11 忽略本键：
 # esbuild >=0.16 二进制经 optionalDependencies 平台包分发，postinstall 仅校验，不阻塞安装）
 allowBuilds:

package/examples/templates/react-host-vue-remote/react-host/package.json

@@ -11,7 +11,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@fulgurjs/federation": "6.11.4",
+    "@fulgurjs/federation": "6.12.0",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
     "vue": "^3.5.13"

package/examples/templates/react-host-vue-remote/vue-remote/package.json

@@ -11,7 +11,7 @@
     "typecheck": "vue-tsc --noEmit"
   },
   "dependencies": {
-    "@fulgurjs/federation": "6.11.4",
+    "@fulgurjs/federation": "6.12.0",
     "vue": "^3.5.13",
     "vue-router": "^4.5.0"
   },

package/examples/templates/react-react/host/package.json

@@ -11,7 +11,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@fulgurjs/federation": "6.11.4",
+    "@fulgurjs/federation": "6.12.0",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
     "react-router-dom": "^7.1.0"

package/examples/templates/react-react/pnpm-lock.yaml

@@ -11,8 +11,8 @@ importers:
   host:
     dependencies:
       '@fulgurjs/federation':
-        specifier: 6.11.4
-        version: 6.11.4(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)
+        specifier: 6.12.0
+        version: 6.12.0(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)
       react:
         specifier: ^19.1.0
         version: 19.3.0
@@ -42,8 +42,8 @@ importers:
   remote:
     dependencies:
       '@fulgurjs/federation':
-        specifier: 6.11.4
-        version: 6.11.4(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)
+        specifier: 6.12.0
+        version: 6.12.0(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)
       react:
         specifier: ^19.1.0
         version: 19.3.0
@@ -464,8 +464,8 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@fulgurjs/federation@6.11.4':
-    resolution: {integrity: sha512-FyBLpBwRbMcLY7tlUIGl2HJBCa+U1GmpQvhTITdJun8pFWfW+9uyNVf3CxZB8S1WizhbXgVuPeWyOgujdsF7rw==}
+  '@fulgurjs/federation@6.12.0':
+    resolution: {integrity: sha512-l37+A1drLgzIztZBTthhQKWuLXUwtsjfv5WQ2cqOHwMxVu/2qYwaacAk4OgDcN/6M4Vyjj8hMGNQL6Hd3Zr46Q==}
     engines: {node: '>=18'}
     hasBin: true
     peerDependencies:
@@ -1169,7 +1169,7 @@ snapshots:
   '@esbuild/win32-x64@0.27.7':
     optional: true
 
-  '@fulgurjs/federation@6.11.4(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)':
+  '@fulgurjs/federation@6.12.0(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)':
     dependencies:
       es-module-lexer: 1.7.0
       esbuild: 0.27.7

package/examples/templates/react-react/pnpm-workspace.yaml

@@ -2,7 +2,7 @@ packages:
   - host
   - remote
 minimumReleaseAgeExclude:
-  - '@fulgurjs/federation@6.11.4'
+  - '@fulgurjs/federation@6.11.4 || 6.12.0'
 # pnpm >=12 构建脚本批准（12 起弃用 onlyBuiltDependencies；pnpm 9-11 忽略本键：
 # esbuild >=0.16 二进制经 optionalDependencies 平台包分发，postinstall 仅校验，不阻塞安装）
 allowBuilds:

package/examples/templates/react-react/remote/package.json

@@ -11,7 +11,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@fulgurjs/federation": "6.11.4",
+    "@fulgurjs/federation": "6.12.0",
     "react": "^19.1.0",
     "react-dom": "^19.1.0"
   },

package/examples/templates/showcase/pnpm-lock.yaml

@@ -11,8 +11,8 @@ importers:
   react-host:
     dependencies:
       '@fulgurjs/federation':
-        specifier: 6.11.4
-        version: 6.11.4(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue-router@4.6.4(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))
+        specifier: 6.12.0
+        version: 6.12.0(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue-router@4.6.4(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))
       react:
         specifier: ^19.1.0
         version: 19.3.0
@@ -45,8 +45,8 @@ importers:
   react-remote:
     dependencies:
       '@fulgurjs/federation':
-        specifier: 6.11.4
-        version: 6.11.4(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue-router@4.6.4(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))
+        specifier: 6.12.0
+        version: 6.12.0(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue-router@4.6.4(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))
       react:
         specifier: ^19.1.0
         version: 19.3.0
@@ -76,8 +76,8 @@ importers:
   vue-host:
     dependencies:
       '@fulgurjs/federation':
-        specifier: 6.11.4
-        version: 6.11.4(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue-router@4.6.4(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))
+        specifier: 6.12.0
+        version: 6.12.0(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue-router@4.6.4(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))
       react:
         specifier: ^19.1.0
         version: 19.3.0
@@ -107,8 +107,8 @@ importers:
   vue-remote:
     dependencies:
       '@fulgurjs/federation':
-        specifier: 6.11.4
-        version: 6.11.4(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue-router@4.6.4(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))
+        specifier: 6.12.0
+        version: 6.12.0(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue-router@4.6.4(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))
       vue:
         specifier: ^3.5.13
         version: 3.5.44(typescript@5.9.3)
@@ -526,8 +526,8 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@fulgurjs/federation@6.11.4':
-    resolution: {integrity: sha512-FyBLpBwRbMcLY7tlUIGl2HJBCa+U1GmpQvhTITdJun8pFWfW+9uyNVf3CxZB8S1WizhbXgVuPeWyOgujdsF7rw==}
+  '@fulgurjs/federation@6.12.0':
+    resolution: {integrity: sha512-l37+A1drLgzIztZBTthhQKWuLXUwtsjfv5WQ2cqOHwMxVu/2qYwaacAk4OgDcN/6M4Vyjj8hMGNQL6Hd3Zr46Q==}
     engines: {node: '>=18'}
     hasBin: true
     peerDependencies:
@@ -1348,7 +1348,7 @@ snapshots:
   '@esbuild/win32-x64@0.27.7':
     optional: true
 
-  '@fulgurjs/federation@6.11.4(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue-router@4.6.4(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))':
+  '@fulgurjs/federation@6.12.0(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue-router@4.6.4(vue@3.5.44(typescript@5.9.3)))(vue@3.5.44(typescript@5.9.3))':
     dependencies:
       es-module-lexer: 1.7.0
       esbuild: 0.27.7

package/examples/templates/showcase/pnpm-workspace.yaml

@@ -4,7 +4,7 @@ packages:
   - react-host
   - react-remote
 minimumReleaseAgeExclude:
-  - '@fulgurjs/federation@6.11.4'
+  - '@fulgurjs/federation@6.11.4 || 6.12.0'
 # pnpm >=12 构建脚本批准（12 起弃用 onlyBuiltDependencies；pnpm 9-11 忽略本键：
 # esbuild >=0.16 二进制经 optionalDependencies 平台包分发，postinstall 仅校验，不阻塞安装）
 allowBuilds:

package/examples/templates/showcase/react-host/package.json

@@ -11,7 +11,7 @@
     "types": "fulgurjs types"
   },
   "dependencies": {
-    "@fulgurjs/federation": "6.11.4",
+    "@fulgurjs/federation": "6.12.0",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
     "react-router-dom": "^7.1.0",

package/examples/templates/showcase/react-remote/package.json

@@ -11,7 +11,7 @@
     "types": "fulgurjs types"
   },
   "dependencies": {
-    "@fulgurjs/federation": "6.11.4",
+    "@fulgurjs/federation": "6.12.0",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
     "react-router-dom": "^7.1.0"

package/examples/templates/showcase/vue-host/package.json

@@ -11,7 +11,7 @@
     "types": "fulgurjs types"
   },
   "dependencies": {
-    "@fulgurjs/federation": "6.11.4",
+    "@fulgurjs/federation": "6.12.0",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
     "vue": "^3.5.13",

package/examples/templates/showcase/vue-remote/package.json

@@ -11,7 +11,7 @@
     "types": "fulgurjs types"
   },
   "dependencies": {
-    "@fulgurjs/federation": "6.11.4",
+    "@fulgurjs/federation": "6.12.0",
     "vue": "^3.5.13",
     "vue-router": "^4.5.0"
   },

package/examples/templates/vue-host-react-remote/README.md

@@ -1,6 +1,6 @@
 # vue-host-react-remote：完整子应用桥接模板
 
-> 本目录是 6.9.0 源码候选：已改用 defineApplication，尚未测试和发布。源码依赖已锁定 6.9.0；正式发布前不要拿旧 registry 包运行这份代码。验收先使用本次候选 tarball，发布后再按下列冻结安装命令验证正式包。
+> 本目录使用 `6.12.0-next.0` 源码候选新增的自动会话能力，尚未构建、测试或发布。当前模板的正式包依赖与锁文件仍是旧版本；验收人员须先构建本分支，在独立副本中安装候选 tarball 后验证。正式交付前再统一更新为已发布版本并重新生成真实 registry 锁文件。下面的冻结安装命令须在这一步完成后使用。
 
 
 `vue-host/` 是宿主，`react-remote/` 是子应用。复制整个模板目录，在根目录运行：
@@ -46,3 +46,7 @@ pnpm prod
 | `scripts/dev.mjs` / `scripts/prod.mjs` | 统一开发/生产启动器；业务接入不复制它们到应用源码 |
 
 `application` 是新增的插件装配文件，`main` 是已有入口接线；页面组件、业务路由、权限和数据不是每个项目都必写的联邦配置。跨框架基础组合不逐页登记子应用菜单；逐页远程页面模板的页面表仅服务它所展示的逐页场景。`src/fulgurjs/types/` 是插件生成目录，按远程实际版本同步，不维护人工伪造的声明或旧缓存。
+
+### 登录接线
+
+Vue宿主在 `src/fulgurjs/host/context.ts` 提供现有业务身份和上下文；挂载配置使用 `session: sessionIdentity`。不在登录/登出流程调用 renew/clear，不手工传 sessionKey。页面提供“刷新 token”按钮，同身份刷新不应增加 onReady 次数；换到 Bob 重挂、登出卸载。真实工程使用已有账号系统，不复制演示登录数据。

package/examples/templates/vue-host-react-remote/pnpm-lock.yaml

@@ -11,8 +11,8 @@ importers:
   react-remote:
     dependencies:
       '@fulgurjs/federation':
-        specifier: 6.11.4
-        version: 6.11.4(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue@3.5.44(typescript@5.9.3))
+        specifier: 6.12.0
+        version: 6.12.0(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue@3.5.44(typescript@5.9.3))
       react:
         specifier: ^19.1.0
         version: 19.3.0
@@ -42,8 +42,8 @@ importers:
   vue-host:
     dependencies:
       '@fulgurjs/federation':
-        specifier: 6.11.4
-        version: 6.11.4(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue@3.5.44(typescript@5.9.3))
+        specifier: 6.12.0
+        version: 6.12.0(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue@3.5.44(typescript@5.9.3))
       react:
         specifier: ^19.1.0
         version: 19.3.0
@@ -470,8 +470,8 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@fulgurjs/federation@6.11.4':
-    resolution: {integrity: sha512-FyBLpBwRbMcLY7tlUIGl2HJBCa+U1GmpQvhTITdJun8pFWfW+9uyNVf3CxZB8S1WizhbXgVuPeWyOgujdsF7rw==}
+  '@fulgurjs/federation@6.12.0':
+    resolution: {integrity: sha512-l37+A1drLgzIztZBTthhQKWuLXUwtsjfv5WQ2cqOHwMxVu/2qYwaacAk4OgDcN/6M4Vyjj8hMGNQL6Hd3Zr46Q==}
     engines: {node: '>=18'}
     hasBin: true
     peerDependencies:
@@ -1284,7 +1284,7 @@ snapshots:
   '@esbuild/win32-x64@0.27.7':
     optional: true
 
-  '@fulgurjs/federation@6.11.4(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue@3.5.44(typescript@5.9.3))':
+  '@fulgurjs/federation@6.12.0(react-dom@19.3.0(react@19.3.0))(react-router-dom@7.18.4(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)(vite@6.4.4)(vue@3.5.44(typescript@5.9.3))':
     dependencies:
       es-module-lexer: 1.7.0
       esbuild: 0.27.7

package/examples/templates/vue-host-react-remote/pnpm-workspace.yaml

@@ -2,7 +2,7 @@ packages:
   - vue-host
   - react-remote
 minimumReleaseAgeExclude:
-  - '@fulgurjs/federation@6.11.4'
+  - '@fulgurjs/federation@6.11.4 || 6.12.0'
 # pnpm >=12 构建脚本批准（12 起弃用 onlyBuiltDependencies；pnpm 9-11 忽略本键：
 # esbuild >=0.16 二进制经 optionalDependencies 平台包分发，postinstall 仅校验，不阻塞安装）
 allowBuilds:

package/examples/templates/vue-host-react-remote/react-remote/package.json

@@ -11,7 +11,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@fulgurjs/federation": "6.11.4",
+    "@fulgurjs/federation": "6.12.0",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
     "react-router-dom": "^7.1.0"

package/examples/templates/vue-host-react-remote/vue-host/README.md

@@ -13,13 +13,17 @@ pnpm build                       # 构建完整组合
 # 单独启动本应用：pnpm --dir vue-host dev
 ```
 
-端口、复制范围与部署路径见[组合说明](../README.md)。
+端口、复制范围、候选版本验收要求与部署路径见[组合说明](../README.md)。
 
-## 关键点（对应 README §8.2）
+## 关键点
 
 - **双框架安装合同**：本宿主同时安装 `vue` + `react` + `react-dom`，shared 三键全部 `singleton: true`。
-- **入口选择**：统一入口 `@fulgurjs/federation/vue`——宿主代码全部来自 /vue，不会加载 React 适配代码（6.0.0 起 /bridge、/bridge/* 深层入口已移除）。
-- **`sessionKey`**：受控登录代次（非业务 props）。置 `null` = 登出态（立即卸载、不再请求）；换账号走「null → `clearAppContext()` → 新代次」顺序，保证 A 的 context 字段零残留。
-- **`getContext`**：同步纯 getter（`src/fulgurjs/host/session.ts`），桥接层校验其快照的 `sessionKey` 后才代写 AppContext。
+- **入口选择**：统一入口 `@fulgurjs/federation/vue`——宿主侧的联邦适配 API 从 /vue 导入。
+- **`session`**：绑定稳定的业务身份 getter。返回用户ID表示已登录，`null` 表示退出，`undefined` 表示身份恢复中。插件自动管理代次、恢复与卸载；同身份刷新 token 不重挂。
+- **`getContext`**：同步纯 getter（`src/fulgurjs/host/context.ts`），不手工填写 `sessionKey`，由桥接层补入自动管理的代次。token 通过函数读取当前凭据，避免刷新后继续发送旧 token。
 - **`appProps`**：挂载时浅拷贝快照；函数引用（`onReady`）保留原引用；换顶层引用不重挂，需要重置时用 `:key`。
 - 错误占位默认内置中文诊断 +「重试加载 / 刷新页面重试」；可用 `errorComponent` 完全接管。
+
+### 登录接线
+
+Vue宿主在 `src/fulgurjs/host/context.ts` 提供现有业务身份和上下文；挂载配置使用 `session: sessionIdentity`。不在登录/登出流程调用 renew/clear，不手工传 sessionKey。页面提供“刷新 token”按钮，同身份刷新不应增加 onReady 次数；换到 Bob 重挂、登出卸载。真实工程使用已有账号系统，不复制演示登录数据。

package/examples/templates/vue-host-react-remote/vue-host/package.json

@@ -11,7 +11,7 @@
     "typecheck": "vue-tsc --noEmit"
   },
   "dependencies": {
-    "@fulgurjs/federation": "6.11.4",
+    "@fulgurjs/federation": "6.12.0",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
     "vue": "^3.5.13"