@fulgurjs/federation 6.13.2 → 6.13.4

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # 当前发布说明
 
+## 6.13.4
+
+- 桥接宿主包装错误时原样保留非 Error 拒绝值；默认 Vue/React 桥接占位与卸载日志使用脱敏摘要。
+- 修复运行时调试出口重新暴露原始远程入口的问题；入口摘要去掉凭据、query/hash，失败摘要和插件日志清理标注的敏感值，原始 cause 不变。
+- 合并重复诊断格式与钩子日志，保持既有体积预算；补充非 Error 身份、调试摘要及两种框架默认提示的回归。
+- 五个模板依赖已发布的 6.13.3；本版本是诊断补强的基础包，后续模板资产版本再统一依赖本版。
+
+## 6.13.3
+
+- 修复 `bindStoreToApp` 在内联 `defineStore` 与 Pinia getter 组合时的泛型推导，保留真实 store 字段、方法和容器约束；使用真实 Pinia 的正反例检查。
+- 修复 MFU-019 的身份误判：只比较当前编译 SFC 实际导入的 Vue 函数与消费方 renderer，不再从默认共享表推断远程组件身份。支持生产脚本子请求；无证据、旧远程和冻结组件保持未知，不盲目拒绝合法组件或独立运行时桥接。
+- 默认 Vue/React 错误占位对地址中的凭据、query/hash 及标注的敏感值脱敏，原始异常仍保留在 `cause`；运行时调试摘要复用地址清理规则，并保留无入口地址的 promise remote 注册行为。
+- 同步源码、生成入口与版本锁文件，补充真实浏览器开发/生产对照、SFC 构建及声明消费回归；体积门禁保持原预算。
+
 ## 6.13.2
 
 构建期 chunk 分组两处修复（DEMES5.5 从零迁移轮 BI-FIX，均含业务工程生产构建/运行实测回归）：

package/dist/bridge-app-react.js

@@ -3,10 +3,10 @@ import {
 } from "./chunk-6OB47FSR.js";
 import {
   markBridgeMount
-} from "./chunk-NVJN2ARX.js";
-import "./chunk-TSPZ3EQ4.js";
-import "./chunk-MBH3TVAS.js";
-import "./chunk-YHXQHZ3E.js";
+} from "./chunk-EK5JODE4.js";
+import "./chunk-EGXWY5NW.js";
+import "./chunk-ATU42YF3.js";
+import "./chunk-NX3HRELG.js";
 
 // src/bridge-app-react.ts
 import { Component, createElement, useEffect } from "react";

package/dist/bridge-app-vue.cjs

@@ -26,11 +26,14 @@ __export(bridge_app_vue_exports, {
 module.exports = __toCommonJS(bridge_app_vue_exports);
 
 // src/runtime/errors.ts
+function diagnosticUrl(text) {
+  return text.replace(/(https?:\/\/)(?:[^\s/@]+@)?([^\s?#"'<>，。；）)\]]+)(?:[?#][^\s"'<>，。；）)\]]*)?/g, "$1$2");
+}
 var FgError = class extends Error {
   code;
   details;
   constructor(code, message, details, options) {
-    super(`[fulgurjs:${code}] ${message}`, options);
+    super(`[fulgurjs:${code}] ${diagnosticUrl(message)}`, options);
     this.name = "FgError";
     this.code = code;
     this.details = details;

package/dist/bridge-app-vue.js

@@ -3,16 +3,16 @@ import {
 } from "./chunk-6OB47FSR.js";
 import {
   sameLocation
-} from "./chunk-OQ4CGWNL.js";
+} from "./chunk-Y7YANGLN.js";
 import {
   markBridgeMount
-} from "./chunk-NVJN2ARX.js";
+} from "./chunk-EK5JODE4.js";
 import {
   routingChannelNotProvidedError,
   routingSyncError
-} from "./chunk-TSPZ3EQ4.js";
-import "./chunk-MBH3TVAS.js";
-import "./chunk-YHXQHZ3E.js";
+} from "./chunk-EGXWY5NW.js";
+import "./chunk-ATU42YF3.js";
+import "./chunk-NX3HRELG.js";
 
 // src/bridge-router-sync.ts
 function collapseConsecutiveReports(report) {

package/dist/bridge-core.cjs

@@ -33,11 +33,17 @@ __export(bridge_core_exports, {
 module.exports = __toCommonJS(bridge_core_exports);
 
 // src/runtime/errors.ts
+function diagnosticUrl(text) {
+  return text.replace(/(https?:\/\/)(?:[^\s/@]+@)?([^\s?#"'<>，。；）)\]]+)(?:[?#][^\s"'<>，。；）)\]]*)?/g, "$1$2");
+}
+function diagnosticMessage(error) {
+  return diagnosticUrl(String(error?.message ?? error)).replace(/\b(token|password|cookie|authorization)["']?\s*[:=]\s*["']?(?:Bearer\s+)?[^\s,;"'}]+/gi, "$1=[redacted]");
+}
 var FgError = class extends Error {
   code;
   details;
   constructor(code, message, details, options) {
-    super(`[fulgurjs:${code}] ${message}`, options);
+    super(`[fulgurjs:${code}] ${diagnosticUrl(message)}`, options);
     this.name = "FgError";
     this.code = code;
     this.details = details;
@@ -91,7 +97,7 @@ function invalidBridgeContractError(spec, mod) {
   );
 }
 function bridgeLifecycleError(phase, spec, cause, extra) {
-  const raw = cause instanceof Error ? cause.message : String(cause ?? "unknown");
+  const raw = diagnosticMessage(cause);
   const fixes = {
     getContext: "\u4FEE\u6CD5: \u2460 getContext \u5FC5\u987B\u662F\u540C\u6B65\u3001\u65E0\u526F\u4F5C\u7528\u7684 getter\uFF08\u4E0D\u5F97\u8FD4\u56DE Promise/thenable\uFF09\uFF1B\n        \u2461 \u8FD4\u56DE\u503C\u987B\u662F\u5305\u542B\u672C\u6B21\u4F1A\u8BDD\u5FEB\u7167\u7684\u5BF9\u8C61\uFF08\u53D7\u63A7 sessionKey \u65F6\u987B\u542B\u76F8\u540C sessionKey\uFF09\uFF1B\n        \u2462 \u5F02\u6B65\u83B7\u53D6\u7528\u6237\u8D44\u6599\u8BF7\u5728\u5BBF\u4E3B\u5B8C\u6210\u540E\u518D\u8BA9\u6865\u63A5\u7EC4\u4EF6\u8FDB\u5165\u53EF\u6302\u8F7D\u72B6\u6001\u3002",
     mount: "\u4FEE\u6CD5: \u2460 \u67E5\u770B\u6839\u56E0\u4E2D\u5B50\u5E94\u7528 mount \u7684\u539F\u59CB\u9519\u8BEF\uFF08\u5DE5\u5382\u629B\u9519\u6216\u9996\u6B21\u6E32\u67D3\u5931\u8D25\uFF09\uFF1B\n        \u2461 \u540C\u4E00\u5BB9\u5668\u672A\u5378\u8F7D\u524D\u91CD\u590D mount \u662F\u5951\u7EA6\u8FDD\u4F8B\u2014\u2014\u5148 unmount \u518D mount\uFF1B\n        \u2462 \u4FEE\u590D\u540E\u70B9\u51FB\u300C\u91CD\u8BD5\u52A0\u8F7D\u300D\u5728\u540C\u9875\u91CD\u5EFA\u6302\u8F7D\u3002",

package/dist/bridge-core.js

@@ -8,10 +8,10 @@ import {
   releaseBridgeSession,
   resolveBridgeContext,
   withBridgeTimeout
-} from "./chunk-NVJN2ARX.js";
-import "./chunk-TSPZ3EQ4.js";
-import "./chunk-MBH3TVAS.js";
-import "./chunk-YHXQHZ3E.js";
+} from "./chunk-EK5JODE4.js";
+import "./chunk-EGXWY5NW.js";
+import "./chunk-ATU42YF3.js";
+import "./chunk-NX3HRELG.js";
 export {
   acquireBridgeSession,
   assertBridgeContract,

package/dist/bridge-errors.cjs

@@ -35,11 +35,17 @@ __export(bridge_errors_exports, {
 module.exports = __toCommonJS(bridge_errors_exports);
 
 // src/runtime/errors.ts
+function diagnosticUrl(text) {
+  return text.replace(/(https?:\/\/)(?:[^\s/@]+@)?([^\s?#"'<>，。；）)\]]+)(?:[?#][^\s"'<>，。；）)\]]*)?/g, "$1$2");
+}
+function diagnosticMessage(error) {
+  return diagnosticUrl(String(error?.message ?? error)).replace(/\b(token|password|cookie|authorization)["']?\s*[:=]\s*["']?(?:Bearer\s+)?[^\s,;"'}]+/gi, "$1=[redacted]");
+}
 var FgError = class extends Error {
   code;
   details;
   constructor(code, message, details, options) {
-    super(`[fulgurjs:${code}] ${message}`, options);
+    super(`[fulgurjs:${code}] ${diagnosticUrl(message)}`, options);
     this.name = "FgError";
     this.code = code;
     this.details = details;
@@ -82,7 +88,7 @@ function invalidBridgeContractError(spec, mod) {
   );
 }
 function bridgeLifecycleError(phase, spec, cause, extra) {
-  const raw = cause instanceof Error ? cause.message : String(cause ?? "unknown");
+  const raw = diagnosticMessage(cause);
   const fixes = {
     getContext: "\u4FEE\u6CD5: \u2460 getContext \u5FC5\u987B\u662F\u540C\u6B65\u3001\u65E0\u526F\u4F5C\u7528\u7684 getter\uFF08\u4E0D\u5F97\u8FD4\u56DE Promise/thenable\uFF09\uFF1B\n        \u2461 \u8FD4\u56DE\u503C\u987B\u662F\u5305\u542B\u672C\u6B21\u4F1A\u8BDD\u5FEB\u7167\u7684\u5BF9\u8C61\uFF08\u53D7\u63A7 sessionKey \u65F6\u987B\u542B\u76F8\u540C sessionKey\uFF09\uFF1B\n        \u2462 \u5F02\u6B65\u83B7\u53D6\u7528\u6237\u8D44\u6599\u8BF7\u5728\u5BBF\u4E3B\u5B8C\u6210\u540E\u518D\u8BA9\u6865\u63A5\u7EC4\u4EF6\u8FDB\u5165\u53EF\u6302\u8F7D\u72B6\u6001\u3002",
     mount: "\u4FEE\u6CD5: \u2460 \u67E5\u770B\u6839\u56E0\u4E2D\u5B50\u5E94\u7528 mount \u7684\u539F\u59CB\u9519\u8BEF\uFF08\u5DE5\u5382\u629B\u9519\u6216\u9996\u6B21\u6E32\u67D3\u5931\u8D25\uFF09\uFF1B\n        \u2461 \u540C\u4E00\u5BB9\u5668\u672A\u5378\u8F7D\u524D\u91CD\u590D mount \u662F\u5951\u7EA6\u8FDD\u4F8B\u2014\u2014\u5148 unmount \u518D mount\uFF1B\n        \u2462 \u4FEE\u590D\u540E\u70B9\u51FB\u300C\u91CD\u8BD5\u52A0\u8F7D\u300D\u5728\u540C\u9875\u91CD\u5EFA\u6302\u8F7D\u3002",
@@ -99,7 +105,7 @@ function bridgeLifecycleError(phase, spec, cause, extra) {
 }
 function bridgeHostError(phase, spec, cause) {
   if (cause instanceof FgError) return cause;
-  return bridgeLifecycleError(phase, spec, cause instanceof Error ? cause : String(cause));
+  return bridgeLifecycleError(phase, spec, cause);
 }
 function bridgeSessionMismatchError(spec, controlled, actual, extra) {
   const actualText = actual === void 0 ? "undefined\uFF08\u9875\u9762\u5C1A\u65E0 AppContext\uFF09" : typeof actual === "string" ? `"${actual}"` : String(actual);

package/dist/bridge-errors.js

@@ -10,8 +10,8 @@ import {
   routingNavigationError,
   routingProtocolError,
   routingSyncError
-} from "./chunk-TSPZ3EQ4.js";
-import "./chunk-YHXQHZ3E.js";
+} from "./chunk-EGXWY5NW.js";
+import "./chunk-NX3HRELG.js";
 export {
   BridgeErrorCodes,
   bridgeHostError,

package/dist/bridge-host-react.cjs

@@ -26,11 +26,17 @@ module.exports = __toCommonJS(bridge_host_react_exports);
 var import_react = require("react");
 
 // src/runtime/errors.ts
+function diagnosticUrl(text) {
+  return text.replace(/(https?:\/\/)(?:[^\s/@]+@)?([^\s?#"'<>，。；）)\]]+)(?:[?#][^\s"'<>，。；）)\]]*)?/g, "$1$2");
+}
+function diagnosticMessage(error) {
+  return diagnosticUrl(String(error?.message ?? error)).replace(/\b(token|password|cookie|authorization)["']?\s*[:=]\s*["']?(?:Bearer\s+)?[^\s,;"'}]+/gi, "$1=[redacted]");
+}
 var FgError = class extends Error {
   code;
   details;
   constructor(code, message, details, options) {
-    super(`[fulgurjs:${code}] ${message}`, options);
+    super(`[fulgurjs:${code}] ${diagnosticUrl(message)}`, options);
     this.name = "FgError";
     this.code = code;
     this.details = details;
@@ -106,7 +112,7 @@ function invalidBridgeContractError(spec, mod) {
   );
 }
 function bridgeLifecycleError(phase, spec, cause, extra) {
-  const raw = cause instanceof Error ? cause.message : String(cause ?? "unknown");
+  const raw = diagnosticMessage(cause);
   const fixes = {
     getContext: "\u4FEE\u6CD5: \u2460 getContext \u5FC5\u987B\u662F\u540C\u6B65\u3001\u65E0\u526F\u4F5C\u7528\u7684 getter\uFF08\u4E0D\u5F97\u8FD4\u56DE Promise/thenable\uFF09\uFF1B\n        \u2461 \u8FD4\u56DE\u503C\u987B\u662F\u5305\u542B\u672C\u6B21\u4F1A\u8BDD\u5FEB\u7167\u7684\u5BF9\u8C61\uFF08\u53D7\u63A7 sessionKey \u65F6\u987B\u542B\u76F8\u540C sessionKey\uFF09\uFF1B\n        \u2462 \u5F02\u6B65\u83B7\u53D6\u7528\u6237\u8D44\u6599\u8BF7\u5728\u5BBF\u4E3B\u5B8C\u6210\u540E\u518D\u8BA9\u6865\u63A5\u7EC4\u4EF6\u8FDB\u5165\u53EF\u6302\u8F7D\u72B6\u6001\u3002",
     mount: "\u4FEE\u6CD5: \u2460 \u67E5\u770B\u6839\u56E0\u4E2D\u5B50\u5E94\u7528 mount \u7684\u539F\u59CB\u9519\u8BEF\uFF08\u5DE5\u5382\u629B\u9519\u6216\u9996\u6B21\u6E32\u67D3\u5931\u8D25\uFF09\uFF1B\n        \u2461 \u540C\u4E00\u5BB9\u5668\u672A\u5378\u8F7D\u524D\u91CD\u590D mount \u662F\u5951\u7EA6\u8FDD\u4F8B\u2014\u2014\u5148 unmount \u518D mount\uFF1B\n        \u2462 \u4FEE\u590D\u540E\u70B9\u51FB\u300C\u91CD\u8BD5\u52A0\u8F7D\u300D\u5728\u540C\u9875\u91CD\u5EFA\u6302\u8F7D\u3002",
@@ -123,7 +129,7 @@ function bridgeLifecycleError(phase, spec, cause, extra) {
 }
 function bridgeHostError(phase, spec, cause) {
   if (cause instanceof FgError) return cause;
-  return bridgeLifecycleError(phase, spec, cause instanceof Error ? cause : String(cause));
+  return bridgeLifecycleError(phase, spec, cause);
 }
 function bridgeSessionMismatchError(spec, controlled, actual, extra) {
   const actualText = actual === void 0 ? "undefined\uFF08\u9875\u9762\u5C1A\u65E0 AppContext\uFF09" : typeof actual === "string" ? `"${actual}"` : String(actual);
@@ -602,7 +608,7 @@ var SECONDARY_BUTTON_STYLE = {
 function DefaultBridgeErrorView({ error, retry, blocked }) {
   const err = error;
   const code = err?.code ?? "UNKNOWN";
-  const message = err?.message ?? String(error ?? "unknown error");
+  const message = diagnosticMessage(error ?? "unknown error");
   return (0, import_react.createElement)("div", { style: ERROR_STYLE, "data-fulgurjs-error": code }, [
     (0, import_react.createElement)("p", { key: "t", style: { margin: "0 0 4px", fontWeight: 600 } }, `\u6865\u63A5\u5E94\u7528\u52A0\u8F7D\u5931\u8D25\uFF08\u9519\u8BEF\u7801 ${code}\uFF09`),
     (0, import_react.createElement)("p", { key: "m", style: MESSAGE_STYLE }, message),
@@ -717,7 +723,7 @@ function createReactBridgeAppWithLoader(loadRemote) {
               c.unmount(el);
             } catch (e) {
               const err = bridgeHostError("unmount", spec, e);
-              console.error("[fulgurjs] \u6865\u63A5\u5E94\u7528\u5378\u8F7D\u5931\u8D25\uFF1A", err);
+              console.error("[fulgurjs] \u6865\u63A5\u5E94\u7528\u5378\u8F7D\u5931\u8D25\uFF1A", diagnosticMessage(err));
               blockedRef.current = true;
               setError(err);
               setStatus("error");

package/dist/bridge-host-react.js

@@ -1,7 +1,7 @@
 import {
   RoutingChannel,
   assertBridgeRoutingProtocol
-} from "./chunk-OQ4CGWNL.js";
+} from "./chunk-Y7YANGLN.js";
 import {
   acquireBridgeSession,
   assertBridgeContract,
@@ -10,14 +10,16 @@ import {
   releaseBridgeSession,
   resolveBridgeContext,
   withBridgeTimeout
-} from "./chunk-NVJN2ARX.js";
+} from "./chunk-EK5JODE4.js";
 import {
   bridgeHostError
-} from "./chunk-TSPZ3EQ4.js";
+} from "./chunk-EGXWY5NW.js";
 import {
   provideAppContext
-} from "./chunk-MBH3TVAS.js";
-import "./chunk-YHXQHZ3E.js";
+} from "./chunk-ATU42YF3.js";
+import {
+  diagnosticMessage
+} from "./chunk-NX3HRELG.js";
 
 // src/bridge-host-react.ts
 import {
@@ -64,7 +66,7 @@ var SECONDARY_BUTTON_STYLE = {
 function DefaultBridgeErrorView({ error, retry, blocked }) {
   const err = error;
   const code = err?.code ?? "UNKNOWN";
-  const message = err?.message ?? String(error ?? "unknown error");
+  const message = diagnosticMessage(error ?? "unknown error");
   return createElement("div", { style: ERROR_STYLE, "data-fulgurjs-error": code }, [
     createElement("p", { key: "t", style: { margin: "0 0 4px", fontWeight: 600 } }, `\u6865\u63A5\u5E94\u7528\u52A0\u8F7D\u5931\u8D25\uFF08\u9519\u8BEF\u7801 ${code}\uFF09`),
     createElement("p", { key: "m", style: MESSAGE_STYLE }, message),
@@ -179,7 +181,7 @@ function createReactBridgeAppWithLoader(loadRemote) {
               c.unmount(el);
             } catch (e) {
               const err = bridgeHostError("unmount", spec, e);
-              console.error("[fulgurjs] \u6865\u63A5\u5E94\u7528\u5378\u8F7D\u5931\u8D25\uFF1A", err);
+              console.error("[fulgurjs] \u6865\u63A5\u5E94\u7528\u5378\u8F7D\u5931\u8D25\uFF1A", diagnosticMessage(err));
               blockedRef.current = true;
               setError(err);
               setStatus("error");

package/dist/bridge-host-vue.cjs

@@ -26,11 +26,17 @@ module.exports = __toCommonJS(bridge_host_vue_exports);
 var import_vue = require("vue");
 
 // src/runtime/errors.ts
+function diagnosticUrl(text) {
+  return text.replace(/(https?:\/\/)(?:[^\s/@]+@)?([^\s?#"'<>，。；）)\]]+)(?:[?#][^\s"'<>，。；）)\]]*)?/g, "$1$2");
+}
+function diagnosticMessage(error) {
+  return diagnosticUrl(String(error?.message ?? error)).replace(/\b(token|password|cookie|authorization)["']?\s*[:=]\s*["']?(?:Bearer\s+)?[^\s,;"'}]+/gi, "$1=[redacted]");
+}
 var FgError = class extends Error {
   code;
   details;
   constructor(code, message, details, options) {
-    super(`[fulgurjs:${code}] ${message}`, options);
+    super(`[fulgurjs:${code}] ${diagnosticUrl(message)}`, options);
     this.name = "FgError";
     this.code = code;
     this.details = details;
@@ -106,7 +112,7 @@ function invalidBridgeContractError(spec, mod) {
   );
 }
 function bridgeLifecycleError(phase, spec, cause, extra) {
-  const raw = cause instanceof Error ? cause.message : String(cause ?? "unknown");
+  const raw = diagnosticMessage(cause);
   const fixes = {
     getContext: "\u4FEE\u6CD5: \u2460 getContext \u5FC5\u987B\u662F\u540C\u6B65\u3001\u65E0\u526F\u4F5C\u7528\u7684 getter\uFF08\u4E0D\u5F97\u8FD4\u56DE Promise/thenable\uFF09\uFF1B\n        \u2461 \u8FD4\u56DE\u503C\u987B\u662F\u5305\u542B\u672C\u6B21\u4F1A\u8BDD\u5FEB\u7167\u7684\u5BF9\u8C61\uFF08\u53D7\u63A7 sessionKey \u65F6\u987B\u542B\u76F8\u540C sessionKey\uFF09\uFF1B\n        \u2462 \u5F02\u6B65\u83B7\u53D6\u7528\u6237\u8D44\u6599\u8BF7\u5728\u5BBF\u4E3B\u5B8C\u6210\u540E\u518D\u8BA9\u6865\u63A5\u7EC4\u4EF6\u8FDB\u5165\u53EF\u6302\u8F7D\u72B6\u6001\u3002",
     mount: "\u4FEE\u6CD5: \u2460 \u67E5\u770B\u6839\u56E0\u4E2D\u5B50\u5E94\u7528 mount \u7684\u539F\u59CB\u9519\u8BEF\uFF08\u5DE5\u5382\u629B\u9519\u6216\u9996\u6B21\u6E32\u67D3\u5931\u8D25\uFF09\uFF1B\n        \u2461 \u540C\u4E00\u5BB9\u5668\u672A\u5378\u8F7D\u524D\u91CD\u590D mount \u662F\u5951\u7EA6\u8FDD\u4F8B\u2014\u2014\u5148 unmount \u518D mount\uFF1B\n        \u2462 \u4FEE\u590D\u540E\u70B9\u51FB\u300C\u91CD\u8BD5\u52A0\u8F7D\u300D\u5728\u540C\u9875\u91CD\u5EFA\u6302\u8F7D\u3002",
@@ -123,7 +129,7 @@ function bridgeLifecycleError(phase, spec, cause, extra) {
 }
 function bridgeHostError(phase, spec, cause) {
   if (cause instanceof FgError) return cause;
-  return bridgeLifecycleError(phase, spec, cause instanceof Error ? cause : String(cause));
+  return bridgeLifecycleError(phase, spec, cause);
 }
 function bridgeSessionMismatchError(spec, controlled, actual, extra) {
   const actualText = actual === void 0 ? "undefined\uFF08\u9875\u9762\u5C1A\u65E0 AppContext\uFF09" : typeof actual === "string" ? `"${actual}"` : String(actual);
@@ -611,7 +617,7 @@ var BridgeErrorPlaceholder = /* @__PURE__ */ (0, import_vue.defineComponent)({
     return () => {
       const err = props.error;
       const code = err?.code ?? "UNKNOWN";
-      const message = err?.message ?? String(props.error ?? "unknown error");
+      const message = diagnosticMessage(props.error ?? "unknown error");
       return (0, import_vue.h)("div", { style: ERROR_STYLE, "data-fulgurjs-error": code }, [
         (0, import_vue.h)("p", { style: "margin:0 0 4px;font-weight:600" }, `\u6865\u63A5\u5E94\u7528\u52A0\u8F7D\u5931\u8D25\uFF08\u9519\u8BEF\u7801 ${code}\uFF09`),
         (0, import_vue.h)("p", { style: "margin:0 0 8px;word-break:break-all" }, message),
@@ -693,7 +699,7 @@ function createVueBridgeAppWithLoader(loadRemote, automaticSession) {
             } catch (e) {
               const err = bridgeHostError("unmount", spec, e);
               containerBlocked = true;
-              console.error("[fulgurjs] \u6865\u63A5\u5E94\u7528\u5378\u8F7D\u5931\u8D25\uFF0C\u8BE5\u5BB9\u5668\u5DF2\u5C01\u9501\uFF08\u540C\u9875\u53EA\u80FD\u5237\u65B0\u6062\u590D\uFF09\uFF1A", err);
+              console.error("[fulgurjs] \u6865\u63A5\u5E94\u7528\u5378\u8F7D\u5931\u8D25\uFF0C\u8BE5\u5BB9\u5668\u5DF2\u5C01\u9501\uFF08\u540C\u9875\u53EA\u80FD\u5237\u65B0\u6062\u590D\uFF09\uFF1A", diagnosticMessage(err));
               error.value = err;
               status.value = "error";
               return false;

package/dist/bridge-host-vue.js

@@ -1,7 +1,7 @@
 import {
   RoutingChannel,
   assertBridgeRoutingProtocol
-} from "./chunk-OQ4CGWNL.js";
+} from "./chunk-Y7YANGLN.js";
 import {
   acquireBridgeSession,
   assertBridgeContract,
@@ -10,15 +10,17 @@ import {
   releaseBridgeSession,
   resolveBridgeContext,
   withBridgeTimeout
-} from "./chunk-NVJN2ARX.js";
+} from "./chunk-EK5JODE4.js";
 import {
   bridgeHostError
-} from "./chunk-TSPZ3EQ4.js";
+} from "./chunk-EGXWY5NW.js";
 import {
   clearAppContext,
   provideAppContext
-} from "./chunk-MBH3TVAS.js";
-import "./chunk-YHXQHZ3E.js";
+} from "./chunk-ATU42YF3.js";
+import {
+  diagnosticMessage
+} from "./chunk-NX3HRELG.js";
 
 // src/bridge-host-vue.ts
 import { defineComponent, h, onActivated, onBeforeUnmount, onDeactivated, onMounted, ref, shallowRef, toRaw, watch } from "vue";
@@ -68,7 +70,7 @@ var BridgeErrorPlaceholder = /* @__PURE__ */ defineComponent({
     return () => {
       const err = props.error;
       const code = err?.code ?? "UNKNOWN";
-      const message = err?.message ?? String(props.error ?? "unknown error");
+      const message = diagnosticMessage(props.error ?? "unknown error");
       return h("div", { style: ERROR_STYLE, "data-fulgurjs-error": code }, [
         h("p", { style: "margin:0 0 4px;font-weight:600" }, `\u6865\u63A5\u5E94\u7528\u52A0\u8F7D\u5931\u8D25\uFF08\u9519\u8BEF\u7801 ${code}\uFF09`),
         h("p", { style: "margin:0 0 8px;word-break:break-all" }, message),
@@ -150,7 +152,7 @@ function createVueBridgeAppWithLoader(loadRemote, automaticSession) {
             } catch (e) {
               const err = bridgeHostError("unmount", spec, e);
               containerBlocked = true;
-              console.error("[fulgurjs] \u6865\u63A5\u5E94\u7528\u5378\u8F7D\u5931\u8D25\uFF0C\u8BE5\u5BB9\u5668\u5DF2\u5C01\u9501\uFF08\u540C\u9875\u53EA\u80FD\u5237\u65B0\u6062\u590D\uFF09\uFF1A", err);
+              console.error("[fulgurjs] \u6865\u63A5\u5E94\u7528\u5378\u8F7D\u5931\u8D25\uFF0C\u8BE5\u5BB9\u5668\u5DF2\u5C01\u9501\uFF08\u540C\u9875\u53EA\u80FD\u5237\u65B0\u6062\u590D\uFF09\uFF1A", diagnosticMessage(err));
               error.value = err;
               status.value = "error";
               return false;

package/dist/bridge-router-react.js

@@ -2,11 +2,14 @@
 import { createElement, useEffect, useState } from "react";
 
 // src/runtime/errors.ts
+function diagnosticUrl(text) {
+  return text.replace(/(https?:\/\/)(?:[^\s/@]+@)?([^\s?#"'<>，。；）)\]]+)(?:[?#][^\s"'<>，。；）)\]]*)?/g, "$1$2");
+}
 var FgError = class extends Error {
   code;
   details;
   constructor(code, message, details, options) {
-    super(`[fulgurjs:${code}] ${message}`, options);
+    super(`[fulgurjs:${code}] ${diagnosticUrl(message)}`, options);
     this.name = "FgError";
     this.code = code;
     this.details = details;

package/dist/bridge-router-vue.js

@@ -1,9 +1,12 @@
 // src/runtime/errors.ts
+function diagnosticUrl(text) {
+  return text.replace(/(https?:\/\/)(?:[^\s/@]+@)?([^\s?#"'<>，。；）)\]]+)(?:[?#][^\s"'<>，。；）)\]]*)?/g, "$1$2");
+}
 var FgError = class extends Error {
   code;
   details;
   constructor(code, message, details, options) {
-    super(`[fulgurjs:${code}] ${message}`, options);
+    super(`[fulgurjs:${code}] ${diagnosticUrl(message)}`, options);
     this.name = "FgError";
     this.code = code;
     this.details = details;

package/dist/bridge-session-auto.js

@@ -1,7 +1,7 @@
 import {
   clearAppContext
-} from "./chunk-MBH3TVAS.js";
-import "./chunk-YHXQHZ3E.js";
+} from "./chunk-ATU42YF3.js";
+import "./chunk-NX3HRELG.js";
 
 // src/bridge-session-auto.ts
 import { effectScope, ref, shallowRef, watch } from "vue";

package/dist/{chunk-MBH3TVAS.js → chunk-ATU42YF3.js}

@@ -1,6 +1,6 @@
 import {
   FgError
-} from "./chunk-YHXQHZ3E.js";
+} from "./chunk-NX3HRELG.js";
 
 // src/context.ts
 var ContextErrorCodes = {

package/dist/{chunk-TSPZ3EQ4.js → chunk-EGXWY5NW.js}

@@ -1,6 +1,7 @@
 import {
-  FgError
-} from "./chunk-YHXQHZ3E.js";
+  FgError,
+  diagnosticMessage
+} from "./chunk-NX3HRELG.js";
 
 // src/bridge-errors.ts
 var BridgeErrorCodes = {
@@ -38,7 +39,7 @@ function invalidBridgeContractError(spec, mod) {
   );
 }
 function bridgeLifecycleError(phase, spec, cause, extra) {
-  const raw = cause instanceof Error ? cause.message : String(cause ?? "unknown");
+  const raw = diagnosticMessage(cause);
   const fixes = {
     getContext: "\u4FEE\u6CD5: \u2460 getContext \u5FC5\u987B\u662F\u540C\u6B65\u3001\u65E0\u526F\u4F5C\u7528\u7684 getter\uFF08\u4E0D\u5F97\u8FD4\u56DE Promise/thenable\uFF09\uFF1B\n        \u2461 \u8FD4\u56DE\u503C\u987B\u662F\u5305\u542B\u672C\u6B21\u4F1A\u8BDD\u5FEB\u7167\u7684\u5BF9\u8C61\uFF08\u53D7\u63A7 sessionKey \u65F6\u987B\u542B\u76F8\u540C sessionKey\uFF09\uFF1B\n        \u2462 \u5F02\u6B65\u83B7\u53D6\u7528\u6237\u8D44\u6599\u8BF7\u5728\u5BBF\u4E3B\u5B8C\u6210\u540E\u518D\u8BA9\u6865\u63A5\u7EC4\u4EF6\u8FDB\u5165\u53EF\u6302\u8F7D\u72B6\u6001\u3002",
     mount: "\u4FEE\u6CD5: \u2460 \u67E5\u770B\u6839\u56E0\u4E2D\u5B50\u5E94\u7528 mount \u7684\u539F\u59CB\u9519\u8BEF\uFF08\u5DE5\u5382\u629B\u9519\u6216\u9996\u6B21\u6E32\u67D3\u5931\u8D25\uFF09\uFF1B\n        \u2461 \u540C\u4E00\u5BB9\u5668\u672A\u5378\u8F7D\u524D\u91CD\u590D mount \u662F\u5951\u7EA6\u8FDD\u4F8B\u2014\u2014\u5148 unmount \u518D mount\uFF1B\n        \u2462 \u4FEE\u590D\u540E\u70B9\u51FB\u300C\u91CD\u8BD5\u52A0\u8F7D\u300D\u5728\u540C\u9875\u91CD\u5EFA\u6302\u8F7D\u3002",
@@ -55,7 +56,7 @@ function bridgeLifecycleError(phase, spec, cause, extra) {
 }
 function bridgeHostError(phase, spec, cause) {
   if (cause instanceof FgError) return cause;
-  return bridgeLifecycleError(phase, spec, cause instanceof Error ? cause : String(cause));
+  return bridgeLifecycleError(phase, spec, cause);
 }
 function bridgeSessionMismatchError(spec, controlled, actual, extra) {
   const actualText = actual === void 0 ? "undefined\uFF08\u9875\u9762\u5C1A\u65E0 AppContext\uFF09" : typeof actual === "string" ? `"${actual}"` : String(actual);

package/dist/{chunk-NVJN2ARX.js → chunk-EK5JODE4.js}

@@ -3,10 +3,10 @@ import {
   bridgeSessionMismatchError,
   invalidBridgeContractError,
   invalidSessionKeyError
-} from "./chunk-TSPZ3EQ4.js";
+} from "./chunk-EGXWY5NW.js";
 import {
   clearAppContext
-} from "./chunk-MBH3TVAS.js";
+} from "./chunk-ATU42YF3.js";
 
 // src/bridge-core.ts
 function assertBridgeContract(spec, mod) {

package/dist/{chunk-2OHKAD6I.js → chunk-FXG2TWSA.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-TSXZ7TWA.js";
 import {
   ErrorCodes
-} from "./chunk-YHXQHZ3E.js";
+} from "./chunk-NX3HRELG.js";
 
 // src/page-providers.ts
 function isComponentLoader(value) {

package/dist/{chunk-YHXQHZ3E.js → chunk-NX3HRELG.js}

@@ -1,9 +1,15 @@
 // src/runtime/errors.ts
+function diagnosticUrl(text) {
+  return text.replace(/(https?:\/\/)(?:[^\s/@]+@)?([^\s?#"'<>，。；）)\]]+)(?:[?#][^\s"'<>，。；）)\]]*)?/g, "$1$2");
+}
+function diagnosticMessage(error) {
+  return diagnosticUrl(String(error?.message ?? error)).replace(/\b(token|password|cookie|authorization)["']?\s*[:=]\s*["']?(?:Bearer\s+)?[^\s,;"'}]+/gi, "$1=[redacted]");
+}
 var FgError = class extends Error {
   code;
   details;
   constructor(code, message, details, options) {
-    super(`[fulgurjs:${code}] ${message}`, options);
+    super(`[fulgurjs:${code}] ${diagnosticUrl(message)}`, options);
     this.name = "FgError";
     this.code = code;
     this.details = details;
@@ -40,13 +46,14 @@ var ErrorCodes = {
   SETUP_RECURSION: "MFU-014",
   /** 远程模块在组件消费边界导出的不是可渲染组件（适配器实测导出形态后报出） */
   COMPONENT_EXPORT_INVALID: "MFU-018",
-  /** Vue 组件直渲染的渲染器与共享作用域实际收敛的 Vue 实例不一致（身份证据已证实） */
+  /** 当前编译 SFC 的 Vue 导入引用与消费方渲染器不一致（组件证据已证实） */
   VUE_RUNTIME_IDENTITY_MISMATCH: "MFU-019",
   /** 远程组件子树内部渲染错误（插件边界观测：setup/render/嵌套异步组件拒绝；原始异常保留在 cause） */
   REMOTE_RENDER_ERROR: "MFU-020"
 };
 
 export {
+  diagnosticMessage,
   FgError,
   ErrorCodes
 };

package/dist/{chunk-OQ4CGWNL.js → chunk-Y7YANGLN.js}

@@ -3,7 +3,7 @@ import {
   routingNavigationError,
   routingProtocolError,
   routingSyncError
-} from "./chunk-TSPZ3EQ4.js";
+} from "./chunk-EGXWY5NW.js";
 
 // src/bridge-router-core.ts
 var MAX_REDIRECT_PER_REQUEST = 5;

package/dist/cli.js

@@ -3187,7 +3187,7 @@ var RUNTIME_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    RUNTIME_VERSION = "6.13.2";
+    RUNTIME_VERSION = "6.13.4";
   }
 });
 
@@ -5585,7 +5585,7 @@ async function runSourceDoctor(configPath) {
       "WARN",
       "\u672C\u5730\u662F Vue \u5E94\u7528\u4E14\u914D\u7F6E\u4E86\u8FDC\u7A0B\u6D88\u8D39\uFF0C\u4F46 shared \u672A\u58F0\u660E vue\u3002",
       "\u7EC4\u4EF6\u76F4\u6E32\u67D3\u8981\u6C42\u8FDC\u7A0B\u7EC4\u4EF6\u4E0E\u6D88\u8D39\u65B9\u6E32\u67D3\u5668\u4F7F\u7528\u540C\u4E00 Vue \u5B9E\u4F8B\uFF1B\u672C\u5730\u672A\u58F0\u660E\u65F6\u65E0\u6CD5\u4ECE\u9759\u6001\u626B\u63CF\u786E\u8BA4\u662F\u5426\u6536\u655B\u2014\u2014\u8FD9\u662F\u63A5\u5165\u98CE\u9669\uFF0C\u5C1A\u672A\u8BC1\u5B9E\u5B58\u5728\u91CD\u590D\u5B9E\u4F8B\uFF08\u8FDC\u7A0B\u53EF\u80FD\u672A\u5171\u4EAB vue\u3001\u6216\u4EC5\u66B4\u9732\u7EAF TS \u6A21\u5757\uFF09\u3002",
-      "\u6D88\u8D39\u8FDC\u7A0B Vue \u7EC4\u4EF6\u7684\u4E24\u4FA7\u90FD\u5728 federation({ shared }) \u58F0\u660E vue\uFF08\u5EFA\u8BAE singleton\uFF09\uFF0C\u5E76\u6838\u5BF9 shareScope \u4E00\u81F4\uFF1B\u8FD0\u884C\u65F6\u82E5\u5B9E\u4F8B\u5206\u88C2\uFF0CremoteComponent \u8FB9\u754C\u4F1A\u62A5 MFU-019\u3002\u4EC5\u6D88\u8D39\u7EAF TS \u6A21\u5757\u53EF\u5FFD\u7565\u672C\u9879\u3002"
+      "\u6D88\u8D39\u8FDC\u7A0B Vue \u7EC4\u4EF6\u7684\u4E24\u4FA7\u90FD\u5728 federation({ shared }) \u58F0\u660E vue\uFF08\u5EFA\u8BAE singleton\uFF09\uFF0C\u5E76\u6838\u5BF9 shareScope \u4E00\u81F4\uFF1B\u7F16\u8BD1 SFC \u6709\u5B9E\u9645\u5BFC\u5165\u5F15\u7528\u8BC1\u636E\u65F6\uFF0CremoteComponent \u53EF\u62A5 MFU-019\uFF1B\u65E7\u8FDC\u7A0B\u6216\u666E\u901A TS \u7EC4\u4EF6\u7F3A\u5C11\u8BC1\u636E\u65F6\u4E0D\u80FD\u636E\u5171\u4EAB\u8868\u81EA\u52A8\u786E\u8BA4\u51B2\u7A81\u3002\u4EC5\u6D88\u8D39\u7EAF TS \u6A21\u5757\u53EF\u5FFD\u7565\u672C\u9879\u3002"
     );
   }
   for (const [key, remote] of Object.entries(options.remotes ?? {})) {

package/dist/context.cjs

@@ -29,11 +29,14 @@ __export(context_exports, {
 module.exports = __toCommonJS(context_exports);
 
 // src/runtime/errors.ts
+function diagnosticUrl(text) {
+  return text.replace(/(https?:\/\/)(?:[^\s/@]+@)?([^\s?#"'<>，。；）)\]]+)(?:[?#][^\s"'<>，。；）)\]]*)?/g, "$1$2");
+}
 var FgError = class extends Error {
   code;
   details;
   constructor(code, message, details, options) {
-    super(`[fulgurjs:${code}] ${message}`, options);
+    super(`[fulgurjs:${code}] ${diagnosticUrl(message)}`, options);
     this.name = "FgError";
     this.code = code;
     this.details = details;

package/dist/context.js

@@ -4,8 +4,8 @@ import {
   getAppContext,
   provideAppContext,
   requireAppContext
-} from "./chunk-MBH3TVAS.js";
-import "./chunk-YHXQHZ3E.js";
+} from "./chunk-ATU42YF3.js";
+import "./chunk-NX3HRELG.js";
 export {
   ContextErrorCodes,
   clearAppContext,