@tbox.cn/app-toolkit 0.1.0 → 0.2.0

package/src/factory.ts

@@ -19,10 +19,15 @@ import { loadModulesView, loadModuleDetailView } from './views/modules.js';
 import { loadAppView } from './views/app.js';
 import { loadServiceDetailView } from './views/service-detail.js';
 import { loadServiceResolutionsView, loadServiceResolutionDetail } from './views/service-resolutions.js';
+import { loadAppIntegrationSchemas, loadModuleIntegrationSchemas } from './views/integration-schemas.js';
+import { loadCredentialsView } from './views/credentials.js';
+import { loadCredentialTypesView } from './views/credential-types.js';
 import type { WalkManifestsResult } from './assembly/walk-manifests.js';
 import type {
   AppIntegrationNode,
   AppView,
+  CredentialTypesView,
+  CredentialsView,
   ModuleDetailView,
   ModuleIntegrationNode,
   ProviderDetail,
@@ -36,15 +41,17 @@ import type {
 } from './dto.js';
 
 /**
- * createAppToolkit（C4 工厂）：22 方法 = 9 读（HTTP 直通）+ 4 写（HTTP 直通）+ 9 迁移面（Internals）。
+ * createAppToolkit（C4 工厂；v4.4——24 方法 = 11 读（含 credentials/credential-types 双端点）
+ * + 4 写 + 9 迁移面；loadApp/loadModule/loadProvider 增 include 选项）。
  * AppToolkit = AppToolkitRead & AppToolkitWrite & AppToolkitInternals——
  * Read+Write = HTTP 直通面 additive 冻结（L1 端点↔方法 1:1，L3 命名镜像：Integration=节点级 /
  * Config=文件级）；Internals = CLI/doctor/桥消费（自由演进）。
  *
  * **门控断言单点（policy at edge）**：求值（2）+ 写（4）+ ensureMockBindings / writeIntegrationsConfig /
  * evaluateIntegrationServices 入口 assertContractsUsable——strictValidation === false → 503
- * CONTRACTS_NOT_RESOLVED（message 三分支）；静态方法不门控（永不 503——铁律 #3）；
- * integrations/ views/ 机制层保持纯函数。
+ * CONTRACTS_NOT_RESOLVED；静态方法不门控（永不 503——铁律 #3）；**include 装配为条件分支非门控**
+ * （D31——serviceResolutions 按 evaluation && strictValidation 双条件装配，<0.9/形态异常 → null，
+ * 静态端点永不 503；integrationSchemas 纯静态轴零 contracts）；integrations/ views/ 机制层保持纯函数。
  *
  * 并发：进程内写串行（per-factory promise chain）+ 原子写 + 写后本实例缓存即刻失效（D26）。
  * onApplied（D7）：toolkit 判定「需要重启」（实际落盘且非 dryRun/no-diff）→ 调用一次 +
@@ -56,17 +63,45 @@ export interface AppToolkitOptions {
   onApplied?: () => void;
 }
 
-/** ── HTTP 直通面（9 读；L1 镜像律：方法名 = load + URL 资源段）── */
+/** include 协议白名单（v4.4 D30/P15——键名 = 产出字段名 1:1；per 端点；注册表 additive-only） */
+const INCLUDE_WHITELIST = {
+  app: ['serviceResolutions', 'integrationSchemas'],
+  module: ['serviceResolutions', 'integrationSchemas'],
+  provider: ['integrationSchemas'],
+} as const;
+
+/** include 校验（P15 单点在 toolkit 方法内——壳层仅解析可重复参数，零校验纪律不变）：
+ *  未知/越权键 → 400 VALIDATION_FAILED fields ['include']；重复键静默去重。 */
+function validateInclude(kind: keyof typeof INCLUDE_WHITELIST, include?: string[]): Set<string> {
+  if (!include || include.length === 0) return new Set();
+  const allowed = INCLUDE_WHITELIST[kind] as readonly string[];
+  const rejected = [...new Set(include)].filter((k) => !allowed.includes(k));
+  if (rejected.length > 0) {
+    throw new AppToolkitError(
+      'VALIDATION_FAILED',
+      400,
+      `include 含未知或不适用于本端点的键：${rejected.join('、')}（白名单：${allowed.join('、')}）`,
+      ['include'],
+    );
+  }
+  return new Set(include);
+}
+
+/** ── HTTP 直通面（11 读；L1 镜像律：方法名 = load + URL 资源段；query → 选项字段 L4）── */
 export interface AppToolkitRead {
   loadModules(): Promise<ModulesView>;
-  loadModule(moduleId: string): Promise<ModuleDetailView>;
-  loadApp(): Promise<AppView>;
+  loadModule(moduleId: string, o?: { include?: string[] }): Promise<ModuleDetailView>;
+  loadApp(o?: { include?: string[] }): Promise<AppView>;
   loadService(service: string): Promise<ServiceDetail>;
   loadServiceResolutions(services?: string[]): Promise<ServiceResolutionsView>;
   loadServiceResolution(service: string): Promise<ServiceResolutionDetail>;
   loadProviders(): Promise<ProvidersView>;
-  loadProvider(provider: string): Promise<ProviderDetail>;
+  loadProvider(provider: string, o?: { include?: string[] }): Promise<ProviderDetail>;
   loadProviderService(provider: string, service: string): Promise<ProviderServiceDetail>;
+  /** GET /credentials（v4.4 D33——应用状态轴；零门控，永不 503） */
+  loadCredentials(): Promise<CredentialsView>;
+  /** GET /credential-types[?provider=]（v4.4 D33——供给轴静态；零门控，永不 503） */
+  loadCredentialTypes(provider?: string): Promise<CredentialTypesView>;
 }
 
 /** ── HTTP 直通面（4 写；body ≡ 文件节点全量替换；DELETE 无 dryRun/无 options）── */
@@ -163,13 +198,39 @@ export function createAppToolkit(appDir: string, options: AppToolkitOptions = {}
       const contracts = await resolveContractsForApp(appDir);
       return loadModulesView(snapshot(contracts));
     },
-    async loadModule(moduleId: string) {
+    // v4.4 D31：门控与内嵌分离——静态方法零门控分支；include=serviceResolutions 按
+    // evaluation && strictValidation 双条件装配（<0.9/形态异常 → null，永不 503——技术方案 §2.4：
+    // 仅判 strictValidation 会被「严格面在场+求值面缺席」畸形包击穿）
+    async loadModule(moduleId: string, o?: { include?: string[] }): Promise<ModuleDetailView> {
+      const include = validateInclude('module', o?.include); // ① 输入校验先行（400 先于 404）
       const contracts = await resolveContractsForApp(appDir);
-      return loadModuleDetailView(snapshot(contracts), moduleId);
+      const snap = snapshot(contracts);
+      const view = loadModuleDetailView(snap, moduleId); // ② MODULE_NOT_FOUND
+      if (include.has('serviceResolutions')) {
+        view.serviceResolutions = contracts.evaluation && contracts.strictValidation
+          ? await predicateIssues().then((issues) =>
+              loadServiceResolutionsView(snap, issues, view.services.map((s) => s.service)))
+          : null; // module = demand 服务过滤（≡ 批量 ?service= 语义；issues 恒全量）
+      }
+      if (include.has('integrationSchemas')) {
+        view.integrationSchemas = loadModuleIntegrationSchemas(snap, moduleId);
+      }
+      return view;
     },
-    async loadApp() {
+    async loadApp(o?: { include?: string[] }): Promise<AppView> {
+      const include = validateInclude('app', o?.include);
       const contracts = await resolveContractsForApp(appDir);
-      return loadAppView(snapshot(contracts));
+      const snap = snapshot(contracts);
+      const view = loadAppView(snap);
+      if (include.has('serviceResolutions')) {
+        view.serviceResolutions = contracts.evaluation && contracts.strictValidation
+          ? await predicateIssues().then((issues) => loadServiceResolutionsView(snap, issues)) // app = 全量键集
+          : null;
+      }
+      if (include.has('integrationSchemas')) {
+        view.integrationSchemas = loadAppIntegrationSchemas(snap);
+      }
+      return view;
     },
     async loadService(service: string) {
       const contracts = await resolveContractsForApp(appDir);
@@ -191,14 +252,24 @@ export function createAppToolkit(appDir: string, options: AppToolkitOptions = {}
       const contracts = await resolveContractsForApp(appDir);
       return loadProvidersView(snapshot(contracts));
     },
-    async loadProvider(provider: string) {
+    async loadProvider(provider: string, o?: { include?: string[] }): Promise<ProviderDetail> {
+      const include = validateInclude('provider', o?.include);
       const contracts = await resolveContractsForApp(appDir);
-      return loadProviderDetailView(snapshot(contracts), provider);
+      return loadProviderDetailView(snapshot(contracts), provider, include);
     },
     async loadProviderService(provider: string, service: string) {
       const contracts = await resolveContractsForApp(appDir);
       return loadProviderServiceDetailView(snapshot(contracts), provider, service);
     },
+    // v4.4 D33：凭据域双端点（应用状态轴 / 供给轴静态——零门控零求值，永不 503）
+    async loadCredentials(): Promise<CredentialsView> {
+      const contracts = await resolveContractsForApp(appDir);
+      return loadCredentialsView(snapshot(contracts));
+    },
+    async loadCredentialTypes(provider?: string): Promise<CredentialTypesView> {
+      const contracts = await resolveContractsForApp(appDir);
+      return loadCredentialTypesView(snapshot(contracts), provider);
+    },
   };
 
   const core = createWriteCore(appDir, {

package/src/index.ts

@@ -79,19 +79,22 @@ export type { AppliedCredential, CredentialInput, OrphanIssue, PlannedCredential
 export { AppToolkitError, contractsNotResolvedMessage } from './core/errors.js';
 export type { AppToolkitErrorCode } from './core/errors.js';
 
-// ── views（五投影——静态四轴 + 求值轴；铁律 #3 静态/求值分离由投影结构承载）──
-export { loadModulesView, loadModuleDetailView, moduleDomainKeyOf } from './views/modules.js';
+// ── views（静态四轴 + 求值轴 + v4.4 层级 schema/凭据域；铁律 #3 静态/求值分离由投影结构承载）──
+export { loadModulesView, loadModuleDetailView } from './views/modules.js';
 export { loadAppView } from './views/app.js';
 export { loadServiceDetailView } from './views/service-detail.js';
 export { loadProvidersView, loadProviderDetailView, loadProviderServiceDetailView } from './views/providers.js';
 export { loadServiceResolutionsView, loadServiceResolutionDetail, resolveServiceSummary } from './views/service-resolutions.js';
+export { loadAppIntegrationSchemas, loadModuleIntegrationSchemas, resolveLayerIntegrationSchemas } from './views/integration-schemas.js';
+export { echoForRef, loadCredentialsView } from './views/credentials.js';
+export { loadCredentialTypesView } from './views/credential-types.js';
 export type { ViewContext, ViewSnapshot } from './views/context.js';
 
-// ── 工厂（22 方法 = 9 读 + 4 写 + 9 Internals；门控 policy at edge；写串行）──
+// ── 工厂（v4.4：24 方法 = 11 读 + 4 写 + 9 Internals；门控 policy at edge；include 条件装配非门控）──
 export { createAppToolkit } from './factory.js';
 export type { AppToolkit, AppToolkitRead, AppToolkitWrite, AppToolkitInternals, AppToolkitOptions } from './factory.js';
 
-// ── DTO（api.md §3 字段级单源——28 类型；agtcodingbox/tbox-ai-coding import type 消费）──
+// ── DTO（api.md §3 字段级单源——34 类型；agtcodingbox/tbox-ai-coding import type 消费）──
 export type {
   ServiceStatus,
   BindingLayer,
@@ -101,6 +104,12 @@ export type {
   ModuleDetailView,
   AppView,
   ServiceDetail,
+  ProviderBinding,
+  LayerIntegrationSchemas,
+  CredentialsView,
+  CredentialBindingEcho,
+  CredentialTypesView,
+  CredentialTypeEntry,
   ServiceResolutionsView,
   ServiceResolutionEntry,
   ServiceResolution,

package/src/integrations/domain-binding.ts

@@ -0,0 +1,81 @@
+import type { WalkCatalog, WalkManifestsResult, WalkModuleInfo } from '../assembly/walk-manifests.js';
+
+/**
+ * 域级联绑定单源（v4.4 F1/F3——integrations 层落位依据：谓词（同层）/ 写核（同层）/
+ * views（下层可向上 import）三向消费的唯一公共下层；import 前缀 guard 覆盖）。
+ *
+ * 知识锚（module-tab note 单源锚表）：
+ *   域级联（值 + 层）  = resolveDomainBinding —— 谓词 #7（等价重构，语义 ≡
+ *                        `domains[d].provider ?? root.provider`）/ deriveBindingLayer 域级段 /
+ *                        buildInheritance module 段 / ProviderBinding
+ *   来源层四层推导     = deriveBindingLayer（views/service-resolutions，域级段改调本文件）
+ *   写通道可用性       = moduleDomainWritable —— configEditable 读标志 / applyModule 400 守卫共用
+ *                        （D34：读标志与写守卫一函数）
+ */
+
+/** 域前缀换算（service → 首点段；自 views/context.ts 迁入——文件格式词汇，静态面零 contracts 依赖） */
+export function domainOfService(service: string): string {
+  const i = service.indexOf('.');
+  return i === -1 ? service : service.slice(0, i);
+}
+
+/** 域级联绑定解析（值 + 来源层）：provider 取非空字符串（域级优先 → root 兜底；空串 = 缺席）。
+ *  layer：域级声明 → 'module'；root 兜底 → 'app'；双缺 → null（ProviderBinding 双缺诚实态）。 */
+export function resolveDomainBinding(
+  config: Record<string, unknown> | null,
+  domainKey: string,
+): { provider: string | null; layer: 'module' | 'app' | null } {
+  const domainProvider = (config?.domains as Record<string, { provider?: unknown }> | undefined)?.[domainKey]?.provider;
+  if (typeof domainProvider === 'string' && domainProvider.length > 0) {
+    return { provider: domainProvider, layer: 'module' };
+  }
+  const rootProvider = config?.provider;
+  if (typeof rootProvider === 'string' && rootProvider.length > 0) {
+    return { provider: rootProvider, layer: 'app' };
+  }
+  return { provider: null, layer: null };
+}
+
+/** 多域模块可写性（D34 判别联合——configEditable 读标志与 applyModule 写守卫共用单源） */
+export type ModuleDomainWritability =
+  | { writable: true; domainKeys: [string]; domainKey: string }
+  | { writable: false; reason: 'zero-domain'; domainKeys: [] }
+  | { writable: false; reason: 'multi-domain'; domainKeys: string[] }
+  | { writable: false; reason: 'shared-key'; domainKeys: [string]; domainKey: string; coOwners: string[] };
+
+/**
+ * 多域模块可写性判定（v4.4 F3）：domainKeys = demand 服务首段去重；
+ * shared-key 判据 = 域级 owner 并集计数（catalog.services 聚合含 dev-manifest 通道需求——
+ * P13 真源；>1 个 distinct owner ⟺ 共享。免 owner↔moduleId 身份映射——本地模块 catalog
+ * owner = entry.package ≠ mod.pkg `@app/<id>`，身份比较必踩；「他方与本模块需求同一服务」
+ * 形态亦被并集计数天然覆盖）。
+ */
+export function moduleDomainWritable(
+  walk: Pick<WalkManifestsResult, 'modules' | 'catalog'>,
+  mod: WalkModuleInfo,
+): ModuleDomainWritability {
+  const domainKeys = [...new Set((mod.descriptor.contributes.services ?? []).map((s) => domainOfService(s.service)))].sort();
+  if (domainKeys.length === 0) return { writable: false, reason: 'zero-domain', domainKeys: [] };
+  if (domainKeys.length > 1) return { writable: false, reason: 'multi-domain', domainKeys };
+  const domainKey = domainKeys[0];
+  const owners = new Set<string>();
+  for (const [service, demand] of Object.entries(walk.catalog.services)) {
+    if (domainOfService(service) === domainKey) for (const o of demand.owners) owners.add(o);
+  }
+  if (owners.size > 1) {
+    return { writable: false, reason: 'shared-key', domainKeys: [domainKey], domainKey, coOwners: [...owners].sort() };
+  }
+  return { writable: true, domainKeys: [domainKey], domainKey };
+}
+
+/** owner 串 → 显示名（尽力映射 module install id；未命中回退原始串——message 质量问题非正确性） */
+export function displayOwnerName(modules: ReadonlyArray<{ id: string; pkg: string }>, owner: string): string {
+  const mod = modules.find((m) => m.pkg === owner || `@app/${m.id}` === owner);
+  if (mod) return mod.id;
+  return owner.startsWith('@app/') ? owner.slice('@app/'.length) : owner;
+}
+
+/** 供给足迹（该厂商全部供给服务并集——应用级 integrationSchemas 作用域，D32） */
+export function providerFootprint(catalog: WalkCatalog, provider: string): string[] {
+  return [...new Set(Object.values(catalog.providers[provider] ?? {}).flatMap((e) => e.services))].sort();
+}

package/src/integrations/predicate.ts

@@ -60,6 +60,7 @@
  *     → warning（moduleResourceNeeds 缺席 → 需求面检查跳过，M3 降级先例）
  */
 import type { EvaluationExports } from '../core/contracts-expected.js';
+import { resolveDomainBinding } from './domain-binding.js';
 
 /** contracts 注入面（resolver 装配产物运行时视图 = EvaluationExports 求值子集） */
 export type PredicateContracts = Pick<
@@ -513,13 +514,12 @@ export function evaluateIntegrationServices(
       };
       checkLayer(integrations.config, 'root.config');
       for (const [k, v] of Object.entries(integrations.configByInstance ?? {})) checkLayer(v, `root.configByInstance[${k}]`);
-      // 域级 config：键 ⊆ 该域生效厂商（domains[d].provider ?? root.provider）schema——
-      // 生效厂商缺席（全走槽级覆盖）→ 用全局并集；生效厂商 schema 缺失 → 跳过该域
+      // 域级 config：键 ⊆ 该域生效厂商 schema（resolveDomainBinding 单源——v4.4 F1 等价重构，
+      // 语义 ≡ 现状 domains[d].provider ?? root.provider）——生效厂商缺席（全走槽级覆盖）→
+      // 用全局并集；生效厂商 schema 缺失 → 跳过该域
       for (const [d, cfg] of Object.entries(integrations.domains ?? {})) {
         if (!cfg?.config) continue;
-        const domainVendor = typeof cfg.provider === 'string' && cfg.provider
-          ? cfg.provider
-          : (typeof integrations.provider === 'string' ? integrations.provider : undefined);
+        const domainVendor = resolveDomainBinding(integrations, d).provider ?? undefined;
         if (domainVendor === undefined) {
           checkLayer(cfg.config, `domains.${d}.config`);
           continue;

package/src/integrations/read.ts

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { resolveContractsForApp, type ResolvedContracts } from '../core/contracts-resolver.js';
+import { AppToolkitError } from '../core/errors.js';
 import type { FileCache } from '../core/file-cache.js';
 
 /**
@@ -45,9 +46,28 @@ export async function readIntegrationsStrict(
   const raw = readIntegrationsConfig(appDir, cache);
   if (raw === null) return { config: null, strict: false, contracts };
   if (contracts.strictValidation && contracts.module.parseIntegrationsConfig) {
-    // 严格链：assertNoInlineSecrets → 旧键直切防线 → zod strict（contracts 单源）
-    const parsed = contracts.module.parseIntegrationsConfig(raw);
-    return { config: parsed as unknown as Record<string, unknown>, strict: true, contracts };
+    // 严格链：assertNoInlineSecrets → 旧键直切防线 → zod strict（contracts 单源）；
+    // 失败转换（A1——裸 ZodError/Error 穿透 500 的同族缺口）：zod → 400 + fields（原始路径——
+    // 文件级读无节点上下文）；普通 Error → 400 直通。结构性判定同 write.runStrictValidation。
+    try {
+      const parsed = contracts.module.parseIntegrationsConfig(raw);
+      return { config: parsed as unknown as Record<string, unknown>, strict: true, contracts };
+    } catch (err) {
+      if (err instanceof Error && Array.isArray((err as { issues?: unknown }).issues)) {
+        const fields = ((err as unknown as { issues: Array<{ path?: unknown }> }).issues)
+          .filter((i) => Array.isArray(i.path))
+          .map((i) => (i.path as Array<string | number>).map(String).join('.'))
+          .filter((p) => p.length > 0);
+        throw new AppToolkitError('VALIDATION_FAILED', 400, 'integrations.json 校验失败', fields.length > 0 ? fields : undefined);
+      }
+      throw new AppToolkitError('VALIDATION_FAILED', 400, err instanceof Error ? err.message : String(err));
+    }
   }
   return { config: raw, strict: false, contracts };
 }
+
+/** P9 服务身份判据单源（A2）：GET/PUT/DELETE 共用「词汇 ∪ 已配置」——service-detail 判据逐字冻结
+ *  （api.md P9 的「demanded 退化」口径为文档层 nuance，现行实现与 GET 均不含 demanded——冻结现状即单源） */
+export function isKnownService(vocabulary: readonly string[], configuredKeys: readonly string[], service: string): boolean {
+  return vocabulary.includes(service) || configuredKeys.includes(service);
+}

package/src/integrations/write.ts

@@ -17,6 +17,8 @@ import {
 } from './credentials.js';
 import type { IntegrationServiceIssue } from './predicate.js';
 import { checkInstanceKeys } from './predicate.js';
+import { isKnownService } from './read.js';
+import { displayOwnerName, moduleDomainWritable } from './domain-binding.js';
 import { AppToolkitError } from '../core/errors.js';
 
 /**
@@ -185,6 +187,11 @@ function validateCredential(
   inlineCredentialType: string | undefined,
   cache?: FileCache,
 ): void {
+  // ⓪ type 在场性（A1 无条件前置）：缺 type 的凭据输入原会以 { type: undefined, ...values }
+  //   落盘（JSON.stringify 静默丢键）→ 无 type 文件 + GET 回显静默缺席——收紧为显式 400
+  if (typeof credentials.type !== 'string' || credentials.type.length === 0) {
+    throw new AppToolkitError('VALIDATION_FAILED', 400, '凭据 type 缺失或为空字符串', ['credentials.type']);
+  }
   // ① type 匹配（内联声明优先；catalog 槽供给次之；均缺席 → 跳过——宽松与 P11 对齐）
   const expectedType = inlineCredentialType ?? declaredCredentialType(appDir, provider, service, cache);
   if (expectedType !== undefined && expectedType !== '-' && credentials.type !== expectedType) {
@@ -222,14 +229,12 @@ export interface WriteCore {
   warmup(): Promise<void>;
   /** PUT /app/integration（root 节点全集） */
   applyApp(node: Record<string, unknown>, opts?: WriteOptions): SaveResult;
-  /** PUT /modules/:module/integration（domains 换算；N1 {} 删域键） */
+  /** PUT /modules/:module/integration（domains 换算；N1 {} 删域键；v4.4 D34 写守卫单源） */
   applyModule(moduleId: string, node: Record<string, unknown>, opts?: WriteOptions): SaveResult;
-  /** PUT /services/:service/integration（整节点含 instances map；N3 {} 不归一化） */
+  /** PUT /services/:service/integration（整节点含 instances map；N3 {} 不归一化；v4.4 A2 身份判据） */
   applyService(service: string, node: Record<string, unknown>, opts?: WriteOptions): SaveResult;
-  /** DELETE /services/:service/integration（恒整节点；幂等；无预演） */
+  /** DELETE /services/:service/integration（恒整节点；幂等仅判据内成员；无预演） */
   deleteService(service: string): SaveResult;
-  /** 模块服务域键（module → domains 键 = 服务集派生域键集 upsert 位） */
-  moduleDomainKey(moduleId: string): string | undefined;
 }
 
 export function createWriteCore(appDir: string, opts: WriteCoreOptions = {}): WriteCore {
@@ -270,7 +275,23 @@ export function createWriteCore(appDir: string, opts: WriteCoreOptions = {}): Wr
     strictContracts = await resolveContractsForApp(appDir);
   }
 
-  function runStrictValidation(next: Record<string, unknown>, issues: IntegrationServiceIssue[]): void {
+  /** zod issues → 节点相对 fields（A1）：字面量前缀剥离——service 名含点号，禁按段数切分；
+   *  无前缀命中的文档级路径（如 'services'）原样保留；空 path（文档根级形态）→ 滤除
+   *  （fields 直指字段名——空串指向不存在）。 */
+  function toNodeFields(issues: Array<{ path?: unknown }>, prefix: string): string[] {
+    return issues
+      .filter((i) => Array.isArray(i.path))
+      .map((i) => {
+        const p = (i.path as Array<string | number>).map(String).join('.');
+        return prefix !== '' && p.startsWith(prefix) && p.length > prefix.length ? p.slice(prefix.length) : p;
+      })
+      .filter((p) => p.length > 0);
+  }
+
+  /** 严格整文档校验（A1 单点转换）：zod → 400 + fields（节点相对）；普通 Error（旧键直切/
+   *  内联密钥防线——contracts parseIntegrationsConfig 内部 assert 族）→ 同族 400 message 直通。
+   *  结构性 ZodError 判定（禁 instanceof——contracts 动态 import，类身份跨模块实例不可靠）。 */
+  function runStrictValidation(next: Record<string, unknown>, issues: IntegrationServiceIssue[], prefix: string): void {
     const strict = strictContracts;
     if (!strict || !strict.strictValidation || !strict.module.parseIntegrationsConfig) {
       throw new AppToolkitError(
@@ -280,20 +301,23 @@ export function createWriteCore(appDir: string, opts: WriteCoreOptions = {}): Wr
       );
     }
     void issues;
-    strict.module.parseIntegrationsConfig(next);
+    try {
+      strict.module.parseIntegrationsConfig(next);
+    } catch (err) {
+      if (err instanceof Error && Array.isArray((err as { issues?: unknown }).issues)) {
+        throw new AppToolkitError(
+          'VALIDATION_FAILED',
+          400,
+          '节点 schema 校验失败',
+          toNodeFields((err as unknown as { issues: Array<{ path?: unknown }> }).issues, prefix),
+        );
+      }
+      throw new AppToolkitError('VALIDATION_FAILED', 400, err instanceof Error ? err.message : String(err));
+    }
   }
 
   return {
     warmup,
-    moduleDomainKey(moduleId: string): string | undefined {
-      const { modules } = walkManifests(appDir, cache);
-      const mod = modules.find((m) => m.id === moduleId);
-      if (!mod) return undefined;
-      const services = mod.descriptor.contributes.services ?? [];
-      const domains = new Set(services.map((s) => (s.service.includes('.') ? s.service.slice(0, s.service.indexOf('.')) : s.service)));
-      // 单域模块 → 该域键；多域/零域 → 模块 id 兜底键（domains 换算层约定）
-      return domains.size === 1 ? [...domains][0] : moduleId;
-    },
 
     applyApp(node: Record<string, unknown>, writeOpts: WriteOptions = {}): SaveResult {
       assertSafeNames(node, 'root');
@@ -332,7 +356,7 @@ export function createWriteCore(appDir: string, opts: WriteCoreOptions = {}): Wr
       if (noDiff && !hasCredentialInput) {
         return { written: false, restartScheduled: false, files: [], credentials: [], issues };
       }
-      runStrictValidation(next, issues);
+      runStrictValidation(next, issues, '');
       // 凭据工件落盘（后置于校验通过；dryRun 零写盘 + existsSync 预览）
       const dryRun = writeOpts.dryRun === true;
       const applied = writeCredentialArtifacts(appDir, plan, dryRun);
@@ -342,6 +366,33 @@ export function createWriteCore(appDir: string, opts: WriteCoreOptions = {}): Wr
 
     applyModule(moduleId: string, node: Record<string, unknown>, writeOpts: WriteOptions = {}): SaveResult {
       assertSafeNames(node, 'root');
+      // D34 写守卫（v4.4，moduleDomainWritable 单源）：404（模块在册）→ 400（多域/零域/共享键
+      // 三分支）→ 既有管线。守卫先于 no-op 短路——多域/零域/共享键模块 PUT {} 清域同 400
+      // （「写路径拒绝歧义操作」含清除；P13/P17）。
+      const { modules, catalog } = walkManifests(appDir, cache);
+      const mod = modules.find((m) => m.id === moduleId);
+      if (!mod) {
+        throw new AppToolkitError('MODULE_NOT_FOUND', 404, `模块 ${moduleId} 非已装模块`);
+      }
+      const w = moduleDomainWritable({ modules, catalog }, mod);
+      if (!w.writable) {
+        if (w.reason === 'multi-domain') {
+          throw new AppToolkitError(
+            'VALIDATION_FAILED',
+            400,
+            `模块 ${moduleId} 跨 ${w.domainKeys.length} 个域（${w.domainKeys.join('、')}）——模块级统一配置仅支持单域模块，请按服务级配置（编辑各服务行）`,
+          );
+        }
+        if (w.reason === 'zero-domain') {
+          throw new AppToolkitError('VALIDATION_FAILED', 400, `模块 ${moduleId} 无服务需求声明，无域配置位`);
+        }
+        throw new AppToolkitError(
+          'VALIDATION_FAILED',
+          400,
+          `域键 ${w.domainKey} 由 ${w.coOwners.map((o) => displayOwnerName(modules, o)).join('、')} 共用——写通道拒绝歧义操作，请按服务级配置`,
+        );
+      }
+      const domainKey = w.domainKey;
       const issues: IntegrationServiceIssue[] = [];
       const current = loadConfig(appDir, cache);
       if (current === null && Object.keys(node).length === 0) {
@@ -356,10 +407,6 @@ export function createWriteCore(appDir: string, opts: WriteCoreOptions = {}): Wr
         });
       }
       const base: Record<string, unknown> = current ?? { services: {} };
-      const domainKey = this.moduleDomainKey(moduleId);
-      if (domainKey === undefined) {
-        throw new AppToolkitError('MODULE_NOT_FOUND', 404, `模块 ${moduleId} 非已装模块`);
-      }
       const domains = { ...((base.domains as Record<string, unknown>) ?? {}) };
       const next: Record<string, unknown> = { ...base, domains };
       // N1：模块节点 {} → 删 domains[键]（清域）；其余 = 域键全量替换
@@ -368,7 +415,7 @@ export function createWriteCore(appDir: string, opts: WriteCoreOptions = {}): Wr
       if (deepEqual(current, next)) {
         return { written: false, restartScheduled: false, files: [], credentials: [], issues };
       }
-      runStrictValidation(next, issues);
+      runStrictValidation(next, issues, `domains.${domainKey}.`);
       issues.push(...registryCheck(next));
       return finalize(next, [], issues, writeOpts.dryRun, false);
     },
@@ -378,6 +425,10 @@ export function createWriteCore(appDir: string, opts: WriteCoreOptions = {}): Wr
       assertSafeInstanceKeys(node, writeOpts, 'slot');
       const issues: IntegrationServiceIssue[] = [];
       const current = loadConfig(appDir, cache);
+      // P9 服务身份判据单源（A2）：写入集 = 词汇 ∪ 已配置——未知服务（含 typo）404（api.md §5）
+      if (!isKnownService(walkManifests(appDir, cache).vocabulary, Object.keys((current?.services as Record<string, unknown> | undefined) ?? {}), service)) {
+        throw new AppToolkitError('SERVICE_NOT_FOUND', 404, `服务 ${service} 不在服务词汇（已装契约包 ∪ 已配置）`);
+      }
       if (current === null) {
         issues.push({
           severity: 'warning',
@@ -418,7 +469,7 @@ export function createWriteCore(appDir: string, opts: WriteCoreOptions = {}): Wr
       if (noDiff && !hasCredentialInput) {
         return { written: false, restartScheduled: false, files: [], credentials: [], issues };
       }
-      runStrictValidation(next, issues);
+      runStrictValidation(next, issues, `services.${service}.`);
       // 凭据工件落盘（后置于校验通过；dryRun 零写盘 + existsSync 预览）
       const dryRun = writeOpts.dryRun === true;
       const applied = writeCredentialArtifacts(appDir, plan, dryRun);
@@ -429,6 +480,10 @@ export function createWriteCore(appDir: string, opts: WriteCoreOptions = {}): Wr
     deleteService(service: string): SaveResult {
       const issues: IntegrationServiceIssue[] = [];
       const current = loadConfig(appDir, cache);
+      // P9 服务身份判据单源（A2）：判据外未知服务 404；判据内缺席节点维持幂等 written:false
+      if (!isKnownService(walkManifests(appDir, cache).vocabulary, Object.keys((current?.services as Record<string, unknown> | undefined) ?? {}), service)) {
+        throw new AppToolkitError('SERVICE_NOT_FOUND', 404, `服务 ${service} 不在服务词汇（已装契约包 ∪ 已配置）`);
+      }
       const services = { ...((current?.services as Record<string, unknown>) ?? {}) };
       if (!(service in services)) {
         // 幂等：清不存在的节点 → written:false（无 409；无预演）

package/src/views/app.ts

@@ -1,11 +1,11 @@
-import type { AppView } from '../dto.js';
+import type { AppView, ServiceDemand } from '../dto.js';
 import { APP_INTEGRATION_NODE_KEYS } from '../dto.js';
 import { moduleOccupiedServices, type ViewSnapshot } from './context.js';
 
 /**
- * 应用静态投影（views/app；C4；FX-1c B10——root 节点投影修）。
- * /app = 平台服务 + root 节点原值（纯静态，D12）：
- * services = 服务词汇 − 模块占用（裸 string[]——owner/标题 UI 按首点段派生，F2）；
+ * 应用静态投影（views/app；C4；FX-1c B10——root 节点投影修；v4.4 D29——services 双端点同型）。
+ * /app = 平台服务 + root 节点原值（纯静态）：services = 服务词汇 − 模块占用
+ * （ServiceDemand[]——平台条目 required 恒 false、title/description 缺席，D29）；
  * 平台服务状态不在此（→ /service-resolutions）；模块服务不在此（→ /modules/:m）。
  * integration = **root 节点投影**（APP_INTEGRATION_NODE_KEYS——D21/L1：GET 预填 ≡ PUT body；
  * 文件另含 services/domains/modules 域键，不进 root 节点投影——原实现整文件透传，
@@ -14,7 +14,9 @@ import { moduleOccupiedServices, type ViewSnapshot } from './context.js';
 
 export function loadAppView(snapshot: ViewSnapshot): AppView {
   const occupied = moduleOccupiedServices(snapshot.walk);
-  const services = snapshot.walk.vocabulary.filter((s) => !occupied.has(s));
+  const services: ServiceDemand[] = snapshot.walk.vocabulary
+    .filter((s) => !occupied.has(s))
+    .map((s) => ({ service: s, required: false }));
   const config = snapshot.integrations;
   let integration: AppView['integration'] = null;
   if (config) {

package/src/views/context.ts

@@ -1,11 +1,12 @@
 import { readIntegrationsConfig } from '../integrations/read.js';
+import { domainOfService } from '../integrations/domain-binding.js';
 import { walkManifests, type WalkCatalog, type WalkManifestsResult } from '../assembly/walk-manifests.js';
 import type { FileCache } from '../core/file-cache.js';
 import type { ResolvedContracts } from '../core/contracts-resolver.js';
 
 /**
  * 视图装配共享上下文（五投影共用；目录枚举零缓存——walkManifests 每次调用执行）。
- * 域前缀换算（service → 首点段）= 本地一行 helper（文件格式词汇，静态面零 contracts 依赖）。
+ * 域前缀换算（service → 首点段）自 v4.4 F1 迁 integrations/domain-binding.ts（本文件 re-export 保导入路径）。
  */
 
 export interface ViewContext {
@@ -21,11 +22,7 @@ export interface ViewSnapshot {
   contracts: ResolvedContracts;
 }
 
-/** 域前缀换算（本地 helper——静态面零 contracts 依赖前提） */
-export function domainOfService(service: string): string {
-  const i = service.indexOf('.');
-  return i === -1 ? service : service.slice(0, i);
-}
+export { domainOfService };
 
 /** 读取视图输入快照（每方法调用独立——Freshness Contract 单位 = 方法调用） */
 export async function loadViewSnapshot(ctx: ViewContext): Promise<ViewSnapshot> {

package/src/views/credential-types.ts

@@ -0,0 +1,28 @@
+import type { CredentialTypesView } from '../dto.js';
+import type { ViewSnapshot } from './context.js';
+import { readSchemaRef } from './providers.js';
+
+/**
+ * 供给轴凭据结构清单（views/credential-types；v4.4 D33 独立端点 GET /credential-types[?provider=]）：
+ * 结构按 credentialType 键（wanda 全部槽共享同一 type 同一 schema 文件——(provider, service)
+ * 组合寻址是错位键）；源 = catalog.credentialTypes（既有聚合产物零新读取路径，聚合条目携
+ * packageDir 供 schema 文件解析）。静态轴（稳定可缓存、永不 503）。
+ * ?provider= 过滤 ≡ ?service= 先例（过滤非寻址；未知 provider → 空 types 不 404）。
+ * '-' = 无凭据语义（mock/local——UI 判 '-' 不渲染凭据表单）；credentialSchema null = 未声明。
+ */
+export function loadCredentialTypesView(snapshot: ViewSnapshot, provider?: string): CredentialTypesView {
+  const types =
+    provider === undefined
+      ? Object.keys(snapshot.catalog.credentialTypes)
+      : [...new Set(Object.values(snapshot.catalog.providers[provider] ?? {}).map((e) => e.credentialType))];
+  return {
+    types: types.sort().map((t) => {
+      const entry = snapshot.catalog.credentialTypes[t];
+      return {
+        credentialType: t,
+        owner: entry?.owner ?? '',
+        credentialSchema: entry ? readSchemaRef(snapshot.appDir, entry.packageDir, entry.credentialSchema) : null,
+      };
+    }),
+  };
+}