@tbox.cn/app-toolkit 0.1.0 → 0.2.0

package/src/views/credentials.ts

@@ -0,0 +1,57 @@
+import type { CredentialBindingEcho, CredentialEcho, CredentialsView } from '../dto.js';
+import { maskCredentialValues, readCredentialFile, stemToFilePath } from '../core/credential-format.js';
+import type { ViewSnapshot } from './context.js';
+
+/**
+ * 凭据状态轴投影（views/credentials；v4.4 D33 独立端点 GET /credentials）：
+ * 绑定位全量掩码回显——应用状态轴（随配置失效、零求值零 contracts、永不 503）。
+ * GET 永无真值（仅 ref/masked）；掩码单源 maskCredentialValues；echoForRef 自
+ * service-resolutions 迁入共享（求值单体 instances[].credential 已删净——求值路径零凭据 I/O）。
+ *
+ * 键集 = 文件语义忠实镜像（api.md §0「键域不对称」）：
+ *   app.byInstance        = 注册表 ids ∩ 有 ref（无 ref 的注册实例不出现；未注册 ref 跳过不虚报）
+ *   services[s].byInstance = 节点 instances map 全键（含 '*'，无 ref 亦在场 → null）
+ * null 语义：credential/byInstance 值 = 「未就绪」（ref 缺席或文件缺失）——缺失诊断归谓词 #1
+ * （CREDENTIAL_FILE_MISSING），echo = 状态回显、issues = 诊断定位（P16 分工）。
+ */
+
+/** 凭据文件掩码回显（ref 非 secret:// 或文件缺席 → undefined——调用方映射 null） */
+export function echoForRef(appDir: string, ref: string | undefined): CredentialEcho | undefined {
+  if (ref === undefined || !ref.startsWith('secret://')) return undefined;
+  const stem = ref.slice('secret://'.length);
+  const file = readCredentialFile(appDir, stem);
+  if (!file) return undefined;
+  return { type: file.type, ref, file: stemToFilePath(stem), masked: maskCredentialValues(file.values) };
+}
+
+export function loadCredentialsView(snapshot: ViewSnapshot): CredentialsView {
+  const cfg = snapshot.integrations as {
+    credentialRef?: unknown;
+    credentialRefByInstance?: Record<string, string>;
+    instances?: Array<{ id: string }>;
+    services?: Record<string, { credentialRef?: string; instances?: Record<string, { credentialRef?: string }> }>;
+  } | null;
+
+  const app: CredentialBindingEcho = {
+    credential: echoForRef(snapshot.appDir, typeof cfg?.credentialRef === 'string' ? cfg.credentialRef : undefined) ?? null,
+    byInstance: {},
+  };
+  for (const { id } of cfg?.instances ?? []) {
+    const ref = cfg?.credentialRefByInstance?.[id];
+    if (ref === undefined) continue; // 无 ref 的注册实例不出现（api.md §4.9a 实证）
+    app.byInstance[id] = echoForRef(snapshot.appDir, ref) ?? null;
+  }
+
+  const services: Record<string, CredentialBindingEcho> = {};
+  for (const [s, node] of Object.entries(cfg?.services ?? {})) {
+    const slot: CredentialBindingEcho = {
+      credential: echoForRef(snapshot.appDir, node.credentialRef) ?? null,
+      byInstance: {},
+    };
+    for (const [k, inst] of Object.entries(node.instances ?? {})) {
+      slot.byInstance[k] = echoForRef(snapshot.appDir, inst.credentialRef) ?? null;
+    }
+    services[s] = slot;
+  }
+  return { app, services };
+}

package/src/views/integration-schemas.ts

@@ -0,0 +1,53 @@
+import type { LayerIntegrationSchemas } from '../dto.js';
+import { isSupplied, type ViewSnapshot } from './context.js';
+import { readSchemaRef } from './providers.js';
+import { moduleDomainWritable, providerFootprint, resolveDomainBinding } from '../integrations/domain-binding.js';
+
+/**
+ * 层级 config schema 计算视图（v4.4 D32——静态轴富化，零 contracts 求值）。
+ * config 表单结构三形态同源（P10）：槽级组合单体（providers.ts）/ 层级内嵌（本文件——
+ * /app、/modules/:m include）/ 供给轴批量（providers.ts include——切换态）。
+ *
+ * 计算规则（D32 裁决）：禁交集——config 五层浅合并下「部分服务认识的字段」合法（谓词 #7
+ * 并集键集同依据）；禁合成单一 schema——required/title 冲突的有损代数；产物 = 扁平映射，
+ * 分组归客户端纯呈现。层级 schema = 表单引导**非写入门禁**（P16——写路径校验权威恒在谓词
+ * #7 键集 + ajv 凭据链；root 级口径差：#7 = 引用厂商并集，表单 = 层生效厂商单厂商作用域）。
+ */
+
+/** 核心纯函数：显式作用域（provider null → 整字段 null；services 逐项 serviceSchemas 复合键 +
+ *  readSchemaRef——既有解析路径零新读；供给在场未声明 = null，mock 合法） */
+export function resolveLayerIntegrationSchemas(
+  snapshot: ViewSnapshot,
+  provider: string | null,
+  services: readonly string[],
+): LayerIntegrationSchemas | null {
+  if (provider === null) return null;
+  const out: LayerIntegrationSchemas['services'] = {};
+  for (const s of services) {
+    const entry = snapshot.walk.serviceSchemas[`${provider}\u0000${s}`];
+    out[s] = { configSchema: entry ? readSchemaRef(snapshot.appDir, entry.packageDir, entry.configSchema) : null };
+  }
+  return { provider, services: out };
+}
+
+/** app 级 loader：生效厂商 = root.provider（非空字符串，缺席 → 整字段 null——D32「未绑定」）；
+ *  作用域 = 该厂商供给足迹全量（≠ AppView.services——root.config 流向包括模块服务在内的所有服务） */
+export function loadAppIntegrationSchemas(snapshot: ViewSnapshot): LayerIntegrationSchemas | null {
+  const p = (snapshot.integrations as { provider?: unknown } | null)?.provider;
+  const provider = typeof p === 'string' && p.length > 0 ? p : null;
+  if (provider === null) return null;
+  return resolveLayerIntegrationSchemas(snapshot, provider, providerFootprint(snapshot.catalog, provider));
+}
+
+/** module 级 loader：仅 writable 单域；生效厂商 = resolveDomainBinding（D32/R4 单源）；
+ *  作用域 = demand ∩ 该厂商供给；多域/零域/共享键/未绑定 → 整字段 null（表单降级 = ExtraFields） */
+export function loadModuleIntegrationSchemas(snapshot: ViewSnapshot, moduleId: string): LayerIntegrationSchemas | null {
+  const mod = snapshot.walk.modules.find((m) => m.id === moduleId);
+  if (!mod) return null; // 视图已先行 404，此处防御
+  const w = moduleDomainWritable(snapshot.walk, mod);
+  if (!w.writable) return null;
+  const provider = resolveDomainBinding(snapshot.integrations, w.domainKey).provider;
+  if (provider === null) return null;
+  const demand = (mod.descriptor.contributes.services ?? []).map((s) => s.service);
+  return resolveLayerIntegrationSchemas(snapshot, provider, demand.filter((s) => isSupplied(snapshot.catalog, provider, s)));
+}

package/src/views/modules.ts

@@ -1,10 +1,14 @@
-import type { ModuleDeclaration, ModuleDetailView, ServiceDemand } from '../dto.js';
+import type { ModuleDeclaration, ModuleDetailView, ProviderBinding, ServiceDemand } from '../dto.js';
 import { AppToolkitError } from '../core/errors.js';
-import { domainOfService, type ViewSnapshot } from './context.js';
+import { moduleDomainWritable, resolveDomainBinding } from '../integrations/domain-binding.js';
+import type { ViewSnapshot } from './context.js';
 
 /**
  * 需求轴/模块静态投影（views/modules；C4）。静态端点结构性零求值（铁律 #3——
  * 无 resolution/issues/contracts 键，永不 503）。
+ * v4.4 D34：domainKeys/providerBindings/configEditable 显式化；integration 仅单域
+ * （writable）时在场——多域/零域/共享键无单键落点；多域回退兜底键机器拆除
+ * （派生统一 = domainOfService 去重集合，moduleDomainWritable 单源）。
  */
 
 /** GET /modules：纯模块清单（demand 不在——卡片展开 = GET /modules/:m） */
@@ -22,12 +26,6 @@ export function loadModulesView(snapshot: ViewSnapshot): { modules: ModuleDeclar
   return { modules };
 }
 
-/** 域键换算（模块服务集派生域键集；单域 = 该域，多域/零域 = 模块 id——与 write.moduleDomainKey 同约定） */
-export function moduleDomainKeyOf(services: ServiceDemand[], moduleId: string): string {
-  const domainKeys = new Set(services.map((s) => domainOfService(s.service)));
-  return domainKeys.size === 1 ? [...domainKeys][0] : moduleId;
-}
-
 /** GET /modules/:module：模块静态一站式（integration 节点原值 + demand；PUT 读对偶） */
 export function loadModuleDetailView(snapshot: ViewSnapshot, moduleId: string): ModuleDetailView {
   const mod = snapshot.walk.modules.find((m) => m.id === moduleId);
@@ -38,11 +36,15 @@ export function loadModuleDetailView(snapshot: ViewSnapshot, moduleId: string):
     service: need.service,
     ...(need.title ? { title: need.title } : {}),
     ...(need.description ? { description: need.description } : {}),
-    required: need.optional !== false,
+    required: need.optional === false,
   }));
+  const w = moduleDomainWritable(snapshot.walk, mod);
   const domains = (snapshot.integrations as { domains?: Record<string, unknown> } | null)?.domains ?? {};
-  const domainKey = moduleDomainKeyOf(services, moduleId);
-  // integration = domains[换算键] 节点原值（D21 编辑预填源）；未配置 = null
-  const integration = (domains[domainKey] as ModuleDetailView['integration']) ?? null;
-  return { integration, services };
+  // integration = domains[换算键] 节点原值（D21 编辑预填源）；未配置 = null；多域/零域/共享键 = null（D34）
+  const integration = w.writable ? ((domains[w.domainKey] as ModuleDetailView['integration']) ?? null) : null;
+  const providerBindings: ProviderBinding[] = w.domainKeys.map((d) => {
+    const binding = resolveDomainBinding(snapshot.integrations, d);
+    return { domain: d, effective: binding.provider, layer: binding.layer };
+  });
+  return { domainKeys: [...w.domainKeys], integration, providerBindings, configEditable: w.writable, services };
 }

package/src/views/providers.ts

@@ -2,7 +2,6 @@ import type { ProviderDetail, ProviderEntry, ProviderServiceDetail, ProvidersVie
 import { AppToolkitError } from '../core/errors.js';
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
-import { walkManifests } from '../assembly/walk-manifests.js';
 import type { ViewSnapshot } from './context.js';
 
 /**
@@ -27,8 +26,9 @@ export function loadProvidersView(snapshot: ViewSnapshot): ProvidersView {
   return { providers: providers.sort((a, b) => a.provider.localeCompare(b.provider)) };
 }
 
-/** GET /providers/:provider：供给足迹（implementations 恒数组——H1 多实现钉版数据源） */
-export function loadProviderDetailView(snapshot: ViewSnapshot, provider: string): ProviderDetail {
+/** GET /providers/:provider：供给足迹（implementations 恒数组——H1 多实现钉版数据源；
+ *  v4.4 F5：include=integrationSchemas 切换态批量——services[s] += { configSchema }（纯 config）） */
+export function loadProviderDetailView(snapshot: ViewSnapshot, provider: string, include?: ReadonlySet<string>): ProviderDetail {
   const impls = snapshot.catalog.providers[provider];
   if (!impls) {
     throw new AppToolkitError('PROVIDER_NOT_FOUND', 404, `厂商 ${provider} 不 ∈ catalog（内联声明厂商无包级档案——身份与表单经组合端点暴露）`);
@@ -40,6 +40,14 @@ export function loadProviderDetailView(snapshot: ViewSnapshot, provider: string)
       bucket.implementations.push({ implementation: entry.implementation, credentialType: entry.credentialType });
     }
   }
+  if (include?.has('integrationSchemas')) {
+    for (const [service, bucket] of Object.entries(services)) {
+      const schemaEntry = snapshot.walk.serviceSchemas[`${provider}\u0000${service}`];
+      bucket.integrationSchemas = {
+        configSchema: schemaEntry ? readSchemaRef(snapshot.appDir, schemaEntry.packageDir, schemaEntry.configSchema) : null,
+      };
+    }
+  }
   const entries = Object.values(impls);
   return {
     provider,
@@ -89,12 +97,12 @@ export function loadProviderServiceDetailView(
 
   // integrationSchemas：catalog schema（复合键）优先；内联声明 configSchema 引用应用 config/schemas/
   // （路径约束 H9——resolve 落 config/schemas/ 内 + realpath 复核，违例 400）
+  // v4.4 F5 消重：schema 表取自 snapshot.walk（原 walkManifests(appDir) 重复全量目录扫描）；
+  // v4.4 D33：credentialSchema 删净（结构归 GET /credential-types——组合单体纯 config）
   let configSchema: object | null = null;
-  let credentialSchema: object | null = null;
-  const schemaEntry = walkManifests(snapshot.appDir).serviceSchemas[`${provider}\u0000${service}`];
+  const schemaEntry = snapshot.walk.serviceSchemas[`${provider}\u0000${service}`];
   if (schemaEntry) {
     configSchema = readSchemaRef(snapshot.appDir, schemaEntry.packageDir, schemaEntry.configSchema);
-    credentialSchema = readSchemaRef(snapshot.appDir, schemaEntry.packageDir, schemaEntry.credentialSchema);
   } else if (inlineDeclaration) {
     // 内联声明 schema 解析：引用文件在 integrations 节点（provider.configSchema）——
     // 形状同 config/schemas/ 约束（路径来源 = 节点声明，由服务端读应用侧）
@@ -108,12 +116,13 @@ export function loadProviderServiceDetailView(
     provider,
     service,
     implementations,
-    integrationSchemas: { configSchema, credentialSchema },
+    integrationSchemas: { configSchema },
   };
 }
 
-/** catalog schema 引用读取（相对包根；缺席 → null——SCHEMA_FILE_MISSING 归谓词 #6） */
-function readSchemaRef(_appDir: string, packageDir: string, ref: string | undefined): object | null {
+/** catalog schema 引用读取（相对包根；缺席 → null——SCHEMA_FILE_MISSING 归谓词 #6）。
+ *  v4.4 导出共享：层级内嵌（integration-schemas.ts）/ 凭据结构清单（credential-types.ts）同源消费。 */
+export function readSchemaRef(_appDir: string, packageDir: string, ref: string | undefined): object | null {
   if (!ref) return null;
   const file = join(packageDir, ref);
   if (!existsSync(file)) return null;

package/src/views/service-detail.ts

@@ -1,5 +1,6 @@
 import type { ServiceDetail } from '../dto.js';
 import { AppToolkitError } from '../core/errors.js';
+import { isKnownService } from '../integrations/read.js';
 import { suppliedByVendors, type ViewSnapshot } from './context.js';
 
 /**
@@ -10,10 +11,8 @@ import { suppliedByVendors, type ViewSnapshot } from './context.js';
 export function loadServiceDetailView(snapshot: ViewSnapshot, service: string): ServiceDetail {
   const configured = (snapshot.integrations as { services?: Record<string, unknown> } | null)?.services ?? {};
   const demand = snapshot.catalog.services[service];
-  const inVocabulary = snapshot.walk.vocabulary.includes(service);
-  const isConfigured = service in configured;
-  // 404 判据与 /service-resolutions/:service 单源（P9）
-  if (!inVocabulary && !isConfigured) {
+  // 404 判据与写路径单源（P9——A2 isKnownService；词汇成员零 demand/供给/config 仍 200）
+  if (!isKnownService(snapshot.walk.vocabulary, Object.keys(configured), service)) {
     throw new AppToolkitError('SERVICE_NOT_FOUND', 404, `服务 ${service} 不在服务词汇（已装契约包 ∪ 已配置）`);
   }
   // integration = 文件 services[s] 逐字原值（编辑预填源 D21）；无声明 = null

package/src/views/service-resolutions.ts

@@ -1,7 +1,6 @@
 import type {
   BindingLayer,
   ContractsResolution,
-  CredentialEcho,
   EffectiveBinding,
   IntegrationIssue,
   ResolvedInstance,
@@ -11,13 +10,15 @@ import type {
   ServiceResolutionDetail,
   ServiceStatus,
 } from '../dto.js';
-import { maskCredentialValues, readCredentialFile, stemToFilePath } from '../core/credential-format.js';
+import { AppToolkitError } from '../core/errors.js';
+import { resolveDomainBinding } from '../integrations/domain-binding.js';
 import type { ResolvedContracts } from '../core/contracts-resolver.js';
 import type { WalkCatalog } from '../assembly/walk-manifests.js';
 import { domainOfService, isSupplied, type ViewSnapshot } from './context.js';
 
 /**
- * 求值轴投影（views/service-resolutions；C4；FX-2c——B6 effective/credential 填充 + F2 layer 推导）。
+ * 求值轴投影（views/service-resolutions；C4；FX-2c——B6 effective 填充 + F2 layer 推导；
+ * v4.4——D31 Entry.layer 双缺席语义 + D33 凭据内嵌删净（求值路径零凭据文件 I/O））。
  *
  * status(service, instanceId) = contracts.resolveEffectiveService(integrations, service, instanceId,
  * supplies).status——动态（应用自身 contracts 求值单源）。
@@ -26,9 +27,9 @@ import { domainOfService, isSupplied, type ViewSnapshot } from './context.js';
  * required(service) = 任一需求方 required（OR 聚合——demandedServices.optional AND 合并的补语义；
  * 平台/孤儿恒 false）——集成就绪判定单源：pending = Σ (required && status !== 'ok')。
  * **P14 单一形状（结构保证）**：resolveServiceSummary() 单源函数——/service-resolutions map 值 ≡
- * /service-resolutions/:s 的 resolution 摘要基（ServiceResolution extends ServiceResolutionEntry）。
- * **实例条目**：effective（合并绑定投影 + layer 推导——contracts EffectiveService 无 layer，F2）
- * + credential（掩码回显——GET 永无真值；文件缺席省略，缺失归谓词 #1）。
+ * /service-resolutions/:s 的 resolution 摘要基（ServiceResolution extends ServiceResolutionEntry）
+ * ≡ /app 内嵌 map 值 ≡ /modules/:m 内嵌 map 值（v4.4 等价面四处）。
+ * **实例条目**：effective（合并绑定投影 + layer 推导——contracts EffectiveService 无 layer，F2）。
  */
 
 function toContractsResolution(contracts: ResolvedContracts): ContractsResolution {
@@ -51,8 +52,9 @@ interface InstanceEvaluation {
 
 /** 最特异声明层推导（F2）：inst 位 provider 在场 → 'instance'；槽级 → 'service'；域级 → 'module'；
  *  root → 'app'。实例位查找复刻 TIER0 语义（精确键优先、'*' 通配兜底——与 resolveEffectiveService
- *  的 instances 查找层同轴）。 */
-function deriveBindingLayer(snapshot: ViewSnapshot, service: string, instanceId: string): BindingLayer {
+ *  的 instances 查找层同轴）。v4.4 F1：域级段消费 resolveDomainBinding 单源；返回扩 null
+ *  （四层全无 provider 声明 → null——Entry.layer「未配置双缺席」口径，D31）。 */
+function deriveBindingLayer(snapshot: ViewSnapshot, service: string, instanceId: string): BindingLayer | null {
   const integrations = snapshot.integrations as {
     provider?: unknown;
     domains?: Record<string, { provider?: unknown }>;
@@ -63,17 +65,9 @@ function deriveBindingLayer(snapshot: ViewSnapshot, service: string, instanceId:
   const inst = slot?.instances?.[instanceId] ?? slot?.instances?.['*'];
   if (inst && inst.provider !== undefined) return 'instance';
   if (slot?.provider !== undefined) return 'service';
-  if (integrations?.domains?.[domain]?.provider !== undefined) return 'module';
-  return 'app';
-}
-
-/** 凭据掩码回显（O4：GET 永无真值——maskCredentialValues 单源；文件缺席省略） */
-function echoForRef(appDir: string, ref: string | undefined): CredentialEcho | undefined {
-  if (ref === undefined || !ref.startsWith('secret://')) return undefined;
-  const stem = ref.slice('secret://'.length);
-  const file = readCredentialFile(appDir, stem);
-  if (!file) return undefined;
-  return { type: file.type, ref, file: stemToFilePath(stem), masked: maskCredentialValues(file.values) };
+  if (resolveDomainBinding(integrations, domain).layer === 'module') return 'module';
+  if (typeof integrations?.provider === 'string' && integrations.provider.length > 0) return 'app';
+  return null;
 }
 
 /** 求值单实例（resolveEffectiveService 动态求值；ok 态携带完整 effective——layer 推导附） */
@@ -102,7 +96,8 @@ function evaluateInstance(
         implementation: r.effective.implementation,
         ...(r.effective.config !== undefined ? { config: { ...(r.effective.config as Record<string, unknown>) } } : {}),
         ...(r.effective.credentialRef !== undefined ? { credentialRef: r.effective.credentialRef } : {}),
-        layer: deriveBindingLayer(snapshot, service, instanceId),
+        // ok 态可证非空（effective.provider 必有声明来源层）——null 兜底为防御性
+        layer: deriveBindingLayer(snapshot, service, instanceId) ?? 'app',
       },
     };
   }
@@ -117,9 +112,11 @@ function evaluationContracts(snapshot: ViewSnapshot) {
     normalizeInstances?: (input: unknown) => { instances: Array<{ id: string }>; defaultInstanceId: string | null };
     buildSupplyLookup?: (catalog: unknown) => unknown;
   };
-  // 门控（工厂边缘）保证 evaluation/strictValidation 后此断言恒真
+  // 门控（工厂边缘）保证 evaluation/strictValidation 后此断言恒真；A2：裸 Error →
+  // AppToolkitError 503（predicateIssues 的 config === null 早退绕过工厂 assertFn 后，
+  // 本函数是畸形包（严格面在场+求值面缺席）唯一后续拦截点——不再 500）
   if (!mod.resolveEffectiveService || !mod.normalizeInstances) {
-    throw new Error('contracts 求值面缺席（工厂门控应先行拦截）');
+    throw new AppToolkitError('CONTRACTS_NOT_RESOLVED', 503, 'contracts 求值面缺席（契约包形态异常）——重新安装或升级应用 @tbox.cn/app-contracts 后重试');
   }
   return mod as unknown as {
     resolveEffectiveService: (
@@ -167,6 +164,10 @@ export function resolveServiceSummary(
   // 跨实例求值异常聚合（statusMessage 直投）
   const evaluation = evaluateInstance(snapshot, contracts, service, defaultInstanceId, supplies);
 
+  // v4.4 D31：layer = provider 字段来源声明层（默认实例口径，与 status 同轴）；
+  // 未配置（provider 缺席）→ 双缺席——layer 单独在场即「无 provider 的孤儿层」，违 D31 口径
+  const layer = deriveBindingLayer(snapshot, service, defaultInstanceId);
+
   // provider：effective 求值厂商（最特异声明层——跨层事实）；缺席 = 未配置/未解析
   const declaredProvider = (snapshot.integrations as { services?: Record<string, { provider?: unknown }> } | null)
     ?.services?.[service]?.provider;
@@ -193,6 +194,7 @@ export function resolveServiceSummary(
     status: evaluation.status,
     ...(evaluation.statusMessage ? { statusMessage: evaluation.statusMessage } : {}),
     ...(provider !== undefined ? { provider } : {}),
+    ...(provider !== undefined && layer !== null ? { layer } : {}),
     ...(supplied !== undefined ? { supplied } : {}),
     ...(module !== undefined ? { module } : {}),
     ...(required !== undefined ? { required } : {}),
@@ -255,13 +257,12 @@ export function loadServiceResolutionDetail(
 
   const instances: ResolvedInstance[] = instanceIds.map((id) => {
     const evalResult = evaluateInstance(snapshot, contracts, service, id, supplies);
-    const echo = echoForRef(snapshot.appDir, evalResult.effective?.credentialRef);
+    // v4.4 D33：instances[].credential 删净（凭据掩码回显归 GET /credentials——求值路径零凭据文件 I/O）
     return {
       instanceId: id,
       status: evalResult.status,
       ...(evalResult.statusMessage ? { statusMessage: evalResult.statusMessage } : {}),
       ...(evalResult.effective ? { effective: evalResult.effective } : {}),
-      ...(echo ? { credential: echo } : {}),
     };
   });
 
@@ -303,9 +304,14 @@ function buildInheritance(
   });
   const defaultInstanceId = normalized.defaultInstanceId ?? '*';
   const defaultInstance = slot?.instances?.[defaultInstanceId] ?? slot?.instances?.['*'];
+  // module 段消费 resolveDomainBinding 单源（v4.4 F1——与 ProviderBinding / 谓词 #7 同源）
+  const domainBinding = resolveDomainBinding(integrations as Record<string, unknown> | null, domain);
   return [
     { layer: 'app' as const, ...(integrations?.provider ? { provider: integrations.provider } : {}) },
-    { layer: 'module' as const, ...(integrations?.domains?.[domain]?.provider ? { provider: integrations.domains[domain].provider } : {}) },
+    {
+      layer: 'module' as const,
+      ...(domainBinding.layer === 'module' && domainBinding.provider ? { provider: domainBinding.provider } : {}),
+    },
     {
       layer: 'service' as const,
       ...(typeof slot?.provider === 'string' ? { provider: slot.provider } : {}),

package/tests/credentials-view.test.ts

@@ -0,0 +1,152 @@
+import { describe, it, expect } from 'vitest';
+import { join } from 'node:path';
+import { createAppToolkit, type AppToolkit } from '../src/factory.js';
+import { invalidateContractsResolver } from '../src/core/contracts-resolver.js';
+import { createTempApp, writeFakeContractsPackage, linkContracts, writeAppFile, type TempApp } from './demo-app.js';
+
+/**
+ * v4.4 D33 凭据域视图矩阵（F6——C1-C5）：键集三断言（app.byInstance = 注册表 ids ∩ 有 ref /
+ * services = 已配置 / services.byInstance = 节点 instances map 全键含 '*'）/ null 语义
+ * （未就绪——诊断归 issues #1）/ 零真值（masked 形态）/ credential-types 清单 + ?provider= 过滤 /
+ * 删净断言（instances[].credential、组合单体 credentialSchema——序列化面不信 typecheck）。
+ */
+
+const OK_RESOLVE = [
+  'const slot = integrations && integrations.services && integrations.services[service];',
+  'if (!slot) return { status: "service-not-configured" };',
+  'const prov = typeof slot.provider === "string" ? slot.provider : slot.provider && slot.provider.provider;',
+  'if (!prov) return { status: "service-not-configured" };',
+  'return { status: "ok", effective: { provider: prov, implementation: slot.implementation || "impl@1", config: slot.config || {}, ...(slot.credentialRef ? { credentialRef: slot.credentialRef } : {}) } };',
+].join(' ');
+
+function credHarness(): { app: TempApp; tk: AppToolkit } {
+  const app = createTempApp('tbox-cred-');
+  invalidateContractsResolver();
+  const store = join(app.appDir, 'contracts');
+  writeFakeContractsPackage(store, { version: '0.9.0', resolveBody: OK_RESOLVE });
+  linkContracts(app.appDir, store, { subdir: 'apps/server' });
+  // 供给 manifest（wanda 两槽共享 type + schema 文件；mock '-' 槽）——types 清单与组合单体删净断言用
+  writeAppFile(
+    app.appDir,
+    'packages/provider-w/tbox.module.json',
+    JSON.stringify({
+      schemaVersion: 1,
+      name: 'provider-w',
+      version: '0.1.0',
+      kind: 'business',
+      contributes: {
+        providers: {
+          slots: [
+            { service: 'parking.payment', provider: 'wanda', implementation: 'wanda-parking@1', credentialType: 'wanda-c-signed-v1', credentialSchema: 'schemas/cred.json' },
+            { service: 'mall.info', provider: 'mock', implementation: 'mock-mall@1', credentialType: '-' },
+          ],
+        },
+      },
+      dependencies: { modules: [] },
+      env: [],
+    }),
+  );
+  writeAppFile(app.appDir, 'packages/provider-w/schemas/cred.json', JSON.stringify({ type: 'object', properties: { appKey: { type: 'string' } } }));
+  writeAppFile(
+    app.appDir,
+    'config/integrations.json',
+    JSON.stringify({
+      provider: 'wanda',
+      credentialRef: 'secret://wanda-global',
+      instances: [
+        { id: 'mall-bj-01', name: '北京店' },
+        { id: 'mall-sh-01', name: '上海店' },
+      ],
+      credentialRefByInstance: { 'mall-sh-01': 'secret://wanda-mall-sh-01-global', 'ghost-id': 'secret://wanda-ghost' },
+      services: {
+        'parking.payment': {
+          provider: 'wanda',
+          implementation: 'wanda-parking@1',
+          credentialRef: 'secret://wanda-parking.payment',
+          instances: { 'mall-bj-01': { credentialRef: 'secret://wanda-mall-bj-01-parking' }, '*': {} },
+        },
+      },
+    }),
+  );
+  writeAppFile(app.appDir, 'config/credentials/wanda-global.json', JSON.stringify({ type: 'wanda-c-signed-v1', appKey: 'KEY-GLOBAL', salt: 'SALT-GLOBAL-VALUE' }));
+  writeAppFile(app.appDir, 'config/credentials/wanda-mall-sh-01-global.json', JSON.stringify({ type: 'wanda-c-signed-v1', appKey: 'SH' }));
+  writeAppFile(app.appDir, 'config/credentials/wanda-parking.payment.json', JSON.stringify({ type: 'wanda-c-signed-v1', appKey: 'SVC-KEY' }));
+  // wanda-mall-bj-01-parking.json 故意缺席（文件缺失 → null——诊断归 issues #1）
+  return { app, tk: createAppToolkit(app.appDir) };
+}
+
+describe('v4.4 D33 凭据域（F6）', () => {
+  it('C1 键集三断言：app.byInstance = 注册表 ∩ 有 ref；services = 已配置；byInstance = 节点全键含 *', async () => {
+    const { app, tk } = credHarness();
+    const view = await tk.loadCredentials();
+    // app 本位 = wanda-global echo
+    expect(view.app.credential).toEqual({
+      type: 'wanda-c-signed-v1',
+      ref: 'secret://wanda-global',
+      file: 'config/credentials/wanda-global.json',
+      masked: { appKey: 'KE****', salt: 'SA****' },
+    });
+    // app.byInstance：mall-bj-01（无 ref）不出现；ghost-id（未注册 ref）跳过不虚报；mall-sh-01 在场
+    expect(Object.keys(view.app.byInstance)).toEqual(['mall-sh-01']);
+    expect(view.app.byInstance['mall-sh-01']?.ref).toBe('secret://wanda-mall-sh-01-global');
+    // services 键集 = 已配置服务；byInstance 键集 = 节点 instances map 全键（含 '*'）
+    expect(Object.keys(view.services)).toEqual(['parking.payment']);
+    expect(Object.keys(view.services['parking.payment']!.byInstance).sort()).toEqual(['*', 'mall-bj-01']);
+    app.dispose();
+  });
+
+  it('C2 null 语义：ref 缺席/文件缺失 → null（未就绪——诊断归 issues #1 分工）', async () => {
+    const { app, tk } = credHarness();
+    const view = await tk.loadCredentials();
+    expect(view.services['parking.payment']!.credential).toEqual({
+      type: 'wanda-c-signed-v1',
+      ref: 'secret://wanda-parking.payment',
+      file: 'config/credentials/wanda-parking.payment.json',
+      masked: { appKey: 'SV****' },
+    });
+    expect(view.services['parking.payment']!.byInstance['*']).toBeNull(); // 无 ref → null
+    expect(view.services['parking.payment']!.byInstance['mall-bj-01']).toBeNull(); // ref 在场文件缺失 → null
+    app.dispose();
+  });
+
+  it('C3 零真值：序列化无明文；≤4 字符全掩码（掩码单源）', async () => {
+    const { app, tk } = credHarness();
+    const view = await tk.loadCredentials();
+    const serialized = JSON.stringify(view);
+    expect(serialized).not.toContain('KEY-GLOBAL');
+    expect(serialized).not.toContain('SALT-GLOBAL-VALUE');
+    expect(serialized).not.toContain('SVC-KEY');
+    expect(view.app.byInstance['mall-sh-01']?.masked.appKey).toBe('****'); // ≤4 字符全掩码
+    app.dispose();
+  });
+
+  it('C4 credential-types：全量清单 + ?provider= 过滤（未知 → 空不 404）+ schema 原文', async () => {
+    const { app, tk } = credHarness();
+    const all = await tk.loadCredentialTypes();
+    expect(all.types.map((t) => t.credentialType)).toEqual(['-', 'wanda-c-signed-v1']);
+    const wanda = await tk.loadCredentialTypes('wanda');
+    expect(wanda.types).toHaveLength(1);
+    expect(wanda.types[0]).toEqual({
+      credentialType: 'wanda-c-signed-v1',
+      owner: expect.any(String),
+      credentialSchema: { type: 'object', properties: { appKey: { type: 'string' } } },
+    });
+    expect((await tk.loadCredentialTypes('mock')).types.map((t) => t.credentialType)).toEqual(['-']);
+    expect((await tk.loadCredentialTypes('ghost')).types).toEqual([]);
+    app.dispose();
+  });
+
+  it('C5 删净断言：单体 instances[].credential 与组合单体 credentialSchema 全链不在场', async () => {
+    const { app, tk } = credHarness();
+    const detail = await tk.loadServiceResolution('parking.payment');
+    const inst = detail.resolution.instances.find((i) => i.instanceId === 'mall-bj-01');
+    // 假 resolve 仅读槽级 ref（简化级联）——effective.credentialRef = 槽级 secret://wanda-parking.payment
+    expect(inst?.effective?.credentialRef).toBe('secret://wanda-parking.payment');
+    expect(inst && 'credential' in inst).toBe(false);
+    expect('credential' in JSON.parse(JSON.stringify(detail.resolution))).toBe(false);
+    const combo = await tk.loadProviderService('wanda', 'parking.payment');
+    expect('credentialSchema' in combo.integrationSchemas).toBe(false);
+    expect(combo.implementations[0]?.credentialType).toBe('wanda-c-signed-v1'); // 寻址键保留
+    app.dispose();
+  });
+});

package/tests/demo-app.ts

@@ -48,15 +48,24 @@ export interface FakeContractsOptions {
   /** resolveEffectiveService 自定义函数体（FX-2c O4 fixture：默认恒 service-not-configured；
    *  入参 (integrations, service, instanceId, supplies)，需 return EffectiveServiceResolution 形状） */
   resolveBody?: string;
+  /** service-slots.json 词汇（P9 身份判据/求值键集；缺省不物化 = 词汇空） */
+  slots?: string[];
+  /** zod 形拒绝 fixture（A1 T9/T10）：parseIntegrationsConfig 恒抛带 issues 的结构化错误
+   *  （结构性 ZodError 形——issues[].path 供 fields 断言；仅在专属 fixture 上使用） */
+  zodRejectPaths?: string[][];
 }
 
 /** 假 contracts 包：package.json exports 形态逐字段复刻发布面（types+import 双条件、无 require/default）
  *  ——resolver 不经 exports 解析（包根直探），该形态为 E4 类错误的机械防线。 */
 export function writeFakeContractsPackage(packageRoot: string, opts: FakeContractsOptions = {}): void {
-  const { version = '0.9.0', withStrict = true, withDist = true, brokenDist = false, missingEvaluationExports = false, rejectMarker, resolveBody } = opts;
+  const { version = '0.9.0', withStrict = true, withDist = true, brokenDist = false, missingEvaluationExports = false, rejectMarker, resolveBody, slots, zodRejectPaths } = opts;
   const strictBody = withStrict
     ? `export function parseIntegrationsConfig(raw) { ${
         rejectMarker ? `if (JSON.stringify(raw).includes(${JSON.stringify(rejectMarker)})) throw new Error("fake strict reject"); ` : ''
+      }${
+        zodRejectPaths
+          ? `throw Object.assign(new Error("fake zod reject"), { issues: ${JSON.stringify(zodRejectPaths.map((p) => ({ path: p })))} }); `
+          : ''
       }return raw; }`
     : '';
   const resolveLine = `export function resolveEffectiveService(integrations, service, instanceId, supplies) { ${
@@ -104,6 +113,10 @@ export function writeFakeContractsPackage(packageRoot: string, opts: FakeContrac
     mkdirSync(join(packageRoot, 'src'), { recursive: true });
     writeFileSync(join(packageRoot, 'src', 'runtime.ts'), exportsBody);
   }
+  // service-slots.json（P9 词汇源——探测链发现位 = 包根；缺省不物化 = 词汇空）
+  if (slots && slots.length > 0) {
+    writeFileSync(join(packageRoot, 'service-slots.json'), `${JSON.stringify({ slots }, null, 2)}\n`);
+  }
 }
 
 export interface LinkOptions {

package/tests/naming-alignment.test.ts

@@ -6,7 +6,7 @@ import { describe, it, expect } from 'vitest';
  * （方法名断言依赖 factory 导出——届时 import { createAppToolkit } 逐行断言 typeof）。
  */
 
-/** 13 行映射表（api.md §8 单源；C4 补全为逐行断言） */
+/** 15 行映射表（api.md §8 单源——v4.4 +GET /credentials、+GET /credential-types） */
 export const URL_METHOD_MAP: ReadonlyArray<{ method: string; url: string }> = [
   // ── 静态（7）──
   { method: 'loadModules', url: 'GET /modules' },
@@ -19,6 +19,9 @@ export const URL_METHOD_MAP: ReadonlyArray<{ method: string; url: string }> = [
   // ── 求值（2）──
   { method: 'loadServiceResolutions', url: 'GET /service-resolutions' },
   { method: 'loadServiceResolution', url: 'GET /service-resolutions/:service' },
+  // ── 凭据域（2；v4.4 D33）──
+  { method: 'loadCredentials', url: 'GET /credentials' },
+  { method: 'loadCredentialTypes', url: 'GET /credential-types' },
   // ── 写（4）──
   { method: 'writeAppIntegration', url: 'PUT /app/integration' },
   { method: 'writeModuleIntegration', url: 'PUT /modules/:module/integration' },
@@ -26,10 +29,10 @@ export const URL_METHOD_MAP: ReadonlyArray<{ method: string; url: string }> = [
   { method: 'deleteServiceIntegration', url: 'DELETE /services/:service/integration' },
 ];
 
-describe('naming-alignment（L1 映射表——C2 骨架）', () => {
-  it('映射表骨架 = 13 行（静态 7 + 求值 2 + 写 4）——计数守卫', () => {
-    expect(URL_METHOD_MAP).toHaveLength(13);
-    expect(URL_METHOD_MAP.filter((r) => r.url.startsWith('GET '))).toHaveLength(9);
+describe('naming-alignment（L1 映射表）', () => {
+  it('映射表 = 15 行（静态 7 + 求值 2 + 凭据域 2 + 写 4）——计数守卫（v4.4）', () => {
+    expect(URL_METHOD_MAP).toHaveLength(15);
+    expect(URL_METHOD_MAP.filter((r) => r.url.startsWith('GET '))).toHaveLength(11);
     expect(URL_METHOD_MAP.filter((r) => r.url.startsWith('PUT '))).toHaveLength(3);
     expect(URL_METHOD_MAP.filter((r) => r.url.startsWith('DELETE '))).toHaveLength(1);
   });