@tbox.cn/app-toolkit 0.1.0 → 0.3.0

package/dist/index.js

@@ -1,8 +1,8 @@
-import{a as ce,b as M,c as le}from"./chunk-VV3ERZXS.js";import{z as y}from"zod";var F=/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/,kn=y.object({cardType:y.string(),schemaVersion:y.number().optional()}),Ve=y.object({route:y.string(),component:y.string()}),$e=y.object({route:y.string(),label:y.string().optional(),icon:y.string().optional(),order:y.number().optional()}),_e=y.object({id:y.string(),range:y.string().optional(),required:y.boolean().default(!0)}),Fe=y.object({service:y.string(),provider:y.string().regex(F,"provider 名含非法字符（需 /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/）"),implementation:y.string(),credentialType:y.string(),local:y.boolean().optional(),configSchema:y.string().optional(),credentialSchema:y.string().optional()}),Le=y.object({service:y.string(),optional:y.boolean().default(!0),defaults:y.array(y.object({provider:y.string().regex(F,"provider 名含非法字符（需 /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/）"),implementation:y.string()})).default([]),title:y.string().optional(),description:y.string().optional()}),We=y.object({id:y.string(),type:y.string()}),Be=y.object({schemaVersion:y.number().default(1),name:y.string(),version:y.string().default("0.0.0"),kind:y.enum(["platform","business","third-party"]).default("business"),risk:y.object({level:y.enum(["high","medium","low"]).default("low"),writeBoundary:y.enum(["sdk-enforced","source"]).default("source")}).default({}),distribution:y.object({defaultMode:y.enum(["hybrid","sdk","codegen","local"]).default("codegen")}).default({}),contributes:y.object({handlers:y.array(y.string()).default([]),tools:y.array(y.string()).default([]),cards:y.array(kn).default([]),routes:y.array(y.string()).default([]),pages:y.array(Ve).default([]),tabs:y.array($e).default([]),providers:y.object({slots:y.array(Fe).default([])}).default({}),services:y.array(Le).default([]),resources:y.array(We).default([])}).default({}),dependencies:y.object({modules:y.array(_e).default([])}).default({}),env:y.array(y.string()).default([])}).strict();function J(e){let n=Be.safeParse(e);return n.success?{ok:!0,value:n.data}:{ok:!1,errors:n.error.issues.map(r=>`${r.path.join(".")||"(root)"}: ${r.message}`)}}var bn=/\$\$?\{([A-Z][A-Z0-9_]*)\}/g;function Cn(e){return JSON.stringify(e).slice(1,-1)}function An(e,n=process.env){let r=[],t=e.replace(bn,(a,i)=>{if(a.startsWith("$$"))return a.slice(1);let o=n[i];return o===void 0?(r.push(i),a):Cn(o)});return r.length>0?{missing:r}:{text:t,missing:[]}}import{mkdirSync as xn,existsSync as ze,readFileSync as En,writeFileSync as Mn}from"fs";import{dirname as On,join as Ke}from"path";function q(e){let n={};for(let[r,t]of Object.entries(e)){if(typeof t!="string"){n[r]=null;continue}n[r]=t.length<=4?"****":`${t.slice(0,2)}****`}return n}function Q(e,n){if(n!==void 0&&(n.includes("/")||n.includes("\\")||n.includes("..")))throw new Error(`凭据 stem 派生输入含路径敌对字符（${e}）——拒绝派生`)}function W(e){if(Q("provider",e.provider),Q("service",e.service),Q("instanceId",e.instanceId),Q("domain",e.domain),e.instanceId!==void 0){let n=e.domain??e.service??"global";return`${e.provider}-${e.instanceId}-${n}`}return e.service!==void 0?`${e.provider}-${e.service}`:`${e.provider}-global`}function jn(e){return`secret://${e}`}function _(e){return`config/credentials/${e}.json`}function Y(e,n){let r=Ke(e,_(n));if(!ze(r))return null;try{let t=JSON.parse(En(r,"utf8"));if(typeof t.type!="string")return null;let{type:a,...i}=t,o={};for(let[g,d]of Object.entries(i))typeof d=="string"&&(o[g]=d);return{type:a,values:o}}catch{return null}}function de(e,n,r){let t=Ke(e,_(n)),a=ze(t);return xn(On(t),{recursive:!0}),Mn(t,`${JSON.stringify({type:r.type,...r.values},null,2)}
-`,"utf8"),a}import{mkdirSync as Tn,renameSync as Nn,writeFileSync as Pn}from"fs";import{dirname as Dn}from"path";function $(e,n){Ue(Dn(e));let r=`${e}.tmp-${process.pid}-${Date.now()}`;Pn(r,n,"utf8"),Nn(r,e)}function Ue(e){Tn(e,{recursive:!0})}function ue(e){if(!e||typeof e!="object")return!1;let n=Object.keys(e),r=new Set(["provider","credentialType","configSchema"]);if(!n.every(a=>r.has(a)))return!1;let t=e;return typeof t.provider=="string"&&t.provider.length>0&&typeof t.credentialType=="string"&&t.credentialType.length>0&&(t.configSchema===void 0||typeof t.configSchema=="string")}function Je(e,n,r){return e==="*"||r.has(e)?null:{severity:"error",code:"INSTANCE_KEY_NOT_REGISTERED",instance:e,message:`integrations: ${n} 键 ${e} 不在 malls 白名单内（${[...r].join(", ")}）`}}function pe(e,n){let r=new Set(n),t=[],a=(i,o)=>{let g=Je(i,o,r);g&&t.push(g)};for(let i of Object.keys(e.configByInstance??{}))a(i,"configByInstance");for(let i of Object.keys(e.credentialRefByInstance??{}))a(i,"credentialRefByInstance");for(let[i,o]of Object.entries(e.services??{}))for(let g of Object.keys(o.instances??{}))a(g,`services.${i}.instances`);return t}function X(e){let n=[],r=e.contracts,{integrations:t,suppliedProviders:a,demandedServices:i,supplies:o,malls:g,credentialSchemaMissing:d,vendorConfigKeys:p,vendorConfigSchemaMissing:m,credentialFileMissing:v,credentialFileType:f,realmSwitchHints:u,moduleResourceNeeds:k}=e,s=g?new Set(g):void 0;for(let c of u??[])n.push({severity:"warning",code:"REALM_SWITCH_HINT",message:c});let l=new Set(Object.keys(a).map(c=>c.slice(0,c.indexOf("\0"))).filter(c=>c.length>0)),h=(c,S,b,I)=>{if(typeof b?.provider=="string"&&typeof b.implementation=="string"&&b.provider&&b.implementation)return a[Z(b.provider,b.implementation)]?.credentialType;if(typeof S.provider=="string"&&typeof S.implementation=="string")return a[Z(S.provider,S.implementation)]?.credentialType;let A=S.provider?.credentialType;if(typeof A=="string")return A;if(!o)return;let x=I??Object.keys(S.instances??{})[0]??"",E=r.resolveEffectiveService(t,c,x,o);if(!(E.status!=="ok"||typeof E.effective.provider!="string"))return a[Z(E.effective.provider,E.effective.implementation)]?.credentialType};if(v||f)for(let[c,S]of Object.entries(t.services))for(let[b,I]of Object.entries(S.instances??{})){if(I.enabled===!1)continue;let A=I.credentialRef??S.credentialRef??t.credentialRefByInstance?.[b]??t.credentialRef;if(typeof A!="string"||!A.startsWith("secret://"))continue;let x=A.slice(9);v?.[x]===!0&&n.push({severity:"error",code:"CREDENTIAL_FILE_MISSING",service:c,instance:b,message:`integrations: 凭据文件缺失 ${x}（${c}@${b} effective ref=${A}；档内 config/credentials/ 无此文件）`});let E=f?.[x];if(E){let N=h(c,S,I,b);N&&E!==N&&n.push({severity:"error",code:"CREDENTIAL_TYPE_MISMATCH",service:c,instance:b,message:`integrations: 凭据文件 ${x}.json type=${E} 与绑定 credentialType ${N} 不一致（${c}@${b}——transport 创建期将按 type 选策略）`})}}let C=(c,S)=>{if(!s)return;let b=Je(c,S,s);b&&n.push(b)};for(let[c]of Object.entries(t.configByInstance??{}))C(c,"configByInstance");for(let[c]of Object.entries(t.credentialRefByInstance??{}))C(c,"credentialRefByInstance");let j=Object.entries(t.services).filter(([,c])=>c.instances==null||c.instances["*"]!=null).map(([c])=>c);if(j.length>0){let c=Object.entries(t.services).filter(([,S])=>S.instances!=null&&S.instances["*"]==null).map(([S])=>S);c.length>0&&n.push({severity:"warning",code:"WILDCARD_ALIGNMENT",message:`integrations: 激活形态不对称（通配：${j.join(", ")}；显式键集：${c.join(", ")}）——动态 mallId 将在显式键集槽上 INSTANCE_NOT_FOUND（provider 业务限制表达位），确认是否齐步`})}let R=r.normalizeInstances({instances:t.instances,defaultInstanceId:t.defaultInstanceId});R.instances.length>=2&&R.defaultInstanceId===null&&n.push({severity:"warning",code:"MULTI_INSTANCE_NO_DEFAULT",message:`integrations: ${R.instances.length} 个部署实例（${R.instances.map(c=>c.id).join(", ")}）均无 defaultInstanceId——无 scope 参数访问将落全局会话（默认商圈不注入）`});for(let[c,S]of Object.entries(t.services)){if(i[c]||n.push({severity:"warning",code:"SLOT_NOT_DECLARED",service:c,message:`integrations: 服务槽 ${c} 无消费方声明（拼写错误或需求方未安装）——若为拆分前旧槽位词汇（member.main/parking.main/promotion.read/shopping-guide.main），参照 cookbook·app-config 槽位迁移配方展开为新槽`}),typeof S.provider=="string"?typeof S.implementation=="string"&&!a[Z(S.provider,S.implementation)]&&n.push({severity:"error",code:"INSTANCE_SUPPLY_UNMATCHED",service:c,message:`integrations: provider ${S.provider}/${S.implementation} 未命中已装供给（${c} 槽级）——装对应 provider 包或改绑`}):S.provider!==void 0&&!ue(S.provider)&&n.push({severity:"error",code:"INLINE_PROVIDER_INVALID",service:c,message:`integrations: 内联 provider 超受控形状（${c} 槽级；允许键 provider/credentialType/configSchema）`}),d){let I=h(c,S);I&&d[I]===!0&&n.push({severity:"error",code:"SCHEMA_FILE_MISSING",service:c,message:`integrations: credentialType ${I} 的 schema 引用不存在（${c}；manifest 声明指向缺失文件）`})}typeof S.provider=="object"&&typeof S.implementation!="string"&&n.push({severity:"error",code:"IMPL_WITHOUT_PROVIDER",service:c,message:`integrations: 内联厂商声明必须同时提供 implementation（${c} 槽级）`});for(let[I,A]of Object.entries(S.instances??{})){C(I,`services.${c}.instances`);let x=A.provider!==void 0,E=A.implementation!==void 0;if(E&&!x&&n.push({severity:"error",code:"IMPL_WITHOUT_PROVIDER",service:c,instance:I,message:`integrations: 实例级 implementation 需伴随 provider（${c}@${I}——impl-only 禁止，provider 是绑定组头）`}),x&&E){let N=A.provider,V=A.implementation;typeof N=="string"&&typeof V=="string"?a[Z(N,V)]||n.push({severity:"error",code:"INSTANCE_SUPPLY_UNMATCHED",service:c,instance:I,message:`integrations: 实例级 provider 覆盖 ${N}/${V} 未命中已装供给（${c}@${I}）`}):ue(N)||n.push({severity:"error",code:"INLINE_PROVIDER_INVALID",service:c,instance:I,message:`integrations: 实例级内联 provider 超受控形状（${c}@${I}）`})}}}for(let[c,S]of[["root",t.provider],...Object.entries(t.domains??{}).map(([b,I])=>[`domains.${b}`,I?.provider])])typeof S!="string"||S.length===0||l.has(S)||n.push({severity:"error",code:"VENDOR_NOT_INSTALLED",module:c.startsWith("domains.")?c.slice(8):void 0,message:`integrations: ${c} provider ${S} 未命中已装供给——装对应 provider 包或 provider use 改绑`});if(o)for(let[c,S]of Object.entries(t.services)){let b=S.instances?Object.keys(S.instances):[""];for(let I of b){let A=r.resolveEffectiveService(t,c,I,o);A.status==="binding-unresolved"&&n.push({severity:"error",code:"BINDING_UNRESOLVED",service:c,instance:I||void 0,message:`integrations: ${A.message}`})}}for(let[c,S]of Object.entries(t.services))S.implementation!==void 0&&S.provider===void 0&&n.push({severity:"error",code:"IMPL_WITHOUT_PROVIDER",service:c,message:`integrations: 槽级 implementation 需伴随 provider（${c}——impl-only 禁止，provider 是绑定组头）`});let w=new Set([...Object.keys(t.services).map(c=>r.moduleDomainOf(c)),...Object.keys(i).map(c=>r.moduleDomainOf(c))]);for(let c of Object.keys(t.domains??{}))w.has(c)||n.push({severity:"warning",code:"DOMAIN_KEY_UNMATCHED",module:c,message:`integrations: domains.${c} 无对应槽位或需求声明（域前缀拼写错误？——键 = 槽位 id 点分前缀）`});if(p){let c=new Set,S=!1,b=I=>{typeof I!="string"||I.length===0||(p[I]&&c.add(I),!p[I]&&!m?.[I]&&(S=!0),m?.[I]&&(S=!0))};b(t.provider);for(let I of Object.values(t.domains??{}))b(I?.provider);for(let I of Object.values(t.services)){let A=I.provider;b(typeof I.provider=="string"?I.provider:A?.provider)}if(c.size>0&&!S){let I=new Set;for(let x of c)for(let E of p[x]??[])I.add(E);let A=(x,E,N)=>{for(let[V]of Object.entries(x??{}))(N??I).has(V)||n.push({severity:"error",code:"DOMAIN_CONFIG_INVALID",message:`integrations: ${E} 键 ${V} 不在引用厂商（${[...c].join("/")}）任何槽 schema properties 内（死配置）`})};A(t.config,"root.config");for(let[x,E]of Object.entries(t.configByInstance??{}))A(E,`root.configByInstance[${x}]`);for(let[x,E]of Object.entries(t.domains??{})){if(!E?.config)continue;let N=typeof E.provider=="string"&&E.provider?E.provider:typeof t.provider=="string"?t.provider:void 0;if(N===void 0){A(E.config,`domains.${x}.config`);continue}let V=p[N];!V||m?.[N]||A(E.config,`domains.${x}.config`,new Set(V))}}}for(let[c,S]of Object.entries(i)){let b=t.services[c];if(!b){n.push({severity:"warning",code:"SLOT_NOT_CONFIGURED",service:c,message:`integrations: 服务槽 ${c}（需求方 ${S.owners.join(", ")}）未配置${S.optional?"（可选槽）":"（必需槽——模块将走降级链）"}`});continue}let I=Object.entries(b.instances??{}).filter(([,A])=>A.enabled===!1).map(([A])=>A);I.length>0&&n.push({severity:"warning",code:"INSTANCE_DISABLED",service:c,instance:I.join(", "),message:`integrations: ${c} 实例禁用（${I.join(", ")}）`})}for(let[c,S]of Object.entries(t.modules??{})){let b=k?.[c];k&&!(c in k)&&n.push({severity:"warning",code:"RESOURCE_NOT_DECLARED",module:c,message:`integrations: modules.${c} 未命中已装模块（键 = install id——检查 .tbox/app.json entry.id / packages/ 目录名）`});for(let[I,A]of Object.entries(S?.resources??{})){let x=A?.type;(typeof x!="string"||!r.RESOURCE_TYPE_IDS.includes(x))&&n.push({severity:"error",code:"RESOURCE_TYPE_UNKNOWN",module:c,message:`integrations: modules.${c}.resources.${I} type 非法（${String(x)}；词汇表 = ${r.RESOURCE_TYPE_IDS.join("/")}）`}),b&&b.size>0&&!b.has(I)&&n.push({severity:"warning",code:"RESOURCE_NOT_DECLARED",module:c,message:`integrations: modules.${c}.resources.${I} 未被模块 manifest contributes.resources 声明`})}}return n}function Z(e,n){return`${e}\0${n}`}import{existsSync as fe,readFileSync as Vn,readdirSync as $n}from"fs";import{join as ee}from"path";function Ze(e){return e.replaceAll("-","_").toUpperCase()}function Ye(e){if(!fe(e))return null;try{let n=JSON.parse(Vn(e,"utf8"));return n&&typeof n=="object"?n:null}catch{return null}}function _n(e){let n=new Set,r=e.properties;if(r&&typeof r=="object"&&!Array.isArray(r))for(let t of Object.keys(r))n.add(t);return n}function ge(e,n,r,t=process.env){let a={};for(let[R,w]of Object.entries(n.catalog.providers))for(let[c,S]of Object.entries(w))a[`${R}\0${c}`]={services:[...S.services],owner:S.owner,credentialType:S.credentialType};let i={};for(let[R,w]of Object.entries(n.catalog.services))i[R]={optional:w.optional,owners:[...w.owners]};let o={},g={},d={},p={};for(let R of n.modules){p[R.id]=new Set((R.descriptor.contributes.resources??[]).map(w=>w.id));for(let w of R.descriptor.contributes.providers?.slots??[]){if(w.configSchema){let c=Ye(ee(R.dir,w.configSchema));if(c){let S=o[w.provider]??=new Set;for(let b of _n(c))S.add(b)}else g[w.provider]=!0}w.credentialSchema&&!fe(ee(R.dir,w.credentialSchema))&&(d[w.credentialType]=!0)}}let m={},v=new Set,f=ee(e,"config","credentials");if(fe(f))for(let R of $n(f)){if(!R.endsWith(".json"))continue;let w=R.slice(0,-5);v.add(w);let c=Ye(ee(f,R));c&&typeof c.type=="string"&&(m[w]=c.type)}let u=r,k=[],s=R=>{typeof R=="string"&&R.startsWith("secret://")&&k.push(R)};for(let R of Object.values(u.services??{}))if(R&&typeof R=="object"){s(R.credentialRef);for(let w of Object.values(R.instances??{}))w&&typeof w=="object"&&s(w.credentialRef)}for(let R of Object.values(u.credentialRefByInstance??{}))s(R);s(u.credentialRef);let l={};for(let R of k){let w=R.slice(9);t[Ze(w)]===void 0&&(v.has(w)||(l[w]=!0))}let h=[];for(let[R,w]of Object.entries(u.services??{})){let c=w&&typeof w=="object"&&typeof w.provider=="string"?w.provider:void 0;for(let[S,b]of Object.entries((w&&typeof w=="object"?w.instances:void 0)??{})){let I=b&&typeof b=="object"&&typeof b.provider=="string"?b.provider:void 0;c&&I&&I!==c&&h.push(`integrations: ${R}@${S} 实现覆盖跨厂商（${c} → ${I}）——凭据域切换，确认该 mall 对应凭据在场`)}}let j=((Array.isArray(u.instances)?u.instances:void 0)??[]).map(R=>R&&typeof R=="object"&&typeof R.id=="string"?R.id:void 0).filter(R=>typeof R=="string");return{suppliedProviders:a,demandedServices:i,credentialFileMissing:l,credentialFileType:m,credentialSchemaMissing:d,vendorConfigKeys:o,vendorConfigSchemaMissing:g,realmSwitchHints:h,moduleResourceNeeds:p,...j.length>0?{malls:j}:{}}}import{existsSync as D,readdirSync as ve,readFileSync as B}from"fs";import{join as T}from"path";import{existsSync as Fn,readFileSync as He,mkdirSync as Ln,writeFileSync as Wn}from"fs";import Ge from"path";function ne(e){return Ge.join(e,".tbox","app.json")}function qe(e){let n=ne(e);if(!Fn(n))return null;try{let r=JSON.parse(He(n,"utf8")),t=r?.templateVersion;return typeof t!="string"||t.trim().length===0?null:{templateVersion:t.trim(),npmModules:Array.isArray(r?.npmModules)?r.npmModules:[]}}catch{return null}}function Bn(e,n){let r=ne(e);Ln(Ge.dirname(r),{recursive:!0}),Wn(r,`${JSON.stringify(n,null,2)}
-`,"utf8")}function me(e){let n=qe(e);if(n===null)return null;let r=ne(e);try{let t=JSON.parse(He(r,"utf8"));return{...n,miniappContainers:Array.isArray(t?.miniappContainers)?t.miniappContainers:[]}}catch{return{...n,miniappContainers:[]}}}function zn(e,n){let r=e.npmModules.filter(t=>t.id!==n.id);return{...e,npmModules:[...r,n]}}function Kn(e,n){return{...e,npmModules:e.npmModules.filter(r=>r.id!==n)}}function Un(e,n){let r=(e.miniappContainers??[]).filter(t=>t.id!==n.id);return{...e,miniappContainers:[...r,n]}}function Jn(e,n,r){return{...e,npmModules:e.npmModules.map(t=>t.id===n?{...t,...r}:t)}}function Qe(e){return/^[a-z0-9]+(-[a-z0-9]+)*$/.test(e)&&!e.includes("..")}function Yn(e,n){if(!Qe(e))throw new Error(`非法模块 id "${e}"（来自 ${n}）：仅允许小写字母/数字/中划线`)}function te(e,n){let r=t=>{try{let a=JSON.parse(t),i=J(a);if(i.ok)return{kind:"strict",name:i.value.name,version:i.value.version,descriptor:i.value,contributes:i.value.contributes};if(a&&typeof a=="object"&&"contributes"in a){let o=a;return{kind:"loose",...typeof o.name=="string"?{name:o.name}:{},contributes:{providers:o.contributes?.providers,services:o.contributes?.services}}}return null}catch{return null}};if(n)return n.read(e,r)??null;if(!D(e))return null;try{return r(B(e,"utf8"))}catch{return null}}function Zn(e){let n=T(e,".tbox","app.json");if(!D(n))return[];try{let r=JSON.parse(B(n,"utf8"));return Array.isArray(r.npmModules)?r.npmModules.filter(t=>!!t&&typeof t=="object"&&typeof t.id=="string"&&typeof t.package=="string"):[]}catch{return[]}}function Hn(e){let n=T(e,".tbox-dev.local"),r=T(n,"dev-manifest.json");if(!D(r))return[];try{let t=JSON.parse(B(r,"utf8")),a=[];for(let[i,o]of Object.entries(t.redirects??{}))typeof o!="string"||!i.startsWith("@tbox.cn/app-")||a.push({pkg:i,dir:T(n,o)});return a}catch{return[]}}function Gn(e,n){let r=[],t=[e];for(let i of["apps","packages"]){let o=T(e,i);if(D(o))try{for(let g of ve(o,{withFileTypes:!0}))g.isDirectory()&&t.push(T(o,g.name))}catch{}}let a=new Set;for(let i of t){let o=T(i,"node_modules","@tbox.cn");if(!D(o))continue;let g=[];try{g=ve(o)}catch{continue}for(let d of g){let p=T(o,d);if(a.has(p))continue;a.add(p);let m=T(p,"service-slots.json");if(!D(m))continue;let v=u=>{try{let k=JSON.parse(u);if(Array.isArray(k.slots))return k.slots.filter(s=>typeof s=="string")}catch{}return null},f=n?n.read(m,v):v(B(m,"utf8"));f!=null&&r.push({dir:p,slots:f})}}return r}function P(e,n){let r=[],t={providers:{},services:{},credentialTypes:{}},a={},i=[],o=new Set,g=new Map,d=(f,u,k)=>{for(let s of f){let l=t.providers[s.provider]??={},h=l[s.implementation];h?h.services.includes(s.service)||h.services.push(s.service):(l[s.implementation]={provider:s.provider,implementation:s.implementation,credentialType:s.credentialType,owner:u,...s.local?{local:!0}:{},...s.configSchema?{configSchema:s.configSchema}:{},...s.credentialSchema?{credentialSchema:s.credentialSchema}:{},services:[s.service]},t.credentialTypes[s.credentialType]??={owner:u,...s.credentialSchema?{credentialSchema:s.credentialSchema}:{}});let C=`${s.provider}\0${s.service}`;a[C]||(a[C]={...s.configSchema?{configSchema:s.configSchema}:{},...s.credentialSchema?{credentialSchema:s.credentialSchema}:{},packageDir:k})}},p=(f,u)=>{let k=f.optional!==!1,s=f.defaults??[],l=t.services[f.service];if(l){l.optional=l.optional&&k;let j=new Set(l.defaults.map(R=>`${R.provider}\0${R.implementation}`));for(let R of s){let w=`${R.provider}\0${R.implementation}`;j.has(w)||(l.defaults.push(R),j.add(w))}l.owners.includes(u)||l.owners.push(u);return}t.services[f.service]={optional:k,defaults:[...s],...f.title?{title:f.title}:{},...f.description?{description:f.description}:{},owners:[u]};let h=f.service.includes(".")?f.service.slice(0,f.service.indexOf(".")):f.service,C=g.get(h);C===void 0?g.set(h,u):C!==u&&i.push({severity:"warning",code:"DOMAIN_KEY_CONFLICT",module:u,message:`域键 ${h} 被多模块声明（${C} 与 ${u}）——domains 换算歧义（P13）`})};for(let f of Zn(e)){if(o.has(f.id))continue;let u=T(e,"packages",f.id),k=T(e,"node_modules",...f.package.split("/")),s=te(T(u,"tbox.module.json"),n)??te(T(k,"tbox.module.json"),n);if(!s)continue;o.add(f.id);let l=D(T(u,"tbox.module.json"))?u:k,h=s.contributes;s.kind==="strict"&&r.push({id:f.id,dir:l,pkg:f.mode==="sdk"?f.package:`@app/${f.id}`,descriptor:s.descriptor});let C=h.providers?.slots??[];C.length&&d(C,f.package,l);let j=h.services??[];if(j.length)for(let R of j)p(R,f.package)}for(let{pkg:f,dir:u}of Hn(e)){let k=te(T(u,"tbox.module.json"),n);if(!k?.name||o.has(k.name))continue;o.add(k.name);let s=k.contributes.providers?.slots??[];s.length&&d(s,f,u);let l=k.contributes.services??[];if(l.length)for(let h of l)p(h,f)}let m=T(e,"packages");if(D(m)){let f=[];try{f=ve(m,{withFileTypes:!0}).filter(u=>u.isDirectory()).map(u=>u.name)}catch{}for(let u of f){if(o.has(u))continue;let k=T(m,u),s=te(T(k,"tbox.module.json"),n);if(!s)continue;let l=s.name??u;if(o.has(l))continue;o.add(l);let h=s.contributes;s.kind==="strict"&&r.push({id:l,dir:k,pkg:`@app/${l}`,descriptor:s.descriptor});let C=h.providers?.slots??[];C.length&&d(C,`@app/${l}`,k);let j=h.services??[];if(j.length)for(let R of j)p(R,`@app/${l}`)}}let v=new Set;for(let f of Gn(e,n))for(let u of f.slots)v.add(u);return{modules:r,catalog:t,serviceSchemas:a,vocabulary:[...v].sort(),domainKeyIssues:i}}function Xe(e,n,r){let t=T(e,"src",n,"index.ts");if(!D(t))return!1;try{let a=B(t,"utf8");return new RegExp(`export\\s+const\\s+${r}\\b`).test(a)}catch{return!1}}function qn(e){let n=T(e,"src","server","index.ts");if(!D(n))return"";try{return B(n,"utf8")}catch{return""}}function en(e){return e.match(/declaration\s*:\s*\{[\s\S]*?moduleId\s*:\s*['"]([^'"]+)['"]/)?.[1]}function Qn(e){let n=[],r=P(e),t=me(e),a=new Map;for(let i of t?.npmModules??[])a.set(i.id,i.mode);for(let i of r.modules){let o=a.get(i.id)??"local",g=Xe(i.dir,"server","serverModule"),d=i.descriptor.contributes;n.push({id:i.id,pkg:o==="sdk"?i.pkg:`@app/${i.id}`,mode:o,hasServerEntry:g,hasClientEntry:Xe(i.dir,"client","clientModule"),hasCards:(d.cards?.length??0)>0,...g?{moduleId:en(qn(i.dir))}:{}})}return n.sort((i,o)=>i.id.localeCompare(o.id))}import{existsSync as Jt,readFileSync as Yt}from"fs";import{join as Ht,resolve as Gt}from"path";function ye(e){return P(e).catalog}function nn(e){let n=P(e).catalog,r={};for(let[i,o]of Object.entries(n.providers)){r[i]={};for(let[g,d]of Object.entries(o))r[i][g]={provider:d.provider,implementation:d.implementation,credentialType:d.credentialType,owner:d.owner,...d.local?{local:!0}:{},...d.configSchema?{configSchema:d.configSchema}:{},...d.credentialSchema?{credentialSchema:d.credentialSchema}:{},services:[...d.services]}}let t={};for(let[i,o]of Object.entries(n.services))t[i]={optional:o.optional,defaults:o.defaults.map(g=>({...g})),owners:[...o.owners]};let a={};for(let[i,o]of Object.entries(n.credentialTypes))a[i]={...o};return{providers:r,services:t,credentialTypes:a}}import{existsSync as Xn,readFileSync as et}from"fs";import{join as tn}from"path";var nt=tn("config","integrations.json");function z(e,n){let r=tn(e,nt),t=a=>JSON.parse(a);if(n)return n.read(r,t)??null;if(!Xn(r))return null;try{return t(et(r,"utf8"))}catch{return null}}async function rn(e,n){let r=await M(e),t=z(e,n);return t===null?{config:null,strict:!1,contracts:r}:r.strictValidation&&r.module.parseIntegrationsConfig?{config:r.module.parseIntegrationsConfig(t),strict:!0,contracts:r}:{config:t,strict:!1,contracts:r}}import{existsSync as ln,readFileSync as dn}from"fs";import{join as K,resolve as ot}from"path";import st from"ajv";var H=["provider","config","configByInstance","credentialRef","credentialRefByInstance","instances","defaultInstanceId"];import{readdirSync as tt,existsSync as re,readFileSync as rt}from"fs";import{join as ie}from"path";function on(e,n,r){let t=[];if(n){let a=W({provider:e});t.push({stem:a,ref:`secret://${a}`,input:n})}for(let[a,i]of Object.entries(r??{})){let o=W({provider:e,instanceId:a});t.push({instanceId:a,stem:o,ref:`secret://${o}`,input:i})}return t}function sn(e,n,r,t,a){let i=[];if(t){let o=W({provider:e,service:n});i.push({stem:o,ref:`secret://${o}`,input:t})}for(let[o,g]of Object.entries(a??{})){let d=W({provider:e,instanceId:o,domain:r});i.push({instanceId:o,stem:d,ref:`secret://${d}`,input:g})}return i}function Re(e,n,r){return n.map(t=>({stem:t.stem,ref:t.ref,overwrote:r?re(ie(e,_(t.stem))):de(e,t.stem,t.input)}))}function it(e,n){return re(ie(e,_(n)))}function Se(e,n){if(typeof e=="string"){e.startsWith("secret://")&&n.add(e.slice(9));return}if(Array.isArray(e)){for(let r of e)Se(r,n);return}if(e&&typeof e=="object")for(let r of Object.values(e))Se(r,n)}function we(e){let n=ie(e,"config","credentials"),r=new Set,t=ie(e,"config","integrations.json");if(re(t))try{Se(JSON.parse(rt(t,"utf8")),r)}catch{}let a=[];if(!re(n))return a;let i=[];try{i=tt(n).filter(o=>o.endsWith(".json")).map(o=>o.slice(0,-5))}catch{return a}for(let o of i.sort()){if(r.has(o))continue;let g=Y(e,o);a.push({severity:"warning",code:"ORPHANED_CREDENTIAL",message:`config/credentials/${o}.json 不再被引用（凭据文件保留，可手动清理）`})}return a}var O=class extends Error{code;httpStatus;fields;constructor(n,r,t,a){super(t),this.name="AppToolkitError",this.code=n,this.httpStatus=r,this.fields=a}};function Ie(e){return e.version===null?"contracts 不可解析（未安装）——检查应用依赖安装后重试":e.strictValidation?e.notes[0]??"contracts workspace 源码态未构建——执行 pnpm --filter @tbox.cn/app-contracts build 后重试":`contracts ${e.version} 无严格校验面（需 ≥0.9）——升级应用 @tbox.cn/app-contracts 依赖后可用`}var L=K("config","integrations.json");function U(e,n){if(e===n)return!0;if(Array.isArray(e)&&Array.isArray(n))return e.length!==n.length?!1:e.every((r,t)=>U(r,n[t]));if(e&&n&&typeof e=="object"&&typeof n=="object"){let r=Object.keys(e),t=Object.keys(n);return r.length!==t.length?!1:r.every(a=>U(e[a],n[a]))}return!1}function ae(e,n){if(typeof e!="string"&&e&&typeof e=="object")for(let[r,t]of Object.entries(e)){if((r==="provider"||r==="instanceId")&&typeof t=="string"&&!F.test(t))throw new O("VALIDATION_FAILED",400,`${r} 名含非法字符（需 /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/）`,[`${n}.${r}`]);ae(t,`${n}.${r}`)}}function oe(e,n,r){if(!(!e||typeof e!="object"||Array.isArray(e))){for(let t of Object.keys(e))if(!(r&&(t==="*"||t==="**"))&&!F.test(t))throw new O("VALIDATION_FAILED",400,`${n} 键 ${t} 含非法字符（需 /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/）——进凭据 stem 派生，防路径逃逸`,[n])}}function an(e,n,r){if(r==="root"){let t=e.instances;Array.isArray(t)&&t.forEach((a,i)=>{let o=a&&typeof a=="object"?a.id:void 0;if(typeof o=="string"&&!F.test(o))throw new O("VALIDATION_FAILED",400,`instances[${i}].id 含非法字符（需 /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/）`,[`root.instances[${i}].id`])}),oe(e.configByInstance,"root.configByInstance",!1),oe(e.credentialRefByInstance,"root.credentialRefByInstance",!1)}else oe(e.instances,"services.instances",!0);oe(n.credentialsByInstance,"credentialsByInstance",!1)}function se(e,n){let r=K(e,L),t=a=>JSON.parse(a);if(n)return n.read(r,t)??null;if(!ln(r))return null;try{return t(dn(r,"utf8"))}catch{return null}}function he(e){let n=(e.instances??[]).map(r=>r.id);return n.length===0?[]:pe(e,n)}function at(e,n,r,t){let{catalog:a}=P(e,t),i=a.providers[n];if(!i)return;let o=new Set;for(let g of Object.values(i))(r===void 0||g.services.includes(r))&&o.add(g.credentialType);return o.size===1?[...o][0]:void 0}function cn(e,n,r,t,a,i){let o=a??at(e,n,r,i);if(o!==void 0&&o!=="-"&&t.type!==o)throw new O("VALIDATION_FAILED",400,`凭据 type=${t.type} 与绑定 credentialType ${o} 不一致`,["credentials.type"]);if(r===void 0)return;let{serviceSchemas:g}=P(e,i),d=g[`${n}\0${r}`];if(!d?.credentialSchema)return;let p=ot(d.packageDir,d.credentialSchema);if(ln(p))try{let v=new st({allErrors:!0}).compile(JSON.parse(dn(p,"utf8")));if(!v({type:t.type,...t.values})){let f=(v.errors??[]).map(u=>`credentials.values.${String(u.instancePath||u.params?.missingProperty||"").replace(/^\//,"")}`);throw new O("VALIDATION_FAILED",400,"凭据字段校验失败（ajv 字段级）",f)}}catch(m){if(m instanceof O)throw m}}function ke(e,n={}){let{onApplied:r,cache:t}=n;function a(d,p,m,v,f){let u=!v&&d!==null;u&&($(K(e,L),`${JSON.stringify(d,null,2)}
-`),t?.invalidate([K(e,L)]));let k=u||f,s=k&&r!==void 0;s&&r?.();let l=[];return u&&l.push(L),f&&l.push(...p.map(h=>`config/credentials/${h.stem}.json`)),{written:k,restartScheduled:s,files:l,credentials:p,issues:m}}let i;async function o(){i=await M(e)}function g(d,p){let m=i;if(!m||!m.strictValidation||!m.module.parseIntegrationsConfig)throw new O("CONTRACTS_NOT_RESOLVED",503,"contracts 严格校验面不可用（需 ≥0.9）——写路径门控失败（工厂边缘断言应先行拦截）");m.module.parseIntegrationsConfig(d)}return{warmup:o,moduleDomainKey(d){let{modules:p}=P(e,t),m=p.find(u=>u.id===d);if(!m)return;let v=m.descriptor.contributes.services??[],f=new Set(v.map(u=>u.service.includes(".")?u.service.slice(0,u.service.indexOf(".")):u.service));return f.size===1?[...f][0]:d},applyApp(d,p={}){ae(d,"root"),an(d,p,"root");let m=[],v=se(e,t),f=v??{services:{}};v===null&&m.push({severity:"warning",code:"SKELETON_MATERIALIZED",message:"config/integrations.json 缺席——已物化骨架（写时自动初始化；R13 语义翻转提示）"});let u={...f};for(let w of H)w in d||delete u[w];for(let[w,c]of Object.entries(d))u[w]=c;let k=typeof u.provider=="string"?u.provider:"app",s=on(k,p.credentials,p.credentialsByInstance);for(let w of s)cn(e,k,void 0,w.input,void 0,t);let l=s.find(w=>w.instanceId===void 0);if(p.credentials&&l&&(u.credentialRef=l.ref),p.credentialsByInstance){let w={...u.credentialRefByInstance??{}};for(let c of s)c.instanceId!==void 0&&(w[c.instanceId]=c.ref);u.credentialRefByInstance=w}let h=p.credentials!==void 0||p.credentialsByInstance!==void 0,C=U(v,u);if(C&&!h)return{written:!1,restartScheduled:!1,files:[],credentials:[],issues:m};g(u,m);let j=p.dryRun===!0,R=Re(e,s,j);return m.push(...he(u)),a(C?null:u,R,m,p.dryRun,!j&&s.length>0)},applyModule(d,p,m={}){ae(p,"root");let v=[],f=se(e,t);if(f===null&&Object.keys(p).length===0)return{written:!1,restartScheduled:!1,files:[],credentials:[],issues:v};f===null&&v.push({severity:"warning",code:"SKELETON_MATERIALIZED",message:"config/integrations.json 缺席——已物化骨架（写时自动初始化；R13 语义翻转提示）"});let u=f??{services:{}},k=this.moduleDomainKey(d);if(k===void 0)throw new O("MODULE_NOT_FOUND",404,`模块 ${d} 非已装模块`);let s={...u.domains??{}},l={...u,domains:s};return Object.keys(p).length===0?delete s[k]:s[k]={...p},U(f,l)?{written:!1,restartScheduled:!1,files:[],credentials:[],issues:v}:(g(l,v),v.push(...he(l)),a(l,[],v,m.dryRun,!1))},applyService(d,p,m={}){ae(p,"root"),an(p,m,"slot");let v=[],f=se(e,t);f===null&&v.push({severity:"warning",code:"SKELETON_MATERIALIZED",message:"config/integrations.json 缺席——已物化骨架（写时自动初始化；R13 语义翻转提示）"});let u=f??{services:{}},k={...u.services??{}},s={...u,services:k};k[d]={...p};let l=p.provider,h=l!==null&&typeof l=="object"?l:void 0,C=typeof l=="string"?l:typeof h?.provider=="string"?h.provider:"app",j=d.includes(".")?d.slice(0,d.indexOf(".")):d,R=sn(C,d,j,m.credentials,m.credentialsByInstance);for(let x of R)cn(e,C,d,x.input,typeof h?.credentialType=="string"?h.credentialType:void 0,t);let w=k[d],c=R.find(x=>x.instanceId===void 0);if(m.credentials&&c&&(w.credentialRef=c.ref),m.credentialsByInstance){let x={...w.instances??{}};for(let E of R){if(E.instanceId===void 0)continue;let N={...x[E.instanceId]??{}};N.credentialRef=E.ref,x[E.instanceId]=N}w.instances=x}let S=m.credentials!==void 0||m.credentialsByInstance!==void 0,b=U(f,s);if(b&&!S)return{written:!1,restartScheduled:!1,files:[],credentials:[],issues:v};g(s,v);let I=m.dryRun===!0,A=Re(e,R,I);return v.push(...he(s)),a(b?null:s,A,v,m.dryRun,!I&&R.length>0)},deleteService(d){let p=[],m=se(e,t),v={...m?.services??{}};if(!(d in v))return{written:!1,restartScheduled:!1,files:[],credentials:[],issues:p};delete v[d];let f={...m??{services:{}},services:v};$(K(e,L),`${JSON.stringify(f,null,2)}
-`),t?.invalidate([K(e,L)]),p.push(...we(e));let u=r!==void 0;return u&&r?.(),{written:!0,restartScheduled:u,files:[L],credentials:[],issues:p}}}}import{existsSync as ct}from"fs";import{join as lt}from"path";function be(e){let n=lt(e,"config","integrations.json");if(ct(n))return{generated:!1,reason:"in-place",services:[]};let r=[];for(let i of P(e).modules)for(let o of i.descriptor.contributes.providers?.slots??[])o.local===!0&&r.push({service:o.service,provider:o.provider,implementation:o.implementation});if(r.length===0)return{generated:!1,reason:"no-local-slots",services:[]};let t={},a=new Set(r.map(i=>i.provider));if(a.size===1){let[i]=a;for(let o of r)t[o.service]={};$(n,`${JSON.stringify({provider:i,services:t},null,2)}
-`)}else{for(let i of r)t[i.service]={provider:i.provider,implementation:i.implementation};$(n,`${JSON.stringify({services:t},null,2)}
-`)}return{generated:!0,reason:"generated",services:r.map(i=>i.service).sort()}}function G(e){let n=e.indexOf(".");return n===-1?e:e.slice(0,n)}function un(e,n){let r=P(e.appDir,e.cache),t=z(e.appDir,e.cache);return{appDir:e.appDir,walk:r,catalog:r.catalog,integrations:t,contracts:n}}function pn(e){let n=new Set;for(let r of e.modules){for(let t of r.descriptor.contributes.services??[])n.add(t.service);for(let t of r.descriptor.contributes.providers?.slots??[])n.add(t.service)}return n}function fn(e,n,r){let t=e.providers[n];return t?Object.values(t).some(a=>a.services.includes(r)):!1}function gn(e,n){let r=[];for(let[t,a]of Object.entries(e.providers))Object.values(a).some(i=>i.services.includes(n))&&r.push(t);return r.sort()}function Ce(e){return{modules:e.walk.modules.map(r=>({id:r.id,name:r.descriptor.name,title:r.descriptor.name,description:""})).sort((r,t)=>r.id.localeCompare(t.id))}}function mn(e,n){let r=new Set(e.map(t=>G(t.service)));return r.size===1?[...r][0]:n}function Ae(e,n){let r=e.walk.modules.find(g=>g.id===n);if(!r)throw new O("MODULE_NOT_FOUND",404,`模块 ${n} 非已装模块`);let t=(r.descriptor.contributes.services??[]).map(g=>({service:g.service,...g.title?{title:g.title}:{},...g.description?{description:g.description}:{},required:g.optional!==!1})),a=e.integrations?.domains??{},i=mn(t,n);return{integration:a[i]??null,services:t}}function xe(e){let n=pn(e.walk),r=e.walk.vocabulary.filter(i=>!n.has(i)),t=e.integrations,a=null;if(t){let i={};for(let o of H)o in t&&(i[o]=t[o]);a=i}return{services:r,integration:a}}function Ee(e,n){let r=e.integrations?.services??{},t=e.catalog.services[n],a=e.walk.vocabulary.includes(n),i=n in r;if(!a&&!i)throw new O("SERVICE_NOT_FOUND",404,`服务 ${n} 不在服务词汇（已装契约包 ∪ 已配置）`);let o=r[n]??null;return{service:n,...t?.title?{title:t.title}:{title:n},...t?.description?{description:t.description}:{},required:t?!t.optional:!1,defaults:t?t.defaults.map(g=>({...g})):[],integration:o,suppliedBy:gn(e.catalog,n)}}import{existsSync as Rn,readFileSync as wn,realpathSync as vn}from"fs";import{isAbsolute as dt,join as ut,relative as pt,resolve as yn,sep as ft}from"path";function Me(e){let n=[];for(let[r,t]of Object.entries(e.catalog.providers)){let a=Object.values(t);a.length!==0&&n.push({provider:r,local:a.every(i=>i.local===!0),owner:a[0].owner})}return{providers:n.sort((r,t)=>r.provider.localeCompare(t.provider))}}function Oe(e,n){let r=e.catalog.providers[n];if(!r)throw new O("PROVIDER_NOT_FOUND",404,`厂商 ${n} 不 ∈ catalog（内联声明厂商无包级档案——身份与表单经组合端点暴露）`);let t={};for(let i of Object.values(r))for(let o of i.services)(t[o]??={implementations:[]}).implementations.push({implementation:i.implementation,credentialType:i.credentialType});let a=Object.values(r);return{provider:n,local:a.every(i=>i.local===!0),owner:a[0].owner,services:t}}function je(e,n,r){let t=e.catalog.providers[n],a=e.integrations?.services??{},i=[];if(t)for(let v of Object.values(t))v.services.includes(r)&&i.push({implementation:v.implementation,credentialType:v.credentialType});let o=a[r]?.provider,g=o&&typeof o=="object"&&o.provider===n?o:void 0;if(i.length===0&&!g)throw t?new O("SUPPLY_NOT_FOUND",404,`厂商 ${n} 未供给服务 ${r}（AI 帮我实现流：PUT 显式绑定后实施）`):new O("PROVIDER_NOT_FOUND",404,`厂商 ${n} 完全未知（不 ∈ catalog 且无任何内联声明）`);i.length===0&&g&&i.push({implementation:a[r]?.implementation??`${n}-inline@1`,credentialType:g.credentialType});let d=null,p=null,m=P(e.appDir).serviceSchemas[`${n}\0${r}`];if(m)d=Sn(e.appDir,m.packageDir,m.configSchema),p=Sn(e.appDir,m.packageDir,m.credentialSchema);else if(g){let v=o?.configSchema;typeof v=="string"&&(d=gt(e.appDir,v))}return{provider:n,service:r,implementations:i,integrationSchemas:{configSchema:d,credentialSchema:p}}}function Sn(e,n,r){if(!r)return null;let t=ut(n,r);if(!Rn(t))return null;try{return JSON.parse(wn(t,"utf8"))}catch{return null}}function gt(e,n){let r=yn(e,"config","schemas"),t=yn(e,n),a=pt(r,t);if(a===""||a.startsWith("..")||dt(a))throw new O("VALIDATION_FAILED",400,"configSchema 引用必须落在 config/schemas/ 内（禁路径逃逸）",["provider.configSchema"]);if(!Rn(t))return null;let i,o;try{i=vn(r),o=vn(t)}catch{return null}if(o!==i&&!o.startsWith(i+ft))throw new O("VALIDATION_FAILED",400,"configSchema 引用经 symlink 逃逸出 config/schemas/（realpath 复核拒绝）",["provider.configSchema"]);try{return JSON.parse(wn(t,"utf8"))}catch{return null}}function In(e){return{version:e.version,evaluation:e.evaluation,strictValidation:e.strictValidation,notes:[...e.notes]}}function mt(e,n,r){let t=e.integrations,a=G(n),i=t?.services?.[n],o=i?.instances?.[r]??i?.instances?.["*"];return o&&o.provider!==void 0?"instance":i?.provider!==void 0?"service":t?.domains?.[a]?.provider!==void 0?"module":"app"}function vt(e,n){if(n===void 0||!n.startsWith("secret://"))return;let r=n.slice(9),t=Y(e,r);if(t)return{type:t.type,ref:n,file:_(r),masked:q(t.values)}}function hn(e,n,r,t,a){let i=n.resolveEffectiveService(e.integrations,r,t,a);if(i.status==="ok"&&i.effective){let o=i.effective.provider,g=typeof o=="string"?o:String(o?.provider??"");return{status:"ok",provider:g,implementation:i.effective.implementation,effective:{provider:g,implementation:i.effective.implementation,...i.effective.config!==void 0?{config:{...i.effective.config}}:{},...i.effective.credentialRef!==void 0?{credentialRef:i.effective.credentialRef}:{},layer:mt(e,r,t)}}}return i.status==="binding-unresolved"?{status:"binding-unresolved",statusMessage:i.message}:{status:i.status}}function Te(e){let n=e.contracts.module;if(!n.resolveEffectiveService||!n.normalizeInstances)throw new Error("contracts 求值面缺席（工厂门控应先行拦截）");return n}function Ne(e,n){let r=Te(n),{integrations:t,catalog:a}=n,i=r.buildSupplyLookup(a),o=t,d=r.normalizeInstances({instances:o?.instances,defaultInstanceId:o?.defaultInstanceId}).defaultInstanceId??"*",p=hn(n,r,e,d,i),m=n.integrations?.services?.[e]?.provider,v=p.provider??(typeof m=="string"?m:typeof m=="object"&&m?String(m.provider):void 0),f=new Set(Object.keys(n.catalog.providers)),u=v!==void 0&&f.has(v)?yt(n.catalog,v,e):void 0,k=a.services[e],s=k!==void 0?!k.optional:void 0,l=k?.owners[0];return{status:p.status,...p.statusMessage?{statusMessage:p.statusMessage}:{},...v!==void 0?{provider:v}:{},...u!==void 0?{supplied:u}:{},...l!==void 0?{module:l}:{},...s!==void 0?{required:s}:{}}}function yt(e,n,r){return fn(e,n,r)}function Pe(e,n,r){let t=new Set([...e.walk.vocabulary,...Object.keys(e.catalog.services)]),a=e.integrations?.services??{};for(let o of Object.keys(a))t.add(o);let i={};for(let o of[...t].sort())r&&!r.includes(o)||(i[o]=Ne(o,e));return{contracts:In(e.contracts),resolutions:i,issues:n}}function De(e,n,r){let t=Te(n),a=t.buildSupplyLookup(n.catalog),i=n.integrations,g=t.normalizeInstances({instances:i?.instances,defaultInstanceId:i?.defaultInstanceId}).instances.map(s=>s.id),d=n.integrations?.services?.[e],p=d?.instances?Object.keys(d.instances):void 0,m;g.length>0?(m=[...g],p?.includes("*")&&m.push("*")):p!==void 0&&p.length>0?m=p.includes("*")?["*"]:p:m=[];let v=m.map(s=>{let l=hn(n,t,e,s,a),h=vt(n.appDir,l.effective?.credentialRef);return{instanceId:s,status:l.status,...l.statusMessage?{statusMessage:l.statusMessage}:{},...l.effective?{effective:l.effective}:{},...h?{credential:h}:{}}}),f=St(n,e),k={...Ne(e,n),instances:v,inheritance:f};return{contracts:In(n.contracts),resolution:k,issues:r.filter(s=>s.service===e)}}function St(e,n){let r=e.integrations,t=G(n),a=r?.services?.[n],i=e.integrations,g=Te(e).normalizeInstances({instances:i?.instances,defaultInstanceId:i?.defaultInstanceId}).defaultInstanceId??"*",d=a?.instances?.[g]??a?.instances?.["*"];return[{layer:"app",...r?.provider?{provider:r.provider}:{}},{layer:"module",...r?.domains?.[t]?.provider?{provider:r.domains[t].provider}:{}},{layer:"service",...typeof a?.provider=="string"?{provider:a.provider}:{},...a?.implementation?{implementation:a.implementation}:{}},{layer:"instance",...d?.provider?{provider:d.provider}:{},...d?.implementation?{implementation:d.implementation}:{}}]}import Rt from"path";function wt(e,n={}){let r=ce(),t=Promise.resolve(),a={appDir:e,cache:r};function i(s){if(!s.strictValidation)throw new O("CONTRACTS_NOT_RESOLVED",503,Ie(s))}function o(s){return un(a,s)}async function g(){let s=await M(e),l=o(s),h=l.integrations;if(h===null)return[];let C={resolveEffectiveService:d(s.module.resolveEffectiveService,"resolveEffectiveService"),buildSupplyLookup:d(s.module.buildSupplyLookup,"buildSupplyLookup"),moduleDomainOf:d(s.module.moduleDomainOf,"moduleDomainOf"),normalizeInstances:d(s.module.normalizeInstances,"normalizeInstances"),RESOURCE_TYPE_IDS:s.module.RESOURCE_TYPE_IDS??[]},j=ge(e,l.walk,h,process.env);return X({contracts:C,integrations:h,supplies:C.buildSupplyLookup(l.catalog),...j})}function d(s,l){if(typeof s!="function")throw new O("CONTRACTS_NOT_RESOLVED",503,`contracts 求值面 ${l} 缺席（形态异常）`);return s}function p(s){let l=t.then(s,s);return t=l.catch(()=>{}),l}let m={async loadModules(){let s=await M(e);return Ce(o(s))},async loadModule(s){let l=await M(e);return Ae(o(l),s)},async loadApp(){let s=await M(e);return xe(o(s))},async loadService(s){let l=await M(e);return Ee(o(l),s)},async loadServiceResolutions(s){let l=await M(e);i(l);let h=await g();return Pe(o(l),h,s)},async loadServiceResolution(s){let l=await M(e);i(l);let h=await g();return De(s,o(l),h)},async loadProviders(){let s=await M(e);return Me(o(s))},async loadProvider(s){let l=await M(e);return Oe(o(l),s)},async loadProviderService(s,l){let h=await M(e);return je(o(h),s,l)}},v=ke(e,{onApplied:n.onApplied,cache:r}),f={async writeAppIntegration(s,l){await v.warmup();let h=await M(e);return i(h),p(()=>v.applyApp(s,l))},async writeModuleIntegration(s,l,h){await v.warmup();let C=await M(e);return i(C),p(()=>v.applyModule(s,l,h))},async writeServiceIntegration(s,l,h){await v.warmup();let C=await M(e);return i(C),p(()=>v.applyService(s,l,h))},async deleteServiceIntegration(s){await v.warmup();let l=await M(e);return i(l),p(()=>v.deleteService(s))}},u={invalidate(){r.invalidate(),le(e)},async resolveContracts(){return M(e)},walkManifests(){return k(e)},parseModuleDescriptor(s){return J(s)},loadProviderCatalogRaw(){return ye(e)},async readIntegrationsConfig(){return z(e,r)},async writeIntegrationsConfig(s){await v.warmup();let l=await M(e);return i(l),p(()=>It(e,s,r))},async ensureMockBindings(){await v.warmup();let s=await M(e);return i(s),p(()=>be(e))},async evaluateIntegrationServices(s){await v.warmup();let l=await M(e);i(l);let h={resolveEffectiveService:d(l.module.resolveEffectiveService,"resolveEffectiveService"),buildSupplyLookup:d(l.module.buildSupplyLookup,"buildSupplyLookup"),moduleDomainOf:d(l.module.moduleDomainOf,"moduleDomainOf"),normalizeInstances:d(l.module.normalizeInstances,"normalizeInstances"),RESOURCE_TYPE_IDS:l.module.RESOURCE_TYPE_IDS??[]};return X({...s,contracts:h})}};function k(s){return P(s,r)}return{...m,...f,...u}}function It(e,n,r){let t=Rt.join(e,"config","integrations.json");$(t,`${JSON.stringify(n,null,2)}
-`),r.invalidate([t])}export{H as APP_INTEGRATION_NODE_KEYS,O as AppToolkitError,F as SAFE_NAME_PATTERN,Yn as assertValidModuleId,ge as buildPredicateAssembly,pe as checkInstanceKeys,Qn as collectDeclaredModules,Ie as contractsNotResolvedMessage,wt as createAppToolkit,ce as createFileCache,ke as createWriteCore,it as credentialArtifactExists,U as deepEqual,W as deriveStem,Ue as ensureDir,be as ensureMockBindings,X as evaluateIntegrationServices,An as expandEnvVars,en as extractModuleIdFromSource,le as invalidateContractsResolver,ue as isControlledInlineProvider,Qe as isValidModuleId,xe as loadAppView,Ae as loadModuleDetailView,Ce as loadModulesView,nn as loadProviderCatalog,ye as loadProviderCatalogRaw,Oe as loadProviderDetailView,je as loadProviderServiceDetailView,Me as loadProvidersView,Ee as loadServiceDetailView,De as loadServiceResolutionDetail,Pe as loadServiceResolutionsView,ne as manifestPath,q as maskCredentialValues,_e as moduleDependencySchema,Be as moduleDescriptorSchema,mn as moduleDomainKeyOf,Ve as pageContribSchema,J as parseModuleDescriptor,Fe as providerSlotContribSchema,qe as readAppManifest,me as readAppManifestFull,Y as readCredentialFile,z as readIntegrationsConfig,rn as readIntegrationsStrict,we as reconcileOrphanCredentials,Ze as refToEnvKey,Kn as removeNpmModule,M as resolveContractsForApp,M as resolveContractsForAppExport,Ne as resolveServiceSummary,We as resourceNeedContribSchema,Le as serviceNeedContribSchema,_ as stemToFilePath,jn as stemToRef,$e as tabContribSchema,Jn as updateNpmModule,Un as upsertMiniappContainer,zn as upsertNpmModule,P as walkManifests,Bn as writeAppManifest,$ as writeAtomic,de as writeCredentialFile};
+import{a as Se,b as M,c as we}from"./chunk-KPD3LUH4.js";import{z as h}from"zod";var W=/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/,zn=h.object({cardType:h.string(),schemaVersion:h.number().optional()}),Ge=h.object({route:h.string(),component:h.string()}),Qe=h.object({route:h.string(),label:h.string().optional(),icon:h.string().optional(),order:h.number().optional()}),Xe=h.object({id:h.string(),range:h.string().optional(),required:h.boolean().default(!0)}),en=h.object({service:h.string(),provider:h.string().regex(W,"provider 名含非法字符（需 /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/）"),implementation:h.string(),credentialType:h.string(),local:h.boolean().optional(),configSchema:h.string().optional(),credentialSchema:h.string().optional()}),nn=h.object({service:h.string(),optional:h.boolean().default(!0),defaults:h.array(h.object({provider:h.string().regex(W,"provider 名含非法字符（需 /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/）"),implementation:h.string()})).default([]),title:h.string().optional(),description:h.string().optional()}),tn=h.object({id:h.string(),type:h.string()}),rn=h.object({schemaVersion:h.number().default(1),name:h.string(),version:h.string().default("0.0.0"),kind:h.enum(["platform","business","third-party"]).default("business"),risk:h.object({level:h.enum(["high","medium","low"]).default("low"),writeBoundary:h.enum(["sdk-enforced","source"]).default("source")}).default({}),distribution:h.object({defaultMode:h.enum(["hybrid","sdk","codegen","local"]).default("codegen")}).default({}),contributes:h.object({handlers:h.array(h.string()).default([]),tools:h.array(h.string()).default([]),cards:h.array(zn).default([]),routes:h.array(h.string()).default([]),pages:h.array(Ge).default([]),tabs:h.array(Qe).default([]),providers:h.object({slots:h.array(en).default([])}).default({}),services:h.array(nn).default([]),resources:h.array(tn).default([])}).default({}),dependencies:h.object({modules:h.array(Xe).default([])}).default({}),env:h.array(h.string()).default([])}).strict();function G(e){let n=rn.safeParse(e);return n.success?{ok:!0,value:n.data}:{ok:!1,errors:n.error.issues.map(r=>`${r.path.join(".")||"(root)"}: ${r.message}`)}}var Un=/\$\$?\{([A-Z][A-Z0-9_]*)\}/g;function Jn(e){return JSON.stringify(e).slice(1,-1)}function Yn(e,n=process.env){let r=[],t=e.replace(Un,(i,o)=>{if(i.startsWith("$$"))return i.slice(1);let s=n[o];return s===void 0?(r.push(o),i):Jn(s)});return r.length>0?{missing:r}:{text:t,missing:[]}}import{mkdirSync as Hn,existsSync as on,readFileSync as Zn,writeFileSync as qn}from"fs";import{dirname as Gn,join as sn}from"path";function oe(e){let n={};for(let[r,t]of Object.entries(e)){if(typeof t!="string"){n[r]=null;continue}n[r]=t.length<=4?"****":`${t.slice(0,2)}****`}return n}var A=class extends Error{code;httpStatus;fields;constructor(n,r,t,i){super(t),this.name="AppToolkitError",this.code=n,this.httpStatus=r,this.fields=i}};function he(e){return e.notes.length>0?e.notes[0]:e.version===null?"contracts 不可解析（未安装）——检查应用依赖安装后重试":e.strictValidation?"contracts workspace 源码态未构建——执行 pnpm --filter @tbox.cn/app-contracts build 后重试":`contracts ${e.version} 无严格校验面（需 ≥0.9.0）——升级应用 @tbox.cn/app-contracts 依赖后可用`}function se(e,n){if(n!==void 0&&(n.includes("/")||n.includes("\\")||n.includes("..")))throw new A("VALIDATION_FAILED",400,`凭据 stem 派生输入含路径敌对字符（${e}）——拒绝派生`)}function z(e){if(se("provider",e.provider),se("service",e.service),se("instanceId",e.instanceId),se("domain",e.domain),e.instanceId!==void 0){let n=e.domain??e.service??"global";return`${e.provider}-${e.instanceId}-${n}`}return e.service!==void 0?`${e.provider}-${e.service}`:`${e.provider}-global`}function Qn(e){return`secret://${e}`}function D(e){return`config/credentials/${e}.json`}function Q(e,n){let r=sn(e,D(n));if(!on(r))return null;try{let t=JSON.parse(Zn(r,"utf8"));if(typeof t.type!="string")return null;let{type:i,...o}=t,s={};for(let[f,u]of Object.entries(o))typeof u=="string"&&(s[f]=u);return{type:i,values:s}}catch{return null}}function Re(e,n,r){let t=sn(e,D(n)),i=on(t);return Hn(Gn(t),{recursive:!0}),qn(t,`${JSON.stringify({type:r.type,...r.values},null,2)}
+`,"utf8"),i}import{mkdirSync as Xn,renameSync as et,writeFileSync as nt}from"fs";import{dirname as tt}from"path";function _(e,n){an(tt(e));let r=`${e}.tmp-${process.pid}-${Date.now()}`;nt(r,n,"utf8"),et(r,e)}function an(e){Xn(e,{recursive:!0})}function L(e){let n=e.indexOf(".");return n===-1?e:e.slice(0,n)}function F(e,n){let r=e?.domains?.[n]?.provider;if(typeof r=="string"&&r.length>0)return{provider:r,layer:"module"};let t=e?.provider;return typeof t=="string"&&t.length>0?{provider:t,layer:"app"}:{provider:null,layer:null}}function U(e,n){let r=[...new Set((n.descriptor.contributes.services??[]).map(o=>L(o.service)))].sort();if(r.length===0)return{writable:!1,reason:"zero-domain",domainKeys:[]};if(r.length>1)return{writable:!1,reason:"multi-domain",domainKeys:r};let t=r[0],i=new Set;for(let[o,s]of Object.entries(e.catalog.services))if(L(o)===t)for(let f of s.owners)i.add(f);return i.size>1?{writable:!1,reason:"shared-key",domainKeys:[t],domainKey:t,coOwners:[...i].sort()}:{writable:!0,domainKeys:[t],domainKey:t}}function cn(e,n){let r=e.find(t=>t.pkg===n||`@app/${t.id}`===n);return r?r.id:n.startsWith("@app/")?n.slice(5):n}function ln(e,n){return[...new Set(Object.values(e.providers[n]??{}).flatMap(r=>r.services))].sort()}function ee(e){if(!e||typeof e!="object")return!1;let n=Object.keys(e),r=new Set(["provider","credentialType","configSchema"]);if(!n.every(i=>r.has(i)))return!1;let t=e;return typeof t.provider=="string"&&t.provider.length>0&&typeof t.credentialType=="string"&&t.credentialType.length>0&&(t.configSchema===void 0||typeof t.configSchema=="string")}function dn(e,n,r){return e==="*"||r.has(e)?null:{severity:"error",code:"INSTANCE_KEY_NOT_REGISTERED",instance:e,message:`integrations: ${n} 键 ${e} 不在 malls 白名单内（${[...r].join(", ")}）`}}function Ie(e,n){let r=new Set(n),t=[],i=(o,s)=>{let f=dn(o,s,r);f&&t.push(f)};for(let o of Object.keys(e.configByInstance??{}))i(o,"configByInstance");for(let o of Object.keys(e.credentialRefByInstance??{}))i(o,"credentialRefByInstance");for(let[o,s]of Object.entries(e.services??{}))for(let f of Object.keys(s.instances??{}))i(f,`services.${o}.instances`);return t}function ae(e){let n=[],r=e.contracts,{integrations:t,suppliedProviders:i,demandedServices:o,supplies:s,malls:f,credentialSchemaMissing:u,vendorConfigKeys:p,vendorConfigSchemaMissing:v,credentialFileMissing:S,credentialFileType:d,realmSwitchHints:y,moduleResourceNeeds:R}=e,a=f?new Set(f):void 0;for(let c of y??[])n.push({severity:"warning",code:"REALM_SWITCH_HINT",message:c});let l=new Set(Object.keys(i).map(c=>c.slice(0,c.indexOf("\0"))).filter(c=>c.length>0)),g=(c,w,x,k)=>{if(typeof x?.provider=="string"&&typeof x.implementation=="string"&&x.provider&&x.implementation)return i[X(x.provider,x.implementation)]?.credentialType;if(typeof w.provider=="string"&&typeof w.implementation=="string")return i[X(w.provider,w.implementation)]?.credentialType;let E=w.provider?.credentialType;if(typeof E=="string")return E;if(!s)return;let T=k??Object.keys(w.instances??{})[0]??"",O=r.resolveEffectiveService(t,c,T,s);if(!(O.status!=="ok"||typeof O.effective.provider!="string"))return i[X(O.effective.provider,O.effective.implementation)]?.credentialType};if(S||d)for(let[c,w]of Object.entries(t.services))for(let[x,k]of Object.entries(w.instances??{})){if(k.enabled===!1)continue;let E=k.credentialRef??w.credentialRef??t.credentialRefByInstance?.[x]??t.credentialRef;if(typeof E!="string"||!E.startsWith("secret://"))continue;let T=E.slice(9);S?.[T]===!0&&n.push({severity:"error",code:"CREDENTIAL_FILE_MISSING",service:c,instance:x,message:`integrations: 凭据文件缺失 ${T}（${c}@${x} effective ref=${E}；档内 config/credentials/ 无此文件）`});let O=d?.[T];if(O){let P=g(c,w,k,x);P&&O!==P&&n.push({severity:"error",code:"CREDENTIAL_TYPE_MISMATCH",service:c,instance:x,message:`integrations: 凭据文件 ${T}.json type=${O} 与绑定 credentialType ${P} 不一致（${c}@${x}——transport 创建期将按 type 选策略）`})}}let b=(c,w)=>{if(!a)return;let x=dn(c,w,a);x&&n.push(x)};for(let[c]of Object.entries(t.configByInstance??{}))b(c,"configByInstance");for(let[c]of Object.entries(t.credentialRefByInstance??{}))b(c,"credentialRefByInstance");let C=Object.entries(t.services).filter(([,c])=>c.instances==null||c.instances["*"]!=null).map(([c])=>c);if(C.length>0){let c=Object.entries(t.services).filter(([,w])=>w.instances!=null&&w.instances["*"]==null).map(([w])=>w);c.length>0&&n.push({severity:"warning",code:"WILDCARD_ALIGNMENT",message:`integrations: 激活形态不对称（通配：${C.join(", ")}；显式键集：${c.join(", ")}）——动态 mallId 将在显式键集槽上 INSTANCE_NOT_FOUND（provider 业务限制表达位），确认是否齐步`})}let m=r.normalizeInstances({instances:t.instances,defaultInstanceId:t.defaultInstanceId});m.instances.length>=2&&m.defaultInstanceId===null&&n.push({severity:"warning",code:"MULTI_INSTANCE_NO_DEFAULT",message:`integrations: ${m.instances.length} 个部署实例（${m.instances.map(c=>c.id).join(", ")}）均无 defaultInstanceId——无 scope 参数访问将落全局会话（默认商圈不注入）`});for(let[c,w]of Object.entries(t.services)){if(o[c]||n.push({severity:"warning",code:"SLOT_NOT_DECLARED",service:c,message:`integrations: 服务槽 ${c} 无消费方声明（拼写错误或需求方未安装）——若为拆分前旧槽位词汇（member.main/parking.main/promotion.read/shopping-guide.main），参照 cookbook·app-config 槽位迁移配方展开为新槽`}),typeof w.provider=="string"?typeof w.implementation=="string"&&!i[X(w.provider,w.implementation)]&&n.push({severity:"error",code:"INSTANCE_SUPPLY_UNMATCHED",service:c,message:`integrations: provider ${w.provider}/${w.implementation} 未命中已装供给（${c} 槽级）——装对应 provider 包或改绑`}):w.provider!==void 0&&!ee(w.provider)&&n.push({severity:"error",code:"INLINE_PROVIDER_INVALID",service:c,message:`integrations: 内联 provider 超受控形状（${c} 槽级；允许键 provider/credentialType/configSchema）`}),u){let k=g(c,w);k&&u[k]===!0&&n.push({severity:"error",code:"SCHEMA_FILE_MISSING",service:c,message:`integrations: credentialType ${k} 的 schema 引用不存在（${c}；manifest 声明指向缺失文件）`})}typeof w.provider=="object"&&typeof w.implementation!="string"&&n.push({severity:"error",code:"IMPL_WITHOUT_PROVIDER",service:c,message:`integrations: 内联厂商声明必须同时提供 implementation（${c} 槽级）`});for(let[k,E]of Object.entries(w.instances??{})){b(k,`services.${c}.instances`);let T=E.provider!==void 0,O=E.implementation!==void 0;if(O&&!T&&n.push({severity:"error",code:"IMPL_WITHOUT_PROVIDER",service:c,instance:k,message:`integrations: 实例级 implementation 需伴随 provider（${c}@${k}——impl-only 禁止，provider 是绑定组头）`}),T&&O){let P=E.provider,V=E.implementation;typeof P=="string"&&typeof V=="string"?i[X(P,V)]||n.push({severity:"error",code:"INSTANCE_SUPPLY_UNMATCHED",service:c,instance:k,message:`integrations: 实例级 provider 覆盖 ${P}/${V} 未命中已装供给（${c}@${k}）`}):ee(P)||n.push({severity:"error",code:"INLINE_PROVIDER_INVALID",service:c,instance:k,message:`integrations: 实例级内联 provider 超受控形状（${c}@${k}）`})}}}for(let[c,w]of[["root",t.provider],...Object.entries(t.domains??{}).map(([x,k])=>[`domains.${x}`,k?.provider])])typeof w!="string"||w.length===0||l.has(w)||n.push({severity:"error",code:"VENDOR_NOT_INSTALLED",module:c.startsWith("domains.")?c.slice(8):void 0,message:`integrations: ${c} provider ${w} 未命中已装供给——装对应 provider 包或 provider use 改绑`});if(s)for(let[c,w]of Object.entries(t.services)){let x=w.instances?Object.keys(w.instances):[""];for(let k of x){let E=r.resolveEffectiveService(t,c,k,s);E.status==="binding-unresolved"&&n.push({severity:"error",code:"BINDING_UNRESOLVED",service:c,instance:k||void 0,message:`integrations: ${E.message}`})}}for(let[c,w]of Object.entries(t.services))w.implementation!==void 0&&w.provider===void 0&&n.push({severity:"error",code:"IMPL_WITHOUT_PROVIDER",service:c,message:`integrations: 槽级 implementation 需伴随 provider（${c}——impl-only 禁止，provider 是绑定组头）`});let I=new Set([...Object.keys(t.services).map(c=>r.moduleDomainOf(c)),...Object.keys(o).map(c=>r.moduleDomainOf(c))]);for(let c of Object.keys(t.domains??{}))I.has(c)||n.push({severity:"warning",code:"DOMAIN_KEY_UNMATCHED",module:c,message:`integrations: domains.${c} 无对应槽位或需求声明（域前缀拼写错误？——键 = 槽位 id 点分前缀）`});if(p){let c=new Set,w=!1,x=k=>{typeof k!="string"||k.length===0||(p[k]&&c.add(k),!p[k]&&!v?.[k]&&(w=!0),v?.[k]&&(w=!0))};x(t.provider);for(let k of Object.values(t.domains??{}))x(k?.provider);for(let k of Object.values(t.services)){let E=k.provider;x(typeof k.provider=="string"?k.provider:E?.provider)}if(c.size>0&&!w){let k=new Set;for(let T of c)for(let O of p[T]??[])k.add(O);let E=(T,O,P)=>{for(let[V]of Object.entries(T??{}))(P??k).has(V)||n.push({severity:"error",code:"DOMAIN_CONFIG_INVALID",message:`integrations: ${O} 键 ${V} 不在引用厂商（${[...c].join("/")}）任何槽 schema properties 内（死配置）`})};E(t.config,"root.config");for(let[T,O]of Object.entries(t.configByInstance??{}))E(O,`root.configByInstance[${T}]`);for(let[T,O]of Object.entries(t.domains??{})){if(!O?.config)continue;let P=F(t,T).provider??void 0;if(P===void 0){E(O.config,`domains.${T}.config`);continue}let V=p[P];!V||v?.[P]||E(O.config,`domains.${T}.config`,new Set(V))}}}for(let[c,w]of Object.entries(o)){let x=t.services[c];if(!x){n.push({severity:"warning",code:"SLOT_NOT_CONFIGURED",service:c,message:`integrations: 服务槽 ${c}（需求方 ${w.owners.join(", ")}）未配置${w.optional?"（可选槽）":"（必需槽——模块将走降级链）"}`});continue}let k=Object.entries(x.instances??{}).filter(([,E])=>E.enabled===!1).map(([E])=>E);k.length>0&&n.push({severity:"warning",code:"INSTANCE_DISABLED",service:c,instance:k.join(", "),message:`integrations: ${c} 实例禁用（${k.join(", ")}）`})}for(let[c,w]of Object.entries(t.modules??{})){let x=R?.[c];R&&!(c in R)&&n.push({severity:"warning",code:"RESOURCE_NOT_DECLARED",module:c,message:`integrations: modules.${c} 未命中已装模块（键 = install id——检查 .tbox/app.json entry.id / packages/ 目录名）`});for(let[k,E]of Object.entries(w?.resources??{})){let T=E?.type;(typeof T!="string"||!r.RESOURCE_TYPE_IDS.includes(T))&&n.push({severity:"error",code:"RESOURCE_TYPE_UNKNOWN",module:c,message:`integrations: modules.${c}.resources.${k} type 非法（${String(T)}；词汇表 = ${r.RESOURCE_TYPE_IDS.join("/")}）`}),x&&x.size>0&&!x.has(k)&&n.push({severity:"warning",code:"RESOURCE_NOT_DECLARED",module:c,message:`integrations: modules.${c}.resources.${k} 未被模块 manifest contributes.resources 声明`})}}return n}function X(e,n){return`${e}\0${n}`}import{existsSync as ke,readFileSync as rt,readdirSync as it}from"fs";import{join as ce}from"path";function pn(e){return e.replaceAll("-","_").toUpperCase()}function un(e){if(!ke(e))return null;try{let n=JSON.parse(rt(e,"utf8"));return n&&typeof n=="object"?n:null}catch{return null}}function ot(e){let n=new Set,r=e.properties;if(r&&typeof r=="object"&&!Array.isArray(r))for(let t of Object.keys(r))n.add(t);return n}function be(e,n,r,t=process.env){let i={};for(let[m,I]of Object.entries(n.catalog.providers))for(let[c,w]of Object.entries(I))i[`${m}\0${c}`]={services:[...w.services],owner:w.owner,credentialType:w.credentialType};let o={};for(let[m,I]of Object.entries(n.catalog.services))o[m]={optional:I.optional,owners:[...I.owners]};let s={},f={},u={},p={};for(let m of n.modules){p[m.id]=new Set((m.descriptor.contributes.resources??[]).map(I=>I.id));for(let I of m.descriptor.contributes.providers?.slots??[]){if(I.configSchema){let c=un(ce(m.dir,I.configSchema));if(c){let w=s[I.provider]??=new Set;for(let x of ot(c))w.add(x)}else f[I.provider]=!0}I.credentialSchema&&!ke(ce(m.dir,I.credentialSchema))&&(u[I.credentialType]=!0)}}let v={},S=new Set,d=ce(e,"config","credentials");if(ke(d))for(let m of it(d)){if(!m.endsWith(".json"))continue;let I=m.slice(0,-5);S.add(I);let c=un(ce(d,m));c&&typeof c.type=="string"&&(v[I]=c.type)}let y=r,R=[],a=m=>{typeof m=="string"&&m.startsWith("secret://")&&R.push(m)};for(let m of Object.values(y.services??{}))if(m&&typeof m=="object"){a(m.credentialRef);for(let I of Object.values(m.instances??{}))I&&typeof I=="object"&&a(I.credentialRef)}for(let m of Object.values(y.credentialRefByInstance??{}))a(m);a(y.credentialRef);let l={};for(let m of R){let I=m.slice(9);t[pn(I)]===void 0&&(S.has(I)||(l[I]=!0))}let g=[];for(let[m,I]of Object.entries(y.services??{})){let c=I&&typeof I=="object"&&typeof I.provider=="string"?I.provider:void 0;for(let[w,x]of Object.entries((I&&typeof I=="object"?I.instances:void 0)??{})){let k=x&&typeof x=="object"&&typeof x.provider=="string"?x.provider:void 0;c&&k&&k!==c&&g.push(`integrations: ${m}@${w} 实现覆盖跨厂商（${c} → ${k}）——凭据域切换，确认该 mall 对应凭据在场`)}}let C=((Array.isArray(y.instances)?y.instances:void 0)??[]).map(m=>m&&typeof m=="object"&&typeof m.id=="string"?m.id:void 0).filter(m=>typeof m=="string");return{suppliedProviders:i,demandedServices:o,credentialFileMissing:l,credentialFileType:v,credentialSchemaMissing:u,vendorConfigKeys:s,vendorConfigSchemaMissing:f,realmSwitchHints:g,moduleResourceNeeds:p,...C.length>0?{malls:C}:{}}}import{existsSync as $,readdirSync as Ce,readFileSync as J}from"fs";import{join as j}from"path";import{existsSync as st,readFileSync as fn,mkdirSync as at,writeFileSync as ct}from"fs";import gn from"path";function le(e){return gn.join(e,".tbox","app.json")}function mn(e){let n=le(e);if(!st(n))return null;try{let r=JSON.parse(fn(n,"utf8")),t=r?.templateVersion;return typeof t!="string"||t.trim().length===0?null:{templateVersion:t.trim(),npmModules:Array.isArray(r?.npmModules)?r.npmModules:[]}}catch{return null}}function lt(e,n){let r=le(e);at(gn.dirname(r),{recursive:!0}),ct(r,`${JSON.stringify(n,null,2)}
+`,"utf8")}function Ae(e){let n=mn(e);if(n===null)return null;let r=le(e);try{let t=JSON.parse(fn(r,"utf8"));return{...n,miniappContainers:Array.isArray(t?.miniappContainers)?t.miniappContainers:[]}}catch{return{...n,miniappContainers:[]}}}function dt(e,n){let r=e.npmModules.filter(t=>t.id!==n.id);return{...e,npmModules:[...r,n]}}function ut(e,n){return{...e,npmModules:e.npmModules.filter(r=>r.id!==n)}}function pt(e,n){let r=(e.miniappContainers??[]).filter(t=>t.id!==n.id);return{...e,miniappContainers:[...r,n]}}function ft(e,n,r){return{...e,npmModules:e.npmModules.map(t=>t.id===n?{...t,...r}:t)}}function vn(e){return/^[a-z0-9]+(-[a-z0-9]+)*$/.test(e)&&!e.includes("..")}function gt(e,n){if(!vn(e))throw new Error(`非法模块 id "${e}"（来自 ${n}）：仅允许小写字母/数字/中划线`)}function de(e,n){let r=t=>{try{let i=JSON.parse(t),o=G(i);if(o.ok)return{kind:"strict",name:o.value.name,version:o.value.version,descriptor:o.value,contributes:o.value.contributes};if(i&&typeof i=="object"&&"contributes"in i){let s=i;return{kind:"loose",...typeof s.name=="string"?{name:s.name}:{},contributes:{providers:s.contributes?.providers,services:s.contributes?.services}}}return null}catch{return null}};if(n)return n.read(e,r)??null;if(!$(e))return null;try{return r(J(e,"utf8"))}catch{return null}}function mt(e){let n=j(e,".tbox","app.json");if(!$(n))return[];try{let r=JSON.parse(J(n,"utf8"));return Array.isArray(r.npmModules)?r.npmModules.filter(t=>!!t&&typeof t=="object"&&typeof t.id=="string"&&typeof t.package=="string"):[]}catch{return[]}}function vt(e){let n=j(e,".tbox-dev.local"),r=j(n,"dev-manifest.json");if(!$(r))return[];try{let t=JSON.parse(J(r,"utf8")),i=[];for(let[o,s]of Object.entries(t.redirects??{}))typeof s!="string"||!o.startsWith("@tbox.cn/app-")||i.push({pkg:o,dir:j(n,s)});return i}catch{return[]}}function yt(e,n){let r=[],t=[e];for(let o of["apps","packages"]){let s=j(e,o);if($(s))try{for(let f of Ce(s,{withFileTypes:!0}))f.isDirectory()&&t.push(j(s,f.name))}catch{}}let i=new Set;for(let o of t){let s=j(o,"node_modules","@tbox.cn");if(!$(s))continue;let f=[];try{f=Ce(s)}catch{continue}for(let u of f){let p=j(s,u);if(i.has(p))continue;i.add(p);let v=j(p,"service-slots.json");if(!$(v))continue;let S=y=>{try{let R=JSON.parse(y);if(Array.isArray(R.slots))return R.slots.filter(a=>typeof a=="string")}catch{}return null},d=n?n.read(v,S):S(J(v,"utf8"));d!=null&&r.push({dir:p,slots:d})}}return r}function N(e,n){let r=[],t={providers:{},services:{},credentialTypes:{}},i={},o=[],s=new Set,f=new Map,u=(d,y,R)=>{for(let a of d){let l=t.providers[a.provider]??={},g=l[a.implementation];g?g.services.includes(a.service)||g.services.push(a.service):(l[a.implementation]={provider:a.provider,implementation:a.implementation,credentialType:a.credentialType,owner:y,...a.local?{local:!0}:{},...a.configSchema?{configSchema:a.configSchema}:{},...a.credentialSchema?{credentialSchema:a.credentialSchema}:{},services:[a.service]},t.credentialTypes[a.credentialType]??={owner:y,packageDir:R,...a.credentialSchema?{credentialSchema:a.credentialSchema}:{}});let b=`${a.provider}\0${a.service}`;i[b]||(i[b]={...a.configSchema?{configSchema:a.configSchema}:{},...a.credentialSchema?{credentialSchema:a.credentialSchema}:{},packageDir:R})}},p=(d,y)=>{let R=d.optional!==!1,a=d.defaults??[],l=t.services[d.service];if(l){l.optional=l.optional&&R;let C=new Set(l.defaults.map(m=>`${m.provider}\0${m.implementation}`));for(let m of a){let I=`${m.provider}\0${m.implementation}`;C.has(I)||(l.defaults.push(m),C.add(I))}l.owners.includes(y)||l.owners.push(y);return}t.services[d.service]={optional:R,defaults:[...a],...d.title?{title:d.title}:{},...d.description?{description:d.description}:{},owners:[y]};let g=d.service.includes(".")?d.service.slice(0,d.service.indexOf(".")):d.service,b=f.get(g);b===void 0?f.set(g,y):b!==y&&o.push({severity:"warning",code:"DOMAIN_KEY_CONFLICT",module:y,message:`域键 ${g} 被多模块声明（${b} 与 ${y}）——domains 换算歧义（P13）`})};for(let d of mt(e)){if(s.has(d.id))continue;let y=j(e,"packages",d.id),R=j(e,"node_modules",...d.package.split("/")),a=de(j(y,"tbox.module.json"),n)??de(j(R,"tbox.module.json"),n);if(!a)continue;s.add(d.id);let l=$(j(y,"tbox.module.json"))?y:R,g=a.contributes;a.kind==="strict"&&r.push({id:d.id,dir:l,pkg:d.mode==="sdk"?d.package:`@app/${d.id}`,descriptor:a.descriptor});let b=g.providers?.slots??[];b.length&&u(b,d.package,l);let C=g.services??[];if(C.length)for(let m of C)p(m,d.package)}for(let{pkg:d,dir:y}of vt(e)){let R=de(j(y,"tbox.module.json"),n);if(!R?.name||s.has(R.name))continue;s.add(R.name);let a=R.contributes.providers?.slots??[];a.length&&u(a,d,y);let l=R.contributes.services??[];if(l.length)for(let g of l)p(g,d)}let v=j(e,"packages");if($(v)){let d=[];try{d=Ce(v,{withFileTypes:!0}).filter(y=>y.isDirectory()).map(y=>y.name)}catch{}for(let y of d){if(s.has(y))continue;let R=j(v,y),a=de(j(R,"tbox.module.json"),n);if(!a)continue;let l=a.name??y;if(s.has(l))continue;s.add(l);let g=a.contributes;a.kind==="strict"&&r.push({id:l,dir:R,pkg:`@app/${l}`,descriptor:a.descriptor});let b=g.providers?.slots??[];b.length&&u(b,`@app/${l}`,R);let C=g.services??[];if(C.length)for(let m of C)p(m,`@app/${l}`)}}let S=new Set;for(let d of yt(e,n))for(let y of d.slots)S.add(y);return{modules:r,catalog:t,serviceSchemas:i,vocabulary:[...S].sort(),domainKeyIssues:o}}function yn(e,n,r){let t=j(e,"src",n,"index.ts");if(!$(t))return!1;try{let i=J(t,"utf8");return new RegExp(`export\\s+const\\s+${r}\\b`).test(i)}catch{return!1}}function St(e){let n=j(e,"src","server","index.ts");if(!$(n))return"";try{return J(n,"utf8")}catch{return""}}function Sn(e){return e.match(/declaration\s*:\s*\{[\s\S]*?moduleId\s*:\s*['"]([^'"]+)['"]/)?.[1]}function wt(e){let n=[],r=N(e),t=Ae(e),i=new Map;for(let o of t?.npmModules??[])i.set(o.id,o.mode);for(let o of r.modules){let s=i.get(o.id)??"local",f=yn(o.dir,"server","serverModule"),u=o.descriptor.contributes;n.push({id:o.id,pkg:s==="sdk"?o.pkg:`@app/${o.id}`,mode:s,hasServerEntry:f,hasClientEntry:yn(o.dir,"client","clientModule"),hasCards:(u.cards?.length??0)>0,...f?{moduleId:Sn(St(o.dir))}:{}})}return n.sort((o,s)=>o.id.localeCompare(s.id))}import{existsSync as kr,readFileSync as br}from"fs";import{join as Cr,resolve as xr}from"path";function xe(e){return N(e).catalog}function wn(e){let n=N(e).catalog,r={};for(let[o,s]of Object.entries(n.providers)){r[o]={};for(let[f,u]of Object.entries(s))r[o][f]={provider:u.provider,implementation:u.implementation,credentialType:u.credentialType,owner:u.owner,...u.local?{local:!0}:{},...u.configSchema?{configSchema:u.configSchema}:{},...u.credentialSchema?{credentialSchema:u.credentialSchema}:{},services:[...u.services]}}let t={};for(let[o,s]of Object.entries(n.services))t[o]={optional:s.optional,defaults:s.defaults.map(f=>({...f})),owners:[...s.owners]};let i={};for(let[o,s]of Object.entries(n.credentialTypes))i[o]={owner:s.owner,...s.credentialSchema?{credentialSchema:s.credentialSchema}:{}};return{providers:r,services:t,credentialTypes:i}}import{existsSync as ht,readFileSync as Rt}from"fs";import{join as hn}from"path";var It=hn("config","integrations.json");function Y(e,n){let r=hn(e,It),t=i=>JSON.parse(i);if(n)return n.read(r,t)??null;if(!ht(r))return null;try{return t(Rt(r,"utf8"))}catch{return null}}async function Rn(e,n){let r=await M(e),t=Y(e,n);if(t===null)return{config:null,strict:!1,contracts:r};if(r.strictValidation&&r.module.parseIntegrationsConfig)try{return{config:r.module.parseIntegrationsConfig(t),strict:!0,contracts:r}}catch(i){if(i instanceof Error&&Array.isArray(i.issues)){let o=i.issues.filter(s=>Array.isArray(s.path)).map(s=>s.path.map(String).join(".")).filter(s=>s.length>0);throw new A("VALIDATION_FAILED",400,"integrations.json 校验失败",o.length>0?o:void 0)}throw new A("VALIDATION_FAILED",400,i instanceof Error?i.message:String(i))}return{config:t,strict:!1,contracts:r}}function ne(e,n,r){return e.includes(r)||n.includes(r)}import{existsSync as Cn,readFileSync as xn}from"fs";import{join as H,resolve as Ct}from"path";import xt from"ajv";var te=["provider","config","configByInstance","credentialRef","credentialRefByInstance","instances","defaultInstanceId"];import{readdirSync as kt,existsSync as ue,readFileSync as bt}from"fs";import{join as pe}from"path";function In(e,n,r){let t=[];if(n){let i=z({provider:e});t.push({stem:i,ref:`secret://${i}`,input:n})}for(let[i,o]of Object.entries(r??{})){let s=z({provider:e,instanceId:i});t.push({instanceId:i,stem:s,ref:`secret://${s}`,input:o})}return t}function kn(e,n,r,t,i){let o=[];if(t){let s=z({provider:e,service:n});o.push({stem:s,ref:`secret://${s}`,input:t})}for(let[s,f]of Object.entries(i??{})){let u=z({provider:e,instanceId:s,domain:r});o.push({instanceId:s,stem:u,ref:`secret://${u}`,input:f})}return o}function Oe(e,n,r){return n.map(t=>({stem:t.stem,ref:t.ref,overwrote:r?ue(pe(e,D(t.stem))):Re(e,t.stem,t.input)}))}function At(e,n){return ue(pe(e,D(n)))}function Ee(e,n){if(typeof e=="string"){e.startsWith("secret://")&&n.add(e.slice(9));return}if(Array.isArray(e)){for(let r of e)Ee(r,n);return}if(e&&typeof e=="object")for(let r of Object.values(e))Ee(r,n)}function Me(e){let n=pe(e,"config","credentials"),r=new Set,t=pe(e,"config","integrations.json");if(ue(t))try{Ee(JSON.parse(bt(t,"utf8")),r)}catch{}let i=[];if(!ue(n))return i;let o=[];try{o=kt(n).filter(s=>s.endsWith(".json")).map(s=>s.slice(0,-5))}catch{return i}for(let s of o.sort()){if(r.has(s))continue;let f=Q(e,s);i.push({severity:"warning",code:"ORPHANED_CREDENTIAL",message:`${D(s)} 不再被引用（凭据文件保留，可手动清理）`})}return i}var B=H("config","integrations.json");function Z(e,n){if(e===n)return!0;if(Array.isArray(e)&&Array.isArray(n))return e.length!==n.length?!1:e.every((r,t)=>Z(r,n[t]));if(e&&n&&typeof e=="object"&&typeof n=="object"){let r=Object.keys(e),t=Object.keys(n);return r.length!==t.length?!1:r.every(i=>Z(e[i],n[i]))}return!1}function me(e,n){if(typeof e!="string"&&e&&typeof e=="object")for(let[r,t]of Object.entries(e)){if((r==="provider"||r==="instanceId")&&typeof t=="string"&&!W.test(t))throw new A("VALIDATION_FAILED",400,`${r} 名含非法字符（需 /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/）`,[`${n}.${r}`]);me(t,`${n}.${r}`)}}function fe(e,n,r){if(!(!e||typeof e!="object"||Array.isArray(e))){for(let t of Object.keys(e))if(!(r&&(t==="*"||t==="**"))&&!W.test(t))throw new A("VALIDATION_FAILED",400,`${n} 键 ${t} 含非法字符（需 /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/）——进凭据 stem 派生，防路径逃逸`,[n])}}function bn(e,n,r){if(r==="root"){let t=e.instances;Array.isArray(t)&&t.forEach((i,o)=>{let s=i&&typeof i=="object"?i.id:void 0;if(typeof s=="string"&&!W.test(s))throw new A("VALIDATION_FAILED",400,`instances[${o}].id 含非法字符（需 /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/）`,[`root.instances[${o}].id`])}),fe(e.configByInstance,"root.configByInstance",!1),fe(e.credentialRefByInstance,"root.credentialRefByInstance",!1)}else fe(e.instances,"services.instances",!0);fe(n.credentialsByInstance,"credentialsByInstance",!1)}function ge(e,n){let r=H(e,B),t=i=>JSON.parse(i);if(n)return n.read(r,t)??null;if(!Cn(r))return null;try{return t(xn(r,"utf8"))}catch{return null}}function Te(e){let n=(e.instances??[]).map(r=>r.id);return n.length===0?[]:Ie(e,n)}function Et(e,n,r,t){let{catalog:i}=N(e,t),o=i.providers[n];if(!o)return;let s=new Set;for(let f of Object.values(o))(r===void 0||f.services.includes(r))&&s.add(f.credentialType);return s.size===1?[...s][0]:void 0}function An(e,n,r,t,i,o){if(typeof t.type!="string"||t.type.length===0)throw new A("VALIDATION_FAILED",400,"凭据 type 缺失或为空字符串",["credentials.type"]);let s=i??Et(e,n,r,o);if(s!==void 0&&s!=="-"&&t.type!==s)throw new A("VALIDATION_FAILED",400,`凭据 type=${t.type} 与绑定 credentialType ${s} 不一致`,["credentials.type"]);if(r===void 0)return;let{serviceSchemas:f}=N(e,o),u=f[`${n}\0${r}`];if(!u?.credentialSchema)return;let p=Ct(u.packageDir,u.credentialSchema);if(Cn(p))try{let S=new xt({allErrors:!0}).compile(JSON.parse(xn(p,"utf8")));if(!S({type:t.type,...t.values})){let d=(S.errors??[]).map(y=>`credentials.values.${String(y.instancePath||y.params?.missingProperty||"").replace(/^\//,"")}`);throw new A("VALIDATION_FAILED",400,"凭据字段校验失败（ajv 字段级）",d)}}catch(v){if(v instanceof A)throw v}}function je(e,n={}){let{onApplied:r,cache:t}=n;function i(p,v,S,d){let y=p!==null,R=v.length>0,a=!d&&y,l=!d&&R;a&&(_(H(e,B),`${JSON.stringify(p,null,2)}
+`),t?.invalidate([H(e,B)]));let g=a||l,b=g&&r!==void 0;b&&r?.();let C=[];return y&&C.push(B),R&&C.push(...v.map(m=>D(m.stem))),{written:g,restartScheduled:b,files:C,credentials:v,issues:S}}let o;async function s(){o=await M(e)}function f(p,v){return p.filter(S=>Array.isArray(S.path)).map(S=>{let d=S.path.map(String).join(".");return v!==""&&d.startsWith(v)&&d.length>v.length?d.slice(v.length):d}).filter(S=>S.length>0)}function u(p,v,S){let d=o;if(!d||!d.strictValidation||!d.module.parseIntegrationsConfig)throw new A("CONTRACTS_NOT_RESOLVED",503,"contracts 严格校验面不可用（需 ≥0.9）——写路径门控失败（工厂边缘断言应先行拦截）");try{d.module.parseIntegrationsConfig(p)}catch(y){throw y instanceof Error&&Array.isArray(y.issues)?new A("VALIDATION_FAILED",400,"节点 schema 校验失败",f(y.issues,S)):new A("VALIDATION_FAILED",400,y instanceof Error?y.message:String(y))}}return{warmup:s,applyApp(p,v={}){me(p,"root"),bn(p,v,"root");let S=[],d=ge(e,t),y=d??{services:{}};d===null&&S.push({severity:"warning",code:"SKELETON_MATERIALIZED",message:"config/integrations.json 缺席——已物化骨架（写时自动初始化；R13 语义翻转提示）"});let R={...y};for(let c of te)c in p||delete R[c];for(let[c,w]of Object.entries(p))R[c]=w;let a=typeof R.provider=="string"?R.provider:"app",l=In(a,v.credentials,v.credentialsByInstance);for(let c of l)An(e,a,void 0,c.input,void 0,t);let g=l.find(c=>c.instanceId===void 0);if(v.credentials&&g&&(R.credentialRef=g.ref),v.credentialsByInstance){let c={...R.credentialRefByInstance??{}};for(let w of l)w.instanceId!==void 0&&(c[w.instanceId]=w.ref);R.credentialRefByInstance=c}let b=v.credentials!==void 0||v.credentialsByInstance!==void 0,C=Z(d,R);if(C&&!b)return{written:!1,restartScheduled:!1,files:[],credentials:[],issues:S};u(R,S,"");let m=v.dryRun===!0,I=Oe(e,l,m);return S.push(...Te(R)),i(C?null:R,I,S,v.dryRun)},applyModule(p,v,S={}){me(v,"root");let{modules:d,catalog:y}=N(e,t),R=d.find(c=>c.id===p);if(!R)throw new A("MODULE_NOT_FOUND",404,`模块 ${p} 非已装模块`);let a=U({modules:d,catalog:y},R);if(!a.writable)throw a.reason==="multi-domain"?new A("VALIDATION_FAILED",400,`模块 ${p} 跨 ${a.domainKeys.length} 个域（${a.domainKeys.join("、")}）——模块级统一配置仅支持单域模块，请按服务级配置（编辑各服务行）`):a.reason==="zero-domain"?new A("VALIDATION_FAILED",400,`模块 ${p} 无服务需求声明，无域配置位`):new A("VALIDATION_FAILED",400,`域键 ${a.domainKey} 由 ${a.coOwners.map(c=>cn(d,c)).join("、")} 共用——写通道拒绝歧义操作，请按服务级配置`);let l=a.domainKey,g=[],b=ge(e,t);if(b===null&&Object.keys(v).length===0)return{written:!1,restartScheduled:!1,files:[],credentials:[],issues:g};b===null&&g.push({severity:"warning",code:"SKELETON_MATERIALIZED",message:"config/integrations.json 缺席——已物化骨架（写时自动初始化；R13 语义翻转提示）"});let C=b??{services:{}},m={...C.domains??{}},I={...C,domains:m};return Object.keys(v).length===0?delete m[l]:m[l]={...v},Z(b,I)?{written:!1,restartScheduled:!1,files:[],credentials:[],issues:g}:(u(I,g,`domains.${l}.`),g.push(...Te(I)),i(I,[],g,S.dryRun))},applyService(p,v,S={}){me(v,"root"),bn(v,S,"slot");let d=[],y=ge(e,t);if(!ne(N(e,t).vocabulary,Object.keys(y?.services??{}),p))throw new A("SERVICE_NOT_FOUND",404,`服务 ${p} 不在服务词汇（已装契约包 ∪ 已配置）`);y===null&&d.push({severity:"warning",code:"SKELETON_MATERIALIZED",message:"config/integrations.json 缺席——已物化骨架（写时自动初始化；R13 语义翻转提示）"});let R=y??{services:{}},a={...R.services??{}},l={...R,services:a};a[p]={...v};let g=v.provider,b=g!==null&&typeof g=="object"?g:void 0,C=typeof g=="string"?g:typeof b?.provider=="string"?b.provider:"app",m=p.includes(".")?p.slice(0,p.indexOf(".")):p,I=kn(C,p,m,S.credentials,S.credentialsByInstance);for(let O of I)An(e,C,p,O.input,typeof b?.credentialType=="string"?b.credentialType:void 0,t);let c=a[p],w=I.find(O=>O.instanceId===void 0);if(S.credentials&&w&&(c.credentialRef=w.ref),S.credentialsByInstance){let O={...c.instances??{}};for(let P of I){if(P.instanceId===void 0)continue;let V={...O[P.instanceId]??{}};V.credentialRef=P.ref,O[P.instanceId]=V}c.instances=O}let x=S.credentials!==void 0||S.credentialsByInstance!==void 0,k=Z(y,l);if(k&&!x)return{written:!1,restartScheduled:!1,files:[],credentials:[],issues:d};u(l,d,`services.${p}.`);let E=S.dryRun===!0,T=Oe(e,I,E);return d.push(...Te(l)),i(k?null:l,T,d,S.dryRun)},deleteService(p){let v=[],S=ge(e,t);if(!ne(N(e,t).vocabulary,Object.keys(S?.services??{}),p))throw new A("SERVICE_NOT_FOUND",404,`服务 ${p} 不在服务词汇（已装契约包 ∪ 已配置）`);let d={...S?.services??{}};if(!(p in d))return{written:!1,restartScheduled:!1,files:[],credentials:[],issues:v};delete d[p];let y={...S??{services:{}},services:d};_(H(e,B),`${JSON.stringify(y,null,2)}
+`),t?.invalidate([H(e,B)]),v.push(...Me(e));let R=r!==void 0;return R&&r?.(),{written:!0,restartScheduled:R,files:[B],credentials:[],issues:v}}}}import{existsSync as Ot}from"fs";import{join as Mt}from"path";function Pe(e){let n=Mt(e,"config","integrations.json");if(Ot(n))return{generated:!1,reason:"in-place",services:[]};let r=[];for(let o of N(e).modules)for(let s of o.descriptor.contributes.providers?.slots??[])s.local===!0&&r.push({service:s.service,provider:s.provider,implementation:s.implementation});if(r.length===0)return{generated:!1,reason:"no-local-slots",services:[]};let t={},i=new Set(r.map(o=>o.provider));if(i.size===1){let[o]=i;for(let s of r)t[s.service]={};_(n,`${JSON.stringify({provider:o,services:t},null,2)}
+`)}else{for(let o of r)t[o.service]={provider:o.provider,implementation:o.implementation};_(n,`${JSON.stringify({services:t},null,2)}
+`)}return{generated:!0,reason:"generated",services:r.map(o=>o.service).sort()}}function En(e){return e.replace(/^@tbox\.cn\/app-/,"").replace(/^@[^/]+\//,"")}function Tt(e){return En(e.id).startsWith("provider-")||En(e.pkg).startsWith("provider-")}function Ne(e){return{modules:e.walk.modules.filter(r=>!Tt(r)).map(r=>({id:r.id,name:r.descriptor.name,title:r.descriptor.name,description:""})).sort((r,t)=>r.id.localeCompare(t.id))}}function Ve(e,n){let r=e.walk.modules.find(u=>u.id===n);if(!r)throw new A("MODULE_NOT_FOUND",404,`模块 ${n} 非已装模块`);let t=(r.descriptor.contributes.services??[]).map(u=>({service:u.service,...u.title?{title:u.title}:{},...u.description?{description:u.description}:{},required:u.optional===!1})),i=U(e.walk,r),o=e.integrations?.domains??{},s=i.writable?o[i.domainKey]??null:null,f=i.domainKeys.map(u=>{let p=F(e.integrations,u);return{domain:u,effective:p.provider,layer:p.layer}});return{domainKeys:[...i.domainKeys],integration:s,providerBindings:f,configEditable:i.writable,services:t}}function On(e,n){let r=N(e.appDir,e.cache),t=Y(e.appDir,e.cache);return{appDir:e.appDir,walk:r,catalog:r.catalog,integrations:t,contracts:n}}function Mn(e){let n=new Set;for(let r of e.modules){for(let t of r.descriptor.contributes.services??[])n.add(t.service);for(let t of r.descriptor.contributes.providers?.slots??[])n.add(t.service)}return n}function ve(e,n,r){let t=e.providers[n];return t?Object.values(t).some(i=>i.services.includes(r)):!1}function Tn(e,n){let r=[];for(let[t,i]of Object.entries(e.providers))Object.values(i).some(o=>o.services.includes(n))&&r.push(t);return r.sort()}function De(e){let n=Mn(e.walk),r=e.walk.vocabulary.filter(o=>!n.has(o)).map(o=>({service:o,required:!1})),t=e.integrations,i=null;if(t){let o={};for(let s of te)s in t&&(o[s]=t[s]);i=o}return{services:r,integration:i}}function Fe(e,n){let r=e.integrations?.services??{},t=e.catalog.services[n];if(!ne(e.walk.vocabulary,Object.keys(r),n))throw new A("SERVICE_NOT_FOUND",404,`服务 ${n} 不在服务词汇（已装契约包 ∪ 已配置）`);let i=r[n]??null;return{service:n,...t?.title?{title:t.title}:{title:n},...t?.description?{description:t.description}:{},required:t?!t.optional:!1,defaults:t?t.defaults.map(o=>({...o})):[],integration:i,suppliedBy:Tn(e.catalog,n)}}import{existsSync as Nn,readFileSync as Vn,realpathSync as jn}from"fs";import{isAbsolute as jt,join as Pt,relative as Nt,resolve as Pn,sep as Vt}from"path";function $e(e){let n=[];for(let[r,t]of Object.entries(e.catalog.providers)){let i=Object.values(t);i.length!==0&&n.push({provider:r,local:i.every(o=>o.local===!0),owner:i[0].owner})}return{providers:n.sort((r,t)=>r.provider.localeCompare(t.provider))}}function _e(e,n,r){let t=e.catalog.providers[n];if(!t)throw new A("PROVIDER_NOT_FOUND",404,`厂商 ${n} 不 ∈ catalog（内联声明厂商无包级档案——身份与表单经组合端点暴露）`);let i={};for(let s of Object.values(t))for(let f of s.services)(i[f]??={implementations:[]}).implementations.push({implementation:s.implementation,credentialType:s.credentialType});if(r?.has("integrationSchemas"))for(let[s,f]of Object.entries(i))f.integrationSchemas={configSchema:K(e,n,s)};let o=Object.values(t);return{provider:n,local:o.every(s=>s.local===!0),owner:o[0].owner,services:i}}function Le(e,n,r){let t=e.catalog.providers[n],i=e.integrations?.services??{},o=[];if(t)for(let p of Object.values(t))p.services.includes(r)&&o.push({implementation:p.implementation,credentialType:p.credentialType});let s=i[r]?.provider,f=s&&typeof s=="object"&&s.provider===n?s:void 0;if(o.length===0&&!f)throw t?new A("SUPPLY_NOT_FOUND",404,`厂商 ${n} 未供给服务 ${r}（AI 帮我实现流：PUT 显式绑定后实施）`):new A("PROVIDER_NOT_FOUND",404,`厂商 ${n} 完全未知（不 ∈ catalog 且无任何内联声明）`);o.length===0&&f&&o.push({implementation:i[r]?.implementation??`${n}-inline@1`,credentialType:f.credentialType});let u=K(e,n,r,f?s?.configSchema:void 0);return{provider:n,service:r,implementations:o,integrationSchemas:{configSchema:u}}}function K(e,n,r,t){let i=e.walk.serviceSchemas[`${n}\0${r}`];return i?We(e.appDir,i.packageDir,i.configSchema):typeof t=="string"?Dt(e.appDir,t):null}function We(e,n,r){if(!r)return null;let t=Pt(n,r);if(!Nn(t))return null;try{return JSON.parse(Vn(t,"utf8"))}catch{return null}}function Dt(e,n){let r=Pn(e,"config","schemas"),t=Pn(e,n),i=Nt(r,t);if(i===""||i.startsWith("..")||jt(i))throw new A("VALIDATION_FAILED",400,"configSchema 引用必须落在 config/schemas/ 内（禁路径逃逸）",["provider.configSchema"]);if(!Nn(t))return null;let o,s;try{o=jn(r),s=jn(t)}catch{return null}if(s!==o&&!s.startsWith(o+Vt))throw new A("VALIDATION_FAILED",400,"configSchema 引用经 symlink 逃逸出 config/schemas/（realpath 复核拒绝）",["provider.configSchema"]);try{return JSON.parse(Vn(t,"utf8"))}catch{return null}}function Dn(e){return{version:e.version,evaluation:e.evaluation,strictValidation:e.strictValidation,notes:[...e.notes]}}function Fn(e,n,r){let t=e.integrations,i=L(n),o=t?.services?.[n],s=o?.instances?.[r]??o?.instances?.["*"];return s&&s.provider!==void 0?"instance":o?.provider!==void 0?"service":F(t,i).layer==="module"?"module":typeof t?.provider=="string"&&t.provider.length>0?"app":null}function $n(e,n,r,t,i){let o=n.resolveEffectiveService(e.integrations,r,t,i);if(o.status==="ok"&&o.effective){let s=o.effective.provider,f=typeof s=="string"?s:String(s?.provider??"");return{status:"ok",provider:f,implementation:o.effective.implementation,effective:{provider:f,implementation:o.effective.implementation,...o.effective.config!==void 0?{config:{...o.effective.config}}:{},...o.effective.credentialRef!==void 0?{credentialRef:o.effective.credentialRef}:{},layer:Fn(e,r,t)??"app"}}}return o.status==="binding-unresolved"?{status:"binding-unresolved",statusMessage:o.message}:{status:o.status}}function Be(e){let n=e.contracts.module;if(!n.resolveEffectiveService||!n.normalizeInstances)throw new A("CONTRACTS_NOT_RESOLVED",503,"contracts 求值面缺席（契约包形态异常）——重新安装或升级应用 @tbox.cn/app-contracts 后重试");return n}function Ke(e,n){let r=Be(n),{integrations:t,catalog:i}=n,o=r.buildSupplyLookup(i),s=t,u=r.normalizeInstances({instances:s?.instances,defaultInstanceId:s?.defaultInstanceId}).defaultInstanceId??"*",p=$n(n,r,e,u,o),v=Fn(n,e,u),S=n.integrations?.services?.[e]?.provider,d=p.provider??(typeof S=="string"?S:typeof S=="object"&&S?String(S.provider):void 0),y=new Set(Object.keys(n.catalog.providers)),R=d!==void 0&&y.has(d)?Ft(n.catalog,d,e):void 0,a=i.services[e],l=a!==void 0?!a.optional:void 0,g=a?.owners[0];return{status:p.status,...p.statusMessage?{statusMessage:p.statusMessage}:{},...d!==void 0?{provider:d}:{},...d!==void 0&&v!==null?{layer:v}:{},...R!==void 0?{supplied:R}:{},...g!==void 0?{module:g}:{},...l!==void 0?{required:l}:{}}}function Ft(e,n,r){return ve(e,n,r)}function re(e,n,r){let t=new Set([...e.walk.vocabulary,...Object.keys(e.catalog.services)]),i=e.integrations?.services??{};for(let s of Object.keys(i))t.add(s);let o={};for(let s of[...t].sort())r&&!r.includes(s)||(o[s]=Ke(s,e));return{contracts:Dn(e.contracts),resolutions:o,issues:n}}function ze(e,n,r){let t=Be(n),i=t.buildSupplyLookup(n.catalog),o=n.integrations,f=t.normalizeInstances({instances:o?.instances,defaultInstanceId:o?.defaultInstanceId}).instances.map(a=>a.id),u=n.integrations?.services?.[e],p=u?.instances?Object.keys(u.instances):void 0,v;f.length>0?(v=[...f],p?.includes("*")&&v.push("*")):p!==void 0&&p.length>0?v=p.includes("*")?["*"]:p:v=[];let S=v.map(a=>{let l=$n(n,t,e,a,i);return{instanceId:a,status:l.status,...l.statusMessage?{statusMessage:l.statusMessage}:{},...l.effective?{effective:l.effective}:{}}}),d=$t(n,e),R={...Ke(e,n),instances:S,inheritance:d};return{contracts:Dn(n.contracts),resolution:R,issues:r.filter(a=>a.service===e)}}function $t(e,n){let r=e.integrations,t=L(n),i=r?.services?.[n],o=e.integrations,f=Be(e).normalizeInstances({instances:o?.instances,defaultInstanceId:o?.defaultInstanceId}).defaultInstanceId??"*",u=i?.instances?.[f]??i?.instances?.["*"],p=F(r,t);return[{layer:"app",...r?.provider?{provider:r.provider}:{}},{layer:"module",...p.layer==="module"&&p.provider?{provider:p.provider}:{}},{layer:"service",...typeof i?.provider=="string"?{provider:i.provider}:{},...i?.implementation?{implementation:i.implementation}:{}},{layer:"instance",...u?.provider?{provider:u.provider}:{},...u?.implementation?{implementation:u.implementation}:{}}]}function Ue(e,n,r){if(n===null)return null;let t={};for(let i of r)t[i]={configSchema:K(e,n,i)};return{provider:n,services:t}}function q(e){return e===null||typeof e!="object"?JSON.stringify(e??null):Array.isArray(e)?`[${e.map(q).join(",")}]`:`{${Object.keys(e).sort().map(r=>`${JSON.stringify(r)}:${q(e[r])}`).join(",")}}`}var _t="\0no-enum";function Lt(e){let n=e.enum;return Array.isArray(n)?`[${[...new Set(n.map(q))].sort().join(",")}]`:_t}function Wt(e){if(!e||typeof e!="object"||Array.isArray(e))return null;let n=e.type;return n===void 0?null:q(n)}function Bt(e){let n=e.map(t=>Wt(t.subschema));if(n.some(t=>t===null)||new Set(n).size>1)return null;if(n[0]==='"object"'){let t=q(e[0].subschema);return e.every(i=>q(i.subschema)===t)?e[0].subschema:null}return new Set(e.map(t=>Lt(t.subschema))).size===1?e[0].subschema:null}function _n(e,n){let r=[],t=!0,i=new Map;for(let[s,f]of Object.entries(e.services)){let u=f.configSchema;if(u===null){r.push(s);continue}if(!u||typeof u!="object"||Array.isArray(u))continue;let p=u;p.additionalProperties===!1&&(t=!1);let v=p.properties;if(!v||typeof v!="object"||Array.isArray(v))continue;let S=Array.isArray(p.required)?p.required:[];for(let d of Object.keys(v)){let y=i.get(d)??[];y.push({service:s,subschema:v[d],required:S.includes(d)}),i.set(d,y)}}let o=[];for(let[s,f]of i)o.push({key:s,schema:Bt(f),sources:f.map(({service:u,required:p})=>({service:u,required:p}))});return{provider:e.provider,schemaless:r,unsupplied:[...n?.unsupplied??[]],additionalPropertiesAllowed:t,fields:o}}function Ln(e,n,r,t){let i=typeof t=="string"&&t.length>0?t:void 0;if(e==="app"){if(i!==void 0)return i;let f=n.integrations?.provider;return typeof f=="string"&&f.length>0?f:null}let o=n.walk.modules.find(f=>f.id===r);if(!o)return null;let s=U(n.walk,o);return s.writable?i!==void 0?i:F(n.integrations,s.domainKey).provider:null}var Wn={integrationSchemas:null,integrationFieldRegistry:null};function Je(e,n){let r=Ln("app",e,void 0,n);if(r===null)return Wn;let t=Ue(e,r,ln(e.catalog,r));return{integrationSchemas:t,integrationFieldRegistry:_n(t)}}function Ye(e,n,r){let t=Ln("module",e,n,r),i=e.walk.modules.find(u=>u.id===n);if(t===null||!i)return Wn;let o=(i.descriptor.contributes.services??[]).map(u=>u.service),s=u=>ve(e.catalog,t,u),f=Ue(e,t,o.filter(s));return{integrationSchemas:f,integrationFieldRegistry:_n(f,{unsupplied:[...new Set(o.filter(u=>!s(u)))]})}}function Kt(e){return Je(e).integrationSchemas}function zt(e,n){return Ye(e,n).integrationSchemas}function He(e,n){let r=e.integrations?.services?.[n]?.provider;if(r===void 0||r===""){let t=F(e.integrations,L(n));return t.provider===null?null:{provider:t.provider,configSchema:K(e,t.provider,n)}}if(typeof r=="string")return{provider:r,configSchema:K(e,r,n)};if(ee(r)){let t=r;return{provider:t.provider,configSchema:K(e,t.provider,n,t.configSchema)}}return null}function ie(e,n){if(n===void 0||!n.startsWith("secret://"))return;let r=n.slice(9),t=Q(e,r);if(t)return{type:t.type,ref:n,file:D(r),masked:oe(t.values)}}function Ze(e){let n=e.integrations,r={credential:ie(e.appDir,typeof n?.credentialRef=="string"?n.credentialRef:void 0)??null,byInstance:{}};for(let{id:i}of n?.instances??[]){let o=n?.credentialRefByInstance?.[i];o!==void 0&&(r.byInstance[i]=ie(e.appDir,o)??null)}let t={};for(let[i,o]of Object.entries(n?.services??{})){let s={credential:ie(e.appDir,o.credentialRef)??null,byInstance:{}};for(let[f,u]of Object.entries(o.instances??{}))s.byInstance[f]=ie(e.appDir,u.credentialRef)??null;t[i]=s}return{app:r,services:t}}function qe(e,n){return{types:(n===void 0?Object.keys(e.catalog.credentialTypes):[...new Set(Object.values(e.catalog.providers[n]??{}).map(t=>t.credentialType))]).sort().map(t=>{let i=e.catalog.credentialTypes[t];return{credentialType:t,owner:i?.owner??"",credentialSchema:i?We(e.appDir,i.packageDir,i.credentialSchema):null}})}}import Ut from"path";var Jt={app:["serviceResolutions","integrationSchemas","integrationFieldRegistry"],module:["serviceResolutions","integrationSchemas","integrationFieldRegistry"],provider:["integrationSchemas"],service:["integrationSchemas"]};function ye(e,n){if(!n||n.length===0)return new Set;let r=Jt[e],t=[...new Set(n)].filter(i=>!r.includes(i));if(t.length>0)throw new A("VALIDATION_FAILED",400,`include 含未知或不适用于本端点的键：${t.join("、")}（白名单：${r.join("、")}）`,["include"]);return new Set(n)}var Bn=["integrationSchemas","integrationFieldRegistry"];function Kn(e,n,r){if(!(typeof n!="string"||n.length===0)&&!Bn.some(t=>r.has(t)))throw new A("VALIDATION_FAILED",400,`参数 ${e} 需与表单 include 键（${Bn.join("、")}）同现——轴参仅重定向表单层双投影`,[e])}function Yt(e,n={}){let r=Se(),t=Promise.resolve(),i={appDir:e,cache:r};function o(a){if(!a.strictValidation)throw new A("CONTRACTS_NOT_RESOLVED",503,he(a))}function s(a){return On(i,a)}async function f(){let a=await M(e),l=s(a),g=l.integrations;if(g===null)return[];let b={resolveEffectiveService:u(a.module.resolveEffectiveService,"resolveEffectiveService"),buildSupplyLookup:u(a.module.buildSupplyLookup,"buildSupplyLookup"),moduleDomainOf:u(a.module.moduleDomainOf,"moduleDomainOf"),normalizeInstances:u(a.module.normalizeInstances,"normalizeInstances"),RESOURCE_TYPE_IDS:a.module.RESOURCE_TYPE_IDS??[]},C=be(e,l.walk,g,process.env);return ae({contracts:b,integrations:g,supplies:b.buildSupplyLookup(l.catalog),...C})}function u(a,l){if(typeof a!="function")throw new A("CONTRACTS_NOT_RESOLVED",503,`contracts 求值面 ${l} 缺席（形态异常）`);return a}function p(a){let l=t.then(a,a);return t=l.catch(()=>{}),l}let v={async loadModules(){let a=await M(e);return Ne(s(a))},async loadModule(a,l){let g=ye("module",l?.include);Kn("moduleProvider",l?.moduleProvider,g);let b=await M(e),C=s(b),m=Ve(C,a);if(g.has("serviceResolutions")&&(m.serviceResolutions=b.evaluation&&b.strictValidation?await f().then(I=>re(C,I,m.services.map(c=>c.service))):null),g.has("integrationSchemas")||g.has("integrationFieldRegistry")){let I=Ye(C,a,l?.moduleProvider);g.has("integrationSchemas")&&(m.integrationSchemas=I.integrationSchemas),g.has("integrationFieldRegistry")&&(m.integrationFieldRegistry=I.integrationFieldRegistry)}return m},async loadApp(a){let l=ye("app",a?.include);Kn("appProvider",a?.appProvider,l);let g=await M(e),b=s(g),C=De(b);if(l.has("serviceResolutions")&&(C.serviceResolutions=g.evaluation&&g.strictValidation?await f().then(m=>re(b,m)):null),l.has("integrationSchemas")||l.has("integrationFieldRegistry")){let m=Je(b,a?.appProvider);l.has("integrationSchemas")&&(C.integrationSchemas=m.integrationSchemas),l.has("integrationFieldRegistry")&&(C.integrationFieldRegistry=m.integrationFieldRegistry)}return C},async loadService(a,l){let g=ye("service",l?.include),b=await M(e),C=s(b),m=Fe(C,a);return g.has("integrationSchemas")&&(m.integrationSchemas=He(C,a)),m},async loadServiceResolutions(a){let l=await M(e);o(l);let g=await f();return re(s(l),g,a)},async loadServiceResolution(a){let l=await M(e);o(l);let g=await f();return ze(a,s(l),g)},async loadProviders(){let a=await M(e);return $e(s(a))},async loadProvider(a,l){let g=ye("provider",l?.include),b=await M(e);return _e(s(b),a,g)},async loadProviderService(a,l){let g=await M(e);return Le(s(g),a,l)},async loadCredentials(){let a=await M(e);return Ze(s(a))},async loadCredentialTypes(a){let l=await M(e);return qe(s(l),a)}},S=je(e,{onApplied:n.onApplied,cache:r}),d={async writeAppIntegration(a,l){await S.warmup();let g=await M(e);return o(g),p(()=>S.applyApp(a,l))},async writeModuleIntegration(a,l,g){await S.warmup();let b=await M(e);return o(b),p(()=>S.applyModule(a,l,g))},async writeServiceIntegration(a,l,g){await S.warmup();let b=await M(e);return o(b),p(()=>S.applyService(a,l,g))},async deleteServiceIntegration(a){await S.warmup();let l=await M(e);return o(l),p(()=>S.deleteService(a))}},y={invalidate(){r.invalidate(),we(e)},async resolveContracts(){return M(e)},walkManifests(){return R(e)},parseModuleDescriptor(a){return G(a)},loadProviderCatalogRaw(){return xe(e)},async readIntegrationsConfig(){return Y(e,r)},async writeIntegrationsConfig(a){await S.warmup();let l=await M(e);return o(l),p(()=>Ht(e,a,r))},async ensureMockBindings(){await S.warmup();let a=await M(e);return o(a),p(()=>Pe(e))},async evaluateIntegrationServices(a){await S.warmup();let l=await M(e);o(l);let g={resolveEffectiveService:u(l.module.resolveEffectiveService,"resolveEffectiveService"),buildSupplyLookup:u(l.module.buildSupplyLookup,"buildSupplyLookup"),moduleDomainOf:u(l.module.moduleDomainOf,"moduleDomainOf"),normalizeInstances:u(l.module.normalizeInstances,"normalizeInstances"),RESOURCE_TYPE_IDS:l.module.RESOURCE_TYPE_IDS??[]};return ae({...a,contracts:g})}};function R(a){return N(a,r)}return{...v,...d,...y}}function Ht(e,n,r){let t=Ut.join(e,"config","integrations.json");_(t,`${JSON.stringify(n,null,2)}
+`),r.invalidate([t])}export{te as APP_INTEGRATION_NODE_KEYS,A as AppToolkitError,W as SAFE_NAME_PATTERN,gt as assertValidModuleId,be as buildPredicateAssembly,Ie as checkInstanceKeys,wt as collectDeclaredModules,he as contractsNotResolvedMessage,Yt as createAppToolkit,Se as createFileCache,je as createWriteCore,At as credentialArtifactExists,Z as deepEqual,z as deriveStem,ie as echoForRef,an as ensureDir,Pe as ensureMockBindings,ae as evaluateIntegrationServices,Yn as expandEnvVars,Sn as extractModuleIdFromSource,we as invalidateContractsResolver,ee as isControlledInlineProvider,vn as isValidModuleId,Kt as loadAppIntegrationSchemas,De as loadAppView,qe as loadCredentialTypesView,Ze as loadCredentialsView,Ve as loadModuleDetailView,zt as loadModuleIntegrationSchemas,Ne as loadModulesView,wn as loadProviderCatalog,xe as loadProviderCatalogRaw,_e as loadProviderDetailView,Le as loadProviderServiceDetailView,$e as loadProvidersView,Fe as loadServiceDetailView,He as loadServiceIntegrationSchemas,ze as loadServiceResolutionDetail,re as loadServiceResolutionsView,le as manifestPath,oe as maskCredentialValues,Xe as moduleDependencySchema,rn as moduleDescriptorSchema,Ge as pageContribSchema,G as parseModuleDescriptor,en as providerSlotContribSchema,mn as readAppManifest,Ae as readAppManifestFull,Q as readCredentialFile,Y as readIntegrationsConfig,Rn as readIntegrationsStrict,Me as reconcileOrphanCredentials,pn as refToEnvKey,ut as removeNpmModule,M as resolveContractsForApp,M as resolveContractsForAppExport,Ue as resolveLayerIntegrationSchemas,Ke as resolveServiceSummary,tn as resourceNeedContribSchema,nn as serviceNeedContribSchema,D as stemToFilePath,Qn as stemToRef,Qe as tabContribSchema,ft as updateNpmModule,pt as upsertMiniappContainer,dt as upsertNpmModule,N as walkManifests,lt as writeAppManifest,_ as writeAtomic,Re as writeCredentialFile};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tbox.cn/app-toolkit",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "type": "module",
   "description": "tbox 应用工具面（运行面/工具面对仗：app-sdk 给运行的应用用，app-toolkit 给操作应用的工具用）——模块解析、集成配置求值/校验/写入内核，contracts 经应用侧动态解析（沙箱与目标应用版本解耦）。",
   "exports": {
@@ -18,7 +18,7 @@
     "zod": "3.25.76"
   },
   "devDependencies": {
-    "@tbox.cn/app-contracts": "0.9.0",
+    "@tbox.cn/app-contracts": "0.10.0",
     "typescript": "5.9.3",
     "tsup": "8.5.1",
     "vitest": "4.1.10",

package/src/assembly/app-manifest.ts

@@ -20,6 +20,12 @@ export interface NpmModuleEntry {
   mode: ModuleMode;
   /** 3-way merge 基线（codegen 模式） */
   baseVersion?: string;
+  /**
+   * 条目类别（单一模板统一化 W2-4）：'ui-kit' = 壳 UI 组件包——create 全量继承后
+   * 不再承担保留判据（模板 manifest = 出厂装配真源）；现职 = update 三方合并锚 +
+   * sync-agent-ui-kit 副本 identity 标记（由该脚本派生维护）。
+   */
+  kind?: 'ui-kit';
 }
 
 export interface AppManifest {

package/src/assembly/provider-catalog.ts

@@ -71,7 +71,12 @@ export function loadProviderCatalog(appDir: string): BridgeProviderCatalog {
   }
   const credentialTypes: BridgeProviderCatalog['credentialTypes'] = {};
   for (const [ct, entry] of Object.entries(rich.credentialTypes)) {
-    credentialTypes[ct] = { ...entry };
+    // 桥源形态冻结（v4.4 注意）：rich 条目新增的 packageDir（凭据结构清单解析位）不进桥——
+    // 显式投影保桥面 = contracts TIER0 形状（owner/credentialSchema），不随富形态漂移
+    credentialTypes[ct] = {
+      owner: entry.owner,
+      ...(entry.credentialSchema ? { credentialSchema: entry.credentialSchema } : {}),
+    };
   }
   return { providers, services, credentialTypes };
 }

package/src/assembly/walk-manifests.ts

@@ -74,7 +74,7 @@ export interface WalkCatalog {
       owners: string[];
     }
   >;
-  credentialTypes: Record<string, { owner: string; credentialSchema?: string }>;
+  credentialTypes: Record<string, { owner: string; packageDir: string; credentialSchema?: string }>;
 }
 
 /** loose 允许的 contributes 局部结构（本地声明——解跨模块类型身份耦合，TS2719 防线） */
@@ -252,6 +252,7 @@ export function walkManifests(appDir: string, cache?: FileCache): WalkManifestsR
         };
         catalog.credentialTypes[slot.credentialType] ??= {
           owner,
+          packageDir,
           ...(slot.credentialSchema ? { credentialSchema: slot.credentialSchema } : {}),
         };
       }

package/src/core/contracts-resolver.ts

@@ -244,9 +244,10 @@ export function resolveContractsForApp(appDir: string): Promise<ResolvedContract
       const resolved = await probeCandidate(candidate, notes);
       if (resolved) {
         if (resolved.version !== null && !resolved.strictValidation) {
-          // 注：push 进 resolved.notes（probeCandidate 返回体自带 notes 字段——调用侧 notes 仅供 null 路径聚合）
+          // 注：push 进 resolved.notes（probeCandidate 返回体自带 notes 字段——调用侧 notes 仅供 null 路径聚合）；
+          // 文案对齐 api.md §5 信封（P-4 notes 优先后该 note 即实际 message）
           resolved.notes.push(
-            `contracts ${resolved.version} 无严格校验面（需 ≥0.9）——升级应用 @tbox.cn/app-contracts 依赖后可用`,
+            `contracts ${resolved.version} 无严格校验面（需 ≥0.9.0）——升级应用 @tbox.cn/app-contracts 依赖后可用`,
           );
         }
         // 实际命中候选覆写（多候选走位可觉察——后续命中判定以命中候选为基准；F9）

package/src/core/credential-format.ts

@@ -16,6 +16,7 @@ import { dirname, join } from 'node:path';
  * 第一道为 descriptor/节点 zod 的字符集 pattern（module-schema SAFE_NAME_PATTERN）。
  */
 import { maskCredentialValues } from './credential-mask.js';
+import { AppToolkitError } from './errors.js';
 
 export { maskCredentialValues };
 
@@ -35,8 +36,9 @@ export interface StemInput {
 function assertSafeSegment(kind: string, value: string | undefined): void {
   if (value === undefined) return;
   if (value.includes('/') || value.includes('\\') || value.includes('..')) {
-    // 纵深防御断言：zod pattern 为第一道，此处兜底敌对输入（测试 O15 钉死）
-    throw new Error(`凭据 stem 派生输入含路径敌对字符（${kind}）——拒绝派生`);
+    // 纵深防御断言（A1：裸 Error → AppToolkitError 400——服务名是路径参数不在节点 zod 覆盖面，
+    // 本断言原是该输入面的唯一拦截点；裸 Error 穿透壳层落 500 违 api.md §5）
+    throw new AppToolkitError('VALIDATION_FAILED', 400, `凭据 stem 派生输入含路径敌对字符（${kind}）——拒绝派生`);
   }
 }
 

package/src/core/errors.ts

@@ -33,14 +33,20 @@ export class AppToolkitError extends Error {
   }
 }
 
-/** CONTRACTS_NOT_RESOLVED 三分支 message（N1 构建指引——api.md 错误信封示例） */
+/** CONTRACTS_NOT_RESOLVED message（N1 构建指引——api.md 错误信封示例）。
+ *  P-4：notes 优先——resolver 在全部不可解析路径均已 push 携带操作指引的 notes（导入失败/
+ *  产物缺失/未安装/<0.9 升级）；现行 version===null 分支会把 notes 内细分指引吞成通用文案。
+ *  三分支保留为兜底（防御性——正常路径 notes 恒非空）。 */
 export function contractsNotResolvedMessage(contracts: { version: string | null; strictValidation: boolean; notes: readonly string[] }): string {
+  if (contracts.notes.length > 0) {
+    return contracts.notes[0];
+  }
   if (contracts.version === null) {
     return 'contracts 不可解析（未安装）——检查应用依赖安装后重试';
   }
   if (!contracts.strictValidation) {
-    return `contracts ${contracts.version} 无严格校验面（需 ≥0.9）——升级应用 @tbox.cn/app-contracts 依赖后可用`;
+    return `contracts ${contracts.version} 无严格校验面（需 ≥0.9.0）——升级应用 @tbox.cn/app-contracts 依赖后可用`;
   }
   // 版本达标但解析态异常（notes 携带细分——导入拒绝/产物缺失）
-  return contracts.notes[0] ?? 'contracts workspace 源码态未构建——执行 pnpm --filter @tbox.cn/app-contracts build 后重试';
+  return 'contracts workspace 源码态未构建——执行 pnpm --filter @tbox.cn/app-contracts build 后重试';
 }