@tbox.cn/app-toolkit 0.1.0 → 0.3.0

package/src/views/integration-schemas.ts

@@ -0,0 +1,226 @@
+import type { IntegrationFieldRegistryView, LayerIntegrationSchemas, ServiceIntegrationSchemas } from '../dto.js';
+import { isSupplied, type ViewSnapshot } from './context.js';
+import { resolveServiceConfigSchema } from './providers.js';
+import { domainOfService, moduleDomainWritable, providerFootprint, resolveDomainBinding } from '../integrations/domain-binding.js';
+import { isControlledInlineProvider } from '../integrations/predicate.js';
+
+/**
+ * 层级/服务级 config schema 计算视图（v4.4 D32——静态轴富化，零 contracts 求值；v4.7 D38 服务级）。
+ * config 表单结构四形态同源（P10）：槽级组合单体（providers.ts）/ 层级内嵌（本文件——
+ * /app、/modules/:m include）/ 供给轴批量（providers.ts include——切换态）/ 服务级生效绑定
+ * （本文件 loadServiceIntegrationSchemas——/services/:s include）。
+ *
+ * 计算规则（D32 裁决）：禁交集——config 五层浅合并下「部分服务认识的字段」合法（谓词 #7
+ * 并集键集同依据）；禁合成单一 schema——required/title 冲突的有损代数；产物 = 扁平映射，
+ * 分组归客户端纯呈现。层级 schema = 表单引导**非写入门禁**（P16——写路径校验权威恒在谓词
+ * #7 键集 + ajv 凭据链；root 级口径差：#7 = 引用厂商并集，表单 = 层生效厂商单厂商作用域）。
+ *
+ * v4.6（D36/D37 additive 精化）：**原始投影**（loadApp/loadModuleIntegrationSchemas）原样保留
+ * 为诊断面 / registry 输入；**消费投影** = buildIntegrationFieldRegistry（字段级合并代数
+ * R1/R2/R3 服务端单源，conflict 折叠 schema:null）；**轴向假想绑定** = formProviderOf
+ * （override ?? 实际解析——双投影同源同口径，formViews 装配层一次计算两投影）。
+ * 单源三锚：层级 schema 计算 = resolveLayerIntegrationSchemas / 生效厂商解析 = formProviderOf /
+ * 合并代数 = buildIntegrationFieldRegistry。
+ */
+
+/** 核心纯函数：显式作用域（provider null → 整字段 null；services 逐项 resolveServiceConfigSchema
+ *  复合解析——v4.7 D38 收口，零新读取路径；供给在场未声明 = null，mock 合法） */
+export function resolveLayerIntegrationSchemas(snapshot: ViewSnapshot, provider: string, services: readonly string[]): LayerIntegrationSchemas;
+export function resolveLayerIntegrationSchemas(snapshot: ViewSnapshot, provider: string | null, services: readonly string[]): LayerIntegrationSchemas | null;
+export function resolveLayerIntegrationSchemas(
+  snapshot: ViewSnapshot,
+  provider: string | null,
+  services: readonly string[],
+): LayerIntegrationSchemas | null {
+  if (provider === null) return null;
+  const out: LayerIntegrationSchemas['services'] = {};
+  for (const s of services) {
+    out[s] = { configSchema: resolveServiceConfigSchema(snapshot, provider, s) };
+  }
+  return { provider, services: out };
+}
+
+// ── v4.6 D36/D37：合并代数助手（内联——深相等判定基）──
+
+/** 稳定序列化（键序归一——R2 深相等 / R1 签名比较统一基；数组保序、对象键 sort） */
+function stableSerialize(v: unknown): string {
+  if (v === null || typeof v !== 'object') return JSON.stringify(v ?? null) as string;
+  if (Array.isArray(v)) return `[${v.map(stableSerialize).join(',')}]`;
+  const keys = Object.keys(v as Record<string, unknown>).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${stableSerialize((v as Record<string, unknown>)[k])}`).join(',')}}`;
+}
+
+/** enum 缺席哨兵（≠ 任何实际集签名——混布必不等） */
+const NO_ENUM = '\u0000no-enum';
+
+/** enum 集签名（去重排序——序不敏感） */
+function enumSig(sub: Record<string, unknown>): string {
+  const e = sub.enum;
+  if (!Array.isArray(e)) return NO_ENUM;
+  return `[${[...new Set(e.map(stableSerialize))].sort().join(',')}]`;
+}
+
+/** 顶层 type 签名（数组形态序敏感——严格全等）；非对象（含布尔子 schema）/ type 缺席 → null（R3） */
+function typeSig(sub: unknown): string | null {
+  if (!sub || typeof sub !== 'object' || Array.isArray(sub)) return null;
+  const t = (sub as Record<string, unknown>).type;
+  return t === undefined ? null : stableSerialize(t);
+}
+
+/** D36 合并代数单点（R1/R2/R3——唯一扩展点；保守降级：不可调和 → null，客户端 RawJson 保真） */
+function mergeFieldSources(sources: ReadonlyArray<{ subschema: unknown }>): object | null {
+  const sigs = sources.map((s) => typeSig(s.subschema));
+  if (sigs.some((s) => s === null) || new Set(sigs).size > 1) return null; // R3：非对象/type 缺席/type 不等
+  if (sigs[0] === '"object"') {
+    // R2：全源稳定序列化深相等 → 首源；异构 → null
+    const first = stableSerialize(sources[0].subschema);
+    return sources.every((s) => stableSerialize(s.subschema) === first) ? (sources[0].subschema as object) : null;
+  }
+  // R1：标量型——enum 集全等（含双无哨兵）→ 首源；不等/混布 → null
+  const es = new Set(sources.map((s) => enumSig(s.subschema as Record<string, unknown>)));
+  return es.size === 1 ? (sources[0].subschema as object) : null;
+}
+
+/** D36 registry 构造（纯函数——消费 resolveLayerIntegrationSchemas 产物，禁旁路直取 serviceSchemas）。
+ *  fields 收集零过滤（布尔/非对象子 schema 入列，判定全权归 mergeFieldSources——S8 互证等式由
+ *  收集定义结构性闭合）；schemaless 仅 configSchema === null（布尔/畸形整 schema 防御跳过——
+ *  不入 schemaless、零参与聚合；D32 运行时畸形，非契约面）。 */
+export function buildIntegrationFieldRegistry(
+  layer: LayerIntegrationSchemas,
+  o?: { unsupplied?: string[] },
+): IntegrationFieldRegistryView {
+  const schemaless: string[] = [];
+  let additionalPropertiesAllowed = true;
+  const buckets = new Map<string, Array<{ service: string; subschema: unknown; required: boolean }>>();
+  for (const [service, entry] of Object.entries(layer.services)) {
+    // 插入序 = scope 遍历序（app 字母序 / module demand 序）——fields 首声明序由此保证
+    const schema = entry.configSchema;
+    if (schema === null) {
+      schemaless.push(service);
+      continue;
+    }
+    if (!schema || typeof schema !== 'object' || Array.isArray(schema)) continue;
+    const s = schema as Record<string, unknown>;
+    if (s.additionalProperties === false) additionalPropertiesAllowed = false;
+    const props = s.properties;
+    if (!props || typeof props !== 'object' || Array.isArray(props)) continue; // ≡ 谓词 collectPropertyKeys 守卫
+    const required = Array.isArray(s.required) ? s.required : [];
+    for (const key of Object.keys(props)) {
+      const bucket = buckets.get(key) ?? [];
+      bucket.push({ service, subschema: (props as Record<string, unknown>)[key], required: required.includes(key) });
+      buckets.set(key, bucket);
+    }
+  }
+  const fields: IntegrationFieldRegistryView['fields'] = [];
+  for (const [key, sources] of buckets) {
+    fields.push({
+      key,
+      schema: mergeFieldSources(sources),
+      sources: sources.map(({ service, required }) => ({ service, required })),
+    });
+  }
+  return {
+    provider: layer.provider,
+    schemaless,
+    unsupplied: [...(o?.unsupplied ?? [])],
+    additionalPropertiesAllowed,
+    fields,
+  };
+}
+
+/** D37 生效厂商解析单源（实际/假想同径）：override（非空串）?? 实际解析。
+ *  空串归一（I3）单点；module 轴 D34 不可写/不在册 → null（override 不豁免——预览服务于保存）。 */
+export function formProviderOf(
+  axis: 'app' | 'module',
+  snapshot: ViewSnapshot,
+  moduleId?: string,
+  override?: string,
+): string | null {
+  const ovr = typeof override === 'string' && override.length > 0 ? override : undefined;
+  if (axis === 'app') {
+    if (ovr !== undefined) return ovr;
+    const p = (snapshot.integrations as { provider?: unknown } | null)?.provider;
+    return typeof p === 'string' && p.length > 0 ? p : null;
+  }
+  const mod = snapshot.walk.modules.find((m) => m.id === moduleId);
+  if (!mod) return null; // 视图已先行 404，此处防御
+  const w = moduleDomainWritable(snapshot.walk, mod);
+  if (!w.writable) return null; // D34 不豁免
+  if (ovr !== undefined) return ovr;
+  return resolveDomainBinding(snapshot.integrations, w.domainKey).provider;
+}
+
+/** D36/D37 表单层双投影（I1：同源同口径一次计算——双取单算 by construction） */
+export interface LayerFormViews {
+  integrationSchemas: LayerIntegrationSchemas | null;
+  integrationFieldRegistry: IntegrationFieldRegistryView | null;
+}
+
+/** 防御双 null（module 不在册/不可写/未绑定、app 未绑定——F3） */
+const NULL_FORM_VIEWS: LayerFormViews = { integrationSchemas: null, integrationFieldRegistry: null };
+
+/** app 轴装配：scope = 供给足迹全量（≠ AppView.services——root.config 流向包括模块服务在内的所有服务）；
+ *  unsupplied 恒 []（结构性：足迹 ⊆ 供给）。未知厂商/零足迹 → 非 null 空集（镜像 D32 mock 语义）。 */
+export function loadAppFormViews(snapshot: ViewSnapshot, appProvider?: string): LayerFormViews {
+  const provider = formProviderOf('app', snapshot, undefined, appProvider);
+  if (provider === null) return NULL_FORM_VIEWS;
+  const layer = resolveLayerIntegrationSchemas(snapshot, provider, providerFootprint(snapshot.catalog, provider));
+  return { integrationSchemas: layer, integrationFieldRegistry: buildIntegrationFieldRegistry(layer) };
+}
+
+/** module 轴装配：仅 writable 单域（D34）；scope = demand ∩ 该厂商供给；unsupplied 同点派生
+ *  （demand − 供给，Set 去重保序——manifest demand 不去重防御）。 */
+export function loadModuleFormViews(snapshot: ViewSnapshot, moduleId: string, moduleProvider?: string): LayerFormViews {
+  const provider = formProviderOf('module', snapshot, moduleId, moduleProvider);
+  const mod = snapshot.walk.modules.find((m) => m.id === moduleId);
+  if (provider === null || !mod) return NULL_FORM_VIEWS;
+  const demand = (mod.descriptor.contributes.services ?? []).map((s) => s.service);
+  const supplied = (s: string): boolean => isSupplied(snapshot.catalog, provider, s);
+  const layer = resolveLayerIntegrationSchemas(snapshot, provider, demand.filter(supplied));
+  return {
+    integrationSchemas: layer,
+    integrationFieldRegistry: buildIntegrationFieldRegistry(layer, {
+      unsupplied: [...new Set(demand.filter((s) => !supplied(s)))],
+    }),
+  };
+}
+
+/** app 级 loader（v4.6 委托化——签名零改动，公开面保持；假想态归 loadAppFormViews override 参） */
+export function loadAppIntegrationSchemas(snapshot: ViewSnapshot): LayerIntegrationSchemas | null {
+  return loadAppFormViews(snapshot).integrationSchemas;
+}
+
+/** module 级 loader（v4.6 委托化——同上；多域/零域/共享键/未绑定 → 整字段 null，表单降级 = ExtraFields） */
+export function loadModuleIntegrationSchemas(snapshot: ViewSnapshot, moduleId: string): LayerIntegrationSchemas | null {
+  return loadModuleFormViews(snapshot, moduleId).integrationSchemas;
+}
+
+/** 服务级 loader（v4.7 D38）：四分支穷举（node.provider = 文件 services[s].provider 逐字原值；
+ *  实例层无条件排除——node 级口径）；非空三分支归约一次复合解析。
+ *  ① undefined/'' → resolveDomainBinding 域级联（域 + root 双缺 → 整字段 null）
+ *  ② 非空 string → bare：catalog miss（未知厂商/未供给）→ configSchema:null 不 404（富化非门控）
+ *  ③ 受控内联（isControlledInlineProvider 单源）→ 名 = p.provider；catalog 复合键 > p.configSchema ref
+ *     （H9 逃逸 400 照抛——readInlineSchema 共享路径）
+ *  ④ 其余（null/数组/原始值/坏对象）→ 整字段 null（≡ 谓词 #5 INLINE_PROVIDER_INVALID 同判——
+ *     不放行域级联，防错误 schema 污染坏节点） */
+export function loadServiceIntegrationSchemas(
+  snapshot: ViewSnapshot,
+  service: string,
+): ServiceIntegrationSchemas | null {
+  const p = (snapshot.integrations as { services?: Record<string, { provider?: unknown }> } | null)
+    ?.services?.[service]?.provider;
+  if (p === undefined || p === '') {
+    const binding = resolveDomainBinding(snapshot.integrations, domainOfService(service));
+    return binding.provider === null
+      ? null
+      : { provider: binding.provider, configSchema: resolveServiceConfigSchema(snapshot, binding.provider, service) };
+  }
+  if (typeof p === 'string') {
+    return { provider: p, configSchema: resolveServiceConfigSchema(snapshot, p, service) };
+  }
+  if (isControlledInlineProvider(p)) {
+    const decl = p as { provider: string; configSchema?: string };
+    return { provider: decl.provider, configSchema: resolveServiceConfigSchema(snapshot, decl.provider, service, decl.configSchema) };
+  }
+  return null;
+}

package/src/views/modules.ts

@@ -1,15 +1,36 @@
-import type { ModuleDeclaration, ModuleDetailView, ServiceDemand } from '../dto.js';
+import type { ModuleDeclaration, ModuleDetailView, ProviderBinding, ServiceDemand } from '../dto.js';
 import { AppToolkitError } from '../core/errors.js';
-import { domainOfService, type ViewSnapshot } from './context.js';
+import { moduleDomainWritable, resolveDomainBinding } from '../integrations/domain-binding.js';
+import type { ViewSnapshot } from './context.js';
 
 /**
  * 需求轴/模块静态投影（views/modules；C4）。静态端点结构性零求值（铁律 #3——
  * 无 resolution/issues/contracts 键，永不 503）。
+ * v4.4 D34：domainKeys/providerBindings/configEditable 显式化；integration 仅单域
+ * （writable）时在场——多域/零域/共享键无单键落点；多域回退兜底键机器拆除
+ * （派生统一 = domainOfService 去重集合，moduleDomainWritable 单源）。
+ * 2026-09-16 双缺陷批：loadModulesView 排除 provider 家族包（供给/实施载体非可配置
+ * 业务模块）——walk 声明集与 loadModuleDetailView 不变（装包仍合法，详情保持 200）。
  */
 
-/** GET /modules：纯模块清单（demand 不在——卡片展开 = GET /modules/:m） */
+/** 家族名归一（cli deriveModuleId 同源语义——依赖方向禁 import，故内联）：
+ *  `@tbox.cn/app-provider-x` / `@app/provider-y` / `provider-z` → `provider-*` */
+function familyName(s: string): string {
+  return s.replace(/^@tbox\.cn\/app-/, '').replace(/^@[^/]+\//, '');
+}
+
+/** provider 家族包判定（模块清单排除供给/实施载体；生态三先例同源：verify-cli 排除判定 /
+ *  guard-vendor-neutrality「provider-* 包」/ cli deriveModuleId 家族推导）。install id 与
+ *  包名 basename 双查 = 防 .tbox/app.json 登记漂移纵深；命名而非结构（provider-custom 零贡献
+ *  空壳与「零贡献合法」形态不可结构区分）；未来收敛 = manifest 显式角色标记（届时整体退场）。 */
+function isProviderFamily(mod: { id: string; pkg: string }): boolean {
+  return familyName(mod.id).startsWith('provider-') || familyName(mod.pkg).startsWith('provider-');
+}
+
+/** GET /modules：纯模块清单（demand 不在——卡片展开 = GET /modules/:m；provider 家族包不在清单） */
 export function loadModulesView(snapshot: ViewSnapshot): { modules: ModuleDeclaration[] } {
   const modules: ModuleDeclaration[] = snapshot.walk.modules
+    .filter((mod) => !isProviderFamily(mod))
     .map((mod) => ({
       id: mod.id,
       name: mod.descriptor.name,
@@ -22,12 +43,6 @@ export function loadModulesView(snapshot: ViewSnapshot): { modules: ModuleDeclar
   return { modules };
 }
 
-/** 域键换算（模块服务集派生域键集；单域 = 该域，多域/零域 = 模块 id——与 write.moduleDomainKey 同约定） */
-export function moduleDomainKeyOf(services: ServiceDemand[], moduleId: string): string {
-  const domainKeys = new Set(services.map((s) => domainOfService(s.service)));
-  return domainKeys.size === 1 ? [...domainKeys][0] : moduleId;
-}
-
 /** GET /modules/:module：模块静态一站式（integration 节点原值 + demand；PUT 读对偶） */
 export function loadModuleDetailView(snapshot: ViewSnapshot, moduleId: string): ModuleDetailView {
   const mod = snapshot.walk.modules.find((m) => m.id === moduleId);
@@ -38,11 +53,15 @@ export function loadModuleDetailView(snapshot: ViewSnapshot, moduleId: string):
     service: need.service,
     ...(need.title ? { title: need.title } : {}),
     ...(need.description ? { description: need.description } : {}),
-    required: need.optional !== false,
+    required: need.optional === false,
   }));
+  const w = moduleDomainWritable(snapshot.walk, mod);
   const domains = (snapshot.integrations as { domains?: Record<string, unknown> } | null)?.domains ?? {};
-  const domainKey = moduleDomainKeyOf(services, moduleId);
-  // integration = domains[换算键] 节点原值（D21 编辑预填源）；未配置 = null
-  const integration = (domains[domainKey] as ModuleDetailView['integration']) ?? null;
-  return { integration, services };
+  // integration = domains[换算键] 节点原值（D21 编辑预填源）；未配置 = null；多域/零域/共享键 = null（D34）
+  const integration = w.writable ? ((domains[w.domainKey] as ModuleDetailView['integration']) ?? null) : null;
+  const providerBindings: ProviderBinding[] = w.domainKeys.map((d) => {
+    const binding = resolveDomainBinding(snapshot.integrations, d);
+    return { domain: d, effective: binding.provider, layer: binding.layer };
+  });
+  return { domainKeys: [...w.domainKeys], integration, providerBindings, configEditable: w.writable, services };
 }

package/src/views/providers.ts

@@ -2,7 +2,6 @@ import type { ProviderDetail, ProviderEntry, ProviderServiceDetail, ProvidersVie
 import { AppToolkitError } from '../core/errors.js';
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
-import { walkManifests } from '../assembly/walk-manifests.js';
 import type { ViewSnapshot } from './context.js';
 
 /**
@@ -27,8 +26,9 @@ export function loadProvidersView(snapshot: ViewSnapshot): ProvidersView {
   return { providers: providers.sort((a, b) => a.provider.localeCompare(b.provider)) };
 }
 
-/** GET /providers/:provider：供给足迹（implementations 恒数组——H1 多实现钉版数据源） */
-export function loadProviderDetailView(snapshot: ViewSnapshot, provider: string): ProviderDetail {
+/** GET /providers/:provider：供给足迹（implementations 恒数组——H1 多实现钉版数据源；
+ *  v4.4 F5：include=integrationSchemas 切换态批量——services[s] += { configSchema }（纯 config）） */
+export function loadProviderDetailView(snapshot: ViewSnapshot, provider: string, include?: ReadonlySet<string>): ProviderDetail {
   const impls = snapshot.catalog.providers[provider];
   if (!impls) {
     throw new AppToolkitError('PROVIDER_NOT_FOUND', 404, `厂商 ${provider} 不 ∈ catalog（内联声明厂商无包级档案——身份与表单经组合端点暴露）`);
@@ -40,6 +40,11 @@ export function loadProviderDetailView(snapshot: ViewSnapshot, provider: string)
       bucket.implementations.push({ implementation: entry.implementation, credentialType: entry.credentialType });
     }
   }
+  if (include?.has('integrationSchemas')) {
+    for (const [service, bucket] of Object.entries(services)) {
+      bucket.integrationSchemas = { configSchema: resolveServiceConfigSchema(snapshot, provider, service) };
+    }
+  }
   const entries = Object.values(impls);
   return {
     provider,
@@ -87,33 +92,43 @@ export function loadProviderServiceDetailView(
     implementations.push({ implementation: configured[service]?.implementation ?? `${provider}-inline@1`, credentialType: inlineDeclaration.credentialType });
   }
 
-  // integrationSchemas：catalog schema（复合键）优先；内联声明 configSchema 引用应用 config/schemas/
-  // （路径约束 H9——resolve 落 config/schemas/ 内 + realpath 复核，违例 400）
-  let configSchema: object | null = null;
-  let credentialSchema: object | null = null;
-  const schemaEntry = walkManifests(snapshot.appDir).serviceSchemas[`${provider}\u0000${service}`];
-  if (schemaEntry) {
-    configSchema = readSchemaRef(snapshot.appDir, schemaEntry.packageDir, schemaEntry.configSchema);
-    credentialSchema = readSchemaRef(snapshot.appDir, schemaEntry.packageDir, schemaEntry.credentialSchema);
-  } else if (inlineDeclaration) {
-    // 内联声明 schema 解析：引用文件在 integrations 节点（provider.configSchema）——
-    // 形状同 config/schemas/ 约束（路径来源 = 节点声明，由服务端读应用侧）
-    const inlineSchemaRef = (inline as { configSchema?: string } | undefined)?.configSchema;
-    if (typeof inlineSchemaRef === 'string') {
-      configSchema = readInlineSchema(snapshot.appDir, inlineSchemaRef);
-    }
-  }
+  // integrationSchemas：schema 解析收口 resolveServiceConfigSchema 单源（v4.7 D38——catalog 复合键 >
+  // 内联 ref，等价重构 O6/O7/O15 零改动即证）；内联 ref 来源 = 节点声明（provider.configSchema，
+  // 仅受控内联声明匹配本厂商名时）；路径约束 H9——resolve 落 config/schemas/ 内 + realpath 复核，违例 400
+  const configSchema = resolveServiceConfigSchema(
+    snapshot,
+    provider,
+    service,
+    inlineDeclaration ? (inline as { configSchema?: string } | undefined)?.configSchema : undefined,
+  );
 
   return {
     provider,
     service,
     implementations,
-    integrationSchemas: { configSchema, credentialSchema },
+    integrationSchemas: { configSchema },
   };
 }
 
-/** catalog schema 引用读取（相对包根；缺席 → null——SCHEMA_FILE_MISSING 归谓词 #6） */
-function readSchemaRef(_appDir: string, packageDir: string, ref: string | undefined): object | null {
+/** per-(provider, service) schema 复合解析单源（v4.7 D38）：catalog 复合键（多 impl 声明序首个）
+ *  > 内联 ref（readInlineSchema 保持私有——H9 双钉子不扩暴露）；miss / 未声明 / 文件缺失 → null。
+ *  views 层 \u0000 复合键唯一消费点（组合单体 / 供给轴批量 / 层级核心 / 服务级 include 同源）。
+ *  （D36 registry 批若需跨包消费再升 index 导出——additive 零成本） */
+export function resolveServiceConfigSchema(
+  snapshot: ViewSnapshot,
+  provider: string,
+  service: string,
+  inlineRef?: string,
+): object | null {
+  const entry = snapshot.walk.serviceSchemas[`${provider}\u0000${service}`];
+  if (entry) return readSchemaRef(snapshot.appDir, entry.packageDir, entry.configSchema);
+  if (typeof inlineRef === 'string') return readInlineSchema(snapshot.appDir, inlineRef);
+  return null;
+}
+
+/** catalog schema 引用读取（相对包根；缺席 → null——SCHEMA_FILE_MISSING 归谓词 #6）。
+ *  v4.4 导出共享：层级内嵌（integration-schemas.ts）/ 凭据结构清单（credential-types.ts）同源消费。 */
+export function readSchemaRef(_appDir: string, packageDir: string, ref: string | undefined): object | null {
   if (!ref) return null;
   const file = join(packageDir, ref);
   if (!existsSync(file)) return null;

package/src/views/service-detail.ts

@@ -1,5 +1,6 @@
 import type { ServiceDetail } from '../dto.js';
 import { AppToolkitError } from '../core/errors.js';
+import { isKnownService } from '../integrations/read.js';
 import { suppliedByVendors, type ViewSnapshot } from './context.js';
 
 /**
@@ -10,10 +11,8 @@ import { suppliedByVendors, type ViewSnapshot } from './context.js';
 export function loadServiceDetailView(snapshot: ViewSnapshot, service: string): ServiceDetail {
   const configured = (snapshot.integrations as { services?: Record<string, unknown> } | null)?.services ?? {};
   const demand = snapshot.catalog.services[service];
-  const inVocabulary = snapshot.walk.vocabulary.includes(service);
-  const isConfigured = service in configured;
-  // 404 判据与 /service-resolutions/:service 单源（P9）
-  if (!inVocabulary && !isConfigured) {
+  // 404 判据与写路径单源（P9——A2 isKnownService；词汇成员零 demand/供给/config 仍 200）
+  if (!isKnownService(snapshot.walk.vocabulary, Object.keys(configured), service)) {
     throw new AppToolkitError('SERVICE_NOT_FOUND', 404, `服务 ${service} 不在服务词汇（已装契约包 ∪ 已配置）`);
   }
   // integration = 文件 services[s] 逐字原值（编辑预填源 D21）；无声明 = null

package/src/views/service-resolutions.ts

@@ -1,7 +1,6 @@
 import type {
   BindingLayer,
   ContractsResolution,
-  CredentialEcho,
   EffectiveBinding,
   IntegrationIssue,
   ResolvedInstance,
@@ -11,13 +10,15 @@ import type {
   ServiceResolutionDetail,
   ServiceStatus,
 } from '../dto.js';
-import { maskCredentialValues, readCredentialFile, stemToFilePath } from '../core/credential-format.js';
+import { AppToolkitError } from '../core/errors.js';
+import { resolveDomainBinding } from '../integrations/domain-binding.js';
 import type { ResolvedContracts } from '../core/contracts-resolver.js';
 import type { WalkCatalog } from '../assembly/walk-manifests.js';
 import { domainOfService, isSupplied, type ViewSnapshot } from './context.js';
 
 /**
- * 求值轴投影（views/service-resolutions；C4；FX-2c——B6 effective/credential 填充 + F2 layer 推导）。
+ * 求值轴投影（views/service-resolutions；C4；FX-2c——B6 effective 填充 + F2 layer 推导；
+ * v4.4——D31 Entry.layer 双缺席语义 + D33 凭据内嵌删净（求值路径零凭据文件 I/O））。
  *
  * status(service, instanceId) = contracts.resolveEffectiveService(integrations, service, instanceId,
  * supplies).status——动态（应用自身 contracts 求值单源）。
@@ -26,9 +27,9 @@ import { domainOfService, isSupplied, type ViewSnapshot } from './context.js';
  * required(service) = 任一需求方 required（OR 聚合——demandedServices.optional AND 合并的补语义；
  * 平台/孤儿恒 false）——集成就绪判定单源：pending = Σ (required && status !== 'ok')。
  * **P14 单一形状（结构保证）**：resolveServiceSummary() 单源函数——/service-resolutions map 值 ≡
- * /service-resolutions/:s 的 resolution 摘要基（ServiceResolution extends ServiceResolutionEntry）。
- * **实例条目**：effective（合并绑定投影 + layer 推导——contracts EffectiveService 无 layer，F2）
- * + credential（掩码回显——GET 永无真值；文件缺席省略，缺失归谓词 #1）。
+ * /service-resolutions/:s 的 resolution 摘要基（ServiceResolution extends ServiceResolutionEntry）
+ * ≡ /app 内嵌 map 值 ≡ /modules/:m 内嵌 map 值（v4.4 等价面四处）。
+ * **实例条目**：effective（合并绑定投影 + layer 推导——contracts EffectiveService 无 layer，F2）。
  */
 
 function toContractsResolution(contracts: ResolvedContracts): ContractsResolution {
@@ -51,8 +52,9 @@ interface InstanceEvaluation {
 
 /** 最特异声明层推导（F2）：inst 位 provider 在场 → 'instance'；槽级 → 'service'；域级 → 'module'；
  *  root → 'app'。实例位查找复刻 TIER0 语义（精确键优先、'*' 通配兜底——与 resolveEffectiveService
- *  的 instances 查找层同轴）。 */
-function deriveBindingLayer(snapshot: ViewSnapshot, service: string, instanceId: string): BindingLayer {
+ *  的 instances 查找层同轴）。v4.4 F1：域级段消费 resolveDomainBinding 单源；返回扩 null
+ *  （四层全无 provider 声明 → null——Entry.layer「未配置双缺席」口径，D31）。 */
+function deriveBindingLayer(snapshot: ViewSnapshot, service: string, instanceId: string): BindingLayer | null {
   const integrations = snapshot.integrations as {
     provider?: unknown;
     domains?: Record<string, { provider?: unknown }>;
@@ -63,17 +65,9 @@ function deriveBindingLayer(snapshot: ViewSnapshot, service: string, instanceId:
   const inst = slot?.instances?.[instanceId] ?? slot?.instances?.['*'];
   if (inst && inst.provider !== undefined) return 'instance';
   if (slot?.provider !== undefined) return 'service';
-  if (integrations?.domains?.[domain]?.provider !== undefined) return 'module';
-  return 'app';
-}
-
-/** 凭据掩码回显（O4：GET 永无真值——maskCredentialValues 单源；文件缺席省略） */
-function echoForRef(appDir: string, ref: string | undefined): CredentialEcho | undefined {
-  if (ref === undefined || !ref.startsWith('secret://')) return undefined;
-  const stem = ref.slice('secret://'.length);
-  const file = readCredentialFile(appDir, stem);
-  if (!file) return undefined;
-  return { type: file.type, ref, file: stemToFilePath(stem), masked: maskCredentialValues(file.values) };
+  if (resolveDomainBinding(integrations, domain).layer === 'module') return 'module';
+  if (typeof integrations?.provider === 'string' && integrations.provider.length > 0) return 'app';
+  return null;
 }
 
 /** 求值单实例（resolveEffectiveService 动态求值；ok 态携带完整 effective——layer 推导附） */
@@ -102,7 +96,8 @@ function evaluateInstance(
         implementation: r.effective.implementation,
         ...(r.effective.config !== undefined ? { config: { ...(r.effective.config as Record<string, unknown>) } } : {}),
         ...(r.effective.credentialRef !== undefined ? { credentialRef: r.effective.credentialRef } : {}),
-        layer: deriveBindingLayer(snapshot, service, instanceId),
+        // ok 态可证非空（effective.provider 必有声明来源层）——null 兜底为防御性
+        layer: deriveBindingLayer(snapshot, service, instanceId) ?? 'app',
       },
     };
   }
@@ -117,9 +112,11 @@ function evaluationContracts(snapshot: ViewSnapshot) {
     normalizeInstances?: (input: unknown) => { instances: Array<{ id: string }>; defaultInstanceId: string | null };
     buildSupplyLookup?: (catalog: unknown) => unknown;
   };
-  // 门控（工厂边缘）保证 evaluation/strictValidation 后此断言恒真
+  // 门控（工厂边缘）保证 evaluation/strictValidation 后此断言恒真；A2：裸 Error →
+  // AppToolkitError 503（predicateIssues 的 config === null 早退绕过工厂 assertFn 后，
+  // 本函数是畸形包（严格面在场+求值面缺席）唯一后续拦截点——不再 500）
   if (!mod.resolveEffectiveService || !mod.normalizeInstances) {
-    throw new Error('contracts 求值面缺席（工厂门控应先行拦截）');
+    throw new AppToolkitError('CONTRACTS_NOT_RESOLVED', 503, 'contracts 求值面缺席（契约包形态异常）——重新安装或升级应用 @tbox.cn/app-contracts 后重试');
   }
   return mod as unknown as {
     resolveEffectiveService: (
@@ -167,6 +164,10 @@ export function resolveServiceSummary(
   // 跨实例求值异常聚合（statusMessage 直投）
   const evaluation = evaluateInstance(snapshot, contracts, service, defaultInstanceId, supplies);
 
+  // v4.4 D31：layer = provider 字段来源声明层（默认实例口径，与 status 同轴）；
+  // 未配置（provider 缺席）→ 双缺席——layer 单独在场即「无 provider 的孤儿层」，违 D31 口径
+  const layer = deriveBindingLayer(snapshot, service, defaultInstanceId);
+
   // provider：effective 求值厂商（最特异声明层——跨层事实）；缺席 = 未配置/未解析
   const declaredProvider = (snapshot.integrations as { services?: Record<string, { provider?: unknown }> } | null)
     ?.services?.[service]?.provider;
@@ -193,6 +194,7 @@ export function resolveServiceSummary(
     status: evaluation.status,
     ...(evaluation.statusMessage ? { statusMessage: evaluation.statusMessage } : {}),
     ...(provider !== undefined ? { provider } : {}),
+    ...(provider !== undefined && layer !== null ? { layer } : {}),
     ...(supplied !== undefined ? { supplied } : {}),
     ...(module !== undefined ? { module } : {}),
     ...(required !== undefined ? { required } : {}),
@@ -255,13 +257,12 @@ export function loadServiceResolutionDetail(
 
   const instances: ResolvedInstance[] = instanceIds.map((id) => {
     const evalResult = evaluateInstance(snapshot, contracts, service, id, supplies);
-    const echo = echoForRef(snapshot.appDir, evalResult.effective?.credentialRef);
+    // v4.4 D33：instances[].credential 删净（凭据掩码回显归 GET /credentials——求值路径零凭据文件 I/O）
     return {
       instanceId: id,
       status: evalResult.status,
       ...(evalResult.statusMessage ? { statusMessage: evalResult.statusMessage } : {}),
       ...(evalResult.effective ? { effective: evalResult.effective } : {}),
-      ...(echo ? { credential: echo } : {}),
     };
   });
 
@@ -303,9 +304,14 @@ function buildInheritance(
   });
   const defaultInstanceId = normalized.defaultInstanceId ?? '*';
   const defaultInstance = slot?.instances?.[defaultInstanceId] ?? slot?.instances?.['*'];
+  // module 段消费 resolveDomainBinding 单源（v4.4 F1——与 ProviderBinding / 谓词 #7 同源）
+  const domainBinding = resolveDomainBinding(integrations as Record<string, unknown> | null, domain);
   return [
     { layer: 'app' as const, ...(integrations?.provider ? { provider: integrations.provider } : {}) },
-    { layer: 'module' as const, ...(integrations?.domains?.[domain]?.provider ? { provider: integrations.domains[domain].provider } : {}) },
+    {
+      layer: 'module' as const,
+      ...(domainBinding.layer === 'module' && domainBinding.provider ? { provider: domainBinding.provider } : {}),
+    },
     {
       layer: 'service' as const,
       ...(typeof slot?.provider === 'string' ? { provider: slot.provider } : {}),