@tbox.cn/app-toolkit 0.1.0

package/src/integrations/predicate.ts

@@ -0,0 +1,598 @@
+/**
+ * integration-services 谓词单源（integrations v4；自 CLI doctor/integration-services.ts 迁入——
+ * doctor 第 19 条与 toolkit 工厂 evaluateIntegrationServices 共用此函数，单源不变）。
+ * 纯函数、零副作用、零 I/O——contracts 经 input.contracts 注入（resolver 装配，版本解耦 D3）。
+ *
+ * 结构化输出（H7 v4.3）：IntegrationIssue { severity, code, message, service?, module?, instance? }——
+ * 检查逻辑零改动（~24 处 push 机械加 code/定位字段；level→severity 字段同名随 D22 班车，
+ * severity 取值恒等旧 level——doctor 门控行为等价）。
+ * **code 枚举单源 = 本文件头映射表（additive-only；api.md §5 表与本表同步）**：
+ *   CREDENTIAL_FILE_MISSING      #1     error    effective credentialRef 引用凭据文件不在场
+ *   CREDENTIAL_TYPE_MISMATCH     #2     error    凭据文件 .type 与绑定 credentialType 不一致
+ *   SLOT_NOT_DECLARED            #3     warning  服务槽无消费方声明（拼写/需求方未安装/旧槽位词汇）
+ *   SLOT_NOT_CONFIGURED          #4     warning  需求方缺口（服务槽未配置）
+ *   INSTANCE_SUPPLY_UNMATCHED    #5     error    绑定未命中已装供给（槽级/实例级覆盖）
+ *   IMPL_WITHOUT_PROVIDER        #5/#13 error    impl-only（implementation 缺 provider 绑定组头）
+ *   INLINE_PROVIDER_INVALID      #5     error    内联厂商声明超受控形状（槽级/实例级）
+ *   SCHEMA_FILE_MISSING          #6     error    credentialType schema 引用不存在
+ *   DOMAIN_CONFIG_INVALID        #7     error    root/domains 死配置（键 ∉ 引用厂商 schema properties；
+ *                                                api.md DOMAIN_CONFIG_UNUSED 行预留 warning 级，
+ *                                                现行为 error 恒等旧谓词——doctor 门控等价）
+ *   INSTANCE_KEY_NOT_REGISTERED  #8     error    ByInstance 键/实例键 ∉ 注册表白名单
+ *   REALM_SWITCH_HINT            #9     warning  实现覆盖跨厂商（凭据域切换确认）
+ *   WILDCARD_ALIGNMENT           #10    warning  通配形态齐步提示
+ *   MULTI_INSTANCE_NO_DEFAULT    v4     warning  多实例无 defaultInstanceId（无 scope 访问落全局会话）
+ *   VENDOR_NOT_INSTALLED         #11    error    root/domains 厂商未命中已装供给
+ *   BINDING_UNRESOLVED           #12    error    绑定不可解析（resolveEffectiveService 求值失败）
+ *   DOMAIN_KEY_UNMATCHED         #14    warning  domains 键 ∉ 匹配域集（typo）
+ *   RESOURCE_TYPE_UNKNOWN        #15    error    modules 资源节 type ∉ 词汇表
+ *   RESOURCE_NOT_DECLARED        #16    warning  资源键/资源 id ∉ 模块声明集
+ *   ORPHANED_CREDENTIAL          写后对账 warning  凭据文件不再被引用（toolkit 写路径产出，非本谓词）
+ *
+ * 输入形状（调用方负责装载）：
+ * - integrations：config/integrations.json 解析产物（宽松 Record 透传——严格 zod 校验归模板 loader）
+ * - suppliedProviders：已声明供给（`${vendor}\u0000${implementation}` 拼接键 → 槽集合；同源聚合）
+ * - demandedServices：已声明需求（service → { optional, owners }）
+ * - supplies：派生查表（contracts buildSupplyLookup 产物；缺席 → #12 跳过，M3 降级兼容）
+ * - malls：可选实例 id 白名单（v4 源 = root instances 注册表 ids；缺席 → ByInstance 键检查跳过）
+ * - credentialSchemas：可选（credentialType → schema 文件引用路径；manifest 声明聚合）
+ * - configSchemas：可选（service/slot → schema 文件引用路径）
+ *
+ * 检查族（v3）：
+ * #1 effective credentialRef → 档内凭据文件在场
+ * #2 凭据文件 .type 与绑定 credentialType 对齐（错配 = transport 期「未知认证类型」前置暴露；
+ *    继承绑定（槽级 provider 缺席）经 effective 求值取厂商——supplies 在场时）
+ * #5 实例 impl-only 禁止 + 覆盖命中供给（含槽级内联形状；provider-only = 派生位，合法）
+ * #6 manifest configSchema/credentialSchema 引用文件存在性（内联与 manifest 绑定同查）
+ * #7 root/domains 死配置：root.config/configByInstance/domains[d].config 键 ⊆ 引用厂商（并集）
+ *    各槽 schema properties——引用面 = root.provider ∪ domains.*.provider ∪ 槽级（terse 化防退化）
+ * #8 ByInstance/实例键 ∈ malls 白名单（v4：源 = root instances 注册表 ids——参考表在场时
+ *    激活；'**' 通配键豁免；注册表缺席 → 跳过；domains 键 = 域前缀非 instanceId，不适用）
+ * #9 实现覆盖跨厂商提示（realm switch——凭据域切换确认）
+ * #11 root/domains 厂商未命中已装供给（vendor 集合 = suppliedProviders 键前缀展开）
+ * #12 绑定可解析性：逐 (service, instanceId) 经 contracts resolveEffectiveService 求值
+ *     （级联单源复用，谓词零级联实现），binding-unresolved → error（supplies 缺席 → 跳过）
+ * #13 槽级/实例级 impl-only（implementation 需伴随 provider——provider 是绑定组头；
+ *     zod 之外的第二道防线——doctor 读裸 JSON）
+ * #14 domains 键 ∈ 匹配域集（已配置槽 ∪ 需求声明的 moduleDomainOf 并集；typo → warning）
+ * #15-#16 modules 资源节对账（v5）：type ∉ RESOURCE_TYPE_IDS → error（裸 JSON 预启动反馈）；
+ *     键 ∉ 已装模块 id 集 / 资源 id ∉ 模块 manifest contributes.resources 声明集（声明非空时）
+ *     → warning（moduleResourceNeeds 缺席 → 需求面检查跳过，M3 降级先例）
+ */
+import type { EvaluationExports } from '../core/contracts-expected.js';
+
+/** contracts 注入面（resolver 装配产物运行时视图 = EvaluationExports 求值子集） */
+export type PredicateContracts = Pick<
+  EvaluationExports,
+  'resolveEffectiveService' | 'buildSupplyLookup' | 'moduleDomainOf' | 'normalizeInstances' | 'RESOURCE_TYPE_IDS'
+>;
+
+/** 派生查表形状（contracts buildSupplyLookup 产物；结构等价 TIER0 SupplyLookup——谓词零 contracts 静态依赖） */
+export type SupplyLookup = Record<string, readonly string[]>;
+
+export interface IntegrationServicePredicateInput {
+  integrations: {
+    provider?: string;
+    domains?: Record<string, { provider?: string; config?: Record<string, unknown> }>;
+    config?: Record<string, unknown>;
+    configByInstance?: Record<string, Record<string, unknown>>;
+    credentialRef?: string;
+    credentialRefByInstance?: Record<string, string>;
+    services: Record<
+      string,
+      {
+        provider?: string | Record<string, unknown>;
+        implementation?: string;
+        config?: Record<string, unknown>;
+        credentialRef?: string;
+        instances?: Record<string, { enabled?: boolean; provider?: unknown; implementation?: unknown; credentialRef?: string }>;
+      }
+    >;
+    /** v4 部署实例注册表（参考表——#8 白名单源 + 多实例无默认 warning） */
+    instances?: Array<{ id: string; name?: string; attributes?: Record<string, unknown> }>;
+    /** v4 默认实例（normalizeInstances 解析语义：显式 ?? 单候选唯一解） */
+    defaultInstanceId?: string | null;
+    /** v5 模块资源绑定（modules 节——宽松透传；严格 zod 归模板 loader） */
+    modules?: Record<string, { resources?: Record<string, { type?: unknown }> }>;
+  };
+  /** 已声明供给（`${vendor}\u0000${implementation}` → 槽集合；credentialType 供 #2/#6 绑定侧对齐） */
+  suppliedProviders: Record<string, { services: string[]; owner: string; credentialType?: string }>;
+  /** 已声明需求（service → { optional, owners }) */
+  demandedServices: Record<string, { optional: boolean; owners: string[] }>;
+  /** 派生查表（buildSupplyLookup 产物；缺席 → #12 跳过 + #2 继承绑定不查 credentialType） */
+  supplies?: SupplyLookup;
+  /** malls 白名单（deployments 控制面 extract；缺席 → ByInstance 键检查跳过） */
+  malls?: string[];
+  /** credentialType → schema 文件引用缺失（manifest 声明指向缺失文件；#6） */
+  credentialSchemaMissing?: Record<string, boolean>;
+  /** 厂商 → 槽 schema properties 键集（#7 用；调用方从 manifest configSchema 引用解析） */
+  vendorConfigKeys?: Record<string, Set<string>>;
+  /** 厂商 → configSchema 引用文件缺失（#7 跳过该厂商——无 schema 不能判死配置） */
+  vendorConfigSchemaMissing?: Record<string, boolean>;
+  /** 凭据文件缺失（#1：credentialRef stem → 档内 credentials/<stem>.json 在场；域中立注入） */
+  credentialFileMissing?: Record<string, boolean>;
+  /** 凭据文件 .type（stem → type；#2 对齐判定——文件无 type 则缺键，跳过） */
+  credentialFileType?: Record<string, string | undefined>;
+  /** #9：实现覆盖跨厂商提示位（CLI 侧组装） */
+  realmSwitchHints?: string[];
+  /** v5：已装模块 id → manifest contributes.resources 声明 id 集（值空集 = 无声明，资源级跳过；
+   *  缺席 = 无需求面信息——键未知/资源未声明检查跳过，type 检查恒跑） */
+  moduleResourceNeeds?: Record<string, ReadonlySet<string>>;
+}
+
+/** 结构化 issue（H7 v4.3）：code 枚举单源 = 本文件头映射表（additive-only） */
+export interface IntegrationServiceIssue {
+  severity: 'error' | 'warning';
+  code: string;
+  message: string;
+  service?: string;
+  module?: string;
+  instance?: string;
+}
+
+/** 内联厂商声明受控形状（v2：provider/credentialType/configSchema） */
+export function isControlledInlineProvider(raw: unknown): boolean {
+  if (!raw || typeof raw !== 'object') return false;
+  const keys = Object.keys(raw);
+  const allowed = new Set(['provider', 'credentialType', 'configSchema']);
+  if (!keys.every((k) => allowed.has(k))) return false;
+  const p = raw as { provider?: unknown; credentialType?: unknown; configSchema?: unknown };
+  return (
+    typeof p.provider === 'string' && p.provider.length > 0 &&
+    typeof p.credentialType === 'string' && p.credentialType.length > 0 &&
+    (p.configSchema === undefined || typeof p.configSchema === 'string')
+  );
+}
+
+/** #8 单键判定（单源：谓词内部 noteMissingMallKey 与写路径 checkInstanceKeys 共用）。
+ *  '*' 通配键豁免（contracts WILDCARD_INSTANCE_KEY；谓词零依赖内联）。 */
+function instanceKeyIssue(key: string, where: string, mallsIndex: ReadonlySet<string>): IntegrationServiceIssue | null {
+  if (key === '*') return null;
+  if (mallsIndex.has(key)) return null;
+  return {
+    severity: 'error',
+    code: 'INSTANCE_KEY_NOT_REGISTERED',
+    instance: key,
+    message: `integrations: ${where} 键 ${key} 不在 malls 白名单内（${[...mallsIndex].join(', ')}）`,
+  };
+}
+
+/** #8 检查族导出（FX-2b 单源）：toolkit 写路径轻量复查（registryCheck）消费——
+ *  覆盖 configByInstance / credentialRefByInstance / services[s].instances 三键位；
+ *  malls = root instances 注册表 ids（参考表缺席 → 消费方跳过，勿传空集）。 */
+export function checkInstanceKeys(
+  integrations: {
+    configByInstance?: Record<string, unknown>;
+    credentialRefByInstance?: Record<string, unknown>;
+    services?: Record<string, { instances?: Record<string, unknown> }>;
+  },
+  malls: readonly string[],
+): IntegrationServiceIssue[] {
+  const mallsIndex = new Set(malls);
+  const out: IntegrationServiceIssue[] = [];
+  const note = (key: string, where: string): void => {
+    const issue = instanceKeyIssue(key, where, mallsIndex);
+    if (issue) out.push(issue);
+  };
+  for (const key of Object.keys(integrations.configByInstance ?? {})) note(key, 'configByInstance');
+  for (const key of Object.keys(integrations.credentialRefByInstance ?? {})) note(key, 'credentialRefByInstance');
+  for (const [serviceId, slot] of Object.entries(integrations.services ?? {})) {
+    for (const key of Object.keys(slot.instances ?? {})) note(key, `services.${serviceId}.instances`);
+  }
+  return out;
+}
+
+/** 谓词主体：integrations 配置 × catalog 声明 交叉校验（error/warning 分级；contracts 注入） */
+export function evaluateIntegrationServices(
+  input: IntegrationServicePredicateInput & { contracts: PredicateContracts },
+): IntegrationServiceIssue[] {
+  const issues: IntegrationServiceIssue[] = [];
+  const contracts = input.contracts;
+  const { integrations, suppliedProviders, demandedServices, supplies, malls, credentialSchemaMissing, vendorConfigKeys, vendorConfigSchemaMissing, credentialFileMissing, credentialFileType, realmSwitchHints, moduleResourceNeeds } = input;
+
+  // #8 白名单索引（malls 缺席 → 跳过 ByInstance 键检查）
+  const mallsIndex = malls ? new Set(malls) : undefined;
+
+  // #9：实现覆盖跨厂商提示（实例级双字段在场、厂商 ≠ 槽级厂商）
+  for (const hint of realmSwitchHints ?? []) {
+    issues.push({ severity: 'warning', code: 'REALM_SWITCH_HINT', message: hint });
+  }
+
+  /** #11 供给厂商索引：suppliedProviders 键（`${vendor}\u0000${impl}`）前缀展开 */
+  const installedVendors = new Set(
+    Object.keys(suppliedProviders)
+      .map((k) => k.slice(0, k.indexOf('\u0000')))
+      .filter((v) => v.length > 0),
+  );
+
+  /** 绑定 credentialType 求值（#2/#6 共用）：实例覆盖（恒字符串）?? 槽级（manifest 或内联）
+   *  ?? effective 求值（v3 继承绑定——槽级 provider 缺席时经 contracts 单源取有效厂商；
+   *  supplies 缺席 → undefined 跳过，不误报） */
+  const boundCredentialType = (
+    serviceId: string,
+    service: {
+      provider?: string | Record<string, unknown>;
+      implementation?: string;
+      instances?: Record<string, { enabled?: boolean; provider?: unknown; implementation?: unknown; credentialRef?: string }>;
+    },
+    instance?: { provider?: unknown; implementation?: unknown },
+    instanceId?: string,
+  ): string | undefined => {
+    if (
+      typeof instance?.provider === 'string' && typeof instance.implementation === 'string'
+      && instance.provider && instance.implementation
+    ) {
+      return suppliedProviders[providerKey(instance.provider, instance.implementation)]?.credentialType;
+    }
+    if (typeof service.provider === 'string' && typeof service.implementation === 'string') {
+      return suppliedProviders[providerKey(service.provider, service.implementation)]?.credentialType;
+    }
+    const ct = (service.provider as Record<string, unknown> | undefined)?.credentialType;
+    if (typeof ct === 'string') return ct;
+    // v3 继承绑定：effective 求值取 (provider, implementation)（supplies 在场才可判）
+    if (!supplies) return undefined;
+    const sk = instanceId ?? Object.keys(service.instances ?? {})[0] ?? '';
+    const r = contracts.resolveEffectiveService(integrations as never, serviceId, sk, supplies);
+    if (r.status !== 'ok' || typeof r.effective.provider !== 'string') return undefined;
+    return suppliedProviders[providerKey(r.effective.provider, r.effective.implementation)]?.credentialType;
+  };
+
+  // #1 + #2：effective credentialRef 双通道工件检查（文件在场 + .type 对齐）
+  if (credentialFileMissing || credentialFileType) {
+    for (const [serviceId, service] of Object.entries(integrations.services)) {
+      for (const [instanceId, instance] of Object.entries(service.instances ?? {})) {
+        if (instance.enabled === false) continue;
+        const ref = instance.credentialRef ?? service.credentialRef
+          ?? integrations.credentialRefByInstance?.[instanceId] ?? integrations.credentialRef;
+        if (typeof ref !== 'string' || !ref.startsWith('secret://')) continue;
+        const stem = ref.slice('secret://'.length);
+        // #1：凭据文件在场（credentialFileMissing 由 CLI 探测注入）
+        if (credentialFileMissing?.[stem] === true) {
+          issues.push({
+            severity: 'error',
+            code: 'CREDENTIAL_FILE_MISSING',
+            service: serviceId,
+            instance: instanceId,
+            message: `integrations: 凭据文件缺失 ${stem}（${serviceId}@${instanceId} effective ref=${ref}；档内 config/credentials/ 无此文件）`,
+          });
+        }
+        // #2：凭据文件 .type 与绑定 credentialType 对齐（.type 错配 = transport 创建期
+        //   「未知认证类型」运行时失败的启动期前置暴露；文件无 .type / 绑定侧未知 → 跳过）
+        const fileType = credentialFileType?.[stem];
+        if (fileType) {
+          const boundType = boundCredentialType(serviceId, service, instance, instanceId);
+          if (boundType && fileType !== boundType) {
+            issues.push({
+              severity: 'error',
+              code: 'CREDENTIAL_TYPE_MISMATCH',
+              service: serviceId,
+              instance: instanceId,
+              message: `integrations: 凭据文件 ${stem}.json type=${fileType} 与绑定 credentialType ${boundType} 不一致（${serviceId}@${instanceId}——transport 创建期将按 type 选策略）`,
+            });
+          }
+        }
+      }
+    }
+  }
+
+  const noteMissingMallKey = (key: string, where: string): void => {
+    if (!mallsIndex) return;
+    const issue = instanceKeyIssue(key, where, mallsIndex);
+    if (issue) issues.push(issue);
+  };
+
+  for (const [key] of Object.entries(integrations.configByInstance ?? {})) noteMissingMallKey(key, 'configByInstance');
+  for (const [key] of Object.entries(integrations.credentialRefByInstance ?? {})) noteMissingMallKey(key, 'credentialRefByInstance');
+
+  // #10：通配齐步检查（v4：instances 键缺席 = 通配激活，与 '*' 同列通配形态）——
+  //      通配槽与显式键集槽混布（login 通配而业务槽显式键集 → 动态 mallId 登录成功但业务
+  //      INSTANCE_NOT_FOUND；反向 → 业务成功登录失败）。合法但高度可疑，warning 级。
+  const wildcardServices = Object.entries(integrations.services)
+    .filter(([, s]) => s.instances == null || s.instances['*'] != null).map(([id]) => id);
+  if (wildcardServices.length > 0) {
+    const nonWildcard = Object.entries(integrations.services)
+      .filter(([, s]) => s.instances != null && s.instances['*'] == null).map(([id]) => id);
+    if (nonWildcard.length > 0) {
+      issues.push({
+        severity: 'warning',
+        code: 'WILDCARD_ALIGNMENT',
+        message: `integrations: 激活形态不对称（通配：${wildcardServices.join(', ')}；显式键集：${nonWildcard.join(', ')}）——动态 mallId 将在显式键集槽上 INSTANCE_NOT_FOUND（provider 业务限制表达位），确认是否齐步`,
+      });
+    }
+  }
+
+  // v4 多实例无默认：instances ≥2 且 defaultInstanceId 未解析（显式/唯一解皆无）→
+  // 无 scope 参数访问落全局会话（mall 模板 defaultContext 不注入）——warning 级提示
+  const normalized = contracts.normalizeInstances({
+    instances: integrations.instances as never,
+    defaultInstanceId: integrations.defaultInstanceId,
+  });
+  if (normalized.instances.length >= 2 && normalized.defaultInstanceId === null) {
+    issues.push({
+      severity: 'warning',
+      code: 'MULTI_INSTANCE_NO_DEFAULT',
+      message: `integrations: ${normalized.instances.length} 个部署实例（${normalized.instances.map((i) => i.id).join(', ')}）均无 defaultInstanceId——无 scope 参数访问将落全局会话（默认商圈不注入）`,
+    });
+  }
+
+  for (const [serviceId, service] of Object.entries(integrations.services)) {
+    // 1. 槽未知（不在任何 manifest 需求声明，也非已知供给域）
+    const demanded = demandedServices[serviceId];
+    if (!demanded) {
+      issues.push({
+        severity: 'warning',
+        code: 'SLOT_NOT_DECLARED',
+        service: serviceId,
+        message: `integrations: 服务槽 ${serviceId} 无消费方声明（拼写错误或需求方未安装）——若为拆分前旧槽位词汇（member.main/parking.main/promotion.read/shopping-guide.main），参照 cookbook·app-config 槽位迁移配方展开为新槽`,
+      });
+    }
+
+    // 2. 槽级 provider 校验（v3：provider 缺席 = 继承/派生位——跳过，可解析性归 #12）
+    if (typeof service.provider === 'string') {
+      if (typeof service.implementation === 'string'
+        && !suppliedProviders[providerKey(service.provider, service.implementation)]) {
+        issues.push({
+          severity: 'error',
+          code: 'INSTANCE_SUPPLY_UNMATCHED',
+          service: serviceId,
+          message: `integrations: provider ${service.provider}/${service.implementation} 未命中已装供给（${serviceId} 槽级）——装对应 provider 包或改绑`,
+        });
+      }
+    } else if (service.provider !== undefined && !isControlledInlineProvider(service.provider)) {
+      issues.push({
+        severity: 'error',
+        code: 'INLINE_PROVIDER_INVALID',
+        service: serviceId,
+        message: `integrations: 内联 provider 超受控形状（${serviceId} 槽级；允许键 provider/credentialType/configSchema）`,
+      });
+    }
+
+    // 2b. 绑定 credentialType 的 schema 引用存在性（#6——manifest 绑定与内联声明同查）
+    if (credentialSchemaMissing) {
+      const ct = boundCredentialType(serviceId, service);
+      if (ct && credentialSchemaMissing[ct] === true) {
+        issues.push({
+          severity: 'error',
+          code: 'SCHEMA_FILE_MISSING',
+          service: serviceId,
+          message: `integrations: credentialType ${ct} 的 schema 引用不存在（${serviceId}；manifest 声明指向缺失文件）`,
+        });
+      }
+    }
+
+    // 2c. 双字段同现同缺（#5 槽级内联形态校验）
+    if (typeof service.provider === 'object' && typeof service.implementation !== 'string') {
+      issues.push({
+        severity: 'error',
+        code: 'IMPL_WITHOUT_PROVIDER',
+        service: serviceId,
+        message: `integrations: 内联厂商声明必须同时提供 implementation（${serviceId} 槽级）`,
+      });
+    }
+
+    // 3. 实例级校验（v4：instances 缺席槽 = 通配激活——无显式实例键可校验）
+    for (const [instanceId, instance] of Object.entries(service.instances ?? {})) {
+      // #8：实例键 ∈ malls 白名单
+      noteMissingMallKey(instanceId, `services.${serviceId}.instances`);
+      // #5（v3）：impl-only 禁止（implementation 需伴随 provider——provider 是绑定组头；
+      //   provider-only = 派生位，合法；双缺 = 继承位，合法）
+      const hasProvider = instance.provider !== undefined;
+      const hasImpl = instance.implementation !== undefined;
+      if (hasImpl && !hasProvider) {
+        issues.push({
+          severity: 'error',
+          code: 'IMPL_WITHOUT_PROVIDER',
+          service: serviceId,
+          instance: instanceId,
+          message: `integrations: 实例级 implementation 需伴随 provider（${serviceId}@${instanceId}——impl-only 禁止，provider 是绑定组头）`,
+        });
+      }
+      // #5：实例级覆盖命中供给（双字段在场时）
+      if (hasProvider && hasImpl) {
+        const p = instance.provider;
+        const i = instance.implementation;
+        if (typeof p === 'string' && typeof i === 'string') {
+          if (!suppliedProviders[providerKey(p, i)]) {
+            issues.push({
+              severity: 'error',
+              code: 'INSTANCE_SUPPLY_UNMATCHED',
+              service: serviceId,
+              instance: instanceId,
+              message: `integrations: 实例级 provider 覆盖 ${p}/${i} 未命中已装供给（${serviceId}@${instanceId}）`,
+            });
+          }
+        } else if (!isControlledInlineProvider(p)) {
+          issues.push({
+            severity: 'error',
+            code: 'INLINE_PROVIDER_INVALID',
+            service: serviceId,
+            instance: instanceId,
+            message: `integrations: 实例级内联 provider 超受控形状（${serviceId}@${instanceId}）`,
+          });
+        }
+      }
+    }
+  }
+
+  // #11：root/domains 厂商存在性（继承层声明必须命中已装供给——vendor 集合 = 供给键前缀展开；
+  //   槽级内联声明不在本检查范围——F5 先声明后实施闭环归 #2/#6 形状检查）
+  for (const [where, vendor] of [
+    ['root', integrations.provider],
+    ...Object.entries(integrations.domains ?? {}).map(([d, cfg]): [string, string | undefined] => [`domains.${d}`, cfg?.provider]),
+  ] as Array<[string, string | undefined]>) {
+    if (typeof vendor !== 'string' || vendor.length === 0) continue;
+    if (!installedVendors.has(vendor)) {
+      issues.push({
+        severity: 'error',
+        code: 'VENDOR_NOT_INSTALLED',
+        module: where.startsWith('domains.') ? where.slice('domains.'.length) : undefined,
+        message: `integrations: ${where} provider ${vendor} 未命中已装供给——装对应 provider 包或 provider use 改绑`,
+      });
+    }
+  }
+
+  // #12：绑定可解析性（级联单源复用 contracts resolveEffectiveService——谓词零级联实现；
+  //   supplies 缺席 → 整体跳过，M3 降级兼容 F5 页面无 catalog 形态。
+  //   v4：instances 键缺席槽 = 通配激活——以 '' 探测求值（继承链可解析性仍需覆盖））
+  if (supplies) {
+    for (const [serviceId, service] of Object.entries(integrations.services)) {
+      const instanceIds = service.instances ? Object.keys(service.instances) : [''];
+      for (const instanceId of instanceIds) {
+        const r = contracts.resolveEffectiveService(integrations as never, serviceId, instanceId, supplies);
+        if (r.status === 'binding-unresolved') {
+          issues.push({ severity: 'error', code: 'BINDING_UNRESOLVED', service: serviceId, instance: instanceId || undefined, message: `integrations: ${r.message}` });
+        }
+      }
+    }
+  }
+
+  // #13：槽级 impl-only（zod 之外的第二道防线——doctor 读裸 JSON；实例级归 #5）
+  for (const [serviceId, service] of Object.entries(integrations.services)) {
+    if (service.implementation !== undefined && service.provider === undefined) {
+      issues.push({
+        severity: 'error',
+        code: 'IMPL_WITHOUT_PROVIDER',
+        service: serviceId,
+        message: `integrations: 槽级 implementation 需伴随 provider（${serviceId}——impl-only 禁止，provider 是绑定组头）`,
+      });
+    }
+  }
+
+  // #14：domains 键 ∈ 匹配域集（已配置槽 ∪ 需求声明的 moduleDomainOf 并集；
+  //   typo 域 = 永不生效的静默死配置 → warning 级，staged 域（先行声明）不告警）
+  const matchedDomains = new Set<string>([
+    ...Object.keys(integrations.services).map((s) => contracts.moduleDomainOf(s)),
+    ...Object.keys(demandedServices).map((s) => contracts.moduleDomainOf(s)),
+  ]);
+  for (const d of Object.keys(integrations.domains ?? {})) {
+    if (!matchedDomains.has(d)) {
+      issues.push({
+        severity: 'warning',
+        code: 'DOMAIN_KEY_UNMATCHED',
+        module: d,
+        message: `integrations: domains.${d} 无对应槽位或需求声明（域前缀拼写错误？——键 = 槽位 id 点分前缀）`,
+      });
+    }
+  }
+
+  // #7：root/domains 死配置 —— root.config/configByInstance/domains[d].config 键 ⊆ 引用厂商
+  //   （跨厂商取并集）各槽 schema properties 键集。并集语义：混布部署中属 A 厂商的 root 键
+  //   不应被 B 厂商判死。引用面（v3）= root.provider ∪ domains.*.provider ∪ 槽级（含内联
+  //   .provider）——terse 化后槽级双字段退场，引用面不上移即静默漏检（N2）。
+  //   保守跳过条件（无法确证即不判死——误报会阻断部署）：任一引用厂商 configSchema 文件缺失，
+  //   或被绑定但零 configSchema 声明（如 mock local 供给——无 schema 知识）。
+  if (vendorConfigKeys) {
+    const referenced = new Set<string>();
+    let schemaIncomplete = false;
+    const noteVendor = (vendor: string | undefined): void => {
+      if (typeof vendor !== 'string' || vendor.length === 0) return;
+      if (vendorConfigKeys[vendor]) referenced.add(vendor);
+      // 零 schema 知识的引用厂商（不在 keys 也不在 missing = 从未声明 configSchema）→ 整体跳过
+      if (!vendorConfigKeys[vendor] && !vendorConfigSchemaMissing?.[vendor]) schemaIncomplete = true;
+      if (vendorConfigSchemaMissing?.[vendor]) schemaIncomplete = true;
+    };
+    noteVendor(integrations.provider);
+    for (const cfg of Object.values(integrations.domains ?? {})) noteVendor(cfg?.provider);
+    for (const slot of Object.values(integrations.services)) {
+      const inline = slot.provider as Record<string, unknown> | undefined;
+      noteVendor(typeof slot.provider === 'string' ? slot.provider : inline?.provider as string | undefined);
+    }
+    if (referenced.size > 0 && !schemaIncomplete) {
+      const allowed = new Set<string>();
+      for (const v of referenced) for (const k of vendorConfigKeys[v] ?? []) allowed.add(k);
+      const checkLayer = (layer: Record<string, unknown> | undefined, where: string, allowedKeys?: Set<string>): void => {
+        for (const [k] of Object.entries(layer ?? {})) {
+          if (!(allowedKeys ?? allowed).has(k)) {
+            issues.push({
+              severity: 'error',
+              code: 'DOMAIN_CONFIG_INVALID',
+              message: `integrations: ${where} 键 ${k} 不在引用厂商（${[...referenced].join('/')}）任何槽 schema properties 内（死配置）`,
+            });
+          }
+        }
+      };
+      checkLayer(integrations.config, 'root.config');
+      for (const [k, v] of Object.entries(integrations.configByInstance ?? {})) checkLayer(v, `root.configByInstance[${k}]`);
+      // 域级 config：键 ⊆ 该域生效厂商（domains[d].provider ?? root.provider）schema——
+      // 生效厂商缺席（全走槽级覆盖）→ 用全局并集；生效厂商 schema 缺失 → 跳过该域
+      for (const [d, cfg] of Object.entries(integrations.domains ?? {})) {
+        if (!cfg?.config) continue;
+        const domainVendor = typeof cfg.provider === 'string' && cfg.provider
+          ? cfg.provider
+          : (typeof integrations.provider === 'string' ? integrations.provider : undefined);
+        if (domainVendor === undefined) {
+          checkLayer(cfg.config, `domains.${d}.config`);
+          continue;
+        }
+        const vendorKeys = vendorConfigKeys[domainVendor];
+        if (!vendorKeys || vendorConfigSchemaMissing?.[domainVendor]) continue;
+        checkLayer(cfg.config, `domains.${d}.config`, new Set(vendorKeys));
+      }
+    }
+  }
+
+  // 4. 需求方缺口（warning 级——缺省/禁用是合法部署态）
+  for (const [serviceId, demand] of Object.entries(demandedServices)) {
+    const configured = integrations.services[serviceId];
+    if (!configured) {
+      issues.push({
+        severity: 'warning',
+        code: 'SLOT_NOT_CONFIGURED',
+        service: serviceId,
+        message: `integrations: 服务槽 ${serviceId}（需求方 ${demand.owners.join(', ')}）未配置${demand.optional ? '（可选槽）' : '（必需槽——模块将走降级链）'}`,
+      });
+      continue;
+    }
+    const disabled = Object.entries(configured.instances ?? {})
+      .filter(([, inst]) => inst.enabled === false)
+      .map(([instanceId]) => instanceId);
+    if (disabled.length > 0) {
+      issues.push({
+        severity: 'warning',
+        code: 'INSTANCE_DISABLED',
+        service: serviceId,
+        instance: disabled.join(', '),
+        message: `integrations: ${serviceId} 实例禁用（${disabled.join(', ')}）`,
+      });
+    }
+  }
+
+  // #15-#16：modules 资源节对账（v5）——type 非法恒查（裸 JSON 预启动反馈）；
+  // 键未知 / 资源未声明需需求面（moduleResourceNeeds 在场）；空声明集 = 老模块/无资源模块，跳过资源级
+  for (const [moduleId, cfg] of Object.entries(integrations.modules ?? {})) {
+    const declared = moduleResourceNeeds?.[moduleId];
+    if (moduleResourceNeeds && !(moduleId in moduleResourceNeeds)) {
+      issues.push({
+        severity: 'warning',
+        code: 'RESOURCE_NOT_DECLARED',
+        module: moduleId,
+        message: `integrations: modules.${moduleId} 未命中已装模块（键 = install id——检查 .tbox/app.json entry.id / packages/ 目录名）`,
+      });
+    }
+    for (const [resourceId, spec] of Object.entries(cfg?.resources ?? {})) {
+      const t = spec?.type;
+      if (typeof t !== 'string' || !(contracts.RESOURCE_TYPE_IDS as readonly string[]).includes(t)) {
+        issues.push({
+          severity: 'error',
+          code: 'RESOURCE_TYPE_UNKNOWN',
+          module: moduleId,
+          message: `integrations: modules.${moduleId}.resources.${resourceId} type 非法（${String(t)}；词汇表 = ${contracts.RESOURCE_TYPE_IDS.join('/')}）`,
+        });
+      }
+      if (declared && declared.size > 0 && !declared.has(resourceId)) {
+        issues.push({
+          severity: 'warning',
+          code: 'RESOURCE_NOT_DECLARED',
+          module: moduleId,
+          message: `integrations: modules.${moduleId}.resources.${resourceId} 未被模块 manifest contributes.resources 声明`,
+        });
+      }
+    }
+  }
+
+  return issues;
+}
+
+function providerKey(vendor: string, implementation: string): string {
+  return `${vendor}\u0000${implementation}`;
+}

package/src/integrations/read.ts

@@ -0,0 +1,53 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { resolveContractsForApp, type ResolvedContracts } from '../core/contracts-resolver.js';
+import type { FileCache } from '../core/file-cache.js';
+
+/**
+ * integrations.json 文件级读（C3-4 read）。
+ * 严格校验面（≥0.9）在场 → contracts parseIntegrationsConfig（assertNoInlineSecrets →
+ * 旧键直切防线 → zod strict）；缺席/降级 → 原文 JSON 透传（谓词宽松透传语义——
+ * doctor 读裸 JSON 先例；写路径门控在工厂边缘，读不阻断静态面）。
+ */
+
+export interface ReadIntegrationsResult {
+  /** 解析产物（严格 zod 产物或原文 JSON；文件缺席 → null） */
+  config: Record<string, unknown> | null;
+  /** 严格校验是否已应用（false = 原文透传——<0.9 或未解析降级态） */
+  strict: boolean;
+  contracts: ResolvedContracts;
+}
+
+const INTEGRATIONS_FILE = join('config', 'integrations.json');
+
+/** 文件级读（cache 注入优先；无 cache 直读——目录枚举零缓存约束不涉文件内容） */
+export function readIntegrationsConfig(
+  appDir: string,
+  cache?: FileCache,
+): Record<string, unknown> | null {
+  const file = join(appDir, INTEGRATIONS_FILE);
+  const parse = (raw: string): Record<string, unknown> => JSON.parse(raw) as Record<string, unknown>;
+  if (cache) return cache.read(file, parse) ?? null;
+  if (!existsSync(file)) return null;
+  try {
+    return parse(readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/** 带严格校验的读（求值/写路径用——门控由工厂边缘断言，本函数按 strictValidation 分派） */
+export async function readIntegrationsStrict(
+  appDir: string,
+  cache?: FileCache,
+): Promise<ReadIntegrationsResult> {
+  const contracts = await resolveContractsForApp(appDir);
+  const raw = readIntegrationsConfig(appDir, cache);
+  if (raw === null) return { config: null, strict: false, contracts };
+  if (contracts.strictValidation && contracts.module.parseIntegrationsConfig) {
+    // 严格链：assertNoInlineSecrets → 旧键直切防线 → zod strict（contracts 单源）
+    const parsed = contracts.module.parseIntegrationsConfig(raw);
+    return { config: parsed as unknown as Record<string, unknown>, strict: true, contracts };
+  }
+  return { config: raw, strict: false, contracts };
+}