@tbox.cn/app-toolkit 0.3.0 → 0.5.0

package/src/integrations/prune-bindings.ts

@@ -0,0 +1,205 @@
+import { existsSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import type { ResolvedContracts } from '../core/contracts-resolver.js';
+import { resolveContractsForApp } from '../core/contracts-resolver.js';
+import { expandEnvVars } from '../core/env-expansion.js';
+import { writeAtomic } from '../core/fskit.js';
+import { walkManifests } from '../assembly/walk-manifests.js';
+import { readIntegrationsConfig } from './read.js';
+import { isControlledInlineProvider } from './predicate.js';
+import { reconcileOrphanCredentials } from './credentials.js';
+import { evaluateAppIntegrationIssues } from './evaluate-app.js';
+
+/**
+ * integrations.json 死绑定清理（cli-remove-prune-and-new D2 核心件）。
+ *
+ * 不变式：**删除判据 ≡ doctor integration-services 报错判据（构造性同源）**——消费 doctor 同一
+ * 共享求值器 evaluateAppIntegrationIssues 的结构化 issue，code 白名单
+ * {VENDOR_NOT_INSTALLED, BINDING_UNRESOLVED, MODULE_CONFIG_DEAD} + 守卫（绑定引用链候选
+ * provider ∈ installedVendors 即保留，排除活厂商错配）→ 删除域严格 = "供给载体消亡"。
+ * v6：模块卸载 → modules[m] **整节点确定性清理**（provider+config+resources——D4：
+ * 模块消亡清理 vs 集成位编辑保全不矛盾；MODULE_CONFIG_DEAD 为判据源）。
+ *
+ * 由此推论（均已实证）：需求侧孤儿绑定（demand 消失、供给在场）保留——doctor 判其合法；用户
+ * 预配置绑定受保护；一次 remove 自愈全文件历史死债；凭据类 issue（CREDENTIAL_FILE_MISSING 等）
+ * 刻意不进白名单，原样保留。
+ *
+ * 写侧三防线（镜像 write core）：归一化（空节点删键）→ parseIntegrationsConfig
+ * 严格校验（失败弃写）→ writeAtomic。凭据孤儿只报告不清理（D9——与 DELETE 管线现行为一致）。
+ * 全空（无任何存活绑定）→ 删文件——ensureMockBindings（缺席即生成）在重装供给时再生闭环。
+ *
+ * 最佳努力语义：谓词不可用（contracts 未安装/降级、env 缺失、求值 throw）→ skipped 返回 +
+ * 文件原样，绝不阻断 remove 本体。
+ */
+
+export interface PruneResult {
+  /** 被清除的绑定节点描述（remove 日志行，如 'root.provider=mock' / 'services.member.account'） */
+  removed: string[];
+  /** 孤儿凭据（D9 只报告不清理——reconcileOrphanCredentials 产物 message） */
+  orphanCredentials: string[];
+  /** 跳过原因（正常路径 undefined；not-configured = integrations.json 缺席，兼容态零动作） */
+  skipped?: 'predicate-unavailable' | 'validation-failed' | 'not-configured';
+}
+
+/** 宽松形状（谓词输入同族子集——doctor 读裸 JSON 先例，严格 zod 归模板 loader） */
+interface PruneDoc {
+  provider?: string;
+  config?: Record<string, unknown>;
+  configByInstance?: Record<string, Record<string, unknown>>;
+  credentialRef?: string;
+  credentialRefByInstance?: Record<string, string>;
+  instances?: Array<{ id: string }>;
+  defaultInstanceId?: string | null;
+  modules?: Record<string, unknown>;
+  services?: Record<
+    string,
+    {
+      provider?: string | Record<string, unknown>;
+      implementation?: unknown;
+      config?: Record<string, unknown>;
+      credentialRef?: string;
+      instances?: Record<string, { enabled?: boolean; provider?: unknown; implementation?: unknown; credentialRef?: string }>;
+    }
+  >;
+}
+
+/** 候选 provider 字符串提取（string 直取；受控内联对象取 .provider；其余 undefined） */
+function providerOf(v: unknown): string | undefined {
+  if (typeof v === 'string') return v.length > 0 ? v : undefined;
+  if (v && typeof v === 'object' && isControlledInlineProvider(v)) {
+    const p = (v as { provider: string }).provider;
+    return p.length > 0 ? p : undefined;
+  }
+  return undefined;
+}
+
+export async function pruneIntegrationBindings(appDir: string): Promise<PruneResult> {
+  const file = join(appDir, 'config', 'integrations.json');
+  const raw = readIntegrationsConfig(appDir);
+  if (raw === null) return { removed: [], orphanCredentials: [], skipped: 'not-configured' };
+
+  const contracts: ResolvedContracts = await resolveContractsForApp(appDir);
+  if (!contracts.strictValidation) {
+    return { removed: [], orphanCredentials: [], skipped: 'predicate-unavailable' };
+  }
+
+  // env 展开（tolerant——doctor 走 fail-fast 外壳，prune 缺变量即降级跳过）
+  let integrations: Record<string, unknown>;
+  try {
+    const expanded = expandEnvVars(JSON.stringify(raw), process.env);
+    if (expanded.missing.length > 0 || expanded.text === undefined) {
+      return { removed: [], orphanCredentials: [], skipped: 'predicate-unavailable' };
+    }
+    integrations = JSON.parse(expanded.text) as Record<string, unknown>;
+  } catch {
+    return { removed: [], orphanCredentials: [], skipped: 'predicate-unavailable' };
+  }
+
+  let issues;
+  try {
+    issues = await evaluateAppIntegrationIssues(appDir, integrations, contracts, process.env);
+  } catch {
+    return { removed: [], orphanCredentials: [], skipped: 'predicate-unavailable' };
+  }
+
+  const walk = walkManifests(appDir);
+  const installedVendors = new Set(Object.keys(walk.catalog.providers));
+  const walkOwnership = walk.ownership;
+  const next = structuredClone(raw) as PruneDoc;
+  next.services ??= {};
+  const removed: string[] = [];
+
+  for (const issue of issues) {
+    if (issue.severity !== 'error') continue;
+    if (issue.code === 'VENDOR_NOT_INSTALLED') {
+      if (issue.module) {
+        // v6：modules[owner].provider 死厂商 → 整节点删除前提下的 provider 键清理；
+        // 仅 provider（无 config/resources）→ 节点删除（N1 归一）
+        const modulesNode = (next.modules ?? {}) as Record<string, Record<string, unknown>>;
+        const node = modulesNode[issue.module];
+        if (node?.provider) {
+          removed.push(`modules.${issue.module}.provider=${String(node.provider)}`);
+          delete node.provider;
+          if (Object.keys(node).length === 0) delete next.modules![issue.module]; // 归一
+        }
+      } else if (next.provider) {
+        removed.push(`root.provider=${next.provider}`);
+        delete next.provider;
+      }
+    } else if (issue.code === 'MODULE_CONFIG_DEAD' && issue.module) {
+      // v6 D4：模块卸载 → modules[m] 整节点确定性清理（provider+config+resources）
+      const modulesNode = (next.modules ?? {}) as Record<string, Record<string, unknown>>;
+      if (modulesNode[issue.module]) {
+        const node = modulesNode[issue.module];
+        const parts = [
+          node.provider !== undefined ? 'provider' : undefined,
+          node.config !== undefined ? 'config' : undefined,
+          node.resources !== undefined ? 'resources' : undefined,
+        ].filter(Boolean);
+        removed.push(`modules.${issue.module}（${parts.join('+')} 整节点）`);
+        delete next.modules![issue.module];
+      }
+    } else if (issue.code === 'BINDING_UNRESOLVED' && issue.service) {
+      const s = next.services[issue.service];
+      if (!s) continue;
+      // 守卫：引用链任一候选 ∈ installedVendors → 活厂商错配，保留（doctor 报错语义不变；
+      // v6 引用链 = 实例级/槽级/modules[ownerOf]/root 四层）
+      const owner = walkOwnership[issue.service];
+      const candidates = [
+        issue.instance ? providerOf(s.instances?.[issue.instance]?.provider) : undefined,
+        providerOf(s.provider),
+        owner !== undefined ? providerOf((next.modules as Record<string, { provider?: unknown }> | undefined)?.[owner]?.provider) : undefined,
+        providerOf(next.provider),
+      ].filter((v): v is string => typeof v === 'string');
+      if (candidates.some((v) => installedVendors.has(v))) continue;
+      if (issue.instance) {
+        const inst = s.instances;
+        if (!inst || !(issue.instance in inst)) continue;
+        delete inst[issue.instance];
+        removed.push(`services.${issue.service}.instances.${issue.instance}`);
+        if (Object.keys(inst).length === 0) delete s.instances;
+        if (Object.keys(s).length === 0) delete next.services[issue.service];
+      } else {
+        delete next.services[issue.service];
+        removed.push(`services.${issue.service}`);
+      }
+    }
+  }
+  if (Object.keys(next.services).length === 0) delete next.services;
+  if (removed.length === 0) return { removed, orphanCredentials: [] };
+
+  // 全空判定先行（**先于严格校验**——空文档 `{}` 缺必填 services 键必然被 zod 拒；删文件免校验）
+  const empty =
+    !next.provider &&
+    Object.keys(next.services ?? {}).length === 0 &&
+    Object.keys(next.config ?? {}).length === 0 &&
+    Object.keys(next.configByInstance ?? {}).length === 0 &&
+    !next.credentialRef &&
+    Object.keys(next.credentialRefByInstance ?? {}).length === 0 &&
+    (next.instances ?? []).length === 0 &&
+    next.defaultInstanceId == null &&
+    Object.keys(next.modules ?? {}).length === 0;
+
+  // ④ 严格校验（仅非空文档——services 为 schema 必填键，全服务剪除的存活文档补空 record 归一）
+  if (!empty) {
+    next.services ??= {};
+    if (typeof contracts.module.parseIntegrationsConfig === 'function') {
+      try {
+        contracts.module.parseIntegrationsConfig(next as never);
+      } catch {
+        return { removed: [], orphanCredentials: [], skipped: 'validation-failed' };
+      }
+    }
+  }
+
+  // ⑤⑥ 写 + 孤儿报告（D9）；空 → 删文件（ensureMockBindings 重装再生闭环）
+  let orphanCredentials: string[] = [];
+  if (empty) {
+    if (existsSync(file)) rmSync(file, { force: true });
+  } else {
+    writeAtomic(file, `${JSON.stringify(next, null, 2)}\n`);
+  }
+  orphanCredentials = reconcileOrphanCredentials(appDir).map((o) => o.message);
+
+  return { removed, orphanCredentials };
+}

package/src/integrations/write.ts

@@ -19,8 +19,9 @@ import {
 import type { IntegrationServiceIssue } from './predicate.js';
 import { checkInstanceKeys } from './predicate.js';
 import { isKnownService } from './read.js';
-import { displayOwnerName, moduleDomainWritable } from './domain-binding.js';
+import { moduleOwnershipWritable } from './module-binding.js';
 import { AppToolkitError } from '../core/errors.js';
+import { MODULE_INTEGRATION_NODE_KEYS } from '../dto.js';
 
 /**
  * 写核心（C3-4 write；FX-1c 管线重排——F3 九步定序 + D-B2 语义 + F4 输入扩位）：
@@ -231,7 +232,8 @@ export interface WriteCore {
   warmup(): Promise<void>;
   /** PUT /app/integration（root 节点全集） */
   applyApp(node: Record<string, unknown>, opts?: WriteOptions): SaveResult;
-  /** PUT /modules/:module/integration（domains 换算；N1 {} 删域键；v4.4 D34 写守卫单源） */
+  /** PUT /modules/:module/integration（v6 modules[owner] 集成位；键集纪律见 MODULE_INTEGRATION_NODE_KEYS；
+   *  N1 {} 清 provider/config 保 resources；moduleOwnershipWritable 写守卫单源） */
   applyModule(moduleId: string, node: Record<string, unknown>, opts?: WriteOptions): SaveResult;
   /** PUT /services/:service/integration（整节点含 instances map；N3 {} 不归一化；v4.4 A2 身份判据） */
   applyService(service: string, node: Record<string, unknown>, opts?: WriteOptions): SaveResult;
@@ -336,7 +338,7 @@ export function createWriteCore(appDir: string, opts: WriteCoreOptions = {}): Wr
           message: 'config/integrations.json 缺席——已物化骨架（写时自动初始化；R13 语义翻转提示）',
         });
       }
-      // root 全量替换（D14 无例外语义）：缺席根键删除（services/domains/modules 域不在根键集——随 base 保留），
+      // root 全量替换（D14 无例外语义）：缺席根键删除（services/modules 域不在根键集——随 base 保留；v6 domains 键已退役），
       // node 全键置入（未知键交严格 zod 拒——fail-visible；B10：原实现 spread+merge 残留 stale 根键）
       const next: Record<string, unknown> = { ...base };
       for (const k of APP_INTEGRATION_NODE_KEYS) if (!(k in node)) delete next[k];
@@ -370,37 +372,27 @@ export function createWriteCore(appDir: string, opts: WriteCoreOptions = {}): Wr
 
     applyModule(moduleId: string, node: Record<string, unknown>, writeOpts: WriteOptions = {}): SaveResult {
       assertSafeNames(node, 'root');
-      // D34 写守卫（v4.4，moduleDomainWritable 单源）：404（模块在册）→ 400（多域/零域/共享键
-      // 三分支）→ 既有管线。守卫先于 no-op 短路——多域/零域/共享键模块 PUT {} 清域同 400
-      // （「写路径拒绝歧义操作」含清除；P13/P17）。
-      const { modules, catalog } = walkManifests(appDir, cache);
+      // v6 写守卫（moduleOwnershipWritable 单源）：404（模块在册）→ 400（zero-ownership——
+      // 模块级集成位作用于 declare.owns 服务，零归属模块无配置位）→ 既有管线。
+      // 守卫先于 no-op 短路——零归属模块 PUT {} 清位同 400（「写路径拒绝歧义操作」含清除）。
+      const { modules, catalog, ownership } = walkManifests(appDir, cache);
       const mod = modules.find((m) => m.id === moduleId);
       if (!mod) {
         throw new AppToolkitError('MODULE_NOT_FOUND', 404, `模块 ${moduleId} 非已装模块`);
       }
-      const w = moduleDomainWritable({ modules, catalog }, mod);
+      const w = moduleOwnershipWritable({ modules, catalog, ownership }, mod);
       if (!w.writable) {
-        if (w.reason === 'multi-domain') {
-          throw new AppToolkitError(
-            'VALIDATION_FAILED',
-            400,
-            `模块 ${moduleId} 跨 ${w.domainKeys.length} 个域（${w.domainKeys.join('、')}）——模块级统一配置仅支持单域模块，请按服务级配置（编辑各服务行）`,
-          );
-        }
-        if (w.reason === 'zero-domain') {
-          throw new AppToolkitError('VALIDATION_FAILED', 400, `模块 ${moduleId} 无服务需求声明，无域配置位`);
-        }
         throw new AppToolkitError(
           'VALIDATION_FAILED',
           400,
-          `域键 ${w.domainKey} 由 ${w.coOwners.map((o) => displayOwnerName(modules, o)).join('、')} 共用——写通道拒绝歧义操作，请按服务级配置`,
+          `模块 ${moduleId} 未声明任何 declare.owns——无模块级配置位（模块级 provider/config 作用于归属服务）`,
         );
       }
-      const domainKey = w.domainKey;
       const issues: IntegrationServiceIssue[] = [];
       const current = loadConfig(appDir, cache);
+      // N2 语义（v6）：空节点 = 清 provider/config 两键，resources 随既有节点保全；
+      // 文件缺席 + 空节点 = no-op（幂等）
       if (current === null && Object.keys(node).length === 0) {
-        // 空文件清空域 = no-op（N1 幂等）
         return { written: false, restartScheduled: false, files: [], credentials: [], issues };
       }
       if (current === null) {
@@ -411,15 +403,39 @@ export function createWriteCore(appDir: string, opts: WriteCoreOptions = {}): Wr
         });
       }
       const base: Record<string, unknown> = current ?? { services: {} };
-      const domains = { ...((base.domains as Record<string, unknown>) ?? {}) };
-      const next: Record<string, unknown> = { ...base, domains };
-      // N1：模块节点 {} → 删 domains[键]（清域）；其余 = 域键全量替换
-      if (Object.keys(node).length === 0) delete domains[domainKey];
-      else domains[domainKey] = { ...node };
+      const modulesNode = { ...((base.modules as Record<string, unknown>) ?? {}) };
+      const existing = { ...((modulesNode[moduleId] as Record<string, unknown> | undefined) ?? {}) };
+      // 键集纪律：node 内仅接受 MODULE_INTEGRATION_NODE_KEYS 成员（未知键交严格 zod 拒——fail-visible）
+      for (const k of Object.keys(node)) {
+        if (!(MODULE_INTEGRATION_NODE_KEYS as readonly string[]).includes(k)) {
+          throw new AppToolkitError(
+            'VALIDATION_FAILED',
+            400,
+            `模块集成位仅接受 ${MODULE_INTEGRATION_NODE_KEYS.join('/')} 键（收到 ${k}）`,
+            [k],
+          );
+        }
+      }
+      // 全量替换（键集内）：缺席键删除；空对象/空串值 = 删除（≡ 缺席——模块节点不留空键）；
+      // PUT {} = 清 provider/config，resources 恒随 existing 保全（N2：清集成位不杀资源绑定）
+      const nextNode: Record<string, unknown> = { ...existing };
+      for (const k of MODULE_INTEGRATION_NODE_KEYS) {
+        const v = node[k];
+        const isEmptyish = v === undefined || v === null || v === ''
+          || (typeof v === 'object' && !Array.isArray(v) && Object.keys(v as object).length === 0);
+        if (isEmptyish) delete nextNode[k];
+        else nextNode[k] = v;
+      }
+      if (Object.keys(nextNode).length === 0) {
+        delete modulesNode[moduleId];
+      } else {
+        modulesNode[moduleId] = nextNode;
+      }
+      const next: Record<string, unknown> = { ...base, modules: modulesNode };
       if (deepEqual(current, next)) {
         return { written: false, restartScheduled: false, files: [], credentials: [], issues };
       }
-      runStrictValidation(next, issues, `domains.${domainKey}.`);
+      runStrictValidation(next, issues, `modules.${moduleId}.`);
       issues.push(...registryCheck(next));
       return finalize(next, [], issues, writeOpts.dryRun);
     },

package/src/views/app.ts

@@ -1,22 +1,26 @@
 import type { AppView, ServiceDemand } from '../dto.js';
 import { APP_INTEGRATION_NODE_KEYS } from '../dto.js';
-import { moduleOccupiedServices, type ViewSnapshot } from './context.js';
+import { moduleOccupiedServices, resolveServiceDisplay, type ViewSnapshot } from './context.js';
 
 /**
  * 应用静态投影（views/app；C4；FX-1c B10——root 节点投影修；v4.4 D29——services 双端点同型）。
  * /app = 平台服务 + root 节点原值（纯静态）：services = 服务词汇 − 模块占用
- * （ServiceDemand[]——平台条目 required 恒 false、title/description 缺席，D29）；
+ * （ServiceDemand[]——平台条目 required 恒 false、name/description 缺席，D29）；
  * 平台服务状态不在此（→ /service-resolutions）；模块服务不在此（→ /modules/:m）。
  * integration = **root 节点投影**（APP_INTEGRATION_NODE_KEYS——D21/L1：GET 预填 ≡ PUT body；
- * 文件另含 services/domains/modules 域键，不进 root 节点投影——原实现整文件透传，
+ * 文件另含 services/modules 域键，不进 root 节点投影——原实现整文件透传，
  * PUT 回会级联写回域键）；文件缺席 = null，文件在场 → 投影对象（可为空）。
  */
 
 export function loadAppView(snapshot: ViewSnapshot): AppView {
   const occupied = moduleOccupiedServices(snapshot.walk);
+  // 平台条目展示名走链（B1）：词汇 meta > demand meta > id——name 恒发（id 兜底内聚）
   const services: ServiceDemand[] = snapshot.walk.vocabulary
     .filter((s) => !occupied.has(s))
-    .map((s) => ({ service: s, required: false }));
+    .map((s) => {
+      const display = resolveServiceDisplay(snapshot.walk, s);
+      return { service: s, name: display.name, ...(display.description !== undefined ? { description: display.description } : {}), required: false };
+    });
   const config = snapshot.integrations;
   let integration: AppView['integration'] = null;
   if (config) {

package/src/views/context.ts

@@ -1,12 +1,11 @@
 import { readIntegrationsConfig } from '../integrations/read.js';
-import { domainOfService } from '../integrations/domain-binding.js';
 import { walkManifests, type WalkCatalog, type WalkManifestsResult } from '../assembly/walk-manifests.js';
 import type { FileCache } from '../core/file-cache.js';
 import type { ResolvedContracts } from '../core/contracts-resolver.js';
 
 /**
  * 视图装配共享上下文（五投影共用；目录枚举零缓存——walkManifests 每次调用执行）。
- * 域前缀换算（service → 首点段）自 v4.4 F1 迁 integrations/domain-binding.ts（本文件 re-export 保导入路径）。
+ * v6：域前缀换算退役（domainOfService 随归属模型退场）——模块占用判定改 declare 三键直读。
  */
 
 export interface ViewContext {
@@ -22,8 +21,6 @@ export interface ViewSnapshot {
   contracts: ResolvedContracts;
 }
 
-export { domainOfService };
-
 /** 读取视图输入快照（每方法调用独立——Freshness Contract 单位 = 方法调用） */
 export async function loadViewSnapshot(ctx: ViewContext): Promise<ViewSnapshot> {
   const walk = walkManifests(ctx.appDir, ctx.cache);
@@ -40,12 +37,14 @@ export function loadViewSnapshotSync(ctx: ViewContext, contracts: ResolvedContra
   return { appDir: ctx.appDir, walk, catalog: walk.catalog, integrations, contracts };
 }
 
-/** 模块占用服务集（demand 侧——平台服务 = 词汇 − 本集） */
+/** 模块占用服务集（v6——demand ∪ supply ∪ owns：归属模型下「平台服务」= 无主服务；
+ *  mall-core owns auth.alipay-login → 移出 AppView.services 平台条目，入其模块页 ownedServices） */
 export function moduleOccupiedServices(walk: WalkManifestsResult): Set<string> {
   const occupied = new Set<string>();
   for (const mod of walk.modules) {
-    for (const need of mod.descriptor.contributes.services ?? []) occupied.add(need.service);
-    for (const slot of mod.descriptor.contributes.providers?.slots ?? []) occupied.add(slot.service);
+    for (const own of mod.descriptor.declare.owns ?? []) occupied.add(own.service);
+    for (const need of mod.descriptor.declare.consumes ?? []) occupied.add(need.service);
+    for (const slot of mod.descriptor.declare.providers?.slots ?? []) occupied.add(slot.service);
   }
   return occupied;
 }
@@ -65,3 +64,23 @@ export function suppliedByVendors(catalog: WalkCatalog, service: string): string
   }
   return vendors.sort();
 }
+
+/** 服务展示名解析结果（name 恒有值——id 兜底内聚；v7 词汇统一 title→name） */
+export interface ServiceDisplay {
+  name: string;
+  description?: string;
+}
+
+/**
+ * 服务展示名单源（B1）：词汇 meta（slotMeta——contracts-mall 词汇锁保证 mall 域覆盖）
+ * > demand meta（catalog.services——域外槽兜底；首声明聚合）> service id。逐字段回落——
+ * 词汇条目仅含 description 时 demand name 仍可达（外部契约包部分 meta 前向容错）。
+ * 四视图唯一消费点（/modules/:m services、/app 平台条目、/services/:s、/providers/:p services）。
+ */
+export function resolveServiceDisplay(walk: WalkManifestsResult, service: string): ServiceDisplay {
+  const vocab = walk.slotMeta[service];
+  const demand = walk.catalog.services[service];
+  const name = vocab?.name ?? demand?.name ?? service;
+  const description = vocab?.description ?? demand?.description;
+  return { name, ...(description !== undefined ? { description } : {}) };
+}

package/src/views/integration-schemas.ts

@@ -1,7 +1,7 @@
 import type { IntegrationFieldRegistryView, LayerIntegrationSchemas, ServiceIntegrationSchemas } from '../dto.js';
 import { isSupplied, type ViewSnapshot } from './context.js';
 import { resolveServiceConfigSchema } from './providers.js';
-import { domainOfService, moduleDomainWritable, providerFootprint, resolveDomainBinding } from '../integrations/domain-binding.js';
+import { moduleOwnershipWritable, providerFootprint, resolveModuleBinding } from '../integrations/module-binding.js';
 import { isControlledInlineProvider } from '../integrations/predicate.js';
 
 /**
@@ -117,6 +117,12 @@ export function buildIntegrationFieldRegistry(
       key,
       schema: mergeFieldSources(sources),
       sources: sources.map(({ service, required }) => ({ service, required })),
+      // G 批：x-tbox-global 聚合旗标（sources.some——subschema 属性标记直读，零新增 IO；
+      // 任一来源声明即 true——并集口径与 required 聚合同族）
+      global: sources.some(
+        (s) => !!s.subschema && typeof s.subschema === 'object'
+          && (s.subschema as Record<string, unknown>)['x-tbox-global'] === true,
+      ),
     });
   }
   return {
@@ -129,7 +135,7 @@ export function buildIntegrationFieldRegistry(
 }
 
 /** D37 生效厂商解析单源（实际/假想同径）：override（非空串）?? 实际解析。
- *  空串归一（I3）单点；module 轴 D34 不可写/不在册 → null（override 不豁免——预览服务于保存）。 */
+ *  空串归一（I3）单点；module 轴 v6 零归属 → null（override 不豁免——预览服务于保存）。 */
 export function formProviderOf(
   axis: 'app' | 'module',
   snapshot: ViewSnapshot,
@@ -144,10 +150,10 @@ export function formProviderOf(
   }
   const mod = snapshot.walk.modules.find((m) => m.id === moduleId);
   if (!mod) return null; // 视图已先行 404，此处防御
-  const w = moduleDomainWritable(snapshot.walk, mod);
-  if (!w.writable) return null; // D34 不豁免
+  const w = moduleOwnershipWritable(snapshot.walk, mod);
+  if (!w.writable) return null; // v6 零归属不豁免
   if (ovr !== undefined) return ovr;
-  return resolveDomainBinding(snapshot.integrations, w.domainKey).provider;
+  return resolveModuleBinding(snapshot.integrations, mod.id).provider;
 }
 
 /** D36/D37 表单层双投影（I1：同源同口径一次计算——双取单算 by construction） */
@@ -159,29 +165,39 @@ export interface LayerFormViews {
 /** 防御双 null（module 不在册/不可写/未绑定、app 未绑定——F3） */
 const NULL_FORM_VIEWS: LayerFormViews = { integrationSchemas: null, integrationFieldRegistry: null };
 
+/** G 批表单收窄（消费投影单点）：app/module 轴 registry.fields 只留 global===true——
+ *  未声明键落 ExtraFields 语义（P16 复合可见面：layer.properties 仍全量，字段级代数不受扰）。
+ *  schemaless/unsupplied/additionalPropertiesAllowed 描述服务/Schema 面，不随字段过滤。 */
+function narrowToGlobal(registry: IntegrationFieldRegistryView): IntegrationFieldRegistryView {
+  return { ...registry, fields: registry.fields.filter((f) => f.global) };
+}
+
 /** app 轴装配：scope = 供给足迹全量（≠ AppView.services——root.config 流向包括模块服务在内的所有服务）；
  *  unsupplied 恒 []（结构性：足迹 ⊆ 供给）。未知厂商/零足迹 → 非 null 空集（镜像 D32 mock 语义）。 */
 export function loadAppFormViews(snapshot: ViewSnapshot, appProvider?: string): LayerFormViews {
   const provider = formProviderOf('app', snapshot, undefined, appProvider);
   if (provider === null) return NULL_FORM_VIEWS;
   const layer = resolveLayerIntegrationSchemas(snapshot, provider, providerFootprint(snapshot.catalog, provider));
-  return { integrationSchemas: layer, integrationFieldRegistry: buildIntegrationFieldRegistry(layer) };
+  return { integrationSchemas: layer, integrationFieldRegistry: narrowToGlobal(buildIntegrationFieldRegistry(layer)) };
 }
 
-/** module 轴装配：仅 writable 单域（D34）；scope = demand ∩ 该厂商供给；unsupplied 同点派生
- *  （demand − 供给，Set 去重保序——manifest demand 不去重防御）。 */
+/** module 轴装配：仅 writable（v6 owns>0）；scope = ownedServices ∩ 该厂商供给（v6——模块
+ *  config 流向归属服务）；unsupplied 同点派生（ownedServices − 供给，Set 去重保序——
+ *  declare.owns 不去重防御）。 */
 export function loadModuleFormViews(snapshot: ViewSnapshot, moduleId: string, moduleProvider?: string): LayerFormViews {
   const provider = formProviderOf('module', snapshot, moduleId, moduleProvider);
   const mod = snapshot.walk.modules.find((m) => m.id === moduleId);
   if (provider === null || !mod) return NULL_FORM_VIEWS;
-  const demand = (mod.descriptor.contributes.services ?? []).map((s) => s.service);
+  const owned = (mod.descriptor.declare.owns ?? []).map((o) => o.service);
   const supplied = (s: string): boolean => isSupplied(snapshot.catalog, provider, s);
-  const layer = resolveLayerIntegrationSchemas(snapshot, provider, demand.filter(supplied));
+  const layer = resolveLayerIntegrationSchemas(snapshot, provider, owned.filter(supplied));
   return {
     integrationSchemas: layer,
-    integrationFieldRegistry: buildIntegrationFieldRegistry(layer, {
-      unsupplied: [...new Set(demand.filter((s) => !supplied(s)))],
-    }),
+    integrationFieldRegistry: narrowToGlobal(
+      buildIntegrationFieldRegistry(layer, {
+        unsupplied: [...new Set(owned.filter((s) => !supplied(s)))],
+      }),
+    ),
   };
 }
 
@@ -195,9 +211,20 @@ export function loadModuleIntegrationSchemas(snapshot: ViewSnapshot, moduleId: s
   return loadModuleFormViews(snapshot, moduleId).integrationSchemas;
 }
 
+/** 服务级生效绑定（v6 级联）：显式 ?? modules[ownerOf[s]].provider ?? root.provider。
+ *  服务无主 → 仅 root（平台槽语义）。 */
+function serviceLevelBindingProvider(snapshot: ViewSnapshot, service: string): string | null {
+  const owner = snapshot.walk.ownership[service];
+  if (owner !== undefined) {
+    return resolveModuleBinding(snapshot.integrations, owner).provider;
+  }
+  const p = (snapshot.integrations as { provider?: unknown } | null)?.provider;
+  return typeof p === 'string' && p.length > 0 ? p : null;
+}
+
 /** 服务级 loader（v4.7 D38）：四分支穷举（node.provider = 文件 services[s].provider 逐字原值；
  *  实例层无条件排除——node 级口径）；非空三分支归约一次复合解析。
- *  ① undefined/'' → resolveDomainBinding 域级联（域 + root 双缺 → 整字段 null）
+ *  ① undefined/'' → 模块级联（v6：modules[ownerOf[s]] → root 双缺 → 整字段 null）
  *  ② 非空 string → bare：catalog miss（未知厂商/未供给）→ configSchema:null 不 404（富化非门控）
  *  ③ 受控内联（isControlledInlineProvider 单源）→ 名 = p.provider；catalog 复合键 > p.configSchema ref
  *     （H9 逃逸 400 照抛——readInlineSchema 共享路径）
@@ -210,10 +237,10 @@ export function loadServiceIntegrationSchemas(
   const p = (snapshot.integrations as { services?: Record<string, { provider?: unknown }> } | null)
     ?.services?.[service]?.provider;
   if (p === undefined || p === '') {
-    const binding = resolveDomainBinding(snapshot.integrations, domainOfService(service));
-    return binding.provider === null
+    const provider = serviceLevelBindingProvider(snapshot, service);
+    return provider === null
       ? null
-      : { provider: binding.provider, configSchema: resolveServiceConfigSchema(snapshot, binding.provider, service) };
+      : { provider, configSchema: resolveServiceConfigSchema(snapshot, provider, service) };
   }
   if (typeof p === 'string') {
     return { provider: p, configSchema: resolveServiceConfigSchema(snapshot, p, service) };
@@ -224,3 +251,20 @@ export function loadServiceIntegrationSchemas(
   }
   return null;
 }
+
+/** G 批：服务轴字段注册表（D38 四分支链复用——消费 loadServiceIntegrationSchemas 单源；
+ *  伪层 {provider, services: {[s]: {configSchema}}} → buildIntegrationFieldRegistry——
+ *  fields = 该 schema 全部字段带 global 旗标；configSchema null → schemaless=[service]
+ *  非 null 空集；schemas 整体 null（全链未绑定/坏节点）→ registry null——镜像 D38 语义） */
+export function loadServiceFieldRegistry(
+  snapshot: ViewSnapshot,
+  service: string,
+): IntegrationFieldRegistryView | null {
+  const schemas = loadServiceIntegrationSchemas(snapshot, service);
+  if (schemas === null) return null;
+  const layer: LayerIntegrationSchemas = {
+    provider: schemas.provider,
+    services: { [service]: { configSchema: schemas.configSchema } },
+  };
+  return buildIntegrationFieldRegistry(layer);
+}