@actiondock/core 2.6.0 → 2.8.0

package/dist/server/routes/actions.js

@@ -1,14 +1,13 @@
-import { randomUUID } from "node:crypto";
-import { ActionResolver } from "../../catalog/action-resolver.js";
+import { parseActionRef } from "../../catalog/resolve-action.js";
 import { filterByIntent } from "../../filter/index.js";
-import { ACTION_NOT_FOUND, ACTION_TIMEOUT, IDEMPOTENCY_CONFLICT, INPUT_VALIDATION_FAILED, PACKAGE_NOT_FOUND } from "../../errors.js";
+import { ACTION_EXECUTION_ERROR, ACTION_NOT_FOUND, ACTION_START_FAILED, ACTION_TIMEOUT, ACTIONS_LIST_ERROR, IDEMPOTENCY_CONFLICT, INPUT_VALIDATION_FAILED, INVALID_JSON, PACKAGE_FORBIDDEN, PACKAGE_NOT_FOUND, REQUEST_TOO_LARGE, } from "../../errors.js";
 import { InvalidJsonError, readJsonBody, RequestTooLargeError } from "../body.js";
 import { getSubPath, jsonResponse } from "./common.js";
 /**
  * 处理 Action 相关的 HTTP 路由（列表、规范查询、同步执行与异步启动）。
  */
 export async function handleActionsRoutes(ctx) {
-    const { req, url, pathname, corsHeaders, options, target } = ctx;
+    const { req, url, pathname, corsHeaders, options, service } = ctx;
     const subpath = getSubPath(pathname);
     // 1. Actions List: GET /api/v2/actions, GET /actions
     if (subpath === "/actions" && req.method === "GET") {
@@ -18,7 +17,7 @@ export async function handleActionsRoutes(ctx) {
             const targetPkg = url.searchParams.get("package") || url.searchParams.get("packageId") || undefined;
             const prefix = url.searchParams.get("prefix") || undefined;
             const tags = url.searchParams.getAll("tag");
-            let actions = await target.listActions({
+            let actions = await service.discovery.listActions({
                 query,
                 prefix,
                 tags: tags.length > 0 ? tags : undefined,
@@ -37,7 +36,7 @@ export async function handleActionsRoutes(ctx) {
         catch (err) {
             return jsonResponse({
                 ok: false,
-                error: { code: "ACTIONS_LIST_ERROR", message: err.message },
+                error: { code: ACTIONS_LIST_ERROR, message: err.message },
             }, 500, corsHeaders);
         }
     }
@@ -51,7 +50,7 @@ export async function handleActionsRoutes(ctx) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: "PACKAGE_FORBIDDEN",
+                        code: PACKAGE_FORBIDDEN,
                         message: `Package '${packageId}' is not in the allowed package list`,
                     },
                 }, 403, corsHeaders);
@@ -59,7 +58,7 @@ export async function handleActionsRoutes(ctx) {
         }
         const ref = `${packageId}/${actionId}`;
         try {
-            const spec = await target.describeAction(ref);
+            const spec = await service.discovery.describeAction(ref);
             return jsonResponse(spec, 200, corsHeaders);
         }
         catch (err) {
@@ -77,13 +76,13 @@ export async function handleActionsRoutes(ctx) {
     if (actionShowMatch && req.method === "GET") {
         const actionId = decodeURIComponent(actionShowMatch[1]);
         try {
-            const parsed = ActionResolver.parseRef(actionId);
+            const parsed = parseActionRef(actionId);
             if (parsed.packageId && options.packageAllowlist && options.packageAllowlist.length > 0) {
                 if (!options.packageAllowlist.includes(parsed.packageId)) {
                     return jsonResponse({
                         ok: false,
                         error: {
-                            code: "PACKAGE_FORBIDDEN",
+                            code: PACKAGE_FORBIDDEN,
                             message: `Package '${parsed.packageId}' is not in the allowed package list`,
                         },
                     }, 403, corsHeaders);
@@ -92,14 +91,14 @@ export async function handleActionsRoutes(ctx) {
         }
         catch { }
         try {
-            const spec = await target.describeAction(actionId);
+            const spec = await service.discovery.describeAction(actionId);
             if (options.packageAllowlist &&
                 options.packageAllowlist.length > 0 &&
                 (!spec.packageId || !options.packageAllowlist.includes(spec.packageId))) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: "PACKAGE_FORBIDDEN",
+                        code: PACKAGE_FORBIDDEN,
                         message: `Package '${spec.packageId}' is not in the allowed package list`,
                     },
                 }, 403, corsHeaders);
@@ -138,7 +137,7 @@ export async function handleActionsRoutes(ctx) {
             actionRef = decodeURIComponent(shortRunMatch[1]);
             endpointMode = shortRunMatch[2];
             try {
-                const parsed = ActionResolver.parseRef(actionRef);
+                const parsed = parseActionRef(actionRef);
                 pkgId = parsed.packageId;
             }
             catch { }
@@ -147,7 +146,7 @@ export async function handleActionsRoutes(ctx) {
         if (options.packageAllowlist && options.packageAllowlist.length > 0) {
             if (!pkgId) {
                 try {
-                    const spec = await target.describeAction(actionRef);
+                    const spec = await service.discovery.describeAction(actionRef);
                     pkgId = spec?.packageId;
                 }
                 catch { }
@@ -155,9 +154,9 @@ export async function handleActionsRoutes(ctx) {
             if (!pkgId || !options.packageAllowlist.includes(pkgId)) {
                 return jsonResponse({
                     ok: false,
-                    runId: randomUUID(),
+                    runId: "",
                     error: {
-                        code: "PACKAGE_FORBIDDEN",
+                        code: PACKAGE_FORBIDDEN,
                         message: pkgId
                             ? `Package '${pkgId}' is not in the allowed package list`
                             : `Action '${actionRef}' does not belong to any allowed package`,
@@ -173,21 +172,21 @@ export async function handleActionsRoutes(ctx) {
             if (err instanceof RequestTooLargeError) {
                 return jsonResponse({
                     ok: false,
-                    runId: randomUUID(),
-                    error: { code: "REQUEST_TOO_LARGE", message: err.message },
+                    runId: "",
+                    error: { code: REQUEST_TOO_LARGE, message: err.message },
                 }, 413, corsHeaders);
             }
             if (err instanceof InvalidJsonError) {
                 return jsonResponse({
                     ok: false,
-                    runId: randomUUID(),
-                    error: { code: "INVALID_JSON", message: err.message },
+                    runId: "",
+                    error: { code: INVALID_JSON, message: err.message },
                 }, 400, corsHeaders);
             }
             return jsonResponse({
                 ok: false,
-                runId: randomUUID(),
-                error: { code: "INVALID_JSON", message: `Failed to parse request body: ${err.message}` },
+                runId: "",
+                error: { code: INVALID_JSON, message: `Failed to parse request body: ${err.message}` },
             }, 400, corsHeaders);
         }
         const isAsync = endpointMode === "start" ||
@@ -205,9 +204,16 @@ export async function handleActionsRoutes(ctx) {
             body?.requestId ||
             body?.execution?.requestId ||
             undefined;
+        let actionRefObj;
+        try {
+            actionRefObj = parseActionRef(actionRef);
+        }
+        catch {
+            actionRefObj = { actionId: actionRef };
+        }
         if (isAsync) {
             try {
-                const ticket = await target.startAction(actionRef, input, {
+                const ticket = await service.execution.start(actionRefObj, input, {
                     timeoutMs,
                     config: configOverrides,
                     requestId,
@@ -236,9 +242,9 @@ export async function handleActionsRoutes(ctx) {
                 }
                 return jsonResponse({
                     ok: false,
-                    runId: randomUUID(),
+                    runId: "",
                     error: {
-                        code: "ACTION_START_FAILED",
+                        code: ACTION_START_FAILED,
                         message: err.message || String(err),
                     },
                 }, 500, corsHeaders);
@@ -246,7 +252,7 @@ export async function handleActionsRoutes(ctx) {
         }
         // 同步执行模式
         try {
-            const result = await target.runAction(actionRef, input, {
+            const result = await service.execution.run(actionRefObj, input, {
                 signal: req.signal,
                 timeoutMs,
                 config: configOverrides,
@@ -286,9 +292,9 @@ export async function handleActionsRoutes(ctx) {
             }
             return jsonResponse({
                 ok: false,
-                runId: randomUUID(),
+                runId: "",
                 error: {
-                    code: "ACTION_EXECUTION_ERROR",
+                    code: ACTION_EXECUTION_ERROR,
                     message: err.message || String(err),
                 },
             }, 500, corsHeaders);

package/dist/server/routes/common.d.ts

@@ -1,6 +1,5 @@
-import type { ActionDockApp } from "../../app/types.js";
-import type { ActionDockHost } from "../../host/types.js";
-import type { ActionDockTarget } from "../../target/types.js";
+import type { PackageInfo } from "../../package/types.js";
+import type { ActionDockService } from "../../service/types.js";
 import type { ServerOptions } from "../types.js";
 /**
  * 路由处理统一上下文对象。
@@ -12,8 +11,7 @@ export interface RouteContext {
     corsHeaders: Record<string, string>;
     projectRoot: string | null;
     customHome?: string;
-    host?: ActionDockHost;
-    target: ActionDockTarget;
+    service: ActionDockService;
     options: ServerOptions;
 }
 /**
@@ -21,27 +19,25 @@ export interface RouteContext {
  */
 export declare function jsonResponse(data: unknown, status?: number, corsHeaders?: Record<string, string>): Response;
 /**
- * 剥离标准版本前缀 (/api/v2/ 与兼容的 /api/v1/)，获取相对路由子路径。
+ * 剥离标准版本前缀 (/api/v2/)，获取相对路由子路径。
  */
 export declare function getSubPath(pathname: string): string;
+import { ActionDockError } from "../../errors.js";
 /**
  * 包未列入白名单拒绝访问异常。
  */
-export declare class PackageNotAllowedError extends Error {
+export declare class PackageNotAllowedError extends ActionDockError {
     status: number;
     statusCode: number;
-    code: string;
     constructor(packageId: string);
 }
 /**
  * 校验目标 packageId 是否属于允许包白名单。
  * 当 options.packageAllowlist 存在且目标 packageId 不在白名单中时抛出 403 PACKAGE_NOT_ALLOWED 异常。
  */
-export declare function assertPackageAllowed(packageId: string | undefined | null, options?: {
-    packageAllowlist?: string[];
-}): void;
+export declare function assertPackageAllowed(packageId: string, options?: ServerOptions): void;
 /**
- * 从 Host 或 Target 中依据 packageId 解析对应的 ActionDockApp 实例。
- * 若提供了 options，过滤或优先选择白名单内的 app。
+ * 解析并确定生效的目标 packageId。
+ * 遵循严格的解析规则与白名单检查。
  */
-export declare function resolveAppForPackage(packageIdOrPath: string | undefined, host?: ActionDockHost, target?: ActionDockTarget, options?: ServerOptions): ActionDockApp;
+export declare function resolveTargetPackageId(packages: PackageInfo[], requestedPackageId?: string, options?: ServerOptions): string;

package/dist/server/routes/common.js

@@ -12,27 +12,25 @@ export function jsonResponse(data, status = 200, corsHeaders = {}) {
     });
 }
 /**
- * 剥离标准版本前缀 (/api/v2/ 与兼容的 /api/v1/)，获取相对路由子路径。
+ * 剥离标准版本前缀 (/api/v2/)，获取相对路由子路径。
  */
 export function getSubPath(pathname) {
     if (pathname.startsWith("/api/v2/")) {
         return pathname.slice(7);
     }
-    if (pathname.startsWith("/api/v1/")) {
-        return pathname.slice(7);
-    }
     return pathname;
 }
+import { ActionDockError, PACKAGE_NOT_FOUND, PACKAGE_NOT_ALLOWED } from "../../errors.js";
 /**
  * 包未列入白名单拒绝访问异常。
  */
-export class PackageNotAllowedError extends Error {
+export class PackageNotAllowedError extends ActionDockError {
     status = 403;
     statusCode = 403;
-    code = "PACKAGE_NOT_ALLOWED";
     constructor(packageId) {
-        super(`Package '${packageId}' is not in the allowed package list`);
+        super(PACKAGE_NOT_ALLOWED, `Package '${packageId}' is not in the allowed package list`);
         this.name = "PackageNotAllowedError";
+        Object.setPrototypeOf(this, PackageNotAllowedError.prototype);
     }
 }
 /**
@@ -42,63 +40,41 @@ export class PackageNotAllowedError extends Error {
 export function assertPackageAllowed(packageId, options) {
     if (options?.packageAllowlist &&
         Array.isArray(options.packageAllowlist) &&
-        options.packageAllowlist.length > 0) {
-        if (!packageId || !options.packageAllowlist.includes(packageId)) {
-            throw new PackageNotAllowedError(packageId || "");
-        }
+        options.packageAllowlist.length > 0 &&
+        !options.packageAllowlist.includes(packageId)) {
+        throw new PackageNotAllowedError(packageId);
     }
 }
 /**
- * 从 Host 或 Target 中依据 packageId 解析对应的 ActionDockApp 实例。
- * 若提供了 options，过滤或优先选择白名单内的 app。
+ * 解析并确定生效的目标 packageId。
+ * 遵循严格的解析规则与白名单检查。
  */
-export function resolveAppForPackage(packageIdOrPath, host, target, options) {
-    if (packageIdOrPath) {
-        assertPackageAllowed(packageIdOrPath, options);
-        assertValidPackageId(packageIdOrPath);
-        if (host) {
-            const app = host.getApp(packageIdOrPath);
-            if (app)
-                return app;
-        }
-        const innerTarget = target?.unwrap?.();
-        if (innerTarget && "packageId" in innerTarget && innerTarget.packageId === packageIdOrPath) {
-            return innerTarget;
+export function resolveTargetPackageId(packages, requestedPackageId, options) {
+    if (requestedPackageId) {
+        if (requestedPackageId === "global") {
+            return "global";
         }
-        if (innerTarget && "getApp" in innerTarget) {
-            const app = innerTarget.getApp(packageIdOrPath);
-            if (app)
-                return app;
+        assertValidPackageId(requestedPackageId);
+        assertPackageAllowed(requestedPackageId, options);
+        const matched = packages.find((p) => p.id === requestedPackageId || p.packageRoot === requestedPackageId);
+        if (!matched) {
+            throw new ActionDockError(PACKAGE_NOT_FOUND, `Unknown or unregistered package: '${requestedPackageId}'`);
         }
-        throw new Error(`Unknown or unregistered package: '${packageIdOrPath}'`);
+        return matched.id;
     }
-    if (host) {
-        const apps = host.listApps();
-        if (options?.packageAllowlist &&
-            Array.isArray(options.packageAllowlist) &&
-            options.packageAllowlist.length > 0) {
-            const allowedApp = apps.find((a) => options.packageAllowlist.includes(a.packageId));
-            if (allowedApp)
-                return allowedApp;
-        }
-        if (apps.length > 0)
-            return apps[0];
+    let targetId;
+    if (options?.packageAllowlist &&
+        Array.isArray(options.packageAllowlist) &&
+        options.packageAllowlist.length > 0) {
+        const allowed = packages.find((p) => options.packageAllowlist.includes(p.id));
+        targetId = allowed ? allowed.id : (packages[0]?.id || "");
     }
-    const innerTarget = target?.unwrap?.();
-    if (innerTarget && "listApps" in innerTarget) {
-        const apps = innerTarget.listApps();
-        if (options?.packageAllowlist &&
-            Array.isArray(options.packageAllowlist) &&
-            options.packageAllowlist.length > 0) {
-            const allowedApp = apps.find((a) => options.packageAllowlist.includes(a.packageId));
-            if (allowedApp)
-                return allowedApp;
-        }
-        if (apps.length > 0)
-            return apps[0];
+    else if (packages.length > 0) {
+        targetId = packages[0].id;
     }
-    if (innerTarget && "packageId" in innerTarget) {
-        return innerTarget;
+    else {
+        throw new ActionDockError(PACKAGE_NOT_FOUND, "No registered package found in service");
     }
-    throw new Error("No registered package found in host or target");
+    assertPackageAllowed(targetId, options);
+    return targetId;
 }

package/dist/server/routes/config.js

@@ -1,14 +1,22 @@
-import { CAPABILITY_UNAVAILABLE } from "../../errors.js";
+import { CAPABILITY_UNAVAILABLE, CONFIG_DELETE_ERROR, CONFIG_ENV_ERROR, CONFIG_LIST_ERROR, CONFIG_SET_ERROR, INVALID_ARGUMENT, INVALID_PACKAGE_ID, PACKAGE_NOT_ALLOWED, PACKAGE_NOT_FOUND, PATH_TRAVERSAL, } from "../../errors.js";
 import { resolveEnvValue } from "../../runtime/index.js";
-import { isSecretConfigKey, maskSecretValue, sanitizeConfigDefinitions } from "../../storage/index.js";
+import { isSecretConfigKey, sanitizeConfigDefinitions } from "../../storage/index.js";
 import { readJsonBody } from "../body.js";
-import { assertPackageAllowed, getSubPath, jsonResponse, resolveAppForPackage } from "./common.js";
+import { getSubPath, jsonResponse, resolveTargetPackageId } from "./common.js";
+function isClientConfigError(err) {
+    return (err?.code === PACKAGE_NOT_FOUND ||
+        err?.code === INVALID_PACKAGE_ID ||
+        err?.code === PATH_TRAVERSAL ||
+        err?.code === INVALID_ARGUMENT ||
+        err?.status === 400 ||
+        err?.status === 404);
+}
 /**
  * 处理配置元数据与当前值读取、更新及删除接口。
  * 在未显式开启管理功能 (options.enableManagement !== true) 时返回 403 拒绝。
  */
 export async function handleConfigRoutes(ctx) {
-    const { req, url, pathname, corsHeaders, options, host, target } = ctx;
+    const { req, url, pathname, corsHeaders, options, service } = ctx;
     const subpath = getSubPath(pathname);
     const isConfigRoute = subpath === "/config" ||
         subpath.startsWith("/config/") ||
@@ -17,7 +25,7 @@ export async function handleConfigRoutes(ctx) {
         return null;
     }
     // 校验管理能力开关
-    if (options.enableManagement !== true) {
+    if (options.enableManagement !== true || !service.management?.config) {
         return jsonResponse({
             ok: false,
             error: {
@@ -29,16 +37,14 @@ export async function handleConfigRoutes(ctx) {
     // 1. Config Env Check: GET /config/env
     if (subpath === "/config/env" && req.method === "GET") {
         try {
+            const pkgs = await service.discovery.listPackages();
             const pkgParam = url.searchParams.get("package") || url.searchParams.get("packageId") || undefined;
-            if (pkgParam) {
-                assertPackageAllowed(pkgParam, options);
-            }
-            const app = resolveAppForPackage(pkgParam, host, target, options);
-            assertPackageAllowed(app.packageId, options);
-            const declared = app.projectConfig?.config || {};
+            const targetPackageId = resolveTargetPackageId(pkgs, pkgParam, options);
+            const pkg = pkgs.find((p) => p.id === targetPackageId);
+            const declared = pkg?.config || {};
             const envChecks = [];
             for (const [k, def] of Object.entries(declared)) {
-                const resolved = resolveEnvValue(k, def, app.packageId);
+                const resolved = resolveEnvValue(k, def, targetPackageId);
                 const matchedEnv = resolved?.envKey || null;
                 envChecks.push({
                     key: k,
@@ -49,61 +55,55 @@ export async function handleConfigRoutes(ctx) {
                     secret: isSecretConfigKey(k, def),
                 });
             }
-            return jsonResponse({ ok: true, packageId: app.packageId, envChecks }, 200, corsHeaders);
+            return jsonResponse({ ok: true, packageId: targetPackageId, envChecks }, 200, corsHeaders);
         }
         catch (err) {
-            if (err.code === "PACKAGE_NOT_ALLOWED" || err.status === 403) {
+            if (err.code === PACKAGE_NOT_ALLOWED || err.status === 403) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: "PACKAGE_NOT_ALLOWED",
+                        code: PACKAGE_NOT_ALLOWED,
                         message: err.message || "Package is not in the allowed package list",
                     },
                 }, 403, corsHeaders);
             }
-            const isClient = err.message?.includes("Unknown or unregistered package") ||
-                err.message?.includes("Invalid packageId") ||
-                err.message?.includes("escapes boundary");
-            return jsonResponse({ ok: false, error: { code: isClient ? "INVALID_ARGUMENT" : "CONFIG_ENV_ERROR", message: err.message } }, isClient ? 400 : 500, corsHeaders);
+            const isClient = isClientConfigError(err);
+            return jsonResponse({ ok: false, error: { code: isClient ? INVALID_ARGUMENT : CONFIG_ENV_ERROR, message: err.message } }, isClient ? 400 : 500, corsHeaders);
         }
     }
     // 2. Config Query: GET /config
     if (subpath === "/config" && req.method === "GET") {
         try {
+            const pkgs = await service.discovery.listPackages();
             const pkgParam = url.searchParams.get("package") || url.searchParams.get("packageId") || undefined;
-            if (pkgParam) {
-                assertPackageAllowed(pkgParam, options);
-            }
-            const app = resolveAppForPackage(pkgParam, host, target, options);
-            assertPackageAllowed(app.packageId, options);
-            const stored = app.storage.listConfig();
-            const rawDeclared = app.projectConfig?.config || {};
+            const targetPackageId = resolveTargetPackageId(pkgs, pkgParam, options);
+            const pkg = pkgs.find((p) => p.id === targetPackageId);
+            const rawDeclared = pkg?.config || {};
             const declared = sanitizeConfigDefinitions(rawDeclared) || {};
+            const views = await service.management.config.list(targetPackageId);
             const maskedValues = {};
-            for (const [k, v] of Object.entries(stored)) {
-                if (isSecretConfigKey(k, rawDeclared[k])) {
-                    maskedValues[k] = maskSecretValue(v);
+            for (const v of views) {
+                if (v.secret) {
+                    maskedValues[v.key] = "********";
                 }
                 else {
-                    maskedValues[k] = v;
+                    maskedValues[v.key] = v.value;
                 }
             }
-            return jsonResponse({ ok: true, packageId: app.packageId, declared, values: maskedValues }, 200, corsHeaders);
+            return jsonResponse({ ok: true, packageId: targetPackageId, declared, values: maskedValues }, 200, corsHeaders);
         }
         catch (err) {
-            if (err.code === "PACKAGE_NOT_ALLOWED" || err.status === 403) {
+            if (err.code === PACKAGE_NOT_ALLOWED || err.status === 403) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: "PACKAGE_NOT_ALLOWED",
+                        code: PACKAGE_NOT_ALLOWED,
                         message: err.message || "Package is not in the allowed package list",
                     },
                 }, 403, corsHeaders);
             }
-            const isClient = err.message?.includes("Unknown or unregistered package") ||
-                err.message?.includes("Invalid packageId") ||
-                err.message?.includes("escapes boundary");
-            return jsonResponse({ ok: false, error: { code: isClient ? "INVALID_ARGUMENT" : "CONFIG_LIST_ERROR", message: err.message } }, isClient ? 400 : 500, corsHeaders);
+            const isClient = isClientConfigError(err);
+            return jsonResponse({ ok: false, error: { code: isClient ? INVALID_ARGUMENT : CONFIG_LIST_ERROR, message: err.message } }, isClient ? 400 : 500, corsHeaders);
         }
     }
     // 3. Config Update: PUT / POST /config
@@ -111,32 +111,27 @@ export async function handleConfigRoutes(ctx) {
         try {
             const body = await readJsonBody(req, { maxBytes: options.maxBodyBytes });
             const pkgParam = url.searchParams.get("package") || url.searchParams.get("packageId") || body.package || undefined;
-            if (pkgParam) {
-                assertPackageAllowed(pkgParam, options);
-            }
-            const app = resolveAppForPackage(pkgParam, host, target, options);
-            assertPackageAllowed(app.packageId, options);
+            const pkgs = await service.discovery.listPackages();
+            const targetPackageId = resolveTargetPackageId(pkgs, pkgParam, options);
             const key = body.key;
             if (!key) {
-                return jsonResponse({ ok: false, error: { code: "INVALID_ARGUMENT", message: "Config 'key' is required" } }, 400, corsHeaders);
+                return jsonResponse({ ok: false, error: { code: INVALID_ARGUMENT, message: "Config 'key' is required" } }, 400, corsHeaders);
             }
-            await app.setConfig(key, body.value);
-            return jsonResponse({ ok: true, packageId: app.packageId, key, message: "updated" }, 200, corsHeaders);
+            await service.management.config.set(targetPackageId, key, body.value);
+            return jsonResponse({ ok: true, packageId: targetPackageId, key, message: "updated" }, 200, corsHeaders);
         }
         catch (err) {
-            if (err.code === "PACKAGE_NOT_ALLOWED" || err.status === 403) {
+            if (err.code === PACKAGE_NOT_ALLOWED || err.status === 403) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: "PACKAGE_NOT_ALLOWED",
+                        code: PACKAGE_NOT_ALLOWED,
                         message: err.message || "Package is not in the allowed package list",
                     },
                 }, 403, corsHeaders);
             }
-            const isClient = err.message?.includes("Unknown or unregistered package") ||
-                err.message?.includes("Invalid packageId") ||
-                err.message?.includes("escapes boundary");
-            return jsonResponse({ ok: false, error: { code: isClient ? "INVALID_ARGUMENT" : "CONFIG_SET_ERROR", message: err.message } }, isClient ? 400 : 500, corsHeaders);
+            const isClient = isClientConfigError(err);
+            return jsonResponse({ ok: false, error: { code: isClient ? INVALID_ARGUMENT : CONFIG_SET_ERROR, message: err.message } }, isClient ? 400 : 500, corsHeaders);
         }
     }
     // 4. Config Delete: DELETE /config/:key
@@ -145,28 +140,23 @@ export async function handleConfigRoutes(ctx) {
         try {
             const key = decodeURIComponent(configKeyMatch[1]);
             const pkgParam = url.searchParams.get("package") || url.searchParams.get("packageId") || undefined;
-            if (pkgParam) {
-                assertPackageAllowed(pkgParam, options);
-            }
-            const app = resolveAppForPackage(pkgParam, host, target, options);
-            assertPackageAllowed(app.packageId, options);
-            const deleted = app.storage.deleteConfig(key);
-            return jsonResponse({ ok: true, packageId: app.packageId, key, deleted }, 200, corsHeaders);
+            const pkgs = await service.discovery.listPackages();
+            const targetPackageId = resolveTargetPackageId(pkgs, pkgParam, options);
+            const deleted = await service.management.config.delete(targetPackageId, key);
+            return jsonResponse({ ok: true, packageId: targetPackageId, key, deleted }, 200, corsHeaders);
         }
         catch (err) {
-            if (err.code === "PACKAGE_NOT_ALLOWED" || err.status === 403) {
+            if (err.code === PACKAGE_NOT_ALLOWED || err.status === 403) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: "PACKAGE_NOT_ALLOWED",
+                        code: PACKAGE_NOT_ALLOWED,
                         message: err.message || "Package is not in the allowed package list",
                     },
                 }, 403, corsHeaders);
             }
-            const isClient = err.message?.includes("Unknown or unregistered package") ||
-                err.message?.includes("Invalid packageId") ||
-                err.message?.includes("escapes boundary");
-            return jsonResponse({ ok: false, error: { code: isClient ? "INVALID_ARGUMENT" : "CONFIG_DELETE_ERROR", message: err.message } }, isClient ? 400 : 500, corsHeaders);
+            const isClient = isClientConfigError(err);
+            return jsonResponse({ ok: false, error: { code: isClient ? INVALID_ARGUMENT : CONFIG_DELETE_ERROR, message: err.message } }, isClient ? 400 : 500, corsHeaders);
         }
     }
     return null;

package/dist/server/routes/doctor.d.ts

@@ -1,5 +1,5 @@
 import { type RouteContext } from "./common.js";
 /**
- * 处理环境与依赖诊断接口（GET /api/v2/doctor、/doctor 与兼容别名 /api/v1/doctor）。
+ * 处理环境与依赖诊断接口（GET /api/v2/doctor 与 /doctor）。
  */
 export declare function handleDoctorRoute(ctx: RouteContext): Promise<Response | null>;