@actiondock/core 2.7.0 → 2.9.0

package/dist/server/routes/config.js

@@ -1,14 +1,22 @@
-import { CAPABILITY_UNAVAILABLE } from "../../errors.js";
+import { CAPABILITY_UNAVAILABLE, CONFIG_DELETE_ERROR, CONFIG_ENV_ERROR, CONFIG_LIST_ERROR, CONFIG_SET_ERROR, INVALID_ARGUMENT, INVALID_PACKAGE_ID, PACKAGE_NOT_ALLOWED, PACKAGE_NOT_FOUND, PATH_TRAVERSAL, } from "../../errors.js";
 import { resolveEnvValue } from "../../runtime/index.js";
-import { isSecretConfigKey, maskSecretValue, sanitizeConfigDefinitions } from "../../storage/index.js";
+import { isSecretConfigKey, sanitizeConfigDefinitions } from "../../storage/index.js";
 import { readJsonBody } from "../body.js";
-import { assertPackageAllowed, getSubPath, jsonResponse, resolveAppForPackage } from "./common.js";
+import { getSubPath, isManagementAllowedByPolicy, jsonResponse, resolveTargetPackageId, } from "./common.js";
+function isClientConfigError(err) {
+    return (err?.code === PACKAGE_NOT_FOUND ||
+        err?.code === INVALID_PACKAGE_ID ||
+        err?.code === PATH_TRAVERSAL ||
+        err?.code === INVALID_ARGUMENT ||
+        err?.status === 400 ||
+        err?.status === 404);
+}
 /**
  * 处理配置元数据与当前值读取、更新及删除接口。
- * 在未显式开启管理功能 (options.enableManagement !== true) 时返回 403 拒绝。
+ * 在未显式开启管理功能时返回 403 拒绝。
  */
 export async function handleConfigRoutes(ctx) {
-    const { req, url, pathname, corsHeaders, options, host, target } = ctx;
+    const { req, url, pathname, corsHeaders, options, service, activePolicy: policy } = ctx;
     const subpath = getSubPath(pathname);
     const isConfigRoute = subpath === "/config" ||
         subpath.startsWith("/config/") ||
@@ -17,7 +25,7 @@ export async function handleConfigRoutes(ctx) {
         return null;
     }
     // 校验管理能力开关
-    if (options.enableManagement !== true) {
+    if (!isManagementAllowedByPolicy(policy) || !service.management?.config) {
         return jsonResponse({
             ok: false,
             error: {
@@ -29,16 +37,14 @@ export async function handleConfigRoutes(ctx) {
     // 1. Config Env Check: GET /config/env
     if (subpath === "/config/env" && req.method === "GET") {
         try {
+            const pkgs = await service.discovery.listPackages();
             const pkgParam = url.searchParams.get("package") || url.searchParams.get("packageId") || undefined;
-            if (pkgParam) {
-                assertPackageAllowed(pkgParam, options);
-            }
-            const app = resolveAppForPackage(pkgParam, host, target, options);
-            assertPackageAllowed(app.packageId, options);
-            const declared = app.projectConfig?.config || {};
+            const targetPackageId = resolveTargetPackageId(pkgs, pkgParam, policy);
+            const pkg = pkgs.find((p) => p.id === targetPackageId);
+            const declared = pkg?.config || {};
             const envChecks = [];
             for (const [k, def] of Object.entries(declared)) {
-                const resolved = resolveEnvValue(k, def, app.packageId);
+                const resolved = resolveEnvValue(k, def, targetPackageId);
                 const matchedEnv = resolved?.envKey || null;
                 envChecks.push({
                     key: k,
@@ -49,61 +55,55 @@ export async function handleConfigRoutes(ctx) {
                     secret: isSecretConfigKey(k, def),
                 });
             }
-            return jsonResponse({ ok: true, packageId: app.packageId, envChecks }, 200, corsHeaders);
+            return jsonResponse({ ok: true, packageId: targetPackageId, envChecks }, 200, corsHeaders);
         }
         catch (err) {
-            if (err.code === "PACKAGE_NOT_ALLOWED" || err.status === 403) {
+            if (err.code === PACKAGE_NOT_ALLOWED || err.status === 403) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: "PACKAGE_NOT_ALLOWED",
+                        code: PACKAGE_NOT_ALLOWED,
                         message: err.message || "Package is not in the allowed package list",
                     },
                 }, 403, corsHeaders);
             }
-            const isClient = err.message?.includes("Unknown or unregistered package") ||
-                err.message?.includes("Invalid packageId") ||
-                err.message?.includes("escapes boundary");
-            return jsonResponse({ ok: false, error: { code: isClient ? "INVALID_ARGUMENT" : "CONFIG_ENV_ERROR", message: err.message } }, isClient ? 400 : 500, corsHeaders);
+            const isClient = isClientConfigError(err);
+            return jsonResponse({ ok: false, error: { code: isClient ? INVALID_ARGUMENT : CONFIG_ENV_ERROR, message: err.message } }, isClient ? 400 : 500, corsHeaders);
         }
     }
     // 2. Config Query: GET /config
     if (subpath === "/config" && req.method === "GET") {
         try {
+            const pkgs = await service.discovery.listPackages();
             const pkgParam = url.searchParams.get("package") || url.searchParams.get("packageId") || undefined;
-            if (pkgParam) {
-                assertPackageAllowed(pkgParam, options);
-            }
-            const app = resolveAppForPackage(pkgParam, host, target, options);
-            assertPackageAllowed(app.packageId, options);
-            const stored = app.storage.listConfig();
-            const rawDeclared = app.projectConfig?.config || {};
+            const targetPackageId = resolveTargetPackageId(pkgs, pkgParam, policy);
+            const pkg = pkgs.find((p) => p.id === targetPackageId);
+            const rawDeclared = pkg?.config || {};
             const declared = sanitizeConfigDefinitions(rawDeclared) || {};
+            const views = await service.management.config.list(targetPackageId);
             const maskedValues = {};
-            for (const [k, v] of Object.entries(stored)) {
-                if (isSecretConfigKey(k, rawDeclared[k])) {
-                    maskedValues[k] = maskSecretValue(v);
+            for (const v of views) {
+                if (v.secret) {
+                    maskedValues[v.key] = "********";
                 }
                 else {
-                    maskedValues[k] = v;
+                    maskedValues[v.key] = v.value;
                 }
             }
-            return jsonResponse({ ok: true, packageId: app.packageId, declared, values: maskedValues }, 200, corsHeaders);
+            return jsonResponse({ ok: true, packageId: targetPackageId, declared, values: maskedValues }, 200, corsHeaders);
         }
         catch (err) {
-            if (err.code === "PACKAGE_NOT_ALLOWED" || err.status === 403) {
+            if (err.code === PACKAGE_NOT_ALLOWED || err.status === 403) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: "PACKAGE_NOT_ALLOWED",
+                        code: PACKAGE_NOT_ALLOWED,
                         message: err.message || "Package is not in the allowed package list",
                     },
                 }, 403, corsHeaders);
             }
-            const isClient = err.message?.includes("Unknown or unregistered package") ||
-                err.message?.includes("Invalid packageId") ||
-                err.message?.includes("escapes boundary");
-            return jsonResponse({ ok: false, error: { code: isClient ? "INVALID_ARGUMENT" : "CONFIG_LIST_ERROR", message: err.message } }, isClient ? 400 : 500, corsHeaders);
+            const isClient = isClientConfigError(err);
+            return jsonResponse({ ok: false, error: { code: isClient ? INVALID_ARGUMENT : CONFIG_LIST_ERROR, message: err.message } }, isClient ? 400 : 500, corsHeaders);
         }
     }
     // 3. Config Update: PUT / POST /config
@@ -111,32 +111,27 @@ export async function handleConfigRoutes(ctx) {
         try {
             const body = await readJsonBody(req, { maxBytes: options.maxBodyBytes });
             const pkgParam = url.searchParams.get("package") || url.searchParams.get("packageId") || body.package || undefined;
-            if (pkgParam) {
-                assertPackageAllowed(pkgParam, options);
-            }
-            const app = resolveAppForPackage(pkgParam, host, target, options);
-            assertPackageAllowed(app.packageId, options);
+            const pkgs = await service.discovery.listPackages();
+            const targetPackageId = resolveTargetPackageId(pkgs, pkgParam, policy);
             const key = body.key;
             if (!key) {
-                return jsonResponse({ ok: false, error: { code: "INVALID_ARGUMENT", message: "Config 'key' is required" } }, 400, corsHeaders);
+                return jsonResponse({ ok: false, error: { code: INVALID_ARGUMENT, message: "Config 'key' is required" } }, 400, corsHeaders);
             }
-            await app.setConfig(key, body.value);
-            return jsonResponse({ ok: true, packageId: app.packageId, key, message: "updated" }, 200, corsHeaders);
+            await service.management.config.set(targetPackageId, key, body.value);
+            return jsonResponse({ ok: true, packageId: targetPackageId, key, message: "updated" }, 200, corsHeaders);
         }
         catch (err) {
-            if (err.code === "PACKAGE_NOT_ALLOWED" || err.status === 403) {
+            if (err.code === PACKAGE_NOT_ALLOWED || err.status === 403) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: "PACKAGE_NOT_ALLOWED",
+                        code: PACKAGE_NOT_ALLOWED,
                         message: err.message || "Package is not in the allowed package list",
                     },
                 }, 403, corsHeaders);
             }
-            const isClient = err.message?.includes("Unknown or unregistered package") ||
-                err.message?.includes("Invalid packageId") ||
-                err.message?.includes("escapes boundary");
-            return jsonResponse({ ok: false, error: { code: isClient ? "INVALID_ARGUMENT" : "CONFIG_SET_ERROR", message: err.message } }, isClient ? 400 : 500, corsHeaders);
+            const isClient = isClientConfigError(err);
+            return jsonResponse({ ok: false, error: { code: isClient ? INVALID_ARGUMENT : CONFIG_SET_ERROR, message: err.message } }, isClient ? 400 : 500, corsHeaders);
         }
     }
     // 4. Config Delete: DELETE /config/:key
@@ -145,28 +140,23 @@ export async function handleConfigRoutes(ctx) {
         try {
             const key = decodeURIComponent(configKeyMatch[1]);
             const pkgParam = url.searchParams.get("package") || url.searchParams.get("packageId") || undefined;
-            if (pkgParam) {
-                assertPackageAllowed(pkgParam, options);
-            }
-            const app = resolveAppForPackage(pkgParam, host, target, options);
-            assertPackageAllowed(app.packageId, options);
-            const deleted = app.storage.deleteConfig(key);
-            return jsonResponse({ ok: true, packageId: app.packageId, key, deleted }, 200, corsHeaders);
+            const pkgs = await service.discovery.listPackages();
+            const targetPackageId = resolveTargetPackageId(pkgs, pkgParam, policy);
+            const deleted = await service.management.config.delete(targetPackageId, key);
+            return jsonResponse({ ok: true, packageId: targetPackageId, key, deleted }, 200, corsHeaders);
         }
         catch (err) {
-            if (err.code === "PACKAGE_NOT_ALLOWED" || err.status === 403) {
+            if (err.code === PACKAGE_NOT_ALLOWED || err.status === 403) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: "PACKAGE_NOT_ALLOWED",
+                        code: PACKAGE_NOT_ALLOWED,
                         message: err.message || "Package is not in the allowed package list",
                     },
                 }, 403, corsHeaders);
             }
-            const isClient = err.message?.includes("Unknown or unregistered package") ||
-                err.message?.includes("Invalid packageId") ||
-                err.message?.includes("escapes boundary");
-            return jsonResponse({ ok: false, error: { code: isClient ? "INVALID_ARGUMENT" : "CONFIG_DELETE_ERROR", message: err.message } }, isClient ? 400 : 500, corsHeaders);
+            const isClient = isClientConfigError(err);
+            return jsonResponse({ ok: false, error: { code: isClient ? INVALID_ARGUMENT : CONFIG_DELETE_ERROR, message: err.message } }, isClient ? 400 : 500, corsHeaders);
         }
     }
     return null;

package/dist/server/routes/doctor.d.ts

@@ -1,5 +1,5 @@
 import { type RouteContext } from "./common.js";
 /**
- * 处理环境与依赖诊断接口（GET /api/v2/doctor、/doctor 与兼容别名 /api/v1/doctor）。
+ * 处理环境与依赖诊断接口（GET /api/v2/doctor 与 /doctor）。
  */
 export declare function handleDoctorRoute(ctx: RouteContext): Promise<Response | null>;

package/dist/server/routes/doctor.js

@@ -1,63 +1,55 @@
+import { DOCTOR_ERROR, PACKAGE_NOT_ALLOWED } from "../../errors.js";
 import { runDoctorChecks } from "../../doctor/doctor.js";
 import { assertPackageAllowed, getSubPath, jsonResponse } from "./common.js";
 /**
- * 处理环境与依赖诊断接口（GET /api/v2/doctor、/doctor 与兼容别名 /api/v1/doctor）。
+ * 处理环境与依赖诊断接口（GET /api/v2/doctor 与 /doctor）。
  */
 export async function handleDoctorRoute(ctx) {
-    const { req, url, pathname, corsHeaders, projectRoot, customHome, host, target, options } = ctx;
+    const { req, url, pathname, corsHeaders, projectRoot, customHome, service, options, activePolicy: policy } = ctx;
     const subpath = getSubPath(pathname);
     if (subpath !== "/doctor" || req.method !== "GET") {
         return null;
     }
     try {
         const targetPkg = url.searchParams.get("package") || url.searchParams.get("packageId") || undefined;
-        if (options.packageAllowlist && options.packageAllowlist.length > 0) {
+        if (policy.packageAllowlist && policy.packageAllowlist.length > 0) {
             if (!targetPkg) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: "PACKAGE_NOT_ALLOWED",
+                        code: PACKAGE_NOT_ALLOWED,
                         message: "Global doctor check is forbidden when package allowlist is active. Please specify an allowed package.",
                     },
                 }, 403, corsHeaders);
             }
         }
         if (targetPkg) {
-            assertPackageAllowed(targetPkg, options);
+            assertPackageAllowed(targetPkg, policy);
         }
         let packageRoot;
         if (targetPkg) {
-            if (host) {
-                packageRoot = host.getApp(targetPkg)?.packageRoot;
-            }
-            if (!packageRoot && target?.unwrap) {
-                const inner = target.unwrap();
-                if (inner && "getApp" in inner && typeof inner.getApp === "function") {
-                    packageRoot = inner.getApp(targetPkg)?.packageRoot;
-                }
-                else if (inner && "packageId" in inner && inner.packageId === targetPkg) {
-                    packageRoot = inner.packageRoot;
-                }
-            }
+            const pkgs = await service.discovery.listPackages();
+            const matched = pkgs.find((p) => p.id === targetPkg || p.packageRoot === targetPkg);
+            packageRoot = matched?.packageRoot;
         }
         const report = await runDoctorChecks({
             cwd: packageRoot || projectRoot || process.cwd(),
             packageIdOrPath: packageRoot || targetPkg,
             customHome,
-            packageAllowlist: options.packageAllowlist,
+            packageAllowlist: policy.packageAllowlist,
         });
         return jsonResponse({ ok: true, report }, 200, corsHeaders);
     }
     catch (err) {
-        if (err.code === "PACKAGE_NOT_ALLOWED" || err.status === 403) {
+        if (err.code === PACKAGE_NOT_ALLOWED || err.status === 403) {
             return jsonResponse({
                 ok: false,
                 error: {
-                    code: "PACKAGE_NOT_ALLOWED",
+                    code: PACKAGE_NOT_ALLOWED,
                     message: err.message || "Package is not in the allowed package list",
                 },
             }, 403, corsHeaders);
         }
-        return jsonResponse({ ok: false, error: { code: "DOCTOR_ERROR", message: err.message } }, 500, corsHeaders);
+        return jsonResponse({ ok: false, error: { code: DOCTOR_ERROR, message: err.message } }, 500, corsHeaders);
     }
 }

package/dist/server/routes/health.d.ts

@@ -1,5 +1,5 @@
 import { type RouteContext } from "./common.js";
 /**
- * 处理健康检查与就绪状态接口（支持 /api/v2/health、/health 与兼容别名 /api/v1/health）。
+ * 处理健康检查与就绪状态接口（支持 /api/v2/health 与 /health）。
  */
 export declare function handleHealthRoute(ctx: RouteContext): Promise<Response | null>;

package/dist/server/routes/health.js

@@ -3,16 +3,15 @@ import { UNAUTHORIZED } from "../../errors.js";
 import { verifyBearerToken } from "../security.js";
 import { jsonResponse } from "./common.js";
 /**
- * 处理健康检查与就绪状态接口（支持 /api/v2/health、/health 与兼容别名 /api/v1/health）。
+ * 处理健康检查与就绪状态接口（支持 /api/v2/health 与 /health）。
  */
 export async function handleHealthRoute(ctx) {
-    const { req, pathname, corsHeaders, options, projectRoot } = ctx;
+    const { req, pathname, corsHeaders, options, projectRoot, activePolicy: policy } = ctx;
     if (pathname !== "/api/v2/health" &&
-        pathname !== "/health" &&
-        pathname !== "/api/v1/health") {
+        pathname !== "/health") {
         return null;
     }
-    if (!verifyBearerToken(req, options.token, options)) {
+    if (!verifyBearerToken(req, policy.token, options)) {
         return jsonResponse({
             ok: false,
             error: {

package/dist/server/routes/info.d.ts

@@ -1,7 +1,7 @@
 import { type RouteContext } from "./common.js";
 /**
  * 处理系统自省与包信息接口：
- * - GET /api/v2/info 与 GET /info -> 委托 target.info()
- * - GET /api/v2/packages 与 GET /packages -> 委托 host.info() 或 target.info()
+ * - GET /api/v2/info 与 GET /info -> 委托 service.info()
+ * - GET /api/v2/packages 与 GET /packages -> 委托 service.discovery.listPackages()
  */
 export declare function handleInfoRoute(ctx: RouteContext): Promise<Response | null>;

package/dist/server/routes/info.js

@@ -1,8 +1,8 @@
 import { filterWithFallbackInfo } from "../../filter/index.js";
-import { PACKAGE_NOT_FOUND } from "../../errors.js";
+import { INFO_ERROR, PACKAGE_NOT_ALLOWED, PACKAGE_NOT_FOUND, PACKAGES_INFO_ERROR } from "../../errors.js";
 import { ACTIONDOCK_VERSION } from "../../version.js";
 import { sanitizeConfigDefinitions } from "../../storage/index.js";
-import { assertPackageAllowed, getSubPath, jsonResponse } from "./common.js";
+import { assertPackageAllowed, filterPackagesByPolicy, getSubPath, jsonResponse } from "./common.js";
 function sanitizePackage(pkg, exposeDebugInfo) {
     if (!pkg)
         return pkg;
@@ -18,42 +18,39 @@ function sanitizePackage(pkg, exposeDebugInfo) {
 }
 /**
  * 处理系统自省与包信息接口：
- * - GET /api/v2/info 与 GET /info -> 委托 target.info()
- * - GET /api/v2/packages 与 GET /packages -> 委托 host.info() 或 target.info()
+ * - GET /api/v2/info 与 GET /info -> 委托 service.info()
+ * - GET /api/v2/packages 与 GET /packages -> 委托 service.discovery.listPackages()
  */
 export async function handleInfoRoute(ctx) {
-    const { req, url, pathname, corsHeaders, options, target, host, projectRoot } = ctx;
+    const { req, url, pathname, corsHeaders, options, service, projectRoot, activePolicy: policy } = ctx;
     const subpath = getSubPath(pathname);
     // 1. Packages List: GET /api/v2/packages, /packages
     if ((subpath === "/packages" || pathname === "/api/v2/packages" || pathname === "/packages") && req.method === "GET") {
         try {
             const targetPkg = url.searchParams.get("package") || url.searchParams.get("packageId") || undefined;
             if (targetPkg) {
-                assertPackageAllowed(targetPkg, options);
-            }
-            const rawPackages = target ? await target.listPackages() : (host ? await host.info() : []);
-            let packages = rawPackages.map((p) => sanitizePackage(p, options.exposeDebugInfo));
-            if (options.packageAllowlist && Array.isArray(options.packageAllowlist) && options.packageAllowlist.length > 0) {
-                packages = packages.filter((p) => p.id && options.packageAllowlist.includes(p.id));
+                assertPackageAllowed(targetPkg, policy);
             }
+            const rawPackages = await service.discovery.listPackages();
+            const packages = filterPackagesByPolicy(rawPackages.map((p) => sanitizePackage(p, options.exposeDebugInfo)), policy);
             return jsonResponse({
                 ok: true,
                 packages,
             }, 200, corsHeaders);
         }
         catch (err) {
-            if (err.code === "PACKAGE_NOT_ALLOWED" || err.status === 403) {
+            if (err.code === PACKAGE_NOT_ALLOWED || err.status === 403) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: "PACKAGE_NOT_ALLOWED",
+                        code: PACKAGE_NOT_ALLOWED,
                         message: err.message || "Package is not in the allowed package list",
                     },
                 }, 403, corsHeaders);
             }
             return jsonResponse({
                 ok: false,
-                error: { code: "PACKAGES_INFO_ERROR", message: err.message },
+                error: { code: PACKAGES_INFO_ERROR, message: err.message },
             }, 500, corsHeaders);
         }
     }
@@ -64,14 +61,10 @@ export async function handleInfoRoute(ctx) {
             const intent = url.searchParams.get("intent") || undefined;
             const targetPkg = url.searchParams.get("package") || url.searchParams.get("packageId") || undefined;
             if (targetPkg) {
-                assertPackageAllowed(targetPkg, options);
-            }
-            const targetInfo = await target.info();
-            const rawPackages = targetInfo.packages || [];
-            let packages = rawPackages.map((p) => sanitizePackage(p, options.exposeDebugInfo));
-            if (options.packageAllowlist && Array.isArray(options.packageAllowlist) && options.packageAllowlist.length > 0) {
-                packages = packages.filter((p) => p.id && options.packageAllowlist.includes(p.id));
+                assertPackageAllowed(targetPkg, policy);
             }
+            const rawPackages = await service.info();
+            const packages = filterPackagesByPolicy(rawPackages.map((p) => sanitizePackage(p, options.exposeDebugInfo)), policy);
             if (isTree) {
                 return jsonResponse({ ok: true, type: "tree", packages }, 200, corsHeaders);
             }
@@ -139,18 +132,18 @@ export async function handleInfoRoute(ctx) {
             }, 200, corsHeaders);
         }
         catch (err) {
-            if (err.code === "PACKAGE_NOT_ALLOWED" || err.status === 403) {
+            if (err.code === PACKAGE_NOT_ALLOWED || err.status === 403) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: "PACKAGE_NOT_ALLOWED",
+                        code: PACKAGE_NOT_ALLOWED,
                         message: err.message || "Package is not in the allowed package list",
                     },
                 }, 403, corsHeaders);
             }
             return jsonResponse({
                 ok: false,
-                error: { code: "INFO_ERROR", message: err.message },
+                error: { code: INFO_ERROR, message: err.message },
             }, 500, corsHeaders);
         }
     }

package/dist/server/routes/playbooks.js

@@ -1,10 +1,11 @@
 import { filterByIntent } from "../../filter/index.js";
-import { assertPackageAllowed, getSubPath, jsonResponse } from "./common.js";
+import { PACKAGE_NOT_ALLOWED, PLAYBOOK_NOT_FOUND, PLAYBOOKS_LIST_ERROR } from "../../errors.js";
+import { assertPackageAllowed, getSubPath, isPackageAllowedByPolicy, jsonResponse } from "./common.js";
 /**
  * 处理 Playbook 规程相关的 HTTP 路由（列表与 SOP 详情查询）。
  */
 export async function handlePlaybooksRoutes(ctx) {
-    const { req, url, pathname, corsHeaders, target, host, options } = ctx;
+    const { req, url, pathname, corsHeaders, service, options, activePolicy: policy } = ctx;
     const subpath = getSubPath(pathname);
     // 1. Playbooks List: GET /api/v2/playbooks, GET /playbooks
     if (subpath === "/playbooks" && req.method === "GET") {
@@ -12,14 +13,14 @@ export async function handlePlaybooksRoutes(ctx) {
             const intent = url.searchParams.get("intent") || undefined;
             const targetPkg = url.searchParams.get("package") || url.searchParams.get("packageId") || undefined;
             if (targetPkg) {
-                assertPackageAllowed(targetPkg, options);
+                assertPackageAllowed(targetPkg, policy);
             }
-            let pbs = await target.listPlaybooks({ intent, package: targetPkg });
+            let pbs = await service.discovery.listPlaybooks({ intent, package: targetPkg });
             if (targetPkg) {
                 pbs = pbs.filter((p) => p.packageId === targetPkg);
             }
-            if (options.packageAllowlist && Array.isArray(options.packageAllowlist) && options.packageAllowlist.length > 0) {
-                pbs = pbs.filter((p) => p.packageId && options.packageAllowlist.includes(p.packageId));
+            if (policy.packageAllowlist && Array.isArray(policy.packageAllowlist) && policy.packageAllowlist.length > 0) {
+                pbs = pbs.filter((p) => isPackageAllowedByPolicy(p.packageId, policy));
             }
             if (intent) {
                 pbs = filterByIntent(pbs, intent, [(p) => p.id, (p) => p.description || "", (p) => p.packageId || "", (p) => (p.actions || []).join(" ")], false);
@@ -27,16 +28,16 @@ export async function handlePlaybooksRoutes(ctx) {
             return jsonResponse(pbs, 200, corsHeaders);
         }
         catch (err) {
-            if (err.code === "PACKAGE_NOT_ALLOWED" || err.status === 403) {
+            if (err.code === PACKAGE_NOT_ALLOWED || err.status === 403) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: "PACKAGE_NOT_ALLOWED",
+                        code: PACKAGE_NOT_ALLOWED,
                         message: err.message || "Package is not in the allowed package list",
                     },
                 }, 403, corsHeaders);
             }
-            return jsonResponse({ ok: false, error: { code: "PLAYBOOKS_LIST_ERROR", message: err.message } }, 500, corsHeaders);
+            return jsonResponse({ ok: false, error: { code: PLAYBOOKS_LIST_ERROR, message: err.message } }, 500, corsHeaders);
         }
     }
     // 2. Multi-package Playbook Show: GET /api/v2/packages/:packageId/playbooks/:playbookId
@@ -45,27 +46,27 @@ export async function handlePlaybooksRoutes(ctx) {
         const packageId = decodeURIComponent(pkgPlaybookMatch[1]);
         const playbookId = decodeURIComponent(pkgPlaybookMatch[2]);
         try {
-            assertPackageAllowed(packageId, options);
+            assertPackageAllowed(packageId, policy);
         }
         catch (err) {
             return jsonResponse({
                 ok: false,
                 error: {
-                    code: "PACKAGE_NOT_ALLOWED",
+                    code: PACKAGE_NOT_ALLOWED,
                     message: err.message || `Package '${packageId}' is not in the allowed package list`,
                 },
             }, 403, corsHeaders);
         }
         const ref = `${packageId}/${playbookId}`;
         try {
-            const pb = await target.describePlaybook(ref);
+            const pb = await service.discovery.describePlaybook(ref);
             return jsonResponse(pb, 200, corsHeaders);
         }
         catch (err) {
             return jsonResponse({
                 ok: false,
                 error: {
-                    code: "PLAYBOOK_NOT_FOUND",
+                    code: PLAYBOOK_NOT_FOUND,
                     message: err.message || `Playbook '${playbookId}' not found in package '${packageId}'`,
                 },
             }, 404, corsHeaders);
@@ -78,56 +79,42 @@ export async function handlePlaybooksRoutes(ctx) {
         if (playbookId.includes("/")) {
             const pkgFromRef = playbookId.slice(0, playbookId.lastIndexOf("/"));
             try {
-                assertPackageAllowed(pkgFromRef, options);
+                assertPackageAllowed(pkgFromRef, policy);
             }
             catch (err) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: "PACKAGE_NOT_ALLOWED",
+                        code: PACKAGE_NOT_ALLOWED,
                         message: err.message || `Package '${pkgFromRef}' is not in the allowed package list`,
                     },
                 }, 403, corsHeaders);
             }
         }
         try {
-            const pb = await target.describePlaybook(playbookId);
-            const unwrapped = target.unwrap?.();
-            let pkgId = pb.packageId || (unwrapped && "packageId" in unwrapped ? unwrapped.packageId : undefined);
-            if (!pkgId && host) {
-                for (const app of host.listApps()) {
-                    try {
-                        const map = app.getStaticPlaybookMap?.();
-                        const cleanId = playbookId.replace(/\.md$/, "");
-                        if (map?.has(cleanId) || map?.has(playbookId)) {
-                            pkgId = app.packageId;
-                            break;
-                        }
-                    }
-                    catch { }
-                }
-            }
+            const pb = await service.discovery.describePlaybook(playbookId);
+            let pkgId = pb.packageId;
             if (!pkgId) {
-                const allPbs = await target.listPlaybooks().catch(() => []);
+                const allPbs = await service.discovery.listPlaybooks().catch(() => []);
                 const matched = allPbs.find((p) => p.id === playbookId || p.id.endsWith(`/${playbookId}`));
                 if (matched?.packageId) {
                     pkgId = matched.packageId;
                 }
             }
-            assertPackageAllowed(pkgId, options);
+            assertPackageAllowed(pkgId, policy);
             return jsonResponse(pb, 200, corsHeaders);
         }
         catch (err) {
-            if (err.code === "PACKAGE_NOT_ALLOWED" || err.status === 403) {
+            if (err.code === PACKAGE_NOT_ALLOWED || err.status === 403) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: "PACKAGE_NOT_ALLOWED",
+                        code: PACKAGE_NOT_ALLOWED,
                         message: err.message || "Package is not in the allowed package list",
                     },
                 }, 403, corsHeaders);
             }
-            return jsonResponse({ ok: false, error: { code: "PLAYBOOK_NOT_FOUND", message: err.message } }, 404, corsHeaders);
+            return jsonResponse({ ok: false, error: { code: PLAYBOOK_NOT_FOUND, message: err.message } }, 404, corsHeaders);
         }
     }
     return null;