@sasjs/api 0.10.0 → 0.11.0

package/build/cjs/corpus/code.js

@@ -38,13 +38,50 @@ exports.CODE_CORPUS = [
             ]
         }
     },
-    // Two refusals are deliberately not pinned here yet: a `code` that is not a
-    // string, and one that is empty. The package answers 400 `"code" must be a
-    // string` / `"code" is not allowed to be empty` - the messages the server's
-    // schema produces - but sasjs/server's code controller carries no
-    // `@Response(400)` for these routes, so the document states 200 alone and the
-    // parity gate refuses a case answering anything else. The cases land when the
-    // decorators do.
+    {
+        id: 'code-lint-unauthenticated',
+        route: 'POST /SASjsApi/code/lint',
+        description: 'refuses a caller with no token',
+        request: { body: { code: 'data _null_; run;' } },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'code-lint-non-string',
+        route: 'POST /SASjsApi/code/lint',
+        description: 'refuses a code value that is not a string, rather than coercing it',
+        request: {
+            subject: { userId: 'user-admin', clientId: 'web_app' },
+            body: { code: 123 }
+        },
+        expect: { status: 400, error: '"code" must be a string' }
+    },
+    {
+        id: 'code-lint-empty',
+        route: 'POST /SASjsApi/code/lint',
+        description: 'refuses an empty buffer, which is not the same as a missing one',
+        request: {
+            subject: { userId: 'user-admin', clientId: 'web_app' },
+            body: { code: '' }
+        },
+        expect: { status: 400, error: '"code" is not allowed to be empty' }
+    },
+    {
+        id: 'code-format-unauthenticated',
+        route: 'POST /SASjsApi/code/format',
+        description: 'refuses a caller with no token',
+        request: { body: { code: 'data _null_; run;' } },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'code-format-non-string',
+        route: 'POST /SASjsApi/code/format',
+        description: 'refuses a code value that is not a string',
+        request: {
+            subject: { userId: 'user-admin', clientId: 'web_app' },
+            body: { code: 123 }
+        },
+        expect: { status: 400, error: '"code" must be a string' }
+    },
     {
         id: 'code-format-adds-the-header',
         route: 'POST /SASjsApi/code/format',

package/build/cjs/corpus/runner.js

@@ -6,6 +6,8 @@ const service_js_1 = require("../drive/service.js");
 const memory_store_js_1 = require("../drive/memory-store.js");
 const service_js_2 = require("../identity/service.js");
 const records_js_1 = require("../identity/records.js");
+const service_js_3 = require("../session/service.js");
+const memory_host_js_1 = require("../session/memory-host.js");
 const memory_store_js_2 = require("../identity/memory-store.js");
 const fixture_js_1 = require("../identity/fixture.js");
 const types_js_1 = require("../types.js");
@@ -26,7 +28,8 @@ const servicesFor = (testCase) => {
             ? new RefusingDriveStore(testCase.seed || {})
             : new memory_store_js_1.MemoryDriveStore(testCase.seed || {})),
         identity: (0, service_js_2.createIdentityService)(identity),
-        records: (0, records_js_1.createRecordService)(identity)
+        records: (0, records_js_1.createRecordService)(identity),
+        session: (0, service_js_3.createSessionService)(identity, new memory_host_js_1.MemorySessionHost())
     };
 };
 exports.servicesFor = servicesFor;

package/build/cjs/corpus/session.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SESSION_CORPUS = void 0;
+const ADMIN = { userId: 'user-admin', clientId: 'web_app' };
+const RESTRICTED = { userId: 'user-restricted', clientId: 'web_app' };
+exports.SESSION_CORPUS = [
+    {
+        id: 'session-summary-own',
+        route: 'GET /SASjsApi/session/{sessionId}',
+        description: 'answers the owner the summary of their own session',
+        request: { subject: ADMIN, params: { sessionId: 'sess-admin' } },
+        expect: {
+            status: 200,
+            body: {
+                sessionId: 'sess-admin',
+                state: 'completed',
+                pid: 4242,
+                creationTimeStamp: '2026-11-07T09:00:00.000Z',
+                deathTimeStamp: '2026-11-07T09:00:04.000Z',
+                expiresAfterMins: 60
+            }
+        }
+    },
+    {
+        id: 'session-summary-as-admin',
+        route: 'GET /SASjsApi/session/{sessionId}',
+        description: "answers an administrator another account's session",
+        request: { subject: ADMIN, params: { sessionId: 'sess-restricted' } },
+        expect: {
+            status: 200,
+            body: {
+                sessionId: 'sess-restricted',
+                state: 'running',
+                pid: 4243,
+                creationTimeStamp: '2026-11-07T09:05:00.000Z'
+            }
+        }
+    },
+    {
+        id: 'session-log-own',
+        route: 'GET /SASjsApi/session/{sessionId}/log',
+        description: 'answers the log this session wrote',
+        request: { subject: ADMIN, params: { sessionId: 'sess-admin' } },
+        expect: {
+            status: 200,
+            contents: 'NOTE: session started\nNOTE: session completed\n'
+        }
+    },
+    {
+        id: 'session-log-nothing-written',
+        route: 'GET /SASjsApi/session/{sessionId}/log',
+        description: 'answers an empty body for a session that has written nothing',
+        request: { subject: ADMIN, params: { sessionId: 'sess-silent' } },
+        expect: { status: 200, contents: '' }
+    },
+    {
+        id: 'session-output-own',
+        route: 'GET /SASjsApi/session/{sessionId}/output',
+        description: 'answers the webout this session produced',
+        request: { subject: ADMIN, params: { sessionId: 'sess-admin' } },
+        expect: { status: 200, contents: '<html><body>42</body></html>' }
+    },
+    {
+        id: 'session-state-own',
+        route: 'GET /SASjsApi/session/{sessionId}/state',
+        description: "answers the run time's state for this session",
+        request: { subject: RESTRICTED, params: { sessionId: 'sess-restricted' } },
+        expect: {
+            status: 200,
+            body: { state: 'running', pid: 4243, lineCount: 3 }
+        }
+    }
+];

package/build/cjs/host/dispatch.js

@@ -74,6 +74,12 @@ const dispatch = async (services, routeId, request = {}) => {
     const body = request.body || {};
     const params = request.params || {};
     /** The record service, or the 501 a host without one answers. */
+    /** The host's sessions, or the 501 that names the missing capability. */
+    const sessionRequired = () => {
+        if (!services.session)
+            throw new types_js_1.ApiError(501, `This host has no session service, so it cannot answer ${routeId}.`);
+        return services.session;
+    };
     const required = () => {
         if (!records)
             throw new types_js_1.ApiError(501, `This host has no record service, so it cannot answer ${routeId}.`);
@@ -171,6 +177,31 @@ const dispatch = async (services, routeId, request = {}) => {
         }
         case 'GET /SASjsApi/drive/filetree':
             return { status: 200, body: await drive.tree(query._folderPath) };
+        // ------------------------------------------------------------- sessions
+        case 'GET /SASjsApi/session/{sessionId}': {
+            return {
+                status: 200,
+                body: await sessionRequired().summary(await caller(), String(params.sessionId ?? ''))
+            };
+        }
+        case 'GET /SASjsApi/session/{sessionId}/log': {
+            return {
+                status: 200,
+                contents: await sessionRequired().log(await caller(), String(params.sessionId ?? ''))
+            };
+        }
+        case 'GET /SASjsApi/session/{sessionId}/output': {
+            return {
+                status: 200,
+                contents: await sessionRequired().output(await caller(), String(params.sessionId ?? ''))
+            };
+        }
+        case 'GET /SASjsApi/session/{sessionId}/state': {
+            return {
+                status: 200,
+                body: await sessionRequired().state(await caller(), String(params.sessionId ?? ''))
+            };
+        }
         // ------------------------------------------------------------- records
         //
         // The administration routes: users, groups, permission rules, clients and the
@@ -357,6 +388,10 @@ const dispatch = async (services, routeId, request = {}) => {
 exports.dispatch = dispatch;
 /** Whether a route is one `dispatch` can answer today. */
 exports.HANDLED_ROUTES = [
+    'GET /SASjsApi/session/{sessionId}',
+    'GET /SASjsApi/session/{sessionId}/log',
+    'GET /SASjsApi/session/{sessionId}/output',
+    'GET /SASjsApi/session/{sessionId}/state',
     'POST /SASjsApi/code/lint',
     'POST /SASjsApi/code/format',
     'GET /SASjsApi/info/authorizedRoutes',

package/build/cjs/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.servicesFor = exports.runCase = exports.PROVIDER_MANAGED = exports.ADMIN_SIGNED_IN = exports.RECORD_CORPUS = exports.IDENTITY_CORPUS = exports.DRIVE_CORPUS = exports.parseIdentity = exports.IDENTITY_FORMAT = exports.DEFAULT_IDENTITY = exports.MemoryIdentityStore = exports.CODE_CORPUS = exports.sanitiseDisplayName = exports.createRecordService = exports.createIdentityService = exports.HANDLED_ROUTES = exports.dispatch = exports.TAG_CAPABILITIES = exports.OVERLAY = exports.findRoute = exports.routeById = exports.ROUTES = exports.MemoryDriveStore = exports.measureDeployTree = exports.isDeployTree = exports.deployTree = exports.decodeBase64 = exports.checkDeployTree = exports.DEPLOY_SUCCESS = exports.DEPLOY_PAYLOAD_BYTES = exports.DEPLOY_LIMITS = exports.createDriveService = exports.isRoot = exports.basename = exports.dirname = exports.hasBlockedExtension = exports.normaliseDrivePath = void 0;
+exports.servicesFor = exports.runCase = exports.PROVIDER_MANAGED = exports.ADMIN_SIGNED_IN = exports.RECORD_CORPUS = exports.SESSION_CORPUS = exports.IDENTITY_CORPUS = exports.DRIVE_CORPUS = exports.parseIdentity = exports.IDENTITY_FORMAT = exports.DEFAULT_IDENTITY = exports.MemoryIdentityStore = exports.CODE_CORPUS = exports.sanitiseDisplayName = exports.createRecordService = exports.createIdentityService = exports.HANDLED_ROUTES = exports.dispatch = exports.TAG_CAPABILITIES = exports.OVERLAY = exports.findRoute = exports.routeById = exports.ROUTES = exports.MemoryDriveStore = exports.measureDeployTree = exports.isDeployTree = exports.deployTree = exports.decodeBase64 = exports.checkDeployTree = exports.DEPLOY_SUCCESS = exports.DEPLOY_PAYLOAD_BYTES = exports.DEPLOY_LIMITS = exports.createDriveService = exports.isRoot = exports.basename = exports.dirname = exports.hasBlockedExtension = exports.normaliseDrivePath = void 0;
 /**
  * `@sasjs/api` - the SASjs Server API described once.
  *
@@ -79,6 +79,8 @@ var drive_js_1 = require("./corpus/drive.js");
 Object.defineProperty(exports, "DRIVE_CORPUS", { enumerable: true, get: function () { return drive_js_1.DRIVE_CORPUS; } });
 var identity_js_1 = require("./corpus/identity.js");
 Object.defineProperty(exports, "IDENTITY_CORPUS", { enumerable: true, get: function () { return identity_js_1.IDENTITY_CORPUS; } });
+var session_js_1 = require("./corpus/session.js");
+Object.defineProperty(exports, "SESSION_CORPUS", { enumerable: true, get: function () { return session_js_1.SESSION_CORPUS; } });
 var records_js_2 = require("./corpus/records.js");
 Object.defineProperty(exports, "RECORD_CORPUS", { enumerable: true, get: function () { return records_js_2.RECORD_CORPUS; } });
 Object.defineProperty(exports, "ADMIN_SIGNED_IN", { enumerable: true, get: function () { return records_js_2.ADMIN_SIGNED_IN; } });

package/build/cjs/routes/generated.js

@@ -347,6 +347,14 @@ exports.GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 400,
+                description: '"code" is required / "code" must be a string / "code" is not allowed to be empty'
+            },
+            {
+                status: 401,
+                description: 'Unauthorized'
             }
         ]
     },
@@ -375,6 +383,14 @@ exports.GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 400,
+                description: '"code" is required / "code" must be a string / "code" is not allowed to be empty'
+            },
+            {
+                status: 401,
+                description: 'Unauthorized'
             }
         ]
     },

package/build/cjs/routes/overlay.js

@@ -27,7 +27,6 @@ exports.TAG_CAPABILITIES = {
  */
 const DIRECTORY = 'Synchronising with an external auth provider needs a directory port, which this package does not have: a host decides which directory it holds accounts in, and answers this itself.';
 const RUNTIME = 'Starting a program needs a runtime port, which this package does not have: a host decides which languages it holds, and answers this itself until then.';
-const SESSION_RECORD = "A triggered session's record, log, output and state belong to the runtime that ran the program, and this package has no runtime port.";
 const HOST_CONFIG = "The body is the host's own configuration - ports, run times and providers - which a mock states for itself and this package cannot know.";
 const HOST_OWNED = "The host owns this report: it describes the host's own process and files, which a browser build has no equivalent of.";
 const WEB_BUNDLE = 'The host serves its own web bundle; there is no API decision here for this package to answer.';
@@ -205,22 +204,13 @@ exports.OVERLAY = {
         implemented: true,
         responses: { 200: user }
     },
-    'GET /SASjsApi/session/{sessionId}': {
-        implemented: false,
-        reason: SESSION_RECORD
-    },
-    'GET /SASjsApi/session/{sessionId}/log': {
-        implemented: false,
-        reason: SESSION_RECORD
-    },
-    'GET /SASjsApi/session/{sessionId}/output': {
-        implemented: false,
-        reason: SESSION_RECORD
-    },
-    'GET /SASjsApi/session/{sessionId}/state': {
-        implemented: false,
-        reason: SESSION_RECORD
-    },
+    // The port takes the owner as a uid and falls back to a username, which is
+    // what sasjs/server records today - a host hands its sessions through as they
+    // are, and the comparison tries the identifier first.
+    'GET /SASjsApi/session/{sessionId}': { implemented: true },
+    'GET /SASjsApi/session/{sessionId}/log': { implemented: true },
+    'GET /SASjsApi/session/{sessionId}/output': { implemented: true },
+    'GET /SASjsApi/session/{sessionId}/state': { implemented: true },
     // STP - a stored program, on the runtime port
     'GET /SASjsApi/stp/execute': { implemented: false, reason: RUNTIME },
     'POST /SASjsApi/stp/execute': { implemented: false, reason: RUNTIME },

package/build/cjs/session/memory-host.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemorySessionHost = exports.DEFAULT_SESSIONS = void 0;
+/**
+ * The sessions the corpus and the package's own tests read.
+ *
+ * One session per account, so the interesting case is expressible: an
+ * administrator may read a session that is not theirs, and the other way round
+ * answers the 404 that hides it. `sess-silent` exists with nothing written yet,
+ * because an empty log is a 200 and not a 404.
+ */
+exports.DEFAULT_SESSIONS = {
+    'sess-admin': {
+        owner: 'user-admin',
+        summary: {
+            sessionId: 'sess-admin',
+            state: 'completed',
+            pid: 4242,
+            creationTimeStamp: '2026-11-07T09:00:00.000Z',
+            deathTimeStamp: '2026-11-07T09:00:04.000Z',
+            expiresAfterMins: 60
+        }
+    },
+    'sess-restricted': {
+        owner: 'user-restricted',
+        summary: {
+            sessionId: 'sess-restricted',
+            state: 'running',
+            pid: 4243,
+            creationTimeStamp: '2026-11-07T09:05:00.000Z'
+        }
+    },
+    'sess-silent': {
+        owner: 'user-admin',
+        summary: {
+            sessionId: 'sess-silent',
+            state: 'running',
+            pid: 4244,
+            creationTimeStamp: '2026-11-07T09:10:00.000Z'
+        }
+    }
+};
+const STATES = {
+    'sess-admin': { state: 'completed', pid: 4242, lineCount: 12 },
+    'sess-restricted': { state: 'running', pid: 4243, lineCount: 3 }
+};
+const LOGS = {
+    'sess-admin': 'NOTE: session started\nNOTE: session completed\n',
+    'sess-restricted': 'NOTE: session started\n',
+    'sess-silent': ''
+};
+const OUTPUTS = {
+    'sess-admin': '<html><body>42</body></html>',
+    'sess-restricted': '',
+    'sess-silent': ''
+};
+class MemorySessionHost {
+    constructor(sessions = exports.DEFAULT_SESSIONS) {
+        this.sessions = sessions;
+    }
+    async session(id) {
+        return this.sessions[id];
+    }
+    async state(id) {
+        return STATES[id];
+    }
+    async log(id) {
+        return LOGS[id];
+    }
+    async output(id) {
+        return OUTPUTS[id];
+    }
+}
+exports.MemorySessionHost = MemorySessionHost;

package/build/cjs/session/service.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSessionService = void 0;
+const types_js_1 = require("../types.js");
+/**
+ * The four session routes, over the host's own session store.
+ *
+ * The caller passes a `Subject` and nothing else: which account that is, whether
+ * it is an administrator, and whether the session is theirs are all resolved
+ * here, against the same store the records service reads. A host never states a
+ * role.
+ *
+ * `404` covers both "no such session" and "not yours", on purpose: a session id
+ * is handed to the caller that triggered the program and is built from a
+ * timestamp plus a small random number, so it is guessable within a window, and
+ * confirming the id exists would say it was right.
+ */
+const createSessionService = (store, host) => {
+    /** The server's wording, so adopting it here does not become a later change. */
+    const notFound = (id) => `Session with ID '${id}' was not found.`;
+    /** The caller, and the session if they may see it - or the 404 that hides it. */
+    const visible = async (caller, id) => {
+        if (!caller)
+            throw new types_js_1.ApiError(401, 'Unauthorized');
+        const reader = await store.userById(caller.userId);
+        if (!reader || !reader.isActive)
+            throw new types_js_1.ApiError(401, 'Unauthorized');
+        const session = await host.session(id);
+        if (!session)
+            throw new types_js_1.ApiError(404, notFound(id));
+        // the uid is the key to compare; a name is the fallback a host may need
+        const owner = session.owner;
+        if (owner !== reader.uid && owner !== reader.username && !reader.isAdmin)
+            throw new types_js_1.ApiError(404, notFound(id));
+        return session;
+    };
+    return {
+        async summary(caller, id) {
+            const session = await visible(caller, id);
+            return session.summary;
+        },
+        async state(caller, id) {
+            await visible(caller, id);
+            const state = await host.state(id);
+            if (!state)
+                throw new types_js_1.ApiError(404, notFound(id));
+            return state;
+        },
+        async log(caller, id) {
+            await visible(caller, id);
+            const log = await host.log(id);
+            if (log === undefined)
+                throw new types_js_1.ApiError(404, notFound(id));
+            return log;
+        },
+        async output(caller, id) {
+            await visible(caller, id);
+            const output = await host.output(id);
+            if (output === undefined)
+                throw new types_js_1.ApiError(404, notFound(id));
+            return output;
+        }
+    };
+};
+exports.createSessionService = createSessionService;

package/build/esm/corpus/code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"code.d.ts","sourceRoot":"","sources":["../../../src/corpus/code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,WAAW,EAAE,UAAU,EA6CnC,CAAA"}
+{"version":3,"file":"code.d.ts","sourceRoot":"","sources":["../../../src/corpus/code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,WAAW,EAAE,UAAU,EAoFnC,CAAA"}

package/build/esm/corpus/code.js

@@ -35,13 +35,50 @@ export const CODE_CORPUS = [
             ]
         }
     },
-    // Two refusals are deliberately not pinned here yet: a `code` that is not a
-    // string, and one that is empty. The package answers 400 `"code" must be a
-    // string` / `"code" is not allowed to be empty` - the messages the server's
-    // schema produces - but sasjs/server's code controller carries no
-    // `@Response(400)` for these routes, so the document states 200 alone and the
-    // parity gate refuses a case answering anything else. The cases land when the
-    // decorators do.
+    {
+        id: 'code-lint-unauthenticated',
+        route: 'POST /SASjsApi/code/lint',
+        description: 'refuses a caller with no token',
+        request: { body: { code: 'data _null_; run;' } },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'code-lint-non-string',
+        route: 'POST /SASjsApi/code/lint',
+        description: 'refuses a code value that is not a string, rather than coercing it',
+        request: {
+            subject: { userId: 'user-admin', clientId: 'web_app' },
+            body: { code: 123 }
+        },
+        expect: { status: 400, error: '"code" must be a string' }
+    },
+    {
+        id: 'code-lint-empty',
+        route: 'POST /SASjsApi/code/lint',
+        description: 'refuses an empty buffer, which is not the same as a missing one',
+        request: {
+            subject: { userId: 'user-admin', clientId: 'web_app' },
+            body: { code: '' }
+        },
+        expect: { status: 400, error: '"code" is not allowed to be empty' }
+    },
+    {
+        id: 'code-format-unauthenticated',
+        route: 'POST /SASjsApi/code/format',
+        description: 'refuses a caller with no token',
+        request: { body: { code: 'data _null_; run;' } },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'code-format-non-string',
+        route: 'POST /SASjsApi/code/format',
+        description: 'refuses a code value that is not a string',
+        request: {
+            subject: { userId: 'user-admin', clientId: 'web_app' },
+            body: { code: 123 }
+        },
+        expect: { status: 400, error: '"code" must be a string' }
+    },
     {
         id: 'code-format-adds-the-header',
         route: 'POST /SASjsApi/code/format',

package/build/esm/corpus/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/corpus/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AASnD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;IAC9B,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,UAAU,UAAU,KAAG,QAkBlD,CAAA;AAkBD;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAClB,UAAU,UAAU,EACpB,WAAU,QAAgC,KACzC,OAAO,CAAC,UAAU,CAepB,CAAA"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/corpus/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAWnD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;IAC9B,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,UAAU,UAAU,KAAG,QAmBlD,CAAA;AAkBD;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAClB,UAAU,UAAU,EACpB,WAAU,QAAgC,KACzC,OAAO,CAAC,UAAU,CAepB,CAAA"}

package/build/esm/corpus/runner.js

@@ -3,6 +3,8 @@ import { createDriveService } from '../drive/service.js';
 import { MemoryDriveStore } from '../drive/memory-store.js';
 import { createIdentityService } from '../identity/service.js';
 import { createRecordService } from '../identity/records.js';
+import { createSessionService } from '../session/service.js';
+import { MemorySessionHost } from '../session/memory-host.js';
 import { MemoryIdentityStore } from '../identity/memory-store.js';
 import { DEFAULT_IDENTITY } from '../identity/fixture.js';
 import { isApiError } from '../types.js';
@@ -23,7 +25,8 @@ export const servicesFor = (testCase) => {
             ? new RefusingDriveStore(testCase.seed || {})
             : new MemoryDriveStore(testCase.seed || {})),
         identity: createIdentityService(identity),
-        records: createRecordService(identity)
+        records: createRecordService(identity),
+        session: createSessionService(identity, new MemorySessionHost())
     };
 };
 /**

package/build/esm/corpus/session.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The session routes' conformance corpus.
+ *
+ * Only the `200` answers are here, and that is a statement about the document
+ * rather than about the routes: sasjs/server documents these four with a `200`
+ * and nothing else, so `spec/corpus-parity.spec.ts` refuses a case that pins a
+ * refusal. Their `401` and the `404` that covers both "no such session" and
+ * "not yours" are pinned in `spec/session.spec.ts` instead, which the parity
+ * gate does not govern.
+ *
+ * The routes are in `documentRefusals.baseline.json` upstream; when they carry
+ * their `@Response(401)` and `@Response(404)`, those cases move here.
+ */
+import type { CorpusCase } from './drive.js';
+export declare const SESSION_CORPUS: CorpusCase[];
+//# sourceMappingURL=session.d.ts.map

package/build/esm/corpus/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/corpus/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAK5C,eAAO,MAAM,cAAc,EAAE,UAAU,EAmEtC,CAAA"}

package/build/esm/corpus/session.js

@@ -0,0 +1,70 @@
+const ADMIN = { userId: 'user-admin', clientId: 'web_app' };
+const RESTRICTED = { userId: 'user-restricted', clientId: 'web_app' };
+export const SESSION_CORPUS = [
+    {
+        id: 'session-summary-own',
+        route: 'GET /SASjsApi/session/{sessionId}',
+        description: 'answers the owner the summary of their own session',
+        request: { subject: ADMIN, params: { sessionId: 'sess-admin' } },
+        expect: {
+            status: 200,
+            body: {
+                sessionId: 'sess-admin',
+                state: 'completed',
+                pid: 4242,
+                creationTimeStamp: '2026-11-07T09:00:00.000Z',
+                deathTimeStamp: '2026-11-07T09:00:04.000Z',
+                expiresAfterMins: 60
+            }
+        }
+    },
+    {
+        id: 'session-summary-as-admin',
+        route: 'GET /SASjsApi/session/{sessionId}',
+        description: "answers an administrator another account's session",
+        request: { subject: ADMIN, params: { sessionId: 'sess-restricted' } },
+        expect: {
+            status: 200,
+            body: {
+                sessionId: 'sess-restricted',
+                state: 'running',
+                pid: 4243,
+                creationTimeStamp: '2026-11-07T09:05:00.000Z'
+            }
+        }
+    },
+    {
+        id: 'session-log-own',
+        route: 'GET /SASjsApi/session/{sessionId}/log',
+        description: 'answers the log this session wrote',
+        request: { subject: ADMIN, params: { sessionId: 'sess-admin' } },
+        expect: {
+            status: 200,
+            contents: 'NOTE: session started\nNOTE: session completed\n'
+        }
+    },
+    {
+        id: 'session-log-nothing-written',
+        route: 'GET /SASjsApi/session/{sessionId}/log',
+        description: 'answers an empty body for a session that has written nothing',
+        request: { subject: ADMIN, params: { sessionId: 'sess-silent' } },
+        expect: { status: 200, contents: '' }
+    },
+    {
+        id: 'session-output-own',
+        route: 'GET /SASjsApi/session/{sessionId}/output',
+        description: 'answers the webout this session produced',
+        request: { subject: ADMIN, params: { sessionId: 'sess-admin' } },
+        expect: { status: 200, contents: '<html><body>42</body></html>' }
+    },
+    {
+        id: 'session-state-own',
+        route: 'GET /SASjsApi/session/{sessionId}/state',
+        description: "answers the run time's state for this session",
+        request: { subject: RESTRICTED, params: { sessionId: 'sess-restricted' } },
+        expect: {
+            status: 200,
+            body: { state: 'running', pid: 4243, lineCount: 3 }
+        }
+    }
+];

package/build/esm/host/dispatch.d.ts

@@ -1,6 +1,7 @@
 import type { DriveService } from '../drive/service.js';
 import type { IdentityService } from '../identity/service.js';
 import type { RecordService } from '../identity/records.js';
+import type { SessionService } from '../session/service.js';
 import type { CodeService } from '../code/service.js';
 import type { Subject } from '../identity/types.js';
 export interface ApiRequest {
@@ -45,6 +46,11 @@ export interface Services {
     identity?: IdentityService;
     /** Users, groups, permission rules and clients. Absent, the record routes answer 501. */
     records?: RecordService;
+    /**
+     * A triggered session's record, log, output and state. A host without one
+     * answers 501 for these four, naming the capability.
+     */
+    session?: SessionService;
 }
 export declare const dispatch: (services: Services, routeId: string, request?: ApiRequest) => Promise<ApiResponse>;
 /** Whether a route is one `dispatch` can answer today. */

package/build/esm/host/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/host/dispatch.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAOnD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,oFAAoF;IACpF,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;KAAE,CAAA;IACtD;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,2DAA2D;IAC3D,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,YAAY,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,yFAAyF;IACzF,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB;AA2CD,eAAO,MAAM,QAAQ,GACnB,UAAU,QAAQ,EAClB,SAAS,MAAM,EACf,UAAS,UAAe,KACvB,OAAO,CAAC,WAAW,CA2YrB,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,cAAc,EAAE,MAAM,EA4ClC,CAAA"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/host/dispatch.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAOnD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,oFAAoF;IACpF,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;KAAE,CAAA;IACtD;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,2DAA2D;IAC3D,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,YAAY,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,yFAAyF;IACzF,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAA;CACzB;AA2CD,eAAO,MAAM,QAAQ,GACnB,UAAU,QAAQ,EAClB,SAAS,MAAM,EACf,UAAS,UAAe,KACvB,OAAO,CAAC,WAAW,CA8brB,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,cAAc,EAAE,MAAM,EAgDlC,CAAA"}