@sasjs/api 0.10.0 → 0.12.0

package/build/browser.js

@@ -1,4 +1,4 @@
-/* @sasjs/api 0.10.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
+/* @sasjs/api 0.12.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
 "use strict";
 var SASjsApi = (() => {
   var __defProp = Object.defineProperty;
@@ -28,6 +28,7 @@ var SASjsApi = (() => {
     CODE_CORPUS: () => CODE_CORPUS,
     DEFAULT_GRANTABLE_ROUTES: () => DEFAULT_GRANTABLE_ROUTES,
     DEFAULT_IDENTITY: () => DEFAULT_IDENTITY,
+    DEPLOY_CORPUS: () => DEPLOY_CORPUS,
     DEPLOY_LIMITS: () => DEPLOY_LIMITS,
     DEPLOY_PAYLOAD_BYTES: () => DEPLOY_PAYLOAD_BYTES,
     DEPLOY_SUCCESS: () => DEPLOY_SUCCESS,
@@ -41,6 +42,7 @@ var SASjsApi = (() => {
     PROVIDER_MANAGED: () => PROVIDER_MANAGED,
     RECORD_CORPUS: () => RECORD_CORPUS,
     ROUTES: () => ROUTES,
+    SESSION_CORPUS: () => SESSION_CORPUS,
     STATIC_AUTHORIZED_ROUTES: () => STATIC_AUTHORIZED_ROUTES,
     TAG_CAPABILITIES: () => TAG_CAPABILITIES,
     TOP_LEVEL_ROUTES: () => TOP_LEVEL_ROUTES,
@@ -892,6 +894,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 400,
+          description: '"code" is required / "code" must be a string / "code" is not allowed to be empty'
+        },
+        {
+          status: 401,
+          description: "Unauthorized"
         }
       ]
     },
@@ -920,6 +930,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 400,
+          description: '"code" is required / "code" must be a string / "code" is not allowed to be empty'
+        },
+        {
+          status: 401,
+          description: "Unauthorized"
         }
       ]
     },
@@ -1830,6 +1848,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "No valid access token or session was supplied"
+        },
+        {
+          status: 404,
+          description: "Session with the given ID was not found."
         }
       ]
     },
@@ -1852,6 +1878,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "No valid access token or session was supplied"
+        },
+        {
+          status: 404,
+          description: "Session with the given ID was not found."
         }
       ]
     },
@@ -1874,6 +1908,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "No valid access token or session was supplied"
+        },
+        {
+          status: 404,
+          description: "Session with the given ID was not found."
         }
       ]
     },
@@ -1896,6 +1938,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "No valid access token or session was supplied"
+        },
+        {
+          status: 404,
+          description: "Session with the given ID was not found."
         }
       ]
     },
@@ -2461,12 +2511,10 @@ var SASjsApi = (() => {
   };
   var DIRECTORY = "Synchronising with an external auth provider needs a directory port, which this package does not have: a host decides which directory it holds accounts in, and answers this itself.";
   var RUNTIME = "Starting a program needs a runtime port, which this package does not have: a host decides which languages it holds, and answers this itself until then.";
-  var SESSION_RECORD = "A triggered session's record, log, output and state belong to the runtime that ran the program, and this package has no runtime port.";
   var HOST_CONFIG = "The body is the host's own configuration - ports, run times and providers - which a mock states for itself and this package cannot know.";
   var HOST_OWNED = "The host owns this report: it describes the host's own process and files, which a browser build has no equivalent of.";
   var WEB_BUNDLE = "The host serves its own web bundle; there is no API decision here for this package to answer.";
   var ARCHIVE = "Expanding the uploaded archive is the host's transport work - multer and a zip library on the server, `DecompressionStream` in a worker - and the host hands this package the tree it produces, which is the same tree `POST /SASjsApi/drive/deploy` takes.";
-  var UNPUBLISH = "Unpublishing inverts the deploy route, so the two land together.";
   var success = { status: "success" };
   var user = {
     uid: "",
@@ -2600,10 +2648,7 @@ var SASjsApi = (() => {
     },
     // `404` is a pair - the registry name and the appLoc it was published from -
     // that matches no entry, and the drive's content is deliberately left alone.
-    "DELETE /SASjsApi/drive/deploy": {
-      implemented: false,
-      reason: UNPUBLISH
-    },
+    "DELETE /SASjsApi/drive/deploy": { implemented: true },
     // Group - members and the groups themselves
     "GET /SASjsApi/group": { implemented: true },
     "GET /SASjsApi/group/{uid}": { implemented: true },
@@ -2639,22 +2684,13 @@ var SASjsApi = (() => {
       implemented: true,
       responses: { 200: user }
     },
-    "GET /SASjsApi/session/{sessionId}": {
-      implemented: false,
-      reason: SESSION_RECORD
-    },
-    "GET /SASjsApi/session/{sessionId}/log": {
-      implemented: false,
-      reason: SESSION_RECORD
-    },
-    "GET /SASjsApi/session/{sessionId}/output": {
-      implemented: false,
-      reason: SESSION_RECORD
-    },
-    "GET /SASjsApi/session/{sessionId}/state": {
-      implemented: false,
-      reason: SESSION_RECORD
-    },
+    // The port takes the owner as a uid and falls back to a username, which is
+    // what sasjs/server records today - a host hands its sessions through as they
+    // are, and the comparison tries the identifier first.
+    "GET /SASjsApi/session/{sessionId}": { implemented: true },
+    "GET /SASjsApi/session/{sessionId}/log": { implemented: true },
+    "GET /SASjsApi/session/{sessionId}/output": { implemented: true },
+    "GET /SASjsApi/session/{sessionId}/state": { implemented: true },
     // STP - a stored program, on the runtime port
     "GET /SASjsApi/stp/execute": { implemented: false, reason: RUNTIME },
     "POST /SASjsApi/stp/execute": { implemented: false, reason: RUNTIME },
@@ -2770,6 +2806,24 @@ var SASjsApi = (() => {
     return void 0;
   };
 
+  // src/drive/registry.ts
+  var unpublishAppStream = async (registry, body) => {
+    if (!body?.streamServiceName)
+      throw new ApiError(400, '"streamServiceName" is required');
+    if (!body.appLoc) throw new ApiError(400, '"appLoc" is required');
+    if (!await registry.unpublish(body.appLoc))
+      throw new ApiError(404, "No such app stream entry.");
+    return { status: "success" };
+  };
+  var MemoryAppStreamRegistry = class {
+    constructor(folders = ["/Public/myApp"]) {
+      this.folders = new Set(folders);
+    }
+    async unpublish(appLoc) {
+      return this.folders.delete(appLoc);
+    }
+  };
+
   // src/host/dispatch.ts
   var SECONDS_IN_A_DAY = 86400;
   var validate = (route, request) => {
@@ -2811,6 +2865,14 @@ var SASjsApi = (() => {
     const query = request.query || {};
     const body = request.body || {};
     const params = request.params || {};
+    const sessionRequired = () => {
+      if (!services.session)
+        throw new ApiError(
+          501,
+          `This host has no session service, so it cannot answer ${routeId}.`
+        );
+      return services.session;
+    };
     const required = () => {
       if (!records)
         throw new ApiError(
@@ -2908,8 +2970,55 @@ var SASjsApi = (() => {
         await drive.deploy(String(body.appLoc ?? ""), body.fileTree);
         return { status: 200, body: DEPLOY_SUCCESS };
       }
+      case "DELETE /SASjsApi/drive/deploy":
+        if (!services.registry)
+          throw new ApiError(
+            501,
+            `This host has no app stream registry, so it cannot answer ${routeId}.`
+          );
+        return {
+          status: 200,
+          body: await unpublishAppStream(services.registry, body)
+        };
       case "GET /SASjsApi/drive/filetree":
         return { status: 200, body: await drive.tree(query._folderPath) };
+      // ------------------------------------------------------------- sessions
+      case "GET /SASjsApi/session/{sessionId}": {
+        return {
+          status: 200,
+          body: await sessionRequired().summary(
+            await caller(),
+            String(params.sessionId ?? "")
+          )
+        };
+      }
+      case "GET /SASjsApi/session/{sessionId}/log": {
+        return {
+          status: 200,
+          contents: await sessionRequired().log(
+            await caller(),
+            String(params.sessionId ?? "")
+          )
+        };
+      }
+      case "GET /SASjsApi/session/{sessionId}/output": {
+        return {
+          status: 200,
+          contents: await sessionRequired().output(
+            await caller(),
+            String(params.sessionId ?? "")
+          )
+        };
+      }
+      case "GET /SASjsApi/session/{sessionId}/state": {
+        return {
+          status: 200,
+          body: await sessionRequired().state(
+            await caller(),
+            String(params.sessionId ?? "")
+          )
+        };
+      }
       // ------------------------------------------------------------- records
       //
       // The administration routes: users, groups, permission rules, clients and the
@@ -3125,6 +3234,11 @@ var SASjsApi = (() => {
     }
   };
   var HANDLED_ROUTES = [
+    "DELETE /SASjsApi/drive/deploy",
+    "GET /SASjsApi/session/{sessionId}",
+    "GET /SASjsApi/session/{sessionId}/log",
+    "GET /SASjsApi/session/{sessionId}/output",
+    "GET /SASjsApi/session/{sessionId}/state",
     "POST /SASjsApi/code/lint",
     "POST /SASjsApi/code/format",
     "GET /SASjsApi/info/authorizedRoutes",
@@ -3662,13 +3776,50 @@ var SASjsApi = (() => {
         ]
       }
     },
-    // Two refusals are deliberately not pinned here yet: a `code` that is not a
-    // string, and one that is empty. The package answers 400 `"code" must be a
-    // string` / `"code" is not allowed to be empty` - the messages the server's
-    // schema produces - but sasjs/server's code controller carries no
-    // `@Response(400)` for these routes, so the document states 200 alone and the
-    // parity gate refuses a case answering anything else. The cases land when the
-    // decorators do.
+    {
+      id: "code-lint-unauthenticated",
+      route: "POST /SASjsApi/code/lint",
+      description: "refuses a caller with no token",
+      request: { body: { code: "data _null_; run;" } },
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "code-lint-non-string",
+      route: "POST /SASjsApi/code/lint",
+      description: "refuses a code value that is not a string, rather than coercing it",
+      request: {
+        subject: { userId: "user-admin", clientId: "web_app" },
+        body: { code: 123 }
+      },
+      expect: { status: 400, error: '"code" must be a string' }
+    },
+    {
+      id: "code-lint-empty",
+      route: "POST /SASjsApi/code/lint",
+      description: "refuses an empty buffer, which is not the same as a missing one",
+      request: {
+        subject: { userId: "user-admin", clientId: "web_app" },
+        body: { code: "" }
+      },
+      expect: { status: 400, error: '"code" is not allowed to be empty' }
+    },
+    {
+      id: "code-format-unauthenticated",
+      route: "POST /SASjsApi/code/format",
+      description: "refuses a caller with no token",
+      request: { body: { code: "data _null_; run;" } },
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "code-format-non-string",
+      route: "POST /SASjsApi/code/format",
+      description: "refuses a code value that is not a string",
+      request: {
+        subject: { userId: "user-admin", clientId: "web_app" },
+        body: { code: 123 }
+      },
+      expect: { status: 400, error: '"code" must be a string' }
+    },
     {
       id: "code-format-adds-the-header",
       route: "POST /SASjsApi/code/format",
@@ -4805,6 +4956,196 @@ var SASjsApi = (() => {
     }
   ];
 
+  // src/corpus/deploy.ts
+  var SUBJECT = { userId: "user-admin", clientId: "web_app" };
+  var DEPLOY_CORPUS = [
+    {
+      id: "deploy-unpublish",
+      route: "DELETE /SASjsApi/drive/deploy",
+      description: "removes a published app stream and answers the status",
+      request: {
+        subject: SUBJECT,
+        body: { streamServiceName: "myApp", appLoc: "/Public/myApp" }
+      },
+      expect: { status: 200, body: { status: "success" } }
+    },
+    {
+      id: "deploy-unpublish-other-name",
+      route: "DELETE /SASjsApi/drive/deploy",
+      description: "removes the app by its folder when the name has been renamed",
+      request: {
+        subject: SUBJECT,
+        body: { streamServiceName: "renamed-app", appLoc: "/Public/myApp" }
+      },
+      expect: { status: 200, body: { status: "success" } }
+    },
+    {
+      id: "deploy-unpublish-no-stream-name",
+      route: "DELETE /SASjsApi/drive/deploy",
+      description: "refuses a body that does not say which stream to remove",
+      request: { subject: SUBJECT, body: { appLoc: "/Public/myApp" } },
+      expect: { status: 400, error: '"streamServiceName" is required' }
+    },
+    {
+      id: "deploy-unpublish-no-app-loc",
+      route: "DELETE /SASjsApi/drive/deploy",
+      description: "refuses a body that does not say which folder to remove",
+      request: { subject: SUBJECT, body: { streamServiceName: "myApp" } },
+      expect: { status: 400, error: '"appLoc" is required' }
+    },
+    {
+      id: "deploy-unpublish-unknown-folder",
+      route: "DELETE /SASjsApi/drive/deploy",
+      description: "answers 404 for a folder nothing is published at",
+      request: {
+        subject: SUBJECT,
+        body: { streamServiceName: "myApp", appLoc: "/Public/not-an-app" }
+      },
+      expect: { status: 404, error: "No such app stream entry." }
+    }
+  ];
+
+  // src/corpus/session.ts
+  var ADMIN = { userId: "user-admin", clientId: "web_app" };
+  var RESTRICTED = { userId: "user-restricted", clientId: "web_app" };
+  var notFound = (id) => `Session with ID '${id}' was not found.`;
+  var UNAUTHORIZED = "Unauthorized";
+  var SESSION_CORPUS = [
+    // ---------------------------------------------------------------- summary
+    {
+      id: "session-summary-own",
+      route: "GET /SASjsApi/session/{sessionId}",
+      description: "answers the owner the summary of their own session",
+      request: { subject: ADMIN, params: { sessionId: "sess-admin" } },
+      expect: {
+        status: 200,
+        body: {
+          sessionId: "sess-admin",
+          state: "completed",
+          pid: 4242,
+          creationTimeStamp: "2026-11-07T09:00:00.000Z",
+          deathTimeStamp: "2026-11-07T09:00:04.000Z",
+          expiresAfterMins: 60
+        }
+      }
+    },
+    {
+      id: "session-summary-as-admin",
+      route: "GET /SASjsApi/session/{sessionId}",
+      description: "answers an administrator another account's session",
+      request: { subject: ADMIN, params: { sessionId: "sess-restricted" } },
+      expect: {
+        status: 200,
+        body: {
+          sessionId: "sess-restricted",
+          state: "running",
+          pid: 4243,
+          creationTimeStamp: "2026-11-07T09:05:00.000Z"
+        }
+      }
+    },
+    {
+      id: "session-summary-unauthenticated",
+      route: "GET /SASjsApi/session/{sessionId}",
+      description: "refuses a caller with no token",
+      request: { params: { sessionId: "sess-admin" } },
+      expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+      id: "session-summary-foreign",
+      route: "GET /SASjsApi/session/{sessionId}",
+      description: "answers 404 for another account's session, not 403",
+      request: { subject: RESTRICTED, params: { sessionId: "sess-admin" } },
+      expect: { status: 404, error: notFound("sess-admin") }
+    },
+    {
+      id: "session-summary-unknown",
+      route: "GET /SASjsApi/session/{sessionId}",
+      description: "answers the same 404 for a session that does not exist",
+      request: { subject: ADMIN, params: { sessionId: "sess-nope" } },
+      expect: { status: 404, error: notFound("sess-nope") }
+    },
+    // -------------------------------------------------------------------- log
+    {
+      id: "session-log-own",
+      route: "GET /SASjsApi/session/{sessionId}/log",
+      description: "answers the log this session wrote",
+      request: { subject: ADMIN, params: { sessionId: "sess-admin" } },
+      expect: {
+        status: 200,
+        contents: "NOTE: session started\nNOTE: session completed\n"
+      }
+    },
+    {
+      id: "session-log-nothing-written",
+      route: "GET /SASjsApi/session/{sessionId}/log",
+      description: "answers an empty body for a session that has written nothing",
+      request: { subject: ADMIN, params: { sessionId: "sess-silent" } },
+      expect: { status: 200, contents: "" }
+    },
+    {
+      id: "session-log-unauthenticated",
+      route: "GET /SASjsApi/session/{sessionId}/log",
+      description: "refuses a caller with no token",
+      request: { params: { sessionId: "sess-admin" } },
+      expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+      id: "session-log-foreign",
+      route: "GET /SASjsApi/session/{sessionId}/log",
+      description: "will not read another account's log",
+      request: { subject: RESTRICTED, params: { sessionId: "sess-admin" } },
+      expect: { status: 404, error: notFound("sess-admin") }
+    },
+    // ----------------------------------------------------------------- output
+    {
+      id: "session-output-own",
+      route: "GET /SASjsApi/session/{sessionId}/output",
+      description: "answers the webout this session produced",
+      request: { subject: ADMIN, params: { sessionId: "sess-admin" } },
+      expect: { status: 200, contents: "<html><body>42</body></html>" }
+    },
+    {
+      id: "session-output-unauthenticated",
+      route: "GET /SASjsApi/session/{sessionId}/output",
+      description: "refuses a caller with no token",
+      request: { params: { sessionId: "sess-admin" } },
+      expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+      id: "session-output-foreign",
+      route: "GET /SASjsApi/session/{sessionId}/output",
+      description: "will not read another account's webout",
+      request: { subject: RESTRICTED, params: { sessionId: "sess-admin" } },
+      expect: { status: 404, error: notFound("sess-admin") }
+    },
+    // ------------------------------------------------------------------ state
+    {
+      id: "session-state-own",
+      route: "GET /SASjsApi/session/{sessionId}/state",
+      description: "answers the run time's state for this session",
+      request: { subject: RESTRICTED, params: { sessionId: "sess-restricted" } },
+      expect: {
+        status: 200,
+        body: { state: "running", pid: 4243, lineCount: 3 }
+      }
+    },
+    {
+      id: "session-state-unauthenticated",
+      route: "GET /SASjsApi/session/{sessionId}/state",
+      description: "refuses a caller with no token",
+      request: { params: { sessionId: "sess-restricted" } },
+      expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+      id: "session-state-foreign",
+      route: "GET /SASjsApi/session/{sessionId}/state",
+      description: "will not report another account's session state",
+      request: { subject: RESTRICTED, params: { sessionId: "sess-admin" } },
+      expect: { status: 404, error: notFound("sess-admin") }
+    }
+  ];
+
   // src/corpus/records.ts
   var SIGNED_IN_TOKENS = [
     {
@@ -4867,8 +5208,8 @@ var SASjsApi = (() => {
       }
     ]
   };
-  var ADMIN = "admin-access";
-  var RESTRICTED = "user-access";
+  var ADMIN2 = "admin-access";
+  var RESTRICTED2 = "user-access";
   var RESTRICTED_UID = "user-restricted";
   var ADMIN_UID = "user-admin";
   var RECORD_CORPUS = [
@@ -4878,7 +5219,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/user",
       description: "lists the accounts any signed-in caller may see",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN },
+      request: { token: ADMIN2 },
       expect: {
         status: 200,
         body: [
@@ -4902,7 +5243,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/user/{uid}",
       description: "returns the caller their own details, with the auto-exec code",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, params: { uid: RESTRICTED_UID } },
+      request: { token: RESTRICTED2, params: { uid: RESTRICTED_UID } },
       expect: {
         status: 200,
         partial: {
@@ -4927,7 +5268,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/user/{uid}",
       description: "answers 404 for an identifier no account has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "user-none" } },
+      request: { token: ADMIN2, params: { uid: "user-none" } },
       expect: { status: 404, error: "User is not found." }
     },
     {
@@ -4935,7 +5276,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/user/by/username/{username}",
       description: "finds an account by username",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { username: "user2" } },
+      request: { token: ADMIN2, params: { username: "user2" } },
       expect: {
         status: 200,
         partial: { uid: RESTRICTED_UID, username: "user2", isAdmin: false }
@@ -4954,7 +5295,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/user/by/username/{username}",
       description: "answers 404 for a username no account has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { username: "nobody" } },
+      request: { token: ADMIN2, params: { username: "nobody" } },
       expect: { status: 404, error: "User is not found." }
     },
     {
@@ -4963,7 +5304,7 @@ var SASjsApi = (() => {
       description: "creates an account, sanitised, and reports it",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           username: "newuser",
           displayName: "  New
 User  ",
@@ -4988,7 +5329,7 @@ var SASjsApi = (() => {
       description: "refuses a creation by a caller who is not an administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: {
           username: "newuser",
           displayName: "New User",
@@ -5011,7 +5352,7 @@ var SASjsApi = (() => {
       description: "refuses a username that is taken",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: { username: "user2", displayName: "Another", password: "newpass" }
       },
       expect: { status: 409, error: "Username already exists." }
@@ -5022,7 +5363,7 @@ var SASjsApi = (() => {
       description: "changes an account's display name",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: RESTRICTED_UID },
         body: {
           displayName: "Renamed User",
@@ -5041,7 +5382,7 @@ var SASjsApi = (() => {
       description: "refuses a change to somebody else's account",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { uid: ADMIN_UID },
         body: { displayName: "Hijacked", username: "admin", password: "admin123" }
       },
@@ -5053,7 +5394,7 @@ var SASjsApi = (() => {
       description: "answers 404 with the identifier it looked up",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: "user-none" },
         body: { displayName: "Nobody", username: "nobody", password: "none123" }
       },
@@ -5065,7 +5406,7 @@ var SASjsApi = (() => {
       description: "refuses a username change on a provider-managed account",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: "user-directory" },
         body: {
           username: "renamed",
@@ -5084,7 +5425,7 @@ var SASjsApi = (() => {
       description: "refuses a username another account already has",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: RESTRICTED_UID },
         body: { username: "admin", displayName: "Demo User", password: "user123" }
       },
@@ -5096,7 +5437,7 @@ var SASjsApi = (() => {
       description: "changes an account looked up by username",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { username: "user2" },
         body: {
           isActive: false,
@@ -5113,7 +5454,7 @@ var SASjsApi = (() => {
       description: "refuses a change to another account by username",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { username: "admin" },
         body: { displayName: "Hijacked", username: "admin", password: "admin123" }
       },
@@ -5125,7 +5466,7 @@ var SASjsApi = (() => {
       description: "answers 404 with the username it looked up",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { username: "nobody" },
         body: { displayName: "Nobody", username: "nobody", password: "none123" }
       },
@@ -5137,7 +5478,7 @@ var SASjsApi = (() => {
       description: "refuses a display-name change on a provider-managed account",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { username: "diruser" },
         body: { displayName: "Renamed", username: "diruser", password: "dir123" }
       },
@@ -5152,7 +5493,7 @@ var SASjsApi = (() => {
       description: "refuses a username another account already has",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { username: "user2" },
         body: { username: "admin", displayName: "Demo User", password: "user123" }
       },
@@ -5163,7 +5504,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/user/{uid}",
       description: "deletes an account as an administrator, without a password",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: RESTRICTED_UID }, body: {} },
+      request: { token: ADMIN2, params: { uid: RESTRICTED_UID }, body: {} },
       expect: { status: 200, body: "Account Deleted!" }
     },
     {
@@ -5171,7 +5512,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/user/{uid}",
       description: "refuses a deletion of somebody else's account",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, params: { uid: ADMIN_UID }, body: {} },
+      request: { token: RESTRICTED2, params: { uid: ADMIN_UID }, body: {} },
       expect: { status: 401, error: "Admin account required" }
     },
     {
@@ -5179,7 +5520,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/user/{uid}",
       description: "answers 404 for an identifier no account has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "user-none" }, body: {} },
+      request: { token: ADMIN2, params: { uid: "user-none" }, body: {} },
       expect: { status: 404, error: "User is not found." }
     },
     {
@@ -5188,7 +5529,7 @@ var SASjsApi = (() => {
       description: "deletes an account looked up by username",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { username: "user2" },
         body: {}
       },
@@ -5200,7 +5541,7 @@ var SASjsApi = (() => {
       description: "refuses a self-deletion whose password is wrong",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { username: "user2" },
         body: { password: "wrong123" }
       },
@@ -5211,7 +5552,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/user/by/username/{username}",
       description: "answers 404 for a username no account has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { username: "nobody" }, body: {} },
+      request: { token: ADMIN2, params: { username: "nobody" }, body: {} },
       expect: { status: 404, error: "User is not found." }
     },
     // ----------------------------------------------------------------- groups
@@ -5220,7 +5561,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/group",
       description: "lists the groups",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED },
+      request: { token: RESTRICTED2 },
       expect: {
         status: 200,
         body: [
@@ -5242,7 +5583,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/group/{uid}",
       description: "returns a group and its members",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, params: { uid: "group-admins" } },
+      request: { token: RESTRICTED2, params: { uid: "group-admins" } },
       expect: {
         status: 200,
         partial: {
@@ -5265,7 +5606,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/group/{uid}",
       description: "answers 404 for an identifier no group has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "group-none" } },
+      request: { token: ADMIN2, params: { uid: "group-none" } },
       expect: { status: 404, error: "Group not found." }
     },
     {
@@ -5273,7 +5614,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/group/by/groupname/{name}",
       description: "finds a group by name",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { name: "DCGroup" } },
+      request: { token: ADMIN2, params: { name: "DCGroup" } },
       expect: {
         status: 200,
         partial: { uid: "group-data-controller", name: "DCGroup" }
@@ -5284,7 +5625,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/group/by/groupname/{name}",
       description: "answers 404 for a name no group has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { name: "nope" } },
+      request: { token: ADMIN2, params: { name: "nope" } },
       expect: { status: 404, error: "Group not found." }
     },
     {
@@ -5293,7 +5634,7 @@ var SASjsApi = (() => {
       description: "creates a group with no members",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: { name: "NewGroup", description: "A new group", isActive: true }
       },
       expect: {
@@ -5312,7 +5653,7 @@ var SASjsApi = (() => {
       description: "refuses a creation by a caller who is not an administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: { name: "NewGroup", description: "x" }
       },
       expect: { status: 401, error: "Admin account required" }
@@ -5322,7 +5663,7 @@ var SASjsApi = (() => {
       route: "POST /SASjsApi/group",
       description: "refuses a name that is taken",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, body: { name: "DCGroup", description: "again" } },
+      request: { token: ADMIN2, body: { name: "DCGroup", description: "again" } },
       expect: { status: 409, error: "Group name already exists." }
     },
     {
@@ -5331,7 +5672,7 @@ var SASjsApi = (() => {
       description: "adds a member and returns the group",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-admins", userUid: RESTRICTED_UID }
       },
       expect: {
@@ -5345,7 +5686,7 @@ var SASjsApi = (() => {
       description: "refuses a change to the reserved public group",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-public", userUid: RESTRICTED_UID }
       },
       expect: { status: 400, error: "Can't add/remove user to 'public' group." }
@@ -5356,7 +5697,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change by a non-administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { groupUid: "group-admins", userUid: RESTRICTED_UID }
       },
       expect: { status: 401, error: "Admin account required" }
@@ -5367,7 +5708,7 @@ var SASjsApi = (() => {
       description: "answers 404 for a group that does not exist",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-none", userUid: RESTRICTED_UID }
       },
       expect: { status: 404, error: "Group not found." }
@@ -5378,7 +5719,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change on a provider-managed group",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-directory", userUid: RESTRICTED_UID }
       },
       expect: {
@@ -5392,7 +5733,7 @@ var SASjsApi = (() => {
       description: "removes a member and returns the group",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-data-controller", userUid: RESTRICTED_UID }
       },
       expect: {
@@ -5406,7 +5747,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change for a provider-managed user",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-admins", userUid: "user-directory" }
       },
       expect: {
@@ -5420,7 +5761,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change for a provider-managed user",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-admins", userUid: "user-directory" }
       },
       expect: {
@@ -5434,7 +5775,7 @@ var SASjsApi = (() => {
       description: "refuses a change to the reserved public group",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-public", userUid: RESTRICTED_UID }
       },
       expect: { status: 400, error: "Can't add/remove user to 'public' group." }
@@ -5445,7 +5786,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change by a non-administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { groupUid: "group-data-controller", userUid: RESTRICTED_UID }
       },
       expect: { status: 401, error: "Admin account required" }
@@ -5456,7 +5797,7 @@ var SASjsApi = (() => {
       description: "answers 404 for a member that does not exist",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-admins", userUid: "user-none" }
       },
       expect: { status: 404, error: "User not found." }
@@ -5467,7 +5808,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change on a provider-managed group",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-directory", userUid: RESTRICTED_UID }
       },
       expect: {
@@ -5480,7 +5821,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/group/{uid}",
       description: "deletes a group",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "group-data-controller" } },
+      request: { token: ADMIN2, params: { uid: "group-data-controller" } },
       expect: { status: 200 }
     },
     {
@@ -5488,7 +5829,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/group/{uid}",
       description: "refuses a deletion by a caller who is not an administrator",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, params: { uid: "group-admins" } },
+      request: { token: RESTRICTED2, params: { uid: "group-admins" } },
       expect: { status: 401, error: "Admin account required" }
     },
     {
@@ -5496,7 +5837,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/group/{uid}",
       description: "answers 404 for an identifier no group has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "group-none" } },
+      request: { token: ADMIN2, params: { uid: "group-none" } },
       expect: { status: 404, error: "Group not found." }
     },
     // ------------------------------------------------------------ permissions
@@ -5505,7 +5846,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/info/authorizedRoutes",
       description: "answers the routes that accept a rule, to any caller",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED },
+      request: { token: RESTRICTED2 },
       expect: {
         status: 200,
         body: {
@@ -5529,7 +5870,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/info/myAuthorizedRoutes",
       description: "answers every route to an administrator",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN },
+      request: { token: ADMIN2 },
       expect: {
         status: 200,
         body: {
@@ -5553,7 +5894,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/info/myAuthorizedRoutes",
       description: "answers a caller only the routes its rules grant",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED },
+      request: { token: RESTRICTED2 },
       expect: {
         status: 200,
         // /AppStream is visible whatever the rules say; the two grants come from
@@ -5569,7 +5910,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/permission",
       description: "returns every rule to an administrator",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN },
+      request: { token: ADMIN2 },
       expect: {
         status: 200,
         body: [
@@ -5602,7 +5943,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/permission",
       description: "returns a caller only their own rules and their groups'",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED },
+      request: { token: RESTRICTED2 },
       expect: {
         status: 200,
         body: [
@@ -5644,7 +5985,7 @@ var SASjsApi = (() => {
       description: "creates a rule for a user",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/folder",
           type: "Route",
@@ -5664,7 +6005,7 @@ var SASjsApi = (() => {
       description: "creates a rule for a group",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/rename",
           type: "Route",
@@ -5688,7 +6029,7 @@ var SASjsApi = (() => {
       description: "refuses a principal type that is neither a user nor a group",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/deploy",
           type: "Route",
@@ -5708,7 +6049,7 @@ var SASjsApi = (() => {
       description: "refuses a rule assigned to an administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/folder",
           type: "Route",
@@ -5728,7 +6069,7 @@ var SASjsApi = (() => {
       description: "refuses a creation by a non-administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: {
           path: "/SASjsApi/drive/folder",
           type: "Route",
@@ -5745,7 +6086,7 @@ var SASjsApi = (() => {
       description: "answers 404 for a principal that does not exist",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/rename",
           type: "Route",
@@ -5762,7 +6103,7 @@ var SASjsApi = (() => {
       description: "refuses a group rule that already exists",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/file",
           type: "Route",
@@ -5782,7 +6123,7 @@ var SASjsApi = (() => {
       description: "refuses a rule that already exists",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/code/execute",
           type: "Route",
@@ -5802,7 +6143,7 @@ var SASjsApi = (() => {
       description: "flips a rule from Deny to Grant",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: "rule-code" },
         body: { setting: "Grant" }
       },
@@ -5814,7 +6155,7 @@ var SASjsApi = (() => {
       description: "refuses a change by a non-administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { uid: "rule-code" },
         body: { setting: "Grant" }
       },
@@ -5826,7 +6167,7 @@ var SASjsApi = (() => {
       description: "answers 404 for a rule that does not exist",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: "rule-none" },
         body: { setting: "Grant" }
       },
@@ -5837,7 +6178,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/permission/{uid}",
       description: "deletes a rule",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "rule-code" } },
+      request: { token: ADMIN2, params: { uid: "rule-code" } },
       expect: { status: 200, body: "Permission Deleted!" }
     },
     {
@@ -5845,7 +6186,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/permission/{uid}",
       description: "refuses a deletion by a non-administrator",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, params: { uid: "rule-code" } },
+      request: { token: RESTRICTED2, params: { uid: "rule-code" } },
       expect: { status: 401, error: "Admin account required" }
     },
     {
@@ -5853,7 +6194,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/permission/{uid}",
       description: "answers 404 for a rule that does not exist",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "rule-none" } },
+      request: { token: ADMIN2, params: { uid: "rule-none" } },
       expect: { status: 404, error: "Permission not found." }
     },
     // --------------------------------------------------------------- clients
@@ -5862,7 +6203,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/client",
       description: "lists the registered clients",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN },
+      request: { token: ADMIN2 },
       expect: {
         status: 200,
         body: [
@@ -5886,7 +6227,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/client",
       description: "refuses the list to a caller who is not an administrator",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED },
+      request: { token: RESTRICTED2 },
       expect: { status: 401, error: "Admin account required" }
     },
     {
@@ -5895,7 +6236,7 @@ var SASjsApi = (() => {
       description: "registers a client",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           clientId: "new_app",
           clientSecret: "new_secret",
@@ -5919,7 +6260,7 @@ var SASjsApi = (() => {
       description: "applies the schema defaults when the lifetimes are omitted",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: { clientId: "default_app", clientSecret: "default_secret" }
       },
       expect: {
@@ -5938,7 +6279,7 @@ var SASjsApi = (() => {
       description: "refuses a registration by a non-administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: {
           clientId: "new_app",
           clientSecret: "new_secret",
@@ -5954,7 +6295,7 @@ var SASjsApi = (() => {
       description: "refuses a client id that is registered, with the 403 the server sends",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           clientId: "web_app",
           clientSecret: "other",
@@ -5971,7 +6312,7 @@ var SASjsApi = (() => {
       description: "changes the caller’s own password",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: { currentPassword: "user123", newPassword: "changed123" }
       },
       expect: { status: 204 }
@@ -5981,7 +6322,7 @@ var SASjsApi = (() => {
       route: "PATCH /SASjsApi/auth/updatePassword",
       description: "refuses a body without the current password",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, body: { newPassword: "changed123" } },
+      request: { token: RESTRICTED2, body: { newPassword: "changed123" } },
       expect: { status: 400, error: '"currentPassword" is required' }
     },
     {
@@ -6000,7 +6341,7 @@ var SASjsApi = (() => {
       description: "refuses a change whose current password is wrong",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: { currentPassword: "wrong", newPassword: "changed123" }
       },
       expect: { status: 403, error: "Invalid current password!" }
@@ -6021,6 +6362,112 @@ var SASjsApi = (() => {
     }
   ];
 
+  // src/session/service.ts
+  var createSessionService = (store, host) => {
+    const notFound2 = (id) => `Session with ID '${id}' was not found.`;
+    const visible = async (caller, id) => {
+      if (!caller) throw new ApiError(401, "Unauthorized");
+      const reader = await store.userById(
+        caller.userId
+      );
+      if (!reader || !reader.isActive) throw new ApiError(401, "Unauthorized");
+      const session = await host.session(id);
+      if (!session) throw new ApiError(404, notFound2(id));
+      const owner = session.owner;
+      if (owner !== reader.uid && owner !== reader.username && !reader.isAdmin)
+        throw new ApiError(404, notFound2(id));
+      return session;
+    };
+    return {
+      async summary(caller, id) {
+        const session = await visible(caller, id);
+        return session.summary;
+      },
+      async state(caller, id) {
+        await visible(caller, id);
+        const state = await host.state(id);
+        if (!state) throw new ApiError(404, notFound2(id));
+        return state;
+      },
+      async log(caller, id) {
+        await visible(caller, id);
+        const log = await host.log(id);
+        if (log === void 0) throw new ApiError(404, notFound2(id));
+        return log;
+      },
+      async output(caller, id) {
+        await visible(caller, id);
+        const output = await host.output(id);
+        if (output === void 0) throw new ApiError(404, notFound2(id));
+        return output;
+      }
+    };
+  };
+
+  // src/session/memory-host.ts
+  var DEFAULT_SESSIONS = {
+    "sess-admin": {
+      owner: "user-admin",
+      summary: {
+        sessionId: "sess-admin",
+        state: "completed",
+        pid: 4242,
+        creationTimeStamp: "2026-11-07T09:00:00.000Z",
+        deathTimeStamp: "2026-11-07T09:00:04.000Z",
+        expiresAfterMins: 60
+      }
+    },
+    "sess-restricted": {
+      owner: "user-restricted",
+      summary: {
+        sessionId: "sess-restricted",
+        state: "running",
+        pid: 4243,
+        creationTimeStamp: "2026-11-07T09:05:00.000Z"
+      }
+    },
+    "sess-silent": {
+      owner: "user-admin",
+      summary: {
+        sessionId: "sess-silent",
+        state: "running",
+        pid: 4244,
+        creationTimeStamp: "2026-11-07T09:10:00.000Z"
+      }
+    }
+  };
+  var STATES = {
+    "sess-admin": { state: "completed", pid: 4242, lineCount: 12 },
+    "sess-restricted": { state: "running", pid: 4243, lineCount: 3 }
+  };
+  var LOGS = {
+    "sess-admin": "NOTE: session started\nNOTE: session completed\n",
+    "sess-restricted": "NOTE: session started\n",
+    "sess-silent": ""
+  };
+  var OUTPUTS = {
+    "sess-admin": "<html><body>42</body></html>",
+    "sess-restricted": "",
+    "sess-silent": ""
+  };
+  var MemorySessionHost = class {
+    constructor(sessions = DEFAULT_SESSIONS) {
+      this.sessions = sessions;
+    }
+    async session(id) {
+      return this.sessions[id];
+    }
+    async state(id) {
+      return STATES[id];
+    }
+    async log(id) {
+      return LOGS[id];
+    }
+    async output(id) {
+      return OUTPUTS[id];
+    }
+  };
+
   // src/corpus/runner.ts
   var servicesFor = (testCase) => {
     const identity = new MemoryIdentityStore(
@@ -6031,7 +6478,9 @@ var SASjsApi = (() => {
         testCase.unwritable ? new RefusingDriveStore(testCase.seed || {}) : new MemoryDriveStore(testCase.seed || {})
       ),
       identity: createIdentityService(identity),
-      records: createRecordService(identity)
+      records: createRecordService(identity),
+      registry: new MemoryAppStreamRegistry(),
+      session: createSessionService(identity, new MemorySessionHost())
     };
   };
   var RefusingDriveStore = class extends MemoryDriveStore {