@sasjs/api 0.11.0 → 0.12.0

package/build/browser.js

@@ -1,4 +1,4 @@
-/* @sasjs/api 0.11.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
+/* @sasjs/api 0.12.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
 "use strict";
 var SASjsApi = (() => {
   var __defProp = Object.defineProperty;
@@ -28,6 +28,7 @@ var SASjsApi = (() => {
     CODE_CORPUS: () => CODE_CORPUS,
     DEFAULT_GRANTABLE_ROUTES: () => DEFAULT_GRANTABLE_ROUTES,
     DEFAULT_IDENTITY: () => DEFAULT_IDENTITY,
+    DEPLOY_CORPUS: () => DEPLOY_CORPUS,
     DEPLOY_LIMITS: () => DEPLOY_LIMITS,
     DEPLOY_PAYLOAD_BYTES: () => DEPLOY_PAYLOAD_BYTES,
     DEPLOY_SUCCESS: () => DEPLOY_SUCCESS,
@@ -1847,6 +1848,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "No valid access token or session was supplied"
+        },
+        {
+          status: 404,
+          description: "Session with the given ID was not found."
         }
       ]
     },
@@ -1869,6 +1878,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "No valid access token or session was supplied"
+        },
+        {
+          status: 404,
+          description: "Session with the given ID was not found."
         }
       ]
     },
@@ -1891,6 +1908,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "No valid access token or session was supplied"
+        },
+        {
+          status: 404,
+          description: "Session with the given ID was not found."
         }
       ]
     },
@@ -1913,6 +1938,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "No valid access token or session was supplied"
+        },
+        {
+          status: 404,
+          description: "Session with the given ID was not found."
         }
       ]
     },
@@ -2482,7 +2515,6 @@ var SASjsApi = (() => {
   var HOST_OWNED = "The host owns this report: it describes the host's own process and files, which a browser build has no equivalent of.";
   var WEB_BUNDLE = "The host serves its own web bundle; there is no API decision here for this package to answer.";
   var ARCHIVE = "Expanding the uploaded archive is the host's transport work - multer and a zip library on the server, `DecompressionStream` in a worker - and the host hands this package the tree it produces, which is the same tree `POST /SASjsApi/drive/deploy` takes.";
-  var UNPUBLISH = "Unpublishing inverts the deploy route, so the two land together.";
   var success = { status: "success" };
   var user = {
     uid: "",
@@ -2616,10 +2648,7 @@ var SASjsApi = (() => {
     },
     // `404` is a pair - the registry name and the appLoc it was published from -
     // that matches no entry, and the drive's content is deliberately left alone.
-    "DELETE /SASjsApi/drive/deploy": {
-      implemented: false,
-      reason: UNPUBLISH
-    },
+    "DELETE /SASjsApi/drive/deploy": { implemented: true },
     // Group - members and the groups themselves
     "GET /SASjsApi/group": { implemented: true },
     "GET /SASjsApi/group/{uid}": { implemented: true },
@@ -2777,6 +2806,24 @@ var SASjsApi = (() => {
     return void 0;
   };
 
+  // src/drive/registry.ts
+  var unpublishAppStream = async (registry, body) => {
+    if (!body?.streamServiceName)
+      throw new ApiError(400, '"streamServiceName" is required');
+    if (!body.appLoc) throw new ApiError(400, '"appLoc" is required');
+    if (!await registry.unpublish(body.appLoc))
+      throw new ApiError(404, "No such app stream entry.");
+    return { status: "success" };
+  };
+  var MemoryAppStreamRegistry = class {
+    constructor(folders = ["/Public/myApp"]) {
+      this.folders = new Set(folders);
+    }
+    async unpublish(appLoc) {
+      return this.folders.delete(appLoc);
+    }
+  };
+
   // src/host/dispatch.ts
   var SECONDS_IN_A_DAY = 86400;
   var validate = (route, request) => {
@@ -2923,6 +2970,16 @@ var SASjsApi = (() => {
         await drive.deploy(String(body.appLoc ?? ""), body.fileTree);
         return { status: 200, body: DEPLOY_SUCCESS };
       }
+      case "DELETE /SASjsApi/drive/deploy":
+        if (!services.registry)
+          throw new ApiError(
+            501,
+            `This host has no app stream registry, so it cannot answer ${routeId}.`
+          );
+        return {
+          status: 200,
+          body: await unpublishAppStream(services.registry, body)
+        };
       case "GET /SASjsApi/drive/filetree":
         return { status: 200, body: await drive.tree(query._folderPath) };
       // ------------------------------------------------------------- sessions
@@ -3177,6 +3234,7 @@ var SASjsApi = (() => {
     }
   };
   var HANDLED_ROUTES = [
+    "DELETE /SASjsApi/drive/deploy",
     "GET /SASjsApi/session/{sessionId}",
     "GET /SASjsApi/session/{sessionId}/log",
     "GET /SASjsApi/session/{sessionId}/output",
@@ -4898,10 +4956,62 @@ var SASjsApi = (() => {
     }
   ];
 
+  // src/corpus/deploy.ts
+  var SUBJECT = { userId: "user-admin", clientId: "web_app" };
+  var DEPLOY_CORPUS = [
+    {
+      id: "deploy-unpublish",
+      route: "DELETE /SASjsApi/drive/deploy",
+      description: "removes a published app stream and answers the status",
+      request: {
+        subject: SUBJECT,
+        body: { streamServiceName: "myApp", appLoc: "/Public/myApp" }
+      },
+      expect: { status: 200, body: { status: "success" } }
+    },
+    {
+      id: "deploy-unpublish-other-name",
+      route: "DELETE /SASjsApi/drive/deploy",
+      description: "removes the app by its folder when the name has been renamed",
+      request: {
+        subject: SUBJECT,
+        body: { streamServiceName: "renamed-app", appLoc: "/Public/myApp" }
+      },
+      expect: { status: 200, body: { status: "success" } }
+    },
+    {
+      id: "deploy-unpublish-no-stream-name",
+      route: "DELETE /SASjsApi/drive/deploy",
+      description: "refuses a body that does not say which stream to remove",
+      request: { subject: SUBJECT, body: { appLoc: "/Public/myApp" } },
+      expect: { status: 400, error: '"streamServiceName" is required' }
+    },
+    {
+      id: "deploy-unpublish-no-app-loc",
+      route: "DELETE /SASjsApi/drive/deploy",
+      description: "refuses a body that does not say which folder to remove",
+      request: { subject: SUBJECT, body: { streamServiceName: "myApp" } },
+      expect: { status: 400, error: '"appLoc" is required' }
+    },
+    {
+      id: "deploy-unpublish-unknown-folder",
+      route: "DELETE /SASjsApi/drive/deploy",
+      description: "answers 404 for a folder nothing is published at",
+      request: {
+        subject: SUBJECT,
+        body: { streamServiceName: "myApp", appLoc: "/Public/not-an-app" }
+      },
+      expect: { status: 404, error: "No such app stream entry." }
+    }
+  ];
+
   // src/corpus/session.ts
   var ADMIN = { userId: "user-admin", clientId: "web_app" };
   var RESTRICTED = { userId: "user-restricted", clientId: "web_app" };
+  var notFound = (id) => `Session with ID '${id}' was not found.`;
+  var UNAUTHORIZED = "Unauthorized";
   var SESSION_CORPUS = [
+    // ---------------------------------------------------------------- summary
     {
       id: "session-summary-own",
       route: "GET /SASjsApi/session/{sessionId}",
@@ -4934,6 +5044,28 @@ var SASjsApi = (() => {
         }
       }
     },
+    {
+      id: "session-summary-unauthenticated",
+      route: "GET /SASjsApi/session/{sessionId}",
+      description: "refuses a caller with no token",
+      request: { params: { sessionId: "sess-admin" } },
+      expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+      id: "session-summary-foreign",
+      route: "GET /SASjsApi/session/{sessionId}",
+      description: "answers 404 for another account's session, not 403",
+      request: { subject: RESTRICTED, params: { sessionId: "sess-admin" } },
+      expect: { status: 404, error: notFound("sess-admin") }
+    },
+    {
+      id: "session-summary-unknown",
+      route: "GET /SASjsApi/session/{sessionId}",
+      description: "answers the same 404 for a session that does not exist",
+      request: { subject: ADMIN, params: { sessionId: "sess-nope" } },
+      expect: { status: 404, error: notFound("sess-nope") }
+    },
+    // -------------------------------------------------------------------- log
     {
       id: "session-log-own",
       route: "GET /SASjsApi/session/{sessionId}/log",
@@ -4951,6 +5083,21 @@ var SASjsApi = (() => {
       request: { subject: ADMIN, params: { sessionId: "sess-silent" } },
       expect: { status: 200, contents: "" }
     },
+    {
+      id: "session-log-unauthenticated",
+      route: "GET /SASjsApi/session/{sessionId}/log",
+      description: "refuses a caller with no token",
+      request: { params: { sessionId: "sess-admin" } },
+      expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+      id: "session-log-foreign",
+      route: "GET /SASjsApi/session/{sessionId}/log",
+      description: "will not read another account's log",
+      request: { subject: RESTRICTED, params: { sessionId: "sess-admin" } },
+      expect: { status: 404, error: notFound("sess-admin") }
+    },
+    // ----------------------------------------------------------------- output
     {
       id: "session-output-own",
       route: "GET /SASjsApi/session/{sessionId}/output",
@@ -4958,6 +5105,21 @@ var SASjsApi = (() => {
       request: { subject: ADMIN, params: { sessionId: "sess-admin" } },
       expect: { status: 200, contents: "<html><body>42</body></html>" }
     },
+    {
+      id: "session-output-unauthenticated",
+      route: "GET /SASjsApi/session/{sessionId}/output",
+      description: "refuses a caller with no token",
+      request: { params: { sessionId: "sess-admin" } },
+      expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+      id: "session-output-foreign",
+      route: "GET /SASjsApi/session/{sessionId}/output",
+      description: "will not read another account's webout",
+      request: { subject: RESTRICTED, params: { sessionId: "sess-admin" } },
+      expect: { status: 404, error: notFound("sess-admin") }
+    },
+    // ------------------------------------------------------------------ state
     {
       id: "session-state-own",
       route: "GET /SASjsApi/session/{sessionId}/state",
@@ -4967,6 +5129,20 @@ var SASjsApi = (() => {
         status: 200,
         body: { state: "running", pid: 4243, lineCount: 3 }
       }
+    },
+    {
+      id: "session-state-unauthenticated",
+      route: "GET /SASjsApi/session/{sessionId}/state",
+      description: "refuses a caller with no token",
+      request: { params: { sessionId: "sess-restricted" } },
+      expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+      id: "session-state-foreign",
+      route: "GET /SASjsApi/session/{sessionId}/state",
+      description: "will not report another account's session state",
+      request: { subject: RESTRICTED, params: { sessionId: "sess-admin" } },
+      expect: { status: 404, error: notFound("sess-admin") }
     }
   ];
 
@@ -6188,7 +6364,7 @@ var SASjsApi = (() => {
 
   // src/session/service.ts
   var createSessionService = (store, host) => {
-    const notFound = (id) => `Session with ID '${id}' was not found.`;
+    const notFound2 = (id) => `Session with ID '${id}' was not found.`;
     const visible = async (caller, id) => {
       if (!caller) throw new ApiError(401, "Unauthorized");
       const reader = await store.userById(
@@ -6196,10 +6372,10 @@ var SASjsApi = (() => {
       );
       if (!reader || !reader.isActive) throw new ApiError(401, "Unauthorized");
       const session = await host.session(id);
-      if (!session) throw new ApiError(404, notFound(id));
+      if (!session) throw new ApiError(404, notFound2(id));
       const owner = session.owner;
       if (owner !== reader.uid && owner !== reader.username && !reader.isAdmin)
-        throw new ApiError(404, notFound(id));
+        throw new ApiError(404, notFound2(id));
       return session;
     };
     return {
@@ -6210,19 +6386,19 @@ var SASjsApi = (() => {
       async state(caller, id) {
         await visible(caller, id);
         const state = await host.state(id);
-        if (!state) throw new ApiError(404, notFound(id));
+        if (!state) throw new ApiError(404, notFound2(id));
         return state;
       },
       async log(caller, id) {
         await visible(caller, id);
         const log = await host.log(id);
-        if (log === void 0) throw new ApiError(404, notFound(id));
+        if (log === void 0) throw new ApiError(404, notFound2(id));
         return log;
       },
       async output(caller, id) {
         await visible(caller, id);
         const output = await host.output(id);
-        if (output === void 0) throw new ApiError(404, notFound(id));
+        if (output === void 0) throw new ApiError(404, notFound2(id));
         return output;
       }
     };
@@ -6303,6 +6479,7 @@ var SASjsApi = (() => {
       ),
       identity: createIdentityService(identity),
       records: createRecordService(identity),
+      registry: new MemoryAppStreamRegistry(),
       session: createSessionService(identity, new MemorySessionHost())
     };
   };

package/build/cjs/corpus/deploy.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPLOY_CORPUS = void 0;
+const SUBJECT = { userId: 'user-admin', clientId: 'web_app' };
+exports.DEPLOY_CORPUS = [
+    {
+        id: 'deploy-unpublish',
+        route: 'DELETE /SASjsApi/drive/deploy',
+        description: 'removes a published app stream and answers the status',
+        request: {
+            subject: SUBJECT,
+            body: { streamServiceName: 'myApp', appLoc: '/Public/myApp' }
+        },
+        expect: { status: 200, body: { status: 'success' } }
+    },
+    {
+        id: 'deploy-unpublish-other-name',
+        route: 'DELETE /SASjsApi/drive/deploy',
+        description: 'removes the app by its folder when the name has been renamed',
+        request: {
+            subject: SUBJECT,
+            body: { streamServiceName: 'renamed-app', appLoc: '/Public/myApp' }
+        },
+        expect: { status: 200, body: { status: 'success' } }
+    },
+    {
+        id: 'deploy-unpublish-no-stream-name',
+        route: 'DELETE /SASjsApi/drive/deploy',
+        description: 'refuses a body that does not say which stream to remove',
+        request: { subject: SUBJECT, body: { appLoc: '/Public/myApp' } },
+        expect: { status: 400, error: '"streamServiceName" is required' }
+    },
+    {
+        id: 'deploy-unpublish-no-app-loc',
+        route: 'DELETE /SASjsApi/drive/deploy',
+        description: 'refuses a body that does not say which folder to remove',
+        request: { subject: SUBJECT, body: { streamServiceName: 'myApp' } },
+        expect: { status: 400, error: '"appLoc" is required' }
+    },
+    {
+        id: 'deploy-unpublish-unknown-folder',
+        route: 'DELETE /SASjsApi/drive/deploy',
+        description: 'answers 404 for a folder nothing is published at',
+        request: {
+            subject: SUBJECT,
+            body: { streamServiceName: 'myApp', appLoc: '/Public/not-an-app' }
+        },
+        expect: { status: 404, error: 'No such app stream entry.' }
+    }
+];

package/build/cjs/corpus/runner.js

@@ -4,6 +4,7 @@ exports.runCase = exports.servicesFor = void 0;
 const dispatch_js_1 = require("../host/dispatch.js");
 const service_js_1 = require("../drive/service.js");
 const memory_store_js_1 = require("../drive/memory-store.js");
+const registry_js_1 = require("../drive/registry.js");
 const service_js_2 = require("../identity/service.js");
 const records_js_1 = require("../identity/records.js");
 const service_js_3 = require("../session/service.js");
@@ -29,6 +30,7 @@ const servicesFor = (testCase) => {
             : new memory_store_js_1.MemoryDriveStore(testCase.seed || {})),
         identity: (0, service_js_2.createIdentityService)(identity),
         records: (0, records_js_1.createRecordService)(identity),
+        registry: new registry_js_1.MemoryAppStreamRegistry(),
         session: (0, service_js_3.createSessionService)(identity, new memory_host_js_1.MemorySessionHost())
     };
 };

package/build/cjs/corpus/session.js

@@ -3,7 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SESSION_CORPUS = void 0;
 const ADMIN = { userId: 'user-admin', clientId: 'web_app' };
 const RESTRICTED = { userId: 'user-restricted', clientId: 'web_app' };
+const notFound = (id) => `Session with ID '${id}' was not found.`;
+const UNAUTHORIZED = 'Unauthorized';
 exports.SESSION_CORPUS = [
+    // ---------------------------------------------------------------- summary
     {
         id: 'session-summary-own',
         route: 'GET /SASjsApi/session/{sessionId}',
@@ -36,6 +39,28 @@ exports.SESSION_CORPUS = [
             }
         }
     },
+    {
+        id: 'session-summary-unauthenticated',
+        route: 'GET /SASjsApi/session/{sessionId}',
+        description: 'refuses a caller with no token',
+        request: { params: { sessionId: 'sess-admin' } },
+        expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+        id: 'session-summary-foreign',
+        route: 'GET /SASjsApi/session/{sessionId}',
+        description: "answers 404 for another account's session, not 403",
+        request: { subject: RESTRICTED, params: { sessionId: 'sess-admin' } },
+        expect: { status: 404, error: notFound('sess-admin') }
+    },
+    {
+        id: 'session-summary-unknown',
+        route: 'GET /SASjsApi/session/{sessionId}',
+        description: 'answers the same 404 for a session that does not exist',
+        request: { subject: ADMIN, params: { sessionId: 'sess-nope' } },
+        expect: { status: 404, error: notFound('sess-nope') }
+    },
+    // -------------------------------------------------------------------- log
     {
         id: 'session-log-own',
         route: 'GET /SASjsApi/session/{sessionId}/log',
@@ -53,6 +78,21 @@ exports.SESSION_CORPUS = [
         request: { subject: ADMIN, params: { sessionId: 'sess-silent' } },
         expect: { status: 200, contents: '' }
     },
+    {
+        id: 'session-log-unauthenticated',
+        route: 'GET /SASjsApi/session/{sessionId}/log',
+        description: 'refuses a caller with no token',
+        request: { params: { sessionId: 'sess-admin' } },
+        expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+        id: 'session-log-foreign',
+        route: 'GET /SASjsApi/session/{sessionId}/log',
+        description: "will not read another account's log",
+        request: { subject: RESTRICTED, params: { sessionId: 'sess-admin' } },
+        expect: { status: 404, error: notFound('sess-admin') }
+    },
+    // ----------------------------------------------------------------- output
     {
         id: 'session-output-own',
         route: 'GET /SASjsApi/session/{sessionId}/output',
@@ -60,6 +100,21 @@ exports.SESSION_CORPUS = [
         request: { subject: ADMIN, params: { sessionId: 'sess-admin' } },
         expect: { status: 200, contents: '<html><body>42</body></html>' }
     },
+    {
+        id: 'session-output-unauthenticated',
+        route: 'GET /SASjsApi/session/{sessionId}/output',
+        description: 'refuses a caller with no token',
+        request: { params: { sessionId: 'sess-admin' } },
+        expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+        id: 'session-output-foreign',
+        route: 'GET /SASjsApi/session/{sessionId}/output',
+        description: "will not read another account's webout",
+        request: { subject: RESTRICTED, params: { sessionId: 'sess-admin' } },
+        expect: { status: 404, error: notFound('sess-admin') }
+    },
+    // ------------------------------------------------------------------ state
     {
         id: 'session-state-own',
         route: 'GET /SASjsApi/session/{sessionId}/state',
@@ -69,5 +124,19 @@ exports.SESSION_CORPUS = [
             status: 200,
             body: { state: 'running', pid: 4243, lineCount: 3 }
         }
+    },
+    {
+        id: 'session-state-unauthenticated',
+        route: 'GET /SASjsApi/session/{sessionId}/state',
+        description: 'refuses a caller with no token',
+        request: { params: { sessionId: 'sess-restricted' } },
+        expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+        id: 'session-state-foreign',
+        route: 'GET /SASjsApi/session/{sessionId}/state',
+        description: "will not report another account's session state",
+        request: { subject: RESTRICTED, params: { sessionId: 'sess-admin' } },
+        expect: { status: 404, error: notFound('sess-admin') }
     }
 ];

package/build/cjs/drive/registry.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemoryAppStreamRegistry = exports.unpublishAppStream = void 0;
+const types_js_1 = require("../types.js");
+/**
+ * `DELETE /SASjsApi/drive/deploy`.
+ *
+ * The document requires both body values, so both are checked - a caller that
+ * names a stream but not the folder has not said what to remove. Only the folder
+ * reaches the registry, because that is what identifies the app.
+ *
+ * The checks are here rather than in the transport because this is the one
+ * implementation of the operation: a host calling it directly gets the same
+ * refusals in the same order, and with the same messages the document states.
+ */
+const unpublishAppStream = async (registry, body) => {
+    if (!body?.streamServiceName)
+        throw new types_js_1.ApiError(400, '"streamServiceName" is required');
+    if (!body.appLoc)
+        throw new types_js_1.ApiError(400, '"appLoc" is required');
+    if (!(await registry.unpublish(body.appLoc)))
+        throw new types_js_1.ApiError(404, 'No such app stream entry.');
+    return { status: 'success' };
+};
+exports.unpublishAppStream = unpublishAppStream;
+/**
+ * The registry the corpus and the package's own tests read: one published app,
+ * identified by its folder alone.
+ */
+class MemoryAppStreamRegistry {
+    constructor(folders = ['/Public/myApp']) {
+        this.folders = new Set(folders);
+    }
+    async unpublish(appLoc) {
+        return this.folders.delete(appLoc);
+    }
+}
+exports.MemoryAppStreamRegistry = MemoryAppStreamRegistry;

package/build/cjs/host/dispatch.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HANDLED_ROUTES = exports.dispatch = void 0;
 const index_js_1 = require("../routes/index.js");
+const registry_js_1 = require("../drive/registry.js");
 const types_js_1 = require("../types.js");
 const deploy_js_1 = require("../drive/deploy.js");
 /** The defaults sasjs/server's Client schema applies to an omitted lifetime. */
@@ -175,6 +176,13 @@ const dispatch = async (services, routeId, request = {}) => {
             await drive.deploy(String(body.appLoc ?? ''), body.fileTree);
             return { status: 200, body: deploy_js_1.DEPLOY_SUCCESS };
         }
+        case 'DELETE /SASjsApi/drive/deploy':
+            if (!services.registry)
+                throw new types_js_1.ApiError(501, `This host has no app stream registry, so it cannot answer ${routeId}.`);
+            return {
+                status: 200,
+                body: await (0, registry_js_1.unpublishAppStream)(services.registry, body)
+            };
         case 'GET /SASjsApi/drive/filetree':
             return { status: 200, body: await drive.tree(query._folderPath) };
         // ------------------------------------------------------------- sessions
@@ -388,6 +396,7 @@ const dispatch = async (services, routeId, request = {}) => {
 exports.dispatch = dispatch;
 /** Whether a route is one `dispatch` can answer today. */
 exports.HANDLED_ROUTES = [
+    'DELETE /SASjsApi/drive/deploy',
     'GET /SASjsApi/session/{sessionId}',
     'GET /SASjsApi/session/{sessionId}/log',
     'GET /SASjsApi/session/{sessionId}/output',

package/build/cjs/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.servicesFor = exports.runCase = exports.PROVIDER_MANAGED = exports.ADMIN_SIGNED_IN = exports.RECORD_CORPUS = exports.SESSION_CORPUS = exports.IDENTITY_CORPUS = exports.DRIVE_CORPUS = exports.parseIdentity = exports.IDENTITY_FORMAT = exports.DEFAULT_IDENTITY = exports.MemoryIdentityStore = exports.CODE_CORPUS = exports.sanitiseDisplayName = exports.createRecordService = exports.createIdentityService = exports.HANDLED_ROUTES = exports.dispatch = exports.TAG_CAPABILITIES = exports.OVERLAY = exports.findRoute = exports.routeById = exports.ROUTES = exports.MemoryDriveStore = exports.measureDeployTree = exports.isDeployTree = exports.deployTree = exports.decodeBase64 = exports.checkDeployTree = exports.DEPLOY_SUCCESS = exports.DEPLOY_PAYLOAD_BYTES = exports.DEPLOY_LIMITS = exports.createDriveService = exports.isRoot = exports.basename = exports.dirname = exports.hasBlockedExtension = exports.normaliseDrivePath = void 0;
+exports.servicesFor = exports.runCase = exports.PROVIDER_MANAGED = exports.ADMIN_SIGNED_IN = exports.RECORD_CORPUS = exports.SESSION_CORPUS = exports.DEPLOY_CORPUS = exports.IDENTITY_CORPUS = exports.DRIVE_CORPUS = exports.parseIdentity = exports.IDENTITY_FORMAT = exports.DEFAULT_IDENTITY = exports.MemoryIdentityStore = exports.CODE_CORPUS = exports.sanitiseDisplayName = exports.createRecordService = exports.createIdentityService = exports.HANDLED_ROUTES = exports.dispatch = exports.TAG_CAPABILITIES = exports.OVERLAY = exports.findRoute = exports.routeById = exports.ROUTES = exports.MemoryDriveStore = exports.measureDeployTree = exports.isDeployTree = exports.deployTree = exports.decodeBase64 = exports.checkDeployTree = exports.DEPLOY_SUCCESS = exports.DEPLOY_PAYLOAD_BYTES = exports.DEPLOY_LIMITS = exports.createDriveService = exports.isRoot = exports.basename = exports.dirname = exports.hasBlockedExtension = exports.normaliseDrivePath = void 0;
 /**
  * `@sasjs/api` - the SASjs Server API described once.
  *
@@ -79,6 +79,8 @@ var drive_js_1 = require("./corpus/drive.js");
 Object.defineProperty(exports, "DRIVE_CORPUS", { enumerable: true, get: function () { return drive_js_1.DRIVE_CORPUS; } });
 var identity_js_1 = require("./corpus/identity.js");
 Object.defineProperty(exports, "IDENTITY_CORPUS", { enumerable: true, get: function () { return identity_js_1.IDENTITY_CORPUS; } });
+var deploy_js_2 = require("./corpus/deploy.js");
+Object.defineProperty(exports, "DEPLOY_CORPUS", { enumerable: true, get: function () { return deploy_js_2.DEPLOY_CORPUS; } });
 var session_js_1 = require("./corpus/session.js");
 Object.defineProperty(exports, "SESSION_CORPUS", { enumerable: true, get: function () { return session_js_1.SESSION_CORPUS; } });
 var records_js_2 = require("./corpus/records.js");

package/build/cjs/routes/generated.js

@@ -1301,6 +1301,14 @@ exports.GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 401,
+                description: 'No valid access token or session was supplied'
+            },
+            {
+                status: 404,
+                description: 'Session with the given ID was not found.'
             }
         ]
     },
@@ -1323,6 +1331,14 @@ exports.GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 401,
+                description: 'No valid access token or session was supplied'
+            },
+            {
+                status: 404,
+                description: 'Session with the given ID was not found.'
             }
         ]
     },
@@ -1345,6 +1361,14 @@ exports.GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 401,
+                description: 'No valid access token or session was supplied'
+            },
+            {
+                status: 404,
+                description: 'Session with the given ID was not found.'
             }
         ]
     },
@@ -1367,6 +1391,14 @@ exports.GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 401,
+                description: 'No valid access token or session was supplied'
+            },
+            {
+                status: 404,
+                description: 'Session with the given ID was not found.'
             }
         ]
     },

package/build/cjs/routes/overlay.js

@@ -31,7 +31,6 @@ const HOST_CONFIG = "The body is the host's own configuration - ports, run times
 const HOST_OWNED = "The host owns this report: it describes the host's own process and files, which a browser build has no equivalent of.";
 const WEB_BUNDLE = 'The host serves its own web bundle; there is no API decision here for this package to answer.';
 const ARCHIVE = "Expanding the uploaded archive is the host's transport work - multer and a zip library on the server, `DecompressionStream` in a worker - and the host hands this package the tree it produces, which is the same tree `POST /SASjsApi/drive/deploy` takes.";
-const UNPUBLISH = 'Unpublishing inverts the deploy route, so the two land together.';
 const success = { status: 'success' };
 const user = {
     uid: '',
@@ -165,10 +164,7 @@ exports.OVERLAY = {
     },
     // `404` is a pair - the registry name and the appLoc it was published from -
     // that matches no entry, and the drive's content is deliberately left alone.
-    'DELETE /SASjsApi/drive/deploy': {
-        implemented: false,
-        reason: UNPUBLISH
-    },
+    'DELETE /SASjsApi/drive/deploy': { implemented: true },
     // Group - members and the groups themselves
     'GET /SASjsApi/group': { implemented: true },
     'GET /SASjsApi/group/{uid}': { implemented: true },

package/build/esm/corpus/deploy.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The deploy routes' conformance corpus.
+ *
+ * `DELETE /SASjsApi/drive/deploy` documents three answers - `200`, `400` and
+ * `404` - and each has a case here, which is what
+ * `spec/corpus-parity.spec.ts` enforces in both directions.
+ *
+ * **The folder is the identity.** An app is one thing to deploy and one thing to
+ * remove; its name is a label on it. The document requires both body values, so a
+ * caller must supply both, but only the folder decides what is deleted - and the
+ * case below with a stale name and the right folder pins exactly that, because a
+ * name-keyed lookup would answer 404 there and leave the app in place.
+ */
+import type { CorpusCase } from './drive.js';
+export declare const DEPLOY_CORPUS: CorpusCase[];
+//# sourceMappingURL=deploy.d.ts.map

package/build/esm/corpus/deploy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/corpus/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAI5C,eAAO,MAAM,aAAa,EAAE,UAAU,EA6CrC,CAAA"}

package/build/esm/corpus/deploy.js

@@ -0,0 +1,47 @@
+const SUBJECT = { userId: 'user-admin', clientId: 'web_app' };
+export const DEPLOY_CORPUS = [
+    {
+        id: 'deploy-unpublish',
+        route: 'DELETE /SASjsApi/drive/deploy',
+        description: 'removes a published app stream and answers the status',
+        request: {
+            subject: SUBJECT,
+            body: { streamServiceName: 'myApp', appLoc: '/Public/myApp' }
+        },
+        expect: { status: 200, body: { status: 'success' } }
+    },
+    {
+        id: 'deploy-unpublish-other-name',
+        route: 'DELETE /SASjsApi/drive/deploy',
+        description: 'removes the app by its folder when the name has been renamed',
+        request: {
+            subject: SUBJECT,
+            body: { streamServiceName: 'renamed-app', appLoc: '/Public/myApp' }
+        },
+        expect: { status: 200, body: { status: 'success' } }
+    },
+    {
+        id: 'deploy-unpublish-no-stream-name',
+        route: 'DELETE /SASjsApi/drive/deploy',
+        description: 'refuses a body that does not say which stream to remove',
+        request: { subject: SUBJECT, body: { appLoc: '/Public/myApp' } },
+        expect: { status: 400, error: '"streamServiceName" is required' }
+    },
+    {
+        id: 'deploy-unpublish-no-app-loc',
+        route: 'DELETE /SASjsApi/drive/deploy',
+        description: 'refuses a body that does not say which folder to remove',
+        request: { subject: SUBJECT, body: { streamServiceName: 'myApp' } },
+        expect: { status: 400, error: '"appLoc" is required' }
+    },
+    {
+        id: 'deploy-unpublish-unknown-folder',
+        route: 'DELETE /SASjsApi/drive/deploy',
+        description: 'answers 404 for a folder nothing is published at',
+        request: {
+            subject: SUBJECT,
+            body: { streamServiceName: 'myApp', appLoc: '/Public/not-an-app' }
+        },
+        expect: { status: 404, error: 'No such app stream entry.' }
+    }
+];

package/build/esm/corpus/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/corpus/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAWnD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;IAC9B,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,UAAU,UAAU,KAAG,QAmBlD,CAAA;AAkBD;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAClB,UAAU,UAAU,EACpB,WAAU,QAAgC,KACzC,OAAO,CAAC,UAAU,CAepB,CAAA"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/corpus/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAYnD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;IAC9B,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,UAAU,UAAU,KAAG,QAoBlD,CAAA;AAkBD;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAClB,UAAU,UAAU,EACpB,WAAU,QAAgC,KACzC,OAAO,CAAC,UAAU,CAepB,CAAA"}

package/build/esm/corpus/runner.js

@@ -1,6 +1,7 @@
 import { dispatch } from '../host/dispatch.js';
 import { createDriveService } from '../drive/service.js';
 import { MemoryDriveStore } from '../drive/memory-store.js';
+import { MemoryAppStreamRegistry } from '../drive/registry.js';
 import { createIdentityService } from '../identity/service.js';
 import { createRecordService } from '../identity/records.js';
 import { createSessionService } from '../session/service.js';
@@ -26,6 +27,7 @@ export const servicesFor = (testCase) => {
             : new MemoryDriveStore(testCase.seed || {})),
         identity: createIdentityService(identity),
         records: createRecordService(identity),
+        registry: new MemoryAppStreamRegistry(),
         session: createSessionService(identity, new MemorySessionHost())
     };
 };

package/build/esm/corpus/session.d.ts

@@ -1,15 +1,16 @@
 /**
  * The session routes' conformance corpus.
  *
- * Only the `200` answers are here, and that is a statement about the document
- * rather than about the routes: sasjs/server documents these four with a `200`
- * and nothing else, so `spec/corpus-parity.spec.ts` refuses a case that pins a
- * refusal. Their `401` and the `404` that covers both "no such session" and
- * "not yours" are pinned in `spec/session.spec.ts` instead, which the parity
- * gate does not govern.
+ * Every status the document states for these four routes has a case, in both
+ * directions - that is what `spec/corpus-parity.spec.ts` enforces. The refusals
+ * arrived here only after sasjs/server#574 documented them: until then the
+ * package answered a 401 and a 404 that the document did not state, and a case
+ * pinning one would have been called drift.
  *
- * The routes are in `documentRefusals.baseline.json` upstream; when they carry
- * their `@Response(401)` and `@Response(404)`, those cases move here.
+ * `404` covers an unknown session and someone else's alike, on purpose - the id
+ * is guessable within a window, so confirming that it exists would say the id
+ * was right. The cases below keep the two apart so a change that starts
+ * answering `403` for a foreign session is visible.
  */
 import type { CorpusCase } from './drive.js';
 export declare const SESSION_CORPUS: CorpusCase[];

package/build/esm/corpus/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/corpus/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAK5C,eAAO,MAAM,cAAc,EAAE,UAAU,EAmEtC,CAAA"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/corpus/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAQ5C,eAAO,MAAM,cAAc,EAAE,UAAU,EAyItC,CAAA"}

package/build/esm/corpus/session.js

@@ -1,6 +1,9 @@
 const ADMIN = { userId: 'user-admin', clientId: 'web_app' };
 const RESTRICTED = { userId: 'user-restricted', clientId: 'web_app' };
+const notFound = (id) => `Session with ID '${id}' was not found.`;
+const UNAUTHORIZED = 'Unauthorized';
 export const SESSION_CORPUS = [
+    // ---------------------------------------------------------------- summary
     {
         id: 'session-summary-own',
         route: 'GET /SASjsApi/session/{sessionId}',
@@ -33,6 +36,28 @@ export const SESSION_CORPUS = [
             }
         }
     },
+    {
+        id: 'session-summary-unauthenticated',
+        route: 'GET /SASjsApi/session/{sessionId}',
+        description: 'refuses a caller with no token',
+        request: { params: { sessionId: 'sess-admin' } },
+        expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+        id: 'session-summary-foreign',
+        route: 'GET /SASjsApi/session/{sessionId}',
+        description: "answers 404 for another account's session, not 403",
+        request: { subject: RESTRICTED, params: { sessionId: 'sess-admin' } },
+        expect: { status: 404, error: notFound('sess-admin') }
+    },
+    {
+        id: 'session-summary-unknown',
+        route: 'GET /SASjsApi/session/{sessionId}',
+        description: 'answers the same 404 for a session that does not exist',
+        request: { subject: ADMIN, params: { sessionId: 'sess-nope' } },
+        expect: { status: 404, error: notFound('sess-nope') }
+    },
+    // -------------------------------------------------------------------- log
     {
         id: 'session-log-own',
         route: 'GET /SASjsApi/session/{sessionId}/log',
@@ -50,6 +75,21 @@ export const SESSION_CORPUS = [
         request: { subject: ADMIN, params: { sessionId: 'sess-silent' } },
         expect: { status: 200, contents: '' }
     },
+    {
+        id: 'session-log-unauthenticated',
+        route: 'GET /SASjsApi/session/{sessionId}/log',
+        description: 'refuses a caller with no token',
+        request: { params: { sessionId: 'sess-admin' } },
+        expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+        id: 'session-log-foreign',
+        route: 'GET /SASjsApi/session/{sessionId}/log',
+        description: "will not read another account's log",
+        request: { subject: RESTRICTED, params: { sessionId: 'sess-admin' } },
+        expect: { status: 404, error: notFound('sess-admin') }
+    },
+    // ----------------------------------------------------------------- output
     {
         id: 'session-output-own',
         route: 'GET /SASjsApi/session/{sessionId}/output',
@@ -57,6 +97,21 @@ export const SESSION_CORPUS = [
         request: { subject: ADMIN, params: { sessionId: 'sess-admin' } },
         expect: { status: 200, contents: '<html><body>42</body></html>' }
     },
+    {
+        id: 'session-output-unauthenticated',
+        route: 'GET /SASjsApi/session/{sessionId}/output',
+        description: 'refuses a caller with no token',
+        request: { params: { sessionId: 'sess-admin' } },
+        expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+        id: 'session-output-foreign',
+        route: 'GET /SASjsApi/session/{sessionId}/output',
+        description: "will not read another account's webout",
+        request: { subject: RESTRICTED, params: { sessionId: 'sess-admin' } },
+        expect: { status: 404, error: notFound('sess-admin') }
+    },
+    // ------------------------------------------------------------------ state
     {
         id: 'session-state-own',
         route: 'GET /SASjsApi/session/{sessionId}/state',
@@ -66,5 +121,19 @@ export const SESSION_CORPUS = [
             status: 200,
             body: { state: 'running', pid: 4243, lineCount: 3 }
         }
+    },
+    {
+        id: 'session-state-unauthenticated',
+        route: 'GET /SASjsApi/session/{sessionId}/state',
+        description: 'refuses a caller with no token',
+        request: { params: { sessionId: 'sess-restricted' } },
+        expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+        id: 'session-state-foreign',
+        route: 'GET /SASjsApi/session/{sessionId}/state',
+        description: "will not report another account's session state",
+        request: { subject: RESTRICTED, params: { sessionId: 'sess-admin' } },
+        expect: { status: 404, error: notFound('sess-admin') }
     }
 ];

package/build/esm/drive/registry.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The app streams a host has published, as the API needs to unpublish one.
+ *
+ * A published stream is the host's own record - a directory convention, a
+ * registry table, whatever it uses to know that `/Public/myApp` is served at
+ * `/Public/myApp/index.html`. The package cannot invent it, so the route takes
+ * this port and answers 501 without it, the same way the session routes do.
+ */
+export interface AppStreamRegistry {
+    /**
+     * Removes the app published at `appLoc`.
+     *
+     * **The folder is the identity.** An app is one thing to deploy and one thing
+     * to delete, and what it is called is a label on it: two apps can share a
+     * folder only as a special case, and they are still one thing to load or
+     * remove. So the lookup is by folder, and a name that no longer matches the
+     * one recorded does not turn a correct deletion into a `404`.
+     *
+     * `false` when nothing is published at that folder, which the route reports as
+     * a 404 - a delete that silently succeeded on a folder nobody deployed would
+     * hide a caller's typo.
+     */
+    unpublish(appLoc: string): Promise<boolean>;
+}
+export interface UnpublishBody {
+    streamServiceName?: string;
+    appLoc?: string;
+}
+/**
+ * `DELETE /SASjsApi/drive/deploy`.
+ *
+ * The document requires both body values, so both are checked - a caller that
+ * names a stream but not the folder has not said what to remove. Only the folder
+ * reaches the registry, because that is what identifies the app.
+ *
+ * The checks are here rather than in the transport because this is the one
+ * implementation of the operation: a host calling it directly gets the same
+ * refusals in the same order, and with the same messages the document states.
+ */
+export declare const unpublishAppStream: (registry: AppStreamRegistry, body: UnpublishBody | undefined) => Promise<{
+    status: "success";
+}>;
+/**
+ * The registry the corpus and the package's own tests read: one published app,
+ * identified by its folder alone.
+ */
+export declare class MemoryAppStreamRegistry implements AppStreamRegistry {
+    private readonly folders;
+    constructor(folders?: string[]);
+    unpublish(appLoc: string): Promise<boolean>;
+}
+//# sourceMappingURL=registry.d.ts.map

package/build/esm/drive/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/drive/registry.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC5C;AAED,MAAM,WAAW,aAAa;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAC7B,UAAU,iBAAiB,EAC3B,MAAM,aAAa,GAAG,SAAS,KAC9B,OAAO,CAAC;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAU/B,CAAA;AAED;;;GAGG;AACH,qBAAa,uBAAwB,YAAW,iBAAiB;IAC/D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;gBAEzB,OAAO,GAAE,MAAM,EAAsB;IAI3C,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAGlD"}

package/build/esm/drive/registry.js

@@ -0,0 +1,33 @@
+import { ApiError } from '../types.js';
+/**
+ * `DELETE /SASjsApi/drive/deploy`.
+ *
+ * The document requires both body values, so both are checked - a caller that
+ * names a stream but not the folder has not said what to remove. Only the folder
+ * reaches the registry, because that is what identifies the app.
+ *
+ * The checks are here rather than in the transport because this is the one
+ * implementation of the operation: a host calling it directly gets the same
+ * refusals in the same order, and with the same messages the document states.
+ */
+export const unpublishAppStream = async (registry, body) => {
+    if (!body?.streamServiceName)
+        throw new ApiError(400, '"streamServiceName" is required');
+    if (!body.appLoc)
+        throw new ApiError(400, '"appLoc" is required');
+    if (!(await registry.unpublish(body.appLoc)))
+        throw new ApiError(404, 'No such app stream entry.');
+    return { status: 'success' };
+};
+/**
+ * The registry the corpus and the package's own tests read: one published app,
+ * identified by its folder alone.
+ */
+export class MemoryAppStreamRegistry {
+    constructor(folders = ['/Public/myApp']) {
+        this.folders = new Set(folders);
+    }
+    async unpublish(appLoc) {
+        return this.folders.delete(appLoc);
+    }
+}

package/build/esm/host/dispatch.d.ts

@@ -2,6 +2,7 @@ import type { DriveService } from '../drive/service.js';
 import type { IdentityService } from '../identity/service.js';
 import type { RecordService } from '../identity/records.js';
 import type { SessionService } from '../session/service.js';
+import type { AppStreamRegistry } from '../drive/registry.js';
 import type { CodeService } from '../code/service.js';
 import type { Subject } from '../identity/types.js';
 export interface ApiRequest {
@@ -51,6 +52,11 @@ export interface Services {
      * answers 501 for these four, naming the capability.
      */
     session?: SessionService;
+    /**
+     * The app streams a host has published. Absent, `DELETE /drive/deploy`
+     * answers 501 - the package cannot know a host's stream registry.
+     */
+    registry?: AppStreamRegistry;
 }
 export declare const dispatch: (services: Services, routeId: string, request?: ApiRequest) => Promise<ApiResponse>;
 /** Whether a route is one `dispatch` can answer today. */

package/build/esm/host/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/host/dispatch.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAOnD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,oFAAoF;IACpF,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;KAAE,CAAA;IACtD;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,2DAA2D;IAC3D,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,YAAY,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,yFAAyF;IACzF,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAA;CACzB;AA2CD,eAAO,MAAM,QAAQ,GACnB,UAAU,QAAQ,EAClB,SAAS,MAAM,EACf,UAAS,UAAe,KACvB,OAAO,CAAC,WAAW,CA8brB,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,cAAc,EAAE,MAAM,EAgDlC,CAAA"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/host/dispatch.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAE7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAOnD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,oFAAoF;IACpF,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;KAAE,CAAA;IACtD;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,2DAA2D;IAC3D,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,YAAY,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,yFAAyF;IACzF,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB;;;OAGG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAA;CAC7B;AA2CD,eAAO,MAAM,QAAQ,GACnB,UAAU,QAAQ,EAClB,SAAS,MAAM,EACf,UAAS,UAAe,KACvB,OAAO,CAAC,WAAW,CAycrB,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,cAAc,EAAE,MAAM,EAiDlC,CAAA"}

package/build/esm/host/dispatch.js

@@ -1,4 +1,5 @@
 import { routeById } from '../routes/index.js';
+import { unpublishAppStream } from '../drive/registry.js';
 import { ApiError } from '../types.js';
 import { DEPLOY_SUCCESS } from '../drive/deploy.js';
 /** The defaults sasjs/server's Client schema applies to an omitted lifetime. */
@@ -172,6 +173,13 @@ export const dispatch = async (services, routeId, request = {}) => {
             await drive.deploy(String(body.appLoc ?? ''), body.fileTree);
             return { status: 200, body: DEPLOY_SUCCESS };
         }
+        case 'DELETE /SASjsApi/drive/deploy':
+            if (!services.registry)
+                throw new ApiError(501, `This host has no app stream registry, so it cannot answer ${routeId}.`);
+            return {
+                status: 200,
+                body: await unpublishAppStream(services.registry, body)
+            };
         case 'GET /SASjsApi/drive/filetree':
             return { status: 200, body: await drive.tree(query._folderPath) };
         // ------------------------------------------------------------- sessions
@@ -384,6 +392,7 @@ export const dispatch = async (services, routeId, request = {}) => {
 };
 /** Whether a route is one `dispatch` can answer today. */
 export const HANDLED_ROUTES = [
+    'DELETE /SASjsApi/drive/deploy',
     'GET /SASjsApi/session/{sessionId}',
     'GET /SASjsApi/session/{sessionId}/log',
     'GET /SASjsApi/session/{sessionId}/output',

package/build/esm/index.d.ts

@@ -38,6 +38,7 @@ export type { IdentityFixture, IdentityFixtureClient, IdentityFixtureCode, Ident
 export type { IdentityClient, IdentityClientRecord, IdentityGroupRecord, IdentityPermissionRecord, IdentityStore, IdentityUser, IdentityUserRecord, NewGroup, NewPermission, NewUser, Subject, TokenPair, UserChange } from './identity/types.js';
 export { DRIVE_CORPUS } from './corpus/drive.js';
 export { IDENTITY_CORPUS } from './corpus/identity.js';
+export { DEPLOY_CORPUS } from './corpus/deploy.js';
 export { SESSION_CORPUS } from './corpus/session.js';
 export { RECORD_CORPUS, ADMIN_SIGNED_IN, PROVIDER_MANAGED } from './corpus/records.js';
 export type { CorpusCase } from './corpus/drive.js';

package/build/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,cAAc,YAAY,CAAA;AAC1B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,MAAM,EACP,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,iBAAiB,EAClB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,UAAU,EACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,SAAS,EACT,SAAS,EACV,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAChE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAG7D,cAAc,2BAA2B,CAAA;AACzC,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,YAAY,EACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,aAAa,EACb,OAAO,EACP,OAAO,EACP,SAAS,EACT,UAAU,EACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EACL,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACzD,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,cAAc,YAAY,CAAA;AAC1B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,MAAM,EACP,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,iBAAiB,EAClB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,UAAU,EACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,SAAS,EACT,SAAS,EACV,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAChE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAG7D,cAAc,2BAA2B,CAAA;AACzC,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,YAAY,EACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,aAAa,EACb,OAAO,EACP,OAAO,EACP,SAAS,EACT,UAAU,EACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EACL,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACzD,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA"}

package/build/esm/index.js

@@ -30,6 +30,7 @@ export { MemoryIdentityStore } from './identity/memory-store.js';
 export { DEFAULT_IDENTITY, IDENTITY_FORMAT, parseIdentity } from './identity/fixture.js';
 export { DRIVE_CORPUS } from './corpus/drive.js';
 export { IDENTITY_CORPUS } from './corpus/identity.js';
+export { DEPLOY_CORPUS } from './corpus/deploy.js';
 export { SESSION_CORPUS } from './corpus/session.js';
 export { RECORD_CORPUS, ADMIN_SIGNED_IN, PROVIDER_MANAGED } from './corpus/records.js';
 export { runCase, servicesFor } from './corpus/runner.js';

package/build/esm/routes/generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generated.d.ts","sourceRoot":"","sources":["../../../src/routes/generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,eAAO,MAAM,gBAAgB,EAAE,cAAc,EAw4D5C,CAAA"}
+{"version":3,"file":"generated.d.ts","sourceRoot":"","sources":["../../../src/routes/generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,eAAO,MAAM,gBAAgB,EAAE,cAAc,EAw6D5C,CAAA"}

package/build/esm/routes/generated.js

@@ -1298,6 +1298,14 @@ export const GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 401,
+                description: 'No valid access token or session was supplied'
+            },
+            {
+                status: 404,
+                description: 'Session with the given ID was not found.'
             }
         ]
     },
@@ -1320,6 +1328,14 @@ export const GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 401,
+                description: 'No valid access token or session was supplied'
+            },
+            {
+                status: 404,
+                description: 'Session with the given ID was not found.'
             }
         ]
     },
@@ -1342,6 +1358,14 @@ export const GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 401,
+                description: 'No valid access token or session was supplied'
+            },
+            {
+                status: 404,
+                description: 'Session with the given ID was not found.'
             }
         ]
     },
@@ -1364,6 +1388,14 @@ export const GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 401,
+                description: 'No valid access token or session was supplied'
+            },
+            {
+                status: 404,
+                description: 'Session with the given ID was not found.'
             }
         ]
     },

package/build/esm/routes/overlay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"overlay.d.ts","sourceRoot":"","sources":["../../../src/routes/overlay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGzD,yDAAyD;AACzD,UAAU,aAAa;IACrB,YAAY,CAAC,EAAE,UAAU,EAAE,CAAA;IAC3B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,aAAa,GACtC,CAAC;IAAE,WAAW,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,WAAW,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAElE,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAczD,CAAA;AAwCD,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAgNhD,CAAA;AAED,wEAAwE;AACxE,eAAO,MAAM,OAAO,EAAE,UAAU,EAA8C,CAAA"}
+{"version":3,"file":"overlay.d.ts","sourceRoot":"","sources":["../../../src/routes/overlay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGzD,yDAAyD;AACzD,UAAU,aAAa;IACrB,YAAY,CAAC,EAAE,UAAU,EAAE,CAAA;IAC3B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,aAAa,GACtC,CAAC;IAAE,WAAW,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,WAAW,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAElE,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAczD,CAAA;AAqCD,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CA6MhD,CAAA;AAED,wEAAwE;AACxE,eAAO,MAAM,OAAO,EAAE,UAAU,EAA8C,CAAA"}

package/build/esm/routes/overlay.js

@@ -28,7 +28,6 @@ const HOST_CONFIG = "The body is the host's own configuration - ports, run times
 const HOST_OWNED = "The host owns this report: it describes the host's own process and files, which a browser build has no equivalent of.";
 const WEB_BUNDLE = 'The host serves its own web bundle; there is no API decision here for this package to answer.';
 const ARCHIVE = "Expanding the uploaded archive is the host's transport work - multer and a zip library on the server, `DecompressionStream` in a worker - and the host hands this package the tree it produces, which is the same tree `POST /SASjsApi/drive/deploy` takes.";
-const UNPUBLISH = 'Unpublishing inverts the deploy route, so the two land together.';
 const success = { status: 'success' };
 const user = {
     uid: '',
@@ -162,10 +161,7 @@ export const OVERLAY = {
     },
     // `404` is a pair - the registry name and the appLoc it was published from -
     // that matches no entry, and the drive's content is deliberately left alone.
-    'DELETE /SASjsApi/drive/deploy': {
-        implemented: false,
-        reason: UNPUBLISH
-    },
+    'DELETE /SASjsApi/drive/deploy': { implemented: true },
     // Group - members and the groups themselves
     'GET /SASjsApi/group': { implemented: true },
     'GET /SASjsApi/group/{uid}': { implemented: true },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sasjs/api",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "The SASjs Server API, described once - a generated route table, the services behind it, and the conformance corpus both hosts run",
   "license": "MIT",
   "author": "SASjs",