@sasjs/api 0.4.0 → 0.6.0

package/build/esm/routes/overlay.js

@@ -1,3 +1,4 @@
+import { DEPLOY_SUCCESS } from '../drive/deploy.js';
 /** The default capability for each tag, overridden per route where it differs. */
 export const TAG_CAPABILITIES = {
     Drive: ['storage'],
@@ -14,6 +15,23 @@ export const TAG_CAPABILITIES = {
     Client: ['identity'],
     Web: ['identity']
 };
+/**
+ * Why a block of operations is not implemented here.
+ *
+ * One per dependency rather than one per route: the reason states what the
+ * operation waits on, and thirty copies of the same sentence would say the same
+ * thing thirty times.
+ */
+const IDENTITY_RECORDS = 'The identity service answers the sign-in flow. User, group, permission rule, client and provider records need read and write methods on the same store, which this package does not have yet.';
+const EDITOR = 'Linting and formatting come from @sasjs/lint, which this package does not depend on. They land with the code routes so an editor has one wiring.';
+const RUNTIME = 'Starting a program needs a runtime port, which this package does not have: a host decides which languages it holds, and answers this itself until then.';
+const SESSION_RECORD = "A triggered session's record, log, output and state belong to the runtime that ran the program, and this package has no runtime port.";
+const HOST_CONFIG = "The body is the host's own configuration - ports, run times and providers - which a mock states for itself and this package cannot know.";
+const PERMISSIONS = "The route inventory is the host's permission model, which this package does not hold.";
+const HOST_OWNED = "The host owns this report: it describes the host's own process and files, which a browser build has no equivalent of.";
+const WEB_BUNDLE = 'The host serves its own web bundle; there is no API decision here for this package to answer.';
+const ARCHIVE = "Expanding the uploaded archive is the host's transport work - multer and a zip library on the server, `DecompressionStream` in a worker - and the host hands this package the tree it produces, which is the same tree `POST /SASjsApi/drive/deploy` takes.";
+const UNPUBLISH = 'Unpublishing inverts the deploy route, so the two land together.';
 const success = { status: 'success' };
 const user = {
     uid: '',
@@ -23,11 +41,61 @@ const user = {
     needsToUpdatePassword: false
 };
 export const OVERLAY = {
-    // the route inventory reports what the CALLER may use, so it needs an identity
-    // even though the rest of the Info tag needs nothing
-    'GET /SASjsApi/info/authorizedRoutes': { capabilities: ['identity'] },
-    'GET /SASjsApi/info/myAuthorizedRoutes': { capabilities: ['identity'] },
-    // the body is the file itself, so there is nothing to annotate
+    // Web - the sign-in pages the identity service answers, and the bundle itself
+    'GET /': { implemented: false, reason: WEB_BUNDLE },
+    'POST /SASLogon/login': {
+        implemented: true,
+        // The lockout and the provider failure are answered before the package is
+        // consulted (routes/web/web.ts in sasjs/server).
+        hostResponses: [429, 500],
+        responses: { 200: { loggedIn: true, user } }
+    },
+    'POST /SASLogon/authorize': {
+        implemented: true,
+        responses: { 200: { code: '' } }
+    },
+    'GET /SASLogon/logout': {
+        implemented: true,
+        hostResponses: [500],
+        responses: { 200: 'OK!' }
+    },
+    // Admin - the host's own process and files
+    'GET /SASjsApi/admin/diagnostics': { implemented: false, reason: HOST_OWNED },
+    'GET /SASjsApi/admin/logs': { implemented: false, reason: HOST_OWNED },
+    'GET /SASjsApi/admin/logs/{fileName}': {
+        implemented: false,
+        reason: HOST_OWNED
+    },
+    // Auth - the token flow, plus a password change the identity store cannot write
+    'POST /SASjsApi/auth/token': {
+        implemented: true,
+        responses: { 200: { accessToken: '', refreshToken: '' } }
+    },
+    'POST /SASjsApi/auth/refresh': {
+        implemented: true,
+        responses: { 200: { accessToken: '', refreshToken: '' } }
+    },
+    'POST /SASjsApi/auth/logout': { implemented: true },
+    'PATCH /SASjsApi/auth/updatePassword': {
+        implemented: false,
+        reason: IDENTITY_RECORDS
+    },
+    // Auth Config - the providers a host was started with, and an LDAP import
+    'GET /SASjsApi/authConfig': { implemented: false, reason: HOST_CONFIG },
+    'POST /SASjsApi/authConfig/synchroniseWithLDAP': {
+        implemented: false,
+        reason: IDENTITY_RECORDS
+    },
+    // Client - the OAuth clients the identity store already holds for sign-in
+    'GET /SASjsApi/client': { implemented: false, reason: IDENTITY_RECORDS },
+    'POST /SASjsApi/client': { implemented: false, reason: IDENTITY_RECORDS },
+    // Code - the editor's three calls, and the runtime one
+    'POST /SASjsApi/code/execute': { implemented: false, reason: RUNTIME },
+    'POST /SASjsApi/code/trigger': { implemented: false, reason: RUNTIME },
+    'POST /SASjsApi/code/lint': { implemented: false, reason: EDITOR },
+    'POST /SASjsApi/code/format': { implemented: false, reason: EDITOR },
+    // Drive - the file and folder rules, and the three deploy routes
+    // The body is the file itself, so there is nothing to annotate
     'GET /SASjsApi/drive/file': { implemented: true },
     'POST /SASjsApi/drive/file': {
         implemented: true,
@@ -65,54 +133,127 @@ export const OVERLAY = {
         implemented: true,
         responses: { 200: { status: 'success', tree: {} } }
     },
-    // The two deploy routes write a whole tree in one request. They are the only
-    // ones where a caller can exhaust the host's storage, so they carry a cap -
-    // see the plan in sasjs/cli#1550 - and they are not implemented yet.
+    // The deploy routes answer an ENVELOPE, unlike the file routes above: their
+    // `400` is `{status:'failure', message}` rather than the message as text, and
+    // `413` is the cap refusing the tree before anything is written.
+    // `"appLoc" is required` and `"fileTree" is required` are the other `400` this
+    // route sends - a missing body property, worded by the table's own
+    // validation - so the body annotated here is the substantial one.
     'POST /SASjsApi/drive/deploy': {
-        implemented: false
+        implemented: true,
+        responses: {
+            200: DEPLOY_SUCCESS,
+            400: {
+                status: 'failure',
+                message: 'Provided not supported data format.'
+            },
+            413: 'The file tree exceeds the deploy limit.',
+            500: { status: 'failure', message: 'Deployment failed!' }
+        }
     },
     'POST /SASjsApi/drive/deploy/upload': {
-        implemented: false
-    },
-    // Unpublishing is the counterpart of the two above and lands with them: the
-    // document in sasjs/server states it (sasjs/server#543), so a host may answer
-    // it in the meantime, but this package cannot until the publish side it would
-    // invert is implemented here. The statuses are the document's; `404` is a pair
-    // - the registry name and the appLoc it was published from - that matches no
-    // entry, and the drive's content is deliberately left alone.
+        implemented: false,
+        reason: ARCHIVE
+    },
+    // `404` is a pair - the registry name and the appLoc it was published from -
+    // that matches no entry, and the drive's content is deliberately left alone.
     'DELETE /SASjsApi/drive/deploy': {
-        implemented: false
+        implemented: false,
+        reason: UNPUBLISH
     },
-    // The lockout and the provider failure are answered before the package is
-    // consulted (routes/web/web.ts in sasjs/server).
-    'POST /SASLogon/login': {
-        implemented: true,
-        hostResponses: [429, 500],
-        responses: { 200: { loggedIn: true, user } }
+    // Group - members and the groups themselves
+    'GET /SASjsApi/group': { implemented: false, reason: IDENTITY_RECORDS },
+    'GET /SASjsApi/group/{uid}': { implemented: false, reason: IDENTITY_RECORDS },
+    'GET /SASjsApi/group/by/groupname/{name}': {
+        implemented: false,
+        reason: IDENTITY_RECORDS
     },
-    // The sign-in flow. The statuses are the document's; these entries state the
-    // body a client keys on, and that this package answers the operation.
-    'POST /SASjsApi/auth/token': {
-        implemented: true,
-        responses: { 200: { accessToken: '', refreshToken: '' } }
+    'POST /SASjsApi/group': { implemented: false, reason: IDENTITY_RECORDS },
+    'POST /SASjsApi/group/{groupUid}/{userUid}': {
+        implemented: false,
+        reason: IDENTITY_RECORDS
     },
-    'POST /SASjsApi/auth/refresh': {
-        implemented: true,
-        responses: { 200: { accessToken: '', refreshToken: '' } }
+    'DELETE /SASjsApi/group/{groupUid}/{userUid}': {
+        implemented: false,
+        reason: IDENTITY_RECORDS
     },
-    'POST /SASjsApi/auth/logout': { implemented: true },
-    'POST /SASLogon/authorize': {
-        implemented: true,
-        responses: { 200: { code: '' } }
+    'DELETE /SASjsApi/group/{uid}': {
+        implemented: false,
+        reason: IDENTITY_RECORDS
     },
-    'GET /SASLogon/logout': {
-        implemented: true,
-        hostResponses: [500],
-        responses: { 200: 'OK!' }
+    // Info - what the host is, and what this caller may use
+    'GET /SASjsApi/info': { implemented: false, reason: HOST_CONFIG },
+    'GET /SASjsApi/info/authorizedRoutes': {
+        implemented: false,
+        // the route inventory reports what the CALLER may use, so it needs an
+        // identity even though the rest of the Info tag needs nothing
+        capabilities: ['identity'],
+        reason: PERMISSIONS
+    },
+    'GET /SASjsApi/info/myAuthorizedRoutes': {
+        implemented: false,
+        capabilities: ['identity'],
+        reason: PERMISSIONS
     },
+    // Permission - the rules the inventory above is derived from
+    'GET /SASjsApi/permission': { implemented: false, reason: IDENTITY_RECORDS },
+    'POST /SASjsApi/permission': { implemented: false, reason: IDENTITY_RECORDS },
+    'PATCH /SASjsApi/permission/{uid}': {
+        implemented: false,
+        reason: IDENTITY_RECORDS
+    },
+    'DELETE /SASjsApi/permission/{uid}': {
+        implemented: false,
+        reason: IDENTITY_RECORDS
+    },
+    // Session - the caller's own session, then the record behind a triggered one
     'GET /SASjsApi/session': {
         implemented: true,
         responses: { 200: user }
+    },
+    'GET /SASjsApi/session/{sessionId}': {
+        implemented: false,
+        reason: SESSION_RECORD
+    },
+    'GET /SASjsApi/session/{sessionId}/log': {
+        implemented: false,
+        reason: SESSION_RECORD
+    },
+    'GET /SASjsApi/session/{sessionId}/output': {
+        implemented: false,
+        reason: SESSION_RECORD
+    },
+    'GET /SASjsApi/session/{sessionId}/state': {
+        implemented: false,
+        reason: SESSION_RECORD
+    },
+    // STP - a stored program, on the runtime port
+    'GET /SASjsApi/stp/execute': { implemented: false, reason: RUNTIME },
+    'POST /SASjsApi/stp/execute': { implemented: false, reason: RUNTIME },
+    'POST /SASjsApi/stp/trigger': { implemented: false, reason: RUNTIME },
+    // User - the accounts the identity store already holds for sign-in
+    'GET /SASjsApi/user': { implemented: false, reason: IDENTITY_RECORDS },
+    'GET /SASjsApi/user/{uid}': { implemented: false, reason: IDENTITY_RECORDS },
+    'GET /SASjsApi/user/by/username/{username}': {
+        implemented: false,
+        reason: IDENTITY_RECORDS
+    },
+    'POST /SASjsApi/user': { implemented: false, reason: IDENTITY_RECORDS },
+    'PATCH /SASjsApi/user/{uid}': {
+        implemented: false,
+        reason: IDENTITY_RECORDS
+    },
+    'PATCH /SASjsApi/user/by/username/{username}': {
+        implemented: false,
+        reason: IDENTITY_RECORDS
+    },
+    'DELETE /SASjsApi/user/{uid}': {
+        implemented: false,
+        reason: IDENTITY_RECORDS
+    },
+    'DELETE /SASjsApi/user/by/username/{username}': {
+        implemented: false,
+        reason: IDENTITY_RECORDS
     }
 };
 /** Every method the table may state, in the order a diff reads best. */

package/build/esm/types.d.ts

@@ -14,9 +14,27 @@
  */
 export declare class ApiError extends Error {
     readonly status: number;
+    /**
+     * The body the route renders instead of the bare message.
+     *
+     * Most drive routes send the message as text (`res.status(code).send(err)`),
+     * and that stays the default: a body here is for the routes that answer an
+     * envelope, which today is the two deploy routes and their
+     * `{status: 'failure', message}`.
+     */
+    readonly body?: unknown | undefined;
     /** Told apart by marker rather than `instanceof` - see `isApiError`. */
     readonly apiError = true;
-    constructor(status: number, message: string);
+    constructor(status: number, message: string, 
+    /**
+     * The body the route renders instead of the bare message.
+     *
+     * Most drive routes send the message as text (`res.status(code).send(err)`),
+     * and that stays the default: a body here is for the routes that answer an
+     * envelope, which today is the two deploy routes and their
+     * `{status: 'failure', message}`.
+     */
+    body?: unknown | undefined);
 }
 /**
  * `instanceof` survives here (the package targets ES2020, not ES5), but a
@@ -85,6 +103,13 @@ export interface Route extends GeneratedRoute {
      * not an absence nobody can see.
      */
     implemented: boolean;
+    /**
+     * Why this package does not implement the operation, and what it waits on.
+     * Present exactly when `implemented` is false: the overlay's entries are a
+     * decision either way, and `src/routes/index.ts` refuses to build a table with
+     * an operation nobody has decided about. A 501 carries it to the caller.
+     */
+    reason?: string;
 }
 /**
  * The drive, as the services see it.

package/build/esm/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,qBAAa,QAAS,SAAQ,KAAK;IAK/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IAJzB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,QAAO;gBAGb,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;CAKlB;AAED;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,QACH,CAAA;AAElD;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,SAAS,GACT,UAAU,GACV,KAAK,GACL,MAAM,CAAA;AAEV,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEpE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAA;AAE7E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,EAAE,EAAE,aAAa,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,qEAAqE;IACrE,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,UAAU,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,UAAU,EAAE,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,SAAS,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC1D;AAED,MAAM,WAAW,KAAM,SAAQ,cAAc;IAC3C,SAAS,EAAE,aAAa,EAAE,CAAA;IAC1B;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,YAAY,EAAE,UAAU,EAAE,CAAA;IAC1B;;;;OAIG;IACH,WAAW,EAAE,OAAO,CAAA;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,CAAA;IAChD,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACtC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjE,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IACnE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,4DAA4D;IAC5D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9C;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,QAAQ,EAAE,CAAA;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;GAIG;AACH,qBAAa,QAAS,SAAQ,KAAK;IAK/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IAEvB;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO;IAdzB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,QAAO;gBAGb,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;IACf;;;;;;;OAOG;IACM,IAAI,CAAC,EAAE,OAAO,YAAA;CAK1B;AAED;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,QACH,CAAA;AAElD;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,SAAS,GACT,UAAU,GACV,KAAK,GACL,MAAM,CAAA;AAEV,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEpE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAA;AAE7E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,EAAE,EAAE,aAAa,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,qEAAqE;IACrE,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,UAAU,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,UAAU,EAAE,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,SAAS,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC1D;AAED,MAAM,WAAW,KAAM,SAAQ,cAAc;IAC3C,SAAS,EAAE,aAAa,EAAE,CAAA;IAC1B;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,YAAY,EAAE,UAAU,EAAE,CAAA;IAC1B;;;;OAIG;IACH,WAAW,EAAE,OAAO,CAAA;IACpB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,CAAA;IAChD,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACtC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjE,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IACnE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,4DAA4D;IAC5D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9C;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,QAAQ,EAAE,CAAA;CACrB"}

package/build/esm/types.js

@@ -13,9 +13,19 @@
  * corpus can assert on the pair.
  */
 export class ApiError extends Error {
-    constructor(status, message) {
+    constructor(status, message, 
+    /**
+     * The body the route renders instead of the bare message.
+     *
+     * Most drive routes send the message as text (`res.status(code).send(err)`),
+     * and that stays the default: a body here is for the routes that answer an
+     * envelope, which today is the two deploy routes and their
+     * `{status: 'failure', message}`.
+     */
+    body) {
         super(message);
         this.status = status;
+        this.body = body;
         /** Told apart by marker rather than `instanceof` - see `isApiError`. */
         this.apiError = true;
         this.name = 'ApiError';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sasjs/api",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "The SASjs Server API, described once - a generated route table, the services behind it, and the conformance corpus both hosts run",
   "license": "MIT",
   "author": "SASjs",