@sasjs/api 0.5.0 → 0.6.1

package/build/esm/drive/deploy.d.ts

@@ -0,0 +1,153 @@
+/**
+ * Deploying a file tree, and the cap that bounds it.
+ *
+ * `POST /SASjsApi/drive/deploy` writes a whole tree in one request, which makes
+ * it the one drive operation where a caller can fill the host's storage: the
+ * others write a single file at a time, bounded by the host's upload limit. So
+ * the tree is measured and its names checked BEFORE anything is written, and a
+ * refusal leaves the drive exactly as it was.
+ *
+ * The numbers live here rather than in a host, because both hosts answer the
+ * same `413` and a corpus case pins the wording: a limit stated twice is a limit
+ * that disagrees with itself in the release nobody re-read.
+ *
+ * Nothing here imports a runtime. A base64 file member is decoded by hand and a
+ * service's size is counted as UTF-8 by hand, because the same build runs in a
+ * service worker where `Buffer` does not exist and the package compiles against
+ * `lib: ES2020` with no ambient types.
+ */
+import type { DriveStore } from '../types.js';
+/** The three member kinds the wire format carries. */
+export type DeployMemberType = 'folder' | 'service' | 'file';
+export interface DeployFolderMember {
+    name: string;
+    type: 'folder';
+    members: DeployMember[];
+}
+/** A program; written as `<name>.sas`, its `code` being the program text. */
+export interface DeployServiceMember {
+    name: string;
+    type: 'service';
+    code: string;
+}
+/** A file; `code` is base64 of the bytes to write. */
+export interface DeployFileMember {
+    name: string;
+    type: 'file';
+    code: string;
+}
+export type DeployMember = DeployFolderMember | DeployServiceMember | DeployFileMember;
+export interface DeployTree {
+    members: DeployMember[];
+}
+/**
+ * The deploy cap, in binary megabytes (the unit a host's upload limit reports)
+ * and compared inclusively: a tree of exactly 10,000 entries and exactly 100 MB
+ * passes.
+ *
+ * The three dimensions fail differently and so are separate: an estate is many
+ * small files (`entries`), a compiled service is one large file (`fileBytes`),
+ * and the total is what the host holds in memory before the tree reaches the
+ * drive (`totalBytes`).
+ */
+export interface DeployLimits {
+    readonly entries: number;
+    readonly totalBytes: number;
+    readonly fileBytes: number;
+}
+export declare const DEPLOY_LIMITS: DeployLimits;
+/**
+ * The largest a deploy tree can be on the wire, which is what a host's transport
+ * has to admit.
+ *
+ * The cap is stated in DECODED bytes; the tree travels as JSON in which a file
+ * member's contents are base64 - 4/3 of what they write - and a service's are
+ * escaped text (~1.04). A tree at `totalBytes` therefore reaches the parser at
+ * up to ~134MB, and a transport that admits less refuses first with its own
+ * shape, so the cap it was meant to enforce is never consulted. 140MB leaves
+ * room for the tree's JSON scaffolding.
+ *
+ * Only the deploy routes use it: everywhere else a smaller limit applies,
+ * because a body is buffered before authentication and nothing else needs the
+ * headroom.
+ */
+export declare const DEPLOY_PAYLOAD_BYTES: number;
+/**
+ * The body a deploy answers success with.
+ *
+ * The wording is the published contract - a client may key on the message - so
+ * it is one constant here rather than a string in each host. It names
+ * `@sasjs/server` because that is the document's example, which predates this
+ * package; changing it is a document change, not a host's choice.
+ */
+export declare const DEPLOY_SUCCESS: {
+    readonly status: "success";
+    readonly message: "Files deployed successfully to @sasjs/server.";
+};
+/** The refusal a deploy earns, in the shape the deploy routes render. */
+export interface DeployRefusal {
+    code: 400 | 413;
+    status: 'failure';
+    message: string;
+}
+export interface DeployMeasurements {
+    entries: number;
+    totalBytes: number;
+    /** The largest single member, by decoded size, with its path in the tree. */
+    largest: {
+        path: string;
+        bytes: number;
+    };
+}
+/**
+ * How deep a tree may nest.
+ *
+ * A deployment is an app: `services/`, `web/`, a folder per service. A few dozen
+ * levels is generous, and the number matters because the walk recurses once per
+ * level - without a ceiling, a tree nested deeply enough exhausts the stack and
+ * throws a `RangeError`, which is neither the `400` nor the `413` this route
+ * documents, on input the cap exists to bound.
+ */
+export declare const MAX_DEPTH = 32;
+/** The bytes a base64 body decodes to, for a store that writes bytes. */
+export declare const decodeBase64: (value: string) => Uint8Array;
+/**
+ * Measures a tree without touching a drive.
+ *
+ * Every member is counted, whatever its name: this answers "how big is this
+ * tree", and a caller that also needs the names checked is `checkDeployTree`.
+ */
+export declare const measureDeployTree: (members: DeployMember[]) => DeployMeasurements;
+/**
+ * The refusal a file tree earns, or `null` when it can be written.
+ *
+ * Names are checked first, then the dimensions in a fixed order - entries,
+ * total, single file - so a tree breaching two of them is refused for the same
+ * one every time, which is what lets a caller key on the message and a test pin
+ * it.
+ *
+ * `limits` defaults to `DEPLOY_LIMITS`; a host may pass its own, stricter set.
+ */
+export declare const checkDeployTree: (members: DeployMember[], limits?: DeployLimits) => DeployRefusal | null;
+/**
+ * The tree's shape, as the wire format states it.
+ *
+ * A port of `isFileTree` from `@sasjs/utils`, which is what sasjs/server
+ * validates with: a tree is an object with a `members` array, and every member
+ * is a folder with its own members, or a service/file with a string `code` and
+ * a string `name`. Anything else is the `400` the routes already answer.
+ */
+export declare const isDeployTree: (value: unknown) => value is DeployTree;
+/**
+ * Deploys a tree into `appLoc`, or refuses without writing.
+ *
+ * The order is the promise: shape, then containment, then the cap and the names,
+ * and only then the first write. `appLoc` is caller-supplied and every segment
+ * must stay a segment, so it is resolved against the drive root and refused when
+ * it leaves it - joined naively, a `..` would write outside the drive.
+ *
+ * A write that fails part-way answers the deploy routes' `500`; the tree before
+ * the failure is already on the drive, which the message does not hide.
+ */
+export declare const deployTree: (store: DriveStore, appLoc: unknown, tree: unknown, limits?: DeployLimits) => Promise<void>;
+//# sourceMappingURL=deploy.d.ts.map

package/build/esm/drive/deploy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/drive/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAI7C,sDAAsD;AACtD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAA;AAE5D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,QAAQ,CAAA;IACd,OAAO,EAAE,YAAY,EAAE,CAAA;CACxB;AAED,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,SAAS,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,MAAM,YAAY,GACtB,kBAAkB,GAAG,mBAAmB,GAAG,gBAAgB,CAAA;AAE7D,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,YAAY,EAAE,CAAA;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,eAAO,MAAM,aAAa,EAAE,YAI3B,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,QAAoB,CAAA;AAErD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;CAGjB,CAAA;AAEV,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,GAAG,GAAG,GAAG,CAAA;IACf,MAAM,EAAE,SAAS,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CACzC;AASD;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,KAAK,CAAA;AAY3B,yEAAyE;AACzE,eAAO,MAAM,YAAY,GAAI,OAAO,MAAM,KAAG,UAmB5C,CAAA;AA8HD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAC5B,SAAS,YAAY,EAAE,KACtB,kBAUF,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,GAC1B,SAAS,YAAY,EAAE,EACvB,SAAQ,YAA4B,KACnC,aAAa,GAAG,IAoClB,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,UAMtD,CAAA;AAkBD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,UAAU,GACrB,OAAO,UAAU,EACjB,QAAQ,OAAO,EACf,MAAM,OAAO,EACb,SAAQ,YAA4B,KACnC,OAAO,CAAC,IAAI,CAiCd,CAAA"}

package/build/esm/drive/deploy.js

@@ -0,0 +1,301 @@
+import { ApiError } from '../types.js';
+import { normaliseDrivePath } from './paths.js';
+export const DEPLOY_LIMITS = {
+    entries: 10000,
+    totalBytes: 100 * 1024 * 1024,
+    fileBytes: 20 * 1024 * 1024
+};
+/**
+ * The largest a deploy tree can be on the wire, which is what a host's transport
+ * has to admit.
+ *
+ * The cap is stated in DECODED bytes; the tree travels as JSON in which a file
+ * member's contents are base64 - 4/3 of what they write - and a service's are
+ * escaped text (~1.04). A tree at `totalBytes` therefore reaches the parser at
+ * up to ~134MB, and a transport that admits less refuses first with its own
+ * shape, so the cap it was meant to enforce is never consulted. 140MB leaves
+ * room for the tree's JSON scaffolding.
+ *
+ * Only the deploy routes use it: everywhere else a smaller limit applies,
+ * because a body is buffered before authentication and nothing else needs the
+ * headroom.
+ */
+export const DEPLOY_PAYLOAD_BYTES = 140 * 1024 * 1024;
+/**
+ * The body a deploy answers success with.
+ *
+ * The wording is the published contract - a client may key on the message - so
+ * it is one constant here rather than a string in each host. It names
+ * `@sasjs/server` because that is the document's example, which predates this
+ * package; changing it is a document change, not a host's choice.
+ */
+export const DEPLOY_SUCCESS = {
+    status: 'success',
+    message: 'Files deployed successfully to @sasjs/server.'
+};
+/**
+ * How deep a tree may nest.
+ *
+ * A deployment is an app: `services/`, `web/`, a folder per service. A few dozen
+ * levels is generous, and the number matters because the walk recurses once per
+ * level - without a ceiling, a tree nested deeply enough exhausts the stack and
+ * throws a `RangeError`, which is neither the `400` nor the `413` this route
+ * documents, on input the cap exists to bound.
+ */
+export const MAX_DEPTH = 32;
+const BASE64_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+/** A base64 body without its padding, which is what the arithmetic needs. */
+const base64Body = (value) => value.replace(/[^A-Za-z0-9+/]/g, '');
+/** The bytes a base64 body decodes to, without decoding it. */
+const base64Length = (value) => Math.floor((base64Body(value).length * 3) / 4);
+/** The bytes a base64 body decodes to, for a store that writes bytes. */
+export const decodeBase64 = (value) => {
+    const body = base64Body(value);
+    const bytes = new Uint8Array(Math.floor((body.length * 3) / 4));
+    let buffer = 0;
+    let bits = 0;
+    let at = 0;
+    for (const char of body) {
+        buffer = (buffer << 6) | BASE64_ALPHABET.indexOf(char);
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            bytes[at++] = (buffer >> bits) & 0xff;
+        }
+    }
+    return bytes.subarray(0, at);
+};
+/** The bytes a string occupies as UTF-8, without an encoding API. */
+const utf8Length = (value) => {
+    let bytes = 0;
+    for (let at = 0; at < value.length; at++) {
+        const code = value.charCodeAt(at);
+        if (code < 0x80)
+            bytes += 1;
+        else if (code < 0x800)
+            bytes += 2;
+        else if (code >= 0xd800 && code <= 0xdbff && at + 1 < value.length) {
+            // a surrogate pair is one code point of four bytes
+            bytes += 4;
+            at++;
+        }
+        else
+            bytes += 3;
+    }
+    return bytes;
+};
+/** The name a member is written under - a service gains the extension. */
+const memberName = (member) => member.type === 'service' ? `${member.name}.sas` : member.name;
+/** The bytes a member writes. */
+const memberBytes = (member) => member.type === 'file' ? base64Length(member.code) : utf8Length(member.code);
+const MEGABYTE = 1024 * 1024;
+/**
+ * A MEASURED size, rounded UP to one decimal in binary megabytes.
+ *
+ * Up, not to nearest: a tree one byte over a 100 MB cap must not read as "100 MB
+ * (maximum 100 MB)", which is a refusal that states no overage at all. Rounding
+ * up is the direction that never understates what is being refused.
+ *
+ * Bytes below a megabyte are printed as bytes, because a limit small enough to
+ * be measured in bytes should not read as "0 MB" - which is what a host passing
+ * a tighter set would otherwise report.
+ */
+const describeSize = (bytes) => bytes < MEGABYTE
+    ? `${bytes} bytes`
+    : `${Math.ceil((bytes / MEGABYTE) * 10) / 10} MB`;
+/**
+ * A LIMIT, printed as it is stated: `DEPLOY_LIMITS` holds exact megabytes, so
+ * rounding cannot make it disagree with itself.
+ */
+const describeLimit = (bytes) => bytes < MEGABYTE
+    ? `${bytes} bytes`
+    : `${Math.round((bytes / MEGABYTE) * 10) / 10} MB`;
+/** A walk's starting point. */
+const emptyWalk = () => ({
+    entries: 0,
+    totalBytes: 0,
+    largest: { path: '', bytes: 0 }
+});
+/**
+ * Every member name becomes a path SEGMENT under the deployment root, so a name
+ * carrying '/', '\' or '..' is a traversal attempt rather than a name.
+ */
+const isSafeSegment = (name) => name !== '' &&
+    name !== '.' &&
+    name !== '..' &&
+    !/[/\\]/.test(name) &&
+    // a Windows drive or a NUL byte is never a segment either
+    !/[\0]/.test(name);
+/**
+ * Walks a tree, counting it and noting the first unsafe name.
+ *
+ * A name problem is RECORDED rather than returned, so the walk always finishes:
+ * a caller that only wants the numbers gets the size of the whole tree, and the
+ * validator decides whether the name matters. Returning early would report a
+ * truncated tree as if it were the real one.
+ *
+ * The one thing that stops the walk is depth: past `MAX_DEPTH` it does not
+ * descend, because descending is the work that would exhaust the stack. The
+ * level it reached is recorded so the refusal can state it.
+ */
+const walk = (members, parentPath, acc, depth = 1) => {
+    for (const member of members) {
+        const name = memberName(member);
+        const memberPath = parentPath ? `${parentPath}/${name}` : name;
+        if (!isSafeSegment(name) && !acc.nameRefusal)
+            acc.nameRefusal = {
+                code: 400,
+                status: 'failure',
+                message: `Invalid member name: '${name}'. Member names must be single path segments (no '/', '\\', '..').`
+            };
+        acc.entries++;
+        if (member.type === 'folder') {
+            if (depth + 1 > MAX_DEPTH) {
+                if (!acc.tooDeep)
+                    acc.tooDeep = depth + 1;
+                continue;
+            }
+            walk(member.members, memberPath, acc, depth + 1);
+            continue;
+        }
+        const bytes = memberBytes(member);
+        acc.totalBytes += bytes;
+        if (bytes > acc.largest.bytes)
+            acc.largest = { path: memberPath, bytes };
+    }
+};
+/**
+ * Measures a tree without touching a drive.
+ *
+ * Every member is counted, whatever its name: this answers "how big is this
+ * tree", and a caller that also needs the names checked is `checkDeployTree`.
+ */
+export const measureDeployTree = (members) => {
+    const acc = emptyWalk();
+    walk(members, '', acc);
+    return {
+        entries: acc.entries,
+        totalBytes: acc.totalBytes,
+        largest: acc.largest
+    };
+};
+/**
+ * The refusal a file tree earns, or `null` when it can be written.
+ *
+ * Names are checked first, then the dimensions in a fixed order - entries,
+ * total, single file - so a tree breaching two of them is refused for the same
+ * one every time, which is what lets a caller key on the message and a test pin
+ * it.
+ *
+ * `limits` defaults to `DEPLOY_LIMITS`; a host may pass its own, stricter set.
+ */
+export const checkDeployTree = (members, limits = DEPLOY_LIMITS) => {
+    const measured = emptyWalk();
+    walk(members, '', measured);
+    if (measured.nameRefusal)
+        return measured.nameRefusal;
+    if (measured.tooDeep)
+        return {
+            code: 413,
+            status: 'failure',
+            message: `The file tree is nested too deeply: ${measured.tooDeep} levels (maximum ${MAX_DEPTH}).`
+        };
+    if (measured.entries > limits.entries)
+        return {
+            code: 413,
+            status: 'failure',
+            message: `The file tree exceeds the deploy limit: ${measured.entries} entries (maximum ${limits.entries}).`
+        };
+    if (measured.totalBytes > limits.totalBytes)
+        return {
+            code: 413,
+            status: 'failure',
+            message: `The file tree exceeds the deploy limit: ${describeSize(measured.totalBytes)} (maximum ${describeLimit(limits.totalBytes)}).`
+        };
+    if (measured.largest.bytes > limits.fileBytes)
+        return {
+            code: 413,
+            status: 'failure',
+            message: `A file in the tree exceeds the deploy limit: ${measured.largest.path} is ${describeSize(measured.largest.bytes)} (maximum ${describeLimit(limits.fileBytes)} per file).`
+        };
+    return null;
+};
+/**
+ * The tree's shape, as the wire format states it.
+ *
+ * A port of `isFileTree` from `@sasjs/utils`, which is what sasjs/server
+ * validates with: a tree is an object with a `members` array, and every member
+ * is a folder with its own members, or a service/file with a string `code` and
+ * a string `name`. Anything else is the `400` the routes already answer.
+ */
+export const isDeployTree = (value) => {
+    if (!value || typeof value !== 'object')
+        return false;
+    const members = value.members;
+    return Array.isArray(members) && members.every(isDeployMember);
+};
+const isDeployMember = (value) => {
+    if (!value || typeof value !== 'object')
+        return false;
+    const member = value;
+    if (typeof member.name !== 'string')
+        return false;
+    if (member.type === 'folder')
+        return Array.isArray(member.members) && member.members.every(isDeployMember);
+    if (member.type === 'service' || member.type === 'file')
+        return typeof member.code === 'string';
+    return false;
+};
+/**
+ * Deploys a tree into `appLoc`, or refuses without writing.
+ *
+ * The order is the promise: shape, then containment, then the cap and the names,
+ * and only then the first write. `appLoc` is caller-supplied and every segment
+ * must stay a segment, so it is resolved against the drive root and refused when
+ * it leaves it - joined naively, a `..` would write outside the drive.
+ *
+ * A write that fails part-way answers the deploy routes' `500`; the tree before
+ * the failure is already on the drive, which the message does not hide.
+ */
+export const deployTree = async (store, appLoc, tree, limits = DEPLOY_LIMITS) => {
+    if (!isDeployTree(tree))
+        throw new ApiError(400, 'Provided not supported data format.', {
+            status: 'failure',
+            message: 'Provided not supported data format.'
+        });
+    const root = normaliseDrivePath(appLoc);
+    if (root === null)
+        throw new ApiError(400, 'appLoc cannot be outside drive.', {
+            status: 'failure',
+            message: 'appLoc cannot be outside drive.'
+        });
+    const refusal = checkDeployTree(tree.members, limits);
+    // the body is the envelope WITHOUT the refusal's own `code`: that field is
+    // how a host turns the refusal into a status, and it is not sent
+    if (refusal)
+        throw new ApiError(refusal.code, refusal.message, {
+            status: refusal.status,
+            message: refusal.message
+        });
+    try {
+        await writeMembers(store, tree.members, root);
+    }
+    catch {
+        throw new ApiError(500, 'Deployment failed!', {
+            status: 'failure',
+            message: 'Deployment failed!'
+        });
+    }
+};
+/** Writes every member under `parentPath`, depth first. */
+const writeMembers = async (store, members, parentPath) => {
+    for (const member of members) {
+        const path = `${parentPath}/${memberName(member)}`;
+        if (member.type === 'folder') {
+            await store.mkdirp(path);
+            await writeMembers(store, member.members, path);
+            continue;
+        }
+        await store.write(path, member.type === 'file' ? decodeBase64(member.code) : member.code);
+    }
+};

package/build/esm/drive/service.d.ts

@@ -37,6 +37,14 @@ export interface DriveService {
     rmdir(folderPath: string): Promise<DriveResult>;
     rename(oldPath: string, newPath: string): Promise<DriveResult>;
     tree(folderPath?: string): Promise<DriveTree>;
+    /**
+     * Writes a whole tree under `appLoc`, or refuses without writing.
+     *
+     * `tree` is `unknown` on purpose: the wire payload is the caller's JSON, and
+     * the shape is one of the things this decides - a mistyped tree earns the
+     * routes' `400` rather than a crash in a host that trusted it.
+     */
+    deploy(appLoc: string, tree: unknown): Promise<DriveResult>;
 }
 export declare const createDriveService: (store: DriveStore) => DriveService;
 //# sourceMappingURL=service.d.ts.map

package/build/esm/drive/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/drive/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAWvD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;IAC7B,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,SAAS,CAAA;IACjB,IAAI,EAAE,QAAQ,CAAA;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAChD,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC3E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC7E,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC9C,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC/C,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC/C,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC9D,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;CAC9C;AAqBD,eAAO,MAAM,kBAAkB,GAAI,OAAO,UAAU,KAAG,YAoJtD,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/drive/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAYvD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;IAC7B,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,SAAS,CAAA;IACjB,IAAI,EAAE,QAAQ,CAAA;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAChD,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC3E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC7E,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC9C,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC/C,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC/C,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC9D,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAC7C;;;;;;OAMG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;CAC5D;AAqBD,eAAO,MAAM,kBAAkB,GAAI,OAAO,UAAU,KAAG,YA0JtD,CAAA"}

package/build/esm/drive/service.js

@@ -1,4 +1,5 @@
 import { ApiError } from '../types.js';
+import { deployTree } from './deploy.js';
 import { basename, checkFilePath, dirname, hasBlockedExtension, isRoot, normaliseDrivePath } from './paths.js';
 /** A path a file operation may act on, or the refusal the operation answers. */
 const filePath = (input, outside) => {
@@ -142,6 +143,10 @@ export const createDriveService = (store) => {
             if (!stat.directory)
                 throw new ApiError(400, 'Not a Folder.');
             return { status: 'success', tree: await treeOf(path) };
+        },
+        async deploy(appLoc, tree) {
+            await deployTree(store, appLoc, tree);
+            return { status: 'success' };
         }
     };
 };

package/build/esm/host/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/host/dispatch.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAGnD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,oFAAoF;IACpF,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;KAAE,CAAA;IACtD;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;CAC3B;AAsCD,eAAO,MAAM,QAAQ,GACnB,UAAU,QAAQ,EAClB,SAAS,MAAM,EACf,UAAS,UAAe,KACvB,OAAO,CAAC,WAAW,CA8HrB,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,cAAc,EAAE,MAAM,EAiBlC,CAAA"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/host/dispatch.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAInD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,oFAAoF;IACpF,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;KAAE,CAAA;IACtD;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;CAC3B;AAsCD,eAAO,MAAM,QAAQ,GACnB,UAAU,QAAQ,EAClB,SAAS,MAAM,EACf,UAAS,UAAe,KACvB,OAAO,CAAC,WAAW,CAsIrB,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,cAAc,EAAE,MAAM,EAkBlC,CAAA"}

package/build/esm/host/dispatch.js

@@ -1,5 +1,6 @@
 import { routeById } from '../routes/index.js';
 import { ApiError } from '../types.js';
+import { DEPLOY_SUCCESS } from '../drive/deploy.js';
 /**
  * The parameters the table marks required, checked before the handler runs.
  *
@@ -126,6 +127,12 @@ export const dispatch = async (services, routeId, request = {}) => {
                 status: 200,
                 body: await drive.rename(String(request.body?.oldPath || ''), String(request.body?.newPath || ''))
             };
+        case 'POST /SASjsApi/drive/deploy': {
+            // `streamWebFolder` is the host's: publishing an app stream is not a drive
+            // operation, and a host that has no app stream ignores it.
+            await drive.deploy(String(body.appLoc ?? ''), body.fileTree);
+            return { status: 200, body: DEPLOY_SUCCESS };
+        }
         case 'GET /SASjsApi/drive/filetree':
             return { status: 200, body: await drive.tree(query._folderPath) };
         default: {
@@ -148,6 +155,7 @@ export const HANDLED_ROUTES = [
     'DELETE /SASjsApi/drive/folder',
     'POST /SASjsApi/drive/rename',
     'GET /SASjsApi/drive/filetree',
+    'POST /SASjsApi/drive/deploy',
     'POST /SASjsApi/auth/token',
     'POST /SASjsApi/auth/refresh',
     'POST /SASjsApi/auth/logout',

package/build/esm/index.d.ts

@@ -16,6 +16,8 @@
 export * from './types.js';
 export { normaliseDrivePath, hasBlockedExtension, dirname, basename, isRoot } from './drive/paths.js';
 export { createDriveService } from './drive/service.js';
+export { DEPLOY_LIMITS, DEPLOY_PAYLOAD_BYTES, DEPLOY_SUCCESS, checkDeployTree, decodeBase64, deployTree, isDeployTree, measureDeployTree } from './drive/deploy.js';
+export type { DeployLimits, DeployMeasurements, DeployMember, DeployRefusal, DeployTree } from './drive/deploy.js';
 export type { DriveService, DriveResult, DriveListing, DriveFile, DriveTree } from './drive/service.js';
 export { MemoryDriveStore } from './drive/memory-store.js';
 export { ROUTES, routeById, findRoute } from './routes/index.js';

package/build/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,cAAc,YAAY,CAAA;AAC1B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,MAAM,EACP,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,YAAY,EACV,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,SAAS,EACT,SAAS,EACV,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAChE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAC7D,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,YAAY,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,cAAc,EACd,aAAa,EACb,YAAY,EACZ,OAAO,EACP,SAAS,EACV,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACzD,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,cAAc,YAAY,CAAA;AAC1B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,MAAM,EACP,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,iBAAiB,EAClB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,UAAU,EACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,SAAS,EACT,SAAS,EACV,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAChE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAC7D,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,YAAY,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,cAAc,EACd,aAAa,EACb,YAAY,EACZ,OAAO,EACP,SAAS,EACV,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACzD,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA"}

package/build/esm/index.js

@@ -16,6 +16,7 @@
 export * from './types.js';
 export { normaliseDrivePath, hasBlockedExtension, dirname, basename, isRoot } from './drive/paths.js';
 export { createDriveService } from './drive/service.js';
+export { DEPLOY_LIMITS, DEPLOY_PAYLOAD_BYTES, DEPLOY_SUCCESS, checkDeployTree, decodeBase64, deployTree, isDeployTree, measureDeployTree } from './drive/deploy.js';
 export { MemoryDriveStore } from './drive/memory-store.js';
 export { ROUTES, routeById, findRoute } from './routes/index.js';
 export { OVERLAY, TAG_CAPABILITIES } from './routes/overlay.js';

package/build/esm/routes/generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generated.d.ts","sourceRoot":"","sources":["../../../src/routes/generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,eAAO,MAAM,gBAAgB,EAAE,cAAc,EAirD5C,CAAA"}
+{"version":3,"file":"generated.d.ts","sourceRoot":"","sources":["../../../src/routes/generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,eAAO,MAAM,gBAAgB,EAAE,cAAc,EAyrD5C,CAAA"}

package/build/esm/routes/generated.js

@@ -469,6 +469,10 @@ export const GENERATED_ROUTES = [
                 status: 400,
                 description: 'Invalid Format'
             },
+            {
+                status: 413,
+                description: 'File tree exceeds the deploy limit'
+            },
             {
                 status: 500,
                 description: 'Execution Error'
@@ -499,6 +503,10 @@ export const GENERATED_ROUTES = [
                 status: 400,
                 description: 'Invalid Format'
             },
+            {
+                status: 413,
+                description: 'File tree exceeds the deploy limit'
+            },
             {
                 status: 500,
                 description: 'Execution Error'

package/build/esm/routes/overlay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"overlay.d.ts","sourceRoot":"","sources":["../../../src/routes/overlay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAEzD,yDAAyD;AACzD,UAAU,aAAa;IACrB,YAAY,CAAC,EAAE,UAAU,EAAE,CAAA;IAC3B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,aAAa,GACtC,CAAC;IAAE,WAAW,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,WAAW,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAElE,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAczD,CAAA;AAiDD,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAkNhD,CAAA;AAED,wEAAwE;AACxE,eAAO,MAAM,OAAO,EAAE,UAAU,EAA8C,CAAA"}
+{"version":3,"file":"overlay.d.ts","sourceRoot":"","sources":["../../../src/routes/overlay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGzD,yDAAyD;AACzD,UAAU,aAAa;IACrB,YAAY,CAAC,EAAE,UAAU,EAAE,CAAA;IAC3B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,aAAa,GACtC,CAAC;IAAE,WAAW,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,WAAW,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAElE,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAczD,CAAA;AAiDD,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAmOhD,CAAA;AAED,wEAAwE;AACxE,eAAO,MAAM,OAAO,EAAE,UAAU,EAA8C,CAAA"}

package/build/esm/routes/overlay.js

@@ -1,3 +1,4 @@
+import { DEPLOY_SUCCESS } from '../drive/deploy.js';
 /** The default capability for each tag, overridden per route where it differs. */
 export const TAG_CAPABILITIES = {
     Drive: ['storage'],
@@ -29,7 +30,7 @@ const HOST_CONFIG = "The body is the host's own configuration - ports, run times
 const PERMISSIONS = "The route inventory is the host's permission model, which this package does not hold.";
 const HOST_OWNED = "The host owns this report: it describes the host's own process and files, which a browser build has no equivalent of.";
 const WEB_BUNDLE = 'The host serves its own web bundle; there is no API decision here for this package to answer.';
-const DEPLOY_CAP = "Writing a whole tree in one request can exhaust the host's storage, so the deploy routes land with the size cap that bounds it.";
+const ARCHIVE = "Expanding the uploaded archive is the host's transport work - multer and a zip library on the server, `DecompressionStream` in a worker - and the host hands this package the tree it produces, which is the same tree `POST /SASjsApi/drive/deploy` takes.";
 const UNPUBLISH = 'Unpublishing inverts the deploy route, so the two land together.';
 const success = { status: 'success' };
 const user = {
@@ -132,10 +133,27 @@ export const OVERLAY = {
         implemented: true,
         responses: { 200: { status: 'success', tree: {} } }
     },
-    'POST /SASjsApi/drive/deploy': { implemented: false, reason: DEPLOY_CAP },
+    // The deploy routes answer an ENVELOPE, unlike the file routes above: their
+    // `400` is `{status:'failure', message}` rather than the message as text, and
+    // `413` is the cap refusing the tree before anything is written.
+    // `"appLoc" is required` and `"fileTree" is required` are the other `400` this
+    // route sends - a missing body property, worded by the table's own
+    // validation - so the body annotated here is the substantial one.
+    'POST /SASjsApi/drive/deploy': {
+        implemented: true,
+        responses: {
+            200: DEPLOY_SUCCESS,
+            400: {
+                status: 'failure',
+                message: 'Provided not supported data format.'
+            },
+            413: 'The file tree exceeds the deploy limit.',
+            500: { status: 'failure', message: 'Deployment failed!' }
+        }
+    },
     'POST /SASjsApi/drive/deploy/upload': {
         implemented: false,
-        reason: DEPLOY_CAP
+        reason: ARCHIVE
     },
     // `404` is a pair - the registry name and the appLoc it was published from -
     // that matches no entry, and the drive's content is deliberately left alone.