@sasjs/cli 6.14.0 → 6.15.0

package/build/commands/build/internal/mockSite/spec/sw.spec.js

@@ -35,6 +35,17 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
         if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
     }
 };
+var __values = (this && this.__values) || function(o) {
+    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
+    if (m) return m.call(o);
+    if (o && typeof o.length === "number") return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
+};
 var __read = (this && this.__read) || function (o, n) {
     var m = typeof Symbol === "function" && o[Symbol.iterator];
     if (!m) return o;
@@ -51,23 +62,13 @@ var __read = (this && this.__read) || function (o, n) {
     }
     return ar;
 };
-var __values = (this && this.__values) || function(o) {
-    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
-    if (m) return m.call(o);
-    if (o && typeof o.length === "number") return {
-        next: function () {
-            if (o && i >= o.length) o = void 0;
-            return { value: o && o[i++], done: !o };
-        }
-    };
-    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
-};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 var path_1 = __importDefault(require("path"));
 var api_1 = require("@sasjs/api");
+var yazl_1 = __importDefault(require("yazl"));
 /**
  * The other half of the parity claim: the service worker is what turns an
  * /SASjsApi/ request into a response, so its framing (webout body, the _debug
@@ -190,6 +191,24 @@ var jsonResponse = function (body) { return ({
         return [2 /*return*/, body];
     }); }); }
 }); };
+/** A zip archive of text members, written the way a deploy upload ships one.
+ * The first member is stored rather than deflated, so both methods the reader
+ * accepts are exercised by the one case. */
+var zipOf = function (files) {
+    return new Promise(function (resolve, reject) {
+        var zip = new yazl_1.default.ZipFile();
+        Object.keys(files).forEach(function (name, index) {
+            return zip.addBuffer(Buffer.from(files[name]), name, {
+                compress: index !== 0
+            });
+        });
+        zip.end();
+        var chunks = [];
+        zip.outputStream.on('data', function (chunk) { return chunks.push(chunk); });
+        zip.outputStream.on('end', function () { return resolve(Buffer.concat(chunks)); });
+        zip.outputStream.on('error', reject);
+    });
+};
 var runRequest = function (body) { return ({
     method: 'POST',
     headers: { 'content-type': 'application/json' },
@@ -551,31 +570,424 @@ describe('service worker host', function () {
             }
         });
     }); });
-    it('answers the session state, and names a route it does not implement', function () { return __awaiter(void 0, void 0, void 0, function () {
-        var dispatch, session, _a, unknown, _b;
-        return __generator(this, function (_c) {
-            switch (_c.label) {
+    it('answers the session route with the caller, and names a route it does not have', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var dispatch, session, _a, refused, _b, unknown, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
                 case 0:
                     dispatch = seeded().dispatch;
                     return [4 /*yield*/, dispatch('/SASjsApi/session')];
                 case 1:
-                    session = _c.sent();
+                    session = _d.sent();
                     _a = expect;
                     return [4 /*yield*/, session.json()];
                 case 2:
-                    _a.apply(void 0, [_c.sent()]).toEqual({ state: 'completed' });
-                    return [4 /*yield*/, dispatch('/SASjsApi/unknown/route')];
+                    _a.apply(void 0, [_d.sent()]).toEqual({
+                        uid: 'user-admin',
+                        username: 'sasjsadmin',
+                        displayName: 'Demo Admin',
+                        isAdmin: true,
+                        needsToUpdatePassword: false
+                    });
+                    return [4 /*yield*/, dispatch('/SASjsApi/session', {
+                            headers: { authorization: 'Bearer not-a-token' }
+                        })];
                 case 3:
-                    unknown = _c.sent();
-                    expect(unknown.status).toBe(404);
+                    refused = _d.sent();
+                    expect(refused.status).toBe(401);
                     _b = expect;
-                    return [4 /*yield*/, unknown.json()];
+                    return [4 /*yield*/, refused.json()];
                 case 4:
-                    _b.apply(void 0, [(_c.sent()).message]).toContain('Not implemented');
+                    _b.apply(void 0, [(_d.sent()).message]).toBe('Unauthorized');
+                    return [4 /*yield*/, dispatch('/SASjsApi/unknown/route')];
+                case 5:
+                    unknown = _d.sent();
+                    expect(unknown.status).toBe(404);
+                    _c = expect;
+                    return [4 /*yield*/, unknown.json()];
+                case 6:
+                    _c.apply(void 0, [(_d.sent()).message]).toContain('Not part of the API');
                     return [2 /*return*/];
             }
         });
     }); });
+    describe('the API surface the package carries', function () {
+        it('answers the sign-in flow, and the record routes as that caller', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var worker, signedIn, _a, refused, _b, authorized, code, exchanged, pair, users, _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        worker = seeded();
+                        return [4 /*yield*/, worker.dispatch('/SASLogon/login', runRequest({ username: 'sasjsadmin', password: 'Orion123' }))];
+                    case 1:
+                        signedIn = _d.sent();
+                        expect(signedIn.status).toBe(200);
+                        _a = expect;
+                        return [4 /*yield*/, signedIn.json()];
+                    case 2:
+                        _a.apply(void 0, [(_d.sent()).user.username]).toBe('sasjsadmin');
+                        return [4 /*yield*/, worker.dispatch('/SASLogon/login', runRequest({ username: 'sasjsadmin', password: 'nope' }))];
+                    case 3:
+                        refused = _d.sent();
+                        expect(refused.status).toBe(401);
+                        _b = expect;
+                        return [4 /*yield*/, refused.json()];
+                    case 4:
+                        _b.apply(void 0, [(_d.sent()).message]).toBe('Invalid Password.');
+                        return [4 /*yield*/, worker.dispatch('/SASLogon/authorize', runRequest({ clientId: 'web_app' }))];
+                    case 5:
+                        authorized = _d.sent();
+                        return [4 /*yield*/, authorized.json()];
+                    case 6:
+                        code = (_d.sent()).code;
+                        return [4 /*yield*/, worker.dispatch('/SASjsApi/auth/token', runRequest({ clientId: 'web_app', code: code }))];
+                    case 7:
+                        exchanged = _d.sent();
+                        return [4 /*yield*/, exchanged.json()];
+                    case 8:
+                        pair = _d.sent();
+                        expect(pair.accessToken).toBeTruthy();
+                        return [4 /*yield*/, worker.dispatch('/SASjsApi/user', {
+                                headers: { authorization: "Bearer ".concat(pair.accessToken) }
+                            })];
+                    case 9:
+                        users = _d.sent();
+                        _c = expect;
+                        return [4 /*yield*/, users.json()];
+                    case 10:
+                        _c.apply(void 0, [(_d.sent()).map(function (user) { return user.username; }).sort()]).toEqual(['sasjsadmin', 'sasjsuser']);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('answers the administration records the fixture seeds', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, groups, _a, permissions, _b, clients, _c, mine, _d, _e, _f;
+            return __generator(this, function (_g) {
+                switch (_g.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        return [4 /*yield*/, dispatch('/SASjsApi/group')];
+                    case 1:
+                        groups = _g.sent();
+                        _a = expect;
+                        return [4 /*yield*/, groups.json()];
+                    case 2:
+                        _a.apply(void 0, [(_g.sent()).map(function (group) { return group.name; }).sort()]).toEqual(['Admins', 'DCGroup']);
+                        return [4 /*yield*/, dispatch('/SASjsApi/permission')];
+                    case 3:
+                        permissions = _g.sent();
+                        _b = expect;
+                        return [4 /*yield*/, permissions.json()];
+                    case 4:
+                        _b.apply(void 0, [(_g.sent()).length]).toBe(3);
+                        return [4 /*yield*/, dispatch('/SASjsApi/client')];
+                    case 5:
+                        clients = _g.sent();
+                        _c = expect;
+                        return [4 /*yield*/, clients.json()];
+                    case 6:
+                        _c.apply(void 0, [(_g.sent()).map(function (client) { return client.clientId; }).sort()]).toEqual(['sasjs', 'web_app']);
+                        return [4 /*yield*/, dispatch('/SASjsApi/info/myAuthorizedRoutes')];
+                    case 7:
+                        mine = _g.sent();
+                        _d = expect;
+                        _f = (_e = Object).keys;
+                        return [4 /*yield*/, mine.json()];
+                    case 8:
+                        _d.apply(void 0, [_f.apply(_e, [_g.sent()]).length]).toBeGreaterThan(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('answers the documented 501 for the capabilities a static origin lacks', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, cases, cases_1, cases_1_1, _a, method, url, capability, response, _b, e_1_1, _c, _d, url, response, _e, e_2_1;
+            var e_1, _f, e_2, _g;
+            return __generator(this, function (_h) {
+                switch (_h.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        cases = [
+                            ['GET', '/SASjsApi/admin/diagnostics', 'admin service'],
+                            ['GET', '/SASjsApi/admin/logs', 'admin service'],
+                            ['GET', '/SASjsApi/admin/logs/app.log', 'admin service'],
+                            [
+                                'POST',
+                                '/SASjsApi/authConfig/synchroniseWithLDAP',
+                                'directory service'
+                            ]
+                        ];
+                        _h.label = 1;
+                    case 1:
+                        _h.trys.push([1, 7, 8, 9]);
+                        cases_1 = __values(cases), cases_1_1 = cases_1.next();
+                        _h.label = 2;
+                    case 2:
+                        if (!!cases_1_1.done) return [3 /*break*/, 6];
+                        _a = __read(cases_1_1.value, 3), method = _a[0], url = _a[1], capability = _a[2];
+                        return [4 /*yield*/, dispatch(url, { method: method })];
+                    case 3:
+                        response = _h.sent();
+                        expect(response.status).toBe(501);
+                        _b = expect;
+                        return [4 /*yield*/, response.json()];
+                    case 4:
+                        _b.apply(void 0, [(_h.sent()).message]).toContain(capability);
+                        _h.label = 5;
+                    case 5:
+                        cases_1_1 = cases_1.next();
+                        return [3 /*break*/, 2];
+                    case 6: return [3 /*break*/, 9];
+                    case 7:
+                        e_1_1 = _h.sent();
+                        e_1 = { error: e_1_1 };
+                        return [3 /*break*/, 9];
+                    case 8:
+                        try {
+                            if (cases_1_1 && !cases_1_1.done && (_f = cases_1.return)) _f.call(cases_1);
+                        }
+                        finally { if (e_1) throw e_1.error; }
+                        return [7 /*endfinally*/];
+                    case 9:
+                        _h.trys.push([9, 15, 16, 17]);
+                        _c = __values(['/SASjsApi/code/lint', '/SASjsApi/code/format']), _d = _c.next();
+                        _h.label = 10;
+                    case 10:
+                        if (!!_d.done) return [3 /*break*/, 14];
+                        url = _d.value;
+                        return [4 /*yield*/, dispatch(url, runRequest({ code: 'data a;' }))];
+                    case 11:
+                        response = _h.sent();
+                        expect(response.status).toBe(501);
+                        _e = expect;
+                        return [4 /*yield*/, response.json()];
+                    case 12:
+                        _e.apply(void 0, [(_h.sent()).message]).toContain('code service');
+                        _h.label = 13;
+                    case 13:
+                        _d = _c.next();
+                        return [3 /*break*/, 10];
+                    case 14: return [3 /*break*/, 17];
+                    case 15:
+                        e_2_1 = _h.sent();
+                        e_2 = { error: e_2_1 };
+                        return [3 /*break*/, 17];
+                    case 16:
+                        try {
+                            if (_d && !_d.done && (_g = _c.return)) _g.call(_c);
+                        }
+                        finally { if (e_2) throw e_2.error; }
+                        return [7 /*endfinally*/];
+                    case 17: return [2 /*return*/];
+                }
+            });
+        }); });
+        it('matches a path whatever its casing, as the API does', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, response, _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        return [4 /*yield*/, dispatch('/sasjsapi/INFO')];
+                    case 1:
+                        response = _b.sent();
+                        expect(response.status).toBe(200);
+                        _a = expect;
+                        return [4 /*yield*/, response.json()];
+                    case 2:
+                        _a.apply(void 0, [(_b.sent()).mode]).toBe('desktop');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('starts a session, then reads its state, log and output', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, program, triggered, sessionId, state, _a, output, _b, log, missing;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        program = encodeURIComponent("".concat(appLoc, "/services/public/getdata"));
+                        return [4 /*yield*/, dispatch('/SASjsApi/stp/trigger?_program=' + program, runRequest({ params: {} }))];
+                    case 1:
+                        triggered = _c.sent();
+                        expect(triggered.status).toBe(200);
+                        return [4 /*yield*/, triggered.json()];
+                    case 2:
+                        sessionId = (_c.sent()).sessionId;
+                        expect(sessionId).toBeTruthy();
+                        return [4 /*yield*/, dispatch("/SASjsApi/session/".concat(sessionId, "/state"))];
+                    case 3:
+                        state = _c.sent();
+                        _a = expect;
+                        return [4 /*yield*/, state.json()];
+                    case 4:
+                        _a.apply(void 0, [_c.sent()]).toEqual({ state: 'completed' });
+                        return [4 /*yield*/, dispatch("/SASjsApi/session/".concat(sessionId, "/output"))];
+                    case 5:
+                        output = _c.sent();
+                        expect(output.status).toBe(200);
+                        _b = expect;
+                        return [4 /*yield*/, output.text()];
+                    case 6:
+                        _b.apply(void 0, [_c.sent()]).toBe('seeded');
+                        return [4 /*yield*/, dispatch("/SASjsApi/session/".concat(sessionId, "/log"))];
+                    case 7:
+                        log = _c.sent();
+                        expect(log.status).toBe(200);
+                        return [4 /*yield*/, dispatch('/SASjsApi/session/not-a-session/state')];
+                    case 8:
+                        missing = _c.sent();
+                        expect(missing.status).toBe(404);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('refuses a deploy upload with no archive, and one that is not a zip', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, empty, _a, form, notZip, _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/deploy/upload', {
+                                method: 'POST',
+                                body: new FormData()
+                            })];
+                    case 1:
+                        empty = _c.sent();
+                        expect(empty.status).toBe(400);
+                        _a = expect;
+                        return [4 /*yield*/, empty.text()];
+                    case 2:
+                        _a.apply(void 0, [_c.sent()]).toBe('"file" is not present.');
+                        form = new FormData();
+                        form.set('file', new Blob([new Uint8Array([1, 2, 3])]), 'not-a-zip.zip');
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/deploy/upload', {
+                                method: 'POST',
+                                body: form
+                            })];
+                    case 3:
+                        notZip = _c.sent();
+                        expect(notZip.status).toBe(400);
+                        _b = expect;
+                        return [4 /*yield*/, notZip.text()];
+                    case 4:
+                        _b.apply(void 0, [_c.sent()]).toBe('The archive is not a zip file.');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('takes a token from the query when a link cannot carry a header', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var worker, authorized, code, exchanged, pair, users, _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        worker = seeded();
+                        return [4 /*yield*/, worker.dispatch('/SASLogon/authorize', runRequest({ clientId: 'web_app' }))];
+                    case 1:
+                        authorized = _b.sent();
+                        return [4 /*yield*/, authorized.json()];
+                    case 2:
+                        code = (_b.sent()).code;
+                        return [4 /*yield*/, worker.dispatch('/SASjsApi/auth/token', runRequest({ clientId: 'web_app', code: code }))];
+                    case 3:
+                        exchanged = _b.sent();
+                        return [4 /*yield*/, exchanged.json()];
+                    case 4:
+                        pair = _b.sent();
+                        return [4 /*yield*/, worker.dispatch("/SASjsApi/user?access_token=".concat(encodeURIComponent(pair.accessToken)))];
+                    case 5:
+                        users = _b.sent();
+                        expect(users.status).toBe(200);
+                        _a = expect;
+                        return [4 /*yield*/, users.json()];
+                    case 6:
+                        _a.apply(void 0, [(_b.sent()).length]).toBe(2);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('names a table the page did not name, and takes an archive under any field', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var worker, unnamed, _a, form, _b, _c, _d, _e, _f, upload;
+            var _g;
+            return __generator(this, function (_h) {
+                switch (_h.label) {
+                    case 0:
+                        worker = seeded();
+                        worker.runtime.load((_g = {},
+                            _g[drivePath('services/public/echo.js')] = '_webout = _WEBIN_NAME1 + "|" + _WEBIN_FILEREF1;',
+                            _g));
+                        return [4 /*yield*/, worker.dispatch('/SASjsApi/stp/execute?_program=' +
+                                encodeURIComponent("".concat(appLoc, "/services/public/echo")), runRequest({ params: {}, tables: [{ csv: 'A,B\r\n1,2' }] }))];
+                    case 1:
+                        unnamed = _h.sent();
+                        _a = expect;
+                        return [4 /*yield*/, unnamed.text()];
+                    case 2:
+                        _a.apply(void 0, [_h.sent()]).toBe('table1|A,B\r\n1,2');
+                        form = new FormData();
+                        form.set('appLoc', appLoc);
+                        _c = (_b = form).set;
+                        _d = ['archive'];
+                        _e = Blob.bind;
+                        _f = Uint8Array.bind;
+                        return [4 /*yield*/, zipOf({ 'x.txt': 'x' })];
+                    case 3:
+                        _c.apply(_b, _d.concat([new (_e.apply(Blob, [void 0, [new (_f.apply(Uint8Array, [void 0, _h.sent()]))()]]))(),
+                            'deploy.zip']));
+                        return [4 /*yield*/, worker.dispatch('/SASjsApi/drive/deploy/upload', {
+                                method: 'POST',
+                                body: form
+                            })];
+                    case 4:
+                        upload = _h.sent();
+                        expect(upload.status).toBe(200);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('expands an uploaded archive into the drive', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, archive, form, response, tree, listing, _a, _b, file, _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        return [4 /*yield*/, zipOf({
+                                'services/public/run.js': '_webout = "deployed";',
+                                'docs/readme.txt': 'hello'
+                            })];
+                    case 1:
+                        archive = _d.sent();
+                        form = new FormData();
+                        form.set('appLoc', appLoc);
+                        form.set('file', new Blob([new Uint8Array(archive)]), 'deploy.zip');
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/deploy/upload', {
+                                method: 'POST',
+                                body: form
+                            })];
+                    case 2:
+                        response = _d.sent();
+                        expect(response.status).toBe(200);
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/filetree?_folderPath=' + encodeURIComponent(appLoc))];
+                    case 3:
+                        tree = _d.sent();
+                        _b = (_a = JSON).stringify;
+                        return [4 /*yield*/, tree.json()];
+                    case 4:
+                        listing = _b.apply(_a, [_d.sent()]);
+                        expect(listing).toContain('run.js');
+                        expect(listing).toContain('readme.txt');
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' +
+                                encodeURIComponent("".concat(appLoc, "/docs/readme.txt")))];
+                    case 5:
+                        file = _d.sent();
+                        _c = expect;
+                        return [4 /*yield*/, file.text()];
+                    case 6:
+                        _c.apply(void 0, [_d.sent()]).toBe('hello');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
     it('answers 404 for a drive file the drive does not hold', function () { return __awaiter(void 0, void 0, void 0, function () {
         var dispatch, response, _a;
         return __generator(this, function (_b) {
@@ -686,12 +1098,12 @@ describe('service worker host', function () {
                     _a = expect;
                     return [4 /*yield*/, response.json()];
                 case 2:
-                    _a.apply(void 0, [_b.sent()]).toEqual({ message: '_program is required' });
+                    _a.apply(void 0, [_b.sent()]).toEqual({ message: '"_program" is required' });
                     return [2 /*return*/];
             }
         });
     }); });
-    it('answers 500 with the failure shape when the service throws', function () { return __awaiter(void 0, void 0, void 0, function () {
+    it('answers the documented failure envelope when the service throws', function () { return __awaiter(void 0, void 0, void 0, function () {
         var _a, runtime, dispatch, response, body;
         var _b;
         return __generator(this, function (_c) {
@@ -705,11 +1117,17 @@ describe('service worker host', function () {
                             encodeURIComponent("".concat(appLoc, "/services/public/broken")))];
                 case 1:
                     response = _c.sent();
-                    return [4 /*yield*/, response.json()];
+                    return [4 /*yield*/, response.json()
+                        // the package's decision, and the server's: a run that failed is a 400
+                        // carrying the failure envelope, not a 500 that blames the transport
+                    ];
                 case 2:
                     body = _c.sent();
-                    expect(response.status).toBe(500);
+                    // the package's decision, and the server's: a run that failed is a 400
+                    // carrying the failure envelope, not a 500 that blames the transport
+                    expect(response.status).toBe(400);
                     expect(body.status).toBe('failure');
+                    expect(body.message).toBe('Job execution failed.');
                     expect(body.error).toContain('boom');
                     return [2 /*return*/];
             }
@@ -721,13 +1139,58 @@ describe('service worker host', function () {
             switch (_b.label) {
                 case 0:
                     dispatch = seeded().dispatch;
-                    return [4 /*yield*/, dispatch('/SASjsApi/code/execute', runRequest({ code: '_webout = "inline";', params: {} }))];
+                    return [4 /*yield*/, dispatch('/SASjsApi/code/execute', runRequest({ code: '_webout = "inline";', runTime: 'js', params: {} }))
+                        // a code route's documented body is the webout framed with the log, so the
+                        // run's output is the first section rather than the whole body
+                    ];
                 case 1:
                     response = _b.sent();
+                    // a code route's documented body is the webout framed with the log, so the
+                    // run's output is the first section rather than the whole body
+                    _a = expect;
+                    return [4 /*yield*/, response.text()];
+                case 2:
+                    // a code route's documented body is the webout framed with the log, so the
+                    // run's output is the first section rather than the whole body
+                    _a.apply(void 0, [(_b.sent()).split(LOGS_SEPARATOR)[0].trim()]).toBe('inline');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('reads the table envelope the page bridge posts for an XHR', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var worker, response, _a;
+        var _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    worker = seeded();
+                    worker.runtime.load((_b = {},
+                        _b[drivePath('services/public/echo.js')] = '_webout = _WEBIN_NAME1 + "|" + _WEBIN_FILEREF1;',
+                        _b));
+                    return [4 /*yield*/, worker.dispatch('/SASjsApi/stp/execute?_program=' +
+                            encodeURIComponent("".concat(appLoc, "/services/public/echo")), runRequest({
+                            params: {},
+                            tables: [
+                                {
+                                    name: 'SASControlTable',
+                                    filename: 'SASControlTable.csv',
+                                    csv: 'A,B\r\n1,2'
+                                }
+                            ]
+                        }))
+                        // the bridge hands the worker `{params, tables}`; a stored program sees the
+                        // tables as its _WEBIN variables, not as one `tables` session variable
+                    ];
+                case 1:
+                    response = _c.sent();
+                    // the bridge hands the worker `{params, tables}`; a stored program sees the
+                    // tables as its _WEBIN variables, not as one `tables` session variable
                     _a = expect;
                     return [4 /*yield*/, response.text()];
                 case 2:
-                    _a.apply(void 0, [_b.sent()]).toBe('inline');
+                    // the bridge hands the worker `{params, tables}`; a stored program sees the
+                    // tables as its _WEBIN variables, not as one `tables` session variable
+                    _a.apply(void 0, [_c.sent()]).toBe('SASControlTable|A,B\r\n1,2');
                     return [2 /*return*/];
             }
         });
@@ -1393,7 +1856,7 @@ describe('service worker host', function () {
         }); });
     });
     describe('conformance corpus', function () {
-        var e_1, _a;
+        var e_3, _a;
         /**
          * The corpus is what "the same API" means: the cases @sasjs/api runs against
          * its own services, and against a live sasjs/server, run here against this
@@ -1402,7 +1865,7 @@ describe('service worker host', function () {
          * used to have - and it is a test rather than a review.
          */
         var httpFor = function (testCase) {
-            var e_2, _a;
+            var e_4, _a;
             var _b;
             var _c = __read(testCase.route.split(' '), 2), method = _c[0], routePath = _c[1];
             var query = new URLSearchParams();
@@ -1413,12 +1876,12 @@ describe('service worker host', function () {
                         query.set(key, String(value));
                 }
             }
-            catch (e_2_1) { e_2 = { error: e_2_1 }; }
+            catch (e_4_1) { e_4 = { error: e_4_1 }; }
             finally {
                 try {
                     if (_e && !_e.done && (_a = _d.return)) _a.call(_d);
                 }
-                finally { if (e_2) throw e_2.error; }
+                finally { if (e_4) throw e_4.error; }
             }
             var suffix = query.toString() ? "?".concat(query) : '';
             var init = { method: method };
@@ -1449,8 +1912,8 @@ describe('service worker host', function () {
          * does.
          */
         var seedDrive = function (runtime, testCase) { return __awaiter(void 0, void 0, void 0, function () {
-            var text, _a, _b, _c, file, contents, _d, _e, _f, file, contents, e_3_1;
-            var e_4, _g, e_3, _h;
+            var text, _a, _b, _c, file, contents, _d, _e, _f, file, contents, e_5_1;
+            var e_6, _g, e_5, _h;
             return __generator(this, function (_j) {
                 switch (_j.label) {
                     case 0:
@@ -1462,12 +1925,12 @@ describe('service worker host', function () {
                                     text["/sasjs/drive/files".concat(file)] = contents;
                             }
                         }
-                        catch (e_4_1) { e_4 = { error: e_4_1 }; }
+                        catch (e_6_1) { e_6 = { error: e_6_1 }; }
                         finally {
                             try {
                                 if (_b && !_b.done && (_g = _a.return)) _g.call(_a);
                             }
-                            finally { if (e_4) throw e_4.error; }
+                            finally { if (e_6) throw e_6.error; }
                         }
                         return [4 /*yield*/, runtime.load(text)];
                     case 1:
@@ -1490,14 +1953,14 @@ describe('service worker host', function () {
                         return [3 /*break*/, 3];
                     case 6: return [3 /*break*/, 9];
                     case 7:
-                        e_3_1 = _j.sent();
-                        e_3 = { error: e_3_1 };
+                        e_5_1 = _j.sent();
+                        e_5 = { error: e_5_1 };
                         return [3 /*break*/, 9];
                     case 8:
                         try {
                             if (_e && !_e.done && (_h = _d.return)) _h.call(_d);
                         }
-                        finally { if (e_3) throw e_3.error; }
+                        finally { if (e_5) throw e_5.error; }
                         return [7 /*endfinally*/];
                     case 9: return [2 /*return*/];
                 }
@@ -1505,42 +1968,55 @@ describe('service worker host', function () {
         }); };
         var _loop_1 = function (testCase) {
             it(testCase.id, function () { return __awaiter(void 0, void 0, void 0, function () {
-                var worker, _a, requestPath, init, response, _b, want, _c, _d, _e;
-                return __generator(this, function (_f) {
-                    switch (_f.label) {
+                var worker, _a, requestPath, init, response, body, want, _b, _c, _d;
+                return __generator(this, function (_e) {
+                    switch (_e.label) {
                         case 0:
                             worker = loadWorker();
                             return [4 /*yield*/, seedDrive(worker.runtime, testCase)];
                         case 1:
-                            _f.sent();
+                            _e.sent();
                             worker.refuseWrites(Boolean(testCase.unwritable));
                             _a = httpFor(testCase), requestPath = _a.path, init = _a.init;
                             return [4 /*yield*/, worker.dispatch(requestPath, init)];
                         case 2:
-                            response = _f.sent();
+                            response = _e.sent();
                             expect(response.status).toBe(testCase.expect.status);
                             if (!(testCase.expect.error !== undefined)) return [3 /*break*/, 4];
-                            _b = expect;
-                            return [4 /*yield*/, response.text()];
+                            return [4 /*yield*/, response.text()
+                                // the routes that answer an envelope - the two deploy routes - send
+                                // `{status, message}`; the rest send the message itself as text, which
+                                // is what the server's `res.status(code).send(err.message)` does
+                            ];
                         case 3:
-                            _b.apply(void 0, [_f.sent()]).toBe(testCase.expect.error);
-                            _f.label = 4;
+                            body = _e.sent();
+                            // the routes that answer an envelope - the two deploy routes - send
+                            // `{status, message}`; the rest send the message itself as text, which
+                            // is what the server's `res.status(code).send(err.message)` does
+                            if ((response.headers.get('content-type') || '').includes('application/json'))
+                                expect(JSON.parse(body)).toEqual({
+                                    status: 'failure',
+                                    message: testCase.expect.error
+                                });
+                            else
+                                expect(body).toBe(testCase.expect.error);
+                            return [3 /*break*/, 8];
                         case 4:
                             want = testCase.expect.contents;
                             if (!(typeof want === 'string')) return [3 /*break*/, 6];
-                            _c = expect;
+                            _b = expect;
                             return [4 /*yield*/, response.text()];
                         case 5:
-                            _c.apply(void 0, [_f.sent()]).toBe(want);
+                            _b.apply(void 0, [_e.sent()]).toBe(want);
                             return [3 /*break*/, 8];
                         case 6:
                             if (!(want !== undefined)) return [3 /*break*/, 8];
-                            _d = expect;
-                            _e = Uint8Array.bind;
+                            _c = expect;
+                            _d = Uint8Array.bind;
                             return [4 /*yield*/, response.arrayBuffer()];
                         case 7:
-                            _d.apply(void 0, [new (_e.apply(Uint8Array, [void 0, _f.sent()]))()]).toEqual(want);
-                            _f.label = 8;
+                            _c.apply(void 0, [new (_d.apply(Uint8Array, [void 0, _e.sent()]))()]).toEqual(want);
+                            _e.label = 8;
                         case 8: return [2 /*return*/];
                     }
                 });
@@ -1552,12 +2028,12 @@ describe('service worker host', function () {
                 _loop_1(testCase);
             }
         }
-        catch (e_1_1) { e_1 = { error: e_1_1 }; }
+        catch (e_3_1) { e_3 = { error: e_3_1 }; }
         finally {
             try {
                 if (DRIVE_CORPUS_1_1 && !DRIVE_CORPUS_1_1.done && (_a = DRIVE_CORPUS_1.return)) _a.call(DRIVE_CORPUS_1);
             }
-            finally { if (e_1) throw e_1.error; }
+            finally { if (e_3) throw e_3.error; }
         }
     });
 });