@sasjs/cli 6.26.1 → 6.27.1

package/build/commands/build/internal/mockSite/assets/sw.js

@@ -698,63 +698,50 @@ const directorySource = {
 }
 
 /**
- * The app streams this host published: the site itself.
+ * The app stream, over the drive this site carries.
  *
- * The index is the package's, so the contract is the package's - an app is its
- * id, one app per `appLoc`, and unpublish takes the id (sasjs/server#544). The id
- * is fixed here rather than minted: this host publishes exactly one app, the
- * folder the site was built for, and a stable id is a handle a test and a
- * reviewer can both name.
+ * The package owns the index and every rule about it: what a publish must say,
+ * when an id is minted and when a redeploy keeps it, what the listing answers,
+ * how an app's files are found, what a removal removes. This host owns only the
+ * bytes - the drive store, which is persisted with the rest of the drive, so an
+ * app published in a mock survives a reload exactly as it would on a server.
  *
- * The folder is the identity, so unpublishing the app the site was built for
- * answers with that app; any other id is the documented 404. The static files
- * stay where they are - a worker cannot delete the site it is served from - so
- * this is a record of the publication, not a filesystem operation.
+ * Nothing is published until a deploy publishes something, which is what makes
+ * the mock honest: a `sasjs deploy` against it, or a bundle posted to
+ * `/SASjsApi/drive/deploy`, is listed and served here the way it is on a server.
+ * The folder the site itself was built for is deliberately not seeded as an app:
+ * its files are this site's static build, not a deployment in the drive, so a
+ * tile for it would open a 404.
  */
-const SITE_APP_ID = '6f1c1c1e-6a1e-4c4a-9d1a-1b2c3d4e5f60'
-
-let appStreamPromise
-const appStreamService = () => {
-  if (!appStreamPromise)
-    appStreamPromise = (async () => {
-      let appLoc
-      try {
-        const config = await (await fetch('host/mock-config.json')).json()
-        appLoc = config && config.appLoc
-      } catch (e) {
-        appLoc = undefined
-      }
+const APP_STREAM = API.createAppStreamService(
+  API.createDriveAppStreamStore(API.createDriveService(DRIVE_STORE))
+)
 
-      return API.createAppStreamService(
-        new API.MemoryAppStreamStore(
-          appLoc
-            ? [
-                {
-                  id: SITE_APP_ID,
-                  name: API.defaultAppName(appLoc),
-                  appLoc,
-                  streamWebFolder: 'web',
-                  publishedAt: new Date(0).toISOString()
-                }
-              ]
-            : []
-        )
-      )
-    })()
-  return appStreamPromise
+/**
+ * The app stream's own web surface: the landing page, the listing, an app's
+ * files and the removal of one.
+ *
+ * Mounted at the short spelling, which is what the interface links to; the
+ * canonical one is translated to it below, so both answer.
+ *
+ * `basePath` is the site's own folder plus that spelling, and the paths handed
+ * to the package include the folder too - the package builds an app's URL, its
+ * tiles and its logo links from `basePath`, so a surface mounted at `/app` on a
+ * site served from `/demo` would answer a listing whose every link pointed at
+ * the site root. Both sides take the same base and the answers land inside the
+ * folder.
+ */
+let appStreamWeb
+const appStreamSurface = () => {
+  if (!appStreamWeb)
+    appStreamWeb = API.createAppStreamWebService(
+      APP_STREAM,
+      API.createDriveService(DRIVE_STORE),
+      { basePath: `${BASE}${SHORT_APP_STREAM_PATH}` }
+    )
+  return appStreamWeb
 }
 
-/** The package's service, built once the config names the folder. */
-const APP_STREAM = new Proxy(
-  {},
-  {
-    get:
-      (_target, method) =>
-      (...args) =>
-        appStreamService().then((service) => service[method](...args))
-  }
-)
-
 /**
  * The page at `/`.
  *
@@ -1247,18 +1234,10 @@ const routeRequest = async (request, url) => {
     //
     // `/app` is the spelling the interface links to and the server serves; the
     // canonical `/AppStream` still answers, because a client built before the
-    // short paths existed asks for it. The answers are the same either way, so
-    // `/AppStream` redirects to `/app` - exactly as the server redirects it -
-    // and the landing page, the listing and the missing-name refusal are decided
-    // on both.
-    //
-    // The listing is empty rather than read from `registry()`, which records this
-    // deployment's own folder so the delete route has something to remove: the
-    // stream really does serve nothing at `/app/<name>/` here, and a listing that
-    // named it would offer a tile that 404s.
-    // `path` has its trailing slashes stripped, and the landing answers differ by
-    // exactly that, so they are decided on the request's own pathname - minus the
-    // folder the site is served from, which the patterns do not name.
+    // short paths existed asks for it. `/AppStream` itself redirects to `/app`,
+    // exactly as the server redirects it, and every request under either prefix
+    // is handed to the package as the short one - so a mock lists and serves what
+    // it published at the same URLs, with the same headers, as a server.
     const stream = withoutBase(url.pathname)
 
     if (/^\/AppStream$/i.test(stream))
@@ -1267,31 +1246,31 @@ const routeRequest = async (request, url) => {
         headers: { location: `${BASE}${SHORT_APP_STREAM_PATH}` }
       })
 
-    if (
-      /^\/(app|AppStream)\/?$/i.test(stream) ||
-      /^\/(app|AppStream)\/index\.html$/i.test(stream)
-    )
-      return new Response(
-        [
-          '<!doctype html><html><head><meta charset="utf-8">',
-          '<title>App Stream</title></head><body>',
-          '<h1>SASjs App Stream</h1>',
-          '<p>This browser host serves no apps: nothing is published on a static site.</p>',
-          '</body></html>'
-        ].join(''),
-        { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' } }
-      )
+    if (/^\/(app|AppStream)(\/|$)/i.test(stream)) {
+      // the path the surface matches on includes the site's folder, which is what
+      // it builds the answers' URLs from; `/AppStream` is translated to the short
+      // spelling so a client built before it existed reaches the same surface
+      const page = await appStreamSurface().request({
+        method: request.method,
+        path: url.pathname.replace(
+          /\/AppStream(?=\/|$)/i,
+          SHORT_APP_STREAM_PATH
+        )
+      })
 
-    if (/^\/(app|AppStream)\/apps\.json$/i.test(stream))
-      return json({ apps: [] })
+      // a removal changes the index, which lives in the drive: persisted in the
+      // same breath as any other change, or a reload would bring the app back
+      if (request.method !== 'GET') await persistChanges()
 
-    if (/^\/(app|AppStream)\//i.test(stream)) {
-      return json(
-        {
-          message:
-            'This browser host serves no apps: nothing is published on a static site.'
-        },
-        404
+      const headers = Object.assign({}, page.headers)
+      // a location the package states is already inside the folder, because the
+      // base it built it from carries it
+      if (page.location) headers.location = page.location
+      if (page.contentType) headers['content-type'] = page.contentType
+
+      return new Response(
+        page.body === undefined || page.body === null ? null : page.body,
+        { status: page.status, headers }
       )
     }
 
@@ -1339,6 +1318,13 @@ const routeRequest = async (request, url) => {
     const answer = await API.dispatch(SERVICES, routeId, apiRequest)
     if (request.method !== 'GET') await persistChanges()
 
+    // A deploy that published an app states its URL against the package's own
+    // default mount. This site may be served from a folder, so the answer has to
+    // name the URL a reader can actually open - the folder the surface above is
+    // mounted under, which is the same base its links are built from.
+    if (BASE && answer.body && answer.body.app && answer.body.app.url)
+      answer.body.app.url = `${BASE}${answer.body.app.url}`
+
     // the shell is a page, not a file the caller named: the document states
     // text/html for it, and the extension of `/` says nothing
     if (routeId === 'GET /')
@@ -1371,12 +1357,14 @@ const routeRequest = async (request, url) => {
 
     if (!refusal) broadcast({ type: 'sasjs-host-error', path, message })
     // A refusal the API decided on carries its status and, where the route
-    // answers an envelope, the body to send. The drive's routes send the message
-    // itself as plain text - the server answers them with `res.status(code)
-    // .send(err.message)` - so those stay text; everything else keeps the JSON
-    // envelope the other routes already answer with.
+    // answers an envelope, the body to send. The deploy routes state one in the
+    // document - a refusal there is `{status: 'failure', message}` - while the
+    // other drive routes send the message itself as plain text, which is what the
+    // server's `res.status(code).send(err.message)` does.
     if (API.isApiError(e)) {
       if (e.body !== undefined) return json(e.body, e.status)
+      if (/\/SASjsApi\/drive\/deploy(\/|$)/.test(apiPath))
+        return json({ status: 'failure', message: e.message }, e.status)
       if (apiPath.includes('/SASjsApi/drive/')) return text(e.message, e.status)
       return json({ message: e.message }, e.status)
     }

package/build/commands/build/internal/mockSite/spec/sw.spec.js

@@ -955,8 +955,8 @@ describe('service worker host', function () {
                 }
             });
         }); });
-        it('imports the fixture directory, and unpublishes the site itself', function () { return __awaiter(void 0, void 0, void 0, function () {
-            var dispatch, synced, _a, siteAppId, unpublished, removed, other;
+        it('imports the fixture directory', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, synced, _a;
             return __generator(this, function (_b) {
                 switch (_b.label) {
                     case 0:
@@ -969,28 +969,6 @@ describe('service worker host', function () {
                         return [4 /*yield*/, synced.json()];
                     case 2:
                         _a.apply(void 0, [_b.sent()]).toEqual({ userCount: 0, groupCount: 0 });
-                        siteAppId = '6f1c1c1e-6a1e-4c4a-9d1a-1b2c3d4e5f60';
-                        return [4 /*yield*/, dispatch('/SASjsApi/drive/deploy', {
-                                method: 'DELETE',
-                                headers: { 'content-type': 'application/json' },
-                                body: JSON.stringify({ id: siteAppId })
-                            })];
-                    case 3:
-                        unpublished = _b.sent();
-                        expect(unpublished.status).toBe(200);
-                        return [4 /*yield*/, unpublished.json()];
-                    case 4:
-                        removed = _b.sent();
-                        expect(removed.status).toBe('success');
-                        expect(removed.app.id).toBe(siteAppId);
-                        return [4 /*yield*/, dispatch('/SASjsApi/drive/deploy', {
-                                method: 'DELETE',
-                                headers: { 'content-type': 'application/json' },
-                                body: JSON.stringify({ id: '00000000-0000-4000-8000-000000000000' })
-                            })];
-                    case 5:
-                        other = _b.sent();
-                        expect(other.status).toBe(404);
                         return [2 /*return*/];
                 }
             });
@@ -1023,6 +1001,61 @@ describe('service worker host', function () {
                 }
             });
         }); });
+        it('keeps an app’s URL and tiles inside the folder the site is served from', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var worker, archive, form, published, app, listing, apps, landing, _a, page, _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        worker = loadWorker('/demo');
+                        return [4 /*yield*/, zipOf({
+                                'services/web/index.html': '<h1>Deployed</h1>'
+                            })];
+                    case 1:
+                        archive = _c.sent();
+                        form = new FormData();
+                        form.set('appLoc', '/Public/apps/demo');
+                        form.set('streamWebFolder', 'web');
+                        form.set('file', new Blob([new Uint8Array(archive)]), 'deploy.zip');
+                        return [4 /*yield*/, worker.dispatch('/demo/SASjsApi/drive/deploy/upload', { method: 'POST', body: form })];
+                    case 2:
+                        published = _c.sent();
+                        expect(published.status).toBe(200);
+                        return [4 /*yield*/, published.json()];
+                    case 3:
+                        app = (_c.sent()).app;
+                        // The package builds an app's URL - and the landing page's links - from the
+                        // base it was mounted on. Mounted at `/app` on a site served from `/demo`,
+                        // every one of them would point at the site root and 404, so this asserts
+                        // the mount and the requests carry the same folder.
+                        expect(app.url).toBe("/demo/app/".concat(app.id, "/"));
+                        return [4 /*yield*/, worker.dispatch('/demo/app/apps.json')];
+                    case 4:
+                        listing = _c.sent();
+                        return [4 /*yield*/, listing.json()];
+                    case 5:
+                        apps = (_c.sent()).apps;
+                        expect(apps.map(function (entry) { return entry.url; })).toEqual([
+                            "/demo/app/".concat(app.id, "/")
+                        ]);
+                        return [4 /*yield*/, worker.dispatch('/demo/app/')];
+                    case 6:
+                        landing = _c.sent();
+                        _a = expect;
+                        return [4 /*yield*/, landing.text()];
+                    case 7:
+                        _a.apply(void 0, [_c.sent()]).toContain("href=\"/demo/app/".concat(app.id, "/\""));
+                        return [4 /*yield*/, worker.dispatch("/demo/app/".concat(app.id, "/"))];
+                    case 8:
+                        page = _c.sent();
+                        expect(page.status).toBe(200);
+                        _b = expect;
+                        return [4 /*yield*/, page.text()];
+                    case 9:
+                        _b.apply(void 0, [_c.sent()]).toContain('<h1>Deployed</h1>');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
         it('answers every route under the folder the site is published in', function () { return __awaiter(void 0, void 0, void 0, function () {
             var worker, info, _a, page, folder, stream, landing, apps, _b, aliased, _c;
             var _d;
@@ -1233,10 +1266,17 @@ describe('service worker host', function () {
                     case 1:
                         empty = _c.sent();
                         expect(empty.status).toBe(400);
+                        // the deploy routes answer a refusal as the envelope the document states for
+                        // them, which is what the corpus pins for the same route
                         _a = expect;
-                        return [4 /*yield*/, empty.text()];
+                        return [4 /*yield*/, empty.json()];
                     case 2:
-                        _a.apply(void 0, [_c.sent()]).toBe('"file" is not present.');
+                        // the deploy routes answer a refusal as the envelope the document states for
+                        // them, which is what the corpus pins for the same route
+                        _a.apply(void 0, [_c.sent()]).toEqual({
+                            status: 'failure',
+                            message: '"file" is not present.'
+                        });
                         form = new FormData();
                         form.set('file', new Blob([new Uint8Array([1, 2, 3])]), 'not-a-zip.zip');
                         return [4 /*yield*/, dispatch('/SASjsApi/drive/deploy/upload', {
@@ -1247,9 +1287,12 @@ describe('service worker host', function () {
                         notZip = _c.sent();
                         expect(notZip.status).toBe(400);
                         _b = expect;
-                        return [4 /*yield*/, notZip.text()];
+                        return [4 /*yield*/, notZip.json()];
                     case 4:
-                        _b.apply(void 0, [_c.sent()]).toBe('The archive is not a zip file.');
+                        _b.apply(void 0, [_c.sent()]).toEqual({
+                            status: 'failure',
+                            message: 'The archive is not a zip file.'
+                        });
                         return [2 /*return*/];
                 }
             });
@@ -1502,120 +1545,211 @@ describe('service worker host', function () {
             }
         });
     }); });
-    it('answers the app stream on the short path, and the canonical one as an alias', function () { return __awaiter(void 0, void 0, void 0, function () {
-        var dispatch, _a, _b, path_2, listing, _c, e_1_1, _d, _e, path_3, landing, _f, e_2_1, root, canonicalLanding, _g, _h, _j, path_4, app, _k, e_3_1;
-        var e_1, _l, e_2, _m, e_3, _o;
-        return __generator(this, function (_p) {
-            switch (_p.label) {
+    it('publishes, lists, serves and removes an app through the package surface', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var dispatch, _a, _b, path_2, listing, _c, e_1_1, _d, _e, path_3, landing, e_2_1, root, archive, form, published, app, _f, _g, path_4, listing, _h, e_3_1, _j, _k, path_5, page, _l, e_4_1, folder, _m, refused, missing, removed, _o, after, _p, gone;
+        var e_1, _q, e_2, _r, e_3, _s, e_4, _t;
+        return __generator(this, function (_u) {
+            switch (_u.label) {
                 case 0:
                     dispatch = seeded().dispatch;
-                    _p.label = 1;
+                    _u.label = 1;
                 case 1:
-                    _p.trys.push([1, 7, 8, 9]);
+                    _u.trys.push([1, 7, 8, 9]);
                     _a = __values(['/app/apps.json', '/AppStream/apps.json']), _b = _a.next();
-                    _p.label = 2;
+                    _u.label = 2;
                 case 2:
                     if (!!_b.done) return [3 /*break*/, 6];
                     path_2 = _b.value;
                     return [4 /*yield*/, dispatch(path_2)];
                 case 3:
-                    listing = _p.sent();
+                    listing = _u.sent();
                     expect(listing.status).toBe(200);
                     _c = expect;
                     return [4 /*yield*/, listing.json()];
                 case 4:
-                    _c.apply(void 0, [_p.sent()]).toEqual({ apps: [] });
-                    _p.label = 5;
+                    _c.apply(void 0, [_u.sent()]).toEqual({ apps: [] });
+                    _u.label = 5;
                 case 5:
                     _b = _a.next();
                     return [3 /*break*/, 2];
                 case 6: return [3 /*break*/, 9];
                 case 7:
-                    e_1_1 = _p.sent();
+                    e_1_1 = _u.sent();
                     e_1 = { error: e_1_1 };
                     return [3 /*break*/, 9];
                 case 8:
                     try {
-                        if (_b && !_b.done && (_l = _a.return)) _l.call(_a);
+                        if (_b && !_b.done && (_q = _a.return)) _q.call(_a);
                     }
                     finally { if (e_1) throw e_1.error; }
                     return [7 /*endfinally*/];
                 case 9:
-                    _p.trys.push([9, 15, 16, 17]);
+                    _u.trys.push([9, 14, 15, 16]);
                     _d = __values(['/app', '/app/', '/app/index.html']), _e = _d.next();
-                    _p.label = 10;
+                    _u.label = 10;
                 case 10:
-                    if (!!_e.done) return [3 /*break*/, 14];
+                    if (!!_e.done) return [3 /*break*/, 13];
                     path_3 = _e.value;
                     return [4 /*yield*/, dispatch(path_3)];
                 case 11:
-                    landing = _p.sent();
+                    landing = _u.sent();
                     expect(landing.status).toBe(200);
                     expect(landing.headers.get('content-type')).toContain('text/html');
-                    _f = expect;
-                    return [4 /*yield*/, landing.text()];
+                    _u.label = 12;
                 case 12:
-                    _f.apply(void 0, [_p.sent()]).toContain('serves no apps');
-                    _p.label = 13;
-                case 13:
                     _e = _d.next();
                     return [3 /*break*/, 10];
-                case 14: return [3 /*break*/, 17];
-                case 15:
-                    e_2_1 = _p.sent();
+                case 13: return [3 /*break*/, 16];
+                case 14:
+                    e_2_1 = _u.sent();
                     e_2 = { error: e_2_1 };
-                    return [3 /*break*/, 17];
-                case 16:
+                    return [3 /*break*/, 16];
+                case 15:
                     try {
-                        if (_e && !_e.done && (_m = _d.return)) _m.call(_d);
+                        if (_e && !_e.done && (_r = _d.return)) _r.call(_d);
                     }
                     finally { if (e_2) throw e_2.error; }
                     return [7 /*endfinally*/];
-                case 17: return [4 /*yield*/, dispatch('/AppStream')];
-                case 18:
-                    root = _p.sent();
+                case 16: return [4 /*yield*/, dispatch('/AppStream')];
+                case 17:
+                    root = _u.sent();
                     expect(root.status).toBe(301);
                     expect(root.headers.get('location')).toBe('/app');
-                    return [4 /*yield*/, dispatch('/AppStream/')];
+                    return [4 /*yield*/, zipOf({
+                            'services/web/index.html': '<h1>Demo</h1>'
+                        })];
+                case 18:
+                    archive = _u.sent();
+                    form = new FormData();
+                    form.set('appLoc', '/Public/apps/demo');
+                    form.set('streamWebFolder', 'web');
+                    form.set('file', new Blob([new Uint8Array(archive)]), 'deploy.zip');
+                    return [4 /*yield*/, dispatch('/SASjsApi/drive/deploy/upload', {
+                            method: 'POST',
+                            body: form
+                        })];
                 case 19:
-                    canonicalLanding = _p.sent();
-                    expect(canonicalLanding.status).toBe(200);
-                    _g = expect;
-                    return [4 /*yield*/, canonicalLanding.text()];
+                    published = _u.sent();
+                    expect(published.status).toBe(200);
+                    return [4 /*yield*/, published.json()];
                 case 20:
-                    _g.apply(void 0, [_p.sent()]).toContain('serves no apps');
-                    _p.label = 21;
+                    app = (_u.sent()).app;
+                    expect(app.name).toBe('demo');
+                    expect(app.url).toBe("/app/".concat(app.id, "/"));
+                    _u.label = 21;
                 case 21:
-                    _p.trys.push([21, 27, 28, 29]);
-                    _h = __values(['/app/Demo/', '/AppStream/Demo/']), _j = _h.next();
-                    _p.label = 22;
+                    _u.trys.push([21, 27, 28, 29]);
+                    _f = __values(['/app/apps.json', '/AppStream/apps.json']), _g = _f.next();
+                    _u.label = 22;
                 case 22:
-                    if (!!_j.done) return [3 /*break*/, 26];
-                    path_4 = _j.value;
+                    if (!!_g.done) return [3 /*break*/, 26];
+                    path_4 = _g.value;
                     return [4 /*yield*/, dispatch(path_4)];
                 case 23:
-                    app = _p.sent();
-                    expect(app.status).toBe(404);
-                    _k = expect;
-                    return [4 /*yield*/, app.json()];
+                    listing = _u.sent();
+                    _h = expect;
+                    return [4 /*yield*/, listing.json()];
                 case 24:
-                    _k.apply(void 0, [(_p.sent()).message]).toContain('serves no apps');
-                    _p.label = 25;
+                    _h.apply(void 0, [(_u.sent()).apps[0]]).toMatchObject({
+                        id: app.id,
+                        name: 'demo',
+                        url: "/app/".concat(app.id, "/")
+                    });
+                    _u.label = 25;
                 case 25:
-                    _j = _h.next();
+                    _g = _f.next();
                     return [3 /*break*/, 22];
                 case 26: return [3 /*break*/, 29];
                 case 27:
-                    e_3_1 = _p.sent();
+                    e_3_1 = _u.sent();
                     e_3 = { error: e_3_1 };
                     return [3 /*break*/, 29];
                 case 28:
                     try {
-                        if (_j && !_j.done && (_o = _h.return)) _o.call(_h);
+                        if (_g && !_g.done && (_s = _f.return)) _s.call(_f);
                     }
                     finally { if (e_3) throw e_3.error; }
                     return [7 /*endfinally*/];
-                case 29: return [2 /*return*/];
+                case 29:
+                    _u.trys.push([29, 35, 36, 37]);
+                    _j = __values([
+                        "/app/".concat(app.id, "/"),
+                        "/app/".concat(app.id, "/index.html"),
+                        "/AppStream/".concat(app.id, "/")
+                    ]), _k = _j.next();
+                    _u.label = 30;
+                case 30:
+                    if (!!_k.done) return [3 /*break*/, 34];
+                    path_5 = _k.value;
+                    return [4 /*yield*/, dispatch(path_5)];
+                case 31:
+                    page = _u.sent();
+                    expect(page.status).toBe(200);
+                    _l = expect;
+                    return [4 /*yield*/, page.text()];
+                case 32:
+                    _l.apply(void 0, [_u.sent()]).toContain('<h1>Demo</h1>');
+                    _u.label = 33;
+                case 33:
+                    _k = _j.next();
+                    return [3 /*break*/, 30];
+                case 34: return [3 /*break*/, 37];
+                case 35:
+                    e_4_1 = _u.sent();
+                    e_4 = { error: e_4_1 };
+                    return [3 /*break*/, 37];
+                case 36:
+                    try {
+                        if (_k && !_k.done && (_t = _j.return)) _t.call(_j);
+                    }
+                    finally { if (e_4) throw e_4.error; }
+                    return [7 /*endfinally*/];
+                case 37: return [4 /*yield*/, dispatch("/app/".concat(app.id))];
+                case 38:
+                    folder = _u.sent();
+                    expect(folder.status).toBe(301);
+                    expect(folder.headers.get('location')).toBe("/app/".concat(app.id, "/"));
+                    _m = expect;
+                    return [4 /*yield*/, folder.text()];
+                case 39:
+                    _m.apply(void 0, [_u.sent()]).toBe('');
+                    return [4 /*yield*/, dispatch('/app/apps.json', {
+                            method: 'POST',
+                            headers: { 'content-type': 'application/json' },
+                            body: '{}'
+                        })];
+                case 40:
+                    refused = _u.sent();
+                    expect(refused.status).toBe(405);
+                    expect(refused.headers.get('allow')).toBe('GET');
+                    return [4 /*yield*/, dispatch('/app/00000000-0000-4000-8000-000000000000/')];
+                case 41:
+                    missing = _u.sent();
+                    expect(missing.status).toBe(404);
+                    return [4 /*yield*/, dispatch('/SASjsApi/drive/deploy', {
+                            method: 'DELETE',
+                            headers: { 'content-type': 'application/json' },
+                            body: JSON.stringify({ id: app.id })
+                        })];
+                case 42:
+                    removed = _u.sent();
+                    expect(removed.status).toBe(200);
+                    _o = expect;
+                    return [4 /*yield*/, removed.json()];
+                case 43:
+                    _o.apply(void 0, [(_u.sent()).app.id]).toBe(app.id);
+                    return [4 /*yield*/, dispatch('/app/apps.json')];
+                case 44:
+                    after = _u.sent();
+                    _p = expect;
+                    return [4 /*yield*/, after.json()];
+                case 45:
+                    _p.apply(void 0, [_u.sent()]).toEqual({ apps: [] });
+                    return [4 /*yield*/, dispatch("/app/".concat(app.id, "/"))];
+                case 46:
+                    gone = _u.sent();
+                    expect(gone.status).toBe(404);
+                    return [2 /*return*/];
             }
         });
     }); });
@@ -2507,7 +2641,7 @@ describe('service worker host', function () {
         }); });
     });
     describe('conformance corpus', function () {
-        var e_4, _a;
+        var e_5, _a, e_6, _b;
         /**
          * The corpus is what "the same API" means: the cases @sasjs/api runs against
          * its own services, and against a live sasjs/server, run here against this
@@ -2516,7 +2650,7 @@ describe('service worker host', function () {
          * used to have - and it is a test rather than a review.
          */
         var httpFor = function (testCase) {
-            var e_5, _a;
+            var e_7, _a;
             var _b;
             var _c = __read(testCase.route.split(' '), 2), method = _c[0], routePath = _c[1];
             var query = new URLSearchParams();
@@ -2527,12 +2661,12 @@ describe('service worker host', function () {
                         query.set(key, String(value));
                 }
             }
-            catch (e_5_1) { e_5 = { error: e_5_1 }; }
+            catch (e_7_1) { e_7 = { error: e_7_1 }; }
             finally {
                 try {
                     if (_e && !_e.done && (_a = _d.return)) _a.call(_d);
                 }
-                finally { if (e_5) throw e_5.error; }
+                finally { if (e_7) throw e_7.error; }
             }
             var suffix = query.toString() ? "?".concat(query) : '';
             var init = { method: method };
@@ -2563,8 +2697,8 @@ describe('service worker host', function () {
          * does.
          */
         var seedDrive = function (runtime, testCase) { return __awaiter(void 0, void 0, void 0, function () {
-            var text, _a, _b, _c, file, contents, _d, _e, _f, file, contents, e_6_1;
-            var e_7, _g, e_6, _h;
+            var text, _a, _b, _c, file, contents, _d, _e, _f, file, contents, e_8_1;
+            var e_9, _g, e_8, _h;
             return __generator(this, function (_j) {
                 switch (_j.label) {
                     case 0:
@@ -2576,12 +2710,12 @@ describe('service worker host', function () {
                                     text["/sasjs/drive/files".concat(file)] = contents;
                             }
                         }
-                        catch (e_7_1) { e_7 = { error: e_7_1 }; }
+                        catch (e_9_1) { e_9 = { error: e_9_1 }; }
                         finally {
                             try {
                                 if (_b && !_b.done && (_g = _a.return)) _g.call(_a);
                             }
-                            finally { if (e_7) throw e_7.error; }
+                            finally { if (e_9) throw e_9.error; }
                         }
                         return [4 /*yield*/, runtime.load(text)];
                     case 1:
@@ -2604,87 +2738,308 @@ describe('service worker host', function () {
                         return [3 /*break*/, 3];
                     case 6: return [3 /*break*/, 9];
                     case 7:
-                        e_6_1 = _j.sent();
-                        e_6 = { error: e_6_1 };
+                        e_8_1 = _j.sent();
+                        e_8 = { error: e_8_1 };
                         return [3 /*break*/, 9];
                     case 8:
                         try {
                             if (_e && !_e.done && (_h = _d.return)) _h.call(_d);
                         }
-                        finally { if (e_6) throw e_6.error; }
+                        finally { if (e_8) throw e_8.error; }
                         return [7 /*endfinally*/];
                     case 9: return [2 /*return*/];
                 }
             });
         }); };
+        /**
+         * The expectation kinds this harness asserts.
+         *
+         * A case that states one it does not implement fails rather than passing
+         * unproven - `keys`, `shape` and `encoding` are asserted by the package's own
+         * corpus run and not here, and a case that starts using them has to be told
+         * so by this list rather than by silence.
+         */
+        var ASSERTED = ['status', 'error', 'partial', 'body', 'contents'];
+        var assertExpectations = function (response, testCase) { return __awaiter(void 0, void 0, void 0, function () {
+            var unasserted, bytes, _a, _b, text, _c, isJson, body;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        unasserted = Object.keys(testCase.expect).filter(function (kind) { return !ASSERTED.includes(kind); });
+                        if (unasserted.length)
+                            throw new Error("".concat(testCase.id, ": this harness does not assert ").concat(unasserted.join(', ')));
+                        expect(response.status).toBe(testCase.expect.status);
+                        if (!(testCase.expect.contents instanceof Uint8Array)) return [3 /*break*/, 2];
+                        _b = Uint8Array.bind;
+                        return [4 /*yield*/, response.arrayBuffer()];
+                    case 1:
+                        _a = new (_b.apply(Uint8Array, [void 0, _d.sent()]))();
+                        return [3 /*break*/, 3];
+                    case 2:
+                        _a = undefined;
+                        _d.label = 3;
+                    case 3:
+                        bytes = _a;
+                        if (!(bytes === undefined)) return [3 /*break*/, 5];
+                        return [4 /*yield*/, response.text()];
+                    case 4:
+                        _c = _d.sent();
+                        return [3 /*break*/, 6];
+                    case 5:
+                        _c = undefined;
+                        _d.label = 6;
+                    case 6:
+                        text = _c;
+                        isJson = (response.headers.get('content-type') || '').includes('application/json');
+                        if (testCase.expect.error !== undefined) {
+                            // the routes that answer an envelope - the two deploy routes - send
+                            // `{status, message}`; the rest send the message itself as text, which is
+                            // what the server's `res.status(code).send(err.message)` does
+                            if (isJson) {
+                                body = JSON.parse(text);
+                                expect(body.message).toBe(testCase.expect.error);
+                                // a refusal that states the envelope it expects is compared on the whole
+                                // of it, not only on the message
+                                if (testCase.expect.body !== undefined)
+                                    expect(body).toEqual(testCase.expect.body);
+                            }
+                            else {
+                                // a case cannot state an envelope and be answered with text: one of the
+                                // two is wrong, and silence would hide which
+                                if (testCase.expect.body !== undefined)
+                                    throw new Error("".concat(testCase.id, ": the answer is text, so its body cannot be asserted"));
+                                expect(text).toBe(testCase.expect.error);
+                            }
+                            return [2 /*return*/];
+                        }
+                        if (testCase.expect.contents !== undefined) {
+                            if (bytes !== undefined)
+                                expect(bytes).toEqual(testCase.expect.contents);
+                            else
+                                expect(text).toEqual(testCase.expect.contents);
+                            return [2 /*return*/];
+                        }
+                        if (testCase.expect.body !== undefined)
+                            expect(JSON.parse(text)).toEqual(testCase.expect.body);
+                        if (testCase.expect.partial !== undefined)
+                            expect(JSON.parse(text)).toMatchObject(testCase.expect.partial);
+                        return [2 /*return*/];
+                }
+            });
+        }); };
         var _loop_1 = function (testCase) {
             it(testCase.id, function () { return __awaiter(void 0, void 0, void 0, function () {
-                var worker, _a, requestPath, init, response, body, want, _b, _c, _d;
-                return __generator(this, function (_e) {
-                    switch (_e.label) {
+                var worker, _a, requestPath, init, response;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0:
                             worker = loadWorker();
                             return [4 /*yield*/, seedDrive(worker.runtime, testCase)];
                         case 1:
-                            _e.sent();
+                            _b.sent();
                             worker.refuseWrites(Boolean(testCase.unwritable));
                             _a = httpFor(testCase), requestPath = _a.path, init = _a.init;
                             return [4 /*yield*/, worker.dispatch(requestPath, init)];
                         case 2:
-                            response = _e.sent();
-                            expect(response.status).toBe(testCase.expect.status);
-                            if (!(testCase.expect.error !== undefined)) return [3 /*break*/, 4];
-                            return [4 /*yield*/, response.text()
-                                // the routes that answer an envelope - the two deploy routes - send
-                                // `{status, message}`; the rest send the message itself as text, which
-                                // is what the server's `res.status(code).send(err.message)` does
+                            response = _b.sent();
+                            return [4 /*yield*/, assertExpectations(response, testCase)];
+                        case 3:
+                            _b.sent();
+                            return [2 /*return*/];
+                    }
+                });
+            }); });
+        };
+        try {
+            for (var DRIVE_CORPUS_1 = __values(api_1.DRIVE_CORPUS), DRIVE_CORPUS_1_1 = DRIVE_CORPUS_1.next(); !DRIVE_CORPUS_1_1.done; DRIVE_CORPUS_1_1 = DRIVE_CORPUS_1.next()) {
+                var testCase = DRIVE_CORPUS_1_1.value;
+                _loop_1(testCase);
+            }
+        }
+        catch (e_5_1) { e_5 = { error: e_5_1 }; }
+        finally {
+            try {
+                if (DRIVE_CORPUS_1_1 && !DRIVE_CORPUS_1_1.done && (_a = DRIVE_CORPUS_1.return)) _a.call(DRIVE_CORPUS_1);
+            }
+            finally { if (e_5) throw e_5.error; }
+        }
+        /**
+         * The deploy route's JSON form and its removal, which is what `sasjs deploy`
+         * sends and what this host's transport carries unchanged.
+         *
+         * The upload route's cases hand over the expanded tree in place of the
+         * archive, which is a host's transport detail rather than an answer: this
+         * worker takes the archive and expands it, so those cases would pin the
+         * corpus's assumption instead of this host's behaviour. The zip cases above
+         * pin that route. The removal cases need an app to remove, so the index is
+         * seeded with the corpus's own - the worker starts with nothing published,
+         * which is the server's state too.
+         *
+         * The state a case leaves is checked too - `expectDrive` - because both deploy
+         * answers are `200` and the difference between replacing a folder and keeping
+         * what is there is only visible in the drive afterwards.
+         */
+        /** The app a removal case names, as the corpus states it. */
+        var CORPUS_APP = {
+            appLoc: '/Public/myApp',
+            streamWebFolder: 'web',
+            publishedAt: '2026-01-01T00:00:00.000Z'
+        };
+        /**
+         * A second app that no removal case names.
+         *
+         * Without it, a removal that ignored the id and deleted whatever was
+         * published would pass both removal cases - the unknown-id one sees an empty
+         * index either way. With it, the assertion after the answer is that the app
+         * the id did *not* name is still listed.
+         */
+        var BYSTANDER = {
+            id: '0b9a1c2d-3e4f-4a5b-8c6d-7e8f9a0b1c2d',
+            name: 'bystander',
+            appLoc: '/Public/bystander',
+            streamWebFolder: 'web',
+            publishedAt: '2026-01-01T00:00:00.000Z'
+        };
+        /**
+         * The index a removal case starts from - built from the id the case asks to
+         * remove, not from the answer it expects, so a host that removed some other
+         * app would answer a different id and fail.
+         */
+        var seedIndex = function (runtime, testCase) { return __awaiter(void 0, void 0, void 0, function () {
+            var id, named, entries;
+            var _a, _b, _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        if (testCase.route !== 'DELETE /SASjsApi/drive/deploy')
+                            return [2 /*return*/];
+                        id = (_a = testCase.request.body) === null || _a === void 0 ? void 0 : _a.id;
+                        named = (_b = testCase.expect.partial) === null || _b === void 0 ? void 0 : _b.app;
+                        entries = [BYSTANDER];
+                        // the app the case expects to remove is published only when the case names
+                        // the id it removes: the unknown-id case asks for one that is not there, and
+                        // publishing it would make that case pass by accident. It goes in *after* the
+                        // bystander, so a removal that takes the first entry rather than the named
+                        // one removes the bystander and both assertions below fail.
+                        if (id !== undefined && (named === null || named === void 0 ? void 0 : named.id) === id)
+                            entries.push(__assign({ id: id, name: (_c = named.name) !== null && _c !== void 0 ? _c : 'myApp' }, CORPUS_APP));
+                        return [4 /*yield*/, runtime.load({
+                                '/sasjs/drive/files/.sasjs/apps.json': JSON.stringify(entries)
+                            })];
+                    case 1:
+                        _d.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); };
+        var _loop_2 = function (testCase) {
+            it(testCase.id, function () { return __awaiter(void 0, void 0, void 0, function () {
+                var worker, _a, requestPath, init, response, listing, ids, _b, _c, path_6, file, e_10_1, _d, _e, path_7, file, e_11_1;
+                var e_10, _f, e_11, _g;
+                var _h, _j, _k;
+                return __generator(this, function (_l) {
+                    switch (_l.label) {
+                        case 0:
+                            worker = loadWorker();
+                            return [4 /*yield*/, seedDrive(worker.runtime, testCase)];
+                        case 1:
+                            _l.sent();
+                            return [4 /*yield*/, seedIndex(worker.runtime, testCase)
+                                // `unwritable` is not passed on here: the case that states it is the
+                                // upload route's, which the filter above keeps out, and the deploy route's
+                                // own `500` is covered by `deploy-refused-by-store` in the drive loop.
                             ];
+                        case 2:
+                            _l.sent();
+                            _a = httpFor(testCase), requestPath = _a.path, init = _a.init;
+                            return [4 /*yield*/, worker.dispatch(requestPath, init)];
                         case 3:
-                            body = _e.sent();
-                            // the routes that answer an envelope - the two deploy routes - send
-                            // `{status, message}`; the rest send the message itself as text, which
-                            // is what the server's `res.status(code).send(err.message)` does
-                            if ((response.headers.get('content-type') || '').includes('application/json'))
-                                expect(JSON.parse(body)).toEqual({
-                                    status: 'failure',
-                                    message: testCase.expect.error
-                                });
-                            else
-                                expect(body).toBe(testCase.expect.error);
-                            return [3 /*break*/, 8];
+                            response = _l.sent();
+                            return [4 /*yield*/, assertExpectations(response, testCase)
+                                // a removal takes the app the id names, and leaves the rest published
+                            ];
                         case 4:
-                            want = testCase.expect.contents;
-                            if (!(typeof want === 'string')) return [3 /*break*/, 6];
-                            _b = expect;
-                            return [4 /*yield*/, response.text()];
+                            _l.sent();
+                            if (!(testCase.route === 'DELETE /SASjsApi/drive/deploy')) return [3 /*break*/, 7];
+                            return [4 /*yield*/, worker.dispatch('/app/apps.json')];
                         case 5:
-                            _b.apply(void 0, [_e.sent()]).toBe(want);
-                            return [3 /*break*/, 8];
+                            listing = _l.sent();
+                            return [4 /*yield*/, listing.json()];
                         case 6:
-                            if (!(want !== undefined)) return [3 /*break*/, 8];
-                            _c = expect;
-                            _d = Uint8Array.bind;
-                            return [4 /*yield*/, response.arrayBuffer()];
+                            ids = (_l.sent()).apps.map(function (app) { return app.id; });
+                            expect(ids).toContain(BYSTANDER.id);
+                            if (response.status === 200)
+                                expect(ids).not.toContain((_h = testCase.request.body) === null || _h === void 0 ? void 0 : _h.id);
+                            _l.label = 7;
                         case 7:
-                            _c.apply(void 0, [new (_d.apply(Uint8Array, [void 0, _e.sent()]))()]).toEqual(want);
-                            _e.label = 8;
-                        case 8: return [2 /*return*/];
+                            _l.trys.push([7, 12, 13, 14]);
+                            _b = __values(((_j = testCase.expectDrive) === null || _j === void 0 ? void 0 : _j.present) || []), _c = _b.next();
+                            _l.label = 8;
+                        case 8:
+                            if (!!_c.done) return [3 /*break*/, 11];
+                            path_6 = _c.value;
+                            return [4 /*yield*/, worker.dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent(path_6))];
+                        case 9:
+                            file = _l.sent();
+                            expect({ path: path_6, status: file.status }).toEqual({ path: path_6, status: 200 });
+                            _l.label = 10;
+                        case 10:
+                            _c = _b.next();
+                            return [3 /*break*/, 8];
+                        case 11: return [3 /*break*/, 14];
+                        case 12:
+                            e_10_1 = _l.sent();
+                            e_10 = { error: e_10_1 };
+                            return [3 /*break*/, 14];
+                        case 13:
+                            try {
+                                if (_c && !_c.done && (_f = _b.return)) _f.call(_b);
+                            }
+                            finally { if (e_10) throw e_10.error; }
+                            return [7 /*endfinally*/];
+                        case 14:
+                            _l.trys.push([14, 19, 20, 21]);
+                            _d = __values(((_k = testCase.expectDrive) === null || _k === void 0 ? void 0 : _k.missing) || []), _e = _d.next();
+                            _l.label = 15;
+                        case 15:
+                            if (!!_e.done) return [3 /*break*/, 18];
+                            path_7 = _e.value;
+                            return [4 /*yield*/, worker.dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent(path_7))];
+                        case 16:
+                            file = _l.sent();
+                            expect({ path: path_7, status: file.status }).toEqual({ path: path_7, status: 404 });
+                            _l.label = 17;
+                        case 17:
+                            _e = _d.next();
+                            return [3 /*break*/, 15];
+                        case 18: return [3 /*break*/, 21];
+                        case 19:
+                            e_11_1 = _l.sent();
+                            e_11 = { error: e_11_1 };
+                            return [3 /*break*/, 21];
+                        case 20:
+                            try {
+                                if (_e && !_e.done && (_g = _d.return)) _g.call(_d);
+                            }
+                            finally { if (e_11) throw e_11.error; }
+                            return [7 /*endfinally*/];
+                        case 21: return [2 /*return*/];
                     }
                 });
             }); });
         };
         try {
-            for (var DRIVE_CORPUS_1 = __values(api_1.DRIVE_CORPUS), DRIVE_CORPUS_1_1 = DRIVE_CORPUS_1.next(); !DRIVE_CORPUS_1_1.done; DRIVE_CORPUS_1_1 = DRIVE_CORPUS_1.next()) {
-                var testCase = DRIVE_CORPUS_1_1.value;
-                _loop_1(testCase);
+            for (var _c = __values(api_1.DEPLOY_CORPUS.filter(function (entry) { return entry.route !== 'POST /SASjsApi/drive/deploy/upload'; })), _d = _c.next(); !_d.done; _d = _c.next()) {
+                var testCase = _d.value;
+                _loop_2(testCase);
             }
         }
-        catch (e_4_1) { e_4 = { error: e_4_1 }; }
+        catch (e_6_1) { e_6 = { error: e_6_1 }; }
         finally {
             try {
-                if (DRIVE_CORPUS_1_1 && !DRIVE_CORPUS_1_1.done && (_a = DRIVE_CORPUS_1.return)) _a.call(DRIVE_CORPUS_1);
+                if (_d && !_d.done && (_b = _c.return)) _b.call(_c);
             }
-            finally { if (e_4) throw e_4.error; }
+            finally { if (e_6) throw e_6.error; }
         }
     });
     /**
@@ -2696,7 +3051,7 @@ describe('service worker host', function () {
      * are the package's.
      */
     describe('identity and record conformance', function () {
-        var e_8, _a;
+        var e_12, _a;
         /**
          * Boots the worker from a fixture, the way the page does: the case's own
          * identity, and `subject: null` for no implicit caller, so a case that
@@ -2729,7 +3084,7 @@ describe('service worker host', function () {
         };
         /** The request a case describes, as HTTP: path parameters filled, token sent. */
         var httpForCase = function (testCase) {
-            var e_9, _a;
+            var e_13, _a;
             var _b = __read(testCase.route.split(' '), 2), method = _b[0], routePath = _b[1];
             var filled = routePath.replace(/\{(\w+)\}/g, function (_match, name) {
                 return encodeURIComponent(String((testCase.request.params || {})[name]));
@@ -2742,12 +3097,12 @@ describe('service worker host', function () {
                         query.set(key, String(value));
                 }
             }
-            catch (e_9_1) { e_9 = { error: e_9_1 }; }
+            catch (e_13_1) { e_13 = { error: e_13_1 }; }
             finally {
                 try {
                     if (_d && !_d.done && (_a = _c.return)) _a.call(_c);
                 }
-                finally { if (e_9) throw e_9.error; }
+                finally { if (e_13) throw e_13.error; }
             }
             var suffix = query.toString() ? "?".concat(query) : '';
             var headers = {};
@@ -2841,7 +3196,7 @@ describe('service worker host', function () {
                 }
             });
         }); };
-        var _loop_2 = function (testCase) {
+        var _loop_3 = function (testCase) {
             it("".concat(testCase.id, ": ").concat(testCase.description), function () { return __awaiter(void 0, void 0, void 0, function () {
                 var worker, _a, requestPath, init, _b, _c;
                 return __generator(this, function (_d) {
@@ -2866,15 +3221,15 @@ describe('service worker host', function () {
         try {
             for (var _b = __values(__spreadArray(__spreadArray([], __read(api_1.IDENTITY_CORPUS), false), __read(api_1.RECORD_CORPUS), false)), _c = _b.next(); !_c.done; _c = _b.next()) {
                 var testCase = _c.value;
-                _loop_2(testCase);
+                _loop_3(testCase);
             }
         }
-        catch (e_8_1) { e_8 = { error: e_8_1 }; }
+        catch (e_12_1) { e_12 = { error: e_12_1 }; }
         finally {
             try {
                 if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
             }
-            finally { if (e_8) throw e_8.error; }
+            finally { if (e_12) throw e_12.error; }
         }
         it('answers as the fixture administrator when no subject was chosen', function () { return __awaiter(void 0, void 0, void 0, function () {
             var worker, response, rules;

package/package.json

@@ -71,7 +71,7 @@
   },
   "dependencies": {
     "@sasjs/adapter": "6.0.2",
-    "@sasjs/api": "0.27.0",
+    "@sasjs/api": "0.27.1",
     "@sasjs/core": "7.1.12",
     "@sasjs/lint": "5.1.1",
     "@sasjs/utils": "4.11.0",
@@ -125,5 +125,5 @@
     "ws": "8.21.0",
     "nanoid": "3.3.18"
   },
-  "version": "6.26.1"
+  "version": "6.27.1"
 }