@sasjs/cli 6.27.0 → 6.27.2

package/build/commands/build/internal/mockSite/assets/sw.js

@@ -457,7 +457,48 @@ const transcriptFor = async (programPath) => {
   return undefined
 }
 
+/**
+ * The program a Studio code run came from, from the line the interface puts in
+ * front of the buffer.
+ *
+ * Run in Studio posts the buffer to `/SASjsApi/code/execute` - not the file's
+ * path - and the interface prepends `%let _program = <path>;` (its
+ * `programPathInjection`) so a program can still see where it lives. That line is
+ * the only thing in such a request that names the file, and it is what lets the
+ * recording answer a Press Run on the program it recorded.
+ *
+ * The line is written whatever was sent - the whole buffer or a selection of it -
+ * so the recording answers the program its path names, and a visitor who edits
+ * the code before pressing Run still sees the session recorded for that file. A
+ * browser cannot run SAS at all, so the alternative is a refusal for every SAS
+ * run; the demo's program says what it is, and its comment says where the answer
+ * comes from.
+ */
+const recordedProgramIn = (code, runTime) => {
+  if (String(runTime || '').toLowerCase() !== 'sas') return undefined
+
+  // anchored: the interface writes the line FIRST (`%let _program = ${path};\n`
+  // + the buffer), so a `%let _program` further down is the program's own code -
+  // a stored program that sets it deliberately, or a datalines row that looks
+  // like it - and is not what this host answers. Without the anchor, a caller's
+  // own SAS program could name the recorded file and be handed its session.
+  const match = /^\s*%let\s+_program\s*=\s*([^;]+);/i.exec(String(code || ''))
+
+  return match ? match[1].trim() : undefined
+}
+
 // ---------------------------------------------------------------- the runner
+/**
+ * What a SAS run this host cannot answer is told.
+ *
+ * `sas` is one of the host's run times, so the message must not claim the run
+ * time is missing: what is missing is the binary, because this is a browser. It
+ * names the one thing that does answer SAS here, so a reader whose program is
+ * refused knows why the demo's own program is not.
+ */
+const SAS_UNAVAILABLE =
+  'SAS is not available on this host: a browser has no SAS binary, and this demo answers only the program it ships a recorded session of.'
+
 /**
  * The work a run does, over the browser's drive.
  *
@@ -477,17 +518,19 @@ class BrowserRuntime extends API.MemorySessionHost {
     const program = request.program || {}
     const params = Object.assign({}, request.vars || {})
 
-    // A SAS program the recording does not name. This host has no SAS binary, so
-    // the answer is the refusal a client already understands - not a JavaScript
-    // SyntaxError quoting the SAS source, which is what handing it to the runner
-    // would produce. The file is resolved because the request may name the
-    // program without its extension.
-    if (program.code === undefined) {
-      const resolved = R.resolveProgram(program.path)
+    // SAS never reaches the runner. `sas` is one of this host's run times - the
+    // recording answers the program it names - but the answer for anything else
+    // is the refusal a client already understands, not a JavaScript SyntaxError
+    // quoting the SAS source, which is what handing it to the runner would
+    // produce. The file is resolved because the request may name the program
+    // without its extension.
+    const resolved =
+      program.code === undefined ? R.resolveProgram(program.path) : undefined
+    const isSas =
+      String(request.runTime || '').toLowerCase() === 'sas' ||
+      Boolean(resolved && /\.sas$/i.test(resolved))
 
-      if (resolved && /\.sas$/i.test(resolved))
-        throw runFailure('"runTime" must be one of [js]')
-    }
+    if (isSas) throw runFailure(SAS_UNAVAILABLE)
 
     const payload = { params, tables: tablesOf(request.files) }
     if (program.code !== undefined) payload.code = program.code
@@ -580,6 +623,23 @@ const withoutBase = (pathname) =>
     ? pathname.slice(BASE.length) || '/'
     : pathname
 
+// ------------------------------------------------------------- what it can run
+/**
+ * The run times this host answers, in the order a client should try them.
+ *
+ * `js` is executed here, in the page's own JavaScript engine. `sas` is answered
+ * from the recorded session (`host/sas-transcript.json`) for the one program the
+ * recording names; any other SAS program is refused by `SAS_UNAVAILABLE`, which
+ * names the missing binary rather than a missing run time - a browser has none.
+ *
+ * Both the `/SASjsApi/info` answer and the runtime service read this list, so the
+ * run times the host states and the ones its service accepts cannot drift apart.
+ * `sas` is stated because that is what offers Run on a `.sas` file at all; a
+ * program the recording does not name is then refused with its reason, not by the
+ * run time being absent from a list the host publishes.
+ */
+const RUN_TIMES = ['js', 'sas']
+
 // ------------------------------------------------------------- host reports
 // The Admin routes ask a host what it is doing. A browser has no process, but it
 // does have a page, a heap and this worker's own activity, so the reports are
@@ -626,7 +686,7 @@ const adminReports = {
         cpuCount: navigator.hardwareConcurrency || 1,
         cpuModel: 'unknown',
         loadAverage: [],
-        runTimes: ['js', 'sas'],
+        runTimes: RUN_TIMES,
         sasjsRoot: '/'
       },
       memory: {
@@ -772,16 +832,21 @@ const homeService = API.createHomeService(async () => {
 
 const SERVICES = {
   drive: API.createDriveService(DRIVE_STORE),
-  info: API.createInfoService(API.BROWSER_INFO),
+  // The package's browser fixture states one run time; this host serves two, and
+  // `info` is what the Studio reads to decide whether a file may be run at all,
+  // so the answer is the host's own list rather than the fixture's.
+  info: API.createInfoService(
+    Object.assign({}, API.BROWSER_INFO, { runTimes: RUN_TIMES })
+  ),
   identity: IDENTITY,
   records: RECORDS,
   runtime: API.createRuntimeService(IDENTITY_STORE, RUNTIME, {
-    // `js` is executed here; `sas` is offered so a SAS program can be run at all
-    // in the demo, and answered from the recording when one names it. A `.sas`
-    // program with no recording is refused in the runner, deliberately - it must
-    // not be handed to the JavaScript runtime as source, which is what the
-    // resolveProgram guard in BrowserRuntime.run prevents.
-    runTimes: ['js', 'sas']
+    // `js` is executed here; `sas` is offered because the recording answers the
+    // program it names, and the Studio offers Run on a `.sas` file only for a run
+    // time the host states. A `.sas` program with no recording is refused in the
+    // runner, deliberately - it must not be handed to the JavaScript runtime as
+    // source, which is what the guard in BrowserRuntime.run prevents.
+    runTimes: RUN_TIMES
   }),
   session: API.createSessionService(IDENTITY_STORE, RUNTIME),
   authConfig: API.createAuthConfigService({}),
@@ -1146,15 +1211,17 @@ const runRoute = async (routeId, payload, subject) => {
     runRequest.program = query._program || body._program
   }
 
-  // A recorded SAS session is answered here, ahead of the run time check: a
-  // transcript is data, not a run time, and this host holds only `js`. Accepting
-  // `sas` instead would make the package compile SAS source as JavaScript and
-  // hand back a SyntaxError where every other .sas program gets a refusal.
-  // Neither a code run nor a trigger: a trigger has to answer with the session
-  // record the route builds, which a client parses as JSON, so a recording is not
-  // an answer there.
-  if (!code && !trigger) {
-    const recording = await transcriptFor(runRequest.program)
+  // A recorded SAS session is answered here, ahead of the run. `sas` IS one of
+  // this host's run times - it is what the Studio reads to offer Run on a .sas
+  // file - and the recording is how it is answered, so the check comes before
+  // the package would compile the source as JavaScript. A trigger is excluded:
+  // it has to answer with the session record the route builds, which a client
+  // parses as JSON, so a recording is not an answer there.
+  if (!trigger) {
+    const recorded = code
+      ? recordedProgramIn(body.code, body.runTime)
+      : runRequest.program
+    const recording = recorded ? await transcriptFor(recorded) : undefined
 
     if (recording)
       return artifactResponse(
@@ -1168,7 +1235,10 @@ const runRoute = async (routeId, payload, subject) => {
             // the same rule runtime-core applies to a service that declares none
             headers: SEEDED_HEADER_LINE
           },
-          vars._debug !== undefined
+          // a code run carries no `_debug` and still answers with its log: the
+          // package compiles a code run at its own debug level, and the Studio
+          // splits the three parts on the separator it writes
+          code ? true : vars._debug !== undefined
         )
       )
   }
@@ -1357,12 +1427,14 @@ const routeRequest = async (request, url) => {
 
     if (!refusal) broadcast({ type: 'sasjs-host-error', path, message })
     // A refusal the API decided on carries its status and, where the route
-    // answers an envelope, the body to send. The drive's routes send the message
-    // itself as plain text - the server answers them with `res.status(code)
-    // .send(err.message)` - so those stay text; everything else keeps the JSON
-    // envelope the other routes already answer with.
+    // answers an envelope, the body to send. The deploy routes state one in the
+    // document - a refusal there is `{status: 'failure', message}` - while the
+    // other drive routes send the message itself as plain text, which is what the
+    // server's `res.status(code).send(err.message)` does.
     if (API.isApiError(e)) {
       if (e.body !== undefined) return json(e.body, e.status)
+      if (/\/SASjsApi\/drive\/deploy(\/|$)/.test(apiPath))
+        return json({ status: 'failure', message: e.message }, e.status)
       if (apiPath.includes('/SASjsApi/drive/')) return text(e.message, e.status)
       return json({ message: e.message }, e.status)
     }

package/build/commands/build/internal/mockSite/spec/sw.spec.js

@@ -90,6 +90,7 @@ var path_1 = __importDefault(require("path"));
 var api_1 = require("@sasjs/api");
 var os_1 = __importDefault(require("os"));
 var yazl_1 = __importDefault(require("yazl"));
+var utils_1 = require("@sasjs/utils");
 var mockSite_1 = require("../mockSite");
 /**
  * The other half of the parity claim: the service worker is what turns an
@@ -122,8 +123,9 @@ var lintBundle = function () {
     }
     return lintBundlePath;
 };
-var loadWorker = function (base) {
+var loadWorker = function (base, options) {
     if (base === void 0) { base = ''; }
+    if (options === void 0) { options = {}; }
     jest.resetModules();
     var handlers = {};
     var refusingWrites = false;
@@ -205,6 +207,22 @@ var loadWorker = function (base) {
                 fixture = global.__sasTranscript;
                 return [2 /*return*/, fixture ? jsonResponse(fixture) : new Response('', { status: 404 })];
             }
+            // the webout() block the build writes beside the worker, from the same
+            // @sasjs/utils generator sasjs/server uses. Absent unless a test asks for
+            // it: a site built before the block existed keeps the `_webout`-only path.
+            if (options.prelude && target.includes('webout-prelude'))
+                return [2 /*return*/, jsonResponse({
+                        sentinels: mockSite_1.WEBOUT_SENTINELS,
+                        template: (0, utils_1.getWeboutPrelude)({
+                            weboutPath: mockSite_1.WEBOUT_SENTINELS.weboutPath,
+                            headersPath: mockSite_1.WEBOUT_SENTINELS.headersPath,
+                            program: mockSite_1.WEBOUT_SENTINELS.program,
+                            debug: mockSite_1.WEBOUT_SENTINELS.debug,
+                            username: mockSite_1.WEBOUT_SENTINELS.username,
+                            userId: mockSite_1.WEBOUT_SENTINELS.userId,
+                            apiServerUrl: mockSite_1.WEBOUT_SENTINELS.apiServerUrl
+                        })
+                    })];
             return [2 /*return*/, target.includes('vfs-seed')
                     ? jsonResponse({
                         files: (_a = {},
@@ -260,7 +278,8 @@ var jsonResponse = function (body) { return ({
         return [2 /*return*/, body];
     }); }); }
 }); };
-/** A zip archive of text members, written the way a deploy upload ships one.
+/** A zip archive of members - text, or bytes for a base64 member - written the way
+ * a deploy upload ships one.
  * The first member is stored rather than deflated, so both methods the reader
  * accepts are exercised by the one case. */
 var zipOf = function (files) {
@@ -392,6 +411,164 @@ describe('service worker host', function () {
             }
         });
     }); });
+    it('runs a JS program written the way sasjs/server runs one', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var worker, response, body, _a, _b;
+        var _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    worker = loadWorker('', { prelude: true });
+                    worker.runtime.load((_c = {},
+                        _c[drivePath('services/public/run.js')] = [
+                            "const rows = [{ name: 'Alice', age: 14 }, { name: 'Bob', age: 15 }]",
+                            'console.log(`Read ${rows.length} rows`)',
+                            "webout('OPEN')",
+                            "webout('OBJ', 'adults', rows.filter((row) => row.age > 13))",
+                            "webout('CLOSE')"
+                        ].join('\n'),
+                        _c));
+                    return [4 /*yield*/, worker.dispatch('/SASjsApi/stp/execute?_program=' +
+                            encodeURIComponent("".concat(appLoc, "/services/public/run")))];
+                case 1:
+                    response = _d.sent();
+                    expect(response.status).toBe(200);
+                    _b = (_a = JSON).parse;
+                    return [4 /*yield*/, response.text()];
+                case 2:
+                    body = _b.apply(_a, [_d.sent()]);
+                    expect(body.adults).toEqual([
+                        { name: 'Alice', age: 14 },
+                        { name: 'Bob', age: 15 }
+                    ]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('answers a Run in Studio on the recorded program, as a code run', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var worker, response, parts;
+        var _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    // Press Run in Studio posts the buffer to /code/execute with the file's own
+                    // path prepended as `%let _program` - the path is not a query parameter, as
+                    // it is for stp/execute. The recording is what answers it: without this the
+                    // demo's .sas program has a Run button (the host states `sas`) and no way to
+                    // answer it, because a browser cannot compile SAS.
+                    ;
+                    global.__sasTranscript = (_a = {},
+                        _a["".concat(appLoc, "/services/public/program.sas")] = {
+                            webout: '{"SYSSITE":"00000000"}',
+                            log: 'NOTE: recorded',
+                            print: 'The SAS System'
+                        },
+                        _a);
+                    worker = loadWorker();
+                    worker.runtime.load((_b = {},
+                        _b[drivePath('services/public/program.sas')] = 'data work.class; run;',
+                        _b));
+                    return [4 /*yield*/, worker.dispatch('/SASjsApi/code/execute', runRequest({
+                            code: "%let _program = ".concat(appLoc, "/services/public/program.sas;\ndata work.class; run;"),
+                            runTime: 'sas'
+                        }))];
+                case 1:
+                    response = _c.sent();
+                    expect(response.status).toBe(200);
+                    return [4 /*yield*/, response.text()];
+                case 2:
+                    parts = (_c.sent()).split(LOGS_SEPARATOR);
+                    expect(parts[0].trim()).toBe('{"SYSSITE":"00000000"}');
+                    expect(parts[1]).toContain('NOTE: recorded');
+                    expect(parts[2]).toContain('The SAS System');
+                    delete global.__sasTranscript;
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('answers only the line the interface writes, not one further down', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var worker, response, _a;
+        var _b, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    // The interface puts `%let _program` first; a line further down belongs to
+                    // the program. Answered, it would hand a caller's own SAS program the session
+                    // recorded for another file - the "inventing a session" the refusal exists to
+                    // avoid, with a different file's log.
+                    ;
+                    global.__sasTranscript = (_b = {},
+                        _b["".concat(appLoc, "/services/public/program.sas")] = {
+                            webout: '{"SYSSITE":"00000000"}',
+                            log: 'NOTE: recorded',
+                            print: 'The SAS System'
+                        },
+                        _b);
+                    worker = loadWorker();
+                    worker.runtime.load((_c = {},
+                        _c[drivePath('services/public/mine.sas')] = 'data work.class; run;',
+                        _c));
+                    return [4 /*yield*/, worker.dispatch('/SASjsApi/code/execute', runRequest({
+                            code: "data _null_;\n%let _program = ".concat(appLoc, "/services/public/program.sas;\nrun;"),
+                            runTime: 'sas'
+                        }))];
+                case 1:
+                    response = _d.sent();
+                    expect(response.status).toBe(400);
+                    _a = expect;
+                    return [4 /*yield*/, response.text()];
+                case 2:
+                    _a.apply(void 0, [_d.sent()]).toContain('SAS is not available');
+                    delete global.__sasTranscript;
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('refuses SAS code that names no recorded program', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var worker, _a, _b, code, response, body, e_1_1;
+        var e_1, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    worker = loadWorker();
+                    _d.label = 1;
+                case 1:
+                    _d.trys.push([1, 7, 8, 9]);
+                    _a = __values([
+                        'data work.class; run;',
+                        "%let _program = ".concat(appLoc, "/services/public/other.sas;\ndata work.class; run;")
+                    ]), _b = _a.next();
+                    _d.label = 2;
+                case 2:
+                    if (!!_b.done) return [3 /*break*/, 6];
+                    code = _b.value;
+                    return [4 /*yield*/, worker.dispatch('/SASjsApi/code/execute', runRequest({ code: code, runTime: 'sas' }))];
+                case 3:
+                    response = _d.sent();
+                    expect(response.status).toBe(400);
+                    return [4 /*yield*/, response.text()];
+                case 4:
+                    body = _d.sent();
+                    expect(body).toContain('SAS is not available');
+                    expect(body).not.toContain('SyntaxError');
+                    _d.label = 5;
+                case 5:
+                    _b = _a.next();
+                    return [3 /*break*/, 2];
+                case 6: return [3 /*break*/, 9];
+                case 7:
+                    e_1_1 = _d.sent();
+                    e_1 = { error: e_1_1 };
+                    return [3 /*break*/, 9];
+                case 8:
+                    try {
+                        if (_b && !_b.done && (_c = _a.return)) _c.call(_a);
+                    }
+                    finally { if (e_1) throw e_1.error; }
+                    return [7 /*endfinally*/];
+                case 9: return [2 /*return*/];
+            }
+        });
+    }); });
     it('refuses a .sas program no recording names, as it always did', function () { return __awaiter(void 0, void 0, void 0, function () {
         var worker, response, body;
         var _a;
@@ -410,7 +587,8 @@ describe('service worker host', function () {
                     return [4 /*yield*/, response.text()];
                 case 2:
                     body = _b.sent();
-                    expect(body).toContain('runTime');
+                    expect(body).toContain('SAS is not available');
+                    expect(body).toContain('recorded session');
                     expect(body).not.toContain('SyntaxError');
                     return [2 /*return*/];
             }
@@ -1266,10 +1444,17 @@ describe('service worker host', function () {
                     case 1:
                         empty = _c.sent();
                         expect(empty.status).toBe(400);
+                        // the deploy routes answer a refusal as the envelope the document states for
+                        // them, which is what the corpus pins for the same route
                         _a = expect;
-                        return [4 /*yield*/, empty.text()];
+                        return [4 /*yield*/, empty.json()];
                     case 2:
-                        _a.apply(void 0, [_c.sent()]).toBe('"file" is not present.');
+                        // the deploy routes answer a refusal as the envelope the document states for
+                        // them, which is what the corpus pins for the same route
+                        _a.apply(void 0, [_c.sent()]).toEqual({
+                            status: 'failure',
+                            message: '"file" is not present.'
+                        });
                         form = new FormData();
                         form.set('file', new Blob([new Uint8Array([1, 2, 3])]), 'not-a-zip.zip');
                         return [4 /*yield*/, dispatch('/SASjsApi/drive/deploy/upload', {
@@ -1280,9 +1465,12 @@ describe('service worker host', function () {
                         notZip = _c.sent();
                         expect(notZip.status).toBe(400);
                         _b = expect;
-                        return [4 /*yield*/, notZip.text()];
+                        return [4 /*yield*/, notZip.json()];
                     case 4:
-                        _b.apply(void 0, [_c.sent()]).toBe('The archive is not a zip file.');
+                        _b.apply(void 0, [_c.sent()]).toEqual({
+                            status: 'failure',
+                            message: 'The archive is not a zip file.'
+                        });
                         return [2 /*return*/];
                 }
             });
@@ -1536,8 +1724,8 @@ describe('service worker host', function () {
         });
     }); });
     it('publishes, lists, serves and removes an app through the package surface', function () { return __awaiter(void 0, void 0, void 0, function () {
-        var dispatch, _a, _b, path_2, listing, _c, e_1_1, _d, _e, path_3, landing, e_2_1, root, archive, form, published, app, _f, _g, path_4, listing, _h, e_3_1, _j, _k, path_5, page, _l, e_4_1, folder, _m, refused, missing, removed, _o, after, _p, gone;
-        var e_1, _q, e_2, _r, e_3, _s, e_4, _t;
+        var dispatch, _a, _b, path_2, listing, _c, e_2_1, _d, _e, path_3, landing, e_3_1, root, archive, form, published, app, _f, _g, path_4, listing, _h, e_4_1, _j, _k, path_5, page, _l, e_5_1, folder, _m, refused, missing, removed, _o, after, _p, gone;
+        var e_2, _q, e_3, _r, e_4, _s, e_5, _t;
         return __generator(this, function (_u) {
             switch (_u.label) {
                 case 0:
@@ -1564,14 +1752,14 @@ describe('service worker host', function () {
                     return [3 /*break*/, 2];
                 case 6: return [3 /*break*/, 9];
                 case 7:
-                    e_1_1 = _u.sent();
-                    e_1 = { error: e_1_1 };
+                    e_2_1 = _u.sent();
+                    e_2 = { error: e_2_1 };
                     return [3 /*break*/, 9];
                 case 8:
                     try {
                         if (_b && !_b.done && (_q = _a.return)) _q.call(_a);
                     }
-                    finally { if (e_1) throw e_1.error; }
+                    finally { if (e_2) throw e_2.error; }
                     return [7 /*endfinally*/];
                 case 9:
                     _u.trys.push([9, 14, 15, 16]);
@@ -1591,14 +1779,14 @@ describe('service worker host', function () {
                     return [3 /*break*/, 10];
                 case 13: return [3 /*break*/, 16];
                 case 14:
-                    e_2_1 = _u.sent();
-                    e_2 = { error: e_2_1 };
+                    e_3_1 = _u.sent();
+                    e_3 = { error: e_3_1 };
                     return [3 /*break*/, 16];
                 case 15:
                     try {
                         if (_e && !_e.done && (_r = _d.return)) _r.call(_d);
                     }
-                    finally { if (e_2) throw e_2.error; }
+                    finally { if (e_3) throw e_3.error; }
                     return [7 /*endfinally*/];
                 case 16: return [4 /*yield*/, dispatch('/AppStream')];
                 case 17:
@@ -1651,14 +1839,14 @@ describe('service worker host', function () {
                     return [3 /*break*/, 22];
                 case 26: return [3 /*break*/, 29];
                 case 27:
-                    e_3_1 = _u.sent();
-                    e_3 = { error: e_3_1 };
+                    e_4_1 = _u.sent();
+                    e_4 = { error: e_4_1 };
                     return [3 /*break*/, 29];
                 case 28:
                     try {
                         if (_g && !_g.done && (_s = _f.return)) _s.call(_f);
                     }
-                    finally { if (e_3) throw e_3.error; }
+                    finally { if (e_4) throw e_4.error; }
                     return [7 /*endfinally*/];
                 case 29:
                     _u.trys.push([29, 35, 36, 37]);
@@ -1685,14 +1873,14 @@ describe('service worker host', function () {
                     return [3 /*break*/, 30];
                 case 34: return [3 /*break*/, 37];
                 case 35:
-                    e_4_1 = _u.sent();
-                    e_4 = { error: e_4_1 };
+                    e_5_1 = _u.sent();
+                    e_5 = { error: e_5_1 };
                     return [3 /*break*/, 37];
                 case 36:
                     try {
                         if (_k && !_k.done && (_t = _j.return)) _t.call(_j);
                     }
-                    finally { if (e_4) throw e_4.error; }
+                    finally { if (e_5) throw e_5.error; }
                     return [7 /*endfinally*/];
                 case 37: return [4 /*yield*/, dispatch("/app/".concat(app.id))];
                 case 38:
@@ -1995,30 +2183,33 @@ describe('service worker host', function () {
                 case 0:
                     dispatch = seeded().dispatch;
                     return [4 /*yield*/, dispatch('/SASjsApi/info')
-                        // the documented body, field for field, in the values @sasjs/api's
-                        // BROWSER_INFO states: a property the document does not state, or a login
-                        // form told there are accounts when there are none, is this host describing
-                        // an API the server does not serve
+                        // the documented body, field for field: a property the document does not
+                        // state, or a login form told there are accounts when there are none, is
+                        // this host describing an API the server does not serve. `runTimes` is the
+                        // host's own, not the package's browser fixture: `sas` is what makes the
+                        // Studio offer Run on a .sas file, and the recording is how it is answered.
                     ];
                 case 1:
                     info = _f.sent();
-                    // the documented body, field for field, in the values @sasjs/api's
-                    // BROWSER_INFO states: a property the document does not state, or a login
-                    // form told there are accounts when there are none, is this host describing
-                    // an API the server does not serve
+                    // the documented body, field for field: a property the document does not
+                    // state, or a login form told there are accounts when there are none, is
+                    // this host describing an API the server does not serve. `runTimes` is the
+                    // host's own, not the package's browser fixture: `sas` is what makes the
+                    // Studio offer Run on a .sas file, and the recording is how it is answered.
                     _a = expect;
                     return [4 /*yield*/, info.json()];
                 case 2:
-                    // the documented body, field for field, in the values @sasjs/api's
-                    // BROWSER_INFO states: a property the document does not state, or a login
-                    // form told there are accounts when there are none, is this host describing
-                    // an API the server does not serve
+                    // the documented body, field for field: a property the document does not
+                    // state, or a login form told there are accounts when there are none, is
+                    // this host describing an API the server does not serve. `runTimes` is the
+                    // host's own, not the package's browser fixture: `sas` is what makes the
+                    // Studio offer Run on a .sas file, and the recording is how it is answered.
                     _a.apply(void 0, [_f.sent()]).toEqual({
                         mode: 'desktop',
                         cors: 'disable',
                         httpPort: null,
                         httpsPort: null,
-                        runTimes: ['js'],
+                        runTimes: ['js', 'sas'],
                         authProviders: [],
                         localLoginEnabled: false,
                         version: 'dev'
@@ -2631,7 +2822,7 @@ describe('service worker host', function () {
         }); });
     });
     describe('conformance corpus', function () {
-        var e_5, _a;
+        var e_6, _a, e_7, _b;
         /**
          * The corpus is what "the same API" means: the cases @sasjs/api runs against
          * its own services, and against a live sasjs/server, run here against this
@@ -2640,7 +2831,7 @@ describe('service worker host', function () {
          * used to have - and it is a test rather than a review.
          */
         var httpFor = function (testCase) {
-            var e_6, _a;
+            var e_8, _a;
             var _b;
             var _c = __read(testCase.route.split(' '), 2), method = _c[0], routePath = _c[1];
             var query = new URLSearchParams();
@@ -2651,12 +2842,12 @@ describe('service worker host', function () {
                         query.set(key, String(value));
                 }
             }
-            catch (e_6_1) { e_6 = { error: e_6_1 }; }
+            catch (e_8_1) { e_8 = { error: e_8_1 }; }
             finally {
                 try {
                     if (_e && !_e.done && (_a = _d.return)) _a.call(_d);
                 }
-                finally { if (e_6) throw e_6.error; }
+                finally { if (e_8) throw e_8.error; }
             }
             var suffix = query.toString() ? "?".concat(query) : '';
             var init = { method: method };
@@ -2687,8 +2878,8 @@ describe('service worker host', function () {
          * does.
          */
         var seedDrive = function (runtime, testCase) { return __awaiter(void 0, void 0, void 0, function () {
-            var text, _a, _b, _c, file, contents, _d, _e, _f, file, contents, e_7_1;
-            var e_8, _g, e_7, _h;
+            var text, _a, _b, _c, file, contents, _d, _e, _f, file, contents, e_9_1;
+            var e_10, _g, e_9, _h;
             return __generator(this, function (_j) {
                 switch (_j.label) {
                     case 0:
@@ -2700,12 +2891,12 @@ describe('service worker host', function () {
                                     text["/sasjs/drive/files".concat(file)] = contents;
                             }
                         }
-                        catch (e_8_1) { e_8 = { error: e_8_1 }; }
+                        catch (e_10_1) { e_10 = { error: e_10_1 }; }
                         finally {
                             try {
                                 if (_b && !_b.done && (_g = _a.return)) _g.call(_a);
                             }
-                            finally { if (e_8) throw e_8.error; }
+                            finally { if (e_10) throw e_10.error; }
                         }
                         return [4 /*yield*/, runtime.load(text)];
                     case 1:
@@ -2728,87 +2919,393 @@ describe('service worker host', function () {
                         return [3 /*break*/, 3];
                     case 6: return [3 /*break*/, 9];
                     case 7:
-                        e_7_1 = _j.sent();
-                        e_7 = { error: e_7_1 };
+                        e_9_1 = _j.sent();
+                        e_9 = { error: e_9_1 };
                         return [3 /*break*/, 9];
                     case 8:
                         try {
                             if (_e && !_e.done && (_h = _d.return)) _h.call(_d);
                         }
-                        finally { if (e_7) throw e_7.error; }
+                        finally { if (e_9) throw e_9.error; }
                         return [7 /*endfinally*/];
                     case 9: return [2 /*return*/];
                 }
             });
         }); };
+        /**
+         * The expectation kinds this harness asserts.
+         *
+         * A case that states one it does not implement fails rather than passing
+         * unproven - `keys`, `shape` and `encoding` are asserted by the package's own
+         * corpus run and not here, and a case that starts using them has to be told
+         * so by this list rather than by silence.
+         */
+        var ASSERTED = ['status', 'error', 'partial', 'body', 'contents'];
+        var assertExpectations = function (response, testCase) { return __awaiter(void 0, void 0, void 0, function () {
+            var unasserted, bytes, _a, _b, text, _c, isJson, body;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        unasserted = Object.keys(testCase.expect).filter(function (kind) { return !ASSERTED.includes(kind); });
+                        if (unasserted.length)
+                            throw new Error("".concat(testCase.id, ": this harness does not assert ").concat(unasserted.join(', ')));
+                        expect(response.status).toBe(testCase.expect.status);
+                        if (!(testCase.expect.contents instanceof Uint8Array)) return [3 /*break*/, 2];
+                        _b = Uint8Array.bind;
+                        return [4 /*yield*/, response.arrayBuffer()];
+                    case 1:
+                        _a = new (_b.apply(Uint8Array, [void 0, _d.sent()]))();
+                        return [3 /*break*/, 3];
+                    case 2:
+                        _a = undefined;
+                        _d.label = 3;
+                    case 3:
+                        bytes = _a;
+                        if (!(bytes === undefined)) return [3 /*break*/, 5];
+                        return [4 /*yield*/, response.text()];
+                    case 4:
+                        _c = _d.sent();
+                        return [3 /*break*/, 6];
+                    case 5:
+                        _c = undefined;
+                        _d.label = 6;
+                    case 6:
+                        text = _c;
+                        isJson = (response.headers.get('content-type') || '').includes('application/json');
+                        if (testCase.expect.error !== undefined) {
+                            // the routes that answer an envelope - the two deploy routes - send
+                            // `{status, message}`; the rest send the message itself as text, which is
+                            // what the server's `res.status(code).send(err.message)` does
+                            if (isJson) {
+                                body = JSON.parse(text);
+                                expect(body.message).toBe(testCase.expect.error);
+                                // a refusal that states the envelope it expects is compared on the whole
+                                // of it, not only on the message
+                                if (testCase.expect.body !== undefined)
+                                    expect(body).toEqual(testCase.expect.body);
+                            }
+                            else {
+                                // a case cannot state an envelope and be answered with text: one of the
+                                // two is wrong, and silence would hide which
+                                if (testCase.expect.body !== undefined)
+                                    throw new Error("".concat(testCase.id, ": the answer is text, so its body cannot be asserted"));
+                                expect(text).toBe(testCase.expect.error);
+                            }
+                            return [2 /*return*/];
+                        }
+                        if (testCase.expect.contents !== undefined) {
+                            if (bytes !== undefined)
+                                expect(bytes).toEqual(testCase.expect.contents);
+                            else
+                                expect(text).toEqual(testCase.expect.contents);
+                            return [2 /*return*/];
+                        }
+                        if (testCase.expect.body !== undefined)
+                            expect(JSON.parse(text)).toEqual(testCase.expect.body);
+                        if (testCase.expect.partial !== undefined)
+                            expect(JSON.parse(text)).toMatchObject(testCase.expect.partial);
+                        return [2 /*return*/];
+                }
+            });
+        }); };
         var _loop_1 = function (testCase) {
             it(testCase.id, function () { return __awaiter(void 0, void 0, void 0, function () {
-                var worker, _a, requestPath, init, response, body, want, _b, _c, _d;
-                return __generator(this, function (_e) {
-                    switch (_e.label) {
+                var worker, _a, requestPath, init, response;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0:
                             worker = loadWorker();
                             return [4 /*yield*/, seedDrive(worker.runtime, testCase)];
                         case 1:
-                            _e.sent();
+                            _b.sent();
                             worker.refuseWrites(Boolean(testCase.unwritable));
                             _a = httpFor(testCase), requestPath = _a.path, init = _a.init;
                             return [4 /*yield*/, worker.dispatch(requestPath, init)];
                         case 2:
-                            response = _e.sent();
-                            expect(response.status).toBe(testCase.expect.status);
-                            if (!(testCase.expect.error !== undefined)) return [3 /*break*/, 4];
-                            return [4 /*yield*/, response.text()
-                                // the routes that answer an envelope - the two deploy routes - send
-                                // `{status, message}`; the rest send the message itself as text, which
-                                // is what the server's `res.status(code).send(err.message)` does
-                            ];
+                            response = _b.sent();
+                            return [4 /*yield*/, assertExpectations(response, testCase)];
                         case 3:
-                            body = _e.sent();
-                            // the routes that answer an envelope - the two deploy routes - send
-                            // `{status, message}`; the rest send the message itself as text, which
-                            // is what the server's `res.status(code).send(err.message)` does
-                            if ((response.headers.get('content-type') || '').includes('application/json'))
-                                expect(JSON.parse(body)).toEqual({
-                                    status: 'failure',
-                                    message: testCase.expect.error
-                                });
+                            _b.sent();
+                            return [2 /*return*/];
+                    }
+                });
+            }); });
+        };
+        try {
+            for (var DRIVE_CORPUS_1 = __values(api_1.DRIVE_CORPUS), DRIVE_CORPUS_1_1 = DRIVE_CORPUS_1.next(); !DRIVE_CORPUS_1_1.done; DRIVE_CORPUS_1_1 = DRIVE_CORPUS_1.next()) {
+                var testCase = DRIVE_CORPUS_1_1.value;
+                _loop_1(testCase);
+            }
+        }
+        catch (e_6_1) { e_6 = { error: e_6_1 }; }
+        finally {
+            try {
+                if (DRIVE_CORPUS_1_1 && !DRIVE_CORPUS_1_1.done && (_a = DRIVE_CORPUS_1.return)) _a.call(DRIVE_CORPUS_1);
+            }
+            finally { if (e_6) throw e_6.error; }
+        }
+        /** The app a removal case names, as the corpus states it. */
+        var CORPUS_APP = {
+            appLoc: '/Public/myApp',
+            streamWebFolder: 'web',
+            publishedAt: '2026-01-01T00:00:00.000Z'
+        };
+        /**
+         * A second app that no removal case names.
+         *
+         * Without it, a removal that ignored the id and deleted whatever was
+         * published would pass both removal cases - the unknown-id one sees an empty
+         * index either way. With it, the assertion after the answer is that the app
+         * the id did *not* name is still listed.
+         */
+        var BYSTANDER = {
+            id: '0b9a1c2d-3e4f-4a5b-8c6d-7e8f9a0b1c2d',
+            name: 'bystander',
+            appLoc: '/Public/bystander',
+            streamWebFolder: 'web',
+            publishedAt: '2026-01-01T00:00:00.000Z'
+        };
+        /**
+         * The index a removal case starts from - built from the id the case asks to
+         * remove, not from the answer it expects, so a host that removed some other
+         * app would answer a different id and fail.
+         */
+        var seedIndex = function (runtime, testCase) { return __awaiter(void 0, void 0, void 0, function () {
+            var id, named, entries;
+            var _a, _b, _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        if (testCase.route !== 'DELETE /SASjsApi/drive/deploy')
+                            return [2 /*return*/];
+                        id = (_a = testCase.request.body) === null || _a === void 0 ? void 0 : _a.id;
+                        named = (_b = testCase.expect.partial) === null || _b === void 0 ? void 0 : _b.app;
+                        entries = [BYSTANDER];
+                        // the app the case expects to remove is published only when the case names
+                        // the id it removes: the unknown-id case asks for one that is not there, and
+                        // publishing it would make that case pass by accident. It goes in *after* the
+                        // bystander, so a removal that takes the first entry rather than the named
+                        // one removes the bystander and both assertions below fail.
+                        if (id !== undefined && (named === null || named === void 0 ? void 0 : named.id) === id)
+                            entries.push(__assign({ id: id, name: (_c = named.name) !== null && _c !== void 0 ? _c : 'myApp' }, CORPUS_APP));
+                        return [4 /*yield*/, runtime.load({
+                                '/sasjs/drive/files/.sasjs/apps.json': JSON.stringify(entries)
+                            })];
+                    case 1:
+                        _d.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); };
+        /**
+         * The archive a client uploads, built from the tree the case states.
+         *
+         * The corpus is transport-agnostic: an upload case gives the tree the archive
+         * has to expand to, and the folder in the query where the document puts it.
+         * This host takes an archive, so the harness makes one - which is the only way
+         * the mock's own expansion, and the tree it produces, gets exercised by the
+         * cases that describe it.
+         */
+        var archiveOf = function (tree) { return __awaiter(void 0, void 0, void 0, function () {
+            var files, walk;
+            return __generator(this, function (_a) {
+                files = {};
+                walk = function (members, prefix) {
+                    var e_11, _a;
+                    var _b;
+                    try {
+                        for (var _c = __values(members || []), _d = _c.next(); !_d.done; _d = _c.next()) {
+                            var member = _d.value;
+                            var at = prefix ? "".concat(prefix, "/").concat(member.name) : member.name;
+                            if (member.type === 'folder')
+                                walk(member.members, at);
                             else
-                                expect(body).toBe(testCase.expect.error);
-                            return [3 /*break*/, 8];
+                                files[at] =
+                                    member.encoding === 'base64'
+                                        ? new Uint8Array(Buffer.from(String(member.code), 'base64'))
+                                        : String((_b = member.code) !== null && _b !== void 0 ? _b : '');
+                        }
+                    }
+                    catch (e_11_1) { e_11 = { error: e_11_1 }; }
+                    finally {
+                        try {
+                            if (_d && !_d.done && (_a = _c.return)) _a.call(_c);
+                        }
+                        finally { if (e_11) throw e_11.error; }
+                    }
+                };
+                walk(tree === null || tree === void 0 ? void 0 : tree.members, '');
+                return [2 /*return*/, zipOf(files)];
+            });
+        }); };
+        /**
+         * The request a deploy case describes, as HTTP.
+         *
+         * The JSON and removal routes carry their fields as they are stated. The upload
+         * route's body is an archive, so the tree becomes one and the fields the case
+         * states beside it travel as form fields - a host's multipart body, with the
+         * folder also in the query where the document puts it.
+         */
+        var deployRequest = function (testCase) { return __awaiter(void 0, void 0, void 0, function () {
+            var _a, requestPath, init, body, archive, form, _b, _c, _d, field, value;
+            var e_12, _e;
+            return __generator(this, function (_f) {
+                switch (_f.label) {
+                    case 0:
+                        _a = httpFor(testCase), requestPath = _a.path, init = _a.init;
+                        if (!testCase.route.endsWith('/deploy/upload'))
+                            return [2 /*return*/, { requestPath: requestPath, init: init }];
+                        body = (testCase.request.body || {});
+                        return [4 /*yield*/, archiveOf(body.fileTree)];
+                    case 1:
+                        archive = _f.sent();
+                        form = new FormData();
+                        try {
+                            for (_b = __values(Object.entries(body)), _c = _b.next(); !_c.done; _c = _b.next()) {
+                                _d = __read(_c.value, 2), field = _d[0], value = _d[1];
+                                if (field !== 'fileTree' && value !== undefined)
+                                    form.set(field, String(value));
+                            }
+                        }
+                        catch (e_12_1) { e_12 = { error: e_12_1 }; }
+                        finally {
+                            try {
+                                if (_c && !_c.done && (_e = _b.return)) _e.call(_b);
+                            }
+                            finally { if (e_12) throw e_12.error; }
+                        }
+                        form.set('file', new Blob([new Uint8Array(archive)]), 'deploy.zip');
+                        return [2 /*return*/, { requestPath: requestPath, init: { method: 'POST', body: form } }];
+                }
+            });
+        }); };
+        var _loop_2 = function (testCase) {
+            it(testCase.id, function () { return __awaiter(void 0, void 0, void 0, function () {
+                var worker, _a, requestPath, init, response, listing, ids, _b, _c, path_6, file, e_13_1, _d, _e, path_7, file, e_14_1;
+                var e_13, _f, e_14, _g;
+                var _h, _j, _k;
+                return __generator(this, function (_l) {
+                    switch (_l.label) {
+                        case 0:
+                            worker = loadWorker();
+                            return [4 /*yield*/, seedDrive(worker.runtime, testCase)];
+                        case 1:
+                            _l.sent();
+                            return [4 /*yield*/, seedIndex(worker.runtime, testCase)];
+                        case 2:
+                            _l.sent();
+                            worker.refuseWrites(Boolean(testCase.unwritable));
+                            return [4 /*yield*/, deployRequest(testCase)];
+                        case 3:
+                            _a = _l.sent(), requestPath = _a.requestPath, init = _a.init;
+                            return [4 /*yield*/, worker.dispatch(requestPath, init)];
                         case 4:
-                            want = testCase.expect.contents;
-                            if (!(typeof want === 'string')) return [3 /*break*/, 6];
-                            _b = expect;
-                            return [4 /*yield*/, response.text()];
+                            response = _l.sent();
+                            return [4 /*yield*/, assertExpectations(response, testCase)
+                                // a removal takes the app the id names, and leaves the rest published
+                            ];
                         case 5:
-                            _b.apply(void 0, [_e.sent()]).toBe(want);
-                            return [3 /*break*/, 8];
+                            _l.sent();
+                            if (!(testCase.route === 'DELETE /SASjsApi/drive/deploy')) return [3 /*break*/, 8];
+                            return [4 /*yield*/, worker.dispatch('/app/apps.json')];
                         case 6:
-                            if (!(want !== undefined)) return [3 /*break*/, 8];
-                            _c = expect;
-                            _d = Uint8Array.bind;
-                            return [4 /*yield*/, response.arrayBuffer()];
+                            listing = _l.sent();
+                            return [4 /*yield*/, listing.json()];
                         case 7:
-                            _c.apply(void 0, [new (_d.apply(Uint8Array, [void 0, _e.sent()]))()]).toEqual(want);
-                            _e.label = 8;
-                        case 8: return [2 /*return*/];
+                            ids = (_l.sent()).apps.map(function (app) { return app.id; });
+                            expect(ids).toContain(BYSTANDER.id);
+                            if (response.status === 200)
+                                expect(ids).not.toContain((_h = testCase.request.body) === null || _h === void 0 ? void 0 : _h.id);
+                            _l.label = 8;
+                        case 8:
+                            _l.trys.push([8, 13, 14, 15]);
+                            _b = __values(((_j = testCase.expectDrive) === null || _j === void 0 ? void 0 : _j.present) || []), _c = _b.next();
+                            _l.label = 9;
+                        case 9:
+                            if (!!_c.done) return [3 /*break*/, 12];
+                            path_6 = _c.value;
+                            return [4 /*yield*/, worker.dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent(path_6))];
+                        case 10:
+                            file = _l.sent();
+                            expect({ path: path_6, status: file.status }).toEqual({ path: path_6, status: 200 });
+                            _l.label = 11;
+                        case 11:
+                            _c = _b.next();
+                            return [3 /*break*/, 9];
+                        case 12: return [3 /*break*/, 15];
+                        case 13:
+                            e_13_1 = _l.sent();
+                            e_13 = { error: e_13_1 };
+                            return [3 /*break*/, 15];
+                        case 14:
+                            try {
+                                if (_c && !_c.done && (_f = _b.return)) _f.call(_b);
+                            }
+                            finally { if (e_13) throw e_13.error; }
+                            return [7 /*endfinally*/];
+                        case 15:
+                            _l.trys.push([15, 20, 21, 22]);
+                            _d = __values(((_k = testCase.expectDrive) === null || _k === void 0 ? void 0 : _k.missing) || []), _e = _d.next();
+                            _l.label = 16;
+                        case 16:
+                            if (!!_e.done) return [3 /*break*/, 19];
+                            path_7 = _e.value;
+                            return [4 /*yield*/, worker.dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent(path_7))];
+                        case 17:
+                            file = _l.sent();
+                            expect({ path: path_7, status: file.status }).toEqual({ path: path_7, status: 404 });
+                            _l.label = 18;
+                        case 18:
+                            _e = _d.next();
+                            return [3 /*break*/, 16];
+                        case 19: return [3 /*break*/, 22];
+                        case 20:
+                            e_14_1 = _l.sent();
+                            e_14 = { error: e_14_1 };
+                            return [3 /*break*/, 22];
+                        case 21:
+                            try {
+                                if (_e && !_e.done && (_g = _d.return)) _g.call(_d);
+                            }
+                            finally { if (e_14) throw e_14.error; }
+                            return [7 /*endfinally*/];
+                        case 22: return [2 /*return*/];
                     }
                 });
             }); });
         };
         try {
-            for (var DRIVE_CORPUS_1 = __values(api_1.DRIVE_CORPUS), DRIVE_CORPUS_1_1 = DRIVE_CORPUS_1.next(); !DRIVE_CORPUS_1_1.done; DRIVE_CORPUS_1_1 = DRIVE_CORPUS_1.next()) {
-                var testCase = DRIVE_CORPUS_1_1.value;
-                _loop_1(testCase);
+            /**
+             * The deploy routes: the JSON form and the removal, plus the upload route
+             * through an archive this harness builds from the tree the case states.
+             *
+             * The corpus describes an upload by what the archive has to expand to, so a
+             * host that takes bytes can run the same case as one that is handed an
+             * expansion - `deployRequest` makes the archive, and what it asserts is this
+             * worker's own unzipping and tree-building rather than the corpus's
+             * assumption. The one case that cannot travel this way is the expansion that is
+             * not a tree, which the corpus marks `transport: 'expansion'`.
+             *
+             * The removal cases need an app to remove, so the index is seeded with the one
+             * the case names and a bystander that must survive it. The state a case leaves
+             * is checked too - `expectDrive` - because both deploy answers are `200` and
+             * replacing a folder only differs from keeping it in what the drive holds
+             * afterwards.
+             */
+            for (var _c = __values(api_1.DEPLOY_CORPUS.filter(
+            // a case a host that takes an archive cannot produce, which the corpus marks
+            // on the case itself rather than leaving each host to name it
+            function (entry) { return entry.transport !== 'expansion'; })), _d = _c.next(); !_d.done; _d = _c.next()) {
+                var testCase = _d.value;
+                _loop_2(testCase);
             }
         }
-        catch (e_5_1) { e_5 = { error: e_5_1 }; }
+        catch (e_7_1) { e_7 = { error: e_7_1 }; }
         finally {
             try {
-                if (DRIVE_CORPUS_1_1 && !DRIVE_CORPUS_1_1.done && (_a = DRIVE_CORPUS_1.return)) _a.call(DRIVE_CORPUS_1);
+                if (_d && !_d.done && (_b = _c.return)) _b.call(_c);
             }
-            finally { if (e_5) throw e_5.error; }
+            finally { if (e_7) throw e_7.error; }
         }
     });
     /**
@@ -2820,7 +3317,7 @@ describe('service worker host', function () {
      * are the package's.
      */
     describe('identity and record conformance', function () {
-        var e_9, _a;
+        var e_15, _a;
         /**
          * Boots the worker from a fixture, the way the page does: the case's own
          * identity, and `subject: null` for no implicit caller, so a case that
@@ -2853,7 +3350,7 @@ describe('service worker host', function () {
         };
         /** The request a case describes, as HTTP: path parameters filled, token sent. */
         var httpForCase = function (testCase) {
-            var e_10, _a;
+            var e_16, _a;
             var _b = __read(testCase.route.split(' '), 2), method = _b[0], routePath = _b[1];
             var filled = routePath.replace(/\{(\w+)\}/g, function (_match, name) {
                 return encodeURIComponent(String((testCase.request.params || {})[name]));
@@ -2866,12 +3363,12 @@ describe('service worker host', function () {
                         query.set(key, String(value));
                 }
             }
-            catch (e_10_1) { e_10 = { error: e_10_1 }; }
+            catch (e_16_1) { e_16 = { error: e_16_1 }; }
             finally {
                 try {
                     if (_d && !_d.done && (_a = _c.return)) _a.call(_c);
                 }
-                finally { if (e_10) throw e_10.error; }
+                finally { if (e_16) throw e_16.error; }
             }
             var suffix = query.toString() ? "?".concat(query) : '';
             var headers = {};
@@ -2965,7 +3462,7 @@ describe('service worker host', function () {
                 }
             });
         }); };
-        var _loop_2 = function (testCase) {
+        var _loop_3 = function (testCase) {
             it("".concat(testCase.id, ": ").concat(testCase.description), function () { return __awaiter(void 0, void 0, void 0, function () {
                 var worker, _a, requestPath, init, _b, _c;
                 return __generator(this, function (_d) {
@@ -2990,15 +3487,15 @@ describe('service worker host', function () {
         try {
             for (var _b = __values(__spreadArray(__spreadArray([], __read(api_1.IDENTITY_CORPUS), false), __read(api_1.RECORD_CORPUS), false)), _c = _b.next(); !_c.done; _c = _b.next()) {
                 var testCase = _c.value;
-                _loop_2(testCase);
+                _loop_3(testCase);
             }
         }
-        catch (e_9_1) { e_9 = { error: e_9_1 }; }
+        catch (e_15_1) { e_15 = { error: e_15_1 }; }
         finally {
             try {
                 if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
             }
-            finally { if (e_9) throw e_9.error; }
+            finally { if (e_15) throw e_15.error; }
         }
         it('answers as the fixture administrator when no subject was chosen', function () { return __awaiter(void 0, void 0, void 0, function () {
             var worker, response, rules;

package/package.json

@@ -71,7 +71,7 @@
   },
   "dependencies": {
     "@sasjs/adapter": "6.0.2",
-    "@sasjs/api": "0.27.0",
+    "@sasjs/api": "0.28.0",
     "@sasjs/core": "7.1.12",
     "@sasjs/lint": "5.1.1",
     "@sasjs/utils": "4.11.0",
@@ -125,5 +125,5 @@
     "ws": "8.21.0",
     "nanoid": "3.3.18"
   },
-  "version": "6.27.0"
+  "version": "6.27.2"
 }