v1.6.2

Fixed

• DELETE /api/oauth/client/:id 500'd (client.remove is not a function) — OAuthClient wraps @simpleworkjs/orm's Resource model, whose instance delete method is .delete(), not .remove(). The Directory Management UI was unaffected (its own delete routes already used .delete() correctly); only this legacy/raw API endpoint was broken. Found live against a real deployment's SSO API.

Added

• Regression tests: PUT/DELETE on /api/oauth/client/:id now verify persistence with a follow-up GET rather than trusting the mutating response alone (this is what would have caught the bug above). A static check across all views/client-side scripts fails CI if any native alert()/confirm()/prompt() call appears — these block all further browser events on the page and were fully removed in 1.6.1.