@shipstatic/ship 3.3.2 → 3.4.0-beta.2

package/dist/index.d.cts

@@ -786,18 +786,34 @@ type AccountRole = 'owner' | 'member';
  * account automation, not a person, and is always `active`.
  */
 type AccountAccess = 'active' | 'paused';
+/**
+ * The word a refusal about the account carries in `details.account`, so a
+ * client can tell the two apart without reading the sentence:
+ *
+ * - `paused`: a 403. The person is a member, and the account holds more
+ *   members than its plan allows (see {@link AccountAccess}).
+ * - `unknown`: a 404. The account the request names ({@link ACCOUNT_HEADER})
+ *   is one the person is not a member of, or one that does not exist; the
+ *   two are indistinguishable by design. A tab whose person was removed from
+ *   the account meets it on its next request.
+ */
+declare const AccountRefusal: {
+    readonly PAUSED: "paused";
+    readonly UNKNOWN: "unknown";
+};
+type AccountRefusalType = (typeof AccountRefusal)[keyof typeof AccountRefusal];
 /**
  * Core account object - used in both API responses and SDK
  * All fields are readonly to prevent accidental mutations
  */
 interface Account {
     /**
-     * The account this response describes, by id. A person may belong to
-     * several accounts and a browser session selects one, so a client names
-     * the one it means on every request (`X-Account`) and this is where it
-     * learns the name. Optional by the additive-evolution law.
+     * The account this response describes, by id: the name the console's URL
+     * carries (`/<account>/`) and a session request sends in
+     * {@link ACCOUNT_HEADER}. A machine credential IS its account, so the
+     * response names the account the credential belongs to.
      */
-    readonly account?: string;
+    readonly account: string;
     /** User email address */
     readonly email: string;
     /**
@@ -941,20 +957,6 @@ interface PlanDestination {
     readonly plan: AccountPlanType;
     readonly intervals: BillingInterval[];
 }
-/**
- * Account as returned by `GET /account` — the entity plus how the request
- * was authorized, so `whoami` can answer "what credential am I holding?".
- * Request-scoped fields live on the response type, never on the entity
- * (the `DeploymentCreateResponse` pattern).
- */
-interface AccountGetResponse extends Account {
-    /** How the request that produced this response was authorized. */
-    readonly authMethod: AuthMethodType;
-    /** Present (and true) only when the caller is an operator acting as themselves. */
-    readonly isAdmin?: true;
-    /** Present only during read-only admin impersonation: the operator's account id. */
-    readonly impersonatedBy?: string;
-}
 /**
  * Acknowledgement of `DELETE /account` (202). Termination is asynchronous —
  * a cleanup consumer finishes the job — so the account survives long enough
@@ -1703,16 +1705,18 @@ declare const CALLER: {
     readonly PATTERN: RegExp;
 };
 /**
- * The account a session request MEANS.
+ * The account a session request is about.
  *
- * A browser session selects one account for every tab at once, so a tab that
- * switched leaves its siblings acting for an account they no longer show. A
- * session caller may name the account it means in this header; the API
- * answers 409 `details.account: 'select'` when it differs from the account the
- * session resolves to, and the client re-selects. A precondition check the
- * client volunteers, never authority: a request without it resolves exactly as
- * before, and machine credentials never send it. One owner for the name, since
- * the API's CORS allowlist and every browser transport spell it.
+ * A person may belong to several accounts, so a request made with a browser
+ * session names the one it means, on every request to an account route; the
+ * console takes the value from its URL (`/<account>/`). The header names and
+ * membership authorizes: the API resolves the person's membership in the
+ * account named, answers 404 `details.account: 'unknown'` for an account the
+ * person is not in (or one that does not exist), and 400 when a session
+ * request names none. Machine credentials never send it, since a key, a
+ * deploy token or an OAuth grant already belongs to one account. One owner
+ * for the name, since the API's CORS allowlist and every browser transport
+ * spell it.
  */
 declare const ACCOUNT_HEADER = "X-Account";
 /**
@@ -2005,6 +2009,122 @@ interface StaticFile {
     /** The size of the file in bytes. */
     size: number;
 }
+/**
+ * The sections of an account, by first segment, each mounted twice by the
+ * console: under `/<account>/` and at the root.
+ *
+ * `owner` marks a section that means the person's OWN account: a bare path
+ * into it opens the person's own account rather than the one entered last,
+ * since a pricing link's `/upgrade/pro` and the published API-key link speak
+ * about the reader's plan and key. Modals inside a section carry their own
+ * owner rule in the console; this flag is the section's alone.
+ */
+declare const SECTIONS: {
+    readonly new: {
+        readonly owner: false;
+    };
+    readonly deployments: {
+        readonly owner: false;
+    };
+    readonly domains: {
+        readonly owner: false;
+    };
+    readonly settings: {
+        readonly owner: false;
+    };
+    readonly upgrade: {
+        readonly owner: true;
+    };
+    readonly success: {
+        readonly owner: false;
+    };
+    readonly 'api-key': {
+        readonly owner: true;
+    };
+};
+/** A section's first segment. */
+type ConsoleSection = keyof typeof SECTIONS;
+/** The two fragments of the settings page a link may name. */
+type SettingsFragment = 'members' | 'api-key';
+/**
+ * The query markers a Stripe return lands with, each written by a builder
+ * below and read by `billingReturnOf`, so neither side spells one.
+ */
+declare const BILLING_RETURNS: {
+    readonly checkout: readonly ["upgrading", "true"];
+    readonly portal: readonly ["billing", "returned"];
+};
+type BillingReturn = keyof typeof BILLING_RETURNS;
+/**
+ * The paths inside one account, or, with no account, the bare form the
+ * console opens in the account entered last.
+ *
+ * ```ts
+ * consolePaths(account).domains.connect('www.example.com')
+ * // '/<account>/domains/www.example.com/connect'
+ * consolePaths().apiKey()
+ * // '/api-key'
+ * ```
+ */
+declare function consolePaths(account?: string): {
+    dashboard: () => string;
+    newSite: () => string;
+    deployments: (() => string) & {
+        upload: () => string;
+    };
+    domains: (() => string) & {
+        connect: (domain: string) => string;
+        deployment: (domain: string) => string;
+    };
+    settings: (fragment?: SettingsFragment) => string;
+    /** Settings, marked as the landing of a Stripe Customer Portal return. */
+    settingsAfterBilling: () => string;
+    upgrade: (plan?: AccountPlanType) => string;
+    success: () => string;
+    /** The success page, marked as the landing of a Stripe Checkout return. */
+    successAfterCheckout: () => string;
+    apiKey: () => string;
+};
+/** The builders `consolePaths` returns. */
+type ConsolePaths = ReturnType<typeof consolePaths>;
+/** The doors: the pages that exist before an account is known. */
+declare const doors: {
+    readonly login: (next?: string) => string;
+    readonly register: (next?: string) => string;
+    readonly logout: () => string;
+    readonly invitation: (invitation: string) => string;
+    readonly claim: (code: string) => string;
+    readonly consent: () => string;
+};
+/**
+ * Which Stripe return a query string marks: `checkout` for the success page
+ * after Checkout, `portal` for settings after the Customer Portal, or null.
+ */
+declare function billingReturnOf(search: string): BillingReturn | null;
+/**
+ * The account a path names, or null for a door, the operator partition, or
+ * the bare form. Any first segment that is not a section, a door or the
+ * partition is an account: the grammar has no other reading, and whether
+ * the account exists is the server's answer, never the path's.
+ */
+declare function accountOfPath(path: string): string | null;
+/** Whether a path names a claim link (`/claim/:code`, a bearer credential). */
+declare const isClaimPath: (path: string) => boolean;
+/** Whether a path names an invitation (`/invitations/:invitation`). */
+declare const isInvitationPath: (path: string) => boolean;
+/**
+ * Whether a path names the upgrade section, in either form: `/upgrade`,
+ * `/upgrade/:plan`, and the same under `/<account>/`.
+ */
+declare const isUpgradePath: (path: string) => boolean;
+/** The errand a destination path carries, as the sign-in doors read it. */
+type ConsoleErrand = 'claim' | 'invite' | 'upgrade';
+/**
+ * The errand a destination path carries, in specificity order: a pricing
+ * link is the broadest, and the narrower ones do not normally coexist with
+ * it.
+ */
+declare function errandOf(path: string): ConsoleErrand | null;
 /** Default API URL if not otherwise configured. */
 declare const DEFAULT_API = "https://api.shipstatic.com";
 /**
@@ -2044,15 +2164,15 @@ declare const SHIP_ENV: {
  */
 declare const SHIP_VIA_ENV = "SHIP_VIA";
 /**
- * Where a human creates an API key — the console deep link quoted by every
+ * Where a human creates an API key: the console deep link quoted by every
  * surface that teaches authentication (the CLI's config wizard, the VS Code
- * and n8n listings, the n8n rate-limit hint and credential copy). Written
- * out in five files across three repos until this export.
+ * and n8n listings, the n8n rate-limit hint and credential copy). The bare
+ * form of the path, which the console opens in the reader's own account.
  *
  * Production-branded by design: published artifacts name the product, never
  * an environment (root `CLAUDE.md`, "Environment-Aware URLs").
  */
-declare const MY_API_KEY_URL = "https://my.shipstatic.com/api-key";
+declare const MY_API_KEY_URL: string;
 /**
  * How long an anonymous deployment lives before it expires.
  *
@@ -2267,7 +2387,7 @@ interface DomainResource {
  * Account resource interface - the contract all implementations must follow
  */
 interface AccountResource {
-    get: () => Promise<AccountGetResponse>;
+    get: () => Promise<Account>;
 }
 /**
  * Token resource interface - the contract all implementations must follow
@@ -3246,17 +3366,9 @@ declare abstract class Ship$1 {
     readonly tokens: TokenResource;
     private readonly http;
     private readonly clientOptions;
-    private initPromise;
-    protected platformLimits: PlatformLimits | null;
     private credential;
     constructor(options?: ShipClientOptions);
-    protected abstract processInput(input: DeployInput, options: DeploymentOptions): Promise<StaticFile[]>;
-    /**
-     * Lazy initialization — fetches platform limits (file size / count caps) once,
-     * on the first API call. Subsequent calls reuse the resolved promise.
-     */
-    protected ensureInitialized(): Promise<void>;
-    private fetchPlatformLimits;
+    protected abstract processInput(input: DeployInput, options: DeploymentOptions, limits: PlatformLimits): Promise<StaticFile[]>;
     /**
      * Ping the API server, resolving its answer: `{ success, timestamp }`, where
      * `timestamp` is the server clock in unix SECONDS.
@@ -3275,11 +3387,11 @@ declare abstract class Ship$1 {
     /**
      * Get current account information (convenience shortcut to `ship.account.get()`).
      */
-    whoami(): Promise<AccountGetResponse>;
+    whoami(): Promise<Account>;
     /**
-     * Get platform limits (max file size, file count, total size).
-     * Reuses the response fetched during initialization. Per-instance state —
-     * does not leak between concurrent Ships against different API URLs.
+     * Get the platform limits the server states now (max file size, file count,
+     * total size, and the blocked extensions). Asked every time and never held,
+     * since a plan move or an operator's grant changes them.
      */
     getLimits(): Promise<PlatformLimits>;
     on<K extends keyof ShipEvents>(event: K, handler: (...args: ShipEvents[K]) => void): void;
@@ -3627,10 +3739,10 @@ declare function pluralize(count: number, singular: string, plural: string, incl
  *
  * @param paths - File or directory paths to scan and process.
  * @param options - Processing options (pathDetect, etc.).
- * @param platformLimits - Per-instance platform limits (file-size / count /
- *   total-size caps) from the originating Ship's `GET /limits` fetch. Passed
- *   in rather than read from a module global so concurrent Ships against
- *   different API URLs cannot clobber each other's caps.
+ * @param platformLimits - The platform limits (file-size / count /
+ *   total-size caps and the blocked extensions) the deploy read from
+ *   `GET /limits` at its start. Passed in, never held, so a validation always
+ *   meets the limits the server states now.
  * @returns Promise resolving to an array of StaticFile objects.
  * @throws {ShipError} If called outside Node.js or if fs/path modules fail.
  */
@@ -3681,10 +3793,10 @@ declare class Ship extends Ship$1 {
      * contract stays platform-neutral.
      */
     deploy(input: string | string[], options?: DeploymentOptions): Promise<DeploymentCreateResponse>;
-    protected processInput(input: DeployInput, options: DeploymentOptions): Promise<StaticFile[]>;
+    protected processInput(input: DeployInput, options: DeploymentOptions, limits: PlatformLimits): Promise<StaticFile[]>;
 }
 
 declare namespace Ship {
-  export { ACCOUNT_HEADER, API_KEY, API_PATHS, AUTH_BASE_PATH, Account, AccountAccess, AccountDeleteResponse, AccountGetResponse, AccountKeyResponse, AccountPlan, AccountPlanType, AccountResource, AccountRole, Activity, ActivityEvent, ActivityListResponse, ActivityMeta, ApiDeployOptions, ApiHttp, ApiHttpOptions, AuthMethod, AuthMethodType, BUILD_SETTINGS, BillingInterval, BillingPortalSession, BillingSyncResponse, BuildFailureDetails, CALLER, Caps, DEFAULT_API, DEPLOYMENT_CONFIG_FILENAME, DEPLOY_FIELDS, DEPLOY_FILE_GRAMMAR, DEPLOY_TOKEN, DeployBodyContext, DeployFile, DeployFileEncoding, DeployFileSpec, DeployInput, DeployTransport, Deployment, DeploymentCreateResponse, DeploymentDeleteResponse, DeploymentListResponse, DeploymentOptions, DeploymentResource, DeploymentResourceContext, DeploymentSetOptions, DeploymentStatus, DeploymentStatusType, DeploymentUploadOptions, DeploymentVia, DeploymentViaType, DnsLookup, DnsProvider, DnsRecord, DnsRecordType, Domain, DomainDeleteResponse, DomainDnsResponse, DomainListResponse, DomainRecordsResponse, DomainResource, DomainSetOptions, DomainSetResult, DomainShareResponse, DomainStatus, DomainStatusType, DomainValidateResponse, DomainVerification, DomainVerificationType, DomainVerifyResponse, ErrorResponse, ErrorType, ExecutionEnvironment, FileValidationStatus as FILE_VALIDATION_STATUS, Fetch, FileValidationResult, FileValidationStatus, FileValidationStatusType, IDEMPOTENCY_KEY_CONSTRAINTS, JUNK_DIRECTORIES, LABEL_CONSTRAINTS, LABEL_PATTERN, LabelsResponse, ListOptions, ListResponse, MD5Result, MY_API_KEY_URL, OAUTH_TOKEN, OAuthScope, OAuthScopeType, PASSWORD_CONSTRAINTS, PUBLIC_DEPLOYMENT_TTL_SECONDS, PingResponse, Plan, PlanChangeRequest, PlanChangeResponse, PlanDestination, PlansResponse, PlatformLimits, RequestResult, ResourceContext, SETUP_TROUBLESHOOTING_ANCHOR, SHIP_ENV, SHIP_VIA_ENV, SIGN_IN_RETURN_PARAM, SPACheckDebug, SPACheckRequest, SPACheckResponse, SPA_CHECK_CONSTRAINTS, SPA_DEFAULT_CONFIG, ScheduledChange, SetupInstructionsResponse, ShipClientOptions, ShipError, ShipEvents, ShipRequestInit, StaticFile, TTL_CONSTRAINTS, Token, TokenCreateOptions, TokenCreateResponse, TokenDeleteResponse, TokenKind, TokenKindType, TokenListResponse, TokenProvider, TokenResource, Transport, UNBUILT_PROJECT_MARKERS, UNSAFE_FILENAME_CHARS, USER_VISIBLE_EVENTS, UploadedFile, UserVisibleActivityEvent, ValidatableFile, ValidationIssue, WEB_FILE_ACCEPT, __setTestEnvironment, allValidFilesReady, assertShipJsonSyntax, calculateMD5, classifyToken, createAccountResource, createDeploymentResource, createDomainResource, createTokenResource, deserializeLabels, extractSubdomain, filterJunk, formatDuration, formatFileSize, formatTimeRemaining, generateDeploymentUrl, generateDomainUrl, getENV, getValidFiles, hasUnbuiltMarker, hasUnsafeChars, isBlockedExtension, isCustomDomain, isDeployment, isPlatformDomain, isShipError, normalizeVia, optimizeDeployPaths, personName, personShortName, pluralize, processFilesForNode, readBearerValue, serializeLabels, validateApiKey, validateApiUrl, validateBuildCommand, validateCaller, validateDeployFile, validateDeployPath, validateDeployToken, validateFileName, validateFiles, validateIdempotencyKey, validateOAuthToken, validateOutputDir, validatePassword, validateToken, validateTtl };
+  export { ACCOUNT_HEADER, API_KEY, API_PATHS, AUTH_BASE_PATH, Account, AccountAccess, AccountDeleteResponse, AccountKeyResponse, AccountPlan, AccountPlanType, AccountRefusal, AccountRefusalType, AccountResource, AccountRole, Activity, ActivityEvent, ActivityListResponse, ActivityMeta, ApiDeployOptions, ApiHttp, ApiHttpOptions, AuthMethod, AuthMethodType, BUILD_SETTINGS, BillingInterval, BillingPortalSession, BillingSyncResponse, BuildFailureDetails, CALLER, Caps, ConsoleErrand, ConsolePaths, ConsoleSection, DEFAULT_API, DEPLOYMENT_CONFIG_FILENAME, DEPLOY_FIELDS, DEPLOY_FILE_GRAMMAR, DEPLOY_TOKEN, DeployBodyContext, DeployFile, DeployFileEncoding, DeployFileSpec, DeployInput, DeployTransport, Deployment, DeploymentCreateResponse, DeploymentDeleteResponse, DeploymentListResponse, DeploymentOptions, DeploymentResource, DeploymentResourceContext, DeploymentSetOptions, DeploymentStatus, DeploymentStatusType, DeploymentUploadOptions, DeploymentVia, DeploymentViaType, DnsLookup, DnsProvider, DnsRecord, DnsRecordType, Domain, DomainDeleteResponse, DomainDnsResponse, DomainListResponse, DomainRecordsResponse, DomainResource, DomainSetOptions, DomainSetResult, DomainShareResponse, DomainStatus, DomainStatusType, DomainValidateResponse, DomainVerification, DomainVerificationType, DomainVerifyResponse, ErrorResponse, ErrorType, ExecutionEnvironment, FileValidationStatus as FILE_VALIDATION_STATUS, Fetch, FileValidationResult, FileValidationStatus, FileValidationStatusType, IDEMPOTENCY_KEY_CONSTRAINTS, JUNK_DIRECTORIES, LABEL_CONSTRAINTS, LABEL_PATTERN, LabelsResponse, ListOptions, ListResponse, MD5Result, MY_API_KEY_URL, OAUTH_TOKEN, OAuthScope, OAuthScopeType, PASSWORD_CONSTRAINTS, PUBLIC_DEPLOYMENT_TTL_SECONDS, PingResponse, Plan, PlanChangeRequest, PlanChangeResponse, PlanDestination, PlansResponse, PlatformLimits, RequestResult, ResourceContext, SECTIONS, SETUP_TROUBLESHOOTING_ANCHOR, SHIP_ENV, SHIP_VIA_ENV, SIGN_IN_RETURN_PARAM, SPACheckDebug, SPACheckRequest, SPACheckResponse, SPA_CHECK_CONSTRAINTS, SPA_DEFAULT_CONFIG, ScheduledChange, SettingsFragment, SetupInstructionsResponse, ShipClientOptions, ShipError, ShipEvents, ShipRequestInit, StaticFile, TTL_CONSTRAINTS, Token, TokenCreateOptions, TokenCreateResponse, TokenDeleteResponse, TokenKind, TokenKindType, TokenListResponse, TokenProvider, TokenResource, Transport, UNBUILT_PROJECT_MARKERS, UNSAFE_FILENAME_CHARS, USER_VISIBLE_EVENTS, UploadedFile, UserVisibleActivityEvent, ValidatableFile, ValidationIssue, WEB_FILE_ACCEPT, __setTestEnvironment, accountOfPath, allValidFilesReady, assertShipJsonSyntax, billingReturnOf, calculateMD5, classifyToken, consolePaths, createAccountResource, createDeploymentResource, createDomainResource, createTokenResource, deserializeLabels, doors, errandOf, extractSubdomain, filterJunk, formatDuration, formatFileSize, formatTimeRemaining, generateDeploymentUrl, generateDomainUrl, getENV, getValidFiles, hasUnbuiltMarker, hasUnsafeChars, isBlockedExtension, isClaimPath, isCustomDomain, isDeployment, isInvitationPath, isPlatformDomain, isShipError, isUpgradePath, normalizeVia, optimizeDeployPaths, personName, personShortName, pluralize, processFilesForNode, readBearerValue, serializeLabels, validateApiKey, validateApiUrl, validateBuildCommand, validateCaller, validateDeployFile, validateDeployPath, validateDeployToken, validateFileName, validateFiles, validateIdempotencyKey, validateOAuthToken, validateOutputDir, validatePassword, validateToken, validateTtl };
 }
 export = Ship;

package/dist/index.d.ts

@@ -786,18 +786,34 @@ type AccountRole = 'owner' | 'member';
  * account automation, not a person, and is always `active`.
  */
 type AccountAccess = 'active' | 'paused';
+/**
+ * The word a refusal about the account carries in `details.account`, so a
+ * client can tell the two apart without reading the sentence:
+ *
+ * - `paused`: a 403. The person is a member, and the account holds more
+ *   members than its plan allows (see {@link AccountAccess}).
+ * - `unknown`: a 404. The account the request names ({@link ACCOUNT_HEADER})
+ *   is one the person is not a member of, or one that does not exist; the
+ *   two are indistinguishable by design. A tab whose person was removed from
+ *   the account meets it on its next request.
+ */
+declare const AccountRefusal: {
+    readonly PAUSED: "paused";
+    readonly UNKNOWN: "unknown";
+};
+type AccountRefusalType = (typeof AccountRefusal)[keyof typeof AccountRefusal];
 /**
  * Core account object - used in both API responses and SDK
  * All fields are readonly to prevent accidental mutations
  */
 interface Account {
     /**
-     * The account this response describes, by id. A person may belong to
-     * several accounts and a browser session selects one, so a client names
-     * the one it means on every request (`X-Account`) and this is where it
-     * learns the name. Optional by the additive-evolution law.
+     * The account this response describes, by id: the name the console's URL
+     * carries (`/<account>/`) and a session request sends in
+     * {@link ACCOUNT_HEADER}. A machine credential IS its account, so the
+     * response names the account the credential belongs to.
      */
-    readonly account?: string;
+    readonly account: string;
     /** User email address */
     readonly email: string;
     /**
@@ -941,20 +957,6 @@ interface PlanDestination {
     readonly plan: AccountPlanType;
     readonly intervals: BillingInterval[];
 }
-/**
- * Account as returned by `GET /account` — the entity plus how the request
- * was authorized, so `whoami` can answer "what credential am I holding?".
- * Request-scoped fields live on the response type, never on the entity
- * (the `DeploymentCreateResponse` pattern).
- */
-interface AccountGetResponse extends Account {
-    /** How the request that produced this response was authorized. */
-    readonly authMethod: AuthMethodType;
-    /** Present (and true) only when the caller is an operator acting as themselves. */
-    readonly isAdmin?: true;
-    /** Present only during read-only admin impersonation: the operator's account id. */
-    readonly impersonatedBy?: string;
-}
 /**
  * Acknowledgement of `DELETE /account` (202). Termination is asynchronous —
  * a cleanup consumer finishes the job — so the account survives long enough
@@ -1703,16 +1705,18 @@ declare const CALLER: {
     readonly PATTERN: RegExp;
 };
 /**
- * The account a session request MEANS.
+ * The account a session request is about.
  *
- * A browser session selects one account for every tab at once, so a tab that
- * switched leaves its siblings acting for an account they no longer show. A
- * session caller may name the account it means in this header; the API
- * answers 409 `details.account: 'select'` when it differs from the account the
- * session resolves to, and the client re-selects. A precondition check the
- * client volunteers, never authority: a request without it resolves exactly as
- * before, and machine credentials never send it. One owner for the name, since
- * the API's CORS allowlist and every browser transport spell it.
+ * A person may belong to several accounts, so a request made with a browser
+ * session names the one it means, on every request to an account route; the
+ * console takes the value from its URL (`/<account>/`). The header names and
+ * membership authorizes: the API resolves the person's membership in the
+ * account named, answers 404 `details.account: 'unknown'` for an account the
+ * person is not in (or one that does not exist), and 400 when a session
+ * request names none. Machine credentials never send it, since a key, a
+ * deploy token or an OAuth grant already belongs to one account. One owner
+ * for the name, since the API's CORS allowlist and every browser transport
+ * spell it.
  */
 declare const ACCOUNT_HEADER = "X-Account";
 /**
@@ -2005,6 +2009,122 @@ interface StaticFile {
     /** The size of the file in bytes. */
     size: number;
 }
+/**
+ * The sections of an account, by first segment, each mounted twice by the
+ * console: under `/<account>/` and at the root.
+ *
+ * `owner` marks a section that means the person's OWN account: a bare path
+ * into it opens the person's own account rather than the one entered last,
+ * since a pricing link's `/upgrade/pro` and the published API-key link speak
+ * about the reader's plan and key. Modals inside a section carry their own
+ * owner rule in the console; this flag is the section's alone.
+ */
+declare const SECTIONS: {
+    readonly new: {
+        readonly owner: false;
+    };
+    readonly deployments: {
+        readonly owner: false;
+    };
+    readonly domains: {
+        readonly owner: false;
+    };
+    readonly settings: {
+        readonly owner: false;
+    };
+    readonly upgrade: {
+        readonly owner: true;
+    };
+    readonly success: {
+        readonly owner: false;
+    };
+    readonly 'api-key': {
+        readonly owner: true;
+    };
+};
+/** A section's first segment. */
+type ConsoleSection = keyof typeof SECTIONS;
+/** The two fragments of the settings page a link may name. */
+type SettingsFragment = 'members' | 'api-key';
+/**
+ * The query markers a Stripe return lands with, each written by a builder
+ * below and read by `billingReturnOf`, so neither side spells one.
+ */
+declare const BILLING_RETURNS: {
+    readonly checkout: readonly ["upgrading", "true"];
+    readonly portal: readonly ["billing", "returned"];
+};
+type BillingReturn = keyof typeof BILLING_RETURNS;
+/**
+ * The paths inside one account, or, with no account, the bare form the
+ * console opens in the account entered last.
+ *
+ * ```ts
+ * consolePaths(account).domains.connect('www.example.com')
+ * // '/<account>/domains/www.example.com/connect'
+ * consolePaths().apiKey()
+ * // '/api-key'
+ * ```
+ */
+declare function consolePaths(account?: string): {
+    dashboard: () => string;
+    newSite: () => string;
+    deployments: (() => string) & {
+        upload: () => string;
+    };
+    domains: (() => string) & {
+        connect: (domain: string) => string;
+        deployment: (domain: string) => string;
+    };
+    settings: (fragment?: SettingsFragment) => string;
+    /** Settings, marked as the landing of a Stripe Customer Portal return. */
+    settingsAfterBilling: () => string;
+    upgrade: (plan?: AccountPlanType) => string;
+    success: () => string;
+    /** The success page, marked as the landing of a Stripe Checkout return. */
+    successAfterCheckout: () => string;
+    apiKey: () => string;
+};
+/** The builders `consolePaths` returns. */
+type ConsolePaths = ReturnType<typeof consolePaths>;
+/** The doors: the pages that exist before an account is known. */
+declare const doors: {
+    readonly login: (next?: string) => string;
+    readonly register: (next?: string) => string;
+    readonly logout: () => string;
+    readonly invitation: (invitation: string) => string;
+    readonly claim: (code: string) => string;
+    readonly consent: () => string;
+};
+/**
+ * Which Stripe return a query string marks: `checkout` for the success page
+ * after Checkout, `portal` for settings after the Customer Portal, or null.
+ */
+declare function billingReturnOf(search: string): BillingReturn | null;
+/**
+ * The account a path names, or null for a door, the operator partition, or
+ * the bare form. Any first segment that is not a section, a door or the
+ * partition is an account: the grammar has no other reading, and whether
+ * the account exists is the server's answer, never the path's.
+ */
+declare function accountOfPath(path: string): string | null;
+/** Whether a path names a claim link (`/claim/:code`, a bearer credential). */
+declare const isClaimPath: (path: string) => boolean;
+/** Whether a path names an invitation (`/invitations/:invitation`). */
+declare const isInvitationPath: (path: string) => boolean;
+/**
+ * Whether a path names the upgrade section, in either form: `/upgrade`,
+ * `/upgrade/:plan`, and the same under `/<account>/`.
+ */
+declare const isUpgradePath: (path: string) => boolean;
+/** The errand a destination path carries, as the sign-in doors read it. */
+type ConsoleErrand = 'claim' | 'invite' | 'upgrade';
+/**
+ * The errand a destination path carries, in specificity order: a pricing
+ * link is the broadest, and the narrower ones do not normally coexist with
+ * it.
+ */
+declare function errandOf(path: string): ConsoleErrand | null;
 /** Default API URL if not otherwise configured. */
 declare const DEFAULT_API = "https://api.shipstatic.com";
 /**
@@ -2044,15 +2164,15 @@ declare const SHIP_ENV: {
  */
 declare const SHIP_VIA_ENV = "SHIP_VIA";
 /**
- * Where a human creates an API key — the console deep link quoted by every
+ * Where a human creates an API key: the console deep link quoted by every
  * surface that teaches authentication (the CLI's config wizard, the VS Code
- * and n8n listings, the n8n rate-limit hint and credential copy). Written
- * out in five files across three repos until this export.
+ * and n8n listings, the n8n rate-limit hint and credential copy). The bare
+ * form of the path, which the console opens in the reader's own account.
  *
  * Production-branded by design: published artifacts name the product, never
  * an environment (root `CLAUDE.md`, "Environment-Aware URLs").
  */
-declare const MY_API_KEY_URL = "https://my.shipstatic.com/api-key";
+declare const MY_API_KEY_URL: string;
 /**
  * How long an anonymous deployment lives before it expires.
  *
@@ -2267,7 +2387,7 @@ interface DomainResource {
  * Account resource interface - the contract all implementations must follow
  */
 interface AccountResource {
-    get: () => Promise<AccountGetResponse>;
+    get: () => Promise<Account>;
 }
 /**
  * Token resource interface - the contract all implementations must follow
@@ -3246,17 +3366,9 @@ declare abstract class Ship$1 {
     readonly tokens: TokenResource;
     private readonly http;
     private readonly clientOptions;
-    private initPromise;
-    protected platformLimits: PlatformLimits | null;
     private credential;
     constructor(options?: ShipClientOptions);
-    protected abstract processInput(input: DeployInput, options: DeploymentOptions): Promise<StaticFile[]>;
-    /**
-     * Lazy initialization — fetches platform limits (file size / count caps) once,
-     * on the first API call. Subsequent calls reuse the resolved promise.
-     */
-    protected ensureInitialized(): Promise<void>;
-    private fetchPlatformLimits;
+    protected abstract processInput(input: DeployInput, options: DeploymentOptions, limits: PlatformLimits): Promise<StaticFile[]>;
     /**
      * Ping the API server, resolving its answer: `{ success, timestamp }`, where
      * `timestamp` is the server clock in unix SECONDS.
@@ -3275,11 +3387,11 @@ declare abstract class Ship$1 {
     /**
      * Get current account information (convenience shortcut to `ship.account.get()`).
      */
-    whoami(): Promise<AccountGetResponse>;
+    whoami(): Promise<Account>;
     /**
-     * Get platform limits (max file size, file count, total size).
-     * Reuses the response fetched during initialization. Per-instance state —
-     * does not leak between concurrent Ships against different API URLs.
+     * Get the platform limits the server states now (max file size, file count,
+     * total size, and the blocked extensions). Asked every time and never held,
+     * since a plan move or an operator's grant changes them.
      */
     getLimits(): Promise<PlatformLimits>;
     on<K extends keyof ShipEvents>(event: K, handler: (...args: ShipEvents[K]) => void): void;
@@ -3627,10 +3739,10 @@ declare function pluralize(count: number, singular: string, plural: string, incl
  *
  * @param paths - File or directory paths to scan and process.
  * @param options - Processing options (pathDetect, etc.).
- * @param platformLimits - Per-instance platform limits (file-size / count /
- *   total-size caps) from the originating Ship's `GET /limits` fetch. Passed
- *   in rather than read from a module global so concurrent Ships against
- *   different API URLs cannot clobber each other's caps.
+ * @param platformLimits - The platform limits (file-size / count /
+ *   total-size caps and the blocked extensions) the deploy read from
+ *   `GET /limits` at its start. Passed in, never held, so a validation always
+ *   meets the limits the server states now.
  * @returns Promise resolving to an array of StaticFile objects.
  * @throws {ShipError} If called outside Node.js or if fs/path modules fail.
  */
@@ -3681,7 +3793,7 @@ declare class Ship extends Ship$1 {
      * contract stays platform-neutral.
      */
     deploy(input: string | string[], options?: DeploymentOptions): Promise<DeploymentCreateResponse>;
-    protected processInput(input: DeployInput, options: DeploymentOptions): Promise<StaticFile[]>;
+    protected processInput(input: DeployInput, options: DeploymentOptions, limits: PlatformLimits): Promise<StaticFile[]>;
 }
 
-export { ACCOUNT_HEADER, API_KEY, API_PATHS, AUTH_BASE_PATH, type Account, type AccountAccess, type AccountDeleteResponse, type AccountGetResponse, type AccountKeyResponse, AccountPlan, type AccountPlanType, type AccountResource, type AccountRole, type Activity, type ActivityEvent, type ActivityListResponse, type ActivityMeta, type ApiDeployOptions, ApiHttp, type ApiHttpOptions, AuthMethod, type AuthMethodType, BUILD_SETTINGS, type BillingInterval, type BillingPortalSession, type BillingSyncResponse, type BuildFailureDetails, CALLER, type Caps, DEFAULT_API, DEPLOYMENT_CONFIG_FILENAME, DEPLOY_FIELDS, DEPLOY_FILE_GRAMMAR, DEPLOY_TOKEN, type DeployBodyContext, type DeployFile, type DeployFileEncoding, type DeployFileSpec, type DeployInput, type DeployTransport, type Deployment, type DeploymentCreateResponse, type DeploymentDeleteResponse, type DeploymentListResponse, type DeploymentOptions, type DeploymentResource, type DeploymentResourceContext, type DeploymentSetOptions, DeploymentStatus, type DeploymentStatusType, type DeploymentUploadOptions, DeploymentVia, type DeploymentViaType, type DnsLookup, type DnsProvider, type DnsRecord, type DnsRecordType, type Domain, type DomainDeleteResponse, type DomainDnsResponse, type DomainListResponse, type DomainRecordsResponse, type DomainResource, type DomainSetOptions, type DomainSetResult, type DomainShareResponse, DomainStatus, type DomainStatusType, type DomainValidateResponse, DomainVerification, type DomainVerificationType, type DomainVerifyResponse, type ErrorResponse, ErrorType, type ExecutionEnvironment, FileValidationStatus as FILE_VALIDATION_STATUS, type Fetch, type FileValidationResult, FileValidationStatus, type FileValidationStatusType, IDEMPOTENCY_KEY_CONSTRAINTS, JUNK_DIRECTORIES, LABEL_CONSTRAINTS, LABEL_PATTERN, type LabelsResponse, type ListOptions, type ListResponse, type MD5Result, MY_API_KEY_URL, OAUTH_TOKEN, OAuthScope, type OAuthScopeType, PASSWORD_CONSTRAINTS, PUBLIC_DEPLOYMENT_TTL_SECONDS, type PingResponse, type Plan, type PlanChangeRequest, type PlanChangeResponse, type PlanDestination, type PlansResponse, type PlatformLimits, type RequestResult, type ResourceContext, SETUP_TROUBLESHOOTING_ANCHOR, SHIP_ENV, SHIP_VIA_ENV, SIGN_IN_RETURN_PARAM, type SPACheckDebug, type SPACheckRequest, type SPACheckResponse, SPA_CHECK_CONSTRAINTS, SPA_DEFAULT_CONFIG, type ScheduledChange, type SetupInstructionsResponse, Ship, type ShipClientOptions, ShipError, type ShipEvents, type ShipRequestInit, type StaticFile, TTL_CONSTRAINTS, type Token, type TokenCreateOptions, type TokenCreateResponse, type TokenDeleteResponse, TokenKind, type TokenKindType, type TokenListResponse, type TokenProvider, type TokenResource, type Transport, UNBUILT_PROJECT_MARKERS, UNSAFE_FILENAME_CHARS, USER_VISIBLE_EVENTS, type UploadedFile, type UserVisibleActivityEvent, type ValidatableFile, type ValidationIssue, WEB_FILE_ACCEPT, __setTestEnvironment, allValidFilesReady, assertShipJsonSyntax, calculateMD5, classifyToken, createAccountResource, createDeploymentResource, createDomainResource, createTokenResource, Ship as default, deserializeLabels, extractSubdomain, filterJunk, formatDuration, formatFileSize, formatTimeRemaining, generateDeploymentUrl, generateDomainUrl, getENV, getValidFiles, hasUnbuiltMarker, hasUnsafeChars, isBlockedExtension, isCustomDomain, isDeployment, isPlatformDomain, isShipError, normalizeVia, optimizeDeployPaths, personName, personShortName, pluralize, processFilesForNode, readBearerValue, serializeLabels, validateApiKey, validateApiUrl, validateBuildCommand, validateCaller, validateDeployFile, validateDeployPath, validateDeployToken, validateFileName, validateFiles, validateIdempotencyKey, validateOAuthToken, validateOutputDir, validatePassword, validateToken, validateTtl };
+export { ACCOUNT_HEADER, API_KEY, API_PATHS, AUTH_BASE_PATH, type Account, type AccountAccess, type AccountDeleteResponse, type AccountKeyResponse, AccountPlan, type AccountPlanType, AccountRefusal, type AccountRefusalType, type AccountResource, type AccountRole, type Activity, type ActivityEvent, type ActivityListResponse, type ActivityMeta, type ApiDeployOptions, ApiHttp, type ApiHttpOptions, AuthMethod, type AuthMethodType, BUILD_SETTINGS, type BillingInterval, type BillingPortalSession, type BillingSyncResponse, type BuildFailureDetails, CALLER, type Caps, type ConsoleErrand, type ConsolePaths, type ConsoleSection, DEFAULT_API, DEPLOYMENT_CONFIG_FILENAME, DEPLOY_FIELDS, DEPLOY_FILE_GRAMMAR, DEPLOY_TOKEN, type DeployBodyContext, type DeployFile, type DeployFileEncoding, type DeployFileSpec, type DeployInput, type DeployTransport, type Deployment, type DeploymentCreateResponse, type DeploymentDeleteResponse, type DeploymentListResponse, type DeploymentOptions, type DeploymentResource, type DeploymentResourceContext, type DeploymentSetOptions, DeploymentStatus, type DeploymentStatusType, type DeploymentUploadOptions, DeploymentVia, type DeploymentViaType, type DnsLookup, type DnsProvider, type DnsRecord, type DnsRecordType, type Domain, type DomainDeleteResponse, type DomainDnsResponse, type DomainListResponse, type DomainRecordsResponse, type DomainResource, type DomainSetOptions, type DomainSetResult, type DomainShareResponse, DomainStatus, type DomainStatusType, type DomainValidateResponse, DomainVerification, type DomainVerificationType, type DomainVerifyResponse, type ErrorResponse, ErrorType, type ExecutionEnvironment, FileValidationStatus as FILE_VALIDATION_STATUS, type Fetch, type FileValidationResult, FileValidationStatus, type FileValidationStatusType, IDEMPOTENCY_KEY_CONSTRAINTS, JUNK_DIRECTORIES, LABEL_CONSTRAINTS, LABEL_PATTERN, type LabelsResponse, type ListOptions, type ListResponse, type MD5Result, MY_API_KEY_URL, OAUTH_TOKEN, OAuthScope, type OAuthScopeType, PASSWORD_CONSTRAINTS, PUBLIC_DEPLOYMENT_TTL_SECONDS, type PingResponse, type Plan, type PlanChangeRequest, type PlanChangeResponse, type PlanDestination, type PlansResponse, type PlatformLimits, type RequestResult, type ResourceContext, SECTIONS, SETUP_TROUBLESHOOTING_ANCHOR, SHIP_ENV, SHIP_VIA_ENV, SIGN_IN_RETURN_PARAM, type SPACheckDebug, type SPACheckRequest, type SPACheckResponse, SPA_CHECK_CONSTRAINTS, SPA_DEFAULT_CONFIG, type ScheduledChange, type SettingsFragment, type SetupInstructionsResponse, Ship, type ShipClientOptions, ShipError, type ShipEvents, type ShipRequestInit, type StaticFile, TTL_CONSTRAINTS, type Token, type TokenCreateOptions, type TokenCreateResponse, type TokenDeleteResponse, TokenKind, type TokenKindType, type TokenListResponse, type TokenProvider, type TokenResource, type Transport, UNBUILT_PROJECT_MARKERS, UNSAFE_FILENAME_CHARS, USER_VISIBLE_EVENTS, type UploadedFile, type UserVisibleActivityEvent, type ValidatableFile, type ValidationIssue, WEB_FILE_ACCEPT, __setTestEnvironment, accountOfPath, allValidFilesReady, assertShipJsonSyntax, billingReturnOf, calculateMD5, classifyToken, consolePaths, createAccountResource, createDeploymentResource, createDomainResource, createTokenResource, Ship as default, deserializeLabels, doors, errandOf, extractSubdomain, filterJunk, formatDuration, formatFileSize, formatTimeRemaining, generateDeploymentUrl, generateDomainUrl, getENV, getValidFiles, hasUnbuiltMarker, hasUnsafeChars, isBlockedExtension, isClaimPath, isCustomDomain, isDeployment, isInvitationPath, isPlatformDomain, isShipError, isUpgradePath, normalizeVia, optimizeDeployPaths, personName, personShortName, pluralize, processFilesForNode, readBearerValue, serializeLabels, validateApiKey, validateApiUrl, validateBuildCommand, validateCaller, validateDeployFile, validateDeployPath, validateDeployToken, validateFileName, validateFiles, validateIdempotencyKey, validateOAuthToken, validateOutputDir, validatePassword, validateToken, validateTtl };