@shipstatic/types 2.17.0-beta.3 → 2.17.0-beta.5

package/dist/index.d.ts

@@ -1223,8 +1223,10 @@ export declare const SIGN_IN_RETURN_PARAM = "signing-in";
  * Client populations: `SESSION` (first-party cookie), `API_KEY` (`ship-`
  * key), `TOKEN` (`deploy-` deploy token), `AGENT` (anonymous public deploy —
  * no credential; the platform grants the public-account identity per
- * request), `OAUTH` (delegated access token). Server populations: `WEBHOOK`
- * (signed webhook processing), `SYSTEM` (scheduled/background jobs).
+ * request), `OAUTH` (delegated access token). The one server population:
+ * `SYSTEM` (scheduled/background jobs). Webhook receipt is deliberately not
+ * a population: a signed delivery is verified, never authorized — it acts
+ * as no one and audits as no one.
  */
 export declare const AuthMethod: {
     readonly SESSION: "session";
@@ -1232,7 +1234,6 @@ export declare const AuthMethod: {
     readonly TOKEN: "token";
     readonly AGENT: "agent";
     readonly OAUTH: "oauth";
-    readonly WEBHOOK: "webhook";
     readonly SYSTEM: "system";
 };
 export type AuthMethodType = (typeof AuthMethod)[keyof typeof AuthMethod];
@@ -1938,8 +1939,14 @@ export interface BillingSyncResponse {
 /**
  * All activity event types logged in the system.
  * Uses dot notation consistently: {resource}.{action}
+ *
+ * Retention: events are swept 90 days after creation unless they record
+ * money, platform enforcement/access, or ownership transfer — those three
+ * ledgers are permanent (and shed their IP at the same 90-day line).
+ * Permanence is granted only in the retention sweep's own list, so a new
+ * event added here is swept until granted there.
  */
-export type ActivityEvent = 'account.create' | 'account.update' | 'account.delete' | 'account.key.generate' | 'account.plan.paid' | 'account.plan.transition' | 'deployment.create' | 'deployment.update' | 'deployment.delete' | 'deployment.claim' | 'deployment.flagged' | 'deployment.open' | 'domain.create' | 'domain.update' | 'domain.delete' | 'domain.verify' | 'token.create' | 'token.consume' | 'token.delete' | 'admin.account.plan.update' | 'admin.account.suspended.update' | 'admin.account.ref.update' | 'admin.account.labels.update' | 'admin.deployment.delete' | 'admin.domain.delete' | 'admin.impersonate';
+export type ActivityEvent = 'account.create' | 'account.update' | 'account.delete' | 'account.key.generate' | 'account.plan.transition' | 'deployment.create' | 'deployment.update' | 'deployment.delete' | 'deployment.claim' | 'deployment.flagged' | 'deployment.open' | 'domain.create' | 'domain.update' | 'domain.delete' | 'domain.verify' | 'token.create' | 'token.consume' | 'token.delete' | 'admin.account.plan.update' | 'admin.account.suspended.update' | 'admin.account.ref.update' | 'admin.account.labels.update' | 'admin.deployment.delete' | 'admin.domain.delete' | 'admin.impersonate';
 /**
  * Activity events visible to users in the dashboard
  */

package/dist/index.js

@@ -1150,8 +1150,10 @@ export const SIGN_IN_RETURN_PARAM = 'signing-in';
  * Client populations: `SESSION` (first-party cookie), `API_KEY` (`ship-`
  * key), `TOKEN` (`deploy-` deploy token), `AGENT` (anonymous public deploy —
  * no credential; the platform grants the public-account identity per
- * request), `OAUTH` (delegated access token). Server populations: `WEBHOOK`
- * (signed webhook processing), `SYSTEM` (scheduled/background jobs).
+ * request), `OAUTH` (delegated access token). The one server population:
+ * `SYSTEM` (scheduled/background jobs). Webhook receipt is deliberately not
+ * a population: a signed delivery is verified, never authorized — it acts
+ * as no one and audits as no one.
  */
 export const AuthMethod = {
     SESSION: 'session',
@@ -1159,7 +1161,6 @@ export const AuthMethod = {
     TOKEN: 'token',
     AGENT: 'agent',
     OAUTH: 'oauth',
-    WEBHOOK: 'webhook',
     SYSTEM: 'system',
 };
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipstatic/types",
-  "version": "2.17.0-beta.3",
+  "version": "2.17.0-beta.5",
   "description": "Shared types for ShipStatic platform",
   "type": "module",
   "main": "./dist/index.js",

package/src/index.ts

@@ -1898,8 +1898,10 @@ export const SIGN_IN_RETURN_PARAM = 'signing-in';
  * Client populations: `SESSION` (first-party cookie), `API_KEY` (`ship-`
  * key), `TOKEN` (`deploy-` deploy token), `AGENT` (anonymous public deploy —
  * no credential; the platform grants the public-account identity per
- * request), `OAUTH` (delegated access token). Server populations: `WEBHOOK`
- * (signed webhook processing), `SYSTEM` (scheduled/background jobs).
+ * request), `OAUTH` (delegated access token). The one server population:
+ * `SYSTEM` (scheduled/background jobs). Webhook receipt is deliberately not
+ * a population: a signed delivery is verified, never authorized — it acts
+ * as no one and audits as no one.
  */
 export const AuthMethod = {
   SESSION: 'session',
@@ -1907,7 +1909,6 @@ export const AuthMethod = {
   TOKEN: 'token',
   AGENT: 'agent',
   OAUTH: 'oauth',
-  WEBHOOK: 'webhook',
   SYSTEM: 'system',
 } as const;
 
@@ -2804,6 +2805,12 @@ export interface BillingSyncResponse {
 /**
  * All activity event types logged in the system.
  * Uses dot notation consistently: {resource}.{action}
+ *
+ * Retention: events are swept 90 days after creation unless they record
+ * money, platform enforcement/access, or ownership transfer — those three
+ * ledgers are permanent (and shed their IP at the same 90-day line).
+ * Permanence is granted only in the retention sweep's own list, so a new
+ * event added here is swept until granted there.
  */
 export type ActivityEvent =
   // Account events
@@ -2811,7 +2818,6 @@ export type ActivityEvent =
   | 'account.update'
   | 'account.delete'
   | 'account.key.generate'
-  | 'account.plan.paid'
   | 'account.plan.transition'
   // Deployment events
   | 'deployment.create'