@shipstatic/types 2.2.0 → 2.3.0-beta.0

package/dist/index.d.ts

@@ -11,7 +11,7 @@ export declare const DeploymentStatus: {
     readonly FAILED: "failed";
     readonly DELETING: "deleting";
 };
-export type DeploymentStatusType = typeof DeploymentStatus[keyof typeof DeploymentStatus];
+export type DeploymentStatusType = (typeof DeploymentStatus)[keyof typeof DeploymentStatus];
 /**
  * Core deployment object - used in both API responses and SDK
  */
@@ -74,7 +74,7 @@ export declare const DomainStatus: {
     readonly SUCCESS: "success";
     readonly PAUSED: "paused";
 };
-export type DomainStatusType = typeof DomainStatus[keyof typeof DomainStatus];
+export type DomainStatusType = (typeof DomainStatus)[keyof typeof DomainStatus];
 /**
  * Core domain object - used in both API responses and SDK
  */
@@ -229,7 +229,7 @@ export declare const AccountPlan: {
     readonly TERMINATING: "terminating";
     readonly TERMINATED: "terminated";
 };
-export type AccountPlanType = typeof AccountPlan[keyof typeof AccountPlan];
+export type AccountPlanType = (typeof AccountPlan)[keyof typeof AccountPlan];
 /**
  * Account usage metrics — always available regardless of billing provider.
  */
@@ -324,7 +324,7 @@ export declare const ErrorType: {
     /** Configuration error. Client-side only — set by SDK during config parsing/validation; never produced server-side. */
     readonly Config: "config_error";
 };
-export type ErrorType = typeof ErrorType[keyof typeof ErrorType];
+export type ErrorType = (typeof ErrorType)[keyof typeof ErrorType];
 /**
  * Standard error response format used everywhere
  */
@@ -518,6 +518,14 @@ export interface PingResponse {
     /** Optional timestamp */
     timestamp?: number;
 }
+/**
+ * Where human identity is mounted on the API host. The API mounts Better
+ * Auth at this path (sign-in, sign-out, session reads, admin impersonation)
+ * and the web console's auth client posts to it — shared here so the two
+ * halves of the auth pair agree by construction, the same way both sides
+ * already share the credential prefixes below.
+ */
+export declare const AUTH_BASE_PATH = "/auth";
 /**
  * How a request (or recorded activity) was authorized.
  *
@@ -536,7 +544,7 @@ export declare const AuthMethod: {
     readonly WEBHOOK: "webhook";
     readonly SYSTEM: "system";
 };
-export type AuthMethodType = typeof AuthMethod[keyof typeof AuthMethod];
+export type AuthMethodType = (typeof AuthMethod)[keyof typeof AuthMethod];
 /**
  * Shape constants for API keys (`ship-{64 hex chars}`).
  * Single source of truth used by validation utilities and auth middleware.
@@ -595,7 +603,7 @@ export declare const TokenKind: {
     readonly DEPLOY_TOKEN: "token";
     readonly OPAQUE: "opaque";
 };
-export type TokenKindType = typeof TokenKind[keyof typeof TokenKind];
+export type TokenKindType = (typeof TokenKind)[keyof typeof TokenKind];
 /**
  * Classify a client token by shape. The single dispatch used by both sides
  * of the wire: API auth middleware (which population is this credential?)
@@ -621,7 +629,7 @@ export declare const OAuthScope: {
     readonly DOMAINS_READ: "domains:read";
     readonly DOMAINS_WRITE: "domains:write";
 };
-export type OAuthScopeType = typeof OAuthScope[keyof typeof OAuthScope];
+export type OAuthScopeType = (typeof OAuthScope)[keyof typeof OAuthScope];
 export declare const DEPLOYMENT_CONFIG_FILENAME = "ship.json";
 /** Default ship.json config for SPA routing. Single source of truth — used by both API and SDK. */
 export declare const SPA_DEFAULT_CONFIG: {
@@ -924,7 +932,7 @@ export declare const FileValidationStatus: {
     /** File passed validation and is ready for deployment */
     readonly READY: "ready";
 };
-export type FileValidationStatusType = typeof FileValidationStatus[keyof typeof FileValidationStatus];
+export type FileValidationStatusType = (typeof FileValidationStatus)[keyof typeof FileValidationStatus];
 /**
  * A validation issue with a display-ready message
  *

package/dist/index.js

@@ -12,7 +12,7 @@ export const DeploymentStatus = {
     PENDING: 'pending',
     SUCCESS: 'success',
     FAILED: 'failed',
-    DELETING: 'deleting'
+    DELETING: 'deleting',
 };
 // =============================================================================
 // DOMAIN TYPES
@@ -29,7 +29,7 @@ export const DomainStatus = {
     PENDING: 'pending',
     PARTIAL: 'partial',
     SUCCESS: 'success',
-    PAUSED: 'paused'
+    PAUSED: 'paused',
 };
 // =============================================================================
 // ACCOUNT TYPES
@@ -44,7 +44,7 @@ export const AccountPlan = {
     ENTERPRISE: 'enterprise',
     SUSPENDED: 'suspended',
     TERMINATING: 'terminating',
-    TERMINATED: 'terminated'
+    TERMINATED: 'terminated',
 };
 // =============================================================================
 // ERROR SYSTEM
@@ -100,7 +100,13 @@ const CLIENT_ONLY_ERROR_TYPES = new Set([
  * union so `.has(error.type)` accepts any value from the union.
  */
 const ERROR_CATEGORIES = {
-    client: new Set([ErrorType.Business, ErrorType.Config, ErrorType.File, ErrorType.Forbidden, ErrorType.Validation]),
+    client: new Set([
+        ErrorType.Business,
+        ErrorType.Config,
+        ErrorType.File,
+        ErrorType.Forbidden,
+        ErrorType.Validation,
+    ]),
     network: new Set([ErrorType.Network]),
     auth: new Set([ErrorType.Authentication]),
 };
@@ -111,7 +117,7 @@ const ERROR_CATEGORIES = {
  * `CLIENT_ONLY_ERROR_TYPES` so adding a new server-producible type to
  * `ErrorType` is automatically picked up.
  */
-const SERVER_PRODUCIBLE_ERROR_TYPES = new Set(Object.values(ErrorType).filter(t => !CLIENT_ONLY_ERROR_TYPES.has(t)));
+const SERVER_PRODUCIBLE_ERROR_TYPES = new Set(Object.values(ErrorType).filter((t) => !CLIENT_ONLY_ERROR_TYPES.has(t)));
 /**
  * Simple unified error class for both API and SDK
  */
@@ -132,14 +138,12 @@ export class ShipError extends Error {
         // tag (see `ShipError.authentication` JSDoc) — these are server-side
         // diagnostics like 'session_invalid' that must not leak to clients.
         const authDetails = this.details;
-        const details = this.type === ErrorType.Authentication && authDetails?.internal
-            ? undefined
-            : this.details;
+        const details = this.type === ErrorType.Authentication && authDetails?.internal ? undefined : this.details;
         return {
             error: this.type,
             message: this.message,
             status: this.status,
-            details
+            details,
         };
     }
     /**
@@ -194,10 +198,14 @@ export class ShipError extends Error {
             // Body unreadable; fall through to operationName-derived message.
         }
         message = message || `${operationName || 'Request'} failed with status ${response.status}`;
-        const type = bodyType ?? (response.status === 401 ? ErrorType.Authentication :
-            response.status === 403 ? ErrorType.Forbidden :
-                response.status === 429 ? ErrorType.RateLimit :
-                    ErrorType.Api);
+        const type = bodyType ??
+            (response.status === 401
+                ? ErrorType.Authentication
+                : response.status === 403
+                    ? ErrorType.Forbidden
+                    : response.status === 429
+                        ? ErrorType.RateLimit
+                        : ErrorType.Api);
         return new ShipError(type, message, response.status, details);
     }
     /**
@@ -247,7 +255,7 @@ export class ShipError extends Error {
     static forbidden(message, details) {
         return new ShipError(ErrorType.Forbidden, message, 403, details);
     }
-    static rateLimit(message = "Too many requests", details) {
+    static rateLimit(message = 'Too many requests', details) {
         return new ShipError(ErrorType.RateLimit, message, 429, details);
     }
     /**
@@ -263,7 +271,7 @@ export class ShipError extends Error {
      * Use this pattern in API auth code; do not put client-visible info under
      * `internal`. Other `details` keys round-trip normally.
      */
-    static authentication(message = "Authentication required", details) {
+    static authentication(message = 'Authentication required', details) {
         return new ShipError(ErrorType.Authentication, message, 401, details);
     }
     static business(message, status = 400, details) {
@@ -332,21 +340,47 @@ export function isShipError(error) {
  */
 export const BLOCKED_EXTENSIONS = new Set([
     // Executables
-    'exe', 'msi', 'dll', 'scr', 'bat', 'cmd', 'com', 'pif', 'app', 'deb', 'rpm',
+    'exe',
+    'msi',
+    'dll',
+    'scr',
+    'bat',
+    'cmd',
+    'com',
+    'pif',
+    'app',
+    'deb',
+    'rpm',
     // Installers
-    'pkg', 'mpkg',
+    'pkg',
+    'mpkg',
     // Disk images
-    'dmg', 'iso', 'img',
+    'dmg',
+    'iso',
+    'img',
     // Malware vectors
-    'cab', 'cpl', 'chm',
+    'cab',
+    'cpl',
+    'chm',
     // Dangerous scripts
-    'ps1', 'vbs', 'vbe', 'ws', 'wsf', 'wsc', 'wsh', 'reg',
+    'ps1',
+    'vbs',
+    'vbe',
+    'ws',
+    'wsf',
+    'wsc',
+    'wsh',
+    'reg',
     // Java
-    'jar', 'jnlp',
+    'jar',
+    'jnlp',
     // Mobile/browser packages
-    'apk', 'crx',
+    'apk',
+    'crx',
     // Shortcut/link
-    'lnk', 'inf', 'hta',
+    'lnk',
+    'inf',
+    'hta',
 ]);
 /**
  * Check if a filename has a blocked extension.
@@ -381,6 +415,7 @@ export function isBlockedExtension(filename) {
  *
  * Everything else is allowed — browser percent-encodes, Worker decodes, R2 matches.
  */
+// biome-ignore lint/suspicious/noControlCharactersInRegex: blocking control characters is this regex's purpose
 export const UNSAFE_FILENAME_CHARS = /[\x00-\x1f\x7f#?%\\<>"]/;
 /**
  * Check if a filename contains unsafe characters.
@@ -415,15 +450,24 @@ export const UNBUILT_PROJECT_MARKERS = new Set([
  */
 export function hasUnbuiltMarker(filePath) {
     const segments = filePath.replace(/\\/g, '/').split('/').filter(Boolean);
-    return segments.some(s => UNBUILT_PROJECT_MARKERS.has(s));
+    return segments.some((s) => UNBUILT_PROJECT_MARKERS.has(s));
 }
 // =============================================================================
 // CREDENTIAL SHAPES
 // =============================================================================
-// The one address for credential vocabulary: how a request is authorized
-// (AuthMethod), the shapes that distinguish populations on the wire
-// (API_KEY, DEPLOY_TOKEN, CALLER), the single dispatch over them (TokenKind,
-// classifyToken), and the delegated-access scopes (OAuthScope).
+// The one address for credential vocabulary: where human identity lives
+// (AUTH_BASE_PATH), how a request is authorized (AuthMethod), the shapes
+// that distinguish populations on the wire (API_KEY, DEPLOY_TOKEN, CALLER),
+// the single dispatch over them (TokenKind, classifyToken), and the
+// delegated-access scopes (OAuthScope).
+/**
+ * Where human identity is mounted on the API host. The API mounts Better
+ * Auth at this path (sign-in, sign-out, session reads, admin impersonation)
+ * and the web console's auth client posts to it — shared here so the two
+ * halves of the auth pair agree by construction, the same way both sides
+ * already share the credential prefixes below.
+ */
+export const AUTH_BASE_PATH = '/auth';
 /**
  * How a request (or recorded activity) was authorized.
  *
@@ -440,7 +484,7 @@ export const AuthMethod = {
     AGENT: 'agent',
     OAUTH: 'oauth',
     WEBHOOK: 'webhook',
-    SYSTEM: 'system'
+    SYSTEM: 'system',
 };
 /**
  * Shape constants for API keys (`ship-{64 hex chars}`).
@@ -536,7 +580,9 @@ export const OAuthScope = {
 // =============================================================================
 export const DEPLOYMENT_CONFIG_FILENAME = 'ship.json';
 /** Default ship.json config for SPA routing. Single source of truth — used by both API and SDK. */
-export const SPA_DEFAULT_CONFIG = { rewrites: [{ source: '/(.*)', destination: '/index.html' }] };
+export const SPA_DEFAULT_CONFIG = {
+    rewrites: [{ source: '/(.*)', destination: '/index.html' }],
+};
 // =============================================================================
 // VALIDATION UTILITIES
 // =============================================================================
@@ -578,9 +624,11 @@ export function validateDeployToken(deployToken) {
 export function validateToken(token) {
     switch (classifyToken(token)) {
         case TokenKind.API_KEY:
-            return validateApiKey(token);
+            validateApiKey(token);
+            return;
         case TokenKind.DEPLOY_TOKEN:
-            return validateDeployToken(token);
+            validateDeployToken(token);
+            return;
         case TokenKind.OPAQUE:
             if (!token)
                 throw ShipError.validation('Token must be a non-empty string');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipstatic/types",
-  "version": "2.2.0",
+  "version": "2.3.0-beta.0",
   "description": "Shared types for ShipStatic platform",
   "type": "module",
   "main": "./dist/index.js",
@@ -33,14 +33,17 @@
     "node": ">=20.0.0"
   },
   "devDependencies": {
+    "@biomejs/biome": "2.5.5",
     "@types/node": "^24.10.9",
-    "husky": "^9.1.7",
     "typescript": "^5.9.3",
     "vitest": "^2.1.8"
   },
   "scripts": {
     "build": "tsc",
     "clean": "rm -rf dist",
-    "test": "vitest"
+    "test": "vitest",
+    "lint": "biome check .",
+    "format": "biome format --write .",
+    "typecheck": "tsc --noEmit"
   }
 }

package/src/index.ts

@@ -14,10 +14,10 @@ export const DeploymentStatus = {
   PENDING: 'pending',
   SUCCESS: 'success',
   FAILED: 'failed',
-  DELETING: 'deleting'
+  DELETING: 'deleting',
 } as const;
 
-export type DeploymentStatusType = typeof DeploymentStatus[keyof typeof DeploymentStatus];
+export type DeploymentStatusType = (typeof DeploymentStatus)[keyof typeof DeploymentStatus];
 
 /**
  * Core deployment object - used in both API responses and SDK
@@ -49,7 +49,6 @@ export interface Deployment {
   readonly screenshot: string;
 }
 
-
 /**
  * Response from deployment creation. Extends Deployment with one-time fields
  * only present on creation (not on subsequent GET requests).
@@ -87,10 +86,10 @@ export const DomainStatus = {
   PENDING: 'pending',
   PARTIAL: 'partial',
   SUCCESS: 'success',
-  PAUSED: 'paused'
+  PAUSED: 'paused',
 } as const;
 
-export type DomainStatusType = typeof DomainStatus[keyof typeof DomainStatus];
+export type DomainStatusType = (typeof DomainStatus)[keyof typeof DomainStatus];
 
 /**
  * Core domain object - used in both API responses and SDK
@@ -262,10 +261,10 @@ export const AccountPlan = {
   ENTERPRISE: 'enterprise',
   SUSPENDED: 'suspended',
   TERMINATING: 'terminating',
-  TERMINATED: 'terminated'
+  TERMINATED: 'terminated',
 } as const;
 
-export type AccountPlanType = typeof AccountPlan[keyof typeof AccountPlan];
+export type AccountPlanType = (typeof AccountPlan)[keyof typeof AccountPlan];
 
 /**
  * Account usage metrics — always available regardless of billing provider.
@@ -370,7 +369,7 @@ export const ErrorType = {
   Config: 'config_error',
 } as const;
 
-export type ErrorType = typeof ErrorType[keyof typeof ErrorType];
+export type ErrorType = (typeof ErrorType)[keyof typeof ErrorType];
 
 /**
  * Error types that originate exclusively on the client (HTTP clients, SDK
@@ -391,7 +390,13 @@ const CLIENT_ONLY_ERROR_TYPES = new Set<string>([
  * union so `.has(error.type)` accepts any value from the union.
  */
 const ERROR_CATEGORIES = {
-  client: new Set<ErrorType>([ErrorType.Business, ErrorType.Config, ErrorType.File, ErrorType.Forbidden, ErrorType.Validation]),
+  client: new Set<ErrorType>([
+    ErrorType.Business,
+    ErrorType.Config,
+    ErrorType.File,
+    ErrorType.Forbidden,
+    ErrorType.Validation,
+  ]),
   network: new Set<ErrorType>([ErrorType.Network]),
   auth: new Set<ErrorType>([ErrorType.Authentication]),
 } as const;
@@ -404,7 +409,7 @@ const ERROR_CATEGORIES = {
  * `ErrorType` is automatically picked up.
  */
 const SERVER_PRODUCIBLE_ERROR_TYPES = new Set<string>(
-  Object.values(ErrorType).filter(t => !CLIENT_ONLY_ERROR_TYPES.has(t)),
+  Object.values(ErrorType).filter((t) => !CLIENT_ONLY_ERROR_TYPES.has(t)),
 );
 
 /**
@@ -441,15 +446,14 @@ export class ShipError extends Error {
     // tag (see `ShipError.authentication` JSDoc) — these are server-side
     // diagnostics like 'session_invalid' that must not leak to clients.
     const authDetails = this.details as { internal?: unknown } | undefined;
-    const details = this.type === ErrorType.Authentication && authDetails?.internal
-      ? undefined
-      : this.details;
+    const details =
+      this.type === ErrorType.Authentication && authDetails?.internal ? undefined : this.details;
 
     return {
       error: this.type,
       message: this.message,
       status: this.status,
-      details
+      details,
     };
   }
 
@@ -475,10 +479,7 @@ export class ShipError extends Error {
    * Async because it reads the response body. Returns rather than throws so
    * callers can compose; most will `throw await ShipError.fromHttpResponse(...)`.
    */
-  static async fromHttpResponse(
-    response: Response,
-    operationName?: string,
-  ): Promise<ShipError> {
+  static async fromHttpResponse(response: Response, operationName?: string): Promise<ShipError> {
     let message: string | undefined;
     let details: unknown;
     let bodyType: ErrorType | undefined;
@@ -506,12 +507,15 @@ export class ShipError extends Error {
 
     message = message || `${operationName || 'Request'} failed with status ${response.status}`;
 
-    const type = bodyType ?? (
-      response.status === 401 ? ErrorType.Authentication :
-      response.status === 403 ? ErrorType.Forbidden :
-      response.status === 429 ? ErrorType.RateLimit :
-      ErrorType.Api
-    );
+    const type =
+      bodyType ??
+      (response.status === 401
+        ? ErrorType.Authentication
+        : response.status === 403
+          ? ErrorType.Forbidden
+          : response.status === 429
+            ? ErrorType.RateLimit
+            : ErrorType.Api);
 
     return new ShipError(type, message, response.status, details);
   }
@@ -570,7 +574,7 @@ export class ShipError extends Error {
     return new ShipError(ErrorType.Forbidden, message, 403, details);
   }
 
-  static rateLimit(message: string = "Too many requests", details?: unknown): ShipError {
+  static rateLimit(message: string = 'Too many requests', details?: unknown): ShipError {
     return new ShipError(ErrorType.RateLimit, message, 429, details);
   }
 
@@ -587,7 +591,7 @@ export class ShipError extends Error {
    * Use this pattern in API auth code; do not put client-visible info under
    * `internal`. Other `details` keys round-trip normally.
    */
-  static authentication(message: string = "Authentication required", details?: unknown): ShipError {
+  static authentication(message: string = 'Authentication required', details?: unknown): ShipError {
     return new ShipError(ErrorType.Authentication, message, 401, details);
   }
 
@@ -694,21 +698,47 @@ export interface PlatformLimits {
  */
 export const BLOCKED_EXTENSIONS: ReadonlySet<string> = new Set([
   // Executables
-  'exe', 'msi', 'dll', 'scr', 'bat', 'cmd', 'com', 'pif', 'app', 'deb', 'rpm',
+  'exe',
+  'msi',
+  'dll',
+  'scr',
+  'bat',
+  'cmd',
+  'com',
+  'pif',
+  'app',
+  'deb',
+  'rpm',
   // Installers
-  'pkg', 'mpkg',
+  'pkg',
+  'mpkg',
   // Disk images
-  'dmg', 'iso', 'img',
+  'dmg',
+  'iso',
+  'img',
   // Malware vectors
-  'cab', 'cpl', 'chm',
+  'cab',
+  'cpl',
+  'chm',
   // Dangerous scripts
-  'ps1', 'vbs', 'vbe', 'ws', 'wsf', 'wsc', 'wsh', 'reg',
+  'ps1',
+  'vbs',
+  'vbe',
+  'ws',
+  'wsf',
+  'wsc',
+  'wsh',
+  'reg',
   // Java
-  'jar', 'jnlp',
+  'jar',
+  'jnlp',
   // Mobile/browser packages
-  'apk', 'crx',
+  'apk',
+  'crx',
   // Shortcut/link
-  'lnk', 'inf', 'hta',
+  'lnk',
+  'inf',
+  'hta',
 ]);
 
 /**
@@ -745,6 +775,7 @@ export function isBlockedExtension(filename: string): boolean {
  *
  * Everything else is allowed — browser percent-encodes, Worker decodes, R2 matches.
  */
+// biome-ignore lint/suspicious/noControlCharactersInRegex: blocking control characters is this regex's purpose
 export const UNSAFE_FILENAME_CHARS = /[\x00-\x1f\x7f#?%\\<>"]/;
 
 /**
@@ -783,7 +814,7 @@ export const UNBUILT_PROJECT_MARKERS: ReadonlySet<string> = new Set([
  */
 export function hasUnbuiltMarker(filePath: string): boolean {
   const segments = filePath.replace(/\\/g, '/').split('/').filter(Boolean);
-  return segments.some(s => UNBUILT_PROJECT_MARKERS.has(s));
+  return segments.some((s) => UNBUILT_PROJECT_MARKERS.has(s));
 }
 
 // =============================================================================
@@ -803,10 +834,20 @@ export interface PingResponse {
 // =============================================================================
 // CREDENTIAL SHAPES
 // =============================================================================
-// The one address for credential vocabulary: how a request is authorized
-// (AuthMethod), the shapes that distinguish populations on the wire
-// (API_KEY, DEPLOY_TOKEN, CALLER), the single dispatch over them (TokenKind,
-// classifyToken), and the delegated-access scopes (OAuthScope).
+// The one address for credential vocabulary: where human identity lives
+// (AUTH_BASE_PATH), how a request is authorized (AuthMethod), the shapes
+// that distinguish populations on the wire (API_KEY, DEPLOY_TOKEN, CALLER),
+// the single dispatch over them (TokenKind, classifyToken), and the
+// delegated-access scopes (OAuthScope).
+
+/**
+ * Where human identity is mounted on the API host. The API mounts Better
+ * Auth at this path (sign-in, sign-out, session reads, admin impersonation)
+ * and the web console's auth client posts to it — shared here so the two
+ * halves of the auth pair agree by construction, the same way both sides
+ * already share the credential prefixes below.
+ */
+export const AUTH_BASE_PATH = '/auth';
 
 /**
  * How a request (or recorded activity) was authorized.
@@ -824,10 +865,10 @@ export const AuthMethod = {
   AGENT: 'agent',
   OAUTH: 'oauth',
   WEBHOOK: 'webhook',
-  SYSTEM: 'system'
+  SYSTEM: 'system',
 } as const;
 
-export type AuthMethodType = typeof AuthMethod[keyof typeof AuthMethod];
+export type AuthMethodType = (typeof AuthMethod)[keyof typeof AuthMethod];
 
 /**
  * Shape constants for API keys (`ship-{64 hex chars}`).
@@ -891,7 +932,7 @@ export const TokenKind = {
   OPAQUE: 'opaque',
 } as const;
 
-export type TokenKindType = typeof TokenKind[keyof typeof TokenKind];
+export type TokenKindType = (typeof TokenKind)[keyof typeof TokenKind];
 
 /**
  * Classify a client token by shape. The single dispatch used by both sides
@@ -924,7 +965,7 @@ export const OAuthScope = {
   DOMAINS_WRITE: 'domains:write',
 } as const;
 
-export type OAuthScopeType = typeof OAuthScope[keyof typeof OAuthScope];
+export type OAuthScopeType = (typeof OAuthScope)[keyof typeof OAuthScope];
 
 // =============================================================================
 // DEPLOYMENT CONFIGURATION CONSTANTS
@@ -933,7 +974,9 @@ export type OAuthScopeType = typeof OAuthScope[keyof typeof OAuthScope];
 export const DEPLOYMENT_CONFIG_FILENAME = 'ship.json';
 
 /** Default ship.json config for SPA routing. Single source of truth — used by both API and SDK. */
-export const SPA_DEFAULT_CONFIG = { rewrites: [{ source: '/(.*)', destination: '/index.html' }] } as const;
+export const SPA_DEFAULT_CONFIG = {
+  rewrites: [{ source: '/(.*)', destination: '/index.html' }],
+} as const;
 
 // =============================================================================
 // VALIDATION UTILITIES
@@ -947,19 +990,23 @@ export const SPA_DEFAULT_CONFIG = { rewrites: [{ source: '/(.*)', destination: '
 function validatePrefixedCredential(
   value: string,
   shape: { PREFIX: string; HEX_LENGTH: number; TOTAL_LENGTH: number },
-  label: string
+  label: string,
 ): void {
   if (!value.startsWith(shape.PREFIX)) {
     throw ShipError.validation(`${label} must start with "${shape.PREFIX}"`);
   }
 
   if (value.length !== shape.TOTAL_LENGTH) {
-    throw ShipError.validation(`${label} must be ${shape.TOTAL_LENGTH} characters total (${shape.PREFIX} + ${shape.HEX_LENGTH} hex chars)`);
+    throw ShipError.validation(
+      `${label} must be ${shape.TOTAL_LENGTH} characters total (${shape.PREFIX} + ${shape.HEX_LENGTH} hex chars)`,
+    );
   }
 
   const hexPart = value.slice(shape.PREFIX.length);
   if (!new RegExp(`^[a-f0-9]{${shape.HEX_LENGTH}}$`, 'i').test(hexPart)) {
-    throw ShipError.validation(`${label} must contain ${shape.HEX_LENGTH} hexadecimal characters after "${shape.PREFIX}" prefix`);
+    throw ShipError.validation(
+      `${label} must contain ${shape.HEX_LENGTH} hexadecimal characters after "${shape.PREFIX}" prefix`,
+    );
   }
 }
 
@@ -986,9 +1033,11 @@ export function validateDeployToken(deployToken: string): void {
 export function validateToken(token: string): void {
   switch (classifyToken(token)) {
     case TokenKind.API_KEY:
-      return validateApiKey(token);
+      validateApiKey(token);
+      return;
     case TokenKind.DEPLOY_TOKEN:
-      return validateDeployToken(token);
+      validateDeployToken(token);
+      return;
     case TokenKind.OPAQUE:
       if (!token) throw ShipError.validation('Token must be a non-empty string');
   }
@@ -1002,7 +1051,7 @@ export function validateToken(token: string): void {
 export function validateCaller(caller: string): void {
   if (!caller || caller.length > CALLER.MAX_LENGTH || !CALLER.PATTERN.test(caller)) {
     throw ShipError.validation(
-      `Caller must be 1-${CALLER.MAX_LENGTH} characters: letters, digits, dots, underscores, or hyphens`
+      `Caller must be 1-${CALLER.MAX_LENGTH} characters: letters, digits, dots, underscores, or hyphens`,
     );
   }
 }
@@ -1180,7 +1229,10 @@ export interface DeploymentUploadOptions {
  * Deployment resource interface - the contract all implementations must follow
  */
 export interface DeploymentResource {
-  upload: (input: DeployInput, options?: DeploymentUploadOptions) => Promise<DeploymentCreateResponse>;
+  upload: (
+    input: DeployInput,
+    options?: DeploymentUploadOptions,
+  ) => Promise<DeploymentCreateResponse>;
   list: () => Promise<DeploymentListResponse>;
   get: (id: string) => Promise<Deployment>;
   set: (id: string, options: { labels: string[] }) => Promise<Deployment>;
@@ -1191,7 +1243,10 @@ export interface DeploymentResource {
  * Domain resource interface - the contract all implementations must follow
  */
 export interface DomainResource {
-  set: (name: string, options?: { deployment?: string; labels?: string[] }) => Promise<DomainSetResult>;
+  set: (
+    name: string,
+    options?: { deployment?: string; labels?: string[] },
+  ) => Promise<DomainSetResult>;
   list: () => Promise<DomainListResponse>;
   get: (name: string) => Promise<Domain>;
   remove: (name: string) => Promise<void>;
@@ -1241,7 +1296,6 @@ export interface BillingStatus {
   portal: string | null;
 }
 
-
 /**
  * Checkout session response from POST /billing/checkout
  */
@@ -1305,9 +1359,9 @@ export type ActivityEvent =
   | 'refund.created'
   | 'dispute.created'
   // Billing operational events (admin/debug only, not user-visible)
-  | 'billing.sync'    // Outbound: unit count pushed to payment provider
-  | 'billing.stale'   // Dropped: webhook predates last known state
-  | 'billing.race';   // Dropped: concurrent webhook already updated state
+  | 'billing.sync' // Outbound: unit count pushed to payment provider
+  | 'billing.stale' // Dropped: webhook predates last known state
+  | 'billing.race'; // Dropped: concurrent webhook already updated state
 
 /**
  * Activity events visible to users in the dashboard
@@ -1416,8 +1470,8 @@ export const FileValidationStatus = {
   READY: 'ready',
 } as const;
 
-export type FileValidationStatusType = typeof FileValidationStatus[keyof typeof FileValidationStatus];
-
+export type FileValidationStatusType =
+  (typeof FileValidationStatus)[keyof typeof FileValidationStatus];
 
 /**
  * A validation issue with a display-ready message
@@ -1660,4 +1714,4 @@ export function validatePassword(value: unknown): string | undefined {
     );
   }
   return trimmed;
-}
+}