From 48b9f27d2eb360b9e9d08f964cc76ab854954112 Mon Sep 17 00:00:00 2001
From: Mark Stuart <mstuart@users.noreply.github.com>
Date: Sun, 9 Aug 2026 18:19:20 -0700
Subject: [PATCH 1/2] chore: migrate to ultracite

---
 biome.jsonc       |   4 +
 package-lock.json | 536 +++++++++++++++++++++++++++++++++++++++++++++-
 package.json      |  18 +-
 3 files changed, 550 insertions(+), 8 deletions(-)
 create mode 100644 biome.jsonc

diff --git a/biome.jsonc b/biome.jsonc
new file mode 100644
index 0000000..a39804b
--- /dev/null
+++ b/biome.jsonc
@@ -0,0 +1,4 @@
+{
+  "$schema": "./node_modules/@biomejs/biome/configuration_schema.json",
+  "extends": ["ultracite/biome/core"]
+}
diff --git a/package-lock.json b/package-lock.json
index d82ead5..b298b5d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,8 +9,215 @@
       "version": "0.1.0",
       "license": "MIT",
       "devDependencies": {
+        "@biomejs/biome": "2.5.6",
         "@types/node": "^22.20.1",
-        "typescript": "^5.9.3"
+        "typescript": "^5.9.3",
+        "ultracite": "7.10.2"
+      }
+    },
+    "node_modules/@biomejs/biome": {
+      "version": "2.5.6",
+      "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-2.5.6.tgz",
+      "integrity": "sha512-lxVNjv7UF6KfhMJfL9gaUHbWdJdHbsAj6OSmwSYNdhRuG67NxNQ4Xdvh3TUxsSK9sBzJBQhEJj3AopmmNJ5pSA==",
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "bin": {
+        "biome": "bin/biome"
+      },
+      "engines": {
+        "node": ">=14.21.3"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/biome"
+      },
+      "optionalDependencies": {
+        "@biomejs/cli-darwin-arm64": "2.5.6",
+        "@biomejs/cli-darwin-x64": "2.5.6",
+        "@biomejs/cli-linux-arm64": "2.5.6",
+        "@biomejs/cli-linux-arm64-musl": "2.5.6",
+        "@biomejs/cli-linux-x64": "2.5.6",
+        "@biomejs/cli-linux-x64-musl": "2.5.6",
+        "@biomejs/cli-win32-arm64": "2.5.6",
+        "@biomejs/cli-win32-x64": "2.5.6"
+      }
+    },
+    "node_modules/@biomejs/cli-darwin-arm64": {
+      "version": "2.5.6",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.5.6.tgz",
+      "integrity": "sha512-zMOLZP4oMrjh6m1zcSj1ud2awUPgTuMVbmQhYYWL7J8HwCnbHHBvTm7VBTRuY7epT5bez76IpKYQ11ZAqHFlnw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-darwin-x64": {
+      "version": "2.5.6",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.5.6.tgz",
+      "integrity": "sha512-JAC1VqzvO7Th5ZplU0G2uGfkZbxEe9uDDektPAhF0JLusoz1w+T4okp2bkykI0bbaO2vslKiRfj4gU43JaGreA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-linux-arm64": {
+      "version": "2.5.6",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.5.6.tgz",
+      "integrity": "sha512-6XsYwCFkp5sMxl85ffhgeGpGgs6A7dRYFnkceZ7WVxvycuTnGdD5xa534Z3xfrBQ0JCMK/mujT6ZNPJoghedwg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-linux-arm64-musl": {
+      "version": "2.5.6",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.5.6.tgz",
+      "integrity": "sha512-eUa3jeeYvfMt19LBeh6E5PUZpxnTC4JqNWo+EDjTtQjAr2xLGnWaxACtVU1DQqmHYbvThlJzLX+ZsYgrqh2qVw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-linux-x64": {
+      "version": "2.5.6",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.5.6.tgz",
+      "integrity": "sha512-Pop9VXCFUhFTMfFefZ39S+u2rOPyNp5iHlxbZRwXGACHLy2r0jjiRgJHmaEKJzL3SyxlVeGShXhvvElvWowonA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-linux-x64-musl": {
+      "version": "2.5.6",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.5.6.tgz",
+      "integrity": "sha512-2Vp13QdKysH3HIWLaYLhUUwbK+jbZonJD1K+Lr0d0RO4wH7mkYd43vJixEDm8cUWrowoRz4UUHF1nm9Ae7ym8A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-win32-arm64": {
+      "version": "2.5.6",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.5.6.tgz",
+      "integrity": "sha512-tDGshcm6BdkZOCGnTDX0Y8/U4IfBSlnUU7T56nNDuPEfed+aHg+u8G36NB43fJVl0Os6+QURXIE1yuD7AaEofA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-win32-x64": {
+      "version": "2.5.6",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.5.6.tgz",
+      "integrity": "sha512-WN05KwXnTO/2J45RQPvzZMXf7tZUIofHoR35xIPfCo7pQ2RFidxI8sfb5mGsaTxdMmEOzHzOPRCdA5/fCpc7xQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@clack/core": {
+      "version": "1.4.3",
+      "resolved": "https://registry.npmjs.org/@clack/core/-/core-1.4.3.tgz",
+      "integrity": "sha512-/kr3UWNtdJfxZtPgDqUOmG2pvwlmcLGheex5yiZKdwbzZJxhV+HMNR9QNmyY5cGwTNV6LrR7Jtp+KjhUAP1qBQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fast-wrap-ansi": "^0.2.0",
+        "sisteransi": "^1.0.5"
+      },
+      "engines": {
+        "node": ">= 20.12.0"
+      }
+    },
+    "node_modules/@clack/prompts": {
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/@clack/prompts/-/prompts-1.7.0.tgz",
+      "integrity": "sha512-y7/yvZ2TPAnR9+jnc00klvNNLkJiXFFrQA/hlLCcxA9a2A4zQIOimyFQ9XfwYKiGD1fb5GY8vbKIIgO8d5Tb2A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@clack/core": "1.4.3",
+        "fast-string-width": "^3.0.2",
+        "fast-wrap-ansi": "^0.2.0",
+        "sisteransi": "^1.0.5"
+      },
+      "engines": {
+        "node": ">= 20.12.0"
       }
     },
     "node_modules/@types/node": {
@@ -23,6 +230,258 @@
         "undici-types": "~6.21.0"
       }
     },
+    "node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/citty": {
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/citty/-/citty-0.2.2.tgz",
+      "integrity": "sha512-+6vJA3L98yv+IdfKGZHBNiGW5KHn22e/JwID0Strsz8h4S/csAu/OuICwxrg44k5MRiZHWIo8XXuJgQTriRP4w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/commander": {
+      "version": "15.0.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-15.0.0.tgz",
+      "integrity": "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=22.12.0"
+      }
+    },
+    "node_modules/cross-spawn": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/deepmerge": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz",
+      "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/fast-string-truncated-width": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/fast-string-truncated-width/-/fast-string-truncated-width-3.0.3.tgz",
+      "integrity": "sha512-0jjjIEL6+0jag3l2XWWizO64/aZVtpiGE3t0Zgqxv0DPuxiMjvB3M24fCyhZUO4KomJQPj3LTSUnDP3GpdwC0g==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fast-string-width": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/fast-string-width/-/fast-string-width-3.0.2.tgz",
+      "integrity": "sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fast-string-truncated-width": "^3.0.2"
+      }
+    },
+    "node_modules/fast-wrap-ansi": {
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/fast-wrap-ansi/-/fast-wrap-ansi-0.2.2.tgz",
+      "integrity": "sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fast-string-width": "^3.0.2"
+      }
+    },
+    "node_modules/glob": {
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/jsonc-parser": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.3.1.tgz",
+      "integrity": "sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/lru-cache": {
+      "version": "11.5.2",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
+      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/minimatch": {
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.8"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
+    "node_modules/nypm": {
+      "version": "0.6.9",
+      "resolved": "https://registry.npmjs.org/nypm/-/nypm-0.6.9.tgz",
+      "integrity": "sha512-zxlE2yvSWZWmHcNdT3+5zV2lrCogeE9YOklHrR3dFjqutq5wO7GFDYLFDRXLsYnJzwvy/im9fYoxePvS0VTW0w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "citty": "^0.2.2",
+        "pathe": "^2.0.3",
+        "tinyexec": "^1.2.4"
+      },
+      "bin": {
+        "nypm": "dist/cli.mjs"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-scurry": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/pathe": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
+      "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/sisteransi": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/sisteransi/-/sisteransi-1.0.5.tgz",
+      "integrity": "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tinyexec": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.3.0.tgz",
+      "integrity": "sha512-QKAl9m8gWWGHV8jZcPeym6j+XULi6tOf1mT83WYJ4Lk2ytW/uwAWkrP0uFsdoYMdueVJ0qs26wZ+23xeB4ibNQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/typescript": {
       "version": "5.9.3",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
@@ -37,12 +496,87 @@
         "node": ">=14.17"
       }
     },
+    "node_modules/ultracite": {
+      "version": "7.10.2",
+      "resolved": "https://registry.npmjs.org/ultracite/-/ultracite-7.10.2.tgz",
+      "integrity": "sha512-WP1Hu/BKy/BDgntaiU33uq2Y8hKL2gEO5li2wfg7XFvmlyIkGDEy8qbWg7GHsxTEjEpWOAKpyFSF8aqc3JNEGQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@clack/prompts": "^1.5.1",
+        "commander": "^15.0.0",
+        "cross-spawn": "^7.0.6",
+        "deepmerge": "^4.3.1",
+        "glob": "^13.0.6",
+        "jsonc-parser": "^3.3.1",
+        "nypm": "^0.6.6",
+        "yaml": "^2.9.0",
+        "zod": "^4.4.3"
+      },
+      "bin": {
+        "ultracite": "dist/index.js"
+      },
+      "peerDependencies": {
+        "oxfmt": ">=0.1.0",
+        "oxlint": "^1.0.0"
+      },
+      "peerDependenciesMeta": {
+        "oxfmt": {
+          "optional": true
+        },
+        "oxlint": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/undici-types": {
       "version": "6.21.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
       "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
       "dev": true,
       "license": "MIT"
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/yaml": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
+      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "yaml": "bin.mjs"
+      },
+      "engines": {
+        "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
+      }
+    },
+    "node_modules/zod": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
     }
   }
 }
diff --git a/package.json b/package.json
index b0cacef..40ca776 100644
--- a/package.json
+++ b/package.json
@@ -2,12 +2,6 @@
   "name": "openapi-sentinel",
   "version": "0.1.0",
   "description": "Runtime OpenAPI 3.1 request/response validation middleware — detect spec drift live",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "scripts": {
-    "build": "tsc",
-    "test": "npx tsx --test tests/*.test.ts"
-  },
   "keywords": [
     "openapi",
     "validation",
@@ -16,8 +10,18 @@
     "api"
   ],
   "license": "MIT",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "check": "ultracite check",
+    "fix": "ultracite fix",
+    "test": "npx tsx --test tests/*.test.ts"
+  },
   "devDependencies": {
+    "@biomejs/biome": "2.5.6",
     "@types/node": "^22.20.1",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "ultracite": "7.10.2"
   }
 }

From 7e712a5a66e2b5538d518ef398eb78166031cffb Mon Sep 17 00:00:00 2001
From: Mark Stuart <mstuart@users.noreply.github.com>
Date: Sun, 9 Aug 2026 21:07:23 -0700
Subject: [PATCH 2/2] chore: enforce ultracite

---
 .github/workflows/ci.yml |   2 +
 AGENTS.md                | 123 +++++++++++++++++++++++++
 docs/assets/logo.svg     |  60 ++++++++++--
 src/index.ts             |   7 +-
 src/loader.ts            |   9 +-
 src/matcher.ts           |  45 ++++++---
 src/reporter.ts          |  14 +--
 src/sentinel.ts          |  72 +++++++++------
 src/types.ts             |  43 +++++----
 src/validator.ts         | 147 ++++++++++++++++++------------
 tests/matcher.test.ts    |  94 +++++++++----------
 tests/sentinel.test.ts   | 144 ++++++++++++++---------------
 tests/validator.test.ts  | 192 +++++++++++++++++++++------------------
 13 files changed, 602 insertions(+), 350 deletions(-)
 create mode 100644 AGENTS.md

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5eed664..8b3dfd2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,5 +22,7 @@ jobs:
           node-version: ${{ matrix.node }}
           cache: npm
       - run: npm ci
+      - name: Ultracite check
+        run: npm run check
       - run: npm run build
       - run: npm test
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..28d2de8
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,123 @@
+# Ultracite Code Standards
+
+This project uses **Ultracite**, a zero-config preset that enforces strict code quality standards through automated formatting and linting.
+
+## Quick Reference
+
+- **Format code**: `npm exec -- ultracite fix`
+- **Check for issues**: `npm exec -- ultracite check`
+- **Diagnose setup**: `npm exec -- ultracite doctor`
+
+Biome (the underlying engine) provides robust linting and formatting. Most issues are automatically fixable.
+
+---
+
+## Core Principles
+
+Write code that is **accessible, performant, type-safe, and maintainable**. Focus on clarity and explicit intent over brevity.
+
+### Type Safety & Explicitness
+
+- Use explicit types for function parameters and return values when they enhance clarity
+- Prefer `unknown` over `any` when the type is genuinely unknown
+- Use const assertions (`as const`) for immutable values and literal types
+- Leverage TypeScript's type narrowing instead of type assertions
+- Use meaningful variable names instead of magic numbers - extract constants with descriptive names
+
+### Modern JavaScript/TypeScript
+
+- Use arrow functions for callbacks and short functions
+- Prefer `for...of` loops over `.forEach()` and indexed `for` loops
+- Use optional chaining (`?.`) and nullish coalescing (`??`) for safer property access
+- Prefer template literals over string concatenation
+- Use destructuring for object and array assignments
+- Use `const` by default, `let` only when reassignment is needed, never `var`
+
+### Async & Promises
+
+- Always `await` promises in async functions - don't forget to use the return value
+- Use `async/await` syntax instead of promise chains for better readability
+- Handle errors appropriately in async code with try-catch blocks
+- Don't use async functions as Promise executors
+
+### React & JSX
+
+- Use function components over class components
+- Call hooks at the top level only, never conditionally
+- Specify all dependencies in hook dependency arrays correctly
+- Use the `key` prop for elements in iterables (prefer unique IDs over array indices)
+- Nest children between opening and closing tags instead of passing as props
+- Don't define components inside other components
+- Use semantic HTML and ARIA attributes for accessibility:
+  - Provide meaningful alt text for images
+  - Use proper heading hierarchy
+  - Add labels for form inputs
+  - Include keyboard event handlers alongside mouse events
+  - Use semantic elements (`<button>`, `<nav>`, etc.) instead of divs with roles
+
+### Error Handling & Debugging
+
+- Remove `console.log`, `debugger`, and `alert` statements from production code
+- Throw `Error` objects with descriptive messages, not strings or other values
+- Use `try-catch` blocks meaningfully - don't catch errors just to rethrow them
+- Prefer early returns over nested conditionals for error cases
+
+### Code Organization
+
+- Keep functions focused and under reasonable cognitive complexity limits
+- Extract complex conditions into well-named boolean variables
+- Use early returns to reduce nesting
+- Prefer simple conditionals over nested ternary operators
+- Group related code together and separate concerns
+
+### Security
+
+- Add `rel="noopener"` when using `target="_blank"` on links
+- Avoid `dangerouslySetInnerHTML` unless absolutely necessary
+- Don't use `eval()` or assign directly to `document.cookie`
+- Validate and sanitize user input
+
+### Performance
+
+- Avoid spread syntax in accumulators within loops
+- Use top-level regex literals instead of creating them in loops
+- Prefer specific imports over namespace imports
+- Avoid barrel files (index files that re-export everything)
+- Use proper image components (e.g., Next.js `<Image>`) over `<img>` tags
+
+### Framework-Specific Guidance
+
+**Next.js:**
+- Use Next.js `<Image>` component for images
+- Use `next/head` or App Router metadata API for head elements
+- Use Server Components for async data fetching instead of async Client Components
+
+**React 19+:**
+- Use ref as a prop instead of `React.forwardRef`
+
+**Solid/Svelte/Vue/Qwik:**
+- Use `class` and `for` attributes (not `className` or `htmlFor`)
+
+---
+
+## Testing
+
+- Write assertions inside `it()` or `test()` blocks
+- Avoid done callbacks in async tests - use async/await instead
+- Don't use `.only` or `.skip` in committed code
+- Keep test suites reasonably flat - avoid excessive `describe` nesting
+
+## When Biome Can't Help
+
+Biome's linter will catch most issues automatically. Focus your attention on:
+
+1. **Business logic correctness** - Biome can't validate your algorithms
+2. **Meaningful naming** - Use descriptive names for functions, variables, and types
+3. **Architecture decisions** - Component structure, data flow, and API design
+4. **Edge cases** - Handle boundary conditions and error states
+5. **User experience** - Accessibility, performance, and usability considerations
+6. **Documentation** - Add comments for complex logic, but prefer self-documenting code
+
+---
+
+Most formatting and common issues are automatically fixed by Biome. Run `npm exec -- ultracite fix` before committing to ensure compliance.
diff --git a/docs/assets/logo.svg b/docs/assets/logo.svg
index 1a30c53..80488b2 100644
--- a/docs/assets/logo.svg
+++ b/docs/assets/logo.svg
@@ -1,12 +1,56 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="800" height="200" viewBox="0 0 800 200" font-family="ui-sans-serif,system-ui,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif">
-  <rect width="800" height="200" rx="16" fill="#0d1117"/>
-  <rect x="0.5" y="0.5" width="799" height="199" rx="16" fill="none" stroke="#30363d"/>
+<svg
+  font-family="ui-sans-serif,system-ui,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif"
+  height="200"
+  viewBox="0 0 800 200"
+  width="800"
+  xmlns="http://www.w3.org/2000/svg"
+>
+  <title>openapi-sentinel</title>
+  <rect fill="#0d1117" height="200" rx="16" width="800" />
+  <rect
+    fill="none"
+    height="199"
+    rx="16"
+    stroke="#30363d"
+    width="799"
+    x="0.5"
+    y="0.5"
+  />
   <g transform="translate(136,38)">
-    <rect width="96" height="96" rx="24" fill="#2f81f7"/>
-    <g transform="translate(48,48) scale(0.52)" stroke="#ffffff" stroke-width="10" stroke-linecap="round" stroke-linejoin="round" fill="none">
-      <path d="M-52 -20 H38"/><path d="M20 -38 L38 -20 L20 -2"/><path d="M52 22 H-38"/><path d="M-20 4 L-38 22 L-20 40"/>
+    <rect fill="#2f81f7" height="96" rx="24" width="96" />
+    <g
+      fill="none"
+      stroke="#ffffff"
+      stroke-linecap="round"
+      stroke-linejoin="round"
+      stroke-width="10"
+      transform="translate(48,48) scale(0.52)"
+    >
+      <path d="M-52 -20 H38" />
+      <path d="M20 -38 L38 -20 L20 -2" />
+      <path d="M52 22 H-38" />
+      <path d="M-20 4 L-38 22 L-20 40" />
     </g>
   </g>
-  <text x="262" y="103" fill="#e6edf3" font-size="48" font-weight="800" letter-spacing="-1">openapi-sentinel</text>
-  <text x="400" y="154" text-anchor="middle" fill="#8b949e" font-size="16" font-weight="500">Runtime OpenAPI 3.1 request/response validation middleware — detect spec drif…</text>
+  <text
+    fill="#e6edf3"
+    font-size="48"
+    font-weight="800"
+    letter-spacing="-1"
+    x="262"
+    y="103"
+  >
+    openapi-sentinel
+  </text>
+  <text
+    fill="#8b949e"
+    font-size="16"
+    font-weight="500"
+    text-anchor="middle"
+    x="400"
+    y="154"
+  >
+    Runtime OpenAPI 3.1 request/response validation middleware — detect spec
+    drif…
+  </text>
 </svg>
diff --git a/src/index.ts b/src/index.ts
index 7b2b3c3..d3d5129 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,5 +1,6 @@
-export { OpenApiSentinel, createSentinel } from './sentinel.js';
-export { loadSpec } from './loader.js';
+// biome-ignore lint/performance/noBarrelFile: This is the package's intentional public entry point.
+export { loadSpec } from "./loader.js";
+export { createSentinel, OpenApiSentinel } from "./sentinel.js";
 export type {
   HttpMethod,
   MatchedOperation,
@@ -11,4 +12,4 @@ export type {
   SchemaObject,
   SentinelOptions,
   Violation,
-} from './types.js';
+} from "./types.js";
diff --git a/src/loader.ts b/src/loader.ts
index c1a0d94..113c20d 100644
--- a/src/loader.ts
+++ b/src/loader.ts
@@ -1,16 +1,17 @@
-import type { OpenApiSpec } from './types.js';
+import type { OpenApiSpec } from "./types.js";
 
 /**
  * Parse an OpenAPI spec from a string (JSON) or return as-is if already an object.
  * YAML is not supported directly — users should use js-yaml to parse YAML before passing.
  */
 export function loadSpec(spec: object | string): OpenApiSpec {
-  if (typeof spec === 'string') {
+  if (typeof spec === "string") {
     try {
       return JSON.parse(spec) as OpenApiSpec;
-    } catch {
+    } catch (error) {
       throw new Error(
-        'Failed to parse spec string as JSON. For YAML specs, parse with js-yaml first and pass the resulting object.'
+        "Failed to parse spec string as JSON. For YAML specs, parse with js-yaml first and pass the resulting object.",
+        { cause: error }
       );
     }
   }
diff --git a/src/matcher.ts b/src/matcher.ts
index 95cf72f..4cd6b9d 100644
--- a/src/matcher.ts
+++ b/src/matcher.ts
@@ -1,10 +1,15 @@
-import type { HttpMethod, MatchedOperation, OpenApiSpec, PathItem } from './types.js';
+import type {
+  HttpMethod,
+  MatchedOperation,
+  OpenApiSpec,
+  PathItem,
+} from "./types.js";
 
 interface CompiledPath {
-  template: string;
-  regex: RegExp;
   paramNames: string[];
   pathItem: PathItem;
+  regex: RegExp;
+  template: string;
 }
 
 /**
@@ -19,19 +24,21 @@ function compilePaths(spec: OpenApiSpec): CompiledPath[] {
     // Escape regex special chars except {}, then replace {param} with capture group
     const regexStr = template
       .replace(/[.*+?^${}()|[\]\\]/g, (match) => {
-        if (match === '{' || match === '}') return match;
-        return '\\' + match;
+        if (match === "{" || match === "}") {
+          return match;
+        }
+        return `\\${match}`;
       })
       .replace(/\{([^}]+)\}/g, (_match, paramName: string) => {
         paramNames.push(paramName);
-        return '([^/]+)';
+        return "([^/]+)";
       });
 
     compiled.push({
-      template,
-      regex: new RegExp('^' + regexStr + '$'),
       paramNames,
       pathItem,
+      regex: new RegExp(`^${regexStr}$`),
+      template,
     });
   }
 
@@ -40,7 +47,9 @@ function compilePaths(spec: OpenApiSpec): CompiledPath[] {
   compiled.sort((a, b) => {
     const aParams = a.paramNames.length;
     const bParams = b.paramNames.length;
-    if (aParams !== bParams) return aParams - bParams;
+    if (aParams !== bParams) {
+      return aParams - bParams;
+    }
     return a.template.localeCompare(b.template);
   });
 
@@ -50,25 +59,33 @@ function compilePaths(spec: OpenApiSpec): CompiledPath[] {
 export function createMatcher(spec: OpenApiSpec) {
   const compiled = compilePaths(spec);
 
-  return function matchOperation(method: string, pathname: string): MatchedOperation | null {
+  return function matchOperation(
+    method: string,
+    pathname: string
+  ): MatchedOperation | null {
     const normalizedMethod = method.toLowerCase() as HttpMethod;
 
     for (const entry of compiled) {
       const match = entry.regex.exec(pathname);
-      if (!match) continue;
+      // biome-ignore lint/suspicious/noUnnecessaryConditions: RegExp.exec returns null for non-matching paths.
+      if (!match) {
+        continue;
+      }
 
       const operation = entry.pathItem[normalizedMethod];
-      if (!operation) continue;
+      if (!operation) {
+        continue;
+      }
 
       const pathParams: Record<string, string> = {};
-      for (let i = 0; i < entry.paramNames.length; i++) {
+      for (let i = 0; i < entry.paramNames.length; i += 1) {
         pathParams[entry.paramNames[i]] = match[i + 1];
       }
 
       return {
         operation,
-        pathTemplate: entry.template,
         pathParams,
+        pathTemplate: entry.template,
       };
     }
 
diff --git a/src/reporter.ts b/src/reporter.ts
index bf71450..169c065 100644
--- a/src/reporter.ts
+++ b/src/reporter.ts
@@ -1,10 +1,9 @@
-import { writeFileSync } from 'node:fs';
-import type { Violation } from './types.js';
+import { writeFileSync } from "node:fs";
+import type { Violation } from "./types.js";
 
 export class DriftReporter {
-  private violations: Violation[] = [];
-  private driftReportPath: string | undefined;
-  private exitHandlerRegistered = false;
+  private readonly violations: Violation[] = [];
+  private readonly driftReportPath: string | undefined;
 
   constructor(driftReportPath?: string) {
     this.driftReportPath = driftReportPath;
@@ -23,10 +22,7 @@ export class DriftReporter {
   }
 
   private registerExitHandler(): void {
-    if (this.exitHandlerRegistered) return;
-    this.exitHandlerRegistered = true;
-
-    process.on('exit', () => {
+    process.on("exit", () => {
       if (this.driftReportPath && this.violations.length > 0) {
         try {
           writeFileSync(
diff --git a/src/sentinel.ts b/src/sentinel.ts
index 75635bf..1cf5b06 100644
--- a/src/sentinel.ts
+++ b/src/sentinel.ts
@@ -1,18 +1,18 @@
-import { loadSpec } from './loader.js';
-import { createMatcher } from './matcher.js';
-import { DriftReporter } from './reporter.js';
-import type { SentinelOptions, Violation } from './types.js';
+import { loadSpec } from "./loader.js";
+import { createMatcher } from "./matcher.js";
+import { DriftReporter } from "./reporter.js";
+import type { SentinelOptions, Violation } from "./types.js";
 import {
   validateRequest as doValidateRequest,
   validateResponse as doValidateResponse,
-} from './validator.js';
+} from "./validator.js";
 
 export class OpenApiSentinel {
-  private match: ReturnType<typeof createMatcher>;
-  private reporter: DriftReporter;
-  private validateReq: boolean;
-  private validateRes: boolean;
-  private onViolation: 'throw' | 'warn' | 'log';
+  private readonly match: ReturnType<typeof createMatcher>;
+  private readonly onViolation: "throw" | "warn" | "log";
+  private readonly reporter: DriftReporter;
+  private readonly validateReq: boolean;
+  private readonly validateRes: boolean;
 
   constructor(opts: SentinelOptions) {
     const spec = loadSpec(opts.spec);
@@ -27,10 +27,15 @@ export class OpenApiSentinel {
    * Web Standards middleware compatible with Hono and similar frameworks.
    * Signature: (req: Request, next: () => Promise<Response>) => Promise<Response>
    */
-  middleware(): (req: Request, next: () => Promise<Response>) => Promise<Response> {
-    return async (req: Request, next: () => Promise<Response>): Promise<Response> => {
-      const url = new URL(req.url, 'http://localhost');
-      const pathname = url.pathname;
+  middleware(): (
+    req: Request,
+    next: () => Promise<Response>
+  ) => Promise<Response> {
+    return async (
+      req: Request,
+      next: () => Promise<Response>
+    ): Promise<Response> => {
+      const { pathname } = new URL(req.url, "http://localhost");
       const matched = this.match(req.method, pathname);
 
       // If the path is not in the spec, pass through
@@ -51,7 +56,12 @@ export class OpenApiSentinel {
 
       // Validate response
       if (this.validateRes) {
-        const violations = await doValidateResponse(req, response, matched, pathname);
+        const violations = await doValidateResponse(
+          req,
+          response,
+          matched,
+          pathname
+        );
         if (violations.length > 0) {
           this.handleViolations(violations);
         }
@@ -65,11 +75,12 @@ export class OpenApiSentinel {
    * Directly validate a request (useful for testing).
    */
   async validateRequest(req: Request): Promise<Violation[]> {
-    const url = new URL(req.url, 'http://localhost');
-    const pathname = url.pathname;
+    const { pathname } = new URL(req.url, "http://localhost");
     const matched = this.match(req.method, pathname);
 
-    if (!matched) return [];
+    if (!matched) {
+      return [];
+    }
 
     const violations = await doValidateRequest(req, matched, pathname);
     this.reporter.add(violations);
@@ -80,11 +91,12 @@ export class OpenApiSentinel {
    * Directly validate a response (useful for testing).
    */
   async validateResponse(req: Request, res: Response): Promise<Violation[]> {
-    const url = new URL(req.url, 'http://localhost');
-    const pathname = url.pathname;
+    const { pathname } = new URL(req.url, "http://localhost");
     const matched = this.match(req.method, pathname);
 
-    if (!matched) return [];
+    if (!matched) {
+      return [];
+    }
 
     const violations = await doValidateResponse(req, res, matched, pathname);
     this.reporter.add(violations);
@@ -102,20 +114,26 @@ export class OpenApiSentinel {
     this.reporter.add(violations);
 
     switch (this.onViolation) {
-      case 'throw':
+      case "throw":
         throw new Error(
-          `OpenAPI violation: ${violations.map((v) => v.issue).join('; ')}`
+          `OpenAPI violation: ${violations.map((v) => v.issue).join("; ")}`
         );
-      case 'warn':
+      case "warn":
         for (const v of violations) {
-          console.warn(`[openapi-sentinel] ${v.type} ${v.method} ${v.path}: ${v.issue}`);
+          console.warn(
+            `[openapi-sentinel] ${v.type} ${v.method} ${v.path}: ${v.issue}`
+          );
         }
         break;
-      case 'log':
+      case "log":
         for (const v of violations) {
-          console.log(`[openapi-sentinel] ${v.type} ${v.method} ${v.path}: ${v.issue}`);
+          console.log(
+            `[openapi-sentinel] ${v.type} ${v.method} ${v.path}: ${v.issue}`
+          );
         }
         break;
+      default:
+        return;
     }
   }
 }
diff --git a/src/types.ts b/src/types.ts
index 456041b..278b883 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -1,22 +1,29 @@
 // OpenAPI 3.1 subset types — just enough for validation
 
 export interface OpenApiSpec {
-  openapi: string;
   info: { title: string; version: string };
+  openapi: string;
   paths: Record<string, PathItem>;
 }
 
 export interface PathItem {
+  delete?: Operation;
   get?: Operation;
+  head?: Operation;
+  options?: Operation;
+  patch?: Operation;
   post?: Operation;
   put?: Operation;
-  patch?: Operation;
-  delete?: Operation;
-  options?: Operation;
-  head?: Operation;
 }
 
-export type HttpMethod = 'get' | 'post' | 'put' | 'patch' | 'delete' | 'options' | 'head';
+export type HttpMethod =
+  | "get"
+  | "post"
+  | "put"
+  | "patch"
+  | "delete"
+  | "options"
+  | "head";
 
 export interface Operation {
   parameters?: Parameter[];
@@ -25,15 +32,15 @@ export interface Operation {
 }
 
 export interface Parameter {
+  in: "query" | "header" | "path" | "cookie";
   name: string;
-  in: 'query' | 'header' | 'path' | 'cookie';
   required?: boolean;
   schema?: SchemaObject;
 }
 
 export interface RequestBody {
-  required?: boolean;
   content: Record<string, MediaType>;
+  required?: boolean;
 }
 
 export interface MediaType {
@@ -41,41 +48,41 @@ export interface MediaType {
 }
 
 export interface ResponseObject {
-  description: string;
   content?: Record<string, MediaType>;
+  description: string;
 }
 
 export interface SchemaObject {
-  type?: string;
+  items?: SchemaObject;
   properties?: Record<string, SchemaObject>;
   required?: string[];
-  items?: SchemaObject;
+  type?: string;
 }
 
 // Sentinel types
 
 export interface SentinelOptions {
+  report?: {
+    driftReportPath?: string;
+  };
   spec: object | string;
   validate: {
     request?: boolean;
     response?: boolean;
-    onViolation: 'throw' | 'warn' | 'log';
-  };
-  report?: {
-    driftReportPath?: string;
+    onViolation: "throw" | "warn" | "log";
   };
 }
 
 export interface Violation {
-  type: 'request' | 'response';
+  issue: string;
   method: string;
   path: string;
-  issue: string;
   timestamp: string;
+  type: "request" | "response";
 }
 
 export interface MatchedOperation {
   operation: Operation;
-  pathTemplate: string;
   pathParams: Record<string, string>;
+  pathTemplate: string;
 }
diff --git a/src/validator.ts b/src/validator.ts
index caa34a6..602fc6a 100644
--- a/src/validator.ts
+++ b/src/validator.ts
@@ -1,4 +1,4 @@
-import type { MatchedOperation, SchemaObject, Violation } from './types.js';
+import type { MatchedOperation, SchemaObject, Violation } from "./types.js";
 
 function now(): string {
   return new Date().toISOString();
@@ -9,17 +9,19 @@ function now(): string {
  */
 function checkType(value: unknown, expectedType: string): boolean {
   switch (expectedType) {
-    case 'string':
-      return typeof value === 'string';
-    case 'number':
-    case 'integer':
-      return typeof value === 'number';
-    case 'boolean':
-      return typeof value === 'boolean';
-    case 'array':
+    case "string":
+      return typeof value === "string";
+    case "number":
+    case "integer":
+      return typeof value === "number";
+    case "boolean":
+      return typeof value === "boolean";
+    case "array":
       return Array.isArray(value);
-    case 'object':
-      return typeof value === 'object' && value !== null && !Array.isArray(value);
+    case "object":
+      return (
+        typeof value === "object" && value !== null && !Array.isArray(value)
+      );
     default:
       return true; // unknown type, pass
   }
@@ -42,11 +44,11 @@ function validateBody(
     for (const field of schema.required) {
       if (!(field in body)) {
         violations.push({
-          type: 'request',
+          issue: `Missing required field: ${field}`,
           method,
           path,
-          issue: `Missing required field: ${field}`,
           timestamp: now(),
+          type: "request",
         });
       }
     }
@@ -57,11 +59,11 @@ function validateBody(
     for (const key of Object.keys(body)) {
       if (!(key in schema.properties)) {
         violations.push({
-          type: 'request',
+          issue: `Unknown field: ${key}`,
           method,
           path,
-          issue: `Unknown field: ${key}`,
           timestamp: now(),
+          type: "request",
         });
       }
     }
@@ -70,16 +72,18 @@ function validateBody(
   // Check types for known properties
   if (schema.properties) {
     for (const [key, propSchema] of Object.entries(schema.properties)) {
-      if (key in body && propSchema.type) {
-        if (!checkType(body[key], propSchema.type)) {
-          violations.push({
-            type: 'request',
-            method,
-            path,
-            issue: `Field '${key}' expected type '${propSchema.type}', got '${typeof body[key]}'`,
-            timestamp: now(),
-          });
-        }
+      if (
+        key in body &&
+        propSchema.type &&
+        !checkType(body[key], propSchema.type)
+      ) {
+        violations.push({
+          issue: `Field '${key}' expected type '${propSchema.type}', got '${typeof body[key]}'`,
+          method,
+          path,
+          timestamp: now(),
+          type: "request",
+        });
       }
     }
   }
@@ -90,6 +94,7 @@ function validateBody(
 /**
  * Validate an incoming request against its matched OpenAPI operation.
  */
+// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: Request validation keeps the OpenAPI checks in protocol order.
 export async function validateRequest(
   req: Request,
   matched: MatchedOperation,
@@ -100,18 +105,20 @@ export async function validateRequest(
 
   // Check required query parameters
   if (matched.operation.parameters) {
-    const url = new URL(req.url, 'http://localhost');
+    const url = new URL(req.url, "http://localhost");
     for (const param of matched.operation.parameters) {
-      if (param.in === 'query' && param.required) {
-        if (!url.searchParams.has(param.name)) {
-          violations.push({
-            type: 'request',
-            method,
-            path: pathname,
-            issue: `Missing required query parameter: ${param.name}`,
-            timestamp: now(),
-          });
-        }
+      if (
+        param.in === "query" &&
+        param.required &&
+        !url.searchParams.has(param.name)
+      ) {
+        violations.push({
+          issue: `Missing required query parameter: ${param.name}`,
+          method,
+          path: pathname,
+          timestamp: now(),
+          type: "request",
+        });
       }
     }
   }
@@ -119,46 +126,57 @@ export async function validateRequest(
   // Validate request body if operation expects one
   if (matched.operation.requestBody) {
     const rb = matched.operation.requestBody;
-    const contentType = req.headers.get('content-type') || '';
+    const contentType = req.headers.get("content-type") || "";
 
-    if (rb.required && !req.body && contentType === '') {
+    if (rb.required && !req.body && contentType === "") {
       violations.push({
-        type: 'request',
+        issue: "Request body is required but missing",
         method,
         path: pathname,
-        issue: 'Request body is required but missing',
         timestamp: now(),
+        type: "request",
       });
     }
 
     // Check Content-Type matches one of the expected media types
     const expectedTypes = Object.keys(rb.content);
-    const baseContentType = contentType.split(';')[0].trim();
+    const baseContentType = contentType.split(";")[0].trim();
 
-    if (baseContentType && expectedTypes.length > 0 && !expectedTypes.includes(baseContentType)) {
+    if (
+      baseContentType &&
+      expectedTypes.length > 0 &&
+      !expectedTypes.includes(baseContentType)
+    ) {
       violations.push({
-        type: 'request',
+        issue: `Unexpected Content-Type '${baseContentType}', expected one of: ${expectedTypes.join(", ")}`,
         method,
         path: pathname,
-        issue: `Unexpected Content-Type '${baseContentType}', expected one of: ${expectedTypes.join(', ')}`,
         timestamp: now(),
+        type: "request",
       });
     }
 
     // Validate body structure for JSON
-    if (baseContentType === 'application/json' && rb.content['application/json']?.schema) {
+    if (
+      baseContentType === "application/json" &&
+      // biome-ignore lint/suspicious/noUnnecessaryConditions: OpenAPI media types are dynamic despite the index signature.
+      rb.content["application/json"]?.schema
+    ) {
       try {
         const cloned = req.clone();
         const body = (await cloned.json()) as Record<string, unknown>;
-        const schema = rb.content['application/json'].schema!;
+        const { schema } = rb.content["application/json"];
+        if (!schema) {
+          return violations;
+        }
         violations.push(...validateBody(body, schema, method, pathname));
       } catch {
         violations.push({
-          type: 'request',
+          issue: "Request body is not valid JSON",
           method,
           path: pathname,
-          issue: 'Request body is not valid JSON',
           timestamp: now(),
+          type: "request",
         });
       }
     }
@@ -170,7 +188,7 @@ export async function validateRequest(
 /**
  * Validate a response against the matched OpenAPI operation.
  */
-export async function validateResponse(
+export function validateResponse(
   req: Request,
   res: Response,
   matched: MatchedOperation,
@@ -182,33 +200,44 @@ export async function validateResponse(
 
   // Check that the status code is defined in the spec
   const definedStatuses = Object.keys(matched.operation.responses);
-  if (!definedStatuses.includes(statusCode) && !definedStatuses.includes('default')) {
+  if (
+    !(
+      definedStatuses.includes(statusCode) ||
+      definedStatuses.includes("default")
+    )
+  ) {
     violations.push({
-      type: 'response',
+      issue: `Unexpected response status ${statusCode}, expected one of: ${definedStatuses.join(", ")}`,
       method,
       path: pathname,
-      issue: `Unexpected response status ${statusCode}, expected one of: ${definedStatuses.join(', ')}`,
       timestamp: now(),
+      type: "response",
     });
   }
 
   // Check response Content-Type if spec defines content for this status
-  const responseSpec = matched.operation.responses[statusCode] || matched.operation.responses['default'];
+  const responseSpec =
+    matched.operation.responses[statusCode] ||
+    matched.operation.responses.default;
   if (responseSpec?.content) {
-    const contentType = res.headers.get('content-type') || '';
-    const baseContentType = contentType.split(';')[0].trim();
+    const contentType = res.headers.get("content-type") || "";
+    const baseContentType = contentType.split(";")[0].trim();
     const expectedTypes = Object.keys(responseSpec.content);
 
-    if (baseContentType && expectedTypes.length > 0 && !expectedTypes.includes(baseContentType)) {
+    if (
+      baseContentType &&
+      expectedTypes.length > 0 &&
+      !expectedTypes.includes(baseContentType)
+    ) {
       violations.push({
-        type: 'response',
+        issue: `Unexpected response Content-Type '${baseContentType}', expected one of: ${expectedTypes.join(", ")}`,
         method,
         path: pathname,
-        issue: `Unexpected response Content-Type '${baseContentType}', expected one of: ${expectedTypes.join(', ')}`,
         timestamp: now(),
+        type: "response",
       });
     }
   }
 
-  return violations;
+  return Promise.resolve(violations);
 }
diff --git a/tests/matcher.test.ts b/tests/matcher.test.ts
index 3792ba0..3617276 100644
--- a/tests/matcher.test.ts
+++ b/tests/matcher.test.ts
@@ -1,97 +1,97 @@
-import { describe, it } from 'node:test';
-import assert from 'node:assert/strict';
-import { createMatcher } from '../src/matcher.js';
-import type { OpenApiSpec } from '../src/types.js';
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { createMatcher } from "../src/matcher.js";
+import type { OpenApiSpec } from "../src/types.js";
 
 const spec: OpenApiSpec = {
-  openapi: '3.1.0',
-  info: { title: 'Test', version: '1.0.0' },
+  info: { title: "Test", version: "1.0.0" },
+  openapi: "3.1.0",
   paths: {
-    '/users': {
+    "/teams/{teamId}/members/{memberId}": {
       get: {
-        parameters: [{ name: 'limit', in: 'query', required: false }],
-        responses: { '200': { description: 'OK' } },
+        responses: { "200": { description: "OK" } },
+      },
+    },
+    "/users": {
+      get: {
+        parameters: [{ in: "query", name: "limit", required: false }],
+        responses: { "200": { description: "OK" } },
       },
       post: {
         requestBody: {
-          required: true,
           content: {
-            'application/json': {
+            "application/json": {
               schema: {
-                type: 'object',
-                required: ['email'],
                 properties: {
-                  email: { type: 'string' },
-                  name: { type: 'string' },
+                  email: { type: "string" },
+                  name: { type: "string" },
                 },
+                required: ["email"],
+                type: "object",
               },
             },
           },
+          required: true,
         },
-        responses: { '201': { description: 'Created' } },
+        responses: { "201": { description: "Created" } },
       },
     },
-    '/users/{id}': {
+    "/users/{id}": {
       get: {
         responses: {
-          '200': { description: 'OK' },
-          '404': { description: 'Not Found' },
+          "200": { description: "OK" },
+          "404": { description: "Not Found" },
         },
       },
     },
-    '/teams/{teamId}/members/{memberId}': {
-      get: {
-        responses: { '200': { description: 'OK' } },
-      },
-    },
   },
 };
 
-describe('matchOperation', () => {
+describe("matchOperation", () => {
   const match = createMatcher(spec);
 
-  it('GET /users matches paths./users.get', () => {
-    const result = match('GET', '/users');
+  it("GET /users matches paths./users.get", () => {
+    const result = match("GET", "/users");
     assert.ok(result);
-    assert.equal(result.pathTemplate, '/users');
+    assert.equal(result.pathTemplate, "/users");
     assert.deepEqual(result.pathParams, {});
-    assert.ok(result.operation.responses['200']);
+    assert.ok(result.operation.responses["200"]);
   });
 
-  it('POST /users matches paths./users.post', () => {
-    const result = match('POST', '/users');
+  it("POST /users matches paths./users.post", () => {
+    const result = match("POST", "/users");
     assert.ok(result);
-    assert.equal(result.pathTemplate, '/users');
+    assert.equal(result.pathTemplate, "/users");
     assert.ok(result.operation.requestBody);
   });
 
-  it('GET /users/123 matches paths./users/{id}.get', () => {
-    const result = match('GET', '/users/123');
+  it("GET /users/123 matches paths./users/{id}.get", () => {
+    const result = match("GET", "/users/123");
     assert.ok(result);
-    assert.equal(result.pathTemplate, '/users/{id}');
-    assert.equal(result.pathParams['id'], '123');
+    assert.equal(result.pathTemplate, "/users/{id}");
+    assert.equal(result.pathParams.id, "123");
   });
 
-  it('matches multiple path parameters', () => {
-    const result = match('GET', '/teams/t1/members/m2');
+  it("matches multiple path parameters", () => {
+    const result = match("GET", "/teams/t1/members/m2");
     assert.ok(result);
-    assert.equal(result.pathTemplate, '/teams/{teamId}/members/{memberId}');
-    assert.equal(result.pathParams['teamId'], 't1');
-    assert.equal(result.pathParams['memberId'], 'm2');
+    assert.equal(result.pathTemplate, "/teams/{teamId}/members/{memberId}");
+    assert.equal(result.pathParams.teamId, "t1");
+    assert.equal(result.pathParams.memberId, "m2");
   });
 
-  it('returns null for unmatched path', () => {
-    const result = match('GET', '/unknown');
+  it("returns null for unmatched path", () => {
+    const result = match("GET", "/unknown");
     assert.equal(result, null);
   });
 
-  it('returns null for unmatched method on existing path', () => {
-    const result = match('DELETE', '/users');
+  it("returns null for unmatched method on existing path", () => {
+    const result = match("DELETE", "/users");
     assert.equal(result, null);
   });
 
-  it('is case-insensitive for HTTP method', () => {
-    const result = match('get', '/users');
+  it("is case-insensitive for HTTP method", () => {
+    const result = match("get", "/users");
     assert.ok(result);
   });
 });
diff --git a/tests/sentinel.test.ts b/tests/sentinel.test.ts
index f991f60..3ac3868 100644
--- a/tests/sentinel.test.ts
+++ b/tests/sentinel.test.ts
@@ -1,187 +1,189 @@
-import { describe, it } from 'node:test';
-import assert from 'node:assert/strict';
-import { createSentinel } from '../src/sentinel.js';
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { createSentinel } from "../src/sentinel.js";
 
 const spec = {
-  openapi: '3.1.0',
-  info: { title: 'Test', version: '1.0.0' },
+  info: { title: "Test", version: "1.0.0" },
+  openapi: "3.1.0",
   paths: {
-    '/users': {
+    "/users": {
       get: {
-        parameters: [{ name: 'limit', in: 'query', required: false }],
-        responses: { '200': { description: 'OK' } },
+        parameters: [{ in: "query", name: "limit", required: false }],
+        responses: { "200": { description: "OK" } },
       },
       post: {
         requestBody: {
-          required: true,
           content: {
-            'application/json': {
+            "application/json": {
               schema: {
-                type: 'object',
-                required: ['email'],
                 properties: {
-                  email: { type: 'string' },
-                  name: { type: 'string' },
+                  email: { type: "string" },
+                  name: { type: "string" },
                 },
+                required: ["email"],
+                type: "object",
               },
             },
           },
+          required: true,
         },
-        responses: { '201': { description: 'Created' } },
+        responses: { "201": { description: "Created" } },
       },
     },
-    '/users/{id}': {
+    "/users/{id}": {
       get: {
         responses: {
-          '200': { description: 'OK' },
-          '404': { description: 'Not Found' },
+          "200": { description: "OK" },
+          "404": { description: "Not Found" },
         },
       },
     },
   },
 };
 
-describe('OpenApiSentinel', () => {
-  it('validateRequest passes for valid request', async () => {
+describe("OpenApiSentinel", () => {
+  it("validateRequest passes for valid request", async () => {
     const sentinel = createSentinel({
       spec,
-      validate: { onViolation: 'log' },
+      validate: { onViolation: "log" },
     });
 
-    const req = new Request('http://localhost/users', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ email: 'a@b.com' }),
+    const req = new Request("http://localhost/users", {
+      body: JSON.stringify({ email: "a@b.com" }),
+      headers: { "Content-Type": "application/json" },
+      method: "POST",
     });
 
     const violations = await sentinel.validateRequest(req);
     assert.equal(violations.length, 0);
   });
 
-  it('validateRequest detects missing required field', async () => {
+  it("validateRequest detects missing required field", async () => {
     const sentinel = createSentinel({
       spec,
-      validate: { onViolation: 'log' },
+      validate: { onViolation: "log" },
     });
 
-    const req = new Request('http://localhost/users', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ name: 'Alice' }),
+    const req = new Request("http://localhost/users", {
+      body: JSON.stringify({ name: "Alice" }),
+      headers: { "Content-Type": "application/json" },
+      method: "POST",
     });
 
     const violations = await sentinel.validateRequest(req);
     assert.equal(violations.length, 1);
-    assert.ok(violations[0].issue.includes('Missing required field: email'));
+    assert.ok(violations[0].issue.includes("Missing required field: email"));
   });
 
-  it('validateResponse detects unexpected status code', async () => {
+  it("validateResponse detects unexpected status code", async () => {
     const sentinel = createSentinel({
       spec,
-      validate: { response: true, onViolation: 'log' },
+      validate: { onViolation: "log", response: true },
     });
 
-    const req = new Request('http://localhost/users/123');
-    const res = new Response('', { status: 500 });
+    const req = new Request("http://localhost/users/123");
+    const res = new Response("", { status: 500 });
 
     const violations = await sentinel.validateResponse(req, res);
     assert.equal(violations.length, 1);
-    assert.ok(violations[0].issue.includes('Unexpected response status 500'));
+    assert.ok(violations[0].issue.includes("Unexpected response status 500"));
   });
 
-  it('getViolations accumulates across multiple calls', async () => {
+  it("getViolations accumulates across multiple calls", async () => {
     const sentinel = createSentinel({
       spec,
-      validate: { response: true, onViolation: 'log' },
+      validate: { onViolation: "log", response: true },
     });
 
     // First: missing email
-    const req1 = new Request('http://localhost/users', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ name: 'Alice' }),
+    const req1 = new Request("http://localhost/users", {
+      body: JSON.stringify({ name: "Alice" }),
+      headers: { "Content-Type": "application/json" },
+      method: "POST",
     });
     await sentinel.validateRequest(req1);
 
     // Second: unexpected status
-    const req2 = new Request('http://localhost/users/123');
-    const res2 = new Response('', { status: 500 });
+    const req2 = new Request("http://localhost/users/123");
+    const res2 = new Response("", { status: 500 });
     await sentinel.validateResponse(req2, res2);
 
     const all = sentinel.getViolations();
     assert.equal(all.length, 2);
-    assert.equal(all[0].type, 'request');
-    assert.equal(all[1].type, 'response');
+    assert.equal(all[0].type, "request");
+    assert.equal(all[1].type, "response");
   });
 
-  it('middleware passes through for unknown paths', async () => {
+  it("middleware passes through for unknown paths", async () => {
     const sentinel = createSentinel({
       spec,
-      validate: { onViolation: 'throw' },
+      validate: { onViolation: "throw" },
     });
 
     const mw = sentinel.middleware();
-    const req = new Request('http://localhost/unknown');
-    const res = await mw(req, async () => new Response('OK'));
+    const req = new Request("http://localhost/unknown");
+    const res = await mw(req, async () => new Response("OK"));
     assert.equal(res.status, 200);
     const text = await res.text();
-    assert.equal(text, 'OK');
+    assert.equal(text, "OK");
   });
 
-  it('middleware throws on violation when onViolation is throw', async () => {
+  it("middleware throws on violation when onViolation is throw", async () => {
     const sentinel = createSentinel({
       spec,
-      validate: { onViolation: 'throw' },
+      validate: { onViolation: "throw" },
     });
 
     const mw = sentinel.middleware();
-    const req = new Request('http://localhost/users', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ name: 'no email' }),
+    const req = new Request("http://localhost/users", {
+      body: JSON.stringify({ name: "no email" }),
+      headers: { "Content-Type": "application/json" },
+      method: "POST",
     });
 
     await assert.rejects(
-      () => mw(req, async () => new Response('OK', { status: 201 })),
+      () => mw(req, async () => new Response("OK", { status: 201 })),
       (err: Error) => {
-        assert.ok(err.message.includes('Missing required field: email'));
+        assert.ok(err.message.includes("Missing required field: email"));
         return true;
       }
     );
   });
 
-  it('middleware validates response when enabled', async () => {
+  it("middleware validates response when enabled", async () => {
     const sentinel = createSentinel({
       spec,
-      validate: { response: true, onViolation: 'log' },
+      validate: { onViolation: "log", response: true },
     });
 
     const mw = sentinel.middleware();
-    const req = new Request('http://localhost/users/123');
-    await mw(req, async () => new Response('', { status: 500 }));
+    const req = new Request("http://localhost/users/123");
+    await mw(req, async () => new Response("", { status: 500 }));
 
     const violations = sentinel.getViolations();
-    assert.ok(violations.some((v) => v.issue.includes('Unexpected response status 500')));
+    assert.ok(
+      violations.some((v) => v.issue.includes("Unexpected response status 500"))
+    );
   });
 
-  it('creates sentinel from JSON string spec', async () => {
+  it("creates sentinel from JSON string spec", async () => {
     const sentinel = createSentinel({
       spec: JSON.stringify(spec),
-      validate: { onViolation: 'log' },
+      validate: { onViolation: "log" },
     });
 
-    const req = new Request('http://localhost/users');
+    const req = new Request("http://localhost/users");
     const violations = await sentinel.validateRequest(req);
     assert.equal(violations.length, 0);
   });
 
-  it('returns empty violations for paths not in spec', async () => {
+  it("returns empty violations for paths not in spec", async () => {
     const sentinel = createSentinel({
       spec,
-      validate: { onViolation: 'log' },
+      validate: { onViolation: "log" },
     });
 
-    const req = new Request('http://localhost/not-in-spec');
+    const req = new Request("http://localhost/not-in-spec");
     const violations = await sentinel.validateRequest(req);
     assert.equal(violations.length, 0);
   });
diff --git a/tests/validator.test.ts b/tests/validator.test.ts
index d5c659e..4e18a5d 100644
--- a/tests/validator.test.ts
+++ b/tests/validator.test.ts
@@ -1,46 +1,46 @@
-import { describe, it } from 'node:test';
-import assert from 'node:assert/strict';
-import { createMatcher } from '../src/matcher.js';
-import { validateRequest, validateResponse } from '../src/validator.js';
-import type { OpenApiSpec } from '../src/types.js';
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { createMatcher } from "../src/matcher.js";
+import type { OpenApiSpec } from "../src/types.js";
+import { validateRequest, validateResponse } from "../src/validator.js";
 
 const spec: OpenApiSpec = {
-  openapi: '3.1.0',
-  info: { title: 'Test', version: '1.0.0' },
+  info: { title: "Test", version: "1.0.0" },
+  openapi: "3.1.0",
   paths: {
-    '/users': {
+    "/users": {
       get: {
         parameters: [
-          { name: 'limit', in: 'query', required: false },
-          { name: 'page', in: 'query', required: true },
+          { in: "query", name: "limit", required: false },
+          { in: "query", name: "page", required: true },
         ],
-        responses: { '200': { description: 'OK' } },
+        responses: { "200": { description: "OK" } },
       },
       post: {
         requestBody: {
-          required: true,
           content: {
-            'application/json': {
+            "application/json": {
               schema: {
-                type: 'object',
-                required: ['email'],
                 properties: {
-                  email: { type: 'string' },
-                  name: { type: 'string' },
-                  age: { type: 'number' },
+                  age: { type: "number" },
+                  email: { type: "string" },
+                  name: { type: "string" },
                 },
+                required: ["email"],
+                type: "object",
               },
             },
           },
+          required: true,
         },
-        responses: { '201': { description: 'Created' } },
+        responses: { "201": { description: "Created" } },
       },
     },
-    '/users/{id}': {
+    "/users/{id}": {
       get: {
         responses: {
-          '200': { description: 'OK' },
-          '404': { description: 'Not Found' },
+          "200": { description: "OK" },
+          "404": { description: "Not Found" },
         },
       },
     },
@@ -49,106 +49,118 @@ const spec: OpenApiSpec = {
 
 const match = createMatcher(spec);
 
-describe('validateRequest', () => {
-  it('POST /users with valid JSON body passes', async () => {
-    const req = new Request('http://localhost/users', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ email: 'a@b.com', name: 'Alice' }),
+function matchRequired(method: string, pathname: string) {
+  const result = match(method, pathname);
+  assert.ok(result);
+  return result;
+}
+
+describe("validateRequest", () => {
+  it("POST /users with valid JSON body passes", async () => {
+    const req = new Request("http://localhost/users", {
+      body: JSON.stringify({ email: "a@b.com", name: "Alice" }),
+      headers: { "Content-Type": "application/json" },
+      method: "POST",
     });
-    const matched = match('POST', '/users')!;
-    const violations = await validateRequest(req, matched, '/users');
+    const matched = matchRequired("POST", "/users");
+    const violations = await validateRequest(req, matched, "/users");
     assert.equal(violations.length, 0);
   });
 
-  it('POST /users missing required email field produces violation', async () => {
-    const req = new Request('http://localhost/users', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ name: 'Alice' }),
+  it("POST /users missing required email field produces violation", async () => {
+    const req = new Request("http://localhost/users", {
+      body: JSON.stringify({ name: "Alice" }),
+      headers: { "Content-Type": "application/json" },
+      method: "POST",
     });
-    const matched = match('POST', '/users')!;
-    const violations = await validateRequest(req, matched, '/users');
+    const matched = matchRequired("POST", "/users");
+    const violations = await validateRequest(req, matched, "/users");
     assert.equal(violations.length, 1);
-    assert.equal(violations[0].type, 'request');
-    assert.ok(violations[0].issue.includes('Missing required field: email'));
+    assert.equal(violations[0].type, "request");
+    assert.ok(violations[0].issue.includes("Missing required field: email"));
   });
 
-  it('POST /users with unknown field produces violation', async () => {
-    const req = new Request('http://localhost/users', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ email: 'a@b.com', legacyId: 99 }),
+  it("POST /users with unknown field produces violation", async () => {
+    const req = new Request("http://localhost/users", {
+      body: JSON.stringify({ email: "a@b.com", legacyId: 99 }),
+      headers: { "Content-Type": "application/json" },
+      method: "POST",
     });
-    const matched = match('POST', '/users')!;
-    const violations = await validateRequest(req, matched, '/users');
+    const matched = matchRequired("POST", "/users");
+    const violations = await validateRequest(req, matched, "/users");
     assert.equal(violations.length, 1);
-    assert.ok(violations[0].issue.includes('Unknown field: legacyId'));
+    assert.ok(violations[0].issue.includes("Unknown field: legacyId"));
   });
 
-  it('POST /users with wrong type produces violation', async () => {
-    const req = new Request('http://localhost/users', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ email: 'a@b.com', age: 'not-a-number' }),
+  it("POST /users with wrong type produces violation", async () => {
+    const req = new Request("http://localhost/users", {
+      body: JSON.stringify({ age: "not-a-number", email: "a@b.com" }),
+      headers: { "Content-Type": "application/json" },
+      method: "POST",
     });
-    const matched = match('POST', '/users')!;
-    const violations = await validateRequest(req, matched, '/users');
+    const matched = matchRequired("POST", "/users");
+    const violations = await validateRequest(req, matched, "/users");
     assert.equal(violations.length, 1);
-    assert.ok(violations[0].issue.includes("Field 'age' expected type 'number'"));
+    assert.ok(
+      violations[0].issue.includes("Field 'age' expected type 'number'")
+    );
   });
 
-  it('POST /users with wrong Content-Type produces violation', async () => {
-    const req = new Request('http://localhost/users', {
-      method: 'POST',
-      headers: { 'Content-Type': 'text/plain' },
-      body: 'not json',
+  it("POST /users with wrong Content-Type produces violation", async () => {
+    const req = new Request("http://localhost/users", {
+      body: "not json",
+      headers: { "Content-Type": "text/plain" },
+      method: "POST",
     });
-    const matched = match('POST', '/users')!;
-    const violations = await validateRequest(req, matched, '/users');
-    assert.ok(violations.some((v) => v.issue.includes('Unexpected Content-Type')));
+    const matched = matchRequired("POST", "/users");
+    const violations = await validateRequest(req, matched, "/users");
+    assert.ok(
+      violations.some((v) => v.issue.includes("Unexpected Content-Type"))
+    );
   });
 
-  it('GET /users missing required query param produces violation', async () => {
-    const req = new Request('http://localhost/users');
-    const matched = match('GET', '/users')!;
-    const violations = await validateRequest(req, matched, '/users');
+  it("GET /users missing required query param produces violation", async () => {
+    const req = new Request("http://localhost/users");
+    const matched = matchRequired("GET", "/users");
+    const violations = await validateRequest(req, matched, "/users");
     assert.equal(violations.length, 1);
-    assert.ok(violations[0].issue.includes('Missing required query parameter: page'));
+    assert.ok(
+      violations[0].issue.includes("Missing required query parameter: page")
+    );
   });
 
-  it('GET /users with required query param passes', async () => {
-    const req = new Request('http://localhost/users?page=1');
-    const matched = match('GET', '/users')!;
-    const violations = await validateRequest(req, matched, '/users');
+  it("GET /users with required query param passes", async () => {
+    const req = new Request("http://localhost/users?page=1");
+    const matched = matchRequired("GET", "/users");
+    const violations = await validateRequest(req, matched, "/users");
     assert.equal(violations.length, 0);
   });
 });
 
-describe('validateResponse', () => {
-  it('200 response matches spec — no violation', async () => {
-    const req = new Request('http://localhost/users/123');
-    const res = new Response('OK', { status: 200 });
-    const matched = match('GET', '/users/123')!;
-    const violations = await validateResponse(req, res, matched, '/users/123');
+describe("validateResponse", () => {
+  it("200 response matches spec — no violation", async () => {
+    const req = new Request("http://localhost/users/123");
+    const res = new Response("OK", { status: 200 });
+    const matched = matchRequired("GET", "/users/123");
+    const violations = await validateResponse(req, res, matched, "/users/123");
     assert.equal(violations.length, 0);
   });
 
-  it('unexpected status code not in spec produces violation', async () => {
-    const req = new Request('http://localhost/users/123');
-    const res = new Response('', { status: 500 });
-    const matched = match('GET', '/users/123')!;
-    const violations = await validateResponse(req, res, matched, '/users/123');
+  it("unexpected status code not in spec produces violation", async () => {
+    const req = new Request("http://localhost/users/123");
+    const res = new Response("", { status: 500 });
+    const matched = matchRequired("GET", "/users/123");
+    const violations = await validateResponse(req, res, matched, "/users/123");
     assert.equal(violations.length, 1);
-    assert.equal(violations[0].type, 'response');
-    assert.ok(violations[0].issue.includes('Unexpected response status 500'));
+    assert.equal(violations[0].type, "response");
+    assert.ok(violations[0].issue.includes("Unexpected response status 500"));
   });
 
-  it('404 response matches spec — no violation', async () => {
-    const req = new Request('http://localhost/users/123');
-    const res = new Response('Not Found', { status: 404 });
-    const matched = match('GET', '/users/123')!;
-    const violations = await validateResponse(req, res, matched, '/users/123');
+  it("404 response matches spec — no violation", async () => {
+    const req = new Request("http://localhost/users/123");
+    const res = new Response("Not Found", { status: 404 });
+    const matched = matchRequired("GET", "/users/123");
+    const violations = await validateResponse(req, res, matched, "/users/123");
     assert.equal(violations.length, 0);
   });
 });