@shipstatic/ship 2.1.0 → 2.2.0-beta.4

package/README.md

@@ -47,6 +47,7 @@ const ship = new Ship({ token: 'ship-...' });
 
 ```bash
 ship ./dist                                        # Deploy (shortcut)
+ship ./dist --domain www.example.com               # Deploy and serve it there
 ship ./dist --label production --label v1.0.0      # Deploy with labels
 ship deployments list
 ship deployments list --limit 20                   # Page size; a hint shows the next cursor
@@ -152,6 +153,14 @@ open https://$(ship ./dist -q)
 ship deployments list -q | xargs -I{} ship deployments delete {} -q
 ```
 
+`--domain` is the same two calls as one command:
+
+```bash
+ship ./dist --domain www.example.com
+```
+
+Both spellings are supported and neither replaces the other. The pipe composes interactively — any two commands, wherever `-q` gives you the value the next one wants. `--domain` is one process, one exit code, and one `--json`, which is what CI needs: a `run:` block is `bash -e` **without** `pipefail`, so a pipeline reports only the last command's status and a failed deploy is masked. It answers as the domain, exactly as `ship domains set` does — DNS records and setup link included on a new external domain — and it needs a token, which it checks before uploading anything.
+
 ### Shell Completion
 
 ```bash
@@ -180,6 +189,7 @@ Available on `ship <path>` and `ship deployments upload`:
 
 | Flag | Description |
 |------|-------------|
+| `--domain <domain>` | Serve this deployment at that domain — creates or repoints it. Needs a token |
 | `--label <label>` | Add label (repeatable) |
 | `--password <password>` | Password-protect this deployment (6–128 chars) |
 | `--no-path-detect` | Disable automatic path optimization |

package/SKILL.md

@@ -62,7 +62,7 @@ ship ./dist --json
   "via": "cli",
   "created": 1743552000,
   "expires": 1743811200,
-  "claim": "https://my.shipstatic.com/claim/abc123"
+  "claim": "https://my.shipstatic.com/claim/1234567890abcdef1234567890abcdef"
 }
 ```
 
@@ -123,8 +123,8 @@ Requires an API key. Full workflow:
 # 1. Validate
 ship domains validate www.example.com
 
-# 2. Deploy + link in one pipe
-ship ./dist -q | ship domains set www.example.com
+# 2. Deploy + link in one command
+ship ./dist --domain www.example.com
 
 # 3. Show DNS records to the user
 ship domains records www.example.com
@@ -135,6 +135,8 @@ ship domains verify www.example.com
 
 Step 2 auto-prints DNS records and a setup link in text mode. With `--json`, call `domains records` separately.
 
+`--domain` answers **as the domain** — same output as `ship domains set`, with the freshly linked deployment in the `deployment` field. Prefer it over the pipe (`ship ./dist -q | ship domains set www.example.com`), which still works: one process means one exit code and one JSON document, so a failed deploy cannot be masked by the second command. It requires a token and refuses before uploading anything if there isn't one. If the link fails, the deployment still exists and is reported first — re-run to link it again.
+
 Verification is async — DNS propagation takes minutes to hours. Check status with `ship domains get <name> --json` and look for `"status": "success"`.
 
 ### Domain types
@@ -235,6 +237,7 @@ List commands return `{"<resource>s": [...], "cursor": null}`. A non-null `curso
 
 ```bash
 ship ./dist                          # Deploy (shortcut)
+ship ./dist --domain <name>          # Deploy and serve it at that domain
 ship deployments upload <path>       # Deploy (explicit)
 ship deployments list                # List all
 ship deployments get <deployment>    # Details
@@ -275,6 +278,7 @@ ship tokens delete <token>            # Delete (revokes immediately)
 | `--json` | JSON output |
 | `-q, --quiet` | Identifier only |
 | `--token <token>` | Any ship token: API key or deploy token |
+| `--domain <domain>` | Deploy and serve it there — creates or repoints. Needs a token |
 | `--label <label>` | Set label (repeatable, replaces all) |
 | `--password <pwd>` | Password-protect deployment (6–128 chars) |
 | `--no-path-detect` | Skip build output auto-detection |

package/THIRD-PARTY-LICENSES.md

@@ -0,0 +1,365 @@
+# Third-party licenses
+
+`@shipstatic/ship` bundles the packages below into its published artifact.
+Their copyright notices travel with that copy, and are reproduced here in
+full. This file is GENERATED from the build's own metafile — edit the
+bundle, not this list.
+
+## @shipstatic/types 2.7.0-beta.2
+
+License: MIT
+
+```
+MIT License
+
+Copyright (c) 2025 shipstatic
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+## ansi-regex 5.0.1
+
+License: MIT
+
+```
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
+## clone 1.0.4
+
+License: MIT
+
+```
+Copyright © 2011-2015 Paul Vorbach <paul@vorba.ch>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the “Software”), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
+## columnify 1.6.0
+
+License: MIT
+
+```
+The MIT License (MIT)
+
+Copyright (c) 2013 Tim Oxley
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+```
+
+## commander 14.0.3
+
+License: MIT
+
+```
+(The MIT License)
+
+Copyright (c) 2011 TJ Holowaychuk <tj@vision-media.ca>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
+## defaults 1.0.4
+
+License: MIT
+
+```
+The MIT License (MIT)
+
+Copyright (c) 2022 Sindre Sorhus
+Copyright (c) 2015 Elijah Insua
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+```
+
+## form-data-encoder 4.1.0
+
+License: MIT
+
+```
+The MIT License (MIT)
+
+Copyright (c) 2021-present Nick K.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+## formdata-node 6.0.3
+
+License: MIT
+
+```
+The MIT License (MIT)
+
+Copyright (c) 2017-present Nick K.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+## junk 4.0.1
+
+License: MIT
+
+```
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
+## spark-md5 3.0.2
+
+License: (WTFPL OR MIT)
+
+```
+DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+                    Version 2, December 2004
+
+ Copyright (C) 2015 André Cruz <amdfcruz@gmail.com>
+
+ Everyone is permitted to copy and distribute verbatim or modified
+ copies of this license document, and changing it is allowed as long
+ as the name is changed.
+
+            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. You just DO WHAT THE FUCK YOU WANT TO.
+```
+
+## strip-ansi 6.0.1
+
+License: MIT
+
+```
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
+## wcwidth 1.0.1
+
+License: MIT
+
+```
+wcwidth.js: JavaScript Portng of Markus Kuhn's wcwidth() Implementation
+=======================================================================
+
+Copyright (C) 2012 by Jun Woong.
+
+This package is a JavaScript porting of `wcwidth()` implementation
+[by Markus Kuhn](http://www.cl.cam.ac.uk/~mgk25/ucs/wcwidth.c).
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+
+THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR
+OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+```
+
+## yocto-spinner 1.2.2
+
+License: MIT
+
+```
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
+## yoctocolors 2.2.0
+
+License: MIT
+
+```
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
+## zod 4.4.3
+
+License: MIT
+
+```
+MIT License
+
+Copyright (c) 2025 Colin McDonnell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```

package/dist/browser.d.ts

@@ -788,12 +788,30 @@ declare class ShipError extends Error {
      *
      * Routing:
      * - Already a `ShipError` → returned as-is (caller's intent preserved)
-     * - `AbortError` → `ShipError.cancelled(...)`
+     * - `AbortError` → `ShipError.cancelled(...)` — someone stopped it on purpose
+     * - `TimeoutError` → `ShipError.network(...)` — a deadline expired, so
+     *   nothing was exchanged; the message names the timeout
      * - A transport failure → `ShipError.network(...)` — see `isTransportFailure`
      *   for what each runtime offers as evidence
      * - Any other `Error` → `ShipError(Api, ...)` (no HTTP status — fetch never reached the server)
      * - Anything else (string, undefined, etc.) → `ShipError(Api, ...)`
      *
+     * **Abort and timeout are read from `name` BEFORE any `instanceof Error`
+     * gate.** A `DOMException` satisfies that gate in every runtime measured
+     * (Node, Bun, Chromium, Firefox, WebKit, workerd — all six), but the
+     * inheritance is a comparatively recent spec change and this classification
+     * has no reason to depend on it: `name` is where the meaning lives, and
+     * reading it first costs nothing. The suite plants a non-`Error`
+     * `DOMException` shape to hold the arm, since no runtime on the table
+     * produces one.
+     *
+     * A caller's own `AbortSignal.timeout()` is the reachable source of
+     * `TimeoutError` — and the two are NOT interchangeable per runtime: WebKit
+     * reports a fired `AbortSignal.timeout()` as `AbortError`, so on Safari a
+     * deadline is indistinguishable from a cancellation and lands on
+     * `Cancelled`. Recorded rather than worked around; `Cancelled` is honest
+     * there, since the caller's signal is what stopped it.
+     *
      * The optional `operationName` is composed into the message for context:
      * `"Get account was cancelled"`, `"Get account failed: ..."`. Defaults to
      * `"Request"` when omitted.
@@ -863,14 +881,17 @@ declare class ShipError extends Error {
  */
 declare function isShipError(error: unknown): error is ShipError;
 /**
- * Plan-based platform limits returned by the `/limits` endpoint.
+ * What the platform will refuse, returned by the `/limits` endpoint.
  *
- * The SDK fetches these once on first API call to drive client-side
- * file-size / file-count / total-size validation that mirrors what the API
- * would enforce server-side. Limits vary by account plan.
+ * The SDK fetches this once on first API call to drive client-side validation
+ * that mirrors what the API would enforce server-side. The caps vary by
+ * account plan; the blocklist does not.
  *
- * These are the *platform's* posted caps for the current account — server
- * truth delivered at runtime, never hard-coded on the client.
+ * These are the *platform's* posted rules for the current account — server
+ * truth delivered at runtime, never hard-coded on the client. That is the
+ * whole point of the shape: a rule the server owns and may change reaches the
+ * client as data, so a pinned client cannot enforce a policy the platform has
+ * moved on from (`npm/types/CLAUDE.md`, "Validation: format vs policy").
  *
  * A report: it answers a question and carries only the answer (`CLAUDE.md`,
  * "A report answers a question").
@@ -882,38 +903,61 @@ interface PlatformLimits {
     maxFilesCount: number;
     /** Maximum total size in bytes across all files in a deployment. */
     maxTotalSize: number;
+    /**
+     * Lowercase extensions, without the dot, that the platform refuses to host
+     * (`exe`, `dmg`, …). Owned and evolved by the API — see
+     * `cloudflare/api/src/lib/blocklist.ts`.
+     *
+     * **Optional, and the absence is load-bearing.** An API deployed before this
+     * field existed sends nothing, so a client MUST read absence as "no
+     * client-side check" rather than as an empty policy. The hint fails open,
+     * the boundary fails closed: the server refuses the file either way, and a
+     * client that guessed would only ever be wrong in the direction that refuses
+     * a file the platform accepts.
+     *
+     * The optionality follows the additive-evolution law and retires with its
+     * reason: once every environment serves the field, it hardens to required at
+     * the entity's next natural break, and the clients' fail-open spellings
+     * retire with it (tracked in root `backlog.md`).
+     */
+    readonly blockedExtensions?: readonly string[];
 }
 /**
- * Blocked file extensions — files that cannot be uploaded.
+ * Whether a file is one the platform refuses to host.
  *
- * We accept any file type by default and derive Content-Type from the
- * extension at serve time (via mime-db in the API worker). Unknown extensions
- * are served as `application/octet-stream` with `X-Content-Type-Options: nosniff`.
+ * **The list is not this package's, and that separation is the point.** What
+ * counts as a blocked extension is hosting POLICY — it evolves, it is enforced
+ * at one security boundary, and `virus.exe` is a perfectly well-formed
+ * filename that breaks nothing about the upload→serve round-trip. So the API
+ * owns the list (`cloudflare/api/src/lib/blocklist.ts`) and delivers it as
+ * `PlatformLimits.blockedExtensions`; a client passes what it was given.
  *
- * The blocklist targets file types that pose direct security risks when hosted:
- * executables, disk images, malware vectors, dangerous scripts, and shortcuts.
- */
-declare const BLOCKED_EXTENSIONS: ReadonlySet<string>;
-/**
- * Check if a filename has a blocked extension.
- * Extracts the extension from the filename and checks against the blocklist.
- * Case-insensitive. Returns false for files without extensions.
+ * What lives here is the MATCHING RULE, and it earns its place by the
+ * constellation law's own test. The list's drift is loud in both directions —
+ * a stale client uploads a file the API refuses by name, on the first try.
+ * A second *matcher* drifts SILENTLY in the one direction that matters: a
+ * client stricter than the server refuses a legal file without the server ever
+ * being asked, and no error names it. Two holders, silent drift, one owner.
+ *
+ * The `blocked` collection is required rather than defaulted: this predicate
+ * guards a security boundary in the API, and a defaulted-empty argument there
+ * would block nothing while reading as though it did. Callers holding a
+ * possibly-absent wire field spell the fail-open themselves.
  *
  * @example
- * isBlockedExtension('virus.exe')     // true
- * isBlockedExtension('app.dmg')       // true
- * isBlockedExtension('style.css')     // false
- * isBlockedExtension('data.custom')   // false
- * isBlockedExtension('README')        // false
+ * isBlockedExtension('virus.exe', ['exe'])   // true
+ * isBlockedExtension('virus.EXE', ['exe'])   // true — case-insensitive
+ * isBlockedExtension('style.css', ['exe'])   // false
+ * isBlockedExtension('README', ['exe'])      // false — no extension
  */
-declare function isBlockedExtension(filename: string): boolean;
+declare function isBlockedExtension(filename: string, blocked: ReadonlySet<string> | readonly string[]): boolean;
 /**
  * The `accept` attribute value for a browser file picker offering web files.
  *
- * **This is a hint, never a rule.** `BLOCKED_EXTENSIONS` is the platform's
- * gate and the only thing that decides what may be hosted; this constant
- * decides what a *file dialog* shows first. The two are not two halves of one
- * policy, and this one must never be consulted to accept or reject a file.
+ * **This is a hint, never a rule.** The API's blocklist is the platform's gate
+ * and the only thing that decides what may be hosted; this constant decides
+ * what a *file dialog* shows first. The two are not two halves of one policy,
+ * and this one must never be consulted to accept or reject a file.
  *
  * The distinction is structural, not stylistic. `accept` can express only an
  * allowlist, while the platform's rule is a blocklist — so this list is
@@ -924,9 +968,12 @@ declare function isBlockedExtension(filename: string): boolean;
  * dropzone and the picker must reach the same verdict on the same files, and
  * they do — because the verdict is `validateFiles`, downstream of both.
  *
- * Kept beside `BLOCKED_EXTENSIONS` so one file holds both, which is what lets
- * `tests/validation-constants.test.ts` fence the invariant that matters: the
- * picker must never offer a file the platform will refuse.
+ * The invariant that matters — the picker must never offer a file the platform
+ * will refuse — is fenced where the authority lives, in the API's own suite
+ * (`cloudflare/api/tests/lib/blocklist.test.ts`), which reads this published
+ * string and holds it against the list it owns. It sat here until the
+ * blocklist became the API's, and moving it was the price of that: a fence
+ * belongs with whichever side can change and break it.
  */
 declare const WEB_FILE_ACCEPT: string;
 /**
@@ -2358,13 +2405,22 @@ declare function validateDeployPath(deployPath: string, sourceIdentifier: string
 /**
  * Validate a deploy file's name and extension.
  * Rejects unsafe filenames (shell/URL-dangerous chars, reserved names)
- * and blocked file extensions (.exe, .msi, .dll, etc.).
+ * and file extensions the platform refuses to host.
+ *
+ * **The blocklist is the platform's, delivered — not this package's.** It
+ * arrives as `PlatformLimits.blockedExtensions` from `GET /limits`, which the
+ * client has already fetched by the time any file is processed. That is what
+ * keeps a pinned CLI from enforcing a policy the platform has moved on from,
+ * in either direction. Callers pass `[]` when the API sent no list (one that
+ * predates the field): the check then does nothing and the API refuses the
+ * file at the boundary, which is the correct place for it to be refused.
  *
  * @param deployPath - The deployment path to validate
  * @param sourceIdentifier - Human-readable identifier for error messages
- * @throws {ShipError} If the filename is unsafe or extension is blocked
+ * @param blockedExtensions - The platform's blocklist, from `/limits`
+ * @throws {ShipError} If the filename is unsafe or the extension is blocked
  */
-declare function validateDeployFile(deployPath: string, sourceIdentifier: string): void;
+declare function validateDeployFile(deployPath: string, sourceIdentifier: string, blockedExtensions: readonly string[]): void;
 
 /**
  * Utility functions for string manipulation.
@@ -2448,4 +2504,4 @@ declare class Ship extends Ship$1 {
     protected getDeployBodyCreator(): DeployBodyCreator;
 }
 
-export { API_KEY, API_PATHS, AUTH_BASE_PATH, type Account, type AccountDeleteResponse, type AccountGetResponse, type AccountKeyResponse, type AccountOverrides, AccountPlan, type AccountPlanType, type AccountResource, type AccountUsage, type Activity, type ActivityEvent, type ActivityListResponse, type ActivityMeta, type ApiDeployOptions, ApiHttp, type ApiHttpOptions, AuthMethod, type AuthMethodType, BLOCKED_EXTENSIONS, type BillingCancelResponse, type BillingStatus, CALLER, type CheckoutSession, DEFAULT_API, DEPLOYMENT_CONFIG_FILENAME, DEPLOY_FIELDS, DEPLOY_TOKEN, type DeployBody, type DeployBodyContext, type DeployBodyCreator, type DeployFile, type DeployInput, type Deployment, type DeploymentCreateResponse, type DeploymentDeleteResponse, type DeploymentListResponse, type DeploymentOptions, type DeploymentResource, type DeploymentResourceContext, type DeploymentSetOptions, DeploymentStatus, type DeploymentStatusType, type DeploymentUploadOptions, DeploymentVia, type DeploymentViaType, type DnsLookup, type DnsProvider, type DnsRecord, type DnsRecordType, type Domain, type DomainDeleteResponse, type DomainDnsResponse, type DomainListResponse, type DomainRecordsResponse, type DomainResource, type DomainSetOptions, type DomainSetResult, type DomainShareResponse, DomainStatus, type DomainStatusType, type DomainValidateResponse, type DomainVerifyResponse, type ErrorResponse, ErrorType, type ExecutionEnvironment, FileValidationStatus as FILE_VALIDATION_STATUS, type Fetch, type FileValidationResult, FileValidationStatus, type FileValidationStatusType, IDEMPOTENCY_KEY_CONSTRAINTS, JUNK_DIRECTORIES, LABEL_CONSTRAINTS, LABEL_PATTERN, type LabelsResponse, type ListOptions, type ListResponse, type MD5Result, MY_API_KEY_URL, OAuthScope, type OAuthScopeType, PASSWORD_CONSTRAINTS, PUBLIC_DEPLOYMENT_TTL_SECONDS, type PingResponse, type PlatformLimits, type ResourceContext, SHIP_ENV, type SPACheckDebug, type SPACheckRequest, type SPACheckResponse, SPA_CHECK_CONSTRAINTS, SPA_DEFAULT_CONFIG, type SetupInstructionsResponse, Ship, type ShipClientOptions, ShipError, type ShipEvents, type StaticFile, type Token, type TokenCreateOptions, type TokenCreateResponse, type TokenDeleteResponse, TokenKind, type TokenKindType, type TokenListResponse, type TokenProvider, type TokenResource, UNBUILT_PROJECT_MARKERS, UNSAFE_FILENAME_CHARS, type UploadedFile, type UserVisibleActivityEvent, type ValidatableFile, type ValidationIssue, WEB_FILE_ACCEPT, __setTestEnvironment, allValidFilesReady, assertShipJsonSyntax, calculateMD5, classifyToken, createAccountResource, createDeploymentResource, createDomainResource, createTokenResource, Ship as default, deserializeLabels, extractSubdomain, filterJunk, formatFileSize, generateDeploymentUrl, generateDomainUrl, getENV, getValidFiles, hasUnbuiltMarker, hasUnsafeChars, isBlockedExtension, isCustomDomain, isDeployment, isPlatformDomain, isShipError, normalizeVia, optimizeDeployPaths, pluralize, processFilesForBrowser, serializeLabels, validateApiKey, validateApiUrl, validateCaller, validateDeployFile, validateDeployPath, validateDeployToken, validateFileName, validateFiles, validateIdempotencyKey, validatePassword, validateToken };
+export { API_KEY, API_PATHS, AUTH_BASE_PATH, type Account, type AccountDeleteResponse, type AccountGetResponse, type AccountKeyResponse, type AccountOverrides, AccountPlan, type AccountPlanType, type AccountResource, type AccountUsage, type Activity, type ActivityEvent, type ActivityListResponse, type ActivityMeta, type ApiDeployOptions, ApiHttp, type ApiHttpOptions, AuthMethod, type AuthMethodType, type BillingCancelResponse, type BillingStatus, CALLER, type CheckoutSession, DEFAULT_API, DEPLOYMENT_CONFIG_FILENAME, DEPLOY_FIELDS, DEPLOY_TOKEN, type DeployBody, type DeployBodyContext, type DeployBodyCreator, type DeployFile, type DeployInput, type Deployment, type DeploymentCreateResponse, type DeploymentDeleteResponse, type DeploymentListResponse, type DeploymentOptions, type DeploymentResource, type DeploymentResourceContext, type DeploymentSetOptions, DeploymentStatus, type DeploymentStatusType, type DeploymentUploadOptions, DeploymentVia, type DeploymentViaType, type DnsLookup, type DnsProvider, type DnsRecord, type DnsRecordType, type Domain, type DomainDeleteResponse, type DomainDnsResponse, type DomainListResponse, type DomainRecordsResponse, type DomainResource, type DomainSetOptions, type DomainSetResult, type DomainShareResponse, DomainStatus, type DomainStatusType, type DomainValidateResponse, type DomainVerifyResponse, type ErrorResponse, ErrorType, type ExecutionEnvironment, FileValidationStatus as FILE_VALIDATION_STATUS, type Fetch, type FileValidationResult, FileValidationStatus, type FileValidationStatusType, IDEMPOTENCY_KEY_CONSTRAINTS, JUNK_DIRECTORIES, LABEL_CONSTRAINTS, LABEL_PATTERN, type LabelsResponse, type ListOptions, type ListResponse, type MD5Result, MY_API_KEY_URL, OAuthScope, type OAuthScopeType, PASSWORD_CONSTRAINTS, PUBLIC_DEPLOYMENT_TTL_SECONDS, type PingResponse, type PlatformLimits, type ResourceContext, SHIP_ENV, type SPACheckDebug, type SPACheckRequest, type SPACheckResponse, SPA_CHECK_CONSTRAINTS, SPA_DEFAULT_CONFIG, type SetupInstructionsResponse, Ship, type ShipClientOptions, ShipError, type ShipEvents, type StaticFile, type Token, type TokenCreateOptions, type TokenCreateResponse, type TokenDeleteResponse, TokenKind, type TokenKindType, type TokenListResponse, type TokenProvider, type TokenResource, UNBUILT_PROJECT_MARKERS, UNSAFE_FILENAME_CHARS, type UploadedFile, type UserVisibleActivityEvent, type ValidatableFile, type ValidationIssue, WEB_FILE_ACCEPT, __setTestEnvironment, allValidFilesReady, assertShipJsonSyntax, calculateMD5, classifyToken, createAccountResource, createDeploymentResource, createDomainResource, createTokenResource, Ship as default, deserializeLabels, extractSubdomain, filterJunk, formatFileSize, generateDeploymentUrl, generateDomainUrl, getENV, getValidFiles, hasUnbuiltMarker, hasUnsafeChars, isBlockedExtension, isCustomDomain, isDeployment, isPlatformDomain, isShipError, normalizeVia, optimizeDeployPaths, pluralize, processFilesForBrowser, serializeLabels, validateApiKey, validateApiUrl, validateCaller, validateDeployFile, validateDeployPath, validateDeployToken, validateFileName, validateFiles, validateIdempotencyKey, validatePassword, validateToken };