@shipstatic/types 2.6.0 → 2.7.0-beta.2

package/README.md

@@ -131,10 +131,20 @@ import {
   validateApiUrl,
   isDeployment,
   isBlockedExtension,
-  BLOCKED_EXTENSIONS,
 } from '@shipstatic/types';
 ```
 
+`isBlockedExtension(filename, blocked)` takes the blocklist rather than owning
+one — the platform's list is hosting policy that the API owns and evolves, and
+it reaches clients as `PlatformLimits.blockedExtensions` from `GET /limits`.
+The field is optional: an API that predates it sends nothing, which means "no
+client-side check", never "an empty policy".
+
+```typescript
+const limits = await ship.getLimits();
+isBlockedExtension('virus.exe', limits.blockedExtensions ?? []);
+```
+
 ### File Upload Types
 
 ```typescript

package/dist/index.d.ts

@@ -788,12 +788,30 @@ export declare class ShipError extends Error {
      *
      * Routing:
      * - Already a `ShipError` → returned as-is (caller's intent preserved)
-     * - `AbortError` → `ShipError.cancelled(...)`
+     * - `AbortError` → `ShipError.cancelled(...)` — someone stopped it on purpose
+     * - `TimeoutError` → `ShipError.network(...)` — a deadline expired, so
+     *   nothing was exchanged; the message names the timeout
      * - A transport failure → `ShipError.network(...)` — see `isTransportFailure`
      *   for what each runtime offers as evidence
      * - Any other `Error` → `ShipError(Api, ...)` (no HTTP status — fetch never reached the server)
      * - Anything else (string, undefined, etc.) → `ShipError(Api, ...)`
      *
+     * **Abort and timeout are read from `name` BEFORE any `instanceof Error`
+     * gate.** A `DOMException` satisfies that gate in every runtime measured
+     * (Node, Bun, Chromium, Firefox, WebKit, workerd — all six), but the
+     * inheritance is a comparatively recent spec change and this classification
+     * has no reason to depend on it: `name` is where the meaning lives, and
+     * reading it first costs nothing. The suite plants a non-`Error`
+     * `DOMException` shape to hold the arm, since no runtime on the table
+     * produces one.
+     *
+     * A caller's own `AbortSignal.timeout()` is the reachable source of
+     * `TimeoutError` — and the two are NOT interchangeable per runtime: WebKit
+     * reports a fired `AbortSignal.timeout()` as `AbortError`, so on Safari a
+     * deadline is indistinguishable from a cancellation and lands on
+     * `Cancelled`. Recorded rather than worked around; `Cancelled` is honest
+     * there, since the caller's signal is what stopped it.
+     *
      * The optional `operationName` is composed into the message for context:
      * `"Get account was cancelled"`, `"Get account failed: ..."`. Defaults to
      * `"Request"` when omitted.
@@ -863,14 +881,17 @@ export declare class ShipError extends Error {
  */
 export declare function isShipError(error: unknown): error is ShipError;
 /**
- * Plan-based platform limits returned by the `/limits` endpoint.
+ * What the platform will refuse, returned by the `/limits` endpoint.
  *
- * The SDK fetches these once on first API call to drive client-side
- * file-size / file-count / total-size validation that mirrors what the API
- * would enforce server-side. Limits vary by account plan.
+ * The SDK fetches this once on first API call to drive client-side validation
+ * that mirrors what the API would enforce server-side. The caps vary by
+ * account plan; the blocklist does not.
  *
- * These are the *platform's* posted caps for the current account — server
- * truth delivered at runtime, never hard-coded on the client.
+ * These are the *platform's* posted rules for the current account — server
+ * truth delivered at runtime, never hard-coded on the client. That is the
+ * whole point of the shape: a rule the server owns and may change reaches the
+ * client as data, so a pinned client cannot enforce a policy the platform has
+ * moved on from (`npm/types/CLAUDE.md`, "Validation: format vs policy").
  *
  * A report: it answers a question and carries only the answer (`CLAUDE.md`,
  * "A report answers a question").
@@ -882,38 +903,61 @@ export interface PlatformLimits {
     maxFilesCount: number;
     /** Maximum total size in bytes across all files in a deployment. */
     maxTotalSize: number;
+    /**
+     * Lowercase extensions, without the dot, that the platform refuses to host
+     * (`exe`, `dmg`, …). Owned and evolved by the API — see
+     * `cloudflare/api/src/lib/blocklist.ts`.
+     *
+     * **Optional, and the absence is load-bearing.** An API deployed before this
+     * field existed sends nothing, so a client MUST read absence as "no
+     * client-side check" rather than as an empty policy. The hint fails open,
+     * the boundary fails closed: the server refuses the file either way, and a
+     * client that guessed would only ever be wrong in the direction that refuses
+     * a file the platform accepts.
+     *
+     * The optionality follows the additive-evolution law and retires with its
+     * reason: once every environment serves the field, it hardens to required at
+     * the entity's next natural break, and the clients' fail-open spellings
+     * retire with it (tracked in root `backlog.md`).
+     */
+    readonly blockedExtensions?: readonly string[];
 }
 /**
- * Blocked file extensions — files that cannot be uploaded.
+ * Whether a file is one the platform refuses to host.
  *
- * We accept any file type by default and derive Content-Type from the
- * extension at serve time (via mime-db in the API worker). Unknown extensions
- * are served as `application/octet-stream` with `X-Content-Type-Options: nosniff`.
+ * **The list is not this package's, and that separation is the point.** What
+ * counts as a blocked extension is hosting POLICY — it evolves, it is enforced
+ * at one security boundary, and `virus.exe` is a perfectly well-formed
+ * filename that breaks nothing about the upload→serve round-trip. So the API
+ * owns the list (`cloudflare/api/src/lib/blocklist.ts`) and delivers it as
+ * `PlatformLimits.blockedExtensions`; a client passes what it was given.
  *
- * The blocklist targets file types that pose direct security risks when hosted:
- * executables, disk images, malware vectors, dangerous scripts, and shortcuts.
- */
-export declare const BLOCKED_EXTENSIONS: ReadonlySet<string>;
-/**
- * Check if a filename has a blocked extension.
- * Extracts the extension from the filename and checks against the blocklist.
- * Case-insensitive. Returns false for files without extensions.
+ * What lives here is the MATCHING RULE, and it earns its place by the
+ * constellation law's own test. The list's drift is loud in both directions —
+ * a stale client uploads a file the API refuses by name, on the first try.
+ * A second *matcher* drifts SILENTLY in the one direction that matters: a
+ * client stricter than the server refuses a legal file without the server ever
+ * being asked, and no error names it. Two holders, silent drift, one owner.
+ *
+ * The `blocked` collection is required rather than defaulted: this predicate
+ * guards a security boundary in the API, and a defaulted-empty argument there
+ * would block nothing while reading as though it did. Callers holding a
+ * possibly-absent wire field spell the fail-open themselves.
  *
  * @example
- * isBlockedExtension('virus.exe')     // true
- * isBlockedExtension('app.dmg')       // true
- * isBlockedExtension('style.css')     // false
- * isBlockedExtension('data.custom')   // false
- * isBlockedExtension('README')        // false
+ * isBlockedExtension('virus.exe', ['exe'])   // true
+ * isBlockedExtension('virus.EXE', ['exe'])   // true — case-insensitive
+ * isBlockedExtension('style.css', ['exe'])   // false
+ * isBlockedExtension('README', ['exe'])      // false — no extension
  */
-export declare function isBlockedExtension(filename: string): boolean;
+export declare function isBlockedExtension(filename: string, blocked: ReadonlySet<string> | readonly string[]): boolean;
 /**
  * The `accept` attribute value for a browser file picker offering web files.
  *
- * **This is a hint, never a rule.** `BLOCKED_EXTENSIONS` is the platform's
- * gate and the only thing that decides what may be hosted; this constant
- * decides what a *file dialog* shows first. The two are not two halves of one
- * policy, and this one must never be consulted to accept or reject a file.
+ * **This is a hint, never a rule.** The API's blocklist is the platform's gate
+ * and the only thing that decides what may be hosted; this constant decides
+ * what a *file dialog* shows first. The two are not two halves of one policy,
+ * and this one must never be consulted to accept or reject a file.
  *
  * The distinction is structural, not stylistic. `accept` can express only an
  * allowlist, while the platform's rule is a blocklist — so this list is
@@ -924,9 +968,12 @@ export declare function isBlockedExtension(filename: string): boolean;
  * dropzone and the picker must reach the same verdict on the same files, and
  * they do — because the verdict is `validateFiles`, downstream of both.
  *
- * Kept beside `BLOCKED_EXTENSIONS` so one file holds both, which is what lets
- * `tests/validation-constants.test.ts` fence the invariant that matters: the
- * picker must never offer a file the platform will refuse.
+ * The invariant that matters — the picker must never offer a file the platform
+ * will refuse — is fenced where the authority lives, in the API's own suite
+ * (`cloudflare/api/tests/lib/blocklist.test.ts`), which reads this published
+ * string and holds it against the list it owns. It sat here until the
+ * blocklist became the API's, and moving it was the price of that: a fence
+ * belongs with whichever side can change and break it.
  */
 export declare const WEB_FILE_ACCEPT: string;
 /**

package/dist/index.js

@@ -340,38 +340,71 @@ const MAX_FOREIGN_MESSAGE_LENGTH = 200;
 /**
  * Did the runtime say the exchange never completed?
  *
- * WHATWG has `fetch` reject with a **TypeError** on network error, and undici,
- * Chromium and Firefox comply. Bun does not: it rejects with a plain `Error`
- * carrying a system `code` string. Captured 2026-08-05 (the capture script is
- * in `tests/errors.test.ts`, "runtime failure shapes"):
- *
- * | failure       | Node 22 / undici          | Bun 1.3.14                                   |
- * |---------------|---------------------------|----------------------------------------------|
- * | refused       | `TypeError: fetch failed` | `Error` `code: 'ConnectionRefused'`          |
- * | DNS failure   | `TypeError: fetch failed` | `Error` `code: 'ConnectionRefused'`          |
- * | reset         | `TypeError: fetch failed` | `Error` `code: 'ECONNRESET'`                 |
- * | TLS rejected  | `TypeError: fetch failed` | `Error` `code: 'UNKNOWN_CERTIFICATE_…ERROR'` |
- *
- * So the test is the **evidence, not a list of dialect strings**: a string
- * `code` is a runtime naming a transport-level failure. An allowlist of codes
- * was written first and rejected — the TLS row alone would mean enumerating
- * BoringSSL's certificate table, and a code nobody guessed is precisely the bug
- * this closes. Two kinds of error are deliberately NOT caught: ordinary JS
- * faults carry no `code` at all, and a `DOMException`'s is a **number**, so
- * aborts and timeouts fall through to their own arms.
- *
- * The accepted trade: a caller's `TokenProvider` that throws a coded error
- * (`ENOENT` from a keychain read) is typed `Network` rather than `Api`. Both
- * are wrong for it, `Network` is the cheaper wrong — it says "nothing was
- * exchanged", which is true, where `Api` claims a server answered.
+ * Clients branch on the TYPE, never on message strings, so a misclassified
+ * transport failure is a lie every consumer inherits — and the one that costs
+ * most: `Api` claims a server answered when nothing was exchanged, and a
+ * retrying caller will not retry it.
+ *
+ * **Every row below is a transcript, not a belief.** Captured 2026-08-12
+ * against real runtimes — Node and Bun by direct run, the three engines by a
+ * one-off playwright probe, workerd through miniflare. The capture scripts are
+ * in `tests/errors.test.ts`, "runtime failure shapes".
+ *
+ * | runtime          | connection refused / DNS failure                     | malformed URL                                    |
+ * |------------------|------------------------------------------------------|--------------------------------------------------|
+ * | Node 22 / undici | `TypeError: fetch failed`                             | `TypeError: Failed to parse URL from …`          |
+ * | Bun 1.3.14       | `Error` `code:'ConnectionRefused'`                    | `TypeError` `code:'ERR_INVALID_URL'`             |
+ * | Chromium 151     | `TypeError: Failed to fetch`                          | `TypeError: …Failed to parse URL from …`         |
+ * | Firefox 153      | `TypeError: NetworkError when attempting to fetch …`  | `TypeError: … is not a valid URL.`               |
+ * | WebKit 26.5      | `TypeError: Load failed`                              | `TypeError: URL is not valid or contains user …` |
+ * | workerd          | `Error: Network connection lost.` (DNS: `internal error; reference = …`) | `TypeError: Invalid URL: …`   |
+ *
+ * Reading that table gives the rule, and it is the INVERSE of the obvious one.
+ * The transport class is unbounded — every OS, TLS and DNS failure any engine
+ * will ever name — while the class fetch raises for its own ARGUMENTS is
+ * small, and every runtime names the URL when it complains about one. So the
+ * bounded side is the one worth testing, and the residual risk points the safe
+ * way: an unrecognised sentence lands on `Network`, which says only that
+ * nothing was exchanged.
+ *
+ * That inversion is what fixes **WebKit**, whose `Load failed` carries no code
+ * and no "fetch", and which every browser-SDK and `@shipstatic/drop` user on
+ * Safari was hitting as `Api`. It also makes the six runtimes AGREE about a
+ * malformed URL, which they did not before: the previous rule tested the
+ * message for "fetch", and Chromium's and Firefox's URL complaints both
+ * contain it, so the same mistake was `Network` on three engines and `Api` on
+ * three.
+ *
+ * **workerd is the recorded gap.** It rejects with a plain `Error`, no code
+ * and no shared sentence — and its two failure modes produce two unrelated
+ * ones — so nothing here can classify it and it lands on `Api`. Left alone
+ * rather than patched with a dialect string: the one consumer running ship in
+ * that runtime (`cloudflare/mcp`) reaches the API through a service BINDING,
+ * which is in-process and does not produce transport rejections at all.
+ *
+ * The accepted trade is unchanged: a caller's `TokenProvider` that throws a
+ * coded error (`ENOENT` from a keychain read) is typed `Network` rather than
+ * `Api`. Both are wrong for it; `Network` is the cheaper wrong.
  */
 function isTransportFailure(cause) {
-    if (typeof cause.code === 'string')
+    const code = cause.code;
+    // Bun is the one runtime that puts a CODE on an argument error, so it is
+    // excluded before the code arm can claim it.
+    if (code === 'ERR_INVALID_URL')
+        return false;
+    // A string `code` is a runtime naming a transport-level failure. An
+    // allowlist of codes was written first and rejected — the TLS row alone
+    // would mean enumerating BoringSSL's certificate table, and a code nobody
+    // guessed is precisely the bug this closes. A `DOMException`'s code is a
+    // NUMBER, so aborts and timeouts never reach here.
+    if (typeof code === 'string')
         return true;
-    // Spec runtimes put no code on the rejection itself. The message test is what
-    // keeps fetch's ARGUMENT errors out — `Failed to parse URL from …` is a
-    // caller's config mistake, not a transport failure.
-    return cause instanceof TypeError && cause.message.includes('fetch');
+    // WHATWG has fetch reject with a TypeError for BOTH halves — network error
+    // and argument error — so among TypeErrors the URL is the discriminator.
+    if (cause instanceof TypeError)
+        return !/\burl\b/i.test(cause.message);
+    // Anything else — an ordinary JS fault, or workerd — is not evidence.
+    return false;
 }
 /**
  * Simple unified error class for both API and SDK
@@ -497,12 +530,30 @@ export class ShipError extends Error {
      *
      * Routing:
      * - Already a `ShipError` → returned as-is (caller's intent preserved)
-     * - `AbortError` → `ShipError.cancelled(...)`
+     * - `AbortError` → `ShipError.cancelled(...)` — someone stopped it on purpose
+     * - `TimeoutError` → `ShipError.network(...)` — a deadline expired, so
+     *   nothing was exchanged; the message names the timeout
      * - A transport failure → `ShipError.network(...)` — see `isTransportFailure`
      *   for what each runtime offers as evidence
      * - Any other `Error` → `ShipError(Api, ...)` (no HTTP status — fetch never reached the server)
      * - Anything else (string, undefined, etc.) → `ShipError(Api, ...)`
      *
+     * **Abort and timeout are read from `name` BEFORE any `instanceof Error`
+     * gate.** A `DOMException` satisfies that gate in every runtime measured
+     * (Node, Bun, Chromium, Firefox, WebKit, workerd — all six), but the
+     * inheritance is a comparatively recent spec change and this classification
+     * has no reason to depend on it: `name` is where the meaning lives, and
+     * reading it first costs nothing. The suite plants a non-`Error`
+     * `DOMException` shape to hold the arm, since no runtime on the table
+     * produces one.
+     *
+     * A caller's own `AbortSignal.timeout()` is the reachable source of
+     * `TimeoutError` — and the two are NOT interchangeable per runtime: WebKit
+     * reports a fired `AbortSignal.timeout()` as `AbortError`, so on Safari a
+     * deadline is indistinguishable from a cancellation and lands on
+     * `Cancelled`. Recorded rather than worked around; `Cancelled` is honest
+     * there, since the caller's signal is what stopped it.
+     *
      * The optional `operationName` is composed into the message for context:
      * `"Get account was cancelled"`, `"Get account failed: ..."`. Defaults to
      * `"Request"` when omitted.
@@ -511,10 +562,19 @@ export class ShipError extends Error {
         if (isShipError(cause))
             return cause;
         const op = operationName || 'Request';
+        // Read by NAME, ahead of the Error gate — see the note above.
+        const name = cause?.name;
+        if (name === 'AbortError') {
+            return ShipError.cancelled(`${op} was cancelled`);
+        }
+        if (name === 'TimeoutError') {
+            // A deadline, not a fault and not a cancellation: nothing was exchanged,
+            // which is exactly what `Network` claims. The runtime's own sentence is
+            // dropped here rather than relayed — "The operation was aborted due to
+            // timeout" is the mechanism, not the news.
+            return ShipError.network(`${op} timed out`, { cause });
+        }
         if (cause instanceof Error) {
-            if (cause.name === 'AbortError') {
-                return ShipError.cancelled(`${op} was cancelled`);
-            }
             if (isTransportFailure(cause)) {
                 return ShipError.network(`${op} failed: ${cause.message}`, { cause });
             }
@@ -633,80 +693,81 @@ export function isShipError(error) {
         'status' in error);
 }
 // =============================================================================
-// EXTENSION BLOCKLIST
+// EXTENSION MATCHING
 // =============================================================================
 /**
- * Blocked file extensions — files that cannot be uploaded.
+ * The rule for reading a file's extension: lowercase, after the last dot of
+ * the last path segment. `null` when there is no extension to read.
+ *
+ * A leading dot names the file rather than its type, so `.gitignore` and
+ * `.htaccess` have no extension — but `.env.exe` has `exe`.
+ *
+ * Segment-aware on purpose: the callers pass deploy PATHS, not basenames, and
+ * a naive `lastIndexOf('.')` over `dir.v1/README` reads the extension
+ * `v1/README` — safe only by accident, since no entry in a real blocklist
+ * contains a slash, which is the kind of correctness nobody should have to
+ * re-derive.
  *
- * We accept any file type by default and derive Content-Type from the
- * extension at serve time (via mime-db in the API worker). Unknown extensions
- * are served as `application/octet-stream` with `X-Content-Type-Options: nosniff`.
+ * **Private, and the reason is the asymmetry rather than any hazard.** Nothing
+ * outside this file reads it: `isBlockedExtension` is the only question anyone
+ * asks, and the API's refusal names the FILE, not its extension. Exporting a
+ * pure function is harmless, which is exactly the argument that talks a
+ * published package into surface it has not earned — and the costs do not
+ * match, since adding an export later is free under the additive law while
+ * removing one is a major. So it stays private until a caller exists. Its
+ * behaviour is fenced through `isBlockedExtension`, which is where it is
+ * observable.
  *
- * The blocklist targets file types that pose direct security risks when hosted:
- * executables, disk images, malware vectors, dangerous scripts, and shortcuts.
+ * (`WEB_FILE_EXTENSIONS` above is private for a different reason — publishing
+ * it would invite a wrong question. Both are private; only one is a hazard.)
+ *
+ * @example
+ * fileExtension('virus.exe')          // 'exe'
+ * fileExtension('assets/style.CSS')   // 'css'
+ * fileExtension('dir.v1/README')      // null
+ * fileExtension('.gitignore')         // null
+ * fileExtension('file.')              // null
  */
-export const BLOCKED_EXTENSIONS = new Set([
-    // Executables
-    'exe',
-    'msi',
-    'dll',
-    'scr',
-    'bat',
-    'cmd',
-    'com',
-    'pif',
-    'app',
-    'deb',
-    'rpm',
-    // Installers
-    'pkg',
-    'mpkg',
-    // Disk images
-    'dmg',
-    'iso',
-    'img',
-    // Malware vectors
-    'cab',
-    'cpl',
-    'chm',
-    // Dangerous scripts
-    'ps1',
-    'vbs',
-    'vbe',
-    'ws',
-    'wsf',
-    'wsc',
-    'wsh',
-    'reg',
-    // Java
-    'jar',
-    'jnlp',
-    // Mobile/browser packages
-    'apk',
-    'crx',
-    // Shortcut/link
-    'lnk',
-    'inf',
-    'hta',
-]);
+function fileExtension(filename) {
+    const basename = filename.replace(/\\/g, '/').split('/').pop() ?? '';
+    const dotIndex = basename.lastIndexOf('.');
+    if (dotIndex <= 0 || dotIndex === basename.length - 1)
+        return null;
+    return basename.slice(dotIndex + 1).toLowerCase();
+}
 /**
- * Check if a filename has a blocked extension.
- * Extracts the extension from the filename and checks against the blocklist.
- * Case-insensitive. Returns false for files without extensions.
+ * Whether a file is one the platform refuses to host.
+ *
+ * **The list is not this package's, and that separation is the point.** What
+ * counts as a blocked extension is hosting POLICY — it evolves, it is enforced
+ * at one security boundary, and `virus.exe` is a perfectly well-formed
+ * filename that breaks nothing about the upload→serve round-trip. So the API
+ * owns the list (`cloudflare/api/src/lib/blocklist.ts`) and delivers it as
+ * `PlatformLimits.blockedExtensions`; a client passes what it was given.
+ *
+ * What lives here is the MATCHING RULE, and it earns its place by the
+ * constellation law's own test. The list's drift is loud in both directions —
+ * a stale client uploads a file the API refuses by name, on the first try.
+ * A second *matcher* drifts SILENTLY in the one direction that matters: a
+ * client stricter than the server refuses a legal file without the server ever
+ * being asked, and no error names it. Two holders, silent drift, one owner.
+ *
+ * The `blocked` collection is required rather than defaulted: this predicate
+ * guards a security boundary in the API, and a defaulted-empty argument there
+ * would block nothing while reading as though it did. Callers holding a
+ * possibly-absent wire field spell the fail-open themselves.
  *
  * @example
- * isBlockedExtension('virus.exe')     // true
- * isBlockedExtension('app.dmg')       // true
- * isBlockedExtension('style.css')     // false
- * isBlockedExtension('data.custom')   // false
- * isBlockedExtension('README')        // false
+ * isBlockedExtension('virus.exe', ['exe'])   // true
+ * isBlockedExtension('virus.EXE', ['exe'])   // true — case-insensitive
+ * isBlockedExtension('style.css', ['exe'])   // false
+ * isBlockedExtension('README', ['exe'])      // false — no extension
  */
-export function isBlockedExtension(filename) {
-    const dotIndex = filename.lastIndexOf('.');
-    if (dotIndex === -1 || dotIndex === filename.length - 1)
+export function isBlockedExtension(filename, blocked) {
+    const ext = fileExtension(filename);
+    if (ext === null)
         return false;
-    const ext = filename.slice(dotIndex + 1).toLowerCase();
-    return BLOCKED_EXTENSIONS.has(ext);
+    return Array.isArray(blocked) ? blocked.includes(ext) : blocked.has(ext);
 }
 // =============================================================================
 // PICKER ACCEPT HINT
@@ -808,10 +869,10 @@ const WEB_FILE_EXTENSIONS = [
 /**
  * The `accept` attribute value for a browser file picker offering web files.
  *
- * **This is a hint, never a rule.** `BLOCKED_EXTENSIONS` is the platform's
- * gate and the only thing that decides what may be hosted; this constant
- * decides what a *file dialog* shows first. The two are not two halves of one
- * policy, and this one must never be consulted to accept or reject a file.
+ * **This is a hint, never a rule.** The API's blocklist is the platform's gate
+ * and the only thing that decides what may be hosted; this constant decides
+ * what a *file dialog* shows first. The two are not two halves of one policy,
+ * and this one must never be consulted to accept or reject a file.
  *
  * The distinction is structural, not stylistic. `accept` can express only an
  * allowlist, while the platform's rule is a blocklist — so this list is
@@ -822,9 +883,12 @@ const WEB_FILE_EXTENSIONS = [
  * dropzone and the picker must reach the same verdict on the same files, and
  * they do — because the verdict is `validateFiles`, downstream of both.
  *
- * Kept beside `BLOCKED_EXTENSIONS` so one file holds both, which is what lets
- * `tests/validation-constants.test.ts` fence the invariant that matters: the
- * picker must never offer a file the platform will refuse.
+ * The invariant that matters — the picker must never offer a file the platform
+ * will refuse — is fenced where the authority lives, in the API's own suite
+ * (`cloudflare/api/tests/lib/blocklist.test.ts`), which reads this published
+ * string and holds it against the list it owns. It sat here until the
+ * blocklist became the API's, and moving it was the price of that: a fence
+ * belongs with whichever side can change and break it.
  */
 export const WEB_FILE_ACCEPT = WEB_FILE_EXTENSIONS.map((ext) => `.${ext}`).join(',');
 // =============================================================================
@@ -887,27 +951,34 @@ export function hasUnbuiltMarker(filePath) {
 // the single dispatch over them (TokenKind, classifyToken), and the
 // delegated-access scopes (OAuthScope).
 //
-// THE SHAPE LAW, in three clauses. Every secret the platform mints obeys it,
-// and `tests/validation-constants.test.ts` holds all three mechanically.
+// THE SHAPE LAW, in three clauses, over the `Authorization: Bearer` slot's
+// two populations below. The deployment claim code is the API's own
+// (`AUTH.CLAIM`, server-side: the API mints it and the API validates it, so
+// it has one holder and stays there) and shares only clause 1 — it is the
+// platform's one deliberately BARE secret, because it never enters the
+// Bearer slot: minted into one URL, consumed by one endpoint's one field,
+// its context names it and a prefix would restate its route.
+// `tests/validation-constants.test.ts` holds the clauses over this file's
+// populations; the API's suite holds its own.
 //
-//  1. ONE ENTROPY STANDARD. Every minted random secret is `HEX_LENGTH` hex
-//     characters — one width for the whole platform, so "how long is a
-//     credential" has a single answer rather than one per population.
+//  1. ONE ENTROPY STANDARD. Every minted secret is `HEX_LENGTH` hex characters
+//     — one width for the whole platform, so "how long is a credential" has a
+//     single answer rather than one per population. Generators read the width
+//     from the population's own constant, so a minted value and an accepted
+//     value cannot differ.
 //
-//  2. A PREFIX MARKS A SHARED SLOT, AND NOTHING ELSE. API keys and deploy
-//     tokens both arrive as `Authorization: Bearer`, so something must say
-//     which population a value belongs to: that is what the prefix IS, and
-//     `classifyToken` below is its only reader. Secrets that arrive somewhere
-//     unambiguous carry none — the deployment claim code reaches its own
-//     route in its own field, inside a URL whose path already says `/claim/`,
-//     so a prefix there would be a second name for what the route states.
+//  2. EVERY BEARER POPULATION IS NAMED BY ITS PREFIX. A credential says what
+//     it is before anything parses it — which is what lets `classifyToken`
+//     below dispatch two populations sharing one `Authorization: Bearer`
+//     slot, and what lets a value found in a log, a support ticket or a
+//     pasted URL be recognised and revoked on sight.
 //
 //  3. NO PREFIX IS A PREFIX OF ANOTHER. This is what makes the dispatch
 //     order-independent, and it is the reason the populations are named on
 //     different axes (`ship-` for the product, `deploy-` for the capability)
-//     rather than sharing a stem. A `ship-` / `ship-deploy-` pair reads tidier
-//     and is a trap: every deploy token would also match the API-key branch,
-//     leaving correctness resting on the order of two `if`s.
+//     rather than sharing a stem. A `ship-` / `ship-deploy-` pair
+//     reads tidier and is a trap: every deploy token would also match the
+//     API-key branch, leaving correctness resting on the order of two `if`s.
 /**
  * Where human identity is mounted on the API host. The API mounts Better
  * Auth at this path (sign-in, sign-out, session reads, admin impersonation)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipstatic/types",
-  "version": "2.6.0",
+  "version": "2.7.0-beta.2",
   "description": "Shared types for ShipStatic platform",
   "type": "module",
   "main": "./dist/index.js",

package/src/index.ts

@@ -893,37 +893,72 @@ const MAX_FOREIGN_MESSAGE_LENGTH = 200;
 /**
  * Did the runtime say the exchange never completed?
  *
- * WHATWG has `fetch` reject with a **TypeError** on network error, and undici,
- * Chromium and Firefox comply. Bun does not: it rejects with a plain `Error`
- * carrying a system `code` string. Captured 2026-08-05 (the capture script is
- * in `tests/errors.test.ts`, "runtime failure shapes"):
- *
- * | failure       | Node 22 / undici          | Bun 1.3.14                                   |
- * |---------------|---------------------------|----------------------------------------------|
- * | refused       | `TypeError: fetch failed` | `Error` `code: 'ConnectionRefused'`          |
- * | DNS failure   | `TypeError: fetch failed` | `Error` `code: 'ConnectionRefused'`          |
- * | reset         | `TypeError: fetch failed` | `Error` `code: 'ECONNRESET'`                 |
- * | TLS rejected  | `TypeError: fetch failed` | `Error` `code: 'UNKNOWN_CERTIFICATE_…ERROR'` |
- *
- * So the test is the **evidence, not a list of dialect strings**: a string
- * `code` is a runtime naming a transport-level failure. An allowlist of codes
- * was written first and rejected — the TLS row alone would mean enumerating
- * BoringSSL's certificate table, and a code nobody guessed is precisely the bug
- * this closes. Two kinds of error are deliberately NOT caught: ordinary JS
- * faults carry no `code` at all, and a `DOMException`'s is a **number**, so
- * aborts and timeouts fall through to their own arms.
- *
- * The accepted trade: a caller's `TokenProvider` that throws a coded error
- * (`ENOENT` from a keychain read) is typed `Network` rather than `Api`. Both
- * are wrong for it, `Network` is the cheaper wrong — it says "nothing was
- * exchanged", which is true, where `Api` claims a server answered.
+ * Clients branch on the TYPE, never on message strings, so a misclassified
+ * transport failure is a lie every consumer inherits — and the one that costs
+ * most: `Api` claims a server answered when nothing was exchanged, and a
+ * retrying caller will not retry it.
+ *
+ * **Every row below is a transcript, not a belief.** Captured 2026-08-12
+ * against real runtimes — Node and Bun by direct run, the three engines by a
+ * one-off playwright probe, workerd through miniflare. The capture scripts are
+ * in `tests/errors.test.ts`, "runtime failure shapes".
+ *
+ * | runtime          | connection refused / DNS failure                     | malformed URL                                    |
+ * |------------------|------------------------------------------------------|--------------------------------------------------|
+ * | Node 22 / undici | `TypeError: fetch failed`                             | `TypeError: Failed to parse URL from …`          |
+ * | Bun 1.3.14       | `Error` `code:'ConnectionRefused'`                    | `TypeError` `code:'ERR_INVALID_URL'`             |
+ * | Chromium 151     | `TypeError: Failed to fetch`                          | `TypeError: …Failed to parse URL from …`         |
+ * | Firefox 153      | `TypeError: NetworkError when attempting to fetch …`  | `TypeError: … is not a valid URL.`               |
+ * | WebKit 26.5      | `TypeError: Load failed`                              | `TypeError: URL is not valid or contains user …` |
+ * | workerd          | `Error: Network connection lost.` (DNS: `internal error; reference = …`) | `TypeError: Invalid URL: …`   |
+ *
+ * Reading that table gives the rule, and it is the INVERSE of the obvious one.
+ * The transport class is unbounded — every OS, TLS and DNS failure any engine
+ * will ever name — while the class fetch raises for its own ARGUMENTS is
+ * small, and every runtime names the URL when it complains about one. So the
+ * bounded side is the one worth testing, and the residual risk points the safe
+ * way: an unrecognised sentence lands on `Network`, which says only that
+ * nothing was exchanged.
+ *
+ * That inversion is what fixes **WebKit**, whose `Load failed` carries no code
+ * and no "fetch", and which every browser-SDK and `@shipstatic/drop` user on
+ * Safari was hitting as `Api`. It also makes the six runtimes AGREE about a
+ * malformed URL, which they did not before: the previous rule tested the
+ * message for "fetch", and Chromium's and Firefox's URL complaints both
+ * contain it, so the same mistake was `Network` on three engines and `Api` on
+ * three.
+ *
+ * **workerd is the recorded gap.** It rejects with a plain `Error`, no code
+ * and no shared sentence — and its two failure modes produce two unrelated
+ * ones — so nothing here can classify it and it lands on `Api`. Left alone
+ * rather than patched with a dialect string: the one consumer running ship in
+ * that runtime (`cloudflare/mcp`) reaches the API through a service BINDING,
+ * which is in-process and does not produce transport rejections at all.
+ *
+ * The accepted trade is unchanged: a caller's `TokenProvider` that throws a
+ * coded error (`ENOENT` from a keychain read) is typed `Network` rather than
+ * `Api`. Both are wrong for it; `Network` is the cheaper wrong.
  */
 function isTransportFailure(cause: Error): boolean {
-  if (typeof (cause as { code?: unknown }).code === 'string') return true;
-  // Spec runtimes put no code on the rejection itself. The message test is what
-  // keeps fetch's ARGUMENT errors out — `Failed to parse URL from …` is a
-  // caller's config mistake, not a transport failure.
-  return cause instanceof TypeError && cause.message.includes('fetch');
+  const code = (cause as { code?: unknown }).code;
+
+  // Bun is the one runtime that puts a CODE on an argument error, so it is
+  // excluded before the code arm can claim it.
+  if (code === 'ERR_INVALID_URL') return false;
+
+  // A string `code` is a runtime naming a transport-level failure. An
+  // allowlist of codes was written first and rejected — the TLS row alone
+  // would mean enumerating BoringSSL's certificate table, and a code nobody
+  // guessed is precisely the bug this closes. A `DOMException`'s code is a
+  // NUMBER, so aborts and timeouts never reach here.
+  if (typeof code === 'string') return true;
+
+  // WHATWG has fetch reject with a TypeError for BOTH halves — network error
+  // and argument error — so among TypeErrors the URL is the discriminator.
+  if (cause instanceof TypeError) return !/\burl\b/i.test(cause.message);
+
+  // Anything else — an ordinary JS fault, or workerd — is not evidence.
+  return false;
 }
 
 /**
@@ -1071,12 +1106,30 @@ export class ShipError extends Error {
    *
    * Routing:
    * - Already a `ShipError` → returned as-is (caller's intent preserved)
-   * - `AbortError` → `ShipError.cancelled(...)`
+   * - `AbortError` → `ShipError.cancelled(...)` — someone stopped it on purpose
+   * - `TimeoutError` → `ShipError.network(...)` — a deadline expired, so
+   *   nothing was exchanged; the message names the timeout
    * - A transport failure → `ShipError.network(...)` — see `isTransportFailure`
    *   for what each runtime offers as evidence
    * - Any other `Error` → `ShipError(Api, ...)` (no HTTP status — fetch never reached the server)
    * - Anything else (string, undefined, etc.) → `ShipError(Api, ...)`
    *
+   * **Abort and timeout are read from `name` BEFORE any `instanceof Error`
+   * gate.** A `DOMException` satisfies that gate in every runtime measured
+   * (Node, Bun, Chromium, Firefox, WebKit, workerd — all six), but the
+   * inheritance is a comparatively recent spec change and this classification
+   * has no reason to depend on it: `name` is where the meaning lives, and
+   * reading it first costs nothing. The suite plants a non-`Error`
+   * `DOMException` shape to hold the arm, since no runtime on the table
+   * produces one.
+   *
+   * A caller's own `AbortSignal.timeout()` is the reachable source of
+   * `TimeoutError` — and the two are NOT interchangeable per runtime: WebKit
+   * reports a fired `AbortSignal.timeout()` as `AbortError`, so on Safari a
+   * deadline is indistinguishable from a cancellation and lands on
+   * `Cancelled`. Recorded rather than worked around; `Cancelled` is honest
+   * there, since the caller's signal is what stopped it.
+   *
    * The optional `operationName` is composed into the message for context:
    * `"Get account was cancelled"`, `"Get account failed: ..."`. Defaults to
    * `"Request"` when omitted.
@@ -1086,10 +1139,20 @@ export class ShipError extends Error {
 
     const op = operationName || 'Request';
 
+    // Read by NAME, ahead of the Error gate — see the note above.
+    const name = (cause as { name?: unknown } | null | undefined)?.name;
+    if (name === 'AbortError') {
+      return ShipError.cancelled(`${op} was cancelled`);
+    }
+    if (name === 'TimeoutError') {
+      // A deadline, not a fault and not a cancellation: nothing was exchanged,
+      // which is exactly what `Network` claims. The runtime's own sentence is
+      // dropped here rather than relayed — "The operation was aborted due to
+      // timeout" is the mechanism, not the news.
+      return ShipError.network(`${op} timed out`, { cause });
+    }
+
     if (cause instanceof Error) {
-      if (cause.name === 'AbortError') {
-        return ShipError.cancelled(`${op} was cancelled`);
-      }
       if (isTransportFailure(cause)) {
         return ShipError.network(`${op} failed: ${cause.message}`, { cause });
       }
@@ -1234,14 +1297,17 @@ export function isShipError(error: unknown): error is ShipError {
 // =============================================================================
 
 /**
- * Plan-based platform limits returned by the `/limits` endpoint.
+ * What the platform will refuse, returned by the `/limits` endpoint.
  *
- * The SDK fetches these once on first API call to drive client-side
- * file-size / file-count / total-size validation that mirrors what the API
- * would enforce server-side. Limits vary by account plan.
+ * The SDK fetches this once on first API call to drive client-side validation
+ * that mirrors what the API would enforce server-side. The caps vary by
+ * account plan; the blocklist does not.
  *
- * These are the *platform's* posted caps for the current account — server
- * truth delivered at runtime, never hard-coded on the client.
+ * These are the *platform's* posted rules for the current account — server
+ * truth delivered at runtime, never hard-coded on the client. That is the
+ * whole point of the shape: a rule the server owns and may change reaches the
+ * client as data, so a pinned client cannot enforce a policy the platform has
+ * moved on from (`npm/types/CLAUDE.md`, "Validation: format vs policy").
  *
  * A report: it answers a question and carries only the answer (`CLAUDE.md`,
  * "A report answers a question").
@@ -1253,84 +1319,105 @@ export interface PlatformLimits {
   maxFilesCount: number;
   /** Maximum total size in bytes across all files in a deployment. */
   maxTotalSize: number;
+  /**
+   * Lowercase extensions, without the dot, that the platform refuses to host
+   * (`exe`, `dmg`, …). Owned and evolved by the API — see
+   * `cloudflare/api/src/lib/blocklist.ts`.
+   *
+   * **Optional, and the absence is load-bearing.** An API deployed before this
+   * field existed sends nothing, so a client MUST read absence as "no
+   * client-side check" rather than as an empty policy. The hint fails open,
+   * the boundary fails closed: the server refuses the file either way, and a
+   * client that guessed would only ever be wrong in the direction that refuses
+   * a file the platform accepts.
+   *
+   * The optionality follows the additive-evolution law and retires with its
+   * reason: once every environment serves the field, it hardens to required at
+   * the entity's next natural break, and the clients' fail-open spellings
+   * retire with it (tracked in root `backlog.md`).
+   */
+  readonly blockedExtensions?: readonly string[];
 }
 
 // =============================================================================
-// EXTENSION BLOCKLIST
+// EXTENSION MATCHING
 // =============================================================================
 
 /**
- * Blocked file extensions — files that cannot be uploaded.
- *
- * We accept any file type by default and derive Content-Type from the
- * extension at serve time (via mime-db in the API worker). Unknown extensions
- * are served as `application/octet-stream` with `X-Content-Type-Options: nosniff`.
- *
- * The blocklist targets file types that pose direct security risks when hosted:
- * executables, disk images, malware vectors, dangerous scripts, and shortcuts.
- */
-export const BLOCKED_EXTENSIONS: ReadonlySet<string> = new Set([
-  // Executables
-  'exe',
-  'msi',
-  'dll',
-  'scr',
-  'bat',
-  'cmd',
-  'com',
-  'pif',
-  'app',
-  'deb',
-  'rpm',
-  // Installers
-  'pkg',
-  'mpkg',
-  // Disk images
-  'dmg',
-  'iso',
-  'img',
-  // Malware vectors
-  'cab',
-  'cpl',
-  'chm',
-  // Dangerous scripts
-  'ps1',
-  'vbs',
-  'vbe',
-  'ws',
-  'wsf',
-  'wsc',
-  'wsh',
-  'reg',
-  // Java
-  'jar',
-  'jnlp',
-  // Mobile/browser packages
-  'apk',
-  'crx',
-  // Shortcut/link
-  'lnk',
-  'inf',
-  'hta',
-]);
+ * The rule for reading a file's extension: lowercase, after the last dot of
+ * the last path segment. `null` when there is no extension to read.
+ *
+ * A leading dot names the file rather than its type, so `.gitignore` and
+ * `.htaccess` have no extension — but `.env.exe` has `exe`.
+ *
+ * Segment-aware on purpose: the callers pass deploy PATHS, not basenames, and
+ * a naive `lastIndexOf('.')` over `dir.v1/README` reads the extension
+ * `v1/README` — safe only by accident, since no entry in a real blocklist
+ * contains a slash, which is the kind of correctness nobody should have to
+ * re-derive.
+ *
+ * **Private, and the reason is the asymmetry rather than any hazard.** Nothing
+ * outside this file reads it: `isBlockedExtension` is the only question anyone
+ * asks, and the API's refusal names the FILE, not its extension. Exporting a
+ * pure function is harmless, which is exactly the argument that talks a
+ * published package into surface it has not earned — and the costs do not
+ * match, since adding an export later is free under the additive law while
+ * removing one is a major. So it stays private until a caller exists. Its
+ * behaviour is fenced through `isBlockedExtension`, which is where it is
+ * observable.
+ *
+ * (`WEB_FILE_EXTENSIONS` above is private for a different reason — publishing
+ * it would invite a wrong question. Both are private; only one is a hazard.)
+ *
+ * @example
+ * fileExtension('virus.exe')          // 'exe'
+ * fileExtension('assets/style.CSS')   // 'css'
+ * fileExtension('dir.v1/README')      // null
+ * fileExtension('.gitignore')         // null
+ * fileExtension('file.')              // null
+ */
+function fileExtension(filename: string): string | null {
+  const basename = filename.replace(/\\/g, '/').split('/').pop() ?? '';
+  const dotIndex = basename.lastIndexOf('.');
+  if (dotIndex <= 0 || dotIndex === basename.length - 1) return null;
+  return basename.slice(dotIndex + 1).toLowerCase();
+}
 
 /**
- * Check if a filename has a blocked extension.
- * Extracts the extension from the filename and checks against the blocklist.
- * Case-insensitive. Returns false for files without extensions.
+ * Whether a file is one the platform refuses to host.
+ *
+ * **The list is not this package's, and that separation is the point.** What
+ * counts as a blocked extension is hosting POLICY — it evolves, it is enforced
+ * at one security boundary, and `virus.exe` is a perfectly well-formed
+ * filename that breaks nothing about the upload→serve round-trip. So the API
+ * owns the list (`cloudflare/api/src/lib/blocklist.ts`) and delivers it as
+ * `PlatformLimits.blockedExtensions`; a client passes what it was given.
+ *
+ * What lives here is the MATCHING RULE, and it earns its place by the
+ * constellation law's own test. The list's drift is loud in both directions —
+ * a stale client uploads a file the API refuses by name, on the first try.
+ * A second *matcher* drifts SILENTLY in the one direction that matters: a
+ * client stricter than the server refuses a legal file without the server ever
+ * being asked, and no error names it. Two holders, silent drift, one owner.
+ *
+ * The `blocked` collection is required rather than defaulted: this predicate
+ * guards a security boundary in the API, and a defaulted-empty argument there
+ * would block nothing while reading as though it did. Callers holding a
+ * possibly-absent wire field spell the fail-open themselves.
  *
  * @example
- * isBlockedExtension('virus.exe')     // true
- * isBlockedExtension('app.dmg')       // true
- * isBlockedExtension('style.css')     // false
- * isBlockedExtension('data.custom')   // false
- * isBlockedExtension('README')        // false
+ * isBlockedExtension('virus.exe', ['exe'])   // true
+ * isBlockedExtension('virus.EXE', ['exe'])   // true — case-insensitive
+ * isBlockedExtension('style.css', ['exe'])   // false
+ * isBlockedExtension('README', ['exe'])      // false — no extension
  */
-export function isBlockedExtension(filename: string): boolean {
-  const dotIndex = filename.lastIndexOf('.');
-  if (dotIndex === -1 || dotIndex === filename.length - 1) return false;
-  const ext = filename.slice(dotIndex + 1).toLowerCase();
-  return BLOCKED_EXTENSIONS.has(ext);
+export function isBlockedExtension(
+  filename: string,
+  blocked: ReadonlySet<string> | readonly string[],
+): boolean {
+  const ext = fileExtension(filename);
+  if (ext === null) return false;
+  return Array.isArray(blocked) ? blocked.includes(ext) : (blocked as ReadonlySet<string>).has(ext);
 }
 
 // =============================================================================
@@ -1435,10 +1522,10 @@ const WEB_FILE_EXTENSIONS = [
 /**
  * The `accept` attribute value for a browser file picker offering web files.
  *
- * **This is a hint, never a rule.** `BLOCKED_EXTENSIONS` is the platform's
- * gate and the only thing that decides what may be hosted; this constant
- * decides what a *file dialog* shows first. The two are not two halves of one
- * policy, and this one must never be consulted to accept or reject a file.
+ * **This is a hint, never a rule.** The API's blocklist is the platform's gate
+ * and the only thing that decides what may be hosted; this constant decides
+ * what a *file dialog* shows first. The two are not two halves of one policy,
+ * and this one must never be consulted to accept or reject a file.
  *
  * The distinction is structural, not stylistic. `accept` can express only an
  * allowlist, while the platform's rule is a blocklist — so this list is
@@ -1449,9 +1536,12 @@ const WEB_FILE_EXTENSIONS = [
  * dropzone and the picker must reach the same verdict on the same files, and
  * they do — because the verdict is `validateFiles`, downstream of both.
  *
- * Kept beside `BLOCKED_EXTENSIONS` so one file holds both, which is what lets
- * `tests/validation-constants.test.ts` fence the invariant that matters: the
- * picker must never offer a file the platform will refuse.
+ * The invariant that matters — the picker must never offer a file the platform
+ * will refuse — is fenced where the authority lives, in the API's own suite
+ * (`cloudflare/api/tests/lib/blocklist.test.ts`), which reads this published
+ * string and holds it against the list it owns. It sat here until the
+ * blocklist became the API's, and moving it was the price of that: a fence
+ * belongs with whichever side can change and break it.
  */
 export const WEB_FILE_ACCEPT: string = WEB_FILE_EXTENSIONS.map((ext) => `.${ext}`).join(',');
 
@@ -1542,27 +1632,34 @@ export interface PingResponse {
 // the single dispatch over them (TokenKind, classifyToken), and the
 // delegated-access scopes (OAuthScope).
 //
-// THE SHAPE LAW, in three clauses. Every secret the platform mints obeys it,
-// and `tests/validation-constants.test.ts` holds all three mechanically.
+// THE SHAPE LAW, in three clauses, over the `Authorization: Bearer` slot's
+// two populations below. The deployment claim code is the API's own
+// (`AUTH.CLAIM`, server-side: the API mints it and the API validates it, so
+// it has one holder and stays there) and shares only clause 1 — it is the
+// platform's one deliberately BARE secret, because it never enters the
+// Bearer slot: minted into one URL, consumed by one endpoint's one field,
+// its context names it and a prefix would restate its route.
+// `tests/validation-constants.test.ts` holds the clauses over this file's
+// populations; the API's suite holds its own.
 //
-//  1. ONE ENTROPY STANDARD. Every minted random secret is `HEX_LENGTH` hex
-//     characters — one width for the whole platform, so "how long is a
-//     credential" has a single answer rather than one per population.
+//  1. ONE ENTROPY STANDARD. Every minted secret is `HEX_LENGTH` hex characters
+//     — one width for the whole platform, so "how long is a credential" has a
+//     single answer rather than one per population. Generators read the width
+//     from the population's own constant, so a minted value and an accepted
+//     value cannot differ.
 //
-//  2. A PREFIX MARKS A SHARED SLOT, AND NOTHING ELSE. API keys and deploy
-//     tokens both arrive as `Authorization: Bearer`, so something must say
-//     which population a value belongs to: that is what the prefix IS, and
-//     `classifyToken` below is its only reader. Secrets that arrive somewhere
-//     unambiguous carry none — the deployment claim code reaches its own
-//     route in its own field, inside a URL whose path already says `/claim/`,
-//     so a prefix there would be a second name for what the route states.
+//  2. EVERY BEARER POPULATION IS NAMED BY ITS PREFIX. A credential says what
+//     it is before anything parses it — which is what lets `classifyToken`
+//     below dispatch two populations sharing one `Authorization: Bearer`
+//     slot, and what lets a value found in a log, a support ticket or a
+//     pasted URL be recognised and revoked on sight.
 //
 //  3. NO PREFIX IS A PREFIX OF ANOTHER. This is what makes the dispatch
 //     order-independent, and it is the reason the populations are named on
 //     different axes (`ship-` for the product, `deploy-` for the capability)
-//     rather than sharing a stem. A `ship-` / `ship-deploy-` pair reads tidier
-//     and is a trap: every deploy token would also match the API-key branch,
-//     leaving correctness resting on the order of two `if`s.
+//     rather than sharing a stem. A `ship-` / `ship-deploy-` pair
+//     reads tidier and is a trap: every deploy token would also match the
+//     API-key branch, leaving correctness resting on the order of two `if`s.
 
 /**
  * Where human identity is mounted on the API host. The API mounts Better