feat(utilities): forbid usernames ending in .md

packages/utilities/src/usernames.ts

@@ -497,9 +497,10 @@ const FORBIDDEN_USERNAMES_REGEXPS = [
     'security\\.txt',
     'llms\\.txt',
     'llms-full\\.txt',
-    'AGENTS\\.md',
-    'CLAUDE\\.md',
-    'auth\\.md',
+    // apify.com serves a markdown twin of each page at <path>.md, so any username ending
+    // in ".md" collides with that route. Blocked here rather than in USERNAME.REGEX so that
+    // existing holders keep their username; the regex runs on every user-record write.
+    '(.*\\.md)',
 
     // All hidden files
     '(\\..*)',

test/usernames.test.ts

@@ -22,12 +22,17 @@ describe('isForbiddenUsername()', () => {
         expect(isForbiddenUsername('BingSiteAuth.XML')).toBe(true);
         expect(isForbiddenUsername('llms.txt')).toBe(true);
         expect(isForbiddenUsername('llms-full.txt')).toBe(true);
+
+        // Any username ending in ".md" collides with the markdown twin of the page
         expect(isForbiddenUsername('AGENTS.md')).toBe(true);
-        expect(isForbiddenUsername('agents.MD')).toBe(true);
         expect(isForbiddenUsername('CLAUDE.md')).toBe(true);
-        expect(isForbiddenUsername('claude.MD')).toBe(true);
         expect(isForbiddenUsername('auth.md')).toBe(true);
-        expect(isForbiddenUsername('AUTH.MD')).toBe(true);
+        expect(isForbiddenUsername('foo.md')).toBe(true);
+        expect(isForbiddenUsername('foo.MD')).toBe(true);
+        expect(isForbiddenUsername('.md')).toBe(true);
+        expect(isForbiddenUsername('foo.mdx')).toBe(false);
+        expect(isForbiddenUsername('foo.markdown')).toBe(false);
+        expect(isForbiddenUsername('md.foo')).toBe(false);
 
         // Agentic protocols and payment standards
         expect(isForbiddenUsername('x402')).toBe(true);