cursedops 0.2.1 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.2.1",
+	"version": "0.2.2",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots without knowing a path, macOS launchd agent install/replace/remove, the scaffolding of a deployed smoke, and the static-serving helpers eight apps copied — the path-traversal guard and the API floor among them. Mechanism only — no app knows its name from here. Bun, zero dependencies, ships source.",
 	"type": "module",
 	"scripts": {

package/src/serve.ts

@@ -207,13 +207,27 @@ export function canonicalApiPath(urlPath: string): string | null {
 
 /**
  * The same normalisation, applied to a whole request. Returns the request unchanged when
- * there is nothing to normalise, so the hot path allocates nothing.
+ * there is nothing to normalise, so a caller that guards on {@link canonicalApiPath}
+ * allocates nothing.
  *
- * 🔴 Wrap it around the ONE function every response leaves through — the `fetch` a host
- * hands `Bun.serve` or exports from a Worker — and never as a Hono middleware. Hono runs
- * middleware in registration order against handlers registered AFTER it, and an app's
- * routes are mounted before the host is built; a middleware added at that point runs for
- * none of them. It also cannot change which route matches, which is the entire job here.
+ * 🔴 **Call it from INSIDE the floor handler and re-dispatch, not from the host's
+ * `fetch`.** Both work; only one of them cannot be wired up wrong. A router has many
+ * callers — `Bun.serve`, a Worker's `export default`, and every test harness that drives
+ * `app.fetch` directly — and a wrap installed at one of them is absent from the others.
+ * That is the shape of the fault this whole family exists to close: the previous
+ * generation's artifact had a floor its harness mounted correctly and production did not,
+ * and it stayed green for six days. A floor that answers
+ *
+ *     const canonical = canonicalApiPath(new URL(c.req.url).pathname);
+ *     if (canonical !== null) return app.fetch(canonicalApiRequest(c.req.raw));
+ *     return c.json(apiNotFoundBody(...), 404, ...);
+ *
+ * is reached by every caller there will ever be, costs nothing on the hot path — only a
+ * MISS gets here — and cannot loop, because the canonical path has no trailing slash left
+ * to strip and a second miss falls straight to the body.
+ *
+ * It must not be a Hono middleware either: Hono matches the route before the chain runs,
+ * so a middleware cannot change which handler answers, which is the entire job here.
  */
 export function canonicalApiRequest(request: Request): Request {
 	const url = new URL(request.url);