cursedops 0.2.3 → 0.2.4

package/README.md

@@ -156,7 +156,7 @@ const floor = (c) => {
   if (canonicalApiPath(urlPath) !== null) return app.fetch(canonicalApiRequest(c.req.raw));
   return Response.json(apiNotFoundBody(c.req.method, urlPath, "myapp", commit), { status: 404 });
 };
-app.all(API_PREFIX, floor);        // `"/api/*"` alone does NOT match a bare `/api`
+app.all(API_PREFIX, floor);
 app.all(`${API_PREFIX}/*`, floor);
 ```
 
@@ -173,6 +173,11 @@ drives `app.fetch` — and a wrap installed at one of them is absent from the re
 the exact fault the previous generation's artifact shipped for six days with a green
 harness.
 
+Both patterns are registered although `"/api/*"` alone already matches a bare `/api` on
+hono@4.13.7 (measured 2026-09-18) — that is an undocumented property of one matcher
+version, and one extra route registration is cheaper than a floor with a hole in it the
+day it tightens.
+
 No `node:` import, no `Bun.` global, no `process` — asserted by `apiFloor.test.ts`, not
 by this paragraph — so it mounts unchanged inside a Cloudflare Worker, which is where
 `patterns` mounts it. `apiNotFoundBody` is the DEFAULT body and not the only one: an app

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.2.3",
+	"version": "0.2.4",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots without knowing a path, macOS launchd agent install/replace/remove, the scaffolding of a deployed smoke, and the static-serving helpers eight apps copied — the path-traversal guard among them — and the API floor that keeps an unmatched /api/... from ever being answered with the app shell. Mechanism only — no app knows its name from here. Bun, zero dependencies, ships source.",
 	"type": "module",
 	"scripts": {

package/src/apiFloor.ts

@@ -50,10 +50,19 @@ export const API_PREFIX = "/api";
 /**
  * Is this path inside the API namespace? `/api` itself counts; `/apiary` does not.
  *
- * 🔴 The namespace ITSELF is the case every hand-rolled floor missed. A Hono
- * `app.all("/api/*")` does not match a bare `/api` — the pattern requires the slash — so
- * the one path most likely to be typed by hand fell through to the shell in the two apps
- * that already believed they had a floor.
+ * 🔴 `/apiary` and `/api-docs` are the cases a `startsWith("/api")` gets wrong, and they
+ * are page URLs — a floor that swallowed them would answer JSON where the client expects
+ * its own route. The namespace ITSELF counting is the other half: a caller that types
+ * `/api` by hand is inside it.
+ *
+ * 🔴 **This does NOT mirror what Hono's router does, and the difference is the reason to
+ * register both patterns.** Measured 2026-09-18 against hono@4.13.7: `app.all("/api/*")`
+ * already matches a bare `/api` — the `*` matches zero segments including the slash in
+ * front of it. So `app.all(API_PREFIX, floor)` is redundant TODAY. It is in the wiring
+ * anyway because that is an undocumented property of one matcher version, it costs one
+ * route registration, and the alternative is a floor with a hole in it the day the
+ * matcher tightens. What proves the rule is each app's spec asking for `/api` and
+ * getting the phrase — never this arithmetic.
  */
 export const isApiPath = (urlPath: string): boolean =>
 	urlPath === API_PREFIX || urlPath.startsWith(`${API_PREFIX}/`);