tina4-nodejs 3.13.135 → 3.13.136

package/CLAUDE.md

@@ -13,13 +13,13 @@ Even if the skill text is not currently loaded, these are non-negotiable:
 
 The full discipline lives in `.claude/skills/tina4-maintainer/SKILL.md`; this block is the always-on floor.
 
-# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.135)
+# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.136)
 
 > This file helps AI assistants (Claude, Copilot, Cursor, etc.) understand and work on this codebase effectively.
 
 ## What This Project Is
 
-Tina4 for Node.js/TypeScript v3.13.135 - The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
+Tina4 for Node.js/TypeScript v3.13.136 - The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
 
 The philosophy: zero ceremony, batteries included, file system as source of truth.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tina4-nodejs",
-  "version": "3.13.135",
+  "version": "3.13.136",
   "type": "module",
   "description": "Tina4 for Node.js/TypeScript - native TypeScript conventions and shared Tina4 contracts",
   "keywords": [

package/packages/cli/dist/bin.js

@@ -37955,13 +37955,37 @@ function swaggerEnabled() {
   return ["true", "1", "yes", "on"].includes(raw);
 }
 function createSwaggerRoutes(getSpec) {
+  const serveUi = async (_req, res) => {
+    res.html(SWAGGER_UI_HTML("/swagger/openapi.json"));
+  };
   return [
     {
       method: "GET",
       pattern: "/swagger",
-      handler: async (_req, res) => {
-        res.html(SWAGGER_UI_HTML("/swagger/openapi.json"));
-      }
+      handler: serveUi
+    },
+    {
+      // The trailing-slash form, registered rather than left to fall through.
+      //
+      // Matching "/foo/" against a "/foo" route is opt-in via
+      // TINA4_TRAILING_SLASH_REDIRECT and OFF by default, so /swagger/ missed
+      // this route and was answered by the framework-bundled
+      // public/swagger/index.html instead. That mattered twice over. It used to
+      // be a 200 carrying a permanently empty UI, because the bundled file asked
+      // for an unsubstituted {SWAGGER_ROUTE}/swagger.json -- fixed in that file.
+      // And it is a SECOND Swagger UI implementation: the bundled one hardcodes
+      // cdnjs, while the page this handler renders loads from
+      // TINA4_SWAGGER_UI_CDN, so an air-gapped deployment pointing that at a
+      // local mirror silently kept reaching cdnjs on this one path.
+      //
+      // Registering it keeps the fix inside swagger rather than changing how
+      // every route treats trailing slashes, satisfies the shared contract that
+      // already requires a 200 here, and matches python and ruby, which both
+      // serve /swagger and /swagger/ with no env var set. Excluded from the
+      // generated document by INTERNAL_PREFIXES like /swagger itself.
+      method: "GET",
+      pattern: "/swagger/",
+      handler: serveUi
     },
     {
       method: "GET",

package/packages/core/dist/index.js

@@ -37934,13 +37934,37 @@ function swaggerEnabled() {
   return ["true", "1", "yes", "on"].includes(raw);
 }
 function createSwaggerRoutes(getSpec) {
+  const serveUi = async (_req, res) => {
+    res.html(SWAGGER_UI_HTML("/swagger/openapi.json"));
+  };
   return [
     {
       method: "GET",
       pattern: "/swagger",
-      handler: async (_req, res) => {
-        res.html(SWAGGER_UI_HTML("/swagger/openapi.json"));
-      }
+      handler: serveUi
+    },
+    {
+      // The trailing-slash form, registered rather than left to fall through.
+      //
+      // Matching "/foo/" against a "/foo" route is opt-in via
+      // TINA4_TRAILING_SLASH_REDIRECT and OFF by default, so /swagger/ missed
+      // this route and was answered by the framework-bundled
+      // public/swagger/index.html instead. That mattered twice over. It used to
+      // be a 200 carrying a permanently empty UI, because the bundled file asked
+      // for an unsubstituted {SWAGGER_ROUTE}/swagger.json -- fixed in that file.
+      // And it is a SECOND Swagger UI implementation: the bundled one hardcodes
+      // cdnjs, while the page this handler renders loads from
+      // TINA4_SWAGGER_UI_CDN, so an air-gapped deployment pointing that at a
+      // local mirror silently kept reaching cdnjs on this one path.
+      //
+      // Registering it keeps the fix inside swagger rather than changing how
+      // every route treats trailing slashes, satisfies the shared contract that
+      // already requires a 200 here, and matches python and ruby, which both
+      // serve /swagger and /swagger/ with no env var set. Excluded from the
+      // generated document by INTERNAL_PREFIXES like /swagger itself.
+      method: "GET",
+      pattern: "/swagger/",
+      handler: serveUi
     },
     {
       method: "GET",

package/packages/core/public/swagger/index.html

@@ -71,7 +71,7 @@
 
         // Build a system
         const ui = SwaggerUIBundle({
-            url: "{SWAGGER_ROUTE}/swagger.json",
+            url: "/swagger/openapi.json",
             dom_id: '#swagger-ui',
             deepLinking: true,
             presets: [

package/packages/orm/dist/index.js

@@ -26223,13 +26223,37 @@ function swaggerEnabled() {
   return ["true", "1", "yes", "on"].includes(raw);
 }
 function createSwaggerRoutes(getSpec) {
+  const serveUi = async (_req, res) => {
+    res.html(SWAGGER_UI_HTML("/swagger/openapi.json"));
+  };
   return [
     {
       method: "GET",
       pattern: "/swagger",
-      handler: async (_req, res) => {
-        res.html(SWAGGER_UI_HTML("/swagger/openapi.json"));
-      }
+      handler: serveUi
+    },
+    {
+      // The trailing-slash form, registered rather than left to fall through.
+      //
+      // Matching "/foo/" against a "/foo" route is opt-in via
+      // TINA4_TRAILING_SLASH_REDIRECT and OFF by default, so /swagger/ missed
+      // this route and was answered by the framework-bundled
+      // public/swagger/index.html instead. That mattered twice over. It used to
+      // be a 200 carrying a permanently empty UI, because the bundled file asked
+      // for an unsubstituted {SWAGGER_ROUTE}/swagger.json -- fixed in that file.
+      // And it is a SECOND Swagger UI implementation: the bundled one hardcodes
+      // cdnjs, while the page this handler renders loads from
+      // TINA4_SWAGGER_UI_CDN, so an air-gapped deployment pointing that at a
+      // local mirror silently kept reaching cdnjs on this one path.
+      //
+      // Registering it keeps the fix inside swagger rather than changing how
+      // every route treats trailing slashes, satisfies the shared contract that
+      // already requires a 200 here, and matches python and ruby, which both
+      // serve /swagger and /swagger/ with no env var set. Excluded from the
+      // generated document by INTERNAL_PREFIXES like /swagger itself.
+      method: "GET",
+      pattern: "/swagger/",
+      handler: serveUi
     },
     {
       method: "GET",

package/packages/swagger/dist/index.js

@@ -521,13 +521,37 @@ function swaggerEnabled() {
   return ["true", "1", "yes", "on"].includes(raw);
 }
 function createSwaggerRoutes(getSpec) {
+  const serveUi = async (_req, res) => {
+    res.html(SWAGGER_UI_HTML("/swagger/openapi.json"));
+  };
   return [
     {
       method: "GET",
       pattern: "/swagger",
-      handler: async (_req, res) => {
-        res.html(SWAGGER_UI_HTML("/swagger/openapi.json"));
-      }
+      handler: serveUi
+    },
+    {
+      // The trailing-slash form, registered rather than left to fall through.
+      //
+      // Matching "/foo/" against a "/foo" route is opt-in via
+      // TINA4_TRAILING_SLASH_REDIRECT and OFF by default, so /swagger/ missed
+      // this route and was answered by the framework-bundled
+      // public/swagger/index.html instead. That mattered twice over. It used to
+      // be a 200 carrying a permanently empty UI, because the bundled file asked
+      // for an unsubstituted {SWAGGER_ROUTE}/swagger.json -- fixed in that file.
+      // And it is a SECOND Swagger UI implementation: the bundled one hardcodes
+      // cdnjs, while the page this handler renders loads from
+      // TINA4_SWAGGER_UI_CDN, so an air-gapped deployment pointing that at a
+      // local mirror silently kept reaching cdnjs on this one path.
+      //
+      // Registering it keeps the fix inside swagger rather than changing how
+      // every route treats trailing slashes, satisfies the shared contract that
+      // already requires a 200 here, and matches python and ruby, which both
+      // serve /swagger and /swagger/ with no env var set. Excluded from the
+      // generated document by INTERNAL_PREFIXES like /swagger itself.
+      method: "GET",
+      pattern: "/swagger/",
+      handler: serveUi
     },
     {
       method: "GET",

package/packages/swagger/src/ui.ts

@@ -56,13 +56,38 @@ export function swaggerEnabled(): boolean {
 export function createSwaggerRoutes(
   getSpec: () => unknown
 ): RouteDefinition[] {
+  const serveUi = async (_req: Tina4Request, res: Tina4Response): Promise<void> => {
+    res.html(SWAGGER_UI_HTML("/swagger/openapi.json"));
+  };
+
   return [
     {
       method: "GET",
       pattern: "/swagger",
-      handler: async (_req: Tina4Request, res: Tina4Response) => {
-        res.html(SWAGGER_UI_HTML("/swagger/openapi.json"));
-      },
+      handler: serveUi,
+    },
+    {
+      // The trailing-slash form, registered rather than left to fall through.
+      //
+      // Matching "/foo/" against a "/foo" route is opt-in via
+      // TINA4_TRAILING_SLASH_REDIRECT and OFF by default, so /swagger/ missed
+      // this route and was answered by the framework-bundled
+      // public/swagger/index.html instead. That mattered twice over. It used to
+      // be a 200 carrying a permanently empty UI, because the bundled file asked
+      // for an unsubstituted {SWAGGER_ROUTE}/swagger.json -- fixed in that file.
+      // And it is a SECOND Swagger UI implementation: the bundled one hardcodes
+      // cdnjs, while the page this handler renders loads from
+      // TINA4_SWAGGER_UI_CDN, so an air-gapped deployment pointing that at a
+      // local mirror silently kept reaching cdnjs on this one path.
+      //
+      // Registering it keeps the fix inside swagger rather than changing how
+      // every route treats trailing slashes, satisfies the shared contract that
+      // already requires a 200 here, and matches python and ruby, which both
+      // serve /swagger and /swagger/ with no env var set. Excluded from the
+      // generated document by INTERNAL_PREFIXES like /swagger itself.
+      method: "GET",
+      pattern: "/swagger/",
+      handler: serveUi,
     },
     {
       method: "GET",