fix(serve): a real public file beats any dynamic route, not just a catch-all

The disk check added in 0.2.174 only dropped `[...catch-all]` candidates, on
the assumption that those are the routes broad enough to swallow an asset.
That assumption holds for a shallow route tree and fails completely for an app
whose routes start at the root: a forge with `[owner]/[repository]` claims
every two-segment path and `[owner]` claims every one-segment path, so
`/js/mermaid.js` and `/favicon.ico` both rendered a page and **the entire
publicDir was unreachable**.

Found by loading a page that dynamically imports `/js/mermaid.js` and getting
72KB of HTML where the 3.4MB bundle should have been - every mermaid diagram
in that product silently not drawing, on the served boot as well as the dev
server, with the fallback leaving the diagram source on screen so it read as
"no diagram here" rather than as a failure.

A file that really exists at exactly the requested path is a stronger signal
than any route pattern, so it now wins over all of them. Nothing is dropped
when publicDir has nothing there, which is what keeps
`/owner/repo/tree/main/src/index.ts` resolving to the code browser.

The resolver test mirrored the old rule and would have kept passing while the
server did something else; it mirrors the new one now, with the forge's own
route shape as the case.

Author: chrisbbreuer

packages/bun-plugin/src/serve.ts

@@ -2423,17 +2423,25 @@ function __stxOverlay(errs){
     // the path carries a non-page file extension, drop catch-all candidates so
     // the request falls through to publicDir (and then the real 404 page).
     // Specific routes may still match (rare, but legitimate). stacksjs/stx#1841.
-    // A catch-all is dropped when publicDir really holds this file, rather
-    // than whenever the path merely looks like an asset: the extension is a
-    // guess about intent, and it refuses every legitimate catch-all page
-    // whose path carries a dot (see publicFileExists).
+    // A dynamic route is dropped when publicDir really holds this file,
+    // rather than whenever the path merely looks like an asset: the extension
+    // is a guess about intent, and it refuses every legitimate page whose
+    // path carries a dot (see publicFileExists).
+    //
+    // **Every** dynamic route, not only catch-alls. Restricting it to `[...x]`
+    // assumed a shallow route tree, and an app whose routes start at the root
+    // does not have one: a forge serving `[owner]/[repository]` claims every
+    // two-segment path and `[owner]` claims every one-segment path, so
+    // `/js/mermaid.js` and `/favicon.ico` both rendered a page and the whole
+    // publicDir was unreachable. A real file at exactly this path is a
+    // stronger signal than any route pattern.
     const isAssetRequest = publicFileExists(`/${normalizedPath}`, publicDir)
     const dynamicFiles = files
       .filter((f) => {
       const nf = f.replace(/^\.\//, '').replace(/\\/g, '/')
       if (!nf.includes('['))
         return false
-      if (isAssetRequest && /\[\.\.\./.test(nf))
+      if (isAssetRequest)
         return false
       return true
     })

packages/bun-plugin/test/routes-catch-all.test.ts

@@ -110,13 +110,13 @@ describe('isStaticAssetPath — catch-all never shadows a static asset (#1841)',
       expect(isStaticAssetPath(p)).toBe(false)
   })
 
-  // Mirrors getRoute: catch-all candidates are dropped when publicDir really
+  // Mirrors getRoute: every dynamic candidate is dropped when publicDir really
   // holds the file, so the resolver returns null and publicDir serves it.
   // `exists` stands in for the disk.
   const resolveAsset = (target: string, files: string[], exists: string[] = []): string | null => {
     const asset = exists.includes(target)
     const candidates = files
-      .filter(f => f.includes('[') && !(asset && /\[\.\.\./.test(f)))
+      .filter(f => f.includes('[') && !asset)
       .sort((a, b) => routeSpecificity(b) - routeSpecificity(a))
     for (const file of candidates) {
       for (const regex of buildDynamicRouteRegexes(file.replace(/\.(stx|md|html)$/, ''))) {
@@ -138,18 +138,34 @@ describe('isStaticAssetPath — catch-all never shadows a static asset (#1841)',
     expect(resolveAsset('some/missing/page', files)).toBe('[...all].stx')
   })
 
-  it('a specific route may still match an extensioned path', () => {
+  it('a specific route may still match an extensioned path publicDir lacks', () => {
     const files = ['[...all].stx', 'download/[file].stx']
     expect(resolveAsset('download/report.pdf', files)).toBe('download/[file].stx')
   })
 
   /*
-   * The regression the disk check exists for. An app whose catch-all serves
-   * paths that carry extensions - a code browser rendering
-   * `/owner/repo/tree/main/src/index.ts` - had every such page refused,
-   * because the extension test called it an asset and dropped the only route
-   * that could answer. Nothing is at that path in publicDir, so nothing
-   * should be dropped.
+   * A forge's routes start at the root: `[owner]` claims every one-segment
+   * path and `[owner]/[repository]` every two-segment one. Restricting the
+   * drop to catch-alls assumed a shallow tree, so `/favicon.ico` and
+   * `/js/mermaid.js` rendered pages and the whole publicDir was unreachable.
+   */
+  it('a plain dynamic route does not shadow a real public file either', () => {
+    const files = ['[owner]/[repository].stx', '[owner].stx']
+    expect(resolveAsset('js/mermaid.js', files, ['js/mermaid.js'])).toBeNull()
+    expect(resolveAsset('favicon.ico', files, ['favicon.ico'])).toBeNull()
+  })
+
+  it('but a dynamic route still answers when publicDir has nothing there', () => {
+    const files = ['[owner]/[repository].stx', '[owner].stx']
+    expect(resolveAsset('stacks/stacks', files)).toBe('[owner]/[repository].stx')
+  })
+
+  /*
+   * The other half of the disk check. An app whose catch-all serves paths that
+   * carry extensions - a code browser rendering
+   * `/owner/repo/tree/main/src/index.ts` - had every such page refused, because
+   * the extension test called it an asset. Nothing is at that path in
+   * publicDir, so nothing should be dropped.
    */
   it('an extensioned path publicDir does not have still resolves to the catch-all', () => {
     const files = ['[...all].stx', 'foo/[id].stx']