Route public AI discovery through App Health

package.json

@@ -133,7 +133,11 @@
       "sharp@<0.35.4": "0.35.4",
       "js-yaml@>=4.0.0 <4.3.2": "4.3.2",
       "svgo@>=4.0.0 <4.1.0": "4.1.0",
-      "smol-toml@<=1.7.0": "1.7.1"
+      "smol-toml@<=1.7.0": "1.7.1",
+      "brace-expansion@>=1.0.0 <1.1.21": "1.1.21",
+      "brace-expansion@>=2.0.0 <2.1.7": "2.1.7",
+      "brace-expansion@>=5.0.0 <5.0.12": "5.0.12",
+      "undici@>=7.0.0 <7.29.1": "7.29.1"
     }
   }
 }

src/worker.test.ts

@@ -1,10 +1,21 @@
 import { beforeEach, expect, it, vi } from 'vitest';
 import type { WorkerEnv } from './lib/worker-env';
 
-const mocks = vi.hoisted(() => ({ auth: vi.fn(), user: vi.fn(), assets: vi.fn() }));
+const mocks = vi.hoisted(() => ({
+  auth: vi.fn(),
+  user: vi.fn(),
+  assets: vi.fn(),
+  appHealth: vi.fn(),
+}));
 vi.mock('./lib/auth', () => ({ createAuth: () => ({ handler: mocks.auth }) }));
 vi.mock('./lib/auth-api', () => ({ getAuthenticatedUserId: mocks.user }));
 vi.mock('./worker/bind-env', () => ({ bindWorkerEnv: vi.fn() }));
+vi.mock('./worker/app-health', () => ({
+  appHealthMiddleware: async (_context: unknown, next: () => Promise<void>) => {
+    mocks.appHealth();
+    await next();
+  },
+}));
 
 import worker from './worker';
 
@@ -48,4 +59,5 @@ it('preserves discovery GET and HEAD without invoking account services', async (
   expect(await head.text()).toBe('');
   expect(mocks.auth).not.toHaveBeenCalled();
   expect(mocks.user).not.toHaveBeenCalled();
+  expect(mocks.appHealth).toHaveBeenCalledTimes(3);
 });

src/worker.ts

@@ -43,6 +43,15 @@ api.use('*', async (c, next) => {
 
 api.use('*', appHealthMiddleware);
 
+api.on(['GET', 'HEAD'], '*', async (c, next) => {
+  const path = c.req.path.replace(/\/{2,}/g, '/').replace(/\/+$/, '');
+  if (path === '/api/ai') {
+    const response = await handleAgentEdge(c.req.raw, c.env);
+    if (response) return response;
+  }
+  await next();
+});
+
 api.use('/api/*', async (c, next) => {
   await next();
   const response = c.res;
@@ -120,9 +129,9 @@ export default {
   async fetch(request: Request, env: WorkerEnv, ctx: ExecutionContext): Promise<Response> {
     const url = new URL(request.url);
 
-    // Discovery owns /api/ai, but its catch-all must not swallow product APIs.
-    const normalizedPath = url.pathname.replace(/\/{2,}/g, '/').replace(/\/+$/, '');
-    if (!url.pathname.startsWith('/api/') || normalizedPath === '/api/ai') {
+    // Discovery outside /api/* remains separate from product API routes.
+    // /api/ai passes through Hono so App Health sees its public GET/HEAD traffic.
+    if (!url.pathname.startsWith('/api/')) {
       const agent = await handleAgentEdge(request, env);
       if (agent) return agent;
     }