Jakob Wennberg
ec27228a8e
Em dashes (—) and en dashes (–) had spread across comments, docs, tests, and a few UI strings, reading as AI-generated boilerplate rather than house style. Replaced each with punctuation matching its context: colon for explanatory clauses, comma for asides, plain hyphen for numeric/legal ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for paired-dash asides. messages/en.json and messages/sv.json were fixed by hand together to keep sv/en in sync. Left untouched where the dash is the functional subject rather than decorative punctuation: date-range-parser.ts's separator regex, charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the agent system-prompt files that already instruct against em dashes, and a golden iXBRL test fixture compared byte-for-byte. Also fixes two bugs surfaced along the way: an off-by-one in ApiKeysPanel's scope-label split (a leftover from an earlier partial pass), and a charset-repair test that had lost the literal en-dash it exists to verify. Regenerated the agent atom seed migration (skills:generate) since 27 SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes, with an explicit carve-out for the functional-dash cases above. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
21 lines
861 B
TypeScript
21 lines
861 B
TypeScript
/**
|
|
* Canonical base URL for v1 surfaces.
|
|
*
|
|
* Use this, NOT `new URL(request.url).host`, when assembling URLs that go
|
|
* into discovery files, OpenAPI specs, or any response a 3rd-party agent
|
|
* caches. The inbound `Host` header is attacker-controlled at the edge; a
|
|
* spoofed value would otherwise poison agent discovery and redirect them
|
|
* to attacker-controlled endpoints.
|
|
*
|
|
* Honours `NEXT_PUBLIC_APP_URL` (the same env var the rest of the codebase
|
|
* uses for absolute links). Falls back to `https://localhost:3000` for
|
|
* local development when the env var is unset: this is a deliberate
|
|
* fail-closed default that any production deploy will override.
|
|
*/
|
|
|
|
export function getCanonicalBaseUrl(): string {
|
|
const fromEnv = process.env.NEXT_PUBLIC_APP_URL?.trim()
|
|
if (fromEnv) return fromEnv.replace(/\/$/, '')
|
|
return 'http://localhost:3000'
|
|
}
|