@lukoweb/apitogo 0.2.65 → 0.2.66

package/dist/cli/cli.js

@@ -11433,7 +11433,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.2.65",
+  version: "0.2.66",
   type: "module",
   sideEffects: [
     "**/*.css",

package/dist/cli/worker.js

@@ -115,6 +115,11 @@ var ProtectedRoutesSchema = z.pipe(
 
 // src/vite/prerender/utils.ts
 var prerenderFileFor = (urlPath) => urlPath === "/" ? "/index.html" : urlPath.endsWith("/index") ? `${urlPath}/index.html` : `${urlPath}.html`;
+var SCRIPT_SAFE_LT = `${"\\"}u003c`;
+var redirectPageHtml = (to) => (
+  // Every `<` of the target becomes SCRIPT_SAFE_LT, so a target can never close the script early.
+  `<!doctype html><link rel="icon" href="data:,"><script>window.location.href=${JSON.stringify(to).replaceAll("<", SCRIPT_SAFE_LT)};</script>`
+);
 
 // src/vite/prerender/worker.ts
 var { template, distDir, serverConfigPath, entryServerPath, writeRedirects } = Piscina.workerData;
@@ -149,7 +154,7 @@ var renderPage = async ({ urlPath }) => {
   if ([301, 302, 303, 307, 308].includes(response.status)) {
     const redirectTo = response.headers.get("Location") ?? "";
     if (writeRedirects) {
-      const redirectHtml = `<!doctype html><script>window.location.href=${JSON.stringify(redirectTo)};</script>`;
+      const redirectHtml = redirectPageHtml(redirectTo);
       await fs.mkdir(path.dirname(outputPath), { recursive: true });
       await fs.writeFile(outputPath, redirectHtml);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lukoweb/apitogo",
-  "version": "0.2.65",
+  "version": "0.2.66",
   "type": "module",
   "sideEffects": [
     "**/*.css",

package/src/vite/prerender/utils.ts

@@ -87,3 +87,15 @@ export const routesToPaths = (routes: RouteObject[]): string[] =>
 
 export const routesToRewrites = (routes: RouteObject[]): RouteRewrite[] =>
   collectRewrites(resolveRoutes(routes));
+
+/** `<` as a JavaScript string escape: a backslash, then u003c. */
+const SCRIPT_SAFE_LT = `${"\\"}u003c`;
+
+/**
+ * The page written for a route that redirects, such as `/` of a portal without a home page of its own. It declares an
+ * empty icon: without one the browser asks for /favicon.ico before the script runs, a 404 and a console error on every
+ * visit of the home page (API-134).
+ */
+export const redirectPageHtml = (to: string): string =>
+  // Every `<` of the target becomes SCRIPT_SAFE_LT, so a target can never close the script early.
+  `<!doctype html><link rel="icon" href="data:,"><script>window.location.href=${JSON.stringify(to).replaceAll("<", SCRIPT_SAFE_LT)};</script>`;

package/src/vite/prerender/worker.ts

@@ -7,7 +7,7 @@ import type { ZudokuConfig } from "../../config/validators/ZudokuConfig.js";
 import { runPluginTransformConfig } from "../../lib/core/transform-config.js";
 import { joinUrl } from "../../lib/util/joinUrl.js";
 import type { WorkerResult } from "./prerender.js";
-import { prerenderFileFor } from "./utils.js";
+import { prerenderFileFor, redirectPageHtml } from "./utils.js";
 
 type EntryServer = typeof import("../../app/entry.server.js");
 
@@ -75,7 +75,7 @@ const renderPage = async ({ urlPath }: WorkerData): Promise<WorkerResult> => {
     const redirectTo = response.headers.get("Location") ?? "";
 
     if (writeRedirects) {
-      const redirectHtml = `<!doctype html><script>window.location.href=${JSON.stringify(redirectTo)};</script>`;
+      const redirectHtml = redirectPageHtml(redirectTo);
       await fs.mkdir(path.dirname(outputPath), { recursive: true });
       await fs.writeFile(outputPath, redirectHtml);
     }