zudoku 0.92.0 → 0.93.0

package/dist/cli/cli.js

@@ -9107,6 +9107,98 @@ import { cp, mkdir as mkdir3, readdir, rm, writeFile as writeFile4 } from "node:
 import path20 from "node:path";
 init_joinUrl();
 
+// src/lib/util/redirectPattern.ts
+init_joinUrl();
+var SPLAT = "*";
+var ABSOLUTE_URL_REGEX = /^(?:[a-z][a-z0-9+.-]*:|[\\/]{2})/i;
+var TOKEN_REGEX = /\/(?::([\w-]+)|\*)(?=[/?#]|$)/g;
+var parseSegments = (path32) => {
+  const parts = path32.split("/").filter(Boolean);
+  return parts.map((part, index) => {
+    if (part === SPLAT && index === parts.length - 1) return { type: "splat" };
+    const match = part.match(/^:([\w-]+)(\?)?$/);
+    if (!match?.[1]) return { type: "static", value: part };
+    return { type: "param", name: match[1], optional: match[2] === "?" };
+  });
+};
+var getParamNames = (from) => parseSegments(from).flatMap((segment) => {
+  if (segment.type === "param") return [segment.name];
+  if (segment.type === "splat") return [SPLAT];
+  return [];
+});
+var isDynamicRedirect = (redirect) => getParamNames(redirect.from).length > 0;
+var replaceTokens = (to, names, replace) => {
+  const target = to.replace(TOKEN_REGEX, (token, name) => {
+    const key = name ?? SPLAT;
+    return names.includes(key) ? replace(key) : token;
+  });
+  const lostPath = target === "" || /^[?#]/.test(target);
+  return target !== to && lostPath ? `/${target}` : target;
+};
+var rankPath = (path32) => {
+  const segments = joinUrl(path32).split("/");
+  return segments.reduce(
+    (score, segment) => {
+      if (segment === SPLAT) return score;
+      if (segment.startsWith(":")) return score + 3;
+      return score + (segment === "" ? 1 : 10);
+    },
+    segments.length - (segments.includes(SPLAT) ? 2 : 0)
+  );
+};
+var segmentToPath = (segment) => {
+  if (segment.type === "static") return segment.value;
+  if (segment.type === "splat") return SPLAT;
+  return `:${segment.name}`;
+};
+var explodeOptional = (segments) => {
+  const [first, ...rest] = segments;
+  if (!first) return [[]];
+  const variants = explodeOptional(rest);
+  const withFirst = variants.map((variant) => [first, ...variant]);
+  return first.type === "param" && first.optional ? [...withFirst, ...variants] : withFirst;
+};
+var escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var toBuildOutputRedirects = (redirects, basePath) => {
+  const base = joinUrl(basePath);
+  const prefix = base === "/" ? "" : escapeRegex(base);
+  return redirects.flatMap((redirect) => {
+    const names = getParamNames(redirect.from);
+    const to = ABSOLUTE_URL_REGEX.test(redirect.to) ? redirect.to : joinUrl(basePath, redirect.to);
+    const toRoute = (segments) => {
+      const captured = segments.flatMap((segment) => {
+        if (segment.type === "param") return [segment.name];
+        if (segment.type === "splat") return [SPLAT];
+        return [];
+      });
+      const pattern = segments.map((segment) => {
+        if (segment.type === "static") {
+          return `/${escapeRegex(segment.value)}`;
+        }
+        return segment.type === "splat" ? "(/.+)" : "(/[^/]+)";
+      }).join("");
+      const endsWithSplat = segments.at(-1)?.type === "splat";
+      return {
+        // React Router accepts any number of trailing slashes
+        src: `^${prefix}${pattern}${endsWithSplat ? "" : "/*"}$`,
+        // Like React Router, a repeated param name takes the last value
+        location: replaceTokens(
+          to,
+          names,
+          (name) => captured.includes(name) ? `$${captured.lastIndexOf(name) + 1}` : ""
+        )
+      };
+    };
+    return explodeOptional(parseSegments(redirect.from)).flatMap(
+      (segments) => {
+        const rank = rankPath(`/${segments.map(segmentToPath).join("/")}`);
+        const variants = segments.at(-1)?.type === "splat" ? [segments, segments.slice(0, -1)] : [segments];
+        return variants.map((variant) => ({ rank, ...toRoute(variant) }));
+      }
+    );
+  }).toSorted((a, b) => b.rank - a.rank).map(({ src, location }) => ({ src, location }));
+};
+
 // src/vite/vercel-markdown-middleware.ts
 var normalizePath2 = (value) => {
   const pathname = value.split("/").filter(Boolean).map((segment) => {
@@ -9575,8 +9667,20 @@ function generateOutput({
       continue: true
     });
   }
-  if (rewrites.length > 0) {
+  const dynamicRedirects = toBuildOutputRedirects(
+    (config.redirects ?? []).filter(isDynamicRedirect),
+    config.basePath
+  );
+  if (rewrites.length > 0 || dynamicRedirects.length > 0) {
     routes.push({ handle: "filesystem" });
+    for (const { src, location } of dynamicRedirects) {
+      routes.push({
+        src,
+        dest: location,
+        status: 301,
+        headers: { Location: location }
+      });
+    }
     for (const rewrite of rewrites) {
       routes.push({
         src: joinUrl(config.basePath, rewrite.source),
@@ -9778,10 +9882,16 @@ var collectRewrites = (resolved) => resolved.flatMap((r) => [
   ...collectRewrites(r.children)
 ]);
 var routesToPaths = (routes) => collectPaths(resolveRoutes(routes), "");
+var withoutDynamicRedirectRoutes = (routes, redirects = []) => {
+  const paths = new Set(
+    redirects.filter(isDynamicRedirect).map(({ from }) => joinUrl(from))
+  );
+  return routes.filter((route) => !route.path || !paths.has(route.path));
+};
 var routesToPrerenderPaths = (routes, redirects = []) => Array.from(
   /* @__PURE__ */ new Set([
     ...routesToPaths(routes),
-    ...redirects.map(({ from }) => joinUrl(from))
+    ...redirects.filter((redirect) => !isDynamicRedirect(redirect)).map(({ from }) => joinUrl(from))
   ])
 );
 var routesToRewrites = (routes) => collectRewrites(resolveRoutes(routes));
@@ -9826,7 +9936,10 @@ var prerender = async ({
   const buildConfig = await getBuildConfig();
   const module = await import(entryServerPath);
   const getRoutes = module.getRoutesByConfig;
-  const routes = getRoutes(config);
+  const routes = withoutDynamicRedirectRoutes(
+    getRoutes(config),
+    config.redirects
+  );
   const paths = routesToPrerenderPaths(routes, config.redirects);
   const rewrites = routesToRewrites(routes);
   const { maxThreads, maxOldGenerationSizeMb } = getWorkerScaling(

package/dist/declarations/lib/plugins/api-keys/fetchSigned.d.ts

@@ -0,0 +1,2 @@
+import type { ZudokuContext } from "../../core/ZudokuContext.js";
+export declare const fetchSigned: (context: ZudokuContext, request: Request) => Promise<Response>;

package/dist/declarations/lib/util/redirectPattern.d.ts

@@ -0,0 +1,11 @@
+type Redirect = {
+    from: string;
+    to: string;
+};
+export declare const isDynamicRedirect: (redirect: Pick<Redirect, "from">) => boolean;
+export declare const resolveRedirectTarget: ({ from, to }: Redirect, params: Record<string, string | undefined>) => string;
+export declare const toBuildOutputRedirects: (redirects: readonly Redirect[], basePath?: string) => {
+    src: string;
+    location: string;
+}[];
+export {};

package/docs/configuration/authentication-auth0.md

@@ -50,21 +50,7 @@ If you don't have an Auth0 account, you can sign up for a
 
    Keep the default **Refresh Token Expiration** settings unless you have specific requirements.
 
-3. Create an Auth0 API:
-   - Navigate to the [APIs section](https://manage.auth0.com/#/apis) in the Auth0 dashboard
-   - Click **Create API**
-   - Set a name (e.g., "Zudoku API") and an identifier (e.g., `https://your-domain.com/api`)
-   - Choose **RS256** as the signing algorithm
-   - Save the API
-
-   :::warning
-
-   This step is important. If you skip creating an API, Zudoku will not be able to validate the
-   tokens issued by Auth0, leading to authentication failures.
-
-   :::
-
-4. **Configure Zudoku**
+3. **Configure Zudoku**
 
    Add the Auth0 configuration to your [Zudoku configuration file](./overview.md):
 
@@ -76,7 +62,6 @@ If you don't have an Auth0 account, you can sign up for a
        type: "auth0",
        domain: "your-domain.us.auth0.com",
        clientId: "<your-auth0-client-id>",
-       audience: "https://your-domain.com/api", // Your Auth0 API identifier
      },
      // ... other configuration
    };
@@ -85,7 +70,36 @@ If you don't have an Auth0 account, you can sign up for a
    Where:
    - **domain**: Your Auth0 domain (found in your application's Basic Information)
    - **clientId**: The Client ID from your Auth0 application settings
-   - **audience**: The identifier of the Auth0 API you created (e.g., `https://your-domain.com/api`)
+
+4. **(Optional) Configure an audience for API access**
+
+   Only configure an `audience` if you need the access token to call a specific API (for example,
+   when using the API playground to send authenticated requests to your backend). Without an
+   audience, Auth0 issues an opaque token that can be used to identify the user via `/userinfo` —
+   which is all Zudoku needs for sign-in and protected routes.
+
+   :::tip
+
+   Avoid setting an audience when you don't need it. Issuing an access token scoped to an API when
+   it isn't going to call that API gives the token broader privileges than necessary.
+
+   :::
+
+   If you do need API access:
+   - Navigate to the [APIs section](https://manage.auth0.com/#/apis) in the Auth0 dashboard
+   - Click **Create API**, set a name (e.g., "Zudoku API") and an identifier (e.g.,
+     `https://your-domain.com/api`)
+   - Choose **RS256** as the signing algorithm and save the API
+   - Add the identifier to your Zudoku configuration:
+
+   ```typescript
+   authentication: {
+     type: "auth0",
+     domain: "your-domain.us.auth0.com",
+     clientId: "<your-auth0-client-id>",
+     audience: "https://your-domain.com/api", // Your Auth0 API identifier
+   }
+   ```
 
 </Stepper>
 
@@ -188,8 +202,9 @@ authentication: {
 3. **Authentication Loop**: Check that your Auth0 domain is a plain hostname only (e.g.,
    `your-domain.us.auth0.com`) without a protocol prefix (`https://`) or trailing slash.
 
-4. **Token Validation Errors**: Ensure the audience in your Zudoku configuration matches the
-   identifier of the Auth0 API you created.
+4. **Token Validation Errors**: If you've configured an `audience`, make sure it matches the
+   identifier of the Auth0 API you created. If you don't need to call an API, remove `audience` from
+   your configuration — Auth0 will issue an opaque token suitable for `/userinfo`.
 
 ## Next Steps
 

package/docs/configuration/overview.md

@@ -284,12 +284,16 @@ URL.
   // ...
   "redirects": [
     { "from": "/", "to": "/documentation/introduction" },
-    { "from": "/documentation", "to": "/documentation/introduction" }
+    { "from": "/documentation", "to": "/documentation/introduction" },
+    { "from": "/blog/:slug", "to": "/posts/:slug" }
   ]
   // ...
 }
 ```
 
+`from` paths can contain `:param` segments and a trailing `*` wildcard. See
+[Redirects](/docs/guides/redirects#path-parameters-and-wildcards) for details.
+
 ### `port`
 
 The port on which the development server will run. Defaults to `3000`. This option can also be

package/docs/guides/managing-api-keys-and-identities.md

@@ -35,6 +35,14 @@ this is already enabled.)
 
 This will make the API Key UI available at `/settings/api-keys` in your Zudoku.
 
+:::note
+
+Zuplo's API key service identifies users by their JWT access token. If you use
+[Auth0](../configuration/authentication-auth0.md), configure an `audience` in your authentication
+settings. Without one, Auth0 issues an opaque access token that can't be used to manage API keys.
+
+:::
+
 ### Creating API Keys
 
 By default, there is no **Create API Key** Button. To get the button working you have to implement

package/docs/guides/redirects.md

@@ -52,6 +52,43 @@ redirects: [{ from: "/old-page", to: "/new-page" }];
 Trailing slashes in the `from` path are normalized automatically. Both `/old-page` and `/old-page/`
 will match the same redirect rule.
 
+## Path parameters and wildcards
+
+A `from` path can match more than one URL. Use `:name` for a single path segment and a trailing `*`
+for everything after a prefix. Reference the same tokens in `to` to carry the matched values over:
+
+```ts
+redirects: [
+  // /blog/hello-world → /posts/hello-world
+  { from: "/blog/:slug", to: "/posts/:slug" },
+  // /v1/guides/auth/tokens → /guides/auth/tokens
+  { from: "/v1/*", to: "/*" },
+  // /dashboard/apps/42 → https://dashboard.example.com/apps/42
+  { from: "/dashboard/*", to: "https://dashboard.example.com/*" },
+];
+```
+
+- **`:name`** matches exactly one segment. Add `?` (`:name?`) to make it optional.
+- **`*`** must be the last segment of `from`. It also matches the prefix itself, so `/dashboard/*`
+  redirects `/dashboard` too. In that case the `/*` in `to` is dropped, leaving `/` if nothing else
+  remains.
+- In `to`, `/:name` and `/*` must each fill a whole path segment, so `/posts/:slug` works and
+  `/posts-:slug` doesn't. Tokens that don't appear in `from` are left as they are.
+- Zudoku doesn't copy the incoming query string to the target.
+
+Pages in your portal take precedence over a wildcard redirect, so `{ from: "/docs/*", to: "/" }`
+still lets visitors reach `/docs/introduction` if that page exists.
+
+Static hosts can't prerender a file for every URL a pattern matches, so pattern redirects behave
+differently from exact ones:
+
+- **Zuplo** and **Vercel**: Zudoku turns the pattern into a regular-expression route in the build
+  output, and the platform returns an HTTP **301**.
+- **SSR deployments**: the server returns an HTTP 301, the same as exact redirects.
+- **Other static hosts**: no redirect file is written. If your host serves `404.html` (or your app's
+  `index.html`) for unknown paths, the page loads, Zudoku matches the pattern, and the browser is
+  redirected. Otherwise, set up the redirect in your host's own configuration.
+
 ## How redirects work
 
 Zudoku redirects operate at two levels depending on how the visitor reaches the page:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zudoku",
-  "version": "0.92.0",
+  "version": "0.93.0",
   "type": "module",
   "engines": {
     "node": ">=22.22.0"

package/src/app/utils/createRedirectRoutes.ts

@@ -1,11 +1,12 @@
 import { redirect, type RouteObject } from "react-router";
 import type { ZudokuRedirect } from "../../config/validators/ZudokuConfig.js";
 import { joinUrl } from "../../lib/util/joinUrl.js";
+import { resolveRedirectTarget } from "../../lib/util/redirectPattern.js";
 
 export const createRedirectRoutes = (
   redirects?: ZudokuRedirect[],
 ): RouteObject[] =>
   (redirects ?? []).map((r) => ({
     path: joinUrl(r.from),
-    loader: () => redirect(r.to, 301),
+    loader: ({ params }) => redirect(resolveRedirectTarget(r, params), 301),
   }));

package/src/lib/authentication/providers/openid.tsx

@@ -17,7 +17,7 @@ import { LogoutCallbackHandler } from "../components/LogoutCallbackHandler.js";
 import { OAuthErrorPage } from "../components/OAuthErrorPage.js";
 import { fetchServerSession } from "../cookie-sync.js";
 import { DEFAULT_SESSION_MAX_AGE, SESSION_ENDPOINT_PATH } from "../cookies.js";
-import { AuthorizationError, OAuthAuthorizationError } from "../errors.js";
+import { AuthorizationError } from "../errors.js";
 import { type UserProfile, useAuthState } from "../state.js";
 import { redirectToSignUpUrl } from "./util.js";
 
@@ -178,19 +178,6 @@ export class OpenIDAuthenticationProvider
       throw new AuthorizationError("No expires_in in response");
     }
 
-    const accessToken = response.access_token;
-    if (accessToken.split(".").length !== 3) {
-      throw new OAuthAuthorizationError(
-        "The access token received is not a valid JWT.",
-        {
-          error: "configuration_error",
-          error_description:
-            "The authentication provider is issuing opaque tokens instead of JWTs. " +
-            "Ensure you have configured the correct `audience` in your authentication settings.",
-        },
-      );
-    }
-
     const claims = response.id_token
       ? oauth.getValidatedIdTokenClaims(response)
       : undefined;

package/src/lib/plugins/api-keys/fetchSigned.ts

@@ -0,0 +1,35 @@
+import type { ZudokuContext } from "../../core/ZudokuContext.js";
+import { ZudokuError } from "../../util/invariant.js";
+
+const isJwt = (token: string) => token.split(".").length === 3;
+
+const isAuthFailure = (response: Response) =>
+  response.status === 401 || response.status === 403;
+
+/**
+ * Signs and sends a request to Zuplo's API key service. The service identifies
+ * the user from a JWT access token, so an opaque token (e.g. Auth0 without an
+ * `audience`) rejected with 401/403 is reported as a configuration error
+ * instead of a generic request failure.
+ */
+export const fetchSigned = async (context: ZudokuContext, request: Request) => {
+  const signedRequest = await context.signRequest(request);
+  const response = await fetch(signedRequest);
+
+  const accessToken = signedRequest.headers
+    .get("Authorization")
+    ?.replace(/^Bearer /i, "");
+
+  if (isAuthFailure(response) && accessToken && !isJwt(accessToken)) {
+    throw new ZudokuError(
+      "The access token issued by the authentication provider can't be used to manage API keys.",
+      {
+        title: "Configuration Error",
+        developerHint:
+          "Zuplo API key management requires a JWT access token, but the authentication provider issued an opaque token. If you use Auth0, set `audience` in your authentication configuration to the identifier of your Auth0 API.",
+      },
+    );
+  }
+
+  return response;
+};

package/src/lib/plugins/api-keys/index.tsx

@@ -11,6 +11,7 @@ import type { ZudokuContext } from "../../core/ZudokuContext.js";
 import invariant from "../../util/invariant.js";
 import { joinUrl } from "../../util/joinUrl.js";
 import { throwIfProblemJson } from "../../util/problemJson.js";
+import { fetchSigned } from "./fetchSigned.js";
 import { SettingsApiKeys } from "./SettingsApiKeys.js";
 
 const DEFAULT_GATEWAY_URL = "https://api.zuploedge.com";
@@ -93,7 +94,7 @@ const createZuploService = ({
           method: "DELETE",
         },
       );
-      const response = await fetch(await context.signRequest(request));
+      const response = await fetchSigned(context, request);
       await throwIfProblemJson(response);
       invariant(response.ok, "Failed to delete API key");
     },
@@ -103,23 +104,22 @@ const createZuploService = ({
         "Cannot update API key description.",
         developerHintOptions,
       );
-      const response = await fetch(
-        await context.signRequest(
-          new Request(
-            joinUrl(
-              getApiKeyEndpoint(context),
-              `${deploymentName}/consumers/${consumer.id}`,
-            ),
-            {
-              method: "PATCH",
-              headers: {
-                "Content-Type": "application/json",
-              },
-              body: JSON.stringify({
-                label: consumer.label,
-              }),
-            },
+      const response = await fetchSigned(
+        context,
+        new Request(
+          joinUrl(
+            getApiKeyEndpoint(context),
+            `${deploymentName}/consumers/${consumer.id}`,
           ),
+          {
+            method: "PATCH",
+            headers: {
+              "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+              label: consumer.label,
+            }),
+          },
         ),
       );
       await throwIfProblemJson(response);
@@ -127,21 +127,20 @@ const createZuploService = ({
     },
     rollKey: async (consumerId, context) => {
       invariant(deploymentName, "Cannot roll API key.", developerHintOptions);
-      const response = await fetch(
-        await context.signRequest(
-          new Request(
-            joinUrl(
-              getApiKeyEndpoint(context),
-              `${deploymentName}/consumers/${consumerId}/roll-key`,
-            ),
-            {
-              method: "POST",
-              headers: {
-                "Content-Type": "application/json",
-              },
-              body: JSON.stringify({}),
-            },
+      const response = await fetchSigned(
+        context,
+        new Request(
+          joinUrl(
+            getApiKeyEndpoint(context),
+            `${deploymentName}/consumers/${consumerId}/roll-key`,
           ),
+          {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+            },
+            body: JSON.stringify({}),
+          },
         ),
       );
       await throwIfProblemJson(response);
@@ -152,9 +151,7 @@ const createZuploService = ({
       const request = new Request(
         joinUrl(getApiKeyEndpoint(context), `${deploymentName}/consumers`),
       );
-      await context.signRequest(request);
-
-      const keys = await fetch(request);
+      const keys = await fetchSigned(context, request);
       await throwIfProblemJson(keys);
       invariant(keys.ok, "Failed to fetch API keys");
 

package/src/lib/util/redirectPattern.ts

@@ -0,0 +1,172 @@
+import { joinUrl } from "./joinUrl.js";
+
+type Redirect = { from: string; to: string };
+
+type Segment =
+  | { type: "static"; value: string }
+  | { type: "param"; name: string; optional: boolean }
+  | { type: "splat" };
+
+const SPLAT = "*";
+// React Router's own check for URLs that leave the app
+const ABSOLUTE_URL_REGEX = /^(?:[a-z][a-z0-9+.-]*:|[\\/]{2})/i;
+// A `/:param` or `/*` token that spans a whole path segment
+const TOKEN_REGEX = /\/(?::([\w-]+)|\*)(?=[/?#]|$)/g;
+
+// Parses a `from` path using React Router's syntax: `:param`, `:param?` and a
+// trailing `*` splat.
+const parseSegments = (path: string): Segment[] => {
+  const parts = path.split("/").filter(Boolean);
+  return parts.map((part, index): Segment => {
+    if (part === SPLAT && index === parts.length - 1) return { type: "splat" };
+    const match = part.match(/^:([\w-]+)(\?)?$/);
+    if (!match?.[1]) return { type: "static", value: part };
+    return { type: "param", name: match[1], optional: match[2] === "?" };
+  });
+};
+
+const getParamNames = (from: string) =>
+  parseSegments(from).flatMap((segment) => {
+    if (segment.type === "param") return [segment.name];
+    if (segment.type === "splat") return [SPLAT];
+    return [];
+  });
+
+export const isDynamicRedirect = (redirect: Pick<Redirect, "from">) =>
+  getParamNames(redirect.from).length > 0;
+
+// Replaces the `/:param` and `/*` tokens in `to` that `from` defines. Tokens
+// unknown to `from` are left untouched. Removing empty params can leave no path
+// at all (`/*` for `/v1/*` at `/v1`), which would redirect back to the same
+// URL, so that falls back to the root. A `to` without replaced tokens is kept
+// as written, so relative targets like `?tab=2` still work.
+const replaceTokens = (
+  to: string,
+  names: string[],
+  replace: (name: string) => string,
+) => {
+  const target = to.replace(TOKEN_REGEX, (token, name: string | undefined) => {
+    const key = name ?? SPLAT;
+    return names.includes(key) ? replace(key) : token;
+  });
+  const lostPath = target === "" || /^[?#]/.test(target);
+  return target !== to && lostPath ? `/${target}` : target;
+};
+
+const encodeParam = (name: string, value: string) =>
+  name === SPLAT
+    ? value.split("/").map(encodeURIComponent).join("/")
+    : encodeURIComponent(value);
+
+/**
+ * Builds the redirect target for a matched `from` path by substituting the
+ * matched params into `to`, e.g. `{ from: "/blog/:slug", to: "/posts/:slug" }`
+ * sends `/blog/hello` to `/posts/hello`. Empty params drop their segment.
+ */
+export const resolveRedirectTarget = (
+  { from, to }: Redirect,
+  params: Record<string, string | undefined>,
+) =>
+  replaceTokens(to, getParamNames(from), (name) => {
+    const value = params[name];
+    return value ? `/${encodeParam(name, value)}` : "";
+  });
+
+// Mirrors React Router's `computeScore` for a concrete (non-optional) path.
+const rankPath = (path: string) => {
+  const segments = joinUrl(path).split("/");
+  return segments.reduce(
+    (score, segment) => {
+      if (segment === SPLAT) return score;
+      if (segment.startsWith(":")) return score + 3;
+      return score + (segment === "" ? 1 : 10);
+    },
+    segments.length - (segments.includes(SPLAT) ? 2 : 0),
+  );
+};
+
+const segmentToPath = (segment: Segment) => {
+  if (segment.type === "static") return segment.value;
+  if (segment.type === "splat") return SPLAT;
+  return `:${segment.name}`;
+};
+
+// React Router ranks each concrete variant of a path with optional segments,
+// in this order: `/:a?/:b?` becomes `/:a/:b`, `/:a`, `/:b` and `/`.
+const explodeOptional = (segments: Segment[]): Segment[][] => {
+  const [first, ...rest] = segments;
+  if (!first) return [[]];
+  const variants = explodeOptional(rest);
+  const withFirst = variants.map((variant) => [first, ...variant]);
+  return first.type === "param" && first.optional
+    ? [...withFirst, ...variants]
+    : withFirst;
+};
+
+const escapeRegex = (value: string) =>
+  value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+/**
+ * Converts dynamic redirects into Build Output API routes. Each concrete
+ * variant of a `from` path becomes a regex with one capture group per param
+ * (including its leading slash), and the tokens in `to` become the matching
+ * `$n` references. Build Output routes match top to bottom, so they are sorted
+ * the way React Router ranks the same paths, keeping configuration order for
+ * ties.
+ */
+export const toBuildOutputRedirects = (
+  redirects: readonly Redirect[],
+  basePath?: string,
+) => {
+  const base = joinUrl(basePath);
+  const prefix = base === "/" ? "" : escapeRegex(base);
+
+  return redirects
+    .flatMap((redirect) => {
+      const names = getParamNames(redirect.from);
+      const to = ABSOLUTE_URL_REGEX.test(redirect.to)
+        ? redirect.to
+        : joinUrl(basePath, redirect.to);
+
+      const toRoute = (segments: Segment[]) => {
+        const captured = segments.flatMap((segment) => {
+          if (segment.type === "param") return [segment.name];
+          if (segment.type === "splat") return [SPLAT];
+          return [];
+        });
+        const pattern = segments
+          .map((segment) => {
+            if (segment.type === "static") {
+              return `/${escapeRegex(segment.value)}`;
+            }
+            return segment.type === "splat" ? "(/.+)" : "(/[^/]+)";
+          })
+          .join("");
+        const endsWithSplat = segments.at(-1)?.type === "splat";
+
+        return {
+          // React Router accepts any number of trailing slashes
+          src: `^${prefix}${pattern}${endsWithSplat ? "" : "/*"}$`,
+          // Like React Router, a repeated param name takes the last value
+          location: replaceTokens(to, names, (name) =>
+            captured.includes(name) ? `$${captured.lastIndexOf(name) + 1}` : "",
+          ),
+        };
+      };
+
+      return explodeOptional(parseSegments(redirect.from)).flatMap(
+        (segments) => {
+          const rank = rankPath(`/${segments.map(segmentToPath).join("/")}`);
+          // An empty splat gets its own route so its target is resolved here
+          // rather than from an empty `$n` at request time
+          const variants =
+            segments.at(-1)?.type === "splat"
+              ? [segments, segments.slice(0, -1)]
+              : [segments];
+          return variants.map((variant) => ({ rank, ...toRoute(variant) }));
+        },
+      );
+    })
+    .toSorted((a, b) => b.rank - a.rank)
+    .map(({ src, location }) => ({ src, location }));
+};

package/src/vite/output.ts

@@ -6,6 +6,10 @@ import { getZudokuPackageJson } from "../cli/common/package-json.js";
 import type { LoadedConfig } from "../config/config.js";
 import invariant from "../lib/util/invariant.js";
 import { joinUrl } from "../lib/util/joinUrl.js";
+import {
+  isDynamicRedirect,
+  toBuildOutputRedirects,
+} from "../lib/util/redirectPattern.js";
 import type { RouteRewrite } from "./prerender/utils.js";
 import {
   generateVercelMarkdownMiddleware,
@@ -200,8 +204,23 @@ export function generateOutput({
     });
   }
 
-  if (rewrites.length > 0) {
+  // Dynamic redirects can't be prerendered, so match them with a regex. They
+  // run after the filesystem so real pages win, like React Router's ranking.
+  const dynamicRedirects = toBuildOutputRedirects(
+    (config.redirects ?? []).filter(isDynamicRedirect),
+    config.basePath,
+  );
+
+  if (rewrites.length > 0 || dynamicRedirects.length > 0) {
     routes.push({ handle: "filesystem" });
+    for (const { src, location } of dynamicRedirects) {
+      routes.push({
+        src,
+        dest: location,
+        status: 301,
+        headers: { Location: location },
+      });
+    }
     for (const rewrite of rewrites) {
       routes.push({
         src: joinUrl(config.basePath, rewrite.source),

package/src/vite/prerender/prerender.ts

@@ -23,6 +23,7 @@ import { generateSitemap } from "../sitemap.js";
 import {
   routesToPrerenderPaths,
   routesToRewrites,
+  withoutDynamicRedirectRoutes,
   selectPagesToIndex,
 } from "./utils.js";
 import type { StaticWorkerData, WorkerData } from "./worker.js";
@@ -87,7 +88,10 @@ export const prerender = async ({
   const module = await import(entryServerPath);
   const getRoutes = module.getRoutesByConfig as typeof getRoutesByConfig;
 
-  const routes = getRoutes(config);
+  const routes = withoutDynamicRedirectRoutes(
+    getRoutes(config),
+    config.redirects,
+  );
   const paths = routesToPrerenderPaths(routes, config.redirects);
   const rewrites = routesToRewrites(routes);
   const { maxThreads, maxOldGenerationSizeMb } = getWorkerScaling(

package/src/vite/prerender/utils.ts

@@ -1,5 +1,6 @@
 import type { RouteObject } from "react-router";
 import { joinUrl } from "../../lib/util/joinUrl.js";
+import { isDynamicRedirect } from "../../lib/util/redirectPattern.js";
 
 const resolveRoutePath = (path: string): string | undefined => {
   const segments = path.split("/");
@@ -72,6 +73,20 @@ const collectRewrites = (resolved: ResolvedRoute[]): RouteRewrite[] =>
 export const routesToPaths = (routes: RouteObject[]): string[] =>
   collectPaths(resolveRoutes(routes), "");
 
+// Dynamic redirects (`/:param`, `/*`) can't be prerendered to a file; they are
+// emitted as Build Output API routes instead (see `generateOutput`). Their
+// top-level route objects are dropped so optional params don't get stripped
+// into a prerendered path and rewrite.
+export const withoutDynamicRedirectRoutes = (
+  routes: RouteObject[],
+  redirects: readonly { from: string }[] = [],
+): RouteObject[] => {
+  const paths = new Set(
+    redirects.filter(isDynamicRedirect).map(({ from }) => joinUrl(from)),
+  );
+  return routes.filter((route) => !route.path || !paths.has(route.path));
+};
+
 export const routesToPrerenderPaths = (
   routes: RouteObject[],
   redirects: readonly { from: string }[] = [],
@@ -79,7 +94,9 @@ export const routesToPrerenderPaths = (
   Array.from(
     new Set([
       ...routesToPaths(routes),
-      ...redirects.map(({ from }) => joinUrl(from)),
+      ...redirects
+        .filter((redirect) => !isDynamicRedirect(redirect))
+        .map(({ from }) => joinUrl(from)),
     ]),
   );