fix(routing): add vercel spa fallback rewrite to index.html

[spandreou]

Summary

This hotfix resolves the production routing issue where direct navigation to client-side SPA routes (such as /login, /register, /stores, /app) resulted in a Vercel 404 NOT_FOUND error.

Root Cause

vercel.json defined headers for routes and assets but lacked an SPA fallback rewrite to /index.html. As a result, direct non-root HTTP requests reached Vercel's static file server rather than falling back to /index.html to allow React client-side routing.

Solution

Added a targeted SPA fallback rewrite in vercel.json:

"rewrites": [
  {
    "source": "/((?!assets/|api/|.*\\.[\\w]+$).*)",
    "destination": "/index.html"
  }
]

• Excludes /assets/*, /api/*, and files with extensions so real assets/APIs are never overwritten with HTML.
• Preserves all existing security headers (Content-Security-Policy, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy).
• Adds scripts/validate-vercel-spa-routing.mjs registered as npm run qa:vercel-spa-routing.
• Zero new dependencies; lockfile unchanged.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
shiftoryx	Ready	Preview	Sep 5, 2026 8:11am UTC

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.