fix(react-router-serve): serve /.well-known files

Express 5's static middleware ignores every dot-segment path by default
(send v1 dropped send v0's allowance for dot directories), so RFC 8615
well-known URIs — ACME challenges, Android's assetlinks.json, Apple's
apple-app-site-association — fell through to the request handler and
came back as app-rendered HTML instead of the static file. Mount the
.well-known directory of the client build explicitly; other dotfiles
remain hidden.

Author: kklem0

contributors.yml

@@ -251,6 +251,7 @@
 - KimHyeongRae0
 - kirillgroshkov
 - kkirsche
+- kklem0
 - kno-raziel
 - knownasilya
 - koojaa

integration/react-router-serve-test.ts

@@ -81,4 +81,46 @@ test.describe("react-router-serve", () => {
       });
     });
   }
+
+  test.describe("well-known URIs", () => {
+    for (const templateName of templateNames) {
+      test.describe(`template: ${templateName}`, () => {
+        let fixture: Fixture;
+        let appFixture: AppFixture;
+
+        test.beforeAll(async () => {
+          fixture = await createFixture({
+            templateName,
+            useReactRouterServe: true,
+            files: {
+              "public/.well-known/security.txt":
+                "Contact: mailto:security@example.com",
+              "public/.hidden.txt": "should not be served",
+            },
+          });
+          appFixture = await createAppFixture(fixture);
+        });
+
+        test.afterAll(() => {
+          appFixture.close();
+        });
+
+        test("serves files under /.well-known", async () => {
+          let response = await fetch(
+            `${appFixture.serverUrl}/.well-known/security.txt`,
+          );
+          expect(response.status).toBe(200);
+          expect(await response.text()).toContain(
+            "Contact: mailto:security@example.com",
+          );
+        });
+
+        test("keeps other dotfiles hidden", async () => {
+          let response = await fetch(`${appFixture.serverUrl}/.hidden.txt`);
+          expect(response.status).toBe(404);
+          expect(await response.text()).not.toContain("should not be served");
+        });
+      });
+    }
+  });
 });

packages/react-router-serve/.changes/patch.serve-well-known.md

@@ -0,0 +1 @@
+Serve `/.well-known/*` files from the client build directory. Express 5's static middleware ignores every dot-segment path by default, so RFC 8615 well-known URIs — ACME challenges, Android's `assetlinks.json`, Apple's `apple-app-site-association` — fell through to the request handler and came back as app-rendered HTML instead of the static file. Other dotfiles remain hidden.

packages/react-router-serve/cli.ts

@@ -206,6 +206,10 @@ async function run() {
   );
   app.use(expressPublicPath, express.static(build.assetsBuildDirectory));
   app.use(express.static("public", { maxAge: "1h" }));
+  app.use(
+    "/.well-known",
+    express.static(path.join(build.assetsBuildDirectory, ".well-known")),
+  );
   app.use(morgan("tiny"));
 
   if (build.fetch) {