Intent registry: legacy `__` scoped-package URLs return HTTP 500 (indexed by Google, no redirect to canonical)

[dearlordylord]

Legacy __ scoped-package registry URLs 500 (indexed by Google, no redirect)

Repo: TanStack/tanstack.com (registry UI).

Bug

Two URL forms indexed by Google per scoped package:

• Canonical …/%2540scope%252Fname → 200
• Legacy …/%40scope__name → 500

Commit 0f55472 ("chore: add audit guardrails", 2026-06-24, direct to main) switched slug codec to encodeURIComponent/decodeURIComponent and removed the old inline slug.replace('__', '/') decode + name.replace('/', '__') links. Legacy __ URLs still in Google index, no redirect → hard 500.

Per-URL-form, not per-package

form	router-core	apollo/client	firfi/quint-connect
canonical %2540…%252F…	200	200	200
legacy %40…__…	500	500	500

No package immune (tanstack __ also 500s). User hits whichever form Google served. All-scoped __ sweep: 183/183 → 500; canonical + unscoped → 200.

Repro

curl -so /dev/null -w "%{http_code}\n" https://tanstack.com/intent/registry/%40apollo__client       # 500
curl -so /dev/null -w "%{http_code}\n" https://tanstack.com/intent/registry/%2540apollo%252Fclient   # 200
curl -so /dev/null -w "%{http_code}\n" https://tanstack.com/intent/registry/%40tanstack__router-core # 500

Videos

• quint-connect (Google → legacy __ → error): **

Screen.Recording.2026-07-19.at.1.10.59.PM.mov

• apollo/client (Google → legacy __ → error): **

Screen.Recording.2026-07-19.at.1.30.27.PM.mov

Root cause (code)

Links pinned to 3b4add9.

decodePackageNameSlug only percent-decodes, no __→/:

export function decodePackageNameSlug(slug: string) {
  let next = slug
  for (let i = 0; i < 2; i++) {                 // double-encoding only (%2540→%40→@)
    try { const d = decodeURIComponent(next); if (d === next) return d; next = d }
    catch { return slug }
  }
  return next
}

Flow: $packageName.tsx loader → decodePkgName → @scope__name (unchanged) → getIntentPackageDetail({name}) → npm-name regex reject → 500. Errored dehydrated state:

status:"error" … queryKey:["intent","package","@firfi__quint-connect"]
{ "message":"Invalid npm package name", "input":"@firfi__quint-connect",
  "expected":"/^(?:@[a-z0-9][a-z0-9._-]*\\/)?[a-z0-9][a-z0-9._-]*$/i" }

Origin: commit 0f55472, per audit P3 "slugs not round-trip safe". Old __→/ back-compat still present in stats route, dropped in Intent route.

Impact

SEO/crawlers/shared-links: legacy __ URLs Google serves = 500, user sees error not listing (videos). Not seen browsing registry UI or when Google serves canonical URL.

Fix

Preferred: 301 legacy __ slug → canonical encodeURIComponent URL in $packageName route.
Alt: restore __→/ in decodePackageNameSlug (mirror stats route).