@everystack/server 0.2.27 → 0.2.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.2.27",
+  "version": "0.2.29",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -74,11 +74,6 @@
       "default": "./src/media.ts"
     }
   },
-  "scripts": {
-    "test": "jest",
-    "build": "tsc --build",
-    "lint": "tsc --noEmit"
-  },
   "peerDependencies": {
     "esbuild": ">=0.20.0",
     "@aws-sdk/client-cloudfront-keyvaluestore": ">=3.1053.0",
@@ -128,8 +123,6 @@
   "devDependencies": {
     "@aws-sdk/client-cloudfront-keyvaluestore": "3.1053.0",
     "@aws-sdk/signature-v4a": "3.1063.0",
-    "@everystack/auth": "workspace:*",
-    "@everystack/cli": "workspace:*",
     "@types/aws-lambda": "8.10.161",
     "@types/jest": "29.5.14",
     "@types/node": "22.19.18",
@@ -139,6 +132,13 @@
     "postgres": "3.4.9",
     "sst": "4.13.1",
     "ts-jest": "29.4.9",
-    "typescript": "5.9.3"
+    "typescript": "5.9.3",
+    "@everystack/auth": "0.2.6",
+    "@everystack/cli": "0.2.40"
+  },
+  "scripts": {
+    "test": "jest",
+    "build": "tsc --build",
+    "lint": "tsc --noEmit"
   }
-}
+}

package/src/db.ts

@@ -262,3 +262,75 @@ export function getAdminSql(): ReturnType<typeof postgres> {
   if (adminSqlClient) return adminSqlClient;
   return getSql();
 }
+
+/**
+ * Resolve the read-replica database URL, if configured.
+ *
+ * The third credential slot: DATABASE_URL (api), ADMIN_DATABASE_URL (operator),
+ * READ_DATABASE_URL (replica). Point it at a physical read replica's endpoint
+ * with the SAME least-privilege role as DATABASE_URL — same credential,
+ * different host. Returns null when no replica is configured.
+ */
+export function getReadDatabaseUrl(): string | null {
+  // SST Secret — PascalCase (Resource.ReadDatabaseUrl.value)
+  const pascal = tryResource(() => (Resource as any).ReadDatabaseUrl?.value as string);
+  if (pascal) return pascal;
+  // SST Secret — raw env name (Resource.READ_DATABASE_URL.value)
+  const raw = tryResource(() => (Resource as any).READ_DATABASE_URL?.value as string);
+  if (raw) return raw;
+  // process.env fallback
+  if (process.env.READ_DATABASE_URL) return process.env.READ_DATABASE_URL;
+  return null;
+}
+
+// Lazy singleton read-replica connection (separate from the API connection)
+let readDbInstance: ReturnType<typeof drizzle> | null = null;
+let readSqlClient: ReturnType<typeof postgres> | null = null;
+
+/**
+ * Read-replica database connection for anonymous read traffic.
+ *
+ * Connects with READ_DATABASE_URL when configured. When it isn't, returns the
+ * primary connection (createDb) with NO warning — unlike the admin split this
+ * is a scaling knob, not a security boundary: absent is normal, not a
+ * misconfiguration. Apps without a replica keep working with zero config.
+ *
+ * `withRole` works unchanged against a hot standby: SET LOCAL ROLE and
+ * set_config(…, true) are permitted in read-only transactions, and physical
+ * replication carries roles, GRANTs, and RLS policies with the catalog. A
+ * write through this connection fails loudly on a real replica ("cannot
+ * execute … in a read-only transaction") — a routing bug can never silently
+ * diverge. See docs/plans/read-replica-routing.md.
+ */
+export function createReadDb<T extends Record<string, unknown>>(
+  schema: T,
+  options?: { maxConnections?: number }
+): {
+  db: ReturnType<typeof drizzle>;
+  schema: T;
+} {
+  if (readDbInstance) return { db: readDbInstance, schema };
+
+  const url = getReadDatabaseUrl();
+  if (!url) return createDb(schema, options);
+
+  readSqlClient = postgres(url, {
+    max: options?.maxConnections ?? 1,
+    idle_timeout: 60,
+    connect_timeout: 5,
+    max_lifetime: 60 * 5,
+    ssl: 'require',
+  });
+  readDbInstance = drizzle(readSqlClient, { schema });
+  return { db: readDbInstance, schema };
+}
+
+/**
+ * Raw postgres.js client for the read-replica connection.
+ * Must be called after createReadDb(). Falls back to the API client when no
+ * replica is configured (same fallback as createReadDb).
+ */
+export function getReadSql(): ReturnType<typeof postgres> {
+  if (readSqlClient) return readSqlClient;
+  return getSql();
+}

package/src/ssr.ts

@@ -69,6 +69,15 @@ export interface WebHandlerOptions {
   /** Inject __EXPO_ROUTER_HYDRATE__ flag before </head>. Default: true. */
   injectHydrateFlag?: boolean;
 
+  /**
+   * Opaque the expo-router loader-data blob so search crawlers can't harvest
+   * URL-shaped strings (route keys like `/stories/index`, image/link values)
+   * out of the inline hydration script. Default: true. Runtime behaviour is
+   * unchanged — the decoded globalThis value is byte-identical. See
+   * deharvestLoaderData.
+   */
+  deharvestLoaderData?: boolean;
+
   /**
    * App-specific HTML post-processing. Called after built-in processing
    * (param stripping, hydrate flag). Receives the processed HTML and the
@@ -82,6 +91,59 @@ export interface WebHandlerOptions {
 const DEFAULT_STRIP_PARAMS = ['_v', '_a'];
 const HYDRATE_SCRIPT = '<script>globalThis.__EXPO_ROUTER_HYDRATE__=true;</script>\n';
 
+/**
+ * Matches expo-router's `<PreloadedDataScript />` output. The renderer emits
+ * exactly:
+ *
+ *   <script id="expo-router-data" type="module">
+ *     globalThis.__EXPO_ROUTER_LOADER_DATA__ = JSON.parse("<escaped-json>");
+ *   </script>
+ *
+ * Group 1 = the opening tag, group 2 = the double-quoted JS string literal
+ * argument. The literal is HTML-safe (expo escapes <, >, & to \uXXXX), so a
+ * `</script>` terminator never appears inside it.
+ */
+const LOADER_DATA_SCRIPT_RE =
+  /(<script id="expo-router-data"[^>]*>globalThis\.__EXPO_ROUTER_LOADER_DATA__\s*=\s*JSON\.parse\()("(?:[^"\\]|\\.)*")(\);<\/script>)/;
+
+/**
+ * Rewrite the expo-router loader-data script so its payload is opaque in the
+ * raw HTML while the executed value is byte-identical.
+ *
+ * expo-router keys the loader map by the route FILE path, so index routes get a
+ * `/index` suffix (`/stories/index`). Googlebot harvests URL-shaped strings
+ * from inline JS, resolves those same-origin, crawls `/stories/index`, and
+ * 404s. The key cannot be renamed: expo-router's client resolver
+ * (useLoaderData) looks the data up by the identical `/index` key, so any
+ * SSR-only rename mismatches on hydration (white flash).
+ *
+ * The one server-only fix that removes the harvestable text AND preserves the
+ * exact key: base64-encode the JSON payload. No URL-shaped substring survives
+ * in the source for the crawler, and at runtime `atob` + TextDecoder + JSON.parse
+ * reproduces the same object with the same keys — the client is untouched. This
+ * also opaques URL-shaped *values* (image/CDN links inside loader data), killing
+ * the whole harvest class, not just `/index` keys.
+ *
+ * Fail-safe: if the script is absent or doesn't match the expected shape (e.g.
+ * an expo-router format change), the HTML is returned unchanged. Idempotent —
+ * the rewritten script no longer matches the string-literal form.
+ */
+export function deharvestLoaderData(html: string): string {
+  return html.replace(LOADER_DATA_SCRIPT_RE, (full, open: string, literal: string, close: string) => {
+    let jsonText: string;
+    try {
+      // The literal is valid JSON string syntax; parsing yields the JSON text
+      // the client would otherwise receive verbatim.
+      jsonText = JSON.parse(literal) as string;
+    } catch {
+      return full; // unexpected shape — leave untouched
+    }
+    const b64 = Buffer.from(jsonText, 'utf8').toString('base64');
+    const decode = `new TextDecoder().decode(Uint8Array.from(atob(${JSON.stringify(b64)}),c=>c.charCodeAt(0)))`;
+    return `${open}${decode}${close}`;
+  });
+}
+
 /**
  * Wraps an SSR request handler with framework-level fixes:
  *
@@ -91,7 +153,10 @@ const HYDRATE_SCRIPT = '<script>globalThis.__EXPO_ROUTER_HYDRATE__=true;</script
  *      Native Web uses `hydrateRoot()` instead of `createRoot()`.
  *      (React 19 suppresses <script> tags from SSR output, so this must
  *      be done via string replacement after rendering.)
- *   3. Calls an optional `postProcessHtml` hook for app-specific transforms
+ *   3. Opaques the expo-router loader-data blob so crawlers can't harvest its
+ *      URL-shaped route keys (`/{path}/index`) and 404 on them. See
+ *      deharvestLoaderData.
+ *   4. Calls an optional `postProcessHtml` hook for app-specific transforms
  *      (e.g., JSON-LD injection, status code override from meta tags).
  *
  * @param innerHandler - The expo-server request handler
@@ -100,11 +165,12 @@ const HYDRATE_SCRIPT = '<script>globalThis.__EXPO_ROUTER_HYDRATE__=true;</script
  */
 export function wrapSsrHandler(
   innerHandler: (request: Request) => Promise<Response>,
-  options?: Pick<WebHandlerOptions, 'stripQueryParams' | 'injectHydrateFlag' | 'postProcessHtml'>,
+  options?: Pick<WebHandlerOptions, 'stripQueryParams' | 'injectHydrateFlag' | 'deharvestLoaderData' | 'postProcessHtml'>,
   metadata?: ReleaseMetadata,
 ): (request: Request) => Promise<Response> {
   const stripParams = options?.stripQueryParams ?? DEFAULT_STRIP_PARAMS;
   const injectHydrate = options?.injectHydrateFlag !== false;
+  const deharvest = options?.deharvestLoaderData !== false;
   const postProcess = options?.postProcessHtml;
 
   return async (request: Request): Promise<Response> => {
@@ -149,6 +215,12 @@ export function wrapSsrHandler(
       html = html.replace('</head>', `${HYDRATE_SCRIPT}</head>`);
     }
 
+    // Opaque the loader-data blob so crawlers can't harvest its URL-shaped
+    // route keys (index routes leak `/{path}/index`). No-op if absent.
+    if (deharvest) {
+      html = deharvestLoaderData(html);
+    }
+
     // 3. App-specific post-processing
     if (postProcess) {
       const result = await postProcess(html, request);