@everystack/server 0.2.28 → 0.2.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.2.28",
+  "version": "0.2.29",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/ssr.ts

@@ -69,6 +69,15 @@ export interface WebHandlerOptions {
   /** Inject __EXPO_ROUTER_HYDRATE__ flag before </head>. Default: true. */
   injectHydrateFlag?: boolean;
 
+  /**
+   * Opaque the expo-router loader-data blob so search crawlers can't harvest
+   * URL-shaped strings (route keys like `/stories/index`, image/link values)
+   * out of the inline hydration script. Default: true. Runtime behaviour is
+   * unchanged — the decoded globalThis value is byte-identical. See
+   * deharvestLoaderData.
+   */
+  deharvestLoaderData?: boolean;
+
   /**
    * App-specific HTML post-processing. Called after built-in processing
    * (param stripping, hydrate flag). Receives the processed HTML and the
@@ -82,6 +91,59 @@ export interface WebHandlerOptions {
 const DEFAULT_STRIP_PARAMS = ['_v', '_a'];
 const HYDRATE_SCRIPT = '<script>globalThis.__EXPO_ROUTER_HYDRATE__=true;</script>\n';
 
+/**
+ * Matches expo-router's `<PreloadedDataScript />` output. The renderer emits
+ * exactly:
+ *
+ *   <script id="expo-router-data" type="module">
+ *     globalThis.__EXPO_ROUTER_LOADER_DATA__ = JSON.parse("<escaped-json>");
+ *   </script>
+ *
+ * Group 1 = the opening tag, group 2 = the double-quoted JS string literal
+ * argument. The literal is HTML-safe (expo escapes <, >, & to \uXXXX), so a
+ * `</script>` terminator never appears inside it.
+ */
+const LOADER_DATA_SCRIPT_RE =
+  /(<script id="expo-router-data"[^>]*>globalThis\.__EXPO_ROUTER_LOADER_DATA__\s*=\s*JSON\.parse\()("(?:[^"\\]|\\.)*")(\);<\/script>)/;
+
+/**
+ * Rewrite the expo-router loader-data script so its payload is opaque in the
+ * raw HTML while the executed value is byte-identical.
+ *
+ * expo-router keys the loader map by the route FILE path, so index routes get a
+ * `/index` suffix (`/stories/index`). Googlebot harvests URL-shaped strings
+ * from inline JS, resolves those same-origin, crawls `/stories/index`, and
+ * 404s. The key cannot be renamed: expo-router's client resolver
+ * (useLoaderData) looks the data up by the identical `/index` key, so any
+ * SSR-only rename mismatches on hydration (white flash).
+ *
+ * The one server-only fix that removes the harvestable text AND preserves the
+ * exact key: base64-encode the JSON payload. No URL-shaped substring survives
+ * in the source for the crawler, and at runtime `atob` + TextDecoder + JSON.parse
+ * reproduces the same object with the same keys — the client is untouched. This
+ * also opaques URL-shaped *values* (image/CDN links inside loader data), killing
+ * the whole harvest class, not just `/index` keys.
+ *
+ * Fail-safe: if the script is absent or doesn't match the expected shape (e.g.
+ * an expo-router format change), the HTML is returned unchanged. Idempotent —
+ * the rewritten script no longer matches the string-literal form.
+ */
+export function deharvestLoaderData(html: string): string {
+  return html.replace(LOADER_DATA_SCRIPT_RE, (full, open: string, literal: string, close: string) => {
+    let jsonText: string;
+    try {
+      // The literal is valid JSON string syntax; parsing yields the JSON text
+      // the client would otherwise receive verbatim.
+      jsonText = JSON.parse(literal) as string;
+    } catch {
+      return full; // unexpected shape — leave untouched
+    }
+    const b64 = Buffer.from(jsonText, 'utf8').toString('base64');
+    const decode = `new TextDecoder().decode(Uint8Array.from(atob(${JSON.stringify(b64)}),c=>c.charCodeAt(0)))`;
+    return `${open}${decode}${close}`;
+  });
+}
+
 /**
  * Wraps an SSR request handler with framework-level fixes:
  *
@@ -91,7 +153,10 @@ const HYDRATE_SCRIPT = '<script>globalThis.__EXPO_ROUTER_HYDRATE__=true;</script
  *      Native Web uses `hydrateRoot()` instead of `createRoot()`.
  *      (React 19 suppresses <script> tags from SSR output, so this must
  *      be done via string replacement after rendering.)
- *   3. Calls an optional `postProcessHtml` hook for app-specific transforms
+ *   3. Opaques the expo-router loader-data blob so crawlers can't harvest its
+ *      URL-shaped route keys (`/{path}/index`) and 404 on them. See
+ *      deharvestLoaderData.
+ *   4. Calls an optional `postProcessHtml` hook for app-specific transforms
  *      (e.g., JSON-LD injection, status code override from meta tags).
  *
  * @param innerHandler - The expo-server request handler
@@ -100,11 +165,12 @@ const HYDRATE_SCRIPT = '<script>globalThis.__EXPO_ROUTER_HYDRATE__=true;</script
  */
 export function wrapSsrHandler(
   innerHandler: (request: Request) => Promise<Response>,
-  options?: Pick<WebHandlerOptions, 'stripQueryParams' | 'injectHydrateFlag' | 'postProcessHtml'>,
+  options?: Pick<WebHandlerOptions, 'stripQueryParams' | 'injectHydrateFlag' | 'deharvestLoaderData' | 'postProcessHtml'>,
   metadata?: ReleaseMetadata,
 ): (request: Request) => Promise<Response> {
   const stripParams = options?.stripQueryParams ?? DEFAULT_STRIP_PARAMS;
   const injectHydrate = options?.injectHydrateFlag !== false;
+  const deharvest = options?.deharvestLoaderData !== false;
   const postProcess = options?.postProcessHtml;
 
   return async (request: Request): Promise<Response> => {
@@ -149,6 +215,12 @@ export function wrapSsrHandler(
       html = html.replace('</head>', `${HYDRATE_SCRIPT}</head>`);
     }
 
+    // Opaque the loader-data blob so crawlers can't harvest its URL-shaped
+    // route keys (index routes leak `/{path}/index`). No-op if absent.
+    if (deharvest) {
+      html = deharvestLoaderData(html);
+    }
+
     // 3. App-specific post-processing
     if (postProcess) {
       const result = await postProcess(html, request);