@everystack/server 0.4.13 → 0.4.14

package/README.md

@@ -149,8 +149,7 @@ Actions contributed (each is an `everystack db:*` command):
 | `db:psql` / `db:query` | connection info / read-only SQL via Lambda |
 | `db:doctor` | audit: is the API connection least-privilege + RLS-subject? Flags BYPASSRLS, un-FORCEd RLS, and **app-reachable tables without RLS** |
 | `db:provision` | create the least-privilege role chain on an existing DB (idempotent; roles only) |
-| `db:backup:probe` | verify the `pg_dump` layer is attached and `pg_dump` major ≥ the server major |
-| `db:backup` | `pg_dump -Fc` → gzip → S3 (streamed); awaits the child exit code, deletes the partial on failure |
+| `db:backup` | dispatched to the Fargate Task lane: `pg_dump -Fc` → gzip → S3 (streamed), fingerprint-stamped; awaits the child exit code, deletes the partial on failure |
 | `db:backups` | list a stage's backups |
 | `db:restore` | S3 → gunzip → `pg_restore --clean --if-exists` (requires `confirm:true`) |
 | `db:authz:probe` | run the CLI-built authorization red-team SQL in a rolled-back transaction |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.4.13",
+  "version": "0.4.14",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -85,9 +85,13 @@
       "types": "./src/pipeline.ts",
       "default": "./src/pipeline.ts"
     },
-    "./infra": {
-      "types": "./src/infra.ts",
-      "default": "./src/infra.ts"
+    "./backup": {
+      "types": "./src/backup.ts",
+      "default": "./src/backup.ts"
+    },
+    "./backup-run": {
+      "types": "./src/backup-run.ts",
+      "default": "./src/backup-run.ts"
     }
   },
   "peerDependencies": {
@@ -99,7 +103,6 @@
     "@aws-sdk/signature-v4a": ">=3.1048.0",
     "@everystack/auth": ">=0.1.0",
     "@everystack/cli": ">=0.1.0",
-    "@everystack/pg-tools": ">=0.4.0",
     "drizzle-orm": "0.41.0",
     "heic-decode": "2.1.0",
     "postgres": "3.4.9",
@@ -119,9 +122,6 @@
     "sst": {
       "optional": true
     },
-    "@everystack/pg-tools": {
-      "optional": true
-    },
     "@everystack/auth": {
       "optional": true
     },
@@ -160,8 +160,7 @@
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
     "@everystack/auth": "0.4.0",
-    "@everystack/pg-tools": "0.4.1",
-    "@everystack/cli": "0.4.29"
+    "@everystack/cli": "0.4.31"
   },
   "scripts": {
     "test": "jest",

package/src/backup-run.ts

@@ -15,12 +15,12 @@
 import { spawn } from 'node:child_process';
 import { createGzip, createGunzip } from 'node:zlib';
 import { pipeline } from 'node:stream/promises';
-import { randomBytes } from 'node:crypto';
 import type { Readable } from 'node:stream';
 import {
-  backupPrefix, backupKey, metaKey, backupId, idForKey, keyForId, utcStamp,
-  artifactKey, artifactId, artifactPrefix, artifactIdForKey,
+  backupPrefix, metaKey, idForKey, keyForId,
   pgEnvFromUrl, dbNameFromUrl, pgDumpArgs, pgRestoreArgs,
+  restoreIntentPrefix,
+  type BackupManifest, type RestoreIntent,
 } from './backup';
 
 /** Where backups live + the operator connection pg_dump/pg_restore use. */
@@ -36,6 +36,8 @@ export interface BackupSummary {
   key: string;
   bytes?: number;
   lastModified?: string;
+  /** The live base-schema fingerprint stamped at dump time (present on B3+ backups). */
+  fingerprint?: string;
 }
 
 /**
@@ -77,19 +79,31 @@ async function getS3(region?: string): Promise<any> {
   return new S3Client(region ? { region } : {});
 }
 
+/** A backup run's target — the id+key the DISPATCHER minted (mintBackupTarget) + its stage. */
+export interface BackupTarget {
+  stage: string;
+  id: string;
+  key: string;
+  /**
+   * The live base-schema fingerprint at dump time (liveBaseFingerprint), stamped into the manifest so
+   * a destructive db:apply can prove `backup.fp == plan.from`. The Task computes it over the same
+   * connection it dumps. Absent → the manifest carries no fp and the safety gate refuses it (a
+   * pre-B3 or fp-less backup can't be a verified net).
+   */
+  fingerprint?: string;
+}
+
 /**
  * pg_dump -Fc → gzip → S3 (multipart, streamed). Writes a `.meta.json` sidecar on success.
  * Throws (after deleting the partial object) if pg_dump exits non-zero — the dump is never trusted
- * on a successful upload alone.
+ * on a successful upload alone. The id+key are minted by the caller (the dispatcher) so the CLI
+ * knows the artifact at dispatch time; this IO never stamps its own clock into the id.
  */
-export async function runBackup(deps: BackupRunDeps, stage: string): Promise<BackupSummary> {
+export async function runBackup(deps: BackupRunDeps, target: BackupTarget): Promise<BackupSummary> {
   const { bucket, region, adminUrl } = deps;
+  const { stage, id, key, fingerprint } = target;
   const env = { ...process.env, ...pgEnvFromUrl(adminUrl) };
-  const stamp = utcStamp(new Date());
-  const shortId = randomBytes(3).toString('hex');
-  const key = backupKey(stage, stamp, shortId);
   const mkey = metaKey(key);
-  const id = backupId(stage, stamp, shortId);
 
   const s3 = await getS3(region);
   const { Upload } = await importOptionalAws(
@@ -139,13 +153,13 @@ export async function runBackup(deps: BackupRunDeps, stage: string): Promise<Bac
     bytes = head.ContentLength;
   } catch { /* size is best-effort */ }
 
-  const meta = { id, stage, createdAt: new Date().toISOString(), bytes, key };
+  const meta = { id, stage, createdAt: new Date().toISOString(), bytes, key, ...(fingerprint ? { fingerprint } : {}) };
   await s3.send(new PutObjectCommand({
     Bucket: bucket, Key: mkey, Body: JSON.stringify(meta),
     ContentType: 'application/json', ServerSideEncryption: 'AES256',
   }));
 
-  return { id, key, bytes };
+  return { id, key, bytes, ...(fingerprint ? { fingerprint } : {}) };
 }
 
 export interface ExportRunResult {
@@ -165,16 +179,12 @@ export interface ExportRunResult {
  */
 export async function runExport(
   deps: BackupRunDeps,
-  opts: { schema: string; stage: string; fingerprint: string },
+  opts: { schema: string; stage: string; fingerprint: string; id: string; key: string },
 ): Promise<ExportRunResult> {
   const { bucket, region, adminUrl } = deps;
-  const { schema, stage, fingerprint } = opts;
+  const { schema, stage, fingerprint, id, key } = opts;
   const env = { ...process.env, ...pgEnvFromUrl(adminUrl) };
-  const stamp = utcStamp(new Date());
-  const shortId = randomBytes(3).toString('hex');
-  const key = artifactKey(schema, stage, stamp, shortId);
   const mkey = metaKey(key);
-  const id = artifactId(schema, stage, stamp, shortId);
 
   const s3 = await getS3(region);
   const { Upload } = await importOptionalAws(() => import('@aws-sdk/lib-storage'), '@aws-sdk/lib-storage', 'db:export');
@@ -219,6 +229,46 @@ export async function runExport(
   return { id, key, bytes, fingerprint };
 }
 
+/**
+ * Fetch a backup's `.meta.json` manifest by id — the destructive-apply safety gate reads it to verify
+ * the ref. Returns null when the id is malformed or the manifest object is absent (a manifest exists
+ * ONLY on a successful dump, so absence == "no completed backup with that id"). The verify treats
+ * null as a refusal.
+ */
+export async function fetchBackupManifest(deps: BackupRunDeps, id: string): Promise<BackupManifest | null> {
+  const key = keyForId(id);
+  if (!key) return null;
+  const s3 = await getS3(deps.region);
+  const { GetObjectCommand } = await import('@aws-sdk/client-s3');
+  try {
+    const obj: any = await s3.send(new GetObjectCommand({ Bucket: deps.bucket, Key: metaKey(key) }));
+    if (!obj.Body) return null;
+    const text = await obj.Body.transformToString();
+    return JSON.parse(text) as BackupManifest;
+  } catch {
+    return null; // NoSuchKey / parse failure → no valid manifest
+  }
+}
+
+/** The stage's newest backup manifest (for the gate's auto-resolve when no --snapshot-ref is given). */
+export async function latestBackupManifest(deps: BackupRunDeps, stage: string): Promise<BackupManifest | null> {
+  const backups = await listBackups(deps, stage); // newest first
+  if (backups.length === 0) return null;
+  return fetchBackupManifest(deps, backups[0].id);
+}
+
+/**
+ * Delete a backup artifact + its `.meta.json` — used to retract a dump whose fingerprint could not be
+ * PROVEN stable across the dump window (a concurrent DDL), so the safety gate never trusts a manifest
+ * whose fp might not match the schema the dump actually holds.
+ */
+export async function deleteBackup(deps: Pick<BackupRunDeps, 'bucket' | 'region'>, key: string): Promise<void> {
+  const s3 = await getS3(deps.region);
+  const { DeleteObjectCommand } = await import('@aws-sdk/client-s3');
+  await s3.send(new DeleteObjectCommand({ Bucket: deps.bucket, Key: key })).catch(() => {});
+  await s3.send(new DeleteObjectCommand({ Bucket: deps.bucket, Key: metaKey(key) })).catch(() => {});
+}
+
 /** List a stage's backups (newest first) from S3 object metadata — one list call, no per-item gets. */
 export async function listBackups(deps: BackupRunDeps, stage: string): Promise<BackupSummary[]> {
   const s3 = await getS3(deps.region);
@@ -279,6 +329,77 @@ export async function runRestore(deps: BackupRunDeps, id: string): Promise<{ id:
   return { id, restored: true };
 }
 
+// --- Restore intent IO (M2 durable ledger — an S3 object OUTSIDE the DB being replaced) ----------
+
+/** Write the intent object (dispatcher, BEFORE RunTask). Crash-truthful: the record exists before
+ *  the restore can trash the DB. */
+export async function putRestoreIntent(
+  deps: Pick<BackupRunDeps, 'bucket' | 'region'>,
+  key: string,
+  intent: RestoreIntent,
+): Promise<void> {
+  const s3 = await getS3(deps.region);
+  const { PutObjectCommand } = await importOptionalAws(
+    () => import('@aws-sdk/client-s3'), '@aws-sdk/client-s3', 'db:restore',
+  );
+  await s3.send(new PutObjectCommand({
+    Bucket: deps.bucket, Key: key, Body: JSON.stringify(intent),
+    ContentType: 'application/json', ServerSideEncryption: 'AES256',
+  }));
+}
+
+/** Read an intent object, or null when absent/unparseable. */
+export async function getRestoreIntent(
+  deps: Pick<BackupRunDeps, 'bucket' | 'region'>,
+  key: string,
+): Promise<RestoreIntent | null> {
+  const s3 = await getS3(deps.region);
+  const { GetObjectCommand } = await import('@aws-sdk/client-s3');
+  try {
+    const obj: any = await s3.send(new GetObjectCommand({ Bucket: deps.bucket, Key: key }));
+    if (!obj.Body) return null;
+    return JSON.parse(await obj.Body.transformToString()) as RestoreIntent;
+  } catch {
+    return null;
+  }
+}
+
+/** Merge a patch into an intent object (stamp the ARN, or the terminal outcome). Best-effort. */
+export async function stampRestoreIntent(
+  deps: Pick<BackupRunDeps, 'bucket' | 'region'>,
+  key: string,
+  patch: Partial<RestoreIntent>,
+): Promise<void> {
+  const current = await getRestoreIntent(deps, key);
+  if (!current) return;
+  await putRestoreIntent(deps, key, { ...current, ...patch });
+}
+
+/** List a stage's restore intents (newest first) — the durable half of db:restores. */
+export async function listRestoreIntents(
+  deps: Pick<BackupRunDeps, 'bucket' | 'region'>,
+  stage: string,
+): Promise<RestoreIntent[]> {
+  const s3 = await getS3(deps.region);
+  const { ListObjectsV2Command, GetObjectCommand } = await import('@aws-sdk/client-s3');
+  const prefix = `${restoreIntentPrefix(stage)}/`;
+  const out: RestoreIntent[] = [];
+  let token: string | undefined;
+  do {
+    const res: any = await s3.send(new ListObjectsV2Command({ Bucket: deps.bucket, Prefix: prefix, ContinuationToken: token }));
+    for (const o of res.Contents ?? []) {
+      if (!o.Key?.endsWith('.json')) continue;
+      try {
+        const obj: any = await s3.send(new GetObjectCommand({ Bucket: deps.bucket, Key: o.Key }));
+        if (obj.Body) out.push(JSON.parse(await obj.Body.transformToString()) as RestoreIntent);
+      } catch { /* skip unreadable */ }
+    }
+    token = res.IsTruncated ? res.NextContinuationToken : undefined;
+  } while (token);
+  out.sort((a, b) => (b.startedAt ?? '').localeCompare(a.startedAt ?? ''));
+  return out;
+}
+
 /** The URL mode's precondition — a presigned http(s) download, never a path or bucket ref. */
 export function assertRestoreUrl(url: string): void {
   if (!/^https?:\/\//.test(url)) {

package/src/backup.ts

@@ -1,12 +1,9 @@
 /**
- * db:backup — logical pg_dump/pg_restore helpers (server side).
- *
- * The version gate is load-bearing: pg_dump must be >= the server's MAJOR version, and there is no
- * bypass flag (a newer server refuses an older client; a custom-format archive won't restore under
- * an older pg_restore). So before any dump we compare the layer's pg_dump major against the live
- * server's `server_version_num`. The parsing/compat logic is pure and unit-tested here; the actual
- * spawn (which needs the pg_dump layer at runtime) is exercised by the deployed db:backup:probe.
- * See docs/plans/db-backup-restore.md.
+ * db:backup — logical pg_dump/pg_restore helpers (server side). Pure helpers: the S3 key schemes,
+ * the PG* env decomposition, the pg_dump/pg_restore arg builders, the snapshot-ref safety gate, and
+ * the version-compat math. The pg binaries run in the ephemeral Fargate Task lane (backup-run.ts),
+ * not this Lambda; the version gate (pg_dump major >= server major — no bypass) is enforced by the
+ * Task image's handshake, verified on demand with `everystack task:probe`.
  */
 
 /**
@@ -110,6 +107,135 @@ export function artifactIdForKey(dumpKey: string): string | null {
   return m ? `${m[1]}/${m[2]}/${m[3]}` : null;
 }
 
+// --- Mint targets (dispatcher-side) -------------------------------------------------------------
+// The ops Lambda mints the id+key from ITS clock + a random shortId and hands both to the ephemeral
+// task (via the job) AND back to the CLI at dispatch time — so the CLI knows the artifact the moment
+// dispatch returns, with no result-readback race. The task writes to exactly this key; nothing has
+// to be discovered after the fact.
+
+/** A minted artifact/backup target: the stage/schema-qualified id and the S3 dump key it maps to. */
+export interface MintedTarget {
+  id: string;
+  key: string;
+}
+
+/** Mint a full-database backup target (db:backup). `now` is the dispatcher's clock. */
+export function mintBackupTarget(stage: string, now: Date, shortId: string): MintedTarget {
+  const stamp = utcStamp(now);
+  return { id: backupId(stage, stamp, shortId), key: backupKey(stage, stamp, shortId) };
+}
+
+/** Mint a schema-scoped artifact target (db:export). `now` is the dispatcher's clock. */
+export function mintExportTarget(schema: string, stage: string, now: Date, shortId: string): MintedTarget {
+  const stamp = utcStamp(now);
+  return { id: artifactId(schema, stage, stamp, shortId), key: artifactKey(schema, stage, stamp, shortId) };
+}
+
+// --- Snapshot-ref verification (the destructive-apply safety gate) ------------------------------
+// A destructive db:apply must be covered by a COMPLETED, restorable, matching backup. The ops Lambda
+// resolves the ref (an explicit --snapshot-ref id, else the stage's newest backup) and runs this pure
+// verdict. The .meta.json is written ONLY on a successful dump (runBackup deletes the partial + never
+// writes meta on failure), so a resolvable manifest IS the success proof. The fingerprint tie
+// (manifest.fingerprint == plan.from) makes the guarantee provable, not merely temporal.
+
+/** A backup's `.meta.json` — the manifest the safety gate reads. `fingerprint` added for the fp tie. */
+export interface BackupManifest {
+  id: string;
+  stage: string;
+  /** ISO 8601. */
+  createdAt: string;
+  /** The base-schema fingerprint captured at dump time (absent on pre-B3 backups). */
+  fingerprint?: string;
+  bytes?: number;
+  key: string;
+}
+
+export interface SnapshotVerifyInput {
+  /** The resolved backup manifest, or null when none could be resolved. */
+  manifest: BackupManifest | null;
+  /** plan.fromFingerprint — the schema state the apply expects to change. */
+  planFrom: string;
+  /** The stage being changed — the backup must cover THIS database. */
+  targetStage: string;
+  now: Date;
+  /** How old a backup may be and still qualify (data-rollback bound; fp already proves schema). */
+  freshnessWindowMs: number;
+}
+
+export type SnapshotVerdict = { ok: true; id: string } | { ok: false; reason: string };
+
+/**
+ * Verify a resolved backup is a valid safety net for a destructive apply: it exists (⇒ succeeded),
+ * covers this stage, carries a fingerprint that equals plan.from (⇒ restores the exact state being
+ * changed), and is fresh. Every refusal names the fix (db:backup). Pure; the resolution IO lives in
+ * backup-run.ts and the enforcement in the ops db:apply action.
+ */
+export function verifySnapshotRef(input: SnapshotVerifyInput): SnapshotVerdict {
+  const { manifest, planFrom, targetStage, now, freshnessWindowMs } = input;
+  const takeFresh = `take a fresh backup: everystack db:backup --stage ${targetStage}, then re-run.`;
+  if (!manifest) {
+    return { ok: false, reason: `no backup found for stage ${targetStage} — ${takeFresh}` };
+  }
+  if (manifest.stage !== targetStage) {
+    return { ok: false, reason: `snapshot ${manifest.id} is for stage ${manifest.stage}, not ${targetStage} — a snapshot must cover the database being changed. ${takeFresh}` };
+  }
+  if (!manifest.fingerprint) {
+    return { ok: false, reason: `snapshot ${manifest.id} predates fingerprint stamping — ${takeFresh}` };
+  }
+  if (manifest.fingerprint !== planFrom) {
+    return { ok: false, reason: `snapshot ${manifest.id} captured schema ${manifest.fingerprint.slice(0, 12)}, but this plan starts from ${planFrom.slice(0, 12)} — it would not restore the state being changed. ${takeFresh}` };
+  }
+  const ageMs = now.getTime() - Date.parse(manifest.createdAt);
+  if (!(ageMs >= 0) || ageMs > freshnessWindowMs) {
+    const mins = Math.round(ageMs / 60_000);
+    return { ok: false, reason: `snapshot ${manifest.id} is ${mins} min old (freshness window ${Math.round(freshnessWindowMs / 60_000)} min) — ${takeFresh}` };
+  }
+  return { ok: true, id: manifest.id };
+}
+
+// --- Restore intent (M2: the durable ledger for a DB-REPLACING restore) -------------------------
+// A restore pg_restores a full backup with --clean, drop+recreating the app schemas — so its own
+// audit record is written OUTSIDE the DB, as a durable S3 object under `restores/<stage>/`, by the
+// dispatcher BEFORE RunTask. That guarantees forensics regardless of how the restore leaves the DB
+// (partial, corrupt, or a hard-killed task): "a restore of X was attempted on Y at Z" always
+// survives. (The everystack ops schema itself is excluded from the dump, so its own ledgers persist
+// across a restore — but the restore's record still belongs in S3, not in the DB it's rewriting.)
+// db:restores reads these + the live ECS status.
+
+/** The S3 prefix a stage's restore intents live under (admin-only, encrypted; OUTSIDE the app DB). */
+export function restoreIntentPrefix(stage: string): string {
+  return `restores/${stage}`;
+}
+
+/** The S3 object key for a restore intent. `stamp` is a UTC `YYYYMMDDTHHMMSSZ` string. */
+export function restoreIntentKey(stage: string, stamp: string, shortId: string): string {
+  return `${restoreIntentPrefix(stage)}/${stamp}-${shortId}.json`;
+}
+
+/** A restore intent's stage-qualified id (what db:restores displays): `dev/20260723T120000Z-ab12cd`. */
+export function restoreIntentId(stage: string, stamp: string, shortId: string): string {
+  return `${stage}/${stamp}-${shortId}`;
+}
+
+/** Mint a restore intent target (dispatcher-side): the S3 key + the display id. */
+export function mintRestoreIntent(stage: string, now: Date, shortId: string): { intentKey: string; intentId: string } {
+  const stamp = utcStamp(now);
+  return { intentKey: restoreIntentKey(stage, stamp, shortId), intentId: restoreIntentId(stage, stamp, shortId) };
+}
+
+/** The M2 intent record — the crash-truthful "what was attempted", plus the outcome once known. */
+export interface RestoreIntent {
+  intentId: string;
+  stage: string;
+  /** The restore source: a backup id in-stage, or a presigned cross-stage URL (never both). */
+  source: { id?: string; url?: string };
+  actor?: string | null;
+  startedAt: string;
+  taskArn?: string;
+  status?: 'started' | 'running' | 'succeeded' | 'failed';
+  finishedAt?: string;
+}
+
 /** Format a Date as the UTC `YYYYMMDDTHHMMSSZ` stamp (caller's clock; pure). */
 export function utcStamp(date: Date): string {
   const p = (n: number): string => String(n).padStart(2, '0');
@@ -155,9 +281,18 @@ export function dbNameFromUrl(url: string): string {
  */
 export function pgDumpArgs(opts: { schema?: string } = {}): string[] {
   const args = ['-Fc', '--no-owner', '--no-privileges', '--no-comments'];
-  // A schema-scoped artifact dumps ONE schema (the canonical-sync export). pg_dump's --schema
-  // takes a pattern; a plain identifier scopes to exactly that schema and its objects.
-  if (opts.schema) args.push(`--schema=${opts.schema}`);
+  if (opts.schema) {
+    // A schema-scoped artifact dumps ONE schema (the canonical-sync export). pg_dump's --schema
+    // takes a pattern; a plain identifier scopes to exactly that schema and its objects.
+    args.push(`--schema=${opts.schema}`);
+  } else {
+    // A full backup EXCLUDES the framework ops schema: everystack.* holds the OPERATIONAL ledgers
+    // (task_log, schema_log, exec_log, backfill_log, derived_provenance) — the TARGET's audit and
+    // migration history, not app data. Restoring them would rewind that history AND makes
+    // pg_restore --clean fail (DROP SCHEMA everystack can't run: its ledger tables depend on it,
+    // non-CASCADE). Excluding it keeps a restore to app data and preserves the target's ops history.
+    args.push('--exclude-schema=everystack');
+  }
   return args;
 }
 
@@ -168,24 +303,3 @@ export function pgDumpArgs(opts: { schema?: string } = {}): string[] {
 export function pgRestoreArgs(dbName: string): string[] {
   return ['--clean', '--if-exists', '--no-owner', '--no-privileges', '--no-comments', '-d', dbName];
 }
-
-/**
- * Spawn `<bin> --version` and return its trimmed stdout (e.g. "pg_dump (PostgreSQL) 16.9").
- * Rejects when the binary is missing — which, in the ops Lambda, means the pg_dump layer is not
- * attached. `bin` defaults to `pg_dump`, resolved on PATH (the layer lands at /opt/bin, on PATH).
- */
-export async function pgClientVersion(bin = 'pg_dump'): Promise<string> {
-  const { spawn } = await import('node:child_process');
-  return await new Promise<string>((resolve, reject) => {
-    let out = '';
-    let err = '';
-    const child = spawn(bin, ['--version']);
-    child.stdout.on('data', (d) => { out += d.toString(); });
-    child.stderr.on('data', (d) => { err += d.toString(); });
-    child.on('error', (e) => reject(e));
-    child.on('close', (code) => {
-      if (code === 0) resolve(out.trim());
-      else reject(new Error(`${bin} --version exited ${code}: ${err.trim()}`));
-    });
-  });
-}

package/src/db-doctor.ts

@@ -87,20 +87,6 @@ export interface DoctorProbe {
    * an older probe (the check is then skipped). B4.
    */
   darkRelations?: DarkRelation[];
-  /**
-   * pg_dump layer capability: whether @everystack/pg-tools is attached (pg_dump present) and its
-   * major can dump this server (client >= server). Drives the one-line "backups" lens — a missing
-   * layer blocks db:backup AND the snapshot-first destructive apply. Absent on an older probe (the
-   * check is then skipped). See docs/plans/pgdump-layer.md.
-   */
-  backup?: {
-    /** `pg_dump --version` output, or null when the layer is not attached. */
-    pgDump: string | null;
-    pgDumpMajor: number | null;
-    serverMajor: number | null;
-    /** pgDumpMajor >= serverMajor — a client can dump an older-or-equal server, never a newer one. */
-    compatible: boolean;
-  };
 }
 
 /** A function PUBLIC can EXECUTE, and whether it runs as its owner (the dangerous half). */
@@ -558,32 +544,8 @@ export function buildDoctorReport(probe: DoctorProbe, options: DoctorReportOptio
     }
   }
 
-  // Backups lens — the pg_dump layer gates db:backup AND the snapshot-first destructive apply. A
-  // missing layer isn't a security hole (warn, not fail), but it silently blocks the ceremony.
-  if (probe.backup) {
-    const b = probe.backup;
-    if (b.pgDump && b.compatible) {
-      checks.push({
-        name: 'Logical backups available (pg_dump layer)',
-        status: 'pass',
-        detail: `pg_dump major ${b.pgDumpMajor} attached and compatible with server major ${b.serverMajor} — db:backup and the snapshot-first destructive apply are ready`,
-      });
-    } else if (b.pgDump && !b.compatible) {
-      checks.push({
-        name: 'Logical backups available (pg_dump layer)',
-        status: 'warn',
-        detail: `pg_dump major ${b.pgDumpMajor} is older than server major ${b.serverMajor} — it will refuse to dump (no bypass exists)`,
-        remediation: 'Upgrade @everystack/pg-tools to advance the client ceiling to >= the server major, then redeploy.',
-      });
-    } else {
-      checks.push({
-        name: 'Logical backups available (pg_dump layer)',
-        status: 'warn',
-        detail: 'pg_dump layer not attached — db:backup and the snapshot-first destructive apply are unavailable',
-        remediation: 'Install @everystack/pg-tools and redeploy (pgDumpLayer attaches it automatically), or pass a bring-your-own layerArn in sst.config.ts.',
-      });
-    }
-  }
+  // (No backups lens: pg-binary backup/restore run in the ephemeral Fargate Task lane, not the ops
+  // Lambda. Verify the Task image's pg_dump-vs-server compatibility with `everystack task:probe`.)
 
   return {
     api,
@@ -610,9 +572,6 @@ export interface DoctorProbeRunners {
 export interface RunDoctorProbeOptions extends DoctorReportOptions {
   /** Names the api credential source in the connect-failure message (e.g. 'DATABASE_URL'). */
   apiSourceLabel?: string;
-  /** The backups lens (pg_dump layer) probe — Lambda-only. Omitted on the direct venue,
-   *  where there is no layer concept, so the lens is simply not shown. */
-  backup?: () => Promise<DoctorProbe['backup']>;
 }
 
 const quoteDoctorIdent = (s: string): string => '"' + String(s).replace(/"/g, '""') + '"';
@@ -667,10 +626,8 @@ export async function runDoctorProbe(
     }
   }
 
-  const backup = options.backup ? await options.backup() : undefined;
-
   return buildDoctorReport(
-    { api, admin, forceRls, appGrantedRls, apiAmbientRead, secdefFunctions, publicExecutableFunctions, darkRelations, backup },
+    { api, admin, forceRls, appGrantedRls, apiAmbientRead, secdefFunctions, publicExecutableFunctions, darkRelations },
     { forceRlsCarveouts: options.forceRlsCarveouts, functionSchemas: options.functionSchemas },
   );
 }

package/src/plugin.ts

@@ -729,34 +729,8 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
       const apiRun = async (q: string): Promise<any[]> => rowsOf(await apiDb.execute(sql.raw(q)));
       const opsRun = async (q: string): Promise<any[]> => rowsOf(await opsDb.execute(sql.raw(q)));
 
-      // Backups lens — is the pg_dump layer attached AND version-compatible? Lambda-only:
-      // a missing layer leaves pgDump null (the lens warns), never throws. Absent on the
-      // CLI direct venue, where there is no layer.
-      const backup = async (): Promise<import('./db-doctor').DoctorProbe['backup']> => {
-        try {
-          const { pgClientVersion, parsePgDumpMajor, serverMajorFromNum, isDumpCompatible } = await import('./backup');
-          let pgDump: string | null = null;
-          let pgDumpMajor: number | null = null;
-          try {
-            pgDump = await pgClientVersion('pg_dump');
-            pgDumpMajor = parsePgDumpMajor(pgDump);
-          } catch {
-            // layer absent — pgDump stays null, the lens reports "not attached"
-          }
-          const svnRow = rowsOf(await opsDb.execute(sql.raw('SHOW server_version_num')))[0];
-          const svn = Number(svnRow?.server_version_num);
-          const serverMajor = Number.isFinite(svn) ? serverMajorFromNum(svn) : null;
-          return {
-            pgDump,
-            pgDumpMajor,
-            serverMajor,
-            compatible: pgDumpMajor != null && Number.isFinite(svn) ? isDumpCompatible(pgDumpMajor, svn) : false,
-          };
-        } catch {
-          return undefined; // leave backup out → the lens is skipped, like the other optional probes
-        }
-      };
-
+      // No backups lens: pg-binary work runs in the ephemeral Fargate Task lane, not the ops Lambda.
+      // Verify the Task image's pg_dump-vs-server compatibility with `everystack task:probe`.
       try {
         return await runDoctorProbe(
           { api: apiRun, ops: opsRun },
@@ -764,7 +738,6 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
             apiSourceLabel: 'DATABASE_URL',
             forceRlsCarveouts: options.forceRlsCarveouts,
             functionSchemas: options.functionSchemas,
-            backup,
           },
         );
       } catch (err: any) {
@@ -820,55 +793,13 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
       );
     };
 
-    // --- db:backup:probe — is the pg_dump layer attached, and does it match the server? ---
-    // The version gate for logical backups: pg_dump must be >= the server's MAJOR (no bypass flag
-    // exists). Returns the layer's pg_dump version + the live server_version_num so a deploy can
-    // confirm the layer is present AND version-compatible before db:backup is trusted. See backup.ts.
-    actions['db:backup:probe'] = async () => {
-      const { pgClientVersion, parsePgDumpMajor, serverMajorFromNum, isDumpCompatible } = await import('./backup');
-      const { sql } = await import('drizzle-orm');
-
-      let pgDump: string;
-      try {
-        pgDump = await pgClientVersion('pg_dump');
-      } catch (err: any) {
-        return { error: `pg_dump not available — the pg_dump layer is not attached. Install @everystack/pg-tools and redeploy (pgDumpLayer() attaches it automatically), or pass a bring-your-own layerArn in sst.config.ts. (${err?.message || String(err)})` };
-      }
-      const pgDumpMajor = parsePgDumpMajor(pgDump);
-
-      const rows: any = await opsDb.execute(sql.raw('SHOW server_version_num'));
-      const row = (Array.isArray(rows) ? rows : rows?.rows ?? [])[0];
-      const serverVersionNum = Number(row?.server_version_num);
-      const serverMajor = Number.isFinite(serverVersionNum) ? serverMajorFromNum(serverVersionNum) : null;
-
-      return {
-        pgDump,
-        pgDumpMajor,
-        serverVersionNum: Number.isFinite(serverVersionNum) ? serverVersionNum : null,
-        serverMajor,
-        compatible: pgDumpMajor != null && Number.isFinite(serverVersionNum)
-          ? isDumpCompatible(pgDumpMajor, serverVersionNum)
-          : false,
-      };
-    };
 
-    // --- db:backup / db:backups / db:restore — logical pg_dump backups streamed to S3 ---
-    // The operator (privileged) connection drives pg_dump/pg_restore; the dump streams to the
-    // dedicated private backups bucket. Restore is destructive and requires an explicit confirm in
-    // the payload (the CLI sets it after the user confirms). See backup-run.ts.
+    // --- db:backups / db:restore — list + restore logical backups ---
+    // db:backup and db:export are pg_dump work and now run in the ephemeral Task lane
+    // (@everystack/jobs dbTaskPlugin) — the ops Lambda holds no pg binaries. db:backups is a plain
+    // S3 list; db:restore drives pg_restore in-Lambda until Phase 3b moves it to the Task. Restore is
+    // destructive and requires an explicit confirm in the payload (the CLI sets it). See backup-run.ts.
     {
-      actions['db:backup'] = async (payload, ctx) => {
-        const r = await resolveBackupDeps();
-        if ('error' in r) return { error: r.error };
-        const stage = ((payload ?? {}) as { stage?: string }).stage ?? ctx.environment ?? 'default';
-        const { runBackup } = await import('./backup-run');
-        try {
-          return await runBackup(r.deps, stage);
-        } catch (err: any) {
-          return { error: err?.message || String(err) };
-        }
-      };
-
       actions['db:backups'] = async (payload, ctx) => {
         const r = await resolveBackupDeps();
         if ('error' in r) return { error: r.error };
@@ -881,40 +812,9 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
         }
       };
 
-      actions['db:restore'] = async (payload, _ctx) => {
-        const { id, url, confirm } = (payload ?? {}) as { id?: string; url?: string; confirm?: boolean };
-        if (!id && !url) return { error: "db:restore requires { id } (a backup in this stage's bucket) or { url } (a presigned cross-stage hand-off — db:fork mints one)" };
-        if (id && url) return { error: 'db:restore takes { id } or { url }, not both' };
-        if (confirm !== true) {
-          return { error: 'db:restore is destructive (drops + replaces the target DB). Pass confirm:true to proceed.' };
-        }
-        const r = await resolveBackupDeps();
-        if ('error' in r) return { error: r.error };
-        const { runRestore, runRestoreFromUrl } = await import('./backup-run');
-        try {
-          return url ? await runRestoreFromUrl(r.deps, url) : await runRestore(r.deps, id!);
-        } catch (err: any) {
-          return { error: err?.message || String(err) };
-        }
-      };
-
-      // --- db:export — the schema-scoped, fingerprint-stamped artifact (canonical-sync gap B) ---
-      // pg_dump ONE schema → S3 artifact carrying the schema fingerprint the CLI computed from the
-      // same live schema (one formula both sides). db:swap gates on that fingerprint before it lands.
-      actions['db:export'] = async (payload, ctx) => {
-        const { schema, fingerprint } = (payload ?? {}) as { schema?: string; fingerprint?: string };
-        const stage = ((payload ?? {}) as { stage?: string }).stage ?? ctx.environment ?? 'default';
-        if (!schema) return { error: 'db:export requires { schema }' };
-        if (!fingerprint) return { error: 'db:export requires { fingerprint } — the CLI computes the scoped schema fingerprint so the artifact and the swap gate agree' };
-        const r = await resolveBackupDeps();
-        if ('error' in r) return { error: r.error };
-        const { runExport } = await import('./backup-run');
-        try {
-          return await runExport(r.deps, { schema, stage, fingerprint });
-        } catch (err: any) {
-          return { error: err?.message || String(err) };
-        }
-      };
+      // db:restore moved to the ephemeral Task lane (@everystack/jobs dbTaskPlugin) — it runs
+      // pg_restore, and the ops Lambda holds no pg binaries. Its intent is a durable S3 object (M2),
+      // since a restore replaces the DB task_log lives in.
     }
 
     // --- db:apply — the credential-free staged write (Phase 2) ---
@@ -928,7 +828,7 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
     // direct --database-url path runs, only here the connection never leaves the
     // Lambda. A destructive plan snapshots first (db:backup), in order.
     actions['db:apply'] = async (payload, ctx) => {
-      const { plan, actor, gitRef, descentVerdict, authorityVerdict, stage } =
+      const { plan, actor, gitRef, descentVerdict, authorityVerdict, stage, snapshotRef } =
         (payload ?? {}) as {
           plan?: any;
           actor?: string | null;
@@ -936,6 +836,8 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
           descentVerdict?: { ok: boolean; reason?: string };
           authorityVerdict?: { ok: boolean; reason?: string };
           stage?: string;
+          /** An explicit backup id to verify; absent → the gate auto-resolves the stage's newest. */
+          snapshotRef?: string;
         };
       if (!plan || typeof plan !== 'object' || !Array.isArray(plan.statements)) {
         return { error: 'db:apply requires { plan } — a reviewed edge minted by db:plan' };
@@ -952,6 +854,10 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
       };
 
       const destructive = Number(plan.destructive) > 0;
+      const snapStage = stage ?? ctx.environment ?? 'default';
+      // How old a backup may be and still auto-qualify as the safety net (the fp match already proves
+      // schema identity; this only bounds how much data a restore would roll back).
+      const SNAPSHOT_FRESHNESS_MS = 60 * 60_000;
       let snapshotId: string | undefined;
       try {
         const result = await executeApplyPlan(runner, plan, {
@@ -965,19 +871,27 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
           ...(destructive && authorityVerdict
             ? { verifyAuthority: async () => (authorityVerdict.ok ? { ok: true as const } : { ok: false as const, reason: authorityVerdict.reason ?? 'authority refused' }) }
             : {}),
-          // Losing data is hard: the snapshot runs HERE, after the lock/descent/
-          // authority gates pass and before the DDL. It uses the same logical
-          // backup as db:backup, on the operator connection.
+          // The B3 safety gate: a destructive apply must be covered by a VERIFIED backup — the apply
+          // no longer takes its own. Resolve the ref (explicit id, else the stage's newest) and verify
+          // it SERVER-SIDE (never a CLI-attested boolean): succeeded, this stage, fresh, and
+          // fingerprint == plan.from. A miss is recorded in schema_log by executeApplyPlan.
           ...(destructive
             ? {
-                beforeDestructive: async () => {
+                verifySnapshot: async ({ planFrom }: { planFrom: string }) => {
                   const r = await resolveBackupDeps();
-                  if ('error' in r) {
-                    throw new Error(`snapshot before a destructive apply is impossible — ${r.error}`);
-                  }
-                  const { runBackup } = await import('./backup-run');
-                  const backup: any = await runBackup(r.deps, stage ?? ctx.environment ?? 'default');
-                  snapshotId = backup?.id;
+                  if ('error' in r) return { ok: false as const, reason: `snapshot gate: ${r.error}` };
+                  const { fetchBackupManifest, latestBackupManifest } = await import('./backup-run');
+                  const { verifySnapshotRef } = await import('./backup');
+                  const manifest = snapshotRef
+                    ? await fetchBackupManifest(r.deps, snapshotRef)
+                    : await latestBackupManifest(r.deps, snapStage);
+                  const verdict = verifySnapshotRef({
+                    manifest, planFrom, targetStage: snapStage,
+                    now: new Date(), freshnessWindowMs: SNAPSHOT_FRESHNESS_MS,
+                  });
+                  if (!verdict.ok) return { ok: false as const, reason: verdict.reason };
+                  snapshotId = verdict.id;
+                  return { ok: true as const };
                 },
               }
             : {}),
@@ -1089,6 +1003,68 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
       }
     };
 
+    // --- db:exec — credential-free DML-only write SQL, ONE transaction, catalog-digest guarded ---
+    // The daily driver: `psql < file.sql --stage`, but credential-free. It runs on the SAME ops
+    // connection db:seed uses (opsDb) — no new role, no BYPASSRLS, no superuser. The file runs in
+    // one transaction; a catalog digest taken BEFORE vs AFTER (schema-relevant catalogs, app
+    // schemas) rejects ANY schema change — however caused (a function, a DO block, dynamic SQL) —
+    // by rolling the whole txn back. The ledger (everystack.exec_log) is crash-truthful: the
+    // intent row commits on its own, BEFORE the run, so a mid-flight death still records what was
+    // attempted; the outcome (status + per-statement rows-affected) is written after.
+    actions['db:exec'] = async (payload, _ctx) => {
+      const p = (payload ?? {}) as { sql?: string; actor?: string | null; stage?: string | null };
+      if (!p.sql || typeof p.sql !== 'string') {
+        return { error: 'db:exec needs a SQL file body (payload.sql).' };
+      }
+      const fileSql = p.sql;
+      const schemas = options.schemas ?? ['public'];
+      try {
+        const {
+          executeExec, runExecInTx,
+          ENSURE_EXEC_LOG_SQL, renderExecIntentInsert, renderExecOutcomeUpdate,
+        } = await import('@everystack/cli/exec');
+        const { sql } = await import('drizzle-orm');
+
+        // The ledger writes on the ops connection but OUTSIDE the file's transaction (each
+        // execute auto-commits), so the intent row survives a rollback or a mid-flight death.
+        const audit = async (query: string): Promise<any[]> => {
+          const result: any = await opsDb.execute(sql.raw(query));
+          return Array.isArray(result) ? result : result?.rows ?? [];
+        };
+
+        return await executeExec({
+          sql: fileSql,
+          actor: p.actor ?? 'unknown',
+          stage: p.stage ?? 'unknown',
+          writeIntent: async (intent) => {
+            for (const ddl of ENSURE_EXEC_LOG_SQL) await audit(ddl);
+            const rows = await audit(renderExecIntentInsert({ sha: intent.sha, actor: intent.actor, stage: intent.stage }));
+            return String(rows[0].id);
+          },
+          run: () =>
+            opsDb.transaction(async (tx: any) => {
+              const txRun = async (stmt: string) => {
+                const r: any = await tx.execute(sql.raw(stmt));
+                const rows = Array.isArray(r) ? r : r?.rows ?? [];
+                const count =
+                  typeof r?.count === 'number' ? r.count
+                  : typeof r?.rowCount === 'number' ? r.rowCount
+                  : rows.length;
+                return { rows, count };
+              };
+              return runExecInTx(txRun, fileSql, { schemas });
+            }),
+          writeOutcome: async (id, outcome) => {
+            await audit(renderExecOutcomeUpdate(id, outcome));
+          },
+        });
+      } catch (err: any) {
+        // A DML-only violation (SchemaChangedError) is a clean rejection — the txn already rolled
+        // back and the outcome is recorded 'failed'. Surface the message, don't crash the plane.
+        return { error: err?.message || String(err) };
+      }
+    };
+
     // --- db:refresh — the credential-free DATA lane's refresh half (the reconcile-lane twin) ---
     // db:reconcile deploys the derived DEFINITION but no-ops on an unchanged def, so a pure
     // DATA-changed matview refresh had no credential-free path. This runs the refresh HERE on

package/src/ssr.ts

@@ -69,6 +69,15 @@ export interface WebHandlerOptions {
   /** Inject __EXPO_ROUTER_HYDRATE__ flag before </head>. Default: true. */
   injectHydrateFlag?: boolean;
 
+  /**
+   * Opaque the expo-router loader-data blob so search crawlers can't harvest
+   * URL-shaped strings (route keys like `/stories/index`, image/link values)
+   * out of the inline hydration script. Default: true. Runtime behaviour is
+   * unchanged — the decoded globalThis value is byte-identical. See
+   * deharvestLoaderData.
+   */
+  deharvestLoaderData?: boolean;
+
   /**
    * App-specific HTML post-processing. Called after built-in processing
    * (param stripping, hydrate flag). Receives the processed HTML and the
@@ -82,6 +91,59 @@ export interface WebHandlerOptions {
 const DEFAULT_STRIP_PARAMS = ['_v', '_a'];
 const HYDRATE_SCRIPT = '<script>globalThis.__EXPO_ROUTER_HYDRATE__=true;</script>\n';
 
+/**
+ * Matches expo-router's `<PreloadedDataScript />` output. The renderer emits
+ * exactly:
+ *
+ *   <script id="expo-router-data" type="module">
+ *     globalThis.__EXPO_ROUTER_LOADER_DATA__ = JSON.parse("<escaped-json>");
+ *   </script>
+ *
+ * Group 1 = the opening tag, group 2 = the double-quoted JS string literal
+ * argument. The literal is HTML-safe (expo escapes <, >, & to \uXXXX), so a
+ * `</script>` terminator never appears inside it.
+ */
+const LOADER_DATA_SCRIPT_RE =
+  /(<script id="expo-router-data"[^>]*>globalThis\.__EXPO_ROUTER_LOADER_DATA__\s*=\s*JSON\.parse\()("(?:[^"\\]|\\.)*")(\);<\/script>)/;
+
+/**
+ * Rewrite the expo-router loader-data script so its payload is opaque in the
+ * raw HTML while the executed value is byte-identical.
+ *
+ * expo-router keys the loader map by the route FILE path, so index routes get a
+ * `/index` suffix (`/stories/index`). Googlebot harvests URL-shaped strings
+ * from inline JS, resolves those same-origin, crawls `/stories/index`, and
+ * 404s. The key cannot be renamed: expo-router's client resolver
+ * (useLoaderData) looks the data up by the identical `/index` key, so any
+ * SSR-only rename mismatches on hydration (white flash).
+ *
+ * The one server-only fix that removes the harvestable text AND preserves the
+ * exact key: base64-encode the JSON payload. No URL-shaped substring survives
+ * in the source for the crawler, and at runtime `atob` + TextDecoder + JSON.parse
+ * reproduces the same object with the same keys — the client is untouched. This
+ * also opaques URL-shaped *values* (image/CDN links inside loader data), killing
+ * the whole harvest class, not just `/index` keys.
+ *
+ * Fail-safe: if the script is absent or doesn't match the expected shape (e.g.
+ * an expo-router format change), the HTML is returned unchanged. Idempotent —
+ * the rewritten script no longer matches the string-literal form.
+ */
+export function deharvestLoaderData(html: string): string {
+  return html.replace(LOADER_DATA_SCRIPT_RE, (full, open: string, literal: string, close: string) => {
+    let jsonText: string;
+    try {
+      // The literal is valid JSON string syntax; parsing yields the JSON text
+      // the client would otherwise receive verbatim.
+      jsonText = JSON.parse(literal) as string;
+    } catch {
+      return full; // unexpected shape — leave untouched
+    }
+    const b64 = Buffer.from(jsonText, 'utf8').toString('base64');
+    const decode = `new TextDecoder().decode(Uint8Array.from(atob(${JSON.stringify(b64)}),c=>c.charCodeAt(0)))`;
+    return `${open}${decode}${close}`;
+  });
+}
+
 /**
  * Wraps an SSR request handler with framework-level fixes:
  *
@@ -91,7 +153,10 @@ const HYDRATE_SCRIPT = '<script>globalThis.__EXPO_ROUTER_HYDRATE__=true;</script
  *      Native Web uses `hydrateRoot()` instead of `createRoot()`.
  *      (React 19 suppresses <script> tags from SSR output, so this must
  *      be done via string replacement after rendering.)
- *   3. Calls an optional `postProcessHtml` hook for app-specific transforms
+ *   3. Opaques the expo-router loader-data blob so crawlers can't harvest its
+ *      URL-shaped route keys (`/{path}/index`) and 404 on them. See
+ *      deharvestLoaderData.
+ *   4. Calls an optional `postProcessHtml` hook for app-specific transforms
  *      (e.g., JSON-LD injection, status code override from meta tags).
  *
  * @param innerHandler - The expo-server request handler
@@ -100,11 +165,12 @@ const HYDRATE_SCRIPT = '<script>globalThis.__EXPO_ROUTER_HYDRATE__=true;</script
  */
 export function wrapSsrHandler(
   innerHandler: (request: Request) => Promise<Response>,
-  options?: Pick<WebHandlerOptions, 'stripQueryParams' | 'injectHydrateFlag' | 'postProcessHtml'>,
+  options?: Pick<WebHandlerOptions, 'stripQueryParams' | 'injectHydrateFlag' | 'deharvestLoaderData' | 'postProcessHtml'>,
   metadata?: ReleaseMetadata,
 ): (request: Request) => Promise<Response> {
   const stripParams = options?.stripQueryParams ?? DEFAULT_STRIP_PARAMS;
   const injectHydrate = options?.injectHydrateFlag !== false;
+  const deharvest = options?.deharvestLoaderData !== false;
   const postProcess = options?.postProcessHtml;
 
   return async (request: Request): Promise<Response> => {
@@ -149,6 +215,12 @@ export function wrapSsrHandler(
       html = html.replace('</head>', `${HYDRATE_SCRIPT}</head>`);
     }
 
+    // Opaque the loader-data blob so crawlers can't harvest its URL-shaped
+    // route keys (index routes leak `/{path}/index`). No-op if absent.
+    if (deharvest) {
+      html = deharvestLoaderData(html);
+    }
+
     // 3. App-specific post-processing
     if (postProcess) {
       const result = await postProcess(html, request);

package/src/infra.ts

@@ -1,96 +0,0 @@
-/**
- * @everystack/server/infra — deploy-time helpers for a consumer's `sst.config.ts`.
- *
- * `pgDumpLayer()` attaches the PostgreSQL client-tools Lambda layer that `db:backup`/`db:restore`
- * (and the snapshot-first apply ceremony) need. It replaces the old `PGDUMP_LAYER_ARN` env-var line
- * with a zero-config, declarative resource: the framework ships the binaries (@everystack/pg-tools),
- * and this publishes them as a content-addressed LayerVersion into the CONSUMER's own account.
- *
- * Declarative, not imperative: it returns a Pulumi-managed resource's arn (or an escape-hatch
- * string), so the SST/Pulumi engine owns the layer's lifecycle — no SDK side effects at config-eval,
- * no untracked state, clean teardown. Same artifact sha => same layer name => redeploys are no-ops.
- */
-
-import { manifest, layerZipPath } from '@everystack/pg-tools';
-
-/**
- * SST's ambient config globals, injected so this package typechecks standalone (it must not depend on
- * SST's per-app generated types). In `sst.config.ts` you already have both — pass `{ aws, $util }`.
- * Typed loosely on purpose; the shapes are Pulumi's and not worth vendoring here.
- */
-export interface PgDumpLayerContext {
-  /** SST's global `aws` (@pulumi/aws) — for `aws.lambda.LayerVersion`. */
-  aws: any;
-  /** SST's global `$util` (@pulumi/pulumi) — for `$util.asset.FileArchive`. */
-  $util: any;
-}
-
-export interface PgDumpLayerOptions {
-  /**
-   * The stage's PostgreSQL server major. The shipped client must be >= this (pg_dump/pg_restore are
-   * backward compatible; a client older than the server is refused). Read it from the engine you declare.
-   */
-  pgMajor: number;
-  /**
-   * Escape hatch: attach this exact layer ARN instead of the managed publish. For consumers who build
-   * their own (e.g. x86_64, an exotic major) via tools/pgdump-layer. Outranks everything else.
-   */
-  layerArn?: string;
-}
-
-let warnedEnv = false;
-
-/**
- * Resolve and attach the pg_dump layer. Returns the ARN to spread into a Function's `layers: []`.
- *
- * Precedence: explicit `layerArn` > `PGDUMP_LAYER_ARN` (deprecated alias, warns once) > the managed
- * content-addressed LayerVersion published into this account.
- *
- * @example
- *   import { pgDumpLayer } from '@everystack/server/infra';
- *   const ops = new sst.aws.Function('Ops', {
- *     layers: [pgDumpLayer({ aws, $util }, 'PgDump', { pgMajor: 16 })],
- *     // ...
- *   });
- */
-export function pgDumpLayer(
-  ctx: PgDumpLayerContext,
-  name: string,
-  opts: PgDumpLayerOptions,
-): any /* Input<string> — the layer arn; `any` at the Pulumi interop boundary so it spreads into layers:[] */ {
-  // 1) explicit escape hatch wins.
-  if (opts.layerArn) return opts.layerArn;
-
-  // 2) deprecated env alias — still honored for one minor line, but warned.
-  const envArn = process.env.PGDUMP_LAYER_ARN;
-  if (envArn) {
-    if (!warnedEnv) {
-      warnedEnv = true;
-      console.warn(
-        '[everystack] PGDUMP_LAYER_ARN is deprecated and will be removed in the next minor. ' +
-          'Install @everystack/pg-tools and drop the env var (the layer is published automatically), ' +
-          'or pass pgDumpLayer(ctx, name, { layerArn }) for a bring-your-own layer.',
-      );
-    }
-    return envArn;
-  }
-
-  // 3) the managed publish: a content-addressed LayerVersion in the consumer's own account.
-  if (manifest.major < opts.pgMajor) {
-    throw new Error(
-      `@everystack/pg-tools ships pg${manifest.major} client tools, but this stage's server is ` +
-        `pg${opts.pgMajor}. pg_dump/pg_restore must be >= the server. Upgrade @everystack/pg-tools ` +
-        `to advance the client ceiling, or pass a bring-your-own layerArn.`,
-    );
-  }
-  const sha8 = manifest.sha256.slice(0, 8);
-  const layer = new ctx.aws.lambda.LayerVersion(name, {
-    // content-addressed: same artifact => same name => Pulumi treats redeploys as no-ops.
-    layerName: `everystack-pgdump${manifest.major}-${sha8}`,
-    code: new ctx.$util.asset.FileArchive(layerZipPath()),
-    compatibleRuntimes: ['nodejs20.x'],
-    compatibleArchitectures: [manifest.arch],
-    description: `everystack pg_dump/pg_restore — pg${manifest.postgresql}, sha ${sha8}`,
-  });
-  return layer.arn;
-}