@weaverse/hydrogen 5.21.1 → 5.22.0

package/dist/index.js

@@ -1365,6 +1365,8 @@ var SMART_CACHE_STRATEGIES = {
     staleIfError: CACHE_DURATIONS.LONG
   }
 };
+var bodyFreeCacheRequests = /* @__PURE__ */ new WeakSet();
+var BODY_FREE_CACHE_SENTINEL = "\0weaverse:body-free";
 var WeaverseClient = class {
   /** Builder API version used by this client. */
   API = API_PATH;
@@ -1748,7 +1750,12 @@ var WeaverseClient = class {
       "weaverse-fetch",
       url,
       options.method || "GET",
-      fetchOptions.body,
+      bodyFreeCacheRequests.has(options) ? BODY_FREE_CACHE_SENTINEL : fetchOptions.body,
+      // WeakSet-derived discriminator: this slot cannot be produced by any
+      // caller-supplied shape, so no external call can reach the marked
+      // identity — even one that happens to send the sentinel string as its
+      // body.
+      bodyFreeCacheRequests.has(options),
       this.configs.projectId,
       cacheTarget || "default"
     ];
@@ -1767,6 +1774,19 @@ var WeaverseClient = class {
     }
     return result.data;
   };
+  /**
+   * Safe origin of the incoming storefront request: scheme, host and explicit
+   * port. Userinfo, path, query and fragment are dropped, so no customer
+   * route or credential-bearing value leaves the storefront. Returns undefined
+   * for a non-http(s) request so the field is simply omitted.
+   */
+  safeStorefrontOrigin() {
+    const { protocol, host } = this.parsedUrl;
+    if (protocol !== "http:" && protocol !== "https:") {
+      return;
+    }
+    return host ? `${protocol}//${host}` : void 0;
+  }
   /**
    * Load theme settings from Weaverse API with fallback to schema defaults.
    * Merges remote settings with local theme schema and handles design mode serialization.
@@ -1789,19 +1809,25 @@ var WeaverseClient = class {
         throw new Error("Missing Weaverse projectId!");
       }
       const url = this.getApiUrl("project_configs");
-      const body = JSON.stringify({ isDesignMode, projectId });
+      const body = JSON.stringify({
+        isDesignMode,
+        projectId,
+        storefrontUrl: this.safeStorefrontOrigin()
+      });
+      const themeSettingsOptions = {
+        method: "POST",
+        cacheTarget: "theme-settings",
+        strategy,
+        body,
+        headers: {
+          "Content-Type": "application/json",
+          Accept: "application/json",
+          "Accept-Encoding": "gzip, deflate, br"
+        }
+      };
+      bodyFreeCacheRequests.add(themeSettingsOptions);
       const [data, merchantOverrides] = await Promise.all([
-        this.fetchWithCache(url, {
-          method: "POST",
-          cacheTarget: "theme-settings",
-          strategy,
-          body,
-          headers: {
-            "Content-Type": "application/json",
-            Accept: "application/json",
-            "Accept-Encoding": "gzip, deflate, br"
-          }
-        }),
+        this.fetchWithCache(url, themeSettingsOptions),
         this.fetchMerchantOverrides(strategy)
       ]);
       let result = data;