@weaverse/hydrogen 5.21.1 → 5.22.0

package/dist/types/weaverse-client.d.ts

@@ -159,6 +159,13 @@ export declare class WeaverseClient {
      * ```
      */
     fetchWithCache: <T = unknown>(url: string, options?: WeaverseFetchWithCacheOptions) => Promise<T>;
+    /**
+     * Safe origin of the incoming storefront request: scheme, host and explicit
+     * port. Userinfo, path, query and fragment are dropped, so no customer
+     * route or credential-bearing value leaves the storefront. Returns undefined
+     * for a non-http(s) request so the field is simply omitted.
+     */
+    private safeStorefrontOrigin;
     /**
      * Load theme settings from Weaverse API with fallback to schema defaults.
      * Merges remote settings with local theme schema and handles design mode serialization.

package/dist/types/weaverse-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"weaverse-client.d.ts","sourceRoot":"","sources":["../../src/weaverse-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,EAGhB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EAEf,uBAAuB,EAEvB,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,EAGd,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EAGvB,MAAM,SAAS,CAAA;AA6EhB,gFAAgF;AAChF,MAAM,MAAM,qBAAqB,GAC7B,cAAc,GACd,oBAAoB,GACpB,SAAS,GACT,gBAAgB,CAAA;AAEpB,uEAAuE;AACvE,MAAM,WAAW,6BAA8B,SAAQ,WAAW;IAChE,0EAA0E;IAC1E,WAAW,CAAC,EAAE,qBAAqB,CAAA;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,eAAe,CAAA;CAC3B;AAED,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAcD;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB,+CAA+C;IAC/C,GAAG,OAAW;IACd,4DAA4D;IAC5D,eAAe,EAAE,IAAI,CAAC,sBAAsB,EAAE,aAAa,CAAC,CAAA;IAC5D,0DAA0D;IAC1D,mBAAmB,EAAE,IAAI,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAA;IACzD,yDAAyD;IACzD,OAAO,EAAE,sBAAsB,CAAA;IAC/B,4DAA4D;IAC5D,SAAS,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,CAAA;IAE7C,6DAA6D;IAC7D,OAAO,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAA;IACtC,yDAAyD;IACzD,eAAe,EAAE,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IACtD,yDAAyD;IACzD,UAAU,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAC5C,sEAAsE;IACtE,UAAU,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAC5C,yDAAyD;IACzD,WAAW,EAAE,kBAAkB,CAAC,aAAa,CAAC,CAAA;IAC9C,8CAA8C;IAC9C,GAAG,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAC9B,sDAAsD;IACtD,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAClC,gEAAgE;IAChE,SAAS,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAA;IAG1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAK;IAC/B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAgC;IAGjE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IAEvC,qEAAqE;gBACzD,IAAI,EAAE,kBAAkB;IAuBpC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAcvB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAsDzB;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAM/B;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,gBAAgB;IA2BxB;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAoBzB;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAe5B;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAK9B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IA4D3B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAwBzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAsDzB;IAED,OAAO,CAAC,QAAQ,CAAC,WAAW,CAoB3B;IAGD,OAAO,CAAC,SAAS;IAKjB,OAAO,CAAC,sBAAsB;IAQ9B;;;;;;;;;;;;;;;;OAgBG;IACI,cAAc,GAAU,CAAC,GAAG,OAAO,EACxC,KAAK,MAAM,EACX,UAAS,6BAAkC,KAC1C,OAAO,CAAC,CAAC,CAAC,CAkDZ;IAED;;;;;;;;;;;;OAYG;IACH,iBAAiB,GACf,WAAW,eAAe,KACzB,OAAO,CAAC,qBAAqB,CAAC,CA8GhC;IAED;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAqD7B;IAED;;;;;;OAMG;IACH,oBAAoB,GAAI,SAAS,MAAM,KAAG,gBAAgB,CAczD;IAED;;;OAGG;IACG,gBAAgB,CACpB,IAAI,CAAC,EAAE,uBAAuB,GAC7B,OAAO,CAAC,eAAe,EAAE,CAAC;IAmD7B;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,QAAQ,GACN,SAAQ,cAAmB,KAC1B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA+KpC;IAED,gFAAgF;IAChF,mBAAmB,GAAU,MAAM,qBAAqB,oCAqBvD;CACF"}
+{"version":3,"file":"weaverse-client.d.ts","sourceRoot":"","sources":["../../src/weaverse-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,EAGhB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EAEf,uBAAuB,EAEvB,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,EAGd,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EAGvB,MAAM,SAAS,CAAA;AA6EhB,gFAAgF;AAChF,MAAM,MAAM,qBAAqB,GAC7B,cAAc,GACd,oBAAoB,GACpB,SAAS,GACT,gBAAgB,CAAA;AAEpB,uEAAuE;AACvE,MAAM,WAAW,6BAA8B,SAAQ,WAAW;IAChE,0EAA0E;IAC1E,WAAW,CAAC,EAAE,qBAAqB,CAAA;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,eAAe,CAAA;CAC3B;AAED,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAyCD;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB,+CAA+C;IAC/C,GAAG,OAAW;IACd,4DAA4D;IAC5D,eAAe,EAAE,IAAI,CAAC,sBAAsB,EAAE,aAAa,CAAC,CAAA;IAC5D,0DAA0D;IAC1D,mBAAmB,EAAE,IAAI,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAA;IACzD,yDAAyD;IACzD,OAAO,EAAE,sBAAsB,CAAA;IAC/B,4DAA4D;IAC5D,SAAS,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,CAAA;IAE7C,6DAA6D;IAC7D,OAAO,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAA;IACtC,yDAAyD;IACzD,eAAe,EAAE,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IACtD,yDAAyD;IACzD,UAAU,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAC5C,sEAAsE;IACtE,UAAU,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAC5C,yDAAyD;IACzD,WAAW,EAAE,kBAAkB,CAAC,aAAa,CAAC,CAAA;IAC9C,8CAA8C;IAC9C,GAAG,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAC9B,sDAAsD;IACtD,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAClC,gEAAgE;IAChE,SAAS,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAA;IAG1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAK;IAC/B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAgC;IAGjE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IAEvC,qEAAqE;gBACzD,IAAI,EAAE,kBAAkB;IAuBpC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAcvB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAsDzB;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAM/B;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,gBAAgB;IA2BxB;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAoBzB;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAe5B;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAK9B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IA4D3B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAwBzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAsDzB;IAED,OAAO,CAAC,QAAQ,CAAC,WAAW,CAoB3B;IAGD,OAAO,CAAC,SAAS;IAKjB,OAAO,CAAC,sBAAsB;IAQ9B;;;;;;;;;;;;;;;;OAgBG;IACI,cAAc,GAAU,CAAC,GAAG,OAAO,EACxC,KAAK,MAAM,EACX,UAAS,6BAAkC,KAC1C,OAAO,CAAC,CAAC,CAAC,CA6DZ;IAED;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAQ5B;;;;;;;;;;;;OAYG;IACH,iBAAiB,GACf,WAAW,eAAe,KACzB,OAAO,CAAC,qBAAqB,CAAC,CAkIhC;IAED;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAqD7B;IAED;;;;;;OAMG;IACH,oBAAoB,GAAI,SAAS,MAAM,KAAG,gBAAgB,CAczD;IAED;;;OAGG;IACG,gBAAgB,CACpB,IAAI,CAAC,EAAE,uBAAuB,GAC7B,OAAO,CAAC,eAAe,EAAE,CAAC;IAmD7B;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,QAAQ,GACN,SAAQ,cAAmB,KAC1B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA+KpC;IAED,gFAAgF;IAChF,mBAAmB,GAAU,MAAM,qBAAqB,oCAqBvD;CACF"}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@weaverse/hydrogen",
   "author": "Weaverse Team",
   "description": "Components, hooks, and utilities for building Shopify Hydrogen websites with Weaverse",
-  "version": "5.21.1",
+  "version": "5.22.0",
   "license": "MIT",
   "main": "dist/index.js",
   "typings": "dist/types/index.d.ts",
@@ -46,8 +46,8 @@
   "dependencies": {
     "@shopify/hydrogen": ">=2025.5",
     "@shopify/remix-oxygen": "3",
-    "@weaverse/react": "5.21.1",
-    "@weaverse/schema": "0.16.0",
+    "@weaverse/react": "5.22.0",
+    "@weaverse/schema": "0.17.0",
     "react": ">=19",
     "react-dom": ">=19",
     "react-error-boundary": "^6",

package/src/weaverse-client.ts

@@ -133,6 +133,33 @@ const SMART_CACHE_STRATEGIES: Record<BuilderApiCacheTarget, CachingStrategy> = {
   },
 } as const
 
+/**
+ * Options objects created by the internal `project_configs` request whose
+ * subrequest cache identity deliberately excludes the body. Theme settings
+ * carry the storefront origin so Builder can attribute hostnames; hashing the
+ * body would give every domain of one project its own entry.
+ *
+ * The SUCCESSFUL theme payload is the same for every storefront of a project,
+ * which is what makes one shared entry correct. This is not a claim that
+ * Builder can never answer differently per host: a hostname-blocked request
+ * returns a 403 `{ error }` body, and `shouldCacheResponse` rejects anything
+ * `hasError()` matches, so a refusal is never stored under (or served from)
+ * the shared entry. If a future response shape ever varies by host WITHOUT an
+ * `error` field, this exclusion has to be revisited.
+ *
+ * Keyed on the exact options object, NOT on `cacheTarget`: `fetchWithCache`
+ * is public API, so gating on the target would silently collapse the cache of
+ * any consumer who selects `theme-settings` with varying bodies. An outside
+ * caller's options object is never in this set and keeps a body-derived key.
+ *
+ * The WeakSet-membership slot in the cache key (`has(options)`) is the actual
+ * discriminator — no caller-supplied value can reach it. The sentinel is not
+ * load-bearing for that; it only keeps the omitted body legible in cache
+ * debugging instead of a bare `undefined`.
+ */
+const bodyFreeCacheRequests = new WeakSet<object>()
+const BODY_FREE_CACHE_SENTINEL = '\u0000weaverse:body-free'
+
 /**
  * Request-scoped client for loading Weaverse pages and theme settings in Hydrogen.
  *
@@ -638,21 +665,32 @@ export class WeaverseClient {
 
     // Update cache key to include method, body content, and projectId for multi-project isolation
     // Prefix for easier debugging in cache systems
+    //
+    // The body is omitted only for options objects marked internally (see
+    // `bodyFreeCacheRequests`): the storefront origin must reach Builder for
+    // hostname attribution, but two domains of one project have to share one
+    // entry. Every other caller keeps a body-derived key.
     const cacheKey = [
       'weaverse-fetch',
       url,
       options.method || 'GET',
-      fetchOptions.body,
+      bodyFreeCacheRequests.has(options)
+        ? BODY_FREE_CACHE_SENTINEL
+        : fetchOptions.body,
+      // WeakSet-derived discriminator: this slot cannot be produced by any
+      // caller-supplied shape, so no external call can reach the marked
+      // identity — even one that happens to send the sentinel string as its
+      // body.
+      bodyFreeCacheRequests.has(options),
       this.configs.projectId,
       cacheTarget || 'default',
     ]
-
     let result: WithCacheFetchResponse<T>
 
     // Bypass the shared Hydrogen subrequest cache for design/revision modes
     // and for the Cloudflare public API proxy. The proxy owns freshness with
     // versioned cache keys; keeping Hydrogen's URL/body cache in front would
-    // keep serving a stale response even after Builder bumps api.weaverse.io's
+    // keep serving a stale response even after Builder bumps the proxy's
     // project version.
     if (
       this.configs.isDesignMode ||
@@ -678,6 +716,20 @@ export class WeaverseClient {
     return result.data
   }
 
+  /**
+   * Safe origin of the incoming storefront request: scheme, host and explicit
+   * port. Userinfo, path, query and fragment are dropped, so no customer
+   * route or credential-bearing value leaves the storefront. Returns undefined
+   * for a non-http(s) request so the field is simply omitted.
+   */
+  private safeStorefrontOrigin(): string | undefined {
+    const { protocol, host } = this.parsedUrl
+    if (protocol !== 'http:' && protocol !== 'https:') {
+      return
+    }
+    return host ? `${protocol}//${host}` : undefined
+  }
+
   /**
    * Load theme settings from Weaverse API with fallback to schema defaults.
    * Merges remote settings with local theme schema and handles design mode serialization.
@@ -704,21 +756,41 @@ export class WeaverseClient {
 
       const url = this.getApiUrl('project_configs')
 
-      const body = JSON.stringify({ isDesignMode, projectId })
+      // Theme/config reads carry no route, so Builder could not tell which
+      // storefront asked. `storefrontUrl` is the request's safe origin only —
+      // scheme, host and explicit port, never a path, query, fragment or
+      // userinfo — so hosted-content attribution works without sending
+      // customer-visible URL data. Older Builder deployments ignore the extra
+      // field. The response does not vary by storefront, so the origin stays
+      // out of BOTH cache identities: the edge excludes it from its selectors,
+      // and this request is marked in `bodyFreeCacheRequests` so Hydrogen's
+      // own subrequest cache key omits the body — hashing it would otherwise
+      // give every domain of one project its own entry.
+      const body = JSON.stringify({
+        isDesignMode,
+        projectId,
+        storefrontUrl: this.safeStorefrontOrigin(),
+      })
+
+      // Fetch theme settings and merchant overrides in parallel. The options
+      // object is registered in `bodyFreeCacheRequests` so `fetchWithCache`
+      // keeps the storefront origin out of the subrequest cache identity for
+      // exactly this internal request — see the marker's doc comment.
+      const themeSettingsOptions: WeaverseFetchWithCacheOptions = {
+        method: 'POST',
+        cacheTarget: 'theme-settings',
+        strategy,
+        body,
+        headers: {
+          'Content-Type': 'application/json',
+          Accept: 'application/json',
+          'Accept-Encoding': 'gzip, deflate, br',
+        },
+      }
+      bodyFreeCacheRequests.add(themeSettingsOptions)
 
-      // Fetch theme settings and merchant overrides in parallel
       const [data, merchantOverrides] = await Promise.all([
-        this.fetchWithCache<ThemeSettingsResponse>(url, {
-          method: 'POST',
-          cacheTarget: 'theme-settings',
-          strategy,
-          body,
-          headers: {
-            'Content-Type': 'application/json',
-            Accept: 'application/json',
-            'Accept-Encoding': 'gzip, deflate, br',
-          },
-        }),
+        this.fetchWithCache<ThemeSettingsResponse>(url, themeSettingsOptions),
         this.fetchMerchantOverrides(strategy),
       ])