@weaverse/next 0.1.0-alpha.13 → 0.1.0-alpha.15

package/README.md

@@ -170,15 +170,26 @@ Main exports:
 
 Example helper for a Next route/server component boundary:
 
+This helper is app-level (not exported by `@weaverse/next`); it plays the role
+of Hydrogen's global load context, but the app owns route identity explicitly.
+The App Router boundary supplies `pathname`, `pageType`, and `handle`, so the
+same identity reaches page loads and per-item revalidation loaders. It uses the
+exported `PageType` and `WeaverseNextRequestContext` types. The module defines
+both helpers used by the route-handler example below:
+
 ```ts
 import { createWeaverseNextServerClient } from '@weaverse/next/server'
+import type { PageType, WeaverseNextRequestContext } from '@weaverse/next'
 import { headers } from 'next/headers'
 import { serverComponents } from './server-components'
 import { getStaticStorefrontClient } from './storefront'
 
 export async function getWeaverseServerClient(
   searchParamsPromise: Promise<Record<string, string | string[] | undefined>>,
-  pathname = '/'
+  pathname = '/',
+  // Route identity the App Router segment owns. Seeding it here means loaders
+  // resolve the same page type / handle during SSR and per-item revalidation.
+  identity: { pageType?: PageType; handle?: string } = {}
 ) {
   let [headersList, rawSearchParams] = await Promise.all([
     headers(),
@@ -202,6 +213,27 @@ export async function getWeaverseServerClient(
     }`
   )
 
+  let requestContext: WeaverseNextRequestContext = {
+    url,
+    headers: requestHeaders,
+    searchParams,
+    pathname,
+    pageType: identity.pageType,
+    handle: identity.handle,
+    i18n: { country: 'US', language: 'EN', locale: 'en-US' },
+  }
+
+  return createWeaverseServerClientFromContext(requestContext)
+}
+
+// Explicit-context path used by the revalidation callback. The context has
+// already been validated by the SDK handler; project/host/env remain app-owned.
+export function createWeaverseServerClientFromContext(
+  requestContext: WeaverseNextRequestContext
+) {
+  // A localized app should select/cache this client from its own supported
+  // market allowlist using requestContext.i18n. This compact example uses the
+  // default market configured by the app helper.
   let storefront = getStaticStorefrontClient()
 
   return createWeaverseNextServerClient({
@@ -220,26 +252,36 @@ export async function getWeaverseServerClient(
           },
         }
       : undefined,
-    requestContext: {
-      url,
-      headers: requestHeaders,
-      searchParams,
-      pathname,
-      i18n: { country: 'US', language: 'EN', locale: 'en-US' },
-    },
+    requestContext,
     cache: { revalidate: 60, tags: ['weaverse'] },
   })
 }
 ```
 
-Then each route can stay close to the Hydrogen mental model:
+Then each route stays close to the Hydrogen mental model while supplying the
+route identity the segment owns — an `INDEX` home route and a handle-bearing
+`PRODUCT` route:
 
 ```ts
-let weaverse = await getWeaverseServerClient(props.searchParams, '/')
+// app/page.tsx — the INDEX segment owns the page type.
+let weaverse = await getWeaverseServerClient(props.searchParams, '/', {
+  pageType: 'INDEX',
+})
 let data = await weaverse.loadPage({ type: 'INDEX' })
 let theme = await weaverse.loadThemeSettings()
 ```
 
+```ts
+// app/products/[handle]/page.tsx — the PRODUCT segment supplies the handle.
+let { handle } = await props.params
+let weaverse = await getWeaverseServerClient(
+  props.searchParams,
+  `/products/${handle}`,
+  { pageType: 'PRODUCT', handle }
+)
+let data = await weaverse.loadPage({ type: 'PRODUCT', handle })
+```
+
 ### Server client members
 
 | Member | Description |
@@ -349,16 +391,18 @@ import {
   WeaverseNextProvider,
   WeaverseNextRenderer,
 } from '@weaverse/next'
-import type { WeaverseNextLoaderData } from '@weaverse/next'
+import type {
+  WeaverseNextLoaderData,
+  WeaverseNextRequestInfo,
+} from '@weaverse/next'
 import { components } from './components'
 
 export function WeaversePage({ data }: { data: WeaverseNextLoaderData }) {
+  // The server client returns `requestInfo` in the exported shape, so restore
+  // the full route identity — including `pageType` and `handle` — into the
+  // client request context instead of a narrow inline subset.
   let requestInfo = data.configs?.requestInfo as
-    | {
-        i18n?: { country?: string; language?: string; locale?: string }
-        pathname?: string
-        search?: string
-      }
+    | WeaverseNextRequestInfo
     | undefined
   let projectId =
     (data.configs?.projectId as string | undefined) ?? data.project?.id
@@ -374,6 +418,8 @@ export function WeaversePage({ data }: { data: WeaverseNextLoaderData }) {
       isPreviewMode: Boolean(data.configs?.isPreviewMode),
       isRevisionPreview: Boolean(data.configs?.isRevisionPreview),
       i18n: requestInfo?.i18n,
+      pageType: requestInfo?.pageType,
+      handle: requestInfo?.handle,
     },
   })
 
@@ -492,13 +538,38 @@ The root script connector and page-level renderer are both required for full Stu
 
 Resource-picker edits should refresh only the affected item's server loader data. The happy path should not call `router.refresh()` because refreshing the whole RSC tree can remount the page and reset scroll.
 
-Mount the route handler in the consuming app:
+Mount the route handler in the consuming app. `getClient` receives a second
+argument — the validated, same-origin route context reconstructed from the
+request body — so the revalidated loader runs with the same pathname, locale,
+page type, handle, and ordinary search params as the active storefront route.
+The two server-client helpers below are app-level consumer helpers, not exports
+from `@weaverse/next`:
 
 ```ts
 // app/api/weaverse/revalidate/route.ts
 import { createWeaverseNextRevalidateHandler } from '@weaverse/next/server'
-import { getWeaverseServerClient } from '../../../weaverse-next/server'
+import {
+  createWeaverseServerClientFromContext,
+  getWeaverseServerClient,
+} from '../../../weaverse-next/server'
+
+export const { POST } = createWeaverseNextRevalidateHandler({
+  // `requestContext` is validated browser input for route identity only.
+  // Project ID, Studio host, API base/key, and env must still come from
+  // server config — never from this context — and it is `undefined` for
+  // legacy request bodies that carry no route context.
+  getClient: (_request, requestContext) =>
+    requestContext
+      ? createWeaverseServerClientFromContext(requestContext)
+      : getWeaverseServerClient(Promise.resolve({})),
+})
+```
 
+The existing one-argument callback still works. A handler mounted with a
+`(request) => client` callback ignores the optional second argument and keeps
+compiling and running, so old wiring needs no change:
+
+```ts
 export const { POST } = createWeaverseNextRevalidateHandler({
   getClient: () => getWeaverseServerClient(Promise.resolve({})),
 })
@@ -508,15 +579,46 @@ Flow:
 
 ```text
 Studio resource picker edit
-  -> Builder calls runtime.internal.revalidateItem(draftItem)
-  -> SDK POSTs { draftItem } to /api/weaverse/revalidate
+  -> Builder calls runtime.internal.revalidateItem(draftItem)   (unchanged)
+  -> SDK snapshots runtime.requestInfo, strips server-owned/transient controls
+  -> SDK POSTs { draftItem, routeContext? } to /api/weaverse/revalidate
+  -> handler validates + sanitizes routeContext at the trust boundary
+  -> handler reconstructs a same-origin WeaverseNextRequestContext
+  -> getClient(request, requestContext) builds the route-aware server client
   -> route handler finds the registered component by draftItem.type
-  -> handler runs that component's loader with draft item data
-  -> response returns { loaderData }
+  -> handler runs that component's loader with draft data + client.requestContext
+  -> response returns { loaderData } with Cache-Control: no-store
   -> SDK applies loaderData to the live item instance in place
 ```
 
-If the route is missing or returns an error, Builder falls back to the older route-refresh path.
+If the route is missing or returns an error, Builder falls back to the older
+route-refresh path.
+
+### Trust boundary
+
+The revalidation endpoint is public and every JSON field is attacker-controlled.
+The SDK sanitizes `routeContext` on the client for clean traffic, but the route
+handler is the security boundary and re-validates independently:
+
+- Only `pathname`, sanitized `search`, a narrow i18n subset, a
+  `PageTypeSchema`-valid `pageType`, and a bounded `handle` cross the boundary.
+  Headers, cookies, auth, env, project ID, Studio host, API base/key, commerce
+  clients, the runtime, and the client are never serialized.
+- Server-owned controls (`weaverseProjectId`, `weaverseHost`, `weaverseApiKey`,
+  `weaverseApiBase`, `weaversePublicApiBase`, `weaverseVersion`, `projectId`) and
+  transient transport controls (`weaverseDraftItem`, `__weaverseDraftItem`,
+  `_rsc`) are stripped case-insensitively on both sides, so a crafted body cannot
+  influence server config resolution.
+- The origin is fixed from the endpoint request before assigning any
+  browser-provided pathname/search, so input cannot change protocol, host, port,
+  or credentials. `pathname` and `url.pathname` share one URL-canonicalized value.
+- A malformed present `routeContext` returns `400 { error: 'invalid-route-context' }`
+  before `getClient` runs; a missing `routeContext` is valid legacy input and
+  passes `undefined` to the callback.
+- Route context is routing input, never an authorization decision. A registered
+  loader must not treat pathname, handle, page type, locale, or search as proof
+  of access; customer/private data still requires independent server-side session
+  and authorization checks derived from the actual request.
 
 ## Config resolution
 

package/dist/{chunk-MQ6N5ODA.mjs → chunk-NL22OVD7.mjs}

@@ -1,3 +1,5 @@
+import { PageTypeSchema } from '@weaverse/schema';
+
 // src/utils.ts
 function generateDataFromSchema(schema) {
   let data = {};
@@ -154,8 +156,95 @@ function buildWeaverseNextRequestInfo(context) {
     pathname: getPathnameFromContext(context),
     search: search ? `?${search}` : "",
     queries: toQueryRecord(searchParams),
-    ...context?.i18n ? { i18n: context.i18n } : {}
+    ...context?.i18n ? { i18n: context.i18n } : {},
+    ...context?.pageType ? { pageType: context.pageType } : {},
+    ...context?.handle ? { handle: context.handle } : {}
+  };
+}
+var DEFAULT_REVALIDATE_ENDPOINT = "/api/weaverse/revalidate";
+var MAX_ROUTE_CONTEXT_HANDLE_LENGTH = 512;
+var DENIED_ROUTE_CONTEXT_PARAMS = [
+  "weaverseprojectid",
+  "weaversehost",
+  "weaverseapikey",
+  "weaverseapibase",
+  "weaversepublicapibase",
+  "weaverseversion",
+  "projectid",
+  "weaversedraftitem",
+  "__weaversedraftitem",
+  "_rsc"
+];
+var ROUTE_CONTEXT_I18N_KEYS = [
+  "country",
+  "label",
+  "language",
+  "locale",
+  "pathPrefix"
+];
+function sanitizeRouteContextSearch(search) {
+  let params = new URLSearchParams(search);
+  let denied = new Set(DENIED_ROUTE_CONTEXT_PARAMS);
+  for (let key of [...new Set(params.keys())]) {
+    if (denied.has(key.toLowerCase())) {
+      params.delete(key);
+    }
+  }
+  let serialized = params.toString();
+  return serialized ? `?${serialized}` : "";
+}
+function buildWeaverseNextRevalidateRouteContext(requestInfo) {
+  if (!requestInfo || typeof requestInfo.pathname !== "string" || !requestInfo.pathname) {
+    return;
+  }
+  let routeContext = {
+    pathname: requestInfo.pathname,
+    search: sanitizeRouteContextSearch(requestInfo.search ?? "")
   };
+  let { i18n } = requestInfo;
+  if (i18n && typeof i18n === "object") {
+    let picked = {};
+    for (let key of ROUTE_CONTEXT_I18N_KEYS) {
+      let value = i18n[key];
+      if (typeof value === "string") {
+        picked[key] = value;
+      }
+    }
+    if (Object.keys(picked).length) {
+      routeContext.i18n = picked;
+    }
+  }
+  if (requestInfo.pageType && PageTypeSchema.safeParse(requestInfo.pageType).success) {
+    routeContext.pageType = requestInfo.pageType;
+  }
+  if (typeof requestInfo.handle === "string" && requestInfo.handle && requestInfo.handle.length <= MAX_ROUTE_CONTEXT_HANDLE_LENGTH) {
+    routeContext.handle = requestInfo.handle;
+  }
+  return routeContext;
+}
+async function revalidateWeaverseNextItem(runtime, draftItem, endpoint = DEFAULT_REVALIDATE_ENDPOINT) {
+  let instance = runtime.itemInstances.get(draftItem.id);
+  if (!instance) {
+    throw new Error(
+      `[weaverse-next] No live item instance for "${draftItem.id}".`
+    );
+  }
+  let routeContext = buildWeaverseNextRevalidateRouteContext(
+    runtime.requestInfo
+  );
+  let body = routeContext ? { draftItem, routeContext } : { draftItem };
+  let response = await fetch(endpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!response.ok) {
+    throw new Error(
+      `[weaverse-next] Revalidate endpoint responded ${response.status}.`
+    );
+  }
+  let { loaderData } = await response.json();
+  instance.setData({ loaderData: loaderData ?? null });
 }
 
 // src/seo.ts
@@ -223,6 +312,6 @@ function getWeaverseNextSeoMetadata(data) {
   return formatWeaverseNextSeoMetadata(page?.seo ?? null);
 }
 
-export { buildWeaverseNextRequestInfo, formatWeaverseNextSeoMetadata, generateDataFromSchema, getWeaverseNextSeoMetadata, runWeaverseComponentLoaders };
-//# sourceMappingURL=chunk-MQ6N5ODA.mjs.map
-//# sourceMappingURL=chunk-MQ6N5ODA.mjs.map
+export { DEFAULT_REVALIDATE_ENDPOINT, ROUTE_CONTEXT_I18N_KEYS, buildWeaverseNextRequestInfo, buildWeaverseNextRevalidateRouteContext, formatWeaverseNextSeoMetadata, generateDataFromSchema, getWeaverseNextSeoMetadata, revalidateWeaverseNextItem, runWeaverseComponentLoaders, sanitizeRouteContextSearch };
+//# sourceMappingURL=chunk-NL22OVD7.mjs.map
+//# sourceMappingURL=chunk-NL22OVD7.mjs.map

package/dist/chunk-NL22OVD7.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils.ts","../src/loader.ts","../src/request-info.ts","../src/revalidate-item.ts","../src/seo.ts"],"names":[],"mappings":";;;AAWO,SAAS,uBACd,MAAA,EACyB;AACzB,EAAA,IAAI,OAAgC,EAAC;AACrC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA,GACD,MAAA,CAAO,QAAA,IAGP,MAAA,CAAyC,aAC1C,EAAC;AAEH,EAAA,KAAA,IAAS,SAAS,MAAA,EAAQ;AACxB,IAAA,KAAA,IAAS,KAAA,IAAS,KAAA,EAAO,MAAA,IAAU,EAAC,EAAG;AACrC,MAAA,IAAI,EAAE,IAAA,EAAM,YAAA,EAAa,GAAI,KAAA;AAC7B,MAAA,IAAI,IAAA,IAAQ,YAAA,KAAiB,IAAA,IAAQ,YAAA,KAAiB,MAAA,EAAW;AAC/D,QAAA,IAAA,CAAK,IAAI,CAAA,GAAI,YAAA;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;;;ACdA,SAAS,WAAW,IAAA,EAAkD;AACpE,EAAA,OACE,OAAO,IAAA,KAAS,QAAA,IAChB,SAAS,IAAA,IACT,OAAQ,KAAmC,IAAA,KAAS,QAAA;AAExD;AAEA,SAAS,UAAU,IAAA,EAA4D;AAC7E,EAAA,OAAO;AAAA,IACL,GAAG,IAAA;AAAA,IACH,UAAU,KAAA,CAAM,OAAA,CAAQ,KAAK,QAAQ,CAAA,GACjC,KAAK,QAAA,CAAS,GAAA;AAAA,MAAI,CAAC,KAAA,KACjB,UAAA,CAAW,KAAK,CAAA,GAAI,UAAU,KAAK,CAAA,GAAI,EAAE,GAAG,KAAA;AAAM,QAEpD,IAAA,CAAK;AAAA,GACX;AACF;AAaA,eAAsB,4BACpB,IAAA,EACwC;AACxC,EAAA,IAAI,EAAE,MAAA,EAAQ,OAAA,EAAS,QAAA,EAAS,GAAI,IAAA;AACpC,EAAA,IAAI,UAAA,GAAa,IAAA,CAAK,IAAA,IAAQ,MAAA,CAAO,IAAA;AACrC,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,UAAA,CAAW,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ;AACjC,IAAA,OAAO,UAAA;AAAA,EACT;AAEA,EAAA,IAAI,IAAA,GAA+B;AAAA,IACjC,GAAG,UAAA;AAAA,IACH,IAAA,EAAM;AAAA,MACJ,GAAG,UAAA,CAAW,IAAA;AAAA,MACd,KAAA,EAAO,UAAA,CAAW,IAAA,CAAK,KAAA,CAAM,IAAI,SAAS;AAAA;AAC5C,GACF;AACA,EAAA,IAAI,KAAA,GAAQ,KAAK,IAAA,CAAK,KAAA;AAEtB,EAAA,IAAI,YAAA,uBAAmB,GAAA,EAAmC;AAC1D,EAAA,KAAA,IAAS,SAAA,IAAa,OAAO,UAAA,EAAY;AACvC,IAAA,IAAI,SAAA,EAAW,QAAQ,IAAA,EAAM;AAC3B,MAAA,YAAA,CAAa,GAAA,CAAI,SAAA,CAAU,MAAA,CAAO,IAAA,EAAM,SAAS,CAAA;AAAA,IACnD;AAAA,EACF;AAEA,EAAA,IAAI,OAAA,uBAAc,GAAA,EAAY;AAC9B,EAAA,IAAI,eAAA,GAAkB,WAAW,MAAA,CAAO,cAAA;AACxC,EAAA,IAAI,gBAAA,GAAmB,YAAY,MAAA,CAAO,QAAA;AAQ1C,EAAA,IAAI,gBAAA,GACF,gBAAA,KAAqB,MAAA,CAAO,QAAA,GACxB,MAAA,GACA;AAAA,IACE,GAAG,MAAA;AAAA,IACH,QAAA,EAAU,gBAAA;AAAA,IACV,YAAY,gBAAA,EAAkB;AAAA,GAChC;AAEN,EAAA,eAAe,KAAK,KAAA,EAAoC;AACtD,IAAA,KAAA,IAAS,QAAQ,KAAA,EAAO;AACtB,MAAA,IAAI,CAAC,IAAA,IAAQ,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA,EAAG;AACjC,QAAA;AAAA,MACF;AACA,MAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,EAAE,CAAA;AAEnB,MAAA,IAAI,SAAA,GAAY,YAAA,CAAa,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AAC1C,MAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,QAAA,IAAI;AACF,UAAA,IAAA,CAAK,UAAA,GAAa,MAAM,SAAA,CAAU,MAAA,CAAO;AAAA,YACvC,IAAA,EAAM,EAAE,GAAG,sBAAA,CAAuB,UAAU,MAAM,CAAA,EAAG,GAAG,IAAA,CAAK,IAAA,EAAK;AAAA,YAClE,QAAA,EAAU,gBAAA;AAAA,YACV,OAAA,EAAS,eAAA;AAAA,YACT,QAAA,EAAU;AAAA,WACX,CAAA;AAAA,QACH,SAAS,KAAA,EAAO;AACd,UAAA,OAAA,CAAQ,KAAK,gCAAA,EAA6B,IAAA,CAAK,IAAA,EAAM,IAAA,CAAK,IAAI,KAAK,CAAA;AAAA,QACrE;AAAA,MACF;AAEA,MAAA,IAAI,WAAW,IAAA,CAAK,QAAA;AACpB,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,EAAG;AAC3B,QAAA,IAAI,iBAAiB,QAAA,CAAS,MAAA;AAAA,UAC5B;AAAA,SACF;AACA,QAAA,IAAI,eAAe,MAAA,EAAQ;AACzB,UAAA,MAAM,KAAK,cAAc,CAAA;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,KAAK,KAAK,CAAA;AAChB,EAAA,OAAO,IAAA;AACT;;;ACjIA,SAAS,MAAM,KAAA,EAA0B;AACvC,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,IAAI,GAAA,CAAI,KAAA,EAAO,kBAAkB,CAAA,GAAI,KAAA;AAC1E;AAEA,SAAS,2BACP,OAAA,EACiB;AACjB,EAAA,IAAI,SAAS,YAAA,EAAc;AACzB,IAAA,OAAO,IAAI,eAAA,CAAgB,OAAA,CAAQ,YAAY,CAAA;AAAA,EACjD;AAEA,EAAA,IAAI,SAAS,GAAA,EAAK;AAChB,IAAA,IAAI,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA;AAC3B,IAAA,OAAO,IAAI,eAAA,CAAgB,GAAA,CAAI,YAAY,CAAA;AAAA,EAC7C;AAEA,EAAA,OAAO,IAAI,eAAA,EAAgB;AAC7B;AAEA,SAAS,uBAAuB,OAAA,EAA8C;AAC5E,EAAA,IAAI,SAAS,QAAA,EAAU;AACrB,IAAA,OAAO,OAAA,CAAQ,QAAA;AAAA,EACjB;AAEA,EAAA,IAAI,SAAS,GAAA,EAAK;AAChB,IAAA,IAAI,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA;AAC3B,IAAA,OAAO,IAAI,QAAA,IAAY,GAAA;AAAA,EACzB;AAEA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,iBAAiB,KAAA,EAAiC;AACzD,EAAA,IAAI,UAAU,MAAA,EAAQ;AACpB,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,UAAU,OAAA,EAAS;AACrB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,cACP,YAAA,EACkC;AAClC,EAAA,IAAI,UAA4C,EAAC;AACjD,EAAA,KAAA,IAAS,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,YAAA,CAAa,SAAQ,EAAG;AAC/C,IAAA,OAAA,CAAQ,GAAG,CAAA,GAAI,gBAAA,CAAiB,KAAK,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,OAAA;AACT;AAEA,IAAM,uBAAA,uBAA8B,GAAA,CAAI;AAAA,EACtC,mBAAA;AAAA;AAAA;AAAA;AAAA,EAIA;AACF,CAAC,CAAA;AAED,SAAS,2BACP,OAAA,EACiB;AACjB,EAAA,IAAI,YAAA,GAAe,IAAI,eAAA,CAAgB,0BAAA,CAA2B,OAAO,CAAC,CAAA;AAC1E,EAAA,KAAA,IAAS,OAAO,uBAAA,EAAyB;AACvC,IAAA,YAAA,CAAa,OAAO,GAAG,CAAA;AAAA,EACzB;AACA,EAAA,OAAO,YAAA;AACT;AAOO,SAAS,6BACd,OAAA,EACyB;AACzB,EAAA,IAAI,YAAA,GAAe,2BAA2B,OAAO,CAAA;AACrD,EAAA,IAAI,MAAA,GAAS,aAAa,QAAA,EAAS;AAEnC,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,uBAAuB,OAAO,CAAA;AAAA,IACxC,MAAA,EAAQ,MAAA,GAAS,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,GAAK,EAAA;AAAA,IAChC,OAAA,EAAS,cAAc,YAAY,CAAA;AAAA,IACnC,GAAI,SAAS,IAAA,GAAO,EAAE,MAAM,OAAA,CAAQ,IAAA,KAAS,EAAC;AAAA,IAC9C,GAAI,SAAS,QAAA,GAAW,EAAE,UAAU,OAAA,CAAQ,QAAA,KAAa,EAAC;AAAA,IAC1D,GAAI,SAAS,MAAA,GAAS,EAAE,QAAQ,OAAA,CAAQ,MAAA,KAAW;AAAC,GACtD;AACF;ACrFO,IAAM,2BAAA,GAA8B;AAE3C,IAAM,+BAAA,GAAkC,GAAA;AAYjC,IAAM,2BAAA,GAA8B;AAAA,EACzC,mBAAA;AAAA,EACA,cAAA;AAAA,EACA,gBAAA;AAAA,EACA,iBAAA;AAAA,EACA,uBAAA;AAAA,EACA,iBAAA;AAAA,EACA,WAAA;AAAA,EACA,mBAAA;AAAA,EACA,qBAAA;AAAA,EACA;AACF,CAAA;AAGO,IAAM,uBAAA,GAA0B;AAAA,EACrC,SAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF;AAmDO,SAAS,2BAA2B,MAAA,EAAwB;AACjE,EAAA,IAAI,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAM,CAAA;AACvC,EAAA,IAAI,MAAA,GAAS,IAAI,GAAA,CAAI,2BAA2B,CAAA;AAChD,EAAA,KAAA,IAAS,GAAA,IAAO,CAAC,GAAG,IAAI,IAAI,MAAA,CAAO,IAAA,EAAM,CAAC,CAAA,EAAG;AAC3C,IAAA,IAAI,MAAA,CAAO,GAAA,CAAI,GAAA,CAAI,WAAA,EAAa,CAAA,EAAG;AACjC,MAAA,MAAA,CAAO,OAAO,GAAG,CAAA;AAAA,IACnB;AAAA,EACF;AACA,EAAA,IAAI,UAAA,GAAa,OAAO,QAAA,EAAS;AACjC,EAAA,OAAO,UAAA,GAAa,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA,GAAK,EAAA;AACzC;AAQO,SAAS,wCACd,WAAA,EACgD;AAChD,EAAA,IACE,CAAC,eACD,OAAO,WAAA,CAAY,aAAa,QAAA,IAChC,CAAC,YAAY,QAAA,EACb;AACA,IAAA;AAAA,EACF;AAEA,EAAA,IAAI,YAAA,GAAmD;AAAA,IACrD,UAAU,WAAA,CAAY,QAAA;AAAA,IACtB,MAAA,EAAQ,0BAAA,CAA2B,WAAA,CAAY,MAAA,IAAU,EAAE;AAAA,GAC7D;AAEA,EAAA,IAAI,EAAE,MAAK,GAAI,WAAA;AACf,EAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACpC,IAAA,IAAI,SAAiC,EAAC;AACtC,IAAA,KAAA,IAAS,OAAO,uBAAA,EAAyB;AACvC,MAAA,IAAI,KAAA,GAAQ,KAAK,GAAG,CAAA;AACpB,MAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AAAA,MAChB;AAAA,IACF;AACA,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,MAAA,EAAQ;AAC9B,MAAA,YAAA,CAAa,IAAA,GAAO,MAAA;AAAA,IACtB;AAAA,EACF;AAEA,EAAA,IACE,YAAY,QAAA,IACZ,cAAA,CAAe,UAAU,WAAA,CAAY,QAAQ,EAAE,OAAA,EAC/C;AACA,IAAA,YAAA,CAAa,WAAW,WAAA,CAAY,QAAA;AAAA,EACtC;AAEA,EAAA,IACE,OAAO,YAAY,MAAA,KAAW,QAAA,IAC9B,YAAY,MAAA,IACZ,WAAA,CAAY,MAAA,CAAO,MAAA,IAAU,+BAAA,EAC7B;AACA,IAAA,YAAA,CAAa,SAAS,WAAA,CAAY,MAAA;AAAA,EACpC;AAEA,EAAA,OAAO,YAAA;AACT;AAeA,eAAsB,0BAAA,CACpB,OAAA,EACA,SAAA,EACA,QAAA,GAAmB,2BAAA,EACJ;AACf,EAAA,IAAI,QAAA,GAAW,OAAA,CAAQ,aAAA,CAAc,GAAA,CAAI,UAAU,EAAE,CAAA;AACrD,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,2CAAA,EAA8C,UAAU,EAAE,CAAA,EAAA;AAAA,KAC5D;AAAA,EACF;AAIA,EAAA,IAAI,YAAA,GAAe,uCAAA;AAAA,IACjB,OAAA,CAAQ;AAAA,GACV;AACA,EAAA,IAAI,OAAO,YAAA,GAAe,EAAE,WAAW,YAAA,EAAa,GAAI,EAAE,SAAA,EAAU;AAEpE,EAAA,IAAI,QAAA,GAAW,MAAM,KAAA,CAAM,QAAA,EAAU;AAAA,IACnC,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,IAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI;AAAA,GAC1B,CAAA;AACD,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,8CAAA,EAAiD,SAAS,MAAM,CAAA,CAAA;AAAA,KAClE;AAAA,EACF;AAEA,EAAA,IAAI,EAAE,UAAA,EAAW,GAAK,MAAM,SAAS,IAAA,EAAK;AAK1C,EAAA,QAAA,CAAS,OAAA,CAAQ,EAAE,UAAA,EAAY,UAAA,IAAc,MAAM,CAAA;AACrD;;;AC5JA,SAAS,oBAAoB,GAAA,EAAwC;AACnE,EAAA,OAAO,OAAA,CAAQ,KAAK,KAAA,IAAS,GAAA,EAAK,eAAe,GAAA,EAAK,KAAA,IAAS,KAAK,IAAI,CAAA;AAC1E;AAEA,SAAS,kBAAkB,GAAA,EAAsC;AAC/D,EAAA,OAAO,OAAA,CAAQ,KAAK,KAAA,IAAS,GAAA,EAAK,eAAe,GAAA,EAAK,KAAA,IAAS,KAAK,QAAQ,CAAA;AAC9E;AAEA,SAAS,qBACP,QAAA,EACmC;AACnC,EAAA,OAAO,QAAA,KAAa,wBAAwB,qBAAA,GAAwB,SAAA;AACtE;AAQA,SAAS,uBACP,IAAA,EACmD;AACnD,EAAA,IAAI,IAAA,KAAS,SAAA,IAAa,IAAA,KAAS,SAAA,IAAa,SAAS,aAAA,EAAe;AACtE,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,SAAA;AACT;AAQO,SAAS,8BACd,GAAA,EACyB;AACzB,EAAA,IAAI,KAAA,GAAQ,GAAA,EAAK,MAAA,EAAQ,KAAA,KAAU,KAAA;AACnC,EAAA,IAAI,MAAA,GAAS,GAAA,EAAK,MAAA,EAAQ,MAAA,KAAW,KAAA;AACrC,EAAA,IAAI,QAAA,GAAoC;AAAA,IACtC,MAAA,EAAQ,EAAE,KAAA,EAAO,MAAA;AAAO,GAC1B;AAEA,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,IAAI,IAAI,KAAA,EAAO;AACb,IAAA,QAAA,CAAS,QAAQ,GAAA,CAAI,KAAA;AAAA,EACvB;AACA,EAAA,IAAI,IAAI,WAAA,EAAa;AACnB,IAAA,QAAA,CAAS,cAAc,GAAA,CAAI,WAAA;AAAA,EAC7B;AACA,EAAA,IAAI,IAAI,QAAA,EAAU;AAChB,IAAA,QAAA,CAAS,WAAW,GAAA,CAAI,QAAA;AAAA,EAC1B;AACA,EAAA,IAAI,IAAI,YAAA,EAAc;AACpB,IAAA,QAAA,CAAS,UAAA,GAAa,EAAE,SAAA,EAAW,GAAA,CAAI,YAAA,EAAa;AAAA,EACtD;AAEA,EAAA,IAAI,YAAY,GAAA,CAAI,SAAA;AACpB,EAAA,IAAI,mBAAA,CAAoB,SAAS,CAAA,EAAG;AAClC,IAAA,QAAA,CAAS,SAAA,GAAY;AAAA,MACnB,OAAO,SAAA,EAAW,KAAA;AAAA,MAClB,aAAa,SAAA,EAAW,WAAA;AAAA,MACxB,QAAQ,SAAA,EAAW,KAAA,GAAQ,CAAC,SAAA,CAAU,KAAK,CAAA,GAAI,MAAA;AAAA,MAC/C,IAAA,EAAM,sBAAA,CAAuB,SAAA,EAAW,IAAI;AAAA,KAC9C;AAAA,EACF;AAEA,EAAA,IAAI,UAAU,GAAA,CAAI,OAAA;AAClB,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAK9B,IAAA,QAAA,CAAS,OAAA,GAAU;AAAA,MACjB,IAAA,EAAM,oBAAA,CAAqB,OAAA,EAAS,QAAQ,CAAA;AAAA,MAC5C,OAAO,OAAA,EAAS,KAAA;AAAA,MAChB,aAAa,OAAA,EAAS,WAAA;AAAA,MACtB,QAAQ,OAAA,EAAS,KAAA,GAAQ,CAAC,OAAA,CAAQ,KAAK,CAAA,GAAI;AAAA,KAC7C;AAAA,EACF;AAEA,EAAA,OAAO,QAAA;AACT;AAMO,SAAS,2BACd,IAAA,EACyB;AACzB,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO,8BAA8B,IAAI,CAAA;AAAA,EAC3C;AACA,EAAA,IAAI,OACF,OAAA,IAAW,IAAA,IAAQ,QAAQ,IAAA,GACtB,IAAA,GACC,KAAsC,IAAA,IAAQ,IAAA;AACtD,EAAA,OAAO,6BAAA,CAA8B,IAAA,EAAM,GAAA,IAAO,IAAI,CAAA;AACxD","file":"chunk-NL22OVD7.mjs","sourcesContent":["import type { SchemaType } from '@weaverse/schema'\nimport type { WeaverseNextThemeSchema } from './types'\n\n/**\n * Generate default component data from a schema's `settings` inputs.\n *\n * Mirrors Hydrogen's `generateDataFromSchema` (settings → `{ [name]:\n * defaultValue }`) but is kept local so `@weaverse/next` doesn't depend on\n * `@weaverse/hydrogen`. Falls back to the deprecated `inspector` array when a\n * schema predates `settings`.\n */\nexport function generateDataFromSchema(\n  schema: SchemaType | WeaverseNextThemeSchema | undefined\n): Record<string, unknown> {\n  let data: Record<string, unknown> = {}\n  if (!schema) {\n    return data\n  }\n\n  let groups =\n    (schema.settings as {\n      inputs?: { name?: string; defaultValue?: unknown }[]\n    }[]) ??\n    (schema as { inspector?: typeof groups }).inspector ??\n    []\n\n  for (let group of groups) {\n    for (let input of group?.inputs ?? []) {\n      let { name, defaultValue } = input\n      if (name && defaultValue !== null && defaultValue !== undefined) {\n        data[name] = defaultValue\n      }\n    }\n  }\n\n  return data\n}\n","import type {\n  WeaverseNextClient,\n  WeaverseNextCommerceContext,\n  WeaverseNextComponent,\n  WeaverseNextComponentData,\n  WeaverseNextLoaderData,\n  WeaverseNextRequestContext,\n} from './types'\nimport { generateDataFromSchema } from './utils'\n\n/** Inputs for running registered component loaders over a page tree. */\nexport interface RunComponentLoadersArgs {\n  /** Weaverse client containing the component registry. */\n  client: WeaverseNextClient\n  /** Request-scoped commerce override; defaults to `client.commerce`. */\n  commerce?: WeaverseNextCommerceContext\n  /** Request-context override; defaults to `client.requestContext`. */\n  context?: WeaverseNextRequestContext\n  /** Page payload to walk; defaults to `client.data`. */\n  data?: WeaverseNextLoaderData | null\n}\n\nfunction isItemNode(node: unknown): node is WeaverseNextComponentData {\n  return (\n    typeof node === 'object' &&\n    node !== null &&\n    typeof (node as WeaverseNextComponentData).type === 'string'\n  )\n}\n\nfunction cloneItem(item: WeaverseNextComponentData): WeaverseNextComponentData {\n  return {\n    ...item,\n    children: Array.isArray(item.children)\n      ? item.children.map((child) =>\n          isItemNode(child) ? cloneItem(child) : { ...child }\n        )\n      : item.children,\n  }\n}\n\n/**\n * Walk a serialized page tree and run each registered component's `loader`,\n * attaching the result to the item as `loaderData`.\n *\n * Loaders receive explicit `commerce.storefront` (and `weaverse.storefront` as\n * a compatibility alias via the client). Children are walked recursively when\n * they are inline item objects; flat `items` arrays are covered by the\n * top-level walk.\n *\n * @returns a cloned `data` object with `loaderData` attached to cloned items.\n */\nexport async function runWeaverseComponentLoaders(\n  args: RunComponentLoadersArgs\n): Promise<WeaverseNextLoaderData | null> {\n  let { client, context, commerce } = args\n  let sourceData = args.data ?? client.data\n  if (!sourceData) {\n    return null\n  }\n  if (!sourceData.page.items.length) {\n    return sourceData\n  }\n\n  let data: WeaverseNextLoaderData = {\n    ...sourceData,\n    page: {\n      ...sourceData.page,\n      items: sourceData.page.items.map(cloneItem),\n    },\n  }\n  let items = data.page.items\n\n  let componentMap = new Map<string, WeaverseNextComponent>()\n  for (let component of client.components) {\n    if (component?.schema?.type) {\n      componentMap.set(component.schema.type, component)\n    }\n  }\n\n  let visited = new Set<string>()\n  let resolvedContext = context ?? client.requestContext\n  let resolvedCommerce = commerce ?? client.commerce\n\n  // Per-call `weaverse` alias. When a request-scoped `commerce` is passed, the\n  // `weaverse.storefront` compatibility alias must resolve to *that* storefront,\n  // not the client's construction-time commerce. Pilot-style loaders call\n  // `weaverse.storefront.query(...)`, so a stale alias would query the wrong\n  // (or an undefined) storefront. When no override is given we reuse the client\n  // as-is to preserve its prototype getters.\n  let resolvedWeaverse: WeaverseNextClient =\n    resolvedCommerce === client.commerce\n      ? client\n      : {\n          ...client,\n          commerce: resolvedCommerce,\n          storefront: resolvedCommerce?.storefront,\n        }\n\n  async function walk(nodes: WeaverseNextComponentData[]) {\n    for (let item of nodes) {\n      if (!item || visited.has(item.id)) {\n        continue\n      }\n      visited.add(item.id)\n\n      let component = componentMap.get(item.type)\n      if (component?.loader) {\n        try {\n          item.loaderData = await component.loader({\n            data: { ...generateDataFromSchema(component.schema), ...item.data },\n            weaverse: resolvedWeaverse,\n            context: resolvedContext,\n            commerce: resolvedCommerce,\n          })\n        } catch (error) {\n          console.warn('❌ Item loader run failed.', item.type, item.id, error)\n        }\n      }\n\n      let children = item.children\n      if (Array.isArray(children)) {\n        let inlineChildren = children.filter(\n          isItemNode\n        ) as WeaverseNextComponentData[]\n        if (inlineChildren.length) {\n          await walk(inlineChildren)\n        }\n      }\n    }\n  }\n\n  await walk(items)\n  return data\n}\n","import type {\n  WeaverseNextRequestContext,\n  WeaverseNextRequestInfo,\n} from './types'\n\nfunction toUrl(value: string | URL): URL {\n  return typeof value === 'string' ? new URL(value, 'http://localhost') : value\n}\n\nfunction getSearchParamsFromContext(\n  context?: WeaverseNextRequestContext\n): URLSearchParams {\n  if (context?.searchParams) {\n    return new URLSearchParams(context.searchParams)\n  }\n\n  if (context?.url) {\n    let url = toUrl(context.url)\n    return new URLSearchParams(url.searchParams)\n  }\n\n  return new URLSearchParams()\n}\n\nfunction getPathnameFromContext(context?: WeaverseNextRequestContext): string {\n  if (context?.pathname) {\n    return context.pathname\n  }\n\n  if (context?.url) {\n    let url = toUrl(context.url)\n    return url.pathname || '/'\n  }\n\n  return '/'\n}\n\nfunction coerceQueryValue(value: string): string | boolean {\n  if (value === 'true') {\n    return true\n  }\n  if (value === 'false') {\n    return false\n  }\n  return value\n}\n\nfunction toQueryRecord(\n  searchParams: URLSearchParams\n): Record<string, string | boolean> {\n  let queries: Record<string, string | boolean> = {}\n  for (let [key, value] of searchParams.entries()) {\n    queries[key] = coerceQueryValue(value)\n  }\n  return queries\n}\n\nconst TRANSIENT_STUDIO_PARAMS = new Set([\n  'weaverseDraftItem',\n  // Legacy name from the original design-mode draft-item spike. Keep it out of\n  // runtime requestInfo too, in case an older Builder bundle is in front of a\n  // newer Next storefront.\n  '__weaverseDraftItem',\n])\n\nfunction getRequestInfoSearchParams(\n  context?: WeaverseNextRequestContext\n): URLSearchParams {\n  let searchParams = new URLSearchParams(getSearchParamsFromContext(context))\n  for (let key of TRANSIENT_STUDIO_PARAMS) {\n    searchParams.delete(key)\n  }\n  return searchParams\n}\n\n/**\n * Build the Hydrogen-like request info shape consumed by the Studio bridge.\n * Duplicate query keys keep the last value, matching `URLSearchParams` iteration\n * assignment and Hydrogen's practical query-object behavior.\n */\nexport function buildWeaverseNextRequestInfo(\n  context?: WeaverseNextRequestContext\n): WeaverseNextRequestInfo {\n  let searchParams = getRequestInfoSearchParams(context)\n  let search = searchParams.toString()\n\n  return {\n    pathname: getPathnameFromContext(context),\n    search: search ? `?${search}` : '',\n    queries: toQueryRecord(searchParams),\n    ...(context?.i18n ? { i18n: context.i18n } : {}),\n    ...(context?.pageType ? { pageType: context.pageType } : {}),\n    ...(context?.handle ? { handle: context.handle } : {}),\n  }\n}\n","import type { PageType } from '@weaverse/schema'\nimport { PageTypeSchema } from '@weaverse/schema'\nimport type {\n  WeaverseNextComponentData,\n  WeaverseNextI18n,\n  WeaverseNextRequestInfo,\n} from './types'\n\n/** Default App Router endpoint used for Studio item-loader revalidation. */\nexport const DEFAULT_REVALIDATE_ENDPOINT = '/api/weaverse/revalidate'\n\nconst MAX_ROUTE_CONTEXT_HANDLE_LENGTH = 512\n\n/**\n * Server-owned and transient controls stripped from the revalidation route\n * context on both sides of the trust boundary. Compared case-insensitively, so\n * every entry is stored lowercased. Client sanitization keeps normal traffic\n * clean; the route handler repeats this deny-list as the security boundary.\n *\n * - Server-owned: a crafted `?weaverseProjectId=`/`?weaverseHost=`/`?weaverseApiKey=`\n *   must never influence server config resolution (see `getWeaverseNextConfigs`).\n * - Transient: draft-item and RSC transport params never describe route identity.\n */\nexport const DENIED_ROUTE_CONTEXT_PARAMS = [\n  'weaverseprojectid',\n  'weaversehost',\n  'weaverseapikey',\n  'weaverseapibase',\n  'weaversepublicapibase',\n  'weaverseversion',\n  'projectid',\n  'weaversedraftitem',\n  '__weaversedraftitem',\n  '_rsc',\n]\n\n/** i18n fields allowed to cross the browser boundary. */\nexport const ROUTE_CONTEXT_I18N_KEYS = [\n  'country',\n  'label',\n  'language',\n  'locale',\n  'pathPrefix',\n] as const\n\n/**\n * JSON-safe route subset that may cross the browser boundary alongside the\n * draft item. Never carries headers, cookies, auth, env, project ID, Studio\n * host, API keys/bases, commerce clients, the request context, runtime, or\n * client. `search` is canonical (preserves duplicate keys); the derived\n * `queries` record is intentionally omitted.\n */\nexport interface WeaverseNextRevalidateRouteContext {\n  /** Route handle used for page assignment. */\n  handle?: string\n  /** Public locale and market identity allowed across the browser boundary. */\n  i18n?: Pick<\n    WeaverseNextI18n,\n    'country' | 'label' | 'language' | 'locale' | 'pathPrefix'\n  >\n  /** Weaverse page type resolved by the active route. */\n  pageType?: PageType\n  /** Canonical same-origin route pathname. */\n  pathname: string\n  /** Sanitized serialized query string, including the leading `?` when set. */\n  search: string\n}\n\n/**\n * Minimal runtime surface the in-place apply needs. Structural (not the\n * concrete `WeaverseNextRuntime` class) so unit tests can drive it with a\n * plain mock. `requestInfo` stays optional: a real `WeaverseNextRuntime`\n * always supplies it, but when absent the client omits `routeContext` and the\n * legacy `{ draftItem }` request is preserved.\n */\nexport interface RevalidateItemRuntimeLike {\n  /** Live item stores keyed by Weaverse item ID. */\n  itemInstances: Map<\n    string,\n    {\n      /** Merge refreshed loader data into the live item store. */\n      setData: (update: Record<string, unknown>) => unknown\n    }\n  >\n  /** Active route identity used to construct the optional revalidation payload. */\n  requestInfo?: WeaverseNextRequestInfo\n}\n\n/**\n * Strip denied (server-owned/transient) controls from a `search` string and\n * re-serialize it. Preserves ordinary application queries, duplicate keys,\n * encoded Unicode, and mode controls (`isDesignMode`, `isPreviewMode`,\n * `__revisionId`, `sectionType`). Returns `''` or a `?`-prefixed string.\n */\nexport function sanitizeRouteContextSearch(search: string): string {\n  let params = new URLSearchParams(search)\n  let denied = new Set(DENIED_ROUTE_CONTEXT_PARAMS)\n  for (let key of [...new Set(params.keys())]) {\n    if (denied.has(key.toLowerCase())) {\n      params.delete(key)\n    }\n  }\n  let serialized = params.toString()\n  return serialized ? `?${serialized}` : ''\n}\n\n/**\n * Build the sanitized {@link WeaverseNextRevalidateRouteContext} from the\n * active runtime's request info. Returns `undefined` without a usable pathname\n * so the caller omits `routeContext` and keeps the legacy request. This is not\n * the security boundary — the route handler re-validates and re-sanitizes.\n */\nexport function buildWeaverseNextRevalidateRouteContext(\n  requestInfo?: WeaverseNextRequestInfo\n): WeaverseNextRevalidateRouteContext | undefined {\n  if (\n    !requestInfo ||\n    typeof requestInfo.pathname !== 'string' ||\n    !requestInfo.pathname\n  ) {\n    return\n  }\n\n  let routeContext: WeaverseNextRevalidateRouteContext = {\n    pathname: requestInfo.pathname,\n    search: sanitizeRouteContextSearch(requestInfo.search ?? ''),\n  }\n\n  let { i18n } = requestInfo\n  if (i18n && typeof i18n === 'object') {\n    let picked: Record<string, string> = {}\n    for (let key of ROUTE_CONTEXT_I18N_KEYS) {\n      let value = i18n[key]\n      if (typeof value === 'string') {\n        picked[key] = value\n      }\n    }\n    if (Object.keys(picked).length) {\n      routeContext.i18n = picked\n    }\n  }\n\n  if (\n    requestInfo.pageType &&\n    PageTypeSchema.safeParse(requestInfo.pageType).success\n  ) {\n    routeContext.pageType = requestInfo.pageType\n  }\n\n  if (\n    typeof requestInfo.handle === 'string' &&\n    requestInfo.handle &&\n    requestInfo.handle.length <= MAX_ROUTE_CONTEXT_HANDLE_LENGTH\n  ) {\n    routeContext.handle = requestInfo.handle\n  }\n\n  return routeContext\n}\n\n/**\n * Studio per-item loader revalidation: POST the unsaved draft item (and, when\n * the runtime exposes route context, a sanitized `routeContext`) to the app's\n * revalidate route (see `createWeaverseNextRevalidateHandler`) and apply the\n * returned `loaderData` to the live item instance in place.\n *\n * No `router.refresh()` is involved, so the RSC tree is never re-applied — no\n * page remount, no scroll reset, and the draft payload never touches the URL.\n *\n * Throws on any failure (missing route, non-OK response, unknown item) so the\n * Builder Studio bridge can detect the miss and fall back to its legacy\n * refresh-based revalidation for this window.\n */\nexport async function revalidateWeaverseNextItem(\n  runtime: RevalidateItemRuntimeLike,\n  draftItem: WeaverseNextComponentData,\n  endpoint: string = DEFAULT_REVALIDATE_ENDPOINT\n): Promise<void> {\n  let instance = runtime.itemInstances.get(draftItem.id)\n  if (!instance) {\n    throw new Error(\n      `[weaverse-next] No live item instance for \"${draftItem.id}\".`\n    )\n  }\n\n  // Snapshot route identity at revalidation start so a later navigation cannot\n  // retarget this in-flight request. Omit `routeContext` for legacy runtimes.\n  let routeContext = buildWeaverseNextRevalidateRouteContext(\n    runtime.requestInfo\n  )\n  let body = routeContext ? { draftItem, routeContext } : { draftItem }\n\n  let response = await fetch(endpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(body),\n  })\n  if (!response.ok) {\n    throw new Error(\n      `[weaverse-next] Revalidate endpoint responded ${response.status}.`\n    )\n  }\n\n  let { loaderData } = (await response.json()) as { loaderData?: unknown }\n  // The item's settings were already mutated by the Studio edit; only the\n  // loader payload needs applying. `setData` merges and notifies subscribers,\n  // and the new `loaderData` identity is what Builder's revalidation poll\n  // observes for completion.\n  instance.setData({ loaderData: loaderData ?? null })\n}\n","import type { PageSEOData } from '@weaverse/schema'\nimport type { Metadata } from 'next'\nimport type { WeaverseNextLoaderData, WeaverseNextPageData } from './types'\n\n/** Object containing an optional Weaverse page for SEO extraction. */\nexport interface WeaverseNextSeoPageContainer {\n  /** Page whose published SEO fields should be formatted. */\n  page?: WeaverseNextPageData | null\n}\n\n/** Input accepted by {@link getWeaverseNextSeoMetadata}. */\nexport type WeaverseNextSeoInput =\n  | WeaverseNextLoaderData\n  | WeaverseNextPageData\n  | WeaverseNextSeoPageContainer\n  | null\n  | undefined\n\n/** Open Graph metadata accepted by Next.js's `Metadata` API. */\nexport type NextOpenGraph = NonNullable<Metadata['openGraph']>\n\n/** Twitter card metadata accepted by Next.js's `Metadata` API. */\nexport type NextTwitter = NonNullable<Metadata['twitter']>\n\n/**\n * Weaverse page SEO expressed as a subset of Next's `Metadata`. Assignable to\n * `Metadata` as-is: `const metadata: Metadata = getWeaverseNextSeoMetadata(data)`.\n */\nexport interface WeaverseNextSeoMetadata {\n  /** Canonical URL settings for Next's metadata API. */\n  alternates?: {\n    /** Preferred URL for search indexing. */\n    canonical?: string\n  }\n  /** Page meta description. */\n  description?: string\n  /** Page meta keywords. */\n  keywords?: string\n  /** Open Graph metadata normalized to Next's supported union. */\n  openGraph?: NextOpenGraph\n  /** Search crawler indexing and link-following directives. */\n  robots: {\n    /** Whether crawlers may follow links on the page. */\n    follow: boolean\n    /** Whether crawlers may index the page. */\n    index: boolean\n  }\n  /** Page title. */\n  title?: string\n  /** Twitter card metadata normalized for Next's metadata API. */\n  twitter?: NextTwitter\n}\n\nfunction hasOpenGraphContent(seo: PageSEOData['openGraph']): boolean {\n  return Boolean(seo?.title || seo?.description || seo?.image || seo?.type)\n}\n\nfunction hasTwitterContent(seo: PageSEOData['twitter']): boolean {\n  return Boolean(seo?.title || seo?.description || seo?.image || seo?.cardType)\n}\n\nfunction normalizeTwitterCard(\n  cardType: NonNullable<PageSEOData['twitter']>['cardType']\n): 'summary' | 'summary_large_image' {\n  return cardType === 'summary_large_image' ? 'summary_large_image' : 'summary'\n}\n\n/**\n * Map a Builder Open Graph type onto Next's `OpenGraphType` union. Every\n * Builder value except `product` exists in Next's union and is preserved\n * verbatim; `product` is not modeled by Next and makes `generateMetadata()`\n * throw, so it degrades to `website` — the closest renderable equivalent.\n */\nfunction normalizeOpenGraphType(\n  type: NonNullable<PageSEOData['openGraph']>['type']\n): 'article' | 'profile' | 'video.other' | 'website' {\n  if (type === 'article' || type === 'profile' || type === 'video.other') {\n    return type\n  }\n  return 'website'\n}\n\n/**\n * Convert Builder SEO fields into metadata accepted by Next.js.\n *\n * Unsupported Open Graph product types and incomplete Twitter app/player\n * cards are safely downgraded to renderable Next.js variants.\n */\nexport function formatWeaverseNextSeoMetadata(\n  seo: PageSEOData | null | undefined\n): WeaverseNextSeoMetadata {\n  let index = seo?.robots?.index !== false\n  let follow = seo?.robots?.follow !== false\n  let metadata: WeaverseNextSeoMetadata = {\n    robots: { index, follow },\n  }\n\n  if (!seo) {\n    return metadata\n  }\n\n  if (seo.title) {\n    metadata.title = seo.title\n  }\n  if (seo.description) {\n    metadata.description = seo.description\n  }\n  if (seo.keywords) {\n    metadata.keywords = seo.keywords\n  }\n  if (seo.canonicalUrl) {\n    metadata.alternates = { canonical: seo.canonicalUrl }\n  }\n\n  let openGraph = seo.openGraph\n  if (hasOpenGraphContent(openGraph)) {\n    metadata.openGraph = {\n      title: openGraph?.title,\n      description: openGraph?.description,\n      images: openGraph?.image ? [openGraph.image] : undefined,\n      type: normalizeOpenGraphType(openGraph?.type),\n    }\n  }\n\n  let twitter = seo.twitter\n  if (hasTwitterContent(twitter)) {\n    // Builder does not collect the descriptors Next requires for `app` cards\n    // (Next throws when they are missing) or `player` cards (which render an\n    // empty, useless card without a player URL and dimensions). Downgrade both\n    // to `summary` rather than emitting metadata Next cannot render.\n    metadata.twitter = {\n      card: normalizeTwitterCard(twitter?.cardType),\n      title: twitter?.title,\n      description: twitter?.description,\n      images: twitter?.image ? [twitter.image] : undefined,\n    }\n  }\n\n  return metadata\n}\n\n/**\n * Read page SEO from loader data or a page payload and format it for Next.js\n * `generateMetadata`. Missing data returns indexable/followable robot defaults.\n */\nexport function getWeaverseNextSeoMetadata(\n  data: WeaverseNextSeoInput\n): WeaverseNextSeoMetadata {\n  if (!data) {\n    return formatWeaverseNextSeoMetadata(null)\n  }\n  let page =\n    'items' in data && 'id' in data\n      ? (data as WeaverseNextPageData)\n      : ((data as WeaverseNextSeoPageContainer).page ?? null)\n  return formatWeaverseNextSeoMetadata(page?.seo ?? null)\n}\n"]}

package/dist/index.js

@@ -54,6 +54,7 @@ var WeaverseNextItem = class extends react.WeaverseItemStore {
   _cachedSnapshot = null;
   _snapshotStoreRef = null;
   _snapshotTranslationRef = null;
+  /** Create an item store from serialized component data and its runtime. */
   constructor(initialData, weaverse) {
     super(initialData, weaverse);
     let schemaData = generateDataFromSchema(this.Element?.schema);
@@ -319,18 +320,24 @@ var useThemeText = useTranslation;
 
 // src/translation-store.ts
 var TranslationStore = class {
+  /** Current flat translation overrides keyed by dot path. */
   overrides = {};
   listeners = /* @__PURE__ */ new Set();
+  /** Replace every override and notify subscribers. */
   setOverrides = (overrides) => {
     this.overrides = { ...overrides };
     this.emit();
   };
+  /** Merge changed overrides into the current values and notify subscribers. */
   updateOverrides = (newOverrides) => {
     this.overrides = { ...this.overrides, ...newOverrides };
     this.emit();
   };
+  /** Return the current client-side override snapshot. */
   getSnapshot = () => this.overrides;
+  /** Return the override snapshot used during server rendering. */
   getServerSnapshot = () => this.overrides;
+  /** Subscribe to override changes and return an unsubscribe function. */
   subscribe = (callback) => {
     this.listeners.add(callback);
     return () => {
@@ -648,7 +655,9 @@ function buildWeaverseNextRequestInfo(context) {
     pathname: getPathnameFromContext(context),
     search: search ? `?${search}` : "",
     queries: toQueryRecord(searchParams),
-    ...context?.i18n ? { i18n: context.i18n } : {}
+    ...context?.i18n ? { i18n: context.i18n } : {},
+    ...context?.pageType ? { pageType: context.pageType } : {},
+    ...context?.handle ? { handle: context.handle } : {}
   };
 }
 
@@ -714,11 +723,17 @@ function rebindPageItemsToRuntime(runtime) {
   }
 }
 var WeaverseNextRuntime = class extends react.Weaverse {
+  /** Stable ID of the page owned by this runtime. */
   pageId;
+  /** Mutable callbacks and stores consumed by the Studio bridge. */
   internal;
+  /** Path, query, and locale metadata for Studio navigation. */
   requestInfo;
+  /** Whether this runtime renders a component preview. */
   isPreviewMode;
+  /** Whether this runtime renders a saved revision. */
   isRevisionPreview;
+  /** Component type rendered in section preview mode. */
   sectionType;
   // ─── Item-level translation sidecar (design mode only) ─────────────
   /**
@@ -727,7 +742,9 @@ var WeaverseNextRuntime = class extends react.Weaverse {
    * components, so translations render without mutating the base `_store`.
    */
   translationMap = {};
+  /** Locale associated with the item-level translation sidecar. */
   translationLocale = String();
+  /** Weaverse language ID used when saving translation changes. */
   translationLanguageId = String();
   /**
    * Fresh page data captured while React was rendering. Runtime reuse happens
@@ -745,6 +762,7 @@ var WeaverseNextRuntime = class extends react.Weaverse {
    * deferred to `flushRenderPhaseUpdates()`.
    */
   pendingItemUpdates = [];
+  /** Create a browser runtime from a loaded page and its request context. */
   constructor(config) {
     let { client, data } = config;
     let page = getRenderablePage(data);
@@ -966,9 +984,67 @@ function bindWeaverseNextStudioRuntime(runtime) {
   });
   return true;
 }
-
-// src/revalidate-item.ts
 var DEFAULT_REVALIDATE_ENDPOINT = "/api/weaverse/revalidate";
+var MAX_ROUTE_CONTEXT_HANDLE_LENGTH = 512;
+var DENIED_ROUTE_CONTEXT_PARAMS = [
+  "weaverseprojectid",
+  "weaversehost",
+  "weaverseapikey",
+  "weaverseapibase",
+  "weaversepublicapibase",
+  "weaverseversion",
+  "projectid",
+  "weaversedraftitem",
+  "__weaversedraftitem",
+  "_rsc"
+];
+var ROUTE_CONTEXT_I18N_KEYS = [
+  "country",
+  "label",
+  "language",
+  "locale",
+  "pathPrefix"
+];
+function sanitizeRouteContextSearch(search) {
+  let params = new URLSearchParams(search);
+  let denied = new Set(DENIED_ROUTE_CONTEXT_PARAMS);
+  for (let key of [...new Set(params.keys())]) {
+    if (denied.has(key.toLowerCase())) {
+      params.delete(key);
+    }
+  }
+  let serialized = params.toString();
+  return serialized ? `?${serialized}` : "";
+}
+function buildWeaverseNextRevalidateRouteContext(requestInfo) {
+  if (!requestInfo || typeof requestInfo.pathname !== "string" || !requestInfo.pathname) {
+    return;
+  }
+  let routeContext = {
+    pathname: requestInfo.pathname,
+    search: sanitizeRouteContextSearch(requestInfo.search ?? "")
+  };
+  let { i18n } = requestInfo;
+  if (i18n && typeof i18n === "object") {
+    let picked = {};
+    for (let key of ROUTE_CONTEXT_I18N_KEYS) {
+      let value = i18n[key];
+      if (typeof value === "string") {
+        picked[key] = value;
+      }
+    }
+    if (Object.keys(picked).length) {
+      routeContext.i18n = picked;
+    }
+  }
+  if (requestInfo.pageType && schema.PageTypeSchema.safeParse(requestInfo.pageType).success) {
+    routeContext.pageType = requestInfo.pageType;
+  }
+  if (typeof requestInfo.handle === "string" && requestInfo.handle && requestInfo.handle.length <= MAX_ROUTE_CONTEXT_HANDLE_LENGTH) {
+    routeContext.handle = requestInfo.handle;
+  }
+  return routeContext;
+}
 async function revalidateWeaverseNextItem(runtime, draftItem, endpoint = DEFAULT_REVALIDATE_ENDPOINT) {
   let instance = runtime.itemInstances.get(draftItem.id);
   if (!instance) {
@@ -976,10 +1052,14 @@ async function revalidateWeaverseNextItem(runtime, draftItem, endpoint = DEFAULT
       `[weaverse-next] No live item instance for "${draftItem.id}".`
     );
   }
+  let routeContext = buildWeaverseNextRevalidateRouteContext(
+    runtime.requestInfo
+  );
+  let body = routeContext ? { draftItem, routeContext } : { draftItem };
   let response = await fetch(endpoint, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ draftItem })
+    body: JSON.stringify(body)
   });
   if (!response.ok) {
     throw new Error(
@@ -1268,7 +1348,7 @@ function resolveWeaverseNextStudioScriptSrc(context, options = {}) {
   if (!isTrustedStudioOrigin(origin, storefrontHostname)) {
     return null;
   }
-  let bundle = isDesignMode ? "index.js" : "preview.js";
+  let bundle = isPreviewMode || isRevisionPreview ? "preview.js" : "index.js";
   let version = last(searchParams, "weaverseVersion");
   let url = `${origin}/static/studio/next/${bundle}`;
   return version ? `${url}?v=${encodeURIComponent(version)}` : url;
@@ -1356,6 +1436,7 @@ exports.WeaverseNextStudioBridge = WeaverseNextStudioBridge;
 exports.WeaverseNextStudioConnect = WeaverseNextStudioConnect;
 exports.bindWeaverseNextStudioRuntime = bindWeaverseNextStudioRuntime;
 exports.buildWeaverseNextRequestInfo = buildWeaverseNextRequestInfo;
+exports.buildWeaverseNextRevalidateRouteContext = buildWeaverseNextRevalidateRouteContext;
 exports.createTranslate = createTranslate;
 exports.createWeaverseNextClient = createWeaverseNextClient;
 exports.createWeaverseNextRuntime = createWeaverseNextRuntime;