@weaverse/next 0.1.0-alpha.16 → 0.1.0-alpha.17

package/package.json

@@ -2,7 +2,7 @@
   "name": "@weaverse/next",
   "author": "Weaverse Team",
   "description": "Next.js App Router integration for building Weaverse-powered storefronts",
-  "version": "0.1.0-alpha.16",
+  "version": "0.1.0-alpha.17",
   "license": "MIT",
   "main": "dist/index.js",
   "typings": "dist/types/index.d.ts",
@@ -62,11 +62,11 @@
     ]
   },
   "dependencies": {
-    "@weaverse/react": "5.16.4",
-    "@weaverse/schema": "0.10.0"
+    "@weaverse/react": "5.20.3",
+    "@weaverse/schema": "0.14.0"
   },
   "devDependencies": {
-    "next": "16.2.9"
+    "next": "16.3.4"
   },
   "peerDependencies": {
     "next": ">=14",

package/src/client.ts

@@ -1,3 +1,4 @@
+import type { SchemaType } from '@weaverse/schema'
 import { registerWeaverseNextComponents } from './registry'
 import type {
   WeaverseNextClient,
@@ -24,7 +25,7 @@ import { generateDataFromSchema } from './utils'
 class NextClient implements WeaverseNextClient {
   projectId: string
   components: WeaverseNextComponent[]
-  themeSchema?: WeaverseNextThemeSchema
+  themeSchema?: SchemaType | WeaverseNextThemeSchema
   themeSettings: Record<string, unknown>
   requestContext?: WeaverseNextRequestContext
   commerce?: WeaverseNextCommerceContext

package/src/revalidate-item.ts

@@ -17,8 +17,9 @@ const MAX_ROUTE_CONTEXT_HANDLE_LENGTH = 512
  * every entry is stored lowercased. Client sanitization keeps normal traffic
  * clean; the route handler repeats this deny-list as the security boundary.
  *
- * - Server-owned: a crafted `?weaverseProjectId=`/`?weaverseHost=`/`?weaverseApiKey=`
- *   must never influence server config resolution (see `getWeaverseNextConfigs`).
+ * - Server-owned: a crafted `?weaverseProjectId=`/`?weaverseHost=` must never
+ *   influence server config resolution (see `getWeaverseNextConfigs`), and
+ *   credential-shaped params never ride along in route context.
  * - Transient: draft-item and RSC transport params never describe route identity.
  */
 export const DENIED_ROUTE_CONTEXT_PARAMS = [

package/src/root-provider.tsx

@@ -1,5 +1,6 @@
 'use client'
 
+import type { SchemaType } from '@weaverse/schema'
 import {
   createContext,
   type ReactNode,
@@ -60,7 +61,7 @@ export interface WeaverseNextRootProviderProps {
   /** Optional external translation function (host i18n); highest priority in `t()`. */
   t?: TranslateFunction
   /** Theme schema associated with the initial settings. */
-  themeSchema?: WeaverseNextThemeSchema
+  themeSchema?: SchemaType | WeaverseNextThemeSchema
 }
 
 /**

package/src/server/configs.ts

@@ -160,10 +160,6 @@ export function getWeaverseNextConfigs(
     envProjectId: readEnv(env, 'WEAVERSE_PROJECT_ID') || '',
     weaverseHost,
     weaverseApiBase,
-    weaverseApiKey:
-      lastParam(searchParams, 'weaverseApiKey') ||
-      readEnv(env, 'WEAVERSE_API_KEY') ||
-      '',
     weaverseVersion:
       lastParam(searchParams, 'weaverseVersion') ||
       options.weaverseVersion ||

package/src/server/server-client.ts

@@ -1,3 +1,4 @@
+import type { SchemaType } from '@weaverse/schema'
 import { runWeaverseComponentLoaders } from '../loader'
 import { buildWeaverseNextRequestInfo } from '../request-info'
 import type {
@@ -105,7 +106,7 @@ class NextServerClient implements WeaverseNextServerClient {
   components: WeaverseNextComponent[]
   commerce?: WeaverseNextCommerceContext
   requestContext?: WeaverseNextRequestContext
-  themeSchema?: WeaverseNextThemeSchema
+  themeSchema?: SchemaType | WeaverseNextThemeSchema
   themeSettings: Record<string, unknown>
   data: WeaverseNextLoaderData | null = null
   dataContext: Record<string, unknown> = {}

package/src/theme-settings-store.ts

@@ -1,3 +1,4 @@
+import type { SchemaType } from '@weaverse/schema'
 import type {
   WeaverseNextThemeSchema,
   WeaverseNextThemeSettingsStore,
@@ -8,7 +9,7 @@ export interface CreateWeaverseNextThemeSettingsStoreOptions {
   /** Public environment values exposed alongside the store. */
   publicEnv?: Record<string, string | undefined>
   /** Theme schema associated with the settings. */
-  schema?: WeaverseNextThemeSchema
+  schema?: SchemaType | WeaverseNextThemeSchema
   /** Initial setting values. */
   settings?: Record<string, unknown>
 }

package/src/types.ts

@@ -36,7 +36,7 @@ export interface WeaverseNextThemeSettingsStore {
   /** Public environment values exposed with the theme settings. */
   publicEnv?: Record<string, string | undefined>
   /** Theme schema associated with this store. */
-  schema?: WeaverseNextThemeSchema
+  schema?: SchemaType | WeaverseNextThemeSchema
   /** Current merged theme-setting values. */
   settings: Record<string, unknown>
   /** Subscribe to setting changes and return an unsubscribe function. */
@@ -474,7 +474,7 @@ export interface WeaverseNextClientConfig {
   /** Request metadata passed to component loaders and the runtime. */
   requestContext?: WeaverseNextRequestContext
   /** Theme schema used to derive default settings. */
-  themeSchema?: WeaverseNextThemeSchema
+  themeSchema?: SchemaType | WeaverseNextThemeSchema
   /** Merchant theme settings merged over schema defaults. */
   themeSettings?: Record<string, unknown>
 }
@@ -506,7 +506,7 @@ export interface WeaverseNextClient {
   /** Compatibility alias for `commerce.storefront`. */
   storefront?: WeaverseNextStorefront
   /** Theme schema used by the current project. */
-  themeSchema?: WeaverseNextThemeSchema
+  themeSchema?: SchemaType | WeaverseNextThemeSchema
   /** Theme settings with schema defaults applied. */
   themeSettings: Record<string, unknown>
 }
@@ -557,8 +557,8 @@ export interface WeaverseNextFetchOptions extends RequestInit {
 
 /**
  * Public, client-safe Weaverse config bundle. Mirrors Hydrogen's
- * `WeaverseProjectConfigs` minus server secrets — `weaverseApiKey` is never
- * included so it cannot leak into serialized loader data.
+ * `WeaverseProjectConfigs`, restricted to the fields that are safe to serialize
+ * into loader data.
  */
 export interface WeaverseNextConfigs {
   /** Whether the request is rendered inside Builder Studio. */
@@ -584,9 +584,9 @@ export interface WeaverseNextConfigs {
 }
 
 /**
- * Resolved base configs derived from request context + env. Includes the
- * server-only `weaverseApiKey`, so this stays internal to the server client and
- * is never serialized into loader data.
+ * Resolved base configs derived from request context + env. Internal to the
+ * server client; the client-facing subset is built explicitly by
+ * `_buildPublicConfigs` and never includes anything beyond it.
  */
 export interface WeaverseNextBaseConfigs {
   /** Project ID read from `WEAVERSE_PROJECT_ID`. */
@@ -605,8 +605,6 @@ export interface WeaverseNextBaseConfigs {
   sectionType: string
   /** Base URL used for public Weaverse data requests. */
   weaverseApiBase: string
-  /** Server-only API key read from the request or environment. */
-  weaverseApiKey: string
   /** Trusted Studio origin. */
   weaverseHost: string
   /** Studio asset version requested by Builder. */
@@ -624,7 +622,7 @@ export interface WeaverseNextThemeSettingsResponse {
   /** Environment values safe to expose to the browser in design mode. */
   publicEnv?: Record<string, string | undefined>
   /** Serializable theme schema returned in design mode. */
-  schema?: WeaverseNextThemeSchema
+  schema?: SchemaType | WeaverseNextThemeSchema
   /** Default-locale static content from the theme schema. */
   staticContent?: Record<string, unknown>
   /** Theme-setting values with schema defaults applied. */
@@ -690,7 +688,7 @@ export interface WeaverseNextServerClientConfig {
   /** Explicit request metadata used for config and page resolution. */
   requestContext?: WeaverseNextRequestContext
   /** Theme schema used to derive default settings and preview data. */
-  themeSchema?: WeaverseNextThemeSchema
+  themeSchema?: SchemaType | WeaverseNextThemeSchema
   /** Merchant theme settings merged over schema defaults. */
   themeSettings?: Record<string, unknown>
   /** Optional override for the resolved Weaverse public API base. */