---
package: "@webjsdev/server"
version: 0.7.0
date: 2026-05-21T04:25:09+05:30
commit_count: 6
---
## Features

- **drop webjs.conventions.js + legacy fallbacks, only support pkg.webjs.conventions** [`81bdf7c`](https://github.com/webjsdev/webjs/commit/81bdf7c)
  loadOverrides now reads exactly one place: package.json
  "webjs": { "conventions": { … } }. Returns {} when the key is
  absent (every default rule active). Removes the old top-level
  "conventions" fallback, the webjs.conventions.js file path, and
- **WEBJS_PUBLIC_* env vars accessible as process.env.* in browser** [`60eed0e`](https://github.com/webjsdev/webjs/commit/60eed0e)
  Adds an SSR-injected inline script that defines window.process.env
  with all server-side env vars whose name starts with WEBJS_PUBLIC_,
  plus NODE_ENV based on dev/prod mode. Counterpart of Next.js's
  NEXT_PUBLIC_ convention, without a build step.
- **no-server-env-in-components lint rule** [`a0dc926`](https://github.com/webjsdev/webjs/commit/a0dc926)
  Flags process.env.X reads in component files where X is not
  WEBJS_PUBLIC_* and not NODE_ENV. The SSR shim only exposes
  those two categories to the browser; any other read either
  leaks a secret into the SSR'd HTML or reads as undefined
- **split .server.ts source-protection from 'use server' RPC marker** [`41a61bb`](https://github.com/webjsdev/webjs/commit/41a61bb)
  The two markers are now complementary instead of interchangeable:
  
    .server.{js,ts}        path-level boundary: file router refuses to
                           serve the source to the browser.
- **add use-server-needs-extension lint rule** [`7e543a6`](https://github.com/webjsdev/webjs/commit/7e543a6)
  The rule catches files that declare `'use server'` at the top but
  lack the `.server.{js,ts,mts,mjs}` extension. Under the two-marker
  convention, the directive alone is silently ignored: the file serves
  to the browser as plain source, exports are not registered as RPC,

## Fixes

- **remove no-server-imports-in-components lint rule entirely** [`2bca0dd`](https://github.com/webjsdev/webjs/commit/2bca0dd)
  The convention 'server-only code goes in .server.ts, route.ts, or
  middleware.ts; never in pages, layouts, or components' is real
  and important, but pure static lint enforcement is the wrong
  mechanism:
