@rebuy/rebuy 2.31.0 → 2.32.0-rc.1

package/dist/server/index.d.ts

@@ -12,6 +12,6 @@ export { fetchUserConfig } from '../server/userConfig';
 export { validateGifts } from '../server/giftValidation';
 export { fetchMonetizeOffers, type MonetizeOffers } from '../server/monetizeOffers';
 export { postAnalyticsEvents, translateAnalyticsEvent, type CabAnalyticsEventName } from '../server/analytics';
-export { AnalyticsEventInputSchema, AnalyticsInputSchema, CartInputSchema, CartLineInputSchema, DataSourceInputSchema, GiftInputSchema, GiftValidationInputSchema, MonetizeInputSchema, MonetizeTransactionItemSchema, UserConfigInputSchema, WidgetSettingsInputSchema, } from '../server/requestSchemas';
+export { AnalyticsEventInputSchema, AnalyticsInputSchema, CartInputSchema, CartLineInputSchema, DataSourceInputSchema, GiftInputSchema, GiftValidationInputSchema, MonetizeInputSchema, MonetizeTransactionItemSchema, REQUEST_BOUNDS, UserConfigInputSchema, WidgetSettingsInputSchema, } from '../server/requestSchemas';
 export { NotFoundError, REBUY_ENGINE_HOST, UpstreamError, type AnalyticsEventInput, type AnalyticsInput, type CartInput, type CartLineInput, type DataSourceInput, type GiftInput, type GiftValidationInput, type MonetizeInput, type MonetizeTransactionItem, type ServerContext, type ServerDrift, type UpstreamFetch, type UserConfigInput, type WidgetSettingsInput, } from '../server/shared';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/G,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC9G,OAAO,EACH,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,yBAAyB,EACzB,mBAAmB,EACnB,6BAA6B,EAC7B,qBAAqB,EACrB,yBAAyB,GAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACH,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,mBAAmB,GAC3B,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/G,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC9G,OAAO,EACH,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,yBAAyB,EACzB,mBAAmB,EACnB,6BAA6B,EAC7B,cAAc,EACd,qBAAqB,EACrB,yBAAyB,GAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACH,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,mBAAmB,GAC3B,MAAM,iBAAiB,CAAC"}

package/dist/server/index.js

@@ -31,6 +31,7 @@ __export(server_exports, {
   MonetizeTransactionItemSchema: () => MonetizeTransactionItemSchema,
   NotFoundError: () => NotFoundError,
   REBUY_ENGINE_HOST: () => REBUY_ENGINE_HOST,
+  REQUEST_BOUNDS: () => REQUEST_BOUNDS,
   UpstreamError: () => UpstreamError,
   UserConfigInputSchema: () => UserConfigInputSchema,
   WidgetSettingsInputSchema: () => WidgetSettingsInputSchema,
@@ -3711,16 +3712,49 @@ var postAnalyticsEvents = async (input, ctx) => {
 
 // src/server/requestSchemas.ts
 var import_zod27 = require("zod");
-var KeyValue = import_zod27.z.object({ key: import_zod27.z.string(), value: import_zod27.z.string().optional() });
+var REQUEST_BOUNDS = {
+  /** Cart-level attributes per cart. */
+  CART_ATTRIBUTES_MAX: 100,
+  /** Shopify's documented cart maximum is 500 line items. */
+  CART_ITEMS_MAX: 500,
+  /** Applied discount codes per cart. */
+  DISCOUNT_CODES_MAX: 50,
+  /** Engine bulk-analytics cap — the engine 400s a batch over 100 and the orchestrator chunks at it. */
+  EVENTS_MAX: 100,
+  /** Gift lines per validation request (gifts are a subset of cart lines). */
+  GIFTS_MAX: 100,
+  /** Integration toggles per data-source request. */
+  INTEGRATION_KEYS_MAX: 50,
+  /** Products a data source may be asked for; real widgets sit far below. */
+  LIMIT_MAX: 100,
+  /** Line-item properties per cart line. */
+  LINE_PROPERTIES_MAX: 100,
+  /** Identifiers: gids, shop domains, visitor/customer/session/transaction ids, tokens, locale/geo codes. */
+  STRING_ID_MAX: 128,
+  /** Attribute/property keys, event names, discount codes (Shopify caps codes at 255), path strings. */
+  STRING_KEY_MAX: 256,
+  /** Free text: titles, order names, emails, customer names. */
+  STRING_TEXT_MAX: 1024,
+  /** URLs (`privacyPolicyUrl`). */
+  STRING_URL_MAX: 2048,
+  /** Attribute/property VALUES — deliberately fat: product-customizer apps stuff JSON/URLs into these. */
+  STRING_VALUE_MAX: 4096,
+  /** Rich ads transaction lines — the engine's ads contract. */
+  TRANSACTION_ITEMS_MAX: 50
+};
+var KeyValue = import_zod27.z.object({
+  key: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX),
+  value: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_VALUE_MAX).optional()
+});
 var CartLineInputSchema = import_zod27.z.object({
-  productId: import_zod27.z.string(),
-  properties: import_zod27.z.array(KeyValue).optional(),
+  productId: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
+  properties: import_zod27.z.array(KeyValue).max(REQUEST_BOUNDS.LINE_PROPERTIES_MAX).optional(),
   quantity: import_zod27.z.number(),
-  subscriptionId: import_zod27.z.string().optional(),
-  variantId: import_zod27.z.string()
+  subscriptionId: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  variantId: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX)
 });
 var CartInputSchema = import_zod27.z.object({
-  attributes: import_zod27.z.array(KeyValue).optional(),
+  attributes: import_zod27.z.array(KeyValue).max(REQUEST_BOUNDS.CART_ATTRIBUTES_MAX).optional(),
   /**
    * Presentment-per-shop-currency FX rate (buyer price ÷ shop price, e.g. `1.35` for a USD shop
    * selling in CAD). Money rule thresholds are authored in SHOP currency, so the engine subtotal is
@@ -3728,103 +3762,105 @@ var CartInputSchema = import_zod27.z.object({
    */
   currencyRate: import_zod27.z.number().optional(),
   /** Applied discount codes; the engine evaluates `discount_code` rules against them (sent as `[{code}]`). */
-  discountCodes: import_zod27.z.array(import_zod27.z.string()).optional(),
+  discountCodes: import_zod27.z.array(import_zod27.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX)).max(REQUEST_BOUNDS.DISCOUNT_CODES_MAX).optional(),
   /** Presentment cents of cart-level discount allocations, subtracted from `subtotal` for the engine. */
   discountTotal: import_zod27.z.number().optional(),
-  items: import_zod27.z.array(CartLineInputSchema),
+  items: import_zod27.z.array(CartLineInputSchema).max(REQUEST_BOUNDS.CART_ITEMS_MAX),
   /** Presentment subtotal in cents. */
   subtotal: import_zod27.z.number()
 });
 var WidgetSettingsInputSchema = import_zod27.z.object({
   cacheKey: import_zod27.z.number().optional(),
   id: import_zod27.z.number(),
-  key: import_zod27.z.string().optional(),
-  shop: import_zod27.z.string(),
+  key: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  shop: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
   /** Stable per-buyer id; when present, enables sticky server-side A/B variant selection. */
-  visitorId: import_zod27.z.string().optional()
+  visitorId: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
 });
-var UserConfigInputSchema = import_zod27.z.object({ shop: import_zod27.z.string() });
+var UserConfigInputSchema = import_zod27.z.object({ shop: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX) });
 var DataSourceInputSchema = import_zod27.z.object({
   cart: CartInputSchema,
-  customerId: import_zod27.z.string().optional(),
-  dataSourcePath: import_zod27.z.string(),
+  customerId: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  dataSourcePath: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX),
   /**
    * Engine `filter_inputs` override: `'no'` keeps in-cart (input) products in the results/rule
    * outputs — gift validation sends it so a gift's own product can appear in its answer. Omitted = the
    * engine's default filtering.
    */
   filterInputs: import_zod27.z.enum(["no", "yes"]).optional(),
-  integrations: import_zod27.z.record(import_zod27.z.string(), import_zod27.z.boolean()).optional(),
-  limit: import_zod27.z.number(),
+  integrations: import_zod27.z.record(import_zod27.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX), import_zod27.z.boolean()).refine((record) => Object.keys(record).length <= REQUEST_BOUNDS.INTEGRATION_KEYS_MAX, {
+    message: `Too many integration keys (max ${REQUEST_BOUNDS.INTEGRATION_KEYS_MAX})`
+  }).optional(),
+  limit: import_zod27.z.number().max(REQUEST_BOUNDS.LIMIT_MAX),
   productType: import_zod27.z.enum(["both", "one-time", "subscription"]).optional(),
-  shop: import_zod27.z.string(),
-  visitorId: import_zod27.z.string().optional()
+  shop: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
+  visitorId: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
 });
 var GiftInputSchema = import_zod27.z.object({
   cost: import_zod27.z.number(),
   discounted: import_zod27.z.boolean(),
-  lineId: import_zod27.z.string(),
+  lineId: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
   productId: import_zod27.z.number(),
   widgetId: import_zod27.z.number()
 });
 var GiftValidationInputSchema = import_zod27.z.object({
   cart: CartInputSchema,
-  customerId: import_zod27.z.string().optional(),
-  gifts: import_zod27.z.array(GiftInputSchema),
-  shop: import_zod27.z.string(),
-  visitorId: import_zod27.z.string().optional()
+  customerId: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  gifts: import_zod27.z.array(GiftInputSchema).max(REQUEST_BOUNDS.GIFTS_MAX),
+  shop: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
+  visitorId: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
 });
 var MonetizeTransactionItemSchema = import_zod27.z.object({
-  id: import_zod27.z.string(),
+  id: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
   priceCents: import_zod27.z.number(),
   quantity: import_zod27.z.number(),
-  title: import_zod27.z.string(),
-  type: import_zod27.z.string()
+  title: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX),
+  type: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX)
 });
 var MonetizeInputSchema = import_zod27.z.object({
   cart: CartInputSchema,
-  country: import_zod27.z.string().optional(),
-  currency: import_zod27.z.string().optional(),
+  country: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  currency: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
   /** Ads-targeting identity/geo/locale fields (React parity); folded into the engine query verbatim. */
-  customerEmail: import_zod27.z.string().optional(),
-  customerFirstName: import_zod27.z.string().optional(),
-  customerId: import_zod27.z.string().optional(),
-  customerLastName: import_zod27.z.string().optional(),
-  language: import_zod27.z.string().optional(),
+  customerEmail: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX).optional(),
+  customerFirstName: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX).optional(),
+  customerId: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  customerLastName: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX).optional(),
+  language: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
   /** Buyer-facing order name (e.g. `#1001`) for the server-composed "Order … Confirmed" chrome line. */
-  orderName: import_zod27.z.string().optional(),
+  orderName: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX).optional(),
   placement: import_zod27.z.enum(["order_status", "thank_you_page"]),
   /** Privacy Policy footer href — the Monetize widget's `privacy_policy_url` setting (React parity). */
-  privacyPolicyUrl: import_zod27.z.string().optional(),
+  privacyPolicyUrl: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_URL_MAX).optional(),
   /** 30-min rolling session id (React parity); used for the ads `session_id`, else the visitor id. */
-  sessionId: import_zod27.z.string().optional(),
-  shop: import_zod27.z.string(),
+  sessionId: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  shop: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
   /** Editor/QA indicator; OR-ed into the ads-engine `testing` flag so it stays out of billing/reporting. */
   testing: import_zod27.z.boolean().optional(),
-  timezone: import_zod27.z.string().optional(),
+  timezone: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
   /** Decorated (numeric) order id → the ads `transaction_id`. */
-  transactionId: import_zod27.z.string().optional(),
-  /** Rich per-line ads items; capped at 50 server-side (engine contract). Preferred over `cart.items`. */
-  transactionItems: import_zod27.z.array(MonetizeTransactionItemSchema).optional(),
+  transactionId: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  /** Rich per-line ads items; capped at the engine's ads contract. Preferred over `cart.items`. */
+  transactionItems: import_zod27.z.array(MonetizeTransactionItemSchema).max(REQUEST_BOUNDS.TRANSACTION_ITEMS_MAX).optional(),
   /** Order total in presentment cents (React prefers total over subtotal); else `cart.subtotal`. */
   transactionTotal: import_zod27.z.number().optional(),
-  visitorId: import_zod27.z.string().optional(),
-  zipCode: import_zod27.z.string().optional()
+  visitorId: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  zipCode: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
 });
 var AnalyticsEventInputSchema = import_zod27.z.object({
-  name: import_zod27.z.string(),
-  properties: import_zod27.z.record(import_zod27.z.string(), import_zod27.z.unknown()).optional(),
-  sentAt: import_zod27.z.string().optional()
+  name: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX),
+  properties: import_zod27.z.record(import_zod27.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX), import_zod27.z.unknown()).optional(),
+  sentAt: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
 });
 var AnalyticsInputSchema = import_zod27.z.object({
   /** Rebuy cart token (the `r_cart_token` cart attribute), when available — primary aggregation key. */
-  cartToken: import_zod27.z.string().optional(),
+  cartToken: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
   /** Shopify checkout token, when available — drives cart/checkout aggregation downstream. */
-  checkoutToken: import_zod27.z.string().optional(),
-  events: import_zod27.z.array(AnalyticsEventInputSchema),
-  shop: import_zod27.z.string(),
-  visitorId: import_zod27.z.string(),
+  checkoutToken: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  events: import_zod27.z.array(AnalyticsEventInputSchema).max(REQUEST_BOUNDS.EVENTS_MAX),
+  shop: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
+  visitorId: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
   /** The widget id (smartBlockId) the events belong to. */
-  widgetId: import_zod27.z.string().optional()
+  widgetId: import_zod27.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
 });
 //# sourceMappingURL=index.js.map