@rebuy/rebuy 3.0.0 → 3.1.0

package/dist/server/index.cjs

@@ -3676,12 +3676,20 @@ var reportUnreadableVerdict = (metadata, report) => {
 var dedupeById = (products) => (0, import_es_toolkit6.uniqBy)(products, (product) => product.id);
 var fetchDataSourceResults = async (input, ctx) => {
   const { shop } = await fetchUserConfig({ shop: input.shop }, ctx);
+  const marketHeaders = {
+    ...input.language && { "Accept-Language": input.language },
+    ...input.country && { "X-Country-Code": input.country }
+  };
   let upstream;
   try {
     upstream = await ctx.fetchUpstream(
       `/api/v1${input.dataSourcePath}`,
       {},
-      { host: ctx.host, search: serialize(buildEngineParams(input, shop.apiKey)) }
+      {
+        ...Object.keys(marketHeaders).length > 0 && { headers: marketHeaders },
+        host: ctx.host,
+        search: serialize(buildEngineParams(input, shop.apiKey))
+      }
     );
   } catch (err) {
     if (err instanceof UpstreamError && (err.status === 404 || err.status === 410)) {
@@ -3851,10 +3859,13 @@ var validateGifts = async (input, ctx) => {
         const { metadata } = await fetchDataSourceResults(
           {
             cart: input.cart,
+            /** Market context threads through so a market-gated gift rule answers for the buyer's market (REB-21102). */
+            country: input.country,
             customerId: input.customerId,
             dataSourcePath,
             /** The gift being validated is in the cart — input filtering would erase it from the answer. */
             filterInputs: "no",
+            language: input.language,
             /**
              * `limit: 0` fetches NO products — only the rule verdict is needed. Safe because the engine
              * derives `matchedRules` from rule-config evaluation, not from fetched results (traced through
@@ -4295,6 +4306,16 @@ var DataSourceInputSchema = import_zod28.z.object({
    * client's country-context market check is bypassed for B2B (it false-negatives B2B-catalog products).
    */
   companyLocationId: import_zod28.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  /**
+   * Buyer's market country (ISO 3166-1 alpha-2) — forwarded to the engine as the `X-Country-Code`
+   * HEADER (REB-21102), so it's regex-bound (not just length-bound like this schema's other passthrough
+   * identifiers): an unfiltered value reaching a header sink can throw a raw `TypeError` (CRLF, or any
+   * non-Latin1 codepoint) that isn't an `UpstreamError`, escaping `fetchDataSourceResults`'s error
+   * handling as an unhandled 500 on this public, unauthenticated route instead of a clean 422 here.
+   * Normalized to uppercase (the wire value is forwarded verbatim as the header) so a case-sensitive
+   * engine lookup can't silently miss a lowercase code — `adsEngine.ts` uppercases for the same reason.
+   */
+  country: import_zod28.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).regex(/^[A-Za-z]{2}$/, "must be an ISO 3166-1 alpha-2 country code (e.g. CA)").transform((value) => value.toUpperCase()).optional(),
   customerId: import_zod28.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
   dataSourcePath: import_zod28.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX),
   /**
@@ -4306,6 +4327,14 @@ var DataSourceInputSchema = import_zod28.z.object({
   integrations: import_zod28.z.record(import_zod28.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX), import_zod28.z.boolean()).refine((record) => Object.keys(record).length <= REQUEST_BOUNDS.INTEGRATION_KEYS_MAX, {
     message: `Too many integration keys (max ${REQUEST_BOUNDS.INTEGRATION_KEYS_MAX})`
   }).optional(),
+  /**
+   * Buyer's checkout language (BCP 47) — forwarded to the engine as the `Accept-Language` HEADER
+   * (REB-21102); regex-bound for the same header-sink reason as `country` above. MUST be a single tag
+   * (e.g. `fr-CA`) — a q-value list like `fr-CA,fr;q=0.9` (the raw shape of a browser `Accept-Language`
+   * request header) fails the regex. Callers should send the buyer's resolved locale (e.g. Shopify
+   * checkout's `localization.language.isoCode`), not the request header verbatim.
+   */
+  language: import_zod28.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).regex(/^[A-Za-z0-9-]+$/, "must be a single BCP-47 tag (e.g. fr-CA), not a q-value list").optional(),
   limit: import_zod28.z.number().max(REQUEST_BOUNDS.LIMIT_MAX),
   productType: import_zod28.z.enum(["both", "one-time", "subscription"]).optional(),
   shop: import_zod28.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
@@ -4320,8 +4349,19 @@ var GiftInputSchema = import_zod28.z.object({
 });
 var GiftValidationInputSchema = import_zod28.z.object({
   cart: CartInputSchema,
+  /**
+   * Buyer's market country — threaded into the per-widget data-source evaluations (REB-21102), which
+   * forward it to a header sink; regex-bound and uppercase-normalized for the same reasons as
+   * `DataSourceInputSchema`'s `country`.
+   */
+  country: import_zod28.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).regex(/^[A-Za-z]{2}$/, "must be an ISO 3166-1 alpha-2 country code (e.g. CA)").transform((value) => value.toUpperCase()).optional(),
   customerId: import_zod28.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
   gifts: import_zod28.z.array(GiftInputSchema).max(REQUEST_BOUNDS.GIFTS_MAX),
+  /**
+   * Buyer's checkout language — threaded into the per-widget data-source evaluations (REB-21102). MUST
+   * be a single BCP-47 tag, for the same reason as `DataSourceInputSchema`'s `language` above.
+   */
+  language: import_zod28.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).regex(/^[A-Za-z0-9-]+$/, "must be a single BCP-47 tag (e.g. fr-CA), not a q-value list").optional(),
   shop: import_zod28.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
   visitorId: import_zod28.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
 });

package/dist/server/index.mjs

@@ -3628,12 +3628,20 @@ var reportUnreadableVerdict = (metadata, report) => {
 var dedupeById = (products) => uniqBy2(products, (product) => product.id);
 var fetchDataSourceResults = async (input, ctx) => {
   const { shop } = await fetchUserConfig({ shop: input.shop }, ctx);
+  const marketHeaders = {
+    ...input.language && { "Accept-Language": input.language },
+    ...input.country && { "X-Country-Code": input.country }
+  };
   let upstream;
   try {
     upstream = await ctx.fetchUpstream(
       `/api/v1${input.dataSourcePath}`,
       {},
-      { host: ctx.host, search: serialize(buildEngineParams(input, shop.apiKey)) }
+      {
+        ...Object.keys(marketHeaders).length > 0 && { headers: marketHeaders },
+        host: ctx.host,
+        search: serialize(buildEngineParams(input, shop.apiKey))
+      }
     );
   } catch (err) {
     if (err instanceof UpstreamError && (err.status === 404 || err.status === 410)) {
@@ -3803,10 +3811,13 @@ var validateGifts = async (input, ctx) => {
         const { metadata } = await fetchDataSourceResults(
           {
             cart: input.cart,
+            /** Market context threads through so a market-gated gift rule answers for the buyer's market (REB-21102). */
+            country: input.country,
             customerId: input.customerId,
             dataSourcePath,
             /** The gift being validated is in the cart — input filtering would erase it from the answer. */
             filterInputs: "no",
+            language: input.language,
             /**
              * `limit: 0` fetches NO products — only the rule verdict is needed. Safe because the engine
              * derives `matchedRules` from rule-config evaluation, not from fetched results (traced through
@@ -4247,6 +4258,16 @@ var DataSourceInputSchema = z28.object({
    * client's country-context market check is bypassed for B2B (it false-negatives B2B-catalog products).
    */
   companyLocationId: z28.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  /**
+   * Buyer's market country (ISO 3166-1 alpha-2) — forwarded to the engine as the `X-Country-Code`
+   * HEADER (REB-21102), so it's regex-bound (not just length-bound like this schema's other passthrough
+   * identifiers): an unfiltered value reaching a header sink can throw a raw `TypeError` (CRLF, or any
+   * non-Latin1 codepoint) that isn't an `UpstreamError`, escaping `fetchDataSourceResults`'s error
+   * handling as an unhandled 500 on this public, unauthenticated route instead of a clean 422 here.
+   * Normalized to uppercase (the wire value is forwarded verbatim as the header) so a case-sensitive
+   * engine lookup can't silently miss a lowercase code — `adsEngine.ts` uppercases for the same reason.
+   */
+  country: z28.string().max(REQUEST_BOUNDS.STRING_ID_MAX).regex(/^[A-Za-z]{2}$/, "must be an ISO 3166-1 alpha-2 country code (e.g. CA)").transform((value) => value.toUpperCase()).optional(),
   customerId: z28.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
   dataSourcePath: z28.string().max(REQUEST_BOUNDS.STRING_KEY_MAX),
   /**
@@ -4258,6 +4279,14 @@ var DataSourceInputSchema = z28.object({
   integrations: z28.record(z28.string().max(REQUEST_BOUNDS.STRING_KEY_MAX), z28.boolean()).refine((record) => Object.keys(record).length <= REQUEST_BOUNDS.INTEGRATION_KEYS_MAX, {
     message: `Too many integration keys (max ${REQUEST_BOUNDS.INTEGRATION_KEYS_MAX})`
   }).optional(),
+  /**
+   * Buyer's checkout language (BCP 47) — forwarded to the engine as the `Accept-Language` HEADER
+   * (REB-21102); regex-bound for the same header-sink reason as `country` above. MUST be a single tag
+   * (e.g. `fr-CA`) — a q-value list like `fr-CA,fr;q=0.9` (the raw shape of a browser `Accept-Language`
+   * request header) fails the regex. Callers should send the buyer's resolved locale (e.g. Shopify
+   * checkout's `localization.language.isoCode`), not the request header verbatim.
+   */
+  language: z28.string().max(REQUEST_BOUNDS.STRING_ID_MAX).regex(/^[A-Za-z0-9-]+$/, "must be a single BCP-47 tag (e.g. fr-CA), not a q-value list").optional(),
   limit: z28.number().max(REQUEST_BOUNDS.LIMIT_MAX),
   productType: z28.enum(["both", "one-time", "subscription"]).optional(),
   shop: z28.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
@@ -4272,8 +4301,19 @@ var GiftInputSchema = z28.object({
 });
 var GiftValidationInputSchema = z28.object({
   cart: CartInputSchema,
+  /**
+   * Buyer's market country — threaded into the per-widget data-source evaluations (REB-21102), which
+   * forward it to a header sink; regex-bound and uppercase-normalized for the same reasons as
+   * `DataSourceInputSchema`'s `country`.
+   */
+  country: z28.string().max(REQUEST_BOUNDS.STRING_ID_MAX).regex(/^[A-Za-z]{2}$/, "must be an ISO 3166-1 alpha-2 country code (e.g. CA)").transform((value) => value.toUpperCase()).optional(),
   customerId: z28.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
   gifts: z28.array(GiftInputSchema).max(REQUEST_BOUNDS.GIFTS_MAX),
+  /**
+   * Buyer's checkout language — threaded into the per-widget data-source evaluations (REB-21102). MUST
+   * be a single BCP-47 tag, for the same reason as `DataSourceInputSchema`'s `language` above.
+   */
+  language: z28.string().max(REQUEST_BOUNDS.STRING_ID_MAX).regex(/^[A-Za-z0-9-]+$/, "must be a single BCP-47 tag (e.g. fr-CA), not a q-value list").optional(),
   shop: z28.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
   visitorId: z28.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
 });

package/dist/server/requestSchemas.d.ts

@@ -114,6 +114,7 @@ export declare const DataSourceInputSchema: z.ZodObject<{
         subtotal: z.ZodNumber;
     }, z.core.$strip>;
     companyLocationId: z.ZodOptional<z.ZodString>;
+    country: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
     customerId: z.ZodOptional<z.ZodString>;
     dataSourcePath: z.ZodString;
     filterInputs: z.ZodOptional<z.ZodEnum<{
@@ -121,6 +122,7 @@ export declare const DataSourceInputSchema: z.ZodObject<{
         yes: "yes";
     }>>;
     integrations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
+    language: z.ZodOptional<z.ZodString>;
     limit: z.ZodNumber;
     productType: z.ZodOptional<z.ZodEnum<{
         "one-time": "one-time";
@@ -160,6 +162,7 @@ export declare const GiftValidationInputSchema: z.ZodObject<{
         }, z.core.$strip>>;
         subtotal: z.ZodNumber;
     }, z.core.$strip>;
+    country: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
     customerId: z.ZodOptional<z.ZodString>;
     gifts: z.ZodArray<z.ZodObject<{
         cost: z.ZodNumber;
@@ -168,6 +171,7 @@ export declare const GiftValidationInputSchema: z.ZodObject<{
         productId: z.ZodNumber;
         widgetId: z.ZodNumber;
     }, z.core.$strip>>;
+    language: z.ZodOptional<z.ZodString>;
     shop: z.ZodString;
     visitorId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;

package/dist/server/shared.d.ts

@@ -10,8 +10,10 @@ export declare const REBUY_ENGINE_HOST = "rebuyengine.com";
  * caller (rebuy-api owns the egress, timeouts, and the `X-Rebuy-Upstream` proxy header); MUST throw
  * {@link UpstreamError} on a non-2xx response so orchestrators can interpret the status.
  *
- * Defaults to GET with `params`/`search` as the query string. Pass `method: 'POST'` with `body` (JSON
- * body) and optional `headers` (e.g. an auth token) for write-style calls like analytics ingest.
+ * Defaults to GET with `params`/`search` as the query string; `headers` (e.g. an auth token, or the
+ * market-context headers `fetchDataSourceResults` sends, REB-21102) apply on GET too — implementations
+ * must not gate `headers` behind a `method === 'POST'` branch. Pass `method: 'POST'` with `body` (JSON
+ * body) for write-style calls like analytics ingest.
  */
 export type UpstreamFetch = (path: string, params: Record<string, string>, options?: {
     body?: unknown;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rebuy/rebuy",
-    "version": "3.0.0",
+    "version": "3.1.0",
     "description": "Shared zod schemas, legacy-to-CAB widget transforms, and server orchestrators for Rebuy's Shopify consumers (rebuy-api, admin-nextjs, rebuy-shopify-extensions)",
     "license": "MIT",
     "author": "Rebuy, Inc.",