@rebuy/rebuy 3.12.0 → 3.13.0

package/dist/index.cjs

@@ -1162,6 +1162,20 @@ var CabShopConfig = import_zod2.z.object({
   apiKey: import_zod2.z.string(),
   /** The shop's billing generation; the smart-cart entitlement gate only fires for `'v6'`. Missing/drift ⇒ `null` (fail open, ungated). */
   billingVersion: import_zod2.z.string().nullable().catch(null).default(null),
+  /**
+   * The shop's rotating cache-buster: `onsite_cache_key` internally — a unix timestamp the engine bumps,
+   * and the edge copy of this config purges, on every widget/settings/theme edit — but serialized on the
+   * wire as `cache_key`, which `deepCamelCase` maps to this field (renaming it `onsiteCacheKey` would
+   * sever the mapping silently; the wire-level assertion in `userConfig.test.ts` is what fails loudly).
+   * Threaded onto the widgets/settings read as `cache_key` so the engine marks the response
+   * immutable-cacheable and the `cached.*` edge serves it fresh-by-URL. The engine sends a numeric
+   * string — coerce — but admit only number/string inputs and constrain to a positive integer: a bare
+   * coercion folds `null`/`''`/`false` to `0` and `true` to `1` — "valid" numbers that would go upstream
+   * as a constant never-rotating buster and pin the edge copy permanently stale. A real key is always a
+   * positive int sent as number or string, so everything else lands on `.catch()` and degrades that read
+   * to un-busted (origin-served — slower, never stale), never a parse fail.
+   */
+  cacheKey: import_zod2.z.union([import_zod2.z.number(), import_zod2.z.string()]).transform((value) => Number(value)).pipe(import_zod2.z.number().int().positive()).optional().catch(void 0),
   /**
    * The shop's base-currency ISO code (e.g. `'USD'`). CAB derives the shop minor-unit exponent from it
    * (`currencyDecimals`) so a Functions-applied fixed discount — whose amount is in shop minor units —
@@ -4678,16 +4692,16 @@ var buildOfferCard = (settings, horizontal) => {
       gridCardImage(image),
       title,
       ...variantTitle,
+      ...reviews,
       price,
       ...description,
-      ...reviews,
       ...variants,
       ...quantity,
       ...subscription,
       addButton
     ];
   }
-  const info = rowsLayout([title, ...variantTitle, price, ...description, ...reviews, ...variants]);
+  const info = rowsLayout([title, ...variantTitle, ...reviews, price, ...description, ...variants]);
   const actions = [...subscription, addButton];
   const actionsCell = actions.length === 1 ? actions[0] : rowsLayout(actions);
   const card = {

package/dist/index.mjs

@@ -876,6 +876,20 @@ var CabShopConfig = z2.object({
   apiKey: z2.string(),
   /** The shop's billing generation; the smart-cart entitlement gate only fires for `'v6'`. Missing/drift ⇒ `null` (fail open, ungated). */
   billingVersion: z2.string().nullable().catch(null).default(null),
+  /**
+   * The shop's rotating cache-buster: `onsite_cache_key` internally — a unix timestamp the engine bumps,
+   * and the edge copy of this config purges, on every widget/settings/theme edit — but serialized on the
+   * wire as `cache_key`, which `deepCamelCase` maps to this field (renaming it `onsiteCacheKey` would
+   * sever the mapping silently; the wire-level assertion in `userConfig.test.ts` is what fails loudly).
+   * Threaded onto the widgets/settings read as `cache_key` so the engine marks the response
+   * immutable-cacheable and the `cached.*` edge serves it fresh-by-URL. The engine sends a numeric
+   * string — coerce — but admit only number/string inputs and constrain to a positive integer: a bare
+   * coercion folds `null`/`''`/`false` to `0` and `true` to `1` — "valid" numbers that would go upstream
+   * as a constant never-rotating buster and pin the edge copy permanently stale. A real key is always a
+   * positive int sent as number or string, so everything else lands on `.catch()` and degrades that read
+   * to un-busted (origin-served — slower, never stale), never a parse fail.
+   */
+  cacheKey: z2.union([z2.number(), z2.string()]).transform((value) => Number(value)).pipe(z2.number().int().positive()).optional().catch(void 0),
   /**
    * The shop's base-currency ISO code (e.g. `'USD'`). CAB derives the shop minor-unit exponent from it
    * (`currencyDecimals`) so a Functions-applied fixed discount — whose amount is in shop minor units —
@@ -4392,16 +4406,16 @@ var buildOfferCard = (settings, horizontal) => {
       gridCardImage(image),
       title,
       ...variantTitle,
+      ...reviews,
       price,
       ...description,
-      ...reviews,
       ...variants,
       ...quantity,
       ...subscription,
       addButton
     ];
   }
-  const info = rowsLayout([title, ...variantTitle, price, ...description, ...reviews, ...variants]);
+  const info = rowsLayout([title, ...variantTitle, ...reviews, price, ...description, ...variants]);
   const actions = [...subscription, addButton];
   const actionsCell = actions.length === 1 ? actions[0] : rowsLayout(actions);
   const card = {

package/dist/schema/cabShopConfig.d.ts

@@ -39,6 +39,7 @@ export declare const CabShopConfig: z.ZodObject<{
     }, z.core.$strip>>>>>;
     apiKey: z.ZodString;
     billingVersion: z.ZodDefault<z.ZodCatch<z.ZodNullable<z.ZodString>>>;
+    cacheKey: z.ZodCatch<z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>>;
     currency: z.ZodCatch<z.ZodOptional<z.ZodString>>;
     markets: z.ZodPipe<z.ZodDefault<z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodObject<{
         enabled: z.ZodBoolean;
@@ -76,6 +77,7 @@ export declare const CabUserConfig: z.ZodObject<{
         }, z.core.$strip>>>>>;
         apiKey: z.ZodString;
         billingVersion: z.ZodDefault<z.ZodCatch<z.ZodNullable<z.ZodString>>>;
+        cacheKey: z.ZodCatch<z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>>;
         currency: z.ZodCatch<z.ZodOptional<z.ZodString>>;
         markets: z.ZodPipe<z.ZodDefault<z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodObject<{
             enabled: z.ZodBoolean;

package/dist/server/adsEngine.d.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { type CabUserConfig } from '../schema/cabShopConfig';
 import { type MonetizeInput, type ServerContext } from '../server/shared';
 /**
  * A single ads-engine offer. The `*_url` fields are tracking endpoints the engine returns fully
@@ -34,5 +35,7 @@ export declare const buildAdsParams: (input: MonetizeInput, publisherKey: string
  * Fetch live ad offers from the Rebuy ads engine. Resolves the shop's publisher key server-side (and
  * returns `[]` when the shop isn't enrolled — no ads, not an error). A non-prod upstream sends the
  * staging supply key; a non-prod/editor/QA-email request is flagged `testing` (excluded from billing).
+ * `prefetched` is a caller's already-resolved shop config (inline hydration threads it) — consulted only
+ * AFTER the gates below, so a gated-out request still costs zero upstream calls either way.
  */
-export declare const fetchAdsEngineOffers: (input: MonetizeInput, ctx: ServerContext) => Promise<AdsEngineOffer[]>;
+export declare const fetchAdsEngineOffers: (input: MonetizeInput, ctx: ServerContext, prefetched?: CabUserConfig) => Promise<AdsEngineOffer[]>;

package/dist/server/index.cjs

@@ -582,6 +582,20 @@ var CabShopConfig = import_zod6.z.object({
   apiKey: import_zod6.z.string(),
   /** The shop's billing generation; the smart-cart entitlement gate only fires for `'v6'`. Missing/drift ⇒ `null` (fail open, ungated). */
   billingVersion: import_zod6.z.string().nullable().catch(null).default(null),
+  /**
+   * The shop's rotating cache-buster: `onsite_cache_key` internally — a unix timestamp the engine bumps,
+   * and the edge copy of this config purges, on every widget/settings/theme edit — but serialized on the
+   * wire as `cache_key`, which `deepCamelCase` maps to this field (renaming it `onsiteCacheKey` would
+   * sever the mapping silently; the wire-level assertion in `userConfig.test.ts` is what fails loudly).
+   * Threaded onto the widgets/settings read as `cache_key` so the engine marks the response
+   * immutable-cacheable and the `cached.*` edge serves it fresh-by-URL. The engine sends a numeric
+   * string — coerce — but admit only number/string inputs and constrain to a positive integer: a bare
+   * coercion folds `null`/`''`/`false` to `0` and `true` to `1` — "valid" numbers that would go upstream
+   * as a constant never-rotating buster and pin the edge copy permanently stale. A real key is always a
+   * positive int sent as number or string, so everything else lands on `.catch()` and degrades that read
+   * to un-busted (origin-served — slower, never stale), never a parse fail.
+   */
+  cacheKey: import_zod6.z.union([import_zod6.z.number(), import_zod6.z.string()]).transform((value) => Number(value)).pipe(import_zod6.z.number().int().positive()).optional().catch(void 0),
   /**
    * The shop's base-currency ISO code (e.g. `'USD'`). CAB derives the shop minor-unit exponent from it
    * (`currencyDecimals`) so a Functions-applied fixed discount — whose amount is in shop minor units —
@@ -3215,16 +3229,16 @@ var buildOfferCard = (settings, horizontal) => {
       gridCardImage(image),
       title,
       ...variantTitle,
+      ...reviews,
       price,
       ...description,
-      ...reviews,
       ...variants,
       ...quantity,
       ...subscription,
       addButton
     ];
   }
-  const info = rowsLayout([title, ...variantTitle, price, ...description, ...reviews, ...variants]);
+  const info = rowsLayout([title, ...variantTitle, ...reviews, price, ...description, ...variants]);
   const actions = [...subscription, addButton];
   const actionsCell = actions.length === 1 ? actions[0] : rowsLayout(actions);
   const card = {
@@ -4008,10 +4022,10 @@ var buildAdsParams = (input, publisherKey, supplyKey, testing, userAgent, ipAddr
     ...userAgent && { user_agent: userAgent }
   };
 };
-var fetchAdsEngineOffers = async (input, ctx) => {
+var fetchAdsEngineOffers = async (input, ctx, prefetched) => {
   if (!input.country || !SUPPORTED_COUNTRIES.has(input.country.toUpperCase())) return [];
   if (!(input.sessionId || input.visitorId)) return [];
-  const { shop } = await fetchUserConfig({ shop: input.shop }, ctx);
+  const { shop } = prefetched ?? await fetchUserConfig({ shop: input.shop }, ctx);
   const publisherKey = shop.monetize?.publisherKey;
   if (!publisherKey) return [];
   const isProduction = ctx.host === REBUY_ENGINE_HOST;
@@ -4169,8 +4183,10 @@ var composeOfferCard = (offer, input) => {
 };
 
 // src/server/monetizeOffers.ts
-var fetchMonetizeOffers = async (input, ctx) => {
-  const composed = (await fetchAdsEngineOffers(input, ctx)).map((offer) => composeOfferCard(offer, input));
+var fetchMonetizeOffers = async (input, ctx, prefetched) => {
+  const composed = (await fetchAdsEngineOffers(input, ctx, prefetched)).map(
+    (offer) => composeOfferCard(offer, input)
+  );
   const offers = composed.filter((card) => card !== void 0);
   if (offers.length < composed.length)
     ctx.reportDrift?.({
@@ -4225,8 +4241,8 @@ var dispatchWidgetTransform = (id, normalized, report) => {
   if (isOfferV1(normalized)) return convertOfferToV2({ id, name: normalized.name, settings: normalized });
   return normalized;
 };
-var fetchProgressBarContext = async (shop, ctx) => {
-  const config = await fetchUserConfig({ shop }, ctx).catch(() => void 0);
+var fetchProgressBarContext = async (shop, ctx, prefetched) => {
+  const config = prefetched === void 0 ? await fetchUserConfig({ shop }, ctx).catch(() => void 0) : prefetched;
   if (!config) return {};
   if (config.shop.billingVersion === "v6" && config.shop.activePackages.some((pkg) => pkg.shortName === "")) {
     ctx.reportDrift?.({
@@ -4265,7 +4281,7 @@ var findMonetizeMarker = (section) => {
   }
   return void 0;
 };
-var hydrateMonetizeMarkers = async (converted, input, ctx) => {
+var hydrateMonetizeMarkers = async (converted, input, ctx, config) => {
   if (!input.monetize || !isCABTree(converted)) return;
   const first = findMonetizeMarker(converted);
   if (!first) return;
@@ -4277,7 +4293,8 @@ var hydrateMonetizeMarkers = async (converted, input, ctx) => {
         shop: input.shop,
         visitorId: input.monetize.visitorId || input.visitorId
       },
-      ctx
+      ctx,
+      config ?? void 0
     );
     first.offers = offers;
   } catch (err) {
@@ -4287,7 +4304,7 @@ var hydrateMonetizeMarkers = async (converted, input, ctx) => {
     });
   }
 };
-var fetchAndConvert = async (id, input, ctx) => {
+var fetchAndConvert = async (id, input, ctx, config) => {
   const params = { id: String(id), shop: input.shop };
   if (input.cacheKey != null) params.cache_key = String(input.cacheKey);
   if (input.key) params.key = input.key;
@@ -4304,34 +4321,32 @@ var fetchAndConvert = async (id, input, ctx) => {
   if (isMissingUpstreamPayload(data)) throw new NotFoundError(`Widget not found: ${id}`);
   const normalized = convertNumericObjects(deepCamelCase(data));
   if (isProgressBarV1(normalized) && normalized.barSettings.barType === "smart-cart") {
-    const { bars, progressColor } = await fetchProgressBarContext(input.shop, ctx);
+    const { bars, progressColor } = await fetchProgressBarContext(input.shop, ctx, config);
     return convertSmartCartProgressBarToV2({ bars: bars ?? [], id, progressColor, settings: normalized });
   }
   if (isConvertibleProgressBarV1(normalized)) {
-    const { progressColor } = await fetchProgressBarContext(input.shop, ctx);
+    const { progressColor } = await fetchProgressBarContext(input.shop, ctx, config);
     return convertProgressBarToV2({ id, progressColor, settings: normalized });
   }
   const converted = dispatchWidgetTransform(id, normalized, ctx.reportDrift);
   const colorless = isCABRootSection(normalized) ? colorlessProgressBars(converted) : [];
   if (colorless.length > 0) {
-    const { progressColor: color } = await fetchProgressBarContext(input.shop, ctx);
+    const { progressColor: color } = await fetchProgressBarContext(input.shop, ctx, config);
     if (color) for (const bar of colorless) bar.progressColor = color;
   }
   return converted;
 };
-var resolveWidgetExperiment = async (input, ctx) => {
-  if (!input.visitorId) return void 0;
-  try {
-    const { shop } = await fetchUserConfig({ shop: input.shop }, ctx);
-    return resolveExperiment(shop.activeExperiments, input.id, input.visitorId);
-  } catch {
-    return void 0;
-  }
-};
+var resolveWidgetExperiment = (input, config) => input.visitorId && config ? resolveExperiment(config.shop.activeExperiments, input.id, input.visitorId) : void 0;
 var convertWidgetSettings = async (input, ctx) => {
-  const experiment = await resolveWidgetExperiment(input, ctx);
-  const result = await fetchAndConvert(experiment?.elementId ?? input.id, input, ctx);
-  await hydrateMonetizeMarkers(result, input, ctx);
+  const config = input.cacheKey != null && !input.visitorId ? void 0 : await fetchUserConfig({ shop: input.shop }, ctx).catch(() => null);
+  const experiment = resolveWidgetExperiment(input, config);
+  const result = await fetchAndConvert(
+    experiment?.elementId ?? input.id,
+    { ...input, cacheKey: input.cacheKey ?? config?.shop.cacheKey },
+    ctx,
+    config
+  );
+  await hydrateMonetizeMarkers(result, input, ctx, config);
   return experiment && isCABTree(result) ? { ...result, experiment } : result;
 };
 
@@ -4675,7 +4690,14 @@ var MonetizeInputSchema = import_zod29.z.object({
   zipCode: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
 });
 var WidgetSettingsInputSchema = import_zod29.z.object({
-  cacheKey: import_zod29.z.number().optional(),
+  /**
+   * Same domain as `CabShopConfig.cacheKey`, for the same reason: this side WINS the orchestrator's
+   * `input.cacheKey ?? config.shop.cacheKey` (and an explicit value skips the config read entirely), so
+   * an unconstrained `0`/negative/float here would go upstream as a constant never-rotating `cache_key`
+   * and pin the edge copy permanently stale. `.catch(undefined)` because a bogus buster should degrade
+   * the read to un-busted, never 400 a widget render.
+   */
+  cacheKey: import_zod29.z.number().int().positive().optional().catch(void 0),
   id: import_zod29.z.number(),
   key: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
   /**

package/dist/server/index.mjs

@@ -534,6 +534,20 @@ var CabShopConfig = z6.object({
   apiKey: z6.string(),
   /** The shop's billing generation; the smart-cart entitlement gate only fires for `'v6'`. Missing/drift ⇒ `null` (fail open, ungated). */
   billingVersion: z6.string().nullable().catch(null).default(null),
+  /**
+   * The shop's rotating cache-buster: `onsite_cache_key` internally — a unix timestamp the engine bumps,
+   * and the edge copy of this config purges, on every widget/settings/theme edit — but serialized on the
+   * wire as `cache_key`, which `deepCamelCase` maps to this field (renaming it `onsiteCacheKey` would
+   * sever the mapping silently; the wire-level assertion in `userConfig.test.ts` is what fails loudly).
+   * Threaded onto the widgets/settings read as `cache_key` so the engine marks the response
+   * immutable-cacheable and the `cached.*` edge serves it fresh-by-URL. The engine sends a numeric
+   * string — coerce — but admit only number/string inputs and constrain to a positive integer: a bare
+   * coercion folds `null`/`''`/`false` to `0` and `true` to `1` — "valid" numbers that would go upstream
+   * as a constant never-rotating buster and pin the edge copy permanently stale. A real key is always a
+   * positive int sent as number or string, so everything else lands on `.catch()` and degrades that read
+   * to un-busted (origin-served — slower, never stale), never a parse fail.
+   */
+  cacheKey: z6.union([z6.number(), z6.string()]).transform((value) => Number(value)).pipe(z6.number().int().positive()).optional().catch(void 0),
   /**
    * The shop's base-currency ISO code (e.g. `'USD'`). CAB derives the shop minor-unit exponent from it
    * (`currencyDecimals`) so a Functions-applied fixed discount — whose amount is in shop minor units —
@@ -3167,16 +3181,16 @@ var buildOfferCard = (settings, horizontal) => {
       gridCardImage(image),
       title,
       ...variantTitle,
+      ...reviews,
       price,
       ...description,
-      ...reviews,
       ...variants,
       ...quantity,
       ...subscription,
       addButton
     ];
   }
-  const info = rowsLayout([title, ...variantTitle, price, ...description, ...reviews, ...variants]);
+  const info = rowsLayout([title, ...variantTitle, ...reviews, price, ...description, ...variants]);
   const actions = [...subscription, addButton];
   const actionsCell = actions.length === 1 ? actions[0] : rowsLayout(actions);
   const card = {
@@ -3960,10 +3974,10 @@ var buildAdsParams = (input, publisherKey, supplyKey, testing, userAgent, ipAddr
     ...userAgent && { user_agent: userAgent }
   };
 };
-var fetchAdsEngineOffers = async (input, ctx) => {
+var fetchAdsEngineOffers = async (input, ctx, prefetched) => {
   if (!input.country || !SUPPORTED_COUNTRIES.has(input.country.toUpperCase())) return [];
   if (!(input.sessionId || input.visitorId)) return [];
-  const { shop } = await fetchUserConfig({ shop: input.shop }, ctx);
+  const { shop } = prefetched ?? await fetchUserConfig({ shop: input.shop }, ctx);
   const publisherKey = shop.monetize?.publisherKey;
   if (!publisherKey) return [];
   const isProduction = ctx.host === REBUY_ENGINE_HOST;
@@ -4121,8 +4135,10 @@ var composeOfferCard = (offer, input) => {
 };
 
 // src/server/monetizeOffers.ts
-var fetchMonetizeOffers = async (input, ctx) => {
-  const composed = (await fetchAdsEngineOffers(input, ctx)).map((offer) => composeOfferCard(offer, input));
+var fetchMonetizeOffers = async (input, ctx, prefetched) => {
+  const composed = (await fetchAdsEngineOffers(input, ctx, prefetched)).map(
+    (offer) => composeOfferCard(offer, input)
+  );
   const offers = composed.filter((card) => card !== void 0);
   if (offers.length < composed.length)
     ctx.reportDrift?.({
@@ -4177,8 +4193,8 @@ var dispatchWidgetTransform = (id, normalized, report) => {
   if (isOfferV1(normalized)) return convertOfferToV2({ id, name: normalized.name, settings: normalized });
   return normalized;
 };
-var fetchProgressBarContext = async (shop, ctx) => {
-  const config = await fetchUserConfig({ shop }, ctx).catch(() => void 0);
+var fetchProgressBarContext = async (shop, ctx, prefetched) => {
+  const config = prefetched === void 0 ? await fetchUserConfig({ shop }, ctx).catch(() => void 0) : prefetched;
   if (!config) return {};
   if (config.shop.billingVersion === "v6" && config.shop.activePackages.some((pkg) => pkg.shortName === "")) {
     ctx.reportDrift?.({
@@ -4217,7 +4233,7 @@ var findMonetizeMarker = (section) => {
   }
   return void 0;
 };
-var hydrateMonetizeMarkers = async (converted, input, ctx) => {
+var hydrateMonetizeMarkers = async (converted, input, ctx, config) => {
   if (!input.monetize || !isCABTree(converted)) return;
   const first = findMonetizeMarker(converted);
   if (!first) return;
@@ -4229,7 +4245,8 @@ var hydrateMonetizeMarkers = async (converted, input, ctx) => {
         shop: input.shop,
         visitorId: input.monetize.visitorId || input.visitorId
       },
-      ctx
+      ctx,
+      config ?? void 0
     );
     first.offers = offers;
   } catch (err) {
@@ -4239,7 +4256,7 @@ var hydrateMonetizeMarkers = async (converted, input, ctx) => {
     });
   }
 };
-var fetchAndConvert = async (id, input, ctx) => {
+var fetchAndConvert = async (id, input, ctx, config) => {
   const params = { id: String(id), shop: input.shop };
   if (input.cacheKey != null) params.cache_key = String(input.cacheKey);
   if (input.key) params.key = input.key;
@@ -4256,34 +4273,32 @@ var fetchAndConvert = async (id, input, ctx) => {
   if (isMissingUpstreamPayload(data)) throw new NotFoundError(`Widget not found: ${id}`);
   const normalized = convertNumericObjects(deepCamelCase(data));
   if (isProgressBarV1(normalized) && normalized.barSettings.barType === "smart-cart") {
-    const { bars, progressColor } = await fetchProgressBarContext(input.shop, ctx);
+    const { bars, progressColor } = await fetchProgressBarContext(input.shop, ctx, config);
     return convertSmartCartProgressBarToV2({ bars: bars ?? [], id, progressColor, settings: normalized });
   }
   if (isConvertibleProgressBarV1(normalized)) {
-    const { progressColor } = await fetchProgressBarContext(input.shop, ctx);
+    const { progressColor } = await fetchProgressBarContext(input.shop, ctx, config);
     return convertProgressBarToV2({ id, progressColor, settings: normalized });
   }
   const converted = dispatchWidgetTransform(id, normalized, ctx.reportDrift);
   const colorless = isCABRootSection(normalized) ? colorlessProgressBars(converted) : [];
   if (colorless.length > 0) {
-    const { progressColor: color } = await fetchProgressBarContext(input.shop, ctx);
+    const { progressColor: color } = await fetchProgressBarContext(input.shop, ctx, config);
     if (color) for (const bar of colorless) bar.progressColor = color;
   }
   return converted;
 };
-var resolveWidgetExperiment = async (input, ctx) => {
-  if (!input.visitorId) return void 0;
-  try {
-    const { shop } = await fetchUserConfig({ shop: input.shop }, ctx);
-    return resolveExperiment(shop.activeExperiments, input.id, input.visitorId);
-  } catch {
-    return void 0;
-  }
-};
+var resolveWidgetExperiment = (input, config) => input.visitorId && config ? resolveExperiment(config.shop.activeExperiments, input.id, input.visitorId) : void 0;
 var convertWidgetSettings = async (input, ctx) => {
-  const experiment = await resolveWidgetExperiment(input, ctx);
-  const result = await fetchAndConvert(experiment?.elementId ?? input.id, input, ctx);
-  await hydrateMonetizeMarkers(result, input, ctx);
+  const config = input.cacheKey != null && !input.visitorId ? void 0 : await fetchUserConfig({ shop: input.shop }, ctx).catch(() => null);
+  const experiment = resolveWidgetExperiment(input, config);
+  const result = await fetchAndConvert(
+    experiment?.elementId ?? input.id,
+    { ...input, cacheKey: input.cacheKey ?? config?.shop.cacheKey },
+    ctx,
+    config
+  );
+  await hydrateMonetizeMarkers(result, input, ctx, config);
   return experiment && isCABTree(result) ? { ...result, experiment } : result;
 };
 
@@ -4627,7 +4642,14 @@ var MonetizeInputSchema = z29.object({
   zipCode: z29.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
 });
 var WidgetSettingsInputSchema = z29.object({
-  cacheKey: z29.number().optional(),
+  /**
+   * Same domain as `CabShopConfig.cacheKey`, for the same reason: this side WINS the orchestrator's
+   * `input.cacheKey ?? config.shop.cacheKey` (and an explicit value skips the config read entirely), so
+   * an unconstrained `0`/negative/float here would go upstream as a constant never-rotating `cache_key`
+   * and pin the edge copy permanently stale. `.catch(undefined)` because a bogus buster should degrade
+   * the read to un-busted, never 400 a widget render.
+   */
+  cacheKey: z29.number().int().positive().optional().catch(void 0),
   id: z29.number(),
   key: z29.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
   /**

package/dist/server/monetizeOffers.d.ts

@@ -1,3 +1,4 @@
+import { type CabUserConfig } from '../schema/cabShopConfig';
 import { type CABSection } from '../schema/widgets/checkout-and-beyond';
 import { type MonetizeInput, type ServerContext } from '../server/shared';
 export type MonetizeOffers = {
@@ -8,6 +9,7 @@ export type MonetizeOffers = {
  * offer card the extension renders directly. The header chrome (experiment copy + order-confirmed
  * line) is baked inside every card — inside its border, as React draws it — so the response no longer
  * carries a separate `header` (older extension builds read it as optional and render nothing). Empty
- * when the shop isn't ad-enrolled.
+ * when the shop isn't ad-enrolled. `prefetched` is a caller's already-resolved shop config, passed
+ * through to the ads layer's publisher-key lookup so inline hydration doesn't refetch it.
  */
-export declare const fetchMonetizeOffers: (input: MonetizeInput, ctx: ServerContext) => Promise<MonetizeOffers>;
+export declare const fetchMonetizeOffers: (input: MonetizeInput, ctx: ServerContext, prefetched?: CabUserConfig) => Promise<MonetizeOffers>;

package/dist/server/requestSchemas.d.ts

@@ -233,7 +233,7 @@ export declare const MonetizeInputSchema: z.ZodObject<{
 }, z.core.$strip>;
 /** Input for `convertWidgetSettings`. */
 export declare const WidgetSettingsInputSchema: z.ZodObject<{
-    cacheKey: z.ZodOptional<z.ZodNumber>;
+    cacheKey: z.ZodCatch<z.ZodOptional<z.ZodNumber>>;
     id: z.ZodNumber;
     key: z.ZodOptional<z.ZodString>;
     monetize: z.ZodOptional<z.ZodObject<{

package/dist/transforms/index.cjs

@@ -3083,16 +3083,16 @@ var buildOfferCard = (settings, horizontal) => {
       gridCardImage(image),
       title,
       ...variantTitle,
+      ...reviews,
       price,
       ...description,
-      ...reviews,
       ...variants,
       ...quantity,
       ...subscription,
       addButton
     ];
   }
-  const info = rowsLayout([title, ...variantTitle, price, ...description, ...reviews, ...variants]);
+  const info = rowsLayout([title, ...variantTitle, ...reviews, price, ...description, ...variants]);
   const actions = [...subscription, addButton];
   const actionsCell = actions.length === 1 ? actions[0] : rowsLayout(actions);
   const card = {

package/dist/transforms/index.mjs

@@ -3026,16 +3026,16 @@ var buildOfferCard = (settings, horizontal) => {
       gridCardImage(image),
       title,
       ...variantTitle,
+      ...reviews,
       price,
       ...description,
-      ...reviews,
       ...variants,
       ...quantity,
       ...subscription,
       addButton
     ];
   }
-  const info = rowsLayout([title, ...variantTitle, price, ...description, ...reviews, ...variants]);
+  const info = rowsLayout([title, ...variantTitle, ...reviews, price, ...description, ...variants]);
   const actions = [...subscription, addButton];
   const actionsCell = actions.length === 1 ? actions[0] : rowsLayout(actions);
   const card = {

package/dist/transforms/offerV1/offerCard.d.ts

@@ -7,9 +7,12 @@ export declare const borderToken: <T extends readonly string[]>(tokens: T, value
  *
  * `horizontal` mirrors the v1 layout orientation (see `convertOfferToV2`):
  * - horizontal (v1 `list`/default, vertical-stacked products): a 3-column grid card —
- * image | title/price/reviews/variants | actions — matching the compact V1 row.
+ * image | title/reviews/price/variants | actions — matching the compact V1 row.
  * - vertical (v1 `grid`/`line`, side-by-side products): a flat top-to-bottom stack
- * (image → title → price → … → button), the narrow column card.
+ * (image → title → reviews → price → … → button), the narrow column card.
+ *
+ * Reviews sit ABOVE the price in both orientations: legacy `OfferDetail` renders the star
+ * rating between the variant title and the price line (REB-24225).
  *
  * Quantity is a full-width row beneath the card in the horizontal layout; in the vertical
  * layout it sits inline in the stack. NOT carried: the savings-amount badge (no live v1

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rebuy/rebuy",
-    "version": "3.12.0",
+    "version": "3.13.0",
     "description": "Shared zod schemas, legacy-to-CAB widget transforms, and server orchestrators for Rebuy's Shopify consumers (rebuy-api, admin-nextjs, rebuy-shopify-extensions)",
     "license": "MIT",
     "author": "Rebuy, Inc.",