@rebuy/rebuy 3.23.0 → 3.24.0

package/README.md

@@ -17,6 +17,7 @@ Node `^22.14.0 || ^24.10.0 || ^26.0.0` for development; the published artifacts
 | Subpath | Contents |
 | --- | --- |
 | `@rebuy/rebuy` | Root barrel: schemas, client helpers, utilities |
+| `@rebuy/rebuy/cab` | zod-free CAB renderer helpers shared by every renderer (`contentText`, `tiptapPlainText`, `tiptapRuns`, `asLayout`, `idFromGid`, `toCents`, `decoratedOrderId`) |
 | `@rebuy/rebuy/client` | `RebuyClient` API client |
 | `@rebuy/rebuy/gwp` | Gift-with-purchase validation helpers |
 | `@rebuy/rebuy/pricing` | Variant pricing/discount forecast (`priceVariant`, `currencyDecimals`) |

package/dist/cab/asLayout.d.ts

@@ -0,0 +1,12 @@
+import type { CABLayoutSection } from '../schema/widgets/checkout-and-beyond/layout';
+/**
+ * Render a layout-derived section (cart-line, offers, carousel, banner) as a plain layout; the variable
+ * fields are dropped — the scope was already mounted and the visibility binding already evaluated at
+ * dispatch, and `mutators` already has its host (a re-dispatch must not double any of them).
+ *
+ * The literal (checked against `SectionType`) rather than the runtime enum: `common.ts` is not tree-shakeable,
+ * so importing one constant would drag every CAB enum into each renderer that bundles this subpath.
+ */
+export declare const asLayout: <T extends {
+    sectionType: string;
+}>(section: T) => CABLayoutSection;

package/dist/cab/contentText.d.ts

@@ -0,0 +1,8 @@
+import { type Variables } from '../cab/interpolateAndSanitize';
+import type { CABTextSection } from '../schema/widgets/checkout-and-beyond/text';
+/**
+ * A text section's buyer-language copy as ONE interpolated, sanitized plain string — rich content flattens
+ * to bare text (marks and structure drop). The shared reading behind button label slots and the `content`
+ * mutator trigger, so "what does this copy say" has a single answer.
+ */
+export declare const contentText: (content: CABTextSection["content"], language?: string, variables?: Variables) => string;

package/dist/cab/decoratedOrderId.d.ts

@@ -0,0 +1,2 @@
+/** Numeric part of the decorated order id (`gid://shopify/Order(Identity)/123` → `123`) → ads `transaction_id`. */
+export declare const decoratedOrderId: (orderId: string | undefined) => string | undefined;

package/dist/cab/gid.d.ts

@@ -0,0 +1,2 @@
+/** `gid://shopify/X/123` → `123` — the engine speaks numeric ids, Shopify's APIs speak gids. */
+export declare const idFromGid: (gid: string) => string;

package/dist/cab/index.cjs

@@ -0,0 +1,177 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/cab/index.ts
+var cab_exports = {};
+__export(cab_exports, {
+  asLayout: () => asLayout,
+  contentText: () => contentText,
+  decoratedOrderId: () => decoratedOrderId,
+  idFromGid: () => idFromGid,
+  interpolateAndSanitize: () => interpolateAndSanitize,
+  isTiptapDoc: () => isTiptapDoc,
+  selectLanguage: () => selectLanguage,
+  tiptapPlainText: () => tiptapPlainText,
+  tiptapRuns: () => tiptapRuns,
+  toCents: () => toCents
+});
+module.exports = __toCommonJS(cab_exports);
+
+// src/cab/asLayout.ts
+var asLayout = (section) => ({
+  ...section,
+  mutators: void 0,
+  sectionType: "layout",
+  variables: void 0,
+  visibility: void 0
+});
+
+// src/schema/widgets/checkout-and-beyond/regex.ts
+var DYNAMIC_TOKEN_REGEX = /^\{\{\s*[A-Za-z]+\s*\}\}$/;
+var DYNAMIC_TOKEN_ANYWHERE_REGEX = /\{\{\s*[A-Za-z0-9_]+\s*\}\}/;
+var HTML_TAGS_REGEX = /<\/?[a-zA-Z][^>]*>/g;
+
+// src/cab/interpolateAndSanitize.ts
+var TOKEN_REGEX = /{{1,2}\s*([^{}\s]+)\s*}{1,2}/g;
+var toCamelCase = (key) => key.replace(/_([a-z0-9])/g, (_, char) => char.toUpperCase());
+var resolveKey = (key, variables) => {
+  if (Object.hasOwn(variables, key)) return key;
+  const camel = toCamelCase(key);
+  if (Object.hasOwn(variables, camel)) return camel;
+  const lower = camel.toLowerCase();
+  return Object.keys(variables).find((name) => name.toLowerCase() === lower);
+};
+var interpolateAndSanitize = (input, variables) => (input ?? "").replace(TOKEN_REGEX, (match, key) => {
+  if (!variables) return match;
+  const resolved = resolveKey(key, variables);
+  return resolved === void 0 ? match : String(variables[resolved] ?? "");
+}).replace(HTML_TAGS_REGEX, "");
+
+// src/cab/selectLanguage.ts
+var FALLBACK_LANGUAGE = "en";
+var selectLanguage = (content, language) => {
+  if (!content) return void 0;
+  if (language && Object.hasOwn(content, language)) return content[language];
+  if (Object.hasOwn(content, FALLBACK_LANGUAGE)) return content[FALLBACK_LANGUAGE];
+  return Object.values(content)[0];
+};
+
+// src/cab/listOf.ts
+var listOf = (value) => Array.isArray(value) ? value.filter((item) => !!item) : [];
+
+// src/cab/tiptapPlain.ts
+var isTiptapDoc = (value) => !!value && typeof value === "object" && value.type === "doc";
+var tiptapPlainText = (doc) => listOf(doc?.content).map(
+  (paragraph) => listOf(paragraph.content).map((node) => node.text ?? "").join("")
+).join(" ").trim();
+
+// src/cab/contentText.ts
+var contentText = (content, language, variables) => {
+  const selected = selectLanguage(content, language);
+  const text = typeof selected === "string" ? selected : isTiptapDoc(selected) ? tiptapPlainText(selected) : "";
+  return interpolateAndSanitize(text, variables);
+};
+
+// src/cab/decoratedOrderId.ts
+var decoratedOrderId = (orderId) => orderId?.match(/\/Order(?:Identity)?\/(\d+)$/)?.[1] ?? orderId;
+
+// src/cab/gid.ts
+var idFromGid = (gid) => gid.slice(gid.lastIndexOf("/") + 1);
+
+// src/transforms/htmlToTiptap/isValidHref.ts
+var RELATIVE_BASE = "https://x.invalid";
+var ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]);
+var isValidHref = (href) => {
+  if (!href) return false;
+  if (href === "#") return true;
+  if (DYNAMIC_TOKEN_REGEX.test(href)) return true;
+  if (href.startsWith("/")) {
+    try {
+      return new URL(href, RELATIVE_BASE).origin === RELATIVE_BASE;
+    } catch {
+      return false;
+    }
+  }
+  try {
+    const url = new URL(href);
+    return ALLOWED_PROTOCOLS.has(url.protocol);
+  } catch {
+    return false;
+  }
+};
+
+// src/transforms/htmlToTiptap/linkSafety.ts
+var DEFAULT_LINK_TARGET = "_blank";
+var DEFAULT_LINK_REL = "noopener noreferrer nofollow";
+var ensureSafeRel = (rel, target) => {
+  if (target !== DEFAULT_LINK_TARGET) return rel;
+  const sourceTokens = (rel ?? "").split(/\s+/).filter(Boolean);
+  if (sourceTokens.length === 0) return DEFAULT_LINK_REL;
+  const tokens = new Set(sourceTokens.filter((token) => token.toLowerCase() !== "opener"));
+  tokens.add("noopener");
+  tokens.add("noreferrer");
+  return Array.from(tokens).join(" ");
+};
+
+// src/cab/tiptapRuns.ts
+var HEADING = "heading";
+var isHeadingMark = (mark) => mark.type === "textStyle" && mark.attrs?.fontSize === HEADING;
+var isRenderableHref = (href) => isValidHref(href) && !DYNAMIC_TOKEN_ANYWHERE_REGEX.test(href);
+var toRun = (node, variables) => {
+  const run = {
+    bold: false,
+    italic: false,
+    strike: false,
+    text: interpolateAndSanitize(node.text ?? "", variables)
+  };
+  let link;
+  let textStyle;
+  for (const mark of listOf(node.marks)) {
+    if (mark.type === "bold") run.bold = true;
+    else if (mark.type === "italic") run.italic = true;
+    else if (mark.type === "strike") run.strike = true;
+    else if (mark.type === "link") link = mark;
+    else if (mark.type === "textStyle") textStyle = mark;
+  }
+  const color = textStyle?.attrs?.color;
+  const fontSize = textStyle?.attrs?.fontSize;
+  if (color) run.color = color;
+  if (fontSize && fontSize !== HEADING) run.fontSize = fontSize;
+  if (link) {
+    const href = interpolateAndSanitize(link.attrs?.href ?? "", variables);
+    if (isRenderableHref(href)) {
+      const target = link.attrs?.target ?? DEFAULT_LINK_TARGET;
+      const rel = ensureSafeRel(link.attrs?.rel, target);
+      run.href = href;
+      if (rel) run.rel = rel;
+      if (target === DEFAULT_LINK_TARGET) run.target = DEFAULT_LINK_TARGET;
+    }
+  }
+  return run;
+};
+var tiptapRuns = (paragraph, variables) => {
+  const content = listOf(paragraph?.content);
+  return {
+    heading: content.some((node) => listOf(node.marks).some(isHeadingMark)),
+    runs: content.map((node) => toRun(node, variables))
+  };
+};
+
+// src/cab/toCents.ts
+var toCents = (amount) => Math.round(Number(amount ?? 0) * 100);

package/dist/cab/index.d.ts

@@ -0,0 +1,9 @@
+export * from '../cab/asLayout';
+export * from '../cab/contentText';
+export * from '../cab/decoratedOrderId';
+export * from '../cab/gid';
+export * from '../cab/interpolateAndSanitize';
+export * from '../cab/selectLanguage';
+export * from '../cab/tiptapPlain';
+export * from '../cab/tiptapRuns';
+export * from '../cab/toCents';

package/dist/cab/index.mjs

@@ -0,0 +1,154 @@
+// src/cab/asLayout.ts
+var asLayout = (section) => ({
+  ...section,
+  mutators: void 0,
+  sectionType: "layout",
+  variables: void 0,
+  visibility: void 0
+});
+
+// src/schema/widgets/checkout-and-beyond/regex.ts
+var DYNAMIC_TOKEN_REGEX = /^\{\{\s*[A-Za-z]+\s*\}\}$/;
+var DYNAMIC_TOKEN_ANYWHERE_REGEX = /\{\{\s*[A-Za-z0-9_]+\s*\}\}/;
+var HTML_TAGS_REGEX = /<\/?[a-zA-Z][^>]*>/g;
+
+// src/cab/interpolateAndSanitize.ts
+var TOKEN_REGEX = /{{1,2}\s*([^{}\s]+)\s*}{1,2}/g;
+var toCamelCase = (key) => key.replace(/_([a-z0-9])/g, (_, char) => char.toUpperCase());
+var resolveKey = (key, variables) => {
+  if (Object.hasOwn(variables, key)) return key;
+  const camel = toCamelCase(key);
+  if (Object.hasOwn(variables, camel)) return camel;
+  const lower = camel.toLowerCase();
+  return Object.keys(variables).find((name) => name.toLowerCase() === lower);
+};
+var interpolateAndSanitize = (input, variables) => (input ?? "").replace(TOKEN_REGEX, (match, key) => {
+  if (!variables) return match;
+  const resolved = resolveKey(key, variables);
+  return resolved === void 0 ? match : String(variables[resolved] ?? "");
+}).replace(HTML_TAGS_REGEX, "");
+
+// src/cab/selectLanguage.ts
+var FALLBACK_LANGUAGE = "en";
+var selectLanguage = (content, language) => {
+  if (!content) return void 0;
+  if (language && Object.hasOwn(content, language)) return content[language];
+  if (Object.hasOwn(content, FALLBACK_LANGUAGE)) return content[FALLBACK_LANGUAGE];
+  return Object.values(content)[0];
+};
+
+// src/cab/listOf.ts
+var listOf = (value) => Array.isArray(value) ? value.filter((item) => !!item) : [];
+
+// src/cab/tiptapPlain.ts
+var isTiptapDoc = (value) => !!value && typeof value === "object" && value.type === "doc";
+var tiptapPlainText = (doc) => listOf(doc?.content).map(
+  (paragraph) => listOf(paragraph.content).map((node) => node.text ?? "").join("")
+).join(" ").trim();
+
+// src/cab/contentText.ts
+var contentText = (content, language, variables) => {
+  const selected = selectLanguage(content, language);
+  const text = typeof selected === "string" ? selected : isTiptapDoc(selected) ? tiptapPlainText(selected) : "";
+  return interpolateAndSanitize(text, variables);
+};
+
+// src/cab/decoratedOrderId.ts
+var decoratedOrderId = (orderId) => orderId?.match(/\/Order(?:Identity)?\/(\d+)$/)?.[1] ?? orderId;
+
+// src/cab/gid.ts
+var idFromGid = (gid) => gid.slice(gid.lastIndexOf("/") + 1);
+
+// src/transforms/htmlToTiptap/isValidHref.ts
+var RELATIVE_BASE = "https://x.invalid";
+var ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]);
+var isValidHref = (href) => {
+  if (!href) return false;
+  if (href === "#") return true;
+  if (DYNAMIC_TOKEN_REGEX.test(href)) return true;
+  if (href.startsWith("/")) {
+    try {
+      return new URL(href, RELATIVE_BASE).origin === RELATIVE_BASE;
+    } catch {
+      return false;
+    }
+  }
+  try {
+    const url = new URL(href);
+    return ALLOWED_PROTOCOLS.has(url.protocol);
+  } catch {
+    return false;
+  }
+};
+
+// src/transforms/htmlToTiptap/linkSafety.ts
+var DEFAULT_LINK_TARGET = "_blank";
+var DEFAULT_LINK_REL = "noopener noreferrer nofollow";
+var ensureSafeRel = (rel, target) => {
+  if (target !== DEFAULT_LINK_TARGET) return rel;
+  const sourceTokens = (rel ?? "").split(/\s+/).filter(Boolean);
+  if (sourceTokens.length === 0) return DEFAULT_LINK_REL;
+  const tokens = new Set(sourceTokens.filter((token) => token.toLowerCase() !== "opener"));
+  tokens.add("noopener");
+  tokens.add("noreferrer");
+  return Array.from(tokens).join(" ");
+};
+
+// src/cab/tiptapRuns.ts
+var HEADING = "heading";
+var isHeadingMark = (mark) => mark.type === "textStyle" && mark.attrs?.fontSize === HEADING;
+var isRenderableHref = (href) => isValidHref(href) && !DYNAMIC_TOKEN_ANYWHERE_REGEX.test(href);
+var toRun = (node, variables) => {
+  const run = {
+    bold: false,
+    italic: false,
+    strike: false,
+    text: interpolateAndSanitize(node.text ?? "", variables)
+  };
+  let link;
+  let textStyle;
+  for (const mark of listOf(node.marks)) {
+    if (mark.type === "bold") run.bold = true;
+    else if (mark.type === "italic") run.italic = true;
+    else if (mark.type === "strike") run.strike = true;
+    else if (mark.type === "link") link = mark;
+    else if (mark.type === "textStyle") textStyle = mark;
+  }
+  const color = textStyle?.attrs?.color;
+  const fontSize = textStyle?.attrs?.fontSize;
+  if (color) run.color = color;
+  if (fontSize && fontSize !== HEADING) run.fontSize = fontSize;
+  if (link) {
+    const href = interpolateAndSanitize(link.attrs?.href ?? "", variables);
+    if (isRenderableHref(href)) {
+      const target = link.attrs?.target ?? DEFAULT_LINK_TARGET;
+      const rel = ensureSafeRel(link.attrs?.rel, target);
+      run.href = href;
+      if (rel) run.rel = rel;
+      if (target === DEFAULT_LINK_TARGET) run.target = DEFAULT_LINK_TARGET;
+    }
+  }
+  return run;
+};
+var tiptapRuns = (paragraph, variables) => {
+  const content = listOf(paragraph?.content);
+  return {
+    heading: content.some((node) => listOf(node.marks).some(isHeadingMark)),
+    runs: content.map((node) => toRun(node, variables))
+  };
+};
+
+// src/cab/toCents.ts
+var toCents = (amount) => Math.round(Number(amount ?? 0) * 100);
+export {
+  asLayout,
+  contentText,
+  decoratedOrderId,
+  idFromGid,
+  interpolateAndSanitize,
+  isTiptapDoc,
+  selectLanguage,
+  tiptapPlainText,
+  tiptapRuns,
+  toCents
+};

package/dist/cab/interpolateAndSanitize.d.ts

@@ -0,0 +1,8 @@
+export type Variables = Record<string, string | number | null | undefined>;
+/**
+ * Interpolate tokens then strip HTML (with the same tag-shaped regex the schema validates against, so the
+ * client never mangles copy the server accepts) — defense-in-depth, since token values can carry HTML from
+ * cart/merchant settings. Unknown tokens are left intact so missing bindings surface during dev (and so
+ * incidental single-brace text that names no variable is never touched).
+ */
+export declare const interpolateAndSanitize: (input: string, variables?: Variables) => string;

package/dist/cab/listOf.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Raw-payload tolerance for the list-shaped Tiptap fields. `TiptapDocument.content`,
+ * `TiptapParagraph.content` and `TiptapText.marks` are each
+ * `z.union([z.array(…), z.strictObject({}).transform(() => [])])` — that second arm exists because stored
+ * payloads serialize an empty list as `{}` — and any of them can carry `null` holes. The CAB renderer
+ * helpers read UNPARSED payloads, so none of those shapes may throw; a malformed list degrades to empty
+ * rather than killing the section around it.
+ */
+export declare const listOf: <T>(value: unknown) => T[];

package/dist/cab/selectLanguage.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Fallback chain: requested language, then 'en', then first available value.
+ *
+ * `Object.hasOwn`, never `in` — `in` would resolve an inherited `Object.prototype` key (`constructor`,
+ * `toString`) as if it were a translation. Far less reachable than in `interpolateAndSanitize`, since a
+ * language code is not merchant-authored, but the two must agree on what counts as present.
+ */
+export declare const selectLanguage: <T>(content: Record<string, T> | undefined | null, language: string | undefined) => T | undefined;

package/dist/cab/tiptapPlain.d.ts

@@ -0,0 +1,10 @@
+import type { TiptapDocument } from '../schema/widgets/checkout-and-beyond/text';
+/** Locale-resolved text content is either a plain string or a Tiptap document. */
+export declare const isTiptapDoc: (value: unknown) => value is TiptapDocument;
+/**
+ * The document's bare text — nodes concatenated, paragraphs space-joined; marks and structure drop.
+ *
+ * Every level goes through `listOf`, including the doc itself, because this reads raw payloads: the `{}`
+ * empty-list arm and `null` holes are both shapes the schema accepts, at any depth.
+ */
+export declare const tiptapPlainText: (doc: TiptapDocument) => string;

package/dist/cab/tiptapRuns.d.ts

@@ -0,0 +1,40 @@
+import { type Variables } from '../cab/interpolateAndSanitize';
+import type { InlineTextSizeName, TextColorName } from '../schema/widgets/checkout-and-beyond/common';
+import type { TiptapParagraph } from '../schema/widgets/checkout-and-beyond/text';
+/**
+ * One text run of a paragraph with its marks resolved to facts. Tokens (`color`, `fontSize`) are the
+ * payload's — mapping them to px/hex/tone is each renderer's. `bold` is reported even inside a heading;
+ * whether the heading element is already bold is the renderer's to know.
+ *
+ * A run carrying `href` is safe to hand to an anchor as-is: the scheme is allowlisted and, for
+ * `target: '_blank'`, `rel` is guaranteed to contain `noopener noreferrer`. Render BOTH — dropping `rel`
+ * re-opens reverse tabnabbing on merchant-authored links, which is the per-renderer knowledge this
+ * subpath exists to delete. A link whose href fails the allowlist yields a run with no `href`/`rel`/
+ * `target` at all, so it renders as plain text rather than as a live unsafe link.
+ */
+export type TiptapRun = {
+    bold: boolean;
+    color?: TextColorName;
+    fontSize?: InlineTextSizeName;
+    href?: string;
+    italic: boolean;
+    rel?: string;
+    strike: boolean;
+    target?: '_blank';
+    text: string;
+};
+/** `heading` promotes the WHOLE paragraph (a block signal, never an inline size — see `textSizeNames`). */
+export type TiptapParagraphRuns = {
+    heading: boolean;
+    runs: TiptapRun[];
+};
+/**
+ * A Tiptap paragraph as ordered styled runs plus its heading promotion — the one mark reading every
+ * renderer shares.
+ *
+ * Takes a payload in EITHER shape: schema-parsed, or raw off the wire. Malformed lists degrade to empty
+ * rather than throwing — including a nullish paragraph, so a renderer can map this straight over a raw
+ * `doc.content` — and the two link fields the schema defaults (`target`, `rel`) are resolved to the same
+ * effective values a parse would have produced, so a run never depends on whether the caller parsed.
+ */
+export declare const tiptapRuns: (paragraph: TiptapParagraph, variables?: Variables) => TiptapParagraphRuns;

package/dist/cab/toCents.d.ts

@@ -0,0 +1,2 @@
+/** Presentment amount → integer cents (engine money unit); matches the cart-context subtotal conversion. */
+export declare const toCents: (amount: string | number | undefined) => number;

package/dist/index.cjs

@@ -90,6 +90,7 @@ __export(src_exports, {
   ContentOperator: () => ContentOperator,
   DEFAULT_ENDPOINTS: () => DEFAULT_ENDPOINTS,
   DESCRIPTION_LABELS: () => DESCRIPTION_LABELS,
+  DYNAMIC_TOKEN_ANYWHERE_REGEX: () => DYNAMIC_TOKEN_ANYWHERE_REGEX,
   DYNAMIC_TOKEN_REGEX: () => DYNAMIC_TOKEN_REGEX,
   Direction: () => Direction,
   DiscountSource: () => DiscountSource,
@@ -1936,6 +1937,7 @@ var import_compat = require("es-toolkit/compat");
 // src/schema/widgets/checkout-and-beyond/regex.ts
 var ARRAY_INDEX_STRING = /^(0|[1-9]\d*)$/;
 var DYNAMIC_TOKEN_REGEX = /^\{\{\s*[A-Za-z]+\s*\}\}$/;
+var DYNAMIC_TOKEN_ANYWHERE_REGEX = /\{\{\s*[A-Za-z0-9_]+\s*\}\}/;
 var HEX_COLOR_REGEX = /^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/;
 var ROOT_RELATIVE_PATH_REGEX = /^\/(?!\/)/;
 var HTML_TAGS_REGEX = /<\/?[a-zA-Z][^>]*>/g;

package/dist/index.mjs

@@ -1642,6 +1642,7 @@ import { get as get2, isString } from "es-toolkit/compat";
 // src/schema/widgets/checkout-and-beyond/regex.ts
 var ARRAY_INDEX_STRING = /^(0|[1-9]\d*)$/;
 var DYNAMIC_TOKEN_REGEX = /^\{\{\s*[A-Za-z]+\s*\}\}$/;
+var DYNAMIC_TOKEN_ANYWHERE_REGEX = /\{\{\s*[A-Za-z0-9_]+\s*\}\}/;
 var HEX_COLOR_REGEX = /^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/;
 var ROOT_RELATIVE_PATH_REGEX = /^\/(?!\/)/;
 var HTML_TAGS_REGEX = /<\/?[a-zA-Z][^>]*>/g;
@@ -4915,6 +4916,7 @@ export {
   ContentOperator,
   DEFAULT_ENDPOINTS,
   DESCRIPTION_LABELS,
+  DYNAMIC_TOKEN_ANYWHERE_REGEX,
   DYNAMIC_TOKEN_REGEX,
   Direction,
   DiscountSource,

package/dist/schema/checkout-and-beyond/index.cjs

@@ -79,6 +79,7 @@ __export(checkout_and_beyond_exports, {
   ContentOperator: () => ContentOperator,
   DEFAULT_ENDPOINTS: () => DEFAULT_ENDPOINTS,
   DESCRIPTION_LABELS: () => DESCRIPTION_LABELS,
+  DYNAMIC_TOKEN_ANYWHERE_REGEX: () => DYNAMIC_TOKEN_ANYWHERE_REGEX,
   DYNAMIC_TOKEN_REGEX: () => DYNAMIC_TOKEN_REGEX,
   Direction: () => Direction,
   DiscountSource: () => DiscountSource,
@@ -510,6 +511,7 @@ var IconTone = freezeEnum(iconTones);
 // src/schema/widgets/checkout-and-beyond/regex.ts
 var ARRAY_INDEX_STRING = /^(0|[1-9]\d*)$/;
 var DYNAMIC_TOKEN_REGEX = /^\{\{\s*[A-Za-z]+\s*\}\}$/;
+var DYNAMIC_TOKEN_ANYWHERE_REGEX = /\{\{\s*[A-Za-z0-9_]+\s*\}\}/;
 var HEX_COLOR_REGEX = /^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/;
 var ROOT_RELATIVE_PATH_REGEX = /^\/(?!\/)/;
 var HTML_TAGS_REGEX = /<\/?[a-zA-Z][^>]*>/g;

package/dist/schema/checkout-and-beyond/index.mjs

@@ -306,6 +306,7 @@ var IconTone = freezeEnum(iconTones);
 // src/schema/widgets/checkout-and-beyond/regex.ts
 var ARRAY_INDEX_STRING = /^(0|[1-9]\d*)$/;
 var DYNAMIC_TOKEN_REGEX = /^\{\{\s*[A-Za-z]+\s*\}\}$/;
+var DYNAMIC_TOKEN_ANYWHERE_REGEX = /\{\{\s*[A-Za-z0-9_]+\s*\}\}/;
 var HEX_COLOR_REGEX = /^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/;
 var ROOT_RELATIVE_PATH_REGEX = /^\/(?!\/)/;
 var HTML_TAGS_REGEX = /<\/?[a-zA-Z][^>]*>/g;
@@ -1942,6 +1943,7 @@ export {
   ContentOperator,
   DEFAULT_ENDPOINTS,
   DESCRIPTION_LABELS,
+  DYNAMIC_TOKEN_ANYWHERE_REGEX,
   DYNAMIC_TOKEN_REGEX,
   Direction,
   DiscountSource,

package/dist/schema/widgets/checkout-and-beyond/regex.d.ts

@@ -1,7 +1,29 @@
 /** Matches a valid array index string (e.g., "0", "1", "42"). */
 export declare const ARRAY_INDEX_STRING: RegExp;
-/** Matches a dynamic token. */
+/**
+ * VALIDATION grammar: whether a whole value IS a dynamic token. Gates what may be STORED (a link href in
+ * `text.ts`, an image source in `image.ts`), so widening it is a schema shape change that ripples to every
+ * consumer. Deliberately narrow — letters only.
+ */
 export declare const DYNAMIC_TOKEN_REGEX: RegExp;
+/**
+ * DETECTION grammar: whether a value still CONTAINS a token after interpolation, i.e. one that failed to
+ * bind. Deliberately NOT derived from the validation grammar above — the two pull in opposite directions.
+ * Validation must stay narrow to keep stored values predictable; detection must be as wide as what
+ * `interpolateAndSanitize` binds in the CANONICAL double-brace spelling, because anything it misses there
+ * is a dead link handed to a renderer. Hence `[A-Za-z0-9_]+` on the key: `resolveKey` camelizes legacy
+ * snake_case (`{{utm_source}}` binds to `utmSource`), so those spellings have to be detectable too.
+ *
+ * Still double-brace only, and still no `.`: that is what keeps third-party click macros — Google Ads'
+ * `{placement}`, Meta's `{{ad.id}}` — out of it. Nothing binds those names today, and dropping a working
+ * ad link is worse than leaving a dead one.
+ *
+ * BOTH exclusions are deliberate carve-outs rather than faithful widenings. `TOKEN_REGEX` quantifies open
+ * and close braces independently, so `{slug}` and `{{slug}` bind yet go undetected; its key class is
+ * `[^{}\s]+`, so a dotted name would bind too if anything were ever registered under one. Each keeps a
+ * probably-dead link, known and tolerated as the cheaper error.
+ */
+export declare const DYNAMIC_TOKEN_ANYWHERE_REGEX: RegExp;
 /** Matches a valid hex color code. */
 export declare const HEX_COLOR_REGEX: RegExp;
 /**

package/dist/server/index.cjs

@@ -2453,13 +2453,19 @@ var isSkipping = (stack = []) => stack.some(({ skip }) => skip);
 var makeDoc = (content, blockSpacing) => TiptapDocument.parse({ attrs: { blockSpacing }, content });
 
 // src/transforms/htmlToTiptap/isValidHref.ts
-var DYNAMIC_TOKEN_REGEX2 = /^\{\{\s*[A-Za-z]+\s*\}\}$/;
+var RELATIVE_BASE = "https://x.invalid";
 var ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]);
 var isValidHref = (href) => {
   if (!href) return false;
   if (href === "#") return true;
-  if (DYNAMIC_TOKEN_REGEX2.test(href)) return true;
-  if (href.startsWith("/") && !href.startsWith("//")) return true;
+  if (DYNAMIC_TOKEN_REGEX.test(href)) return true;
+  if (href.startsWith("/")) {
+    try {
+      return new URL(href, RELATIVE_BASE).origin === RELATIVE_BASE;
+    } catch {
+      return false;
+    }
+  }
   try {
     const url = new URL(href);
     return ALLOWED_PROTOCOLS.has(url.protocol);
@@ -2468,26 +2474,32 @@ var isValidHref = (href) => {
   }
 };
 
-// src/transforms/htmlToTiptap/buildLinkMark.ts
-var DEFAULT_TARGET = "_blank";
-var DEFAULT_REL = "noopener noreferrer nofollow";
+// src/transforms/htmlToTiptap/linkSafety.ts
+var DEFAULT_LINK_TARGET = "_blank";
+var DEFAULT_LINK_REL = "noopener noreferrer nofollow";
 var ensureSafeRel = (rel, target) => {
-  if (target !== "_blank") return rel;
+  if (target !== DEFAULT_LINK_TARGET) return rel;
   const sourceTokens = (rel ?? "").split(/\s+/).filter(Boolean);
-  if (sourceTokens.length === 0) return DEFAULT_REL;
+  if (sourceTokens.length === 0) return DEFAULT_LINK_REL;
   const tokens = new Set(sourceTokens.filter((token) => token.toLowerCase() !== "opener"));
   tokens.add("noopener");
   tokens.add("noreferrer");
   return Array.from(tokens).join(" ");
 };
+
+// src/transforms/htmlToTiptap/buildLinkMark.ts
 var buildLinkMark = (attrs = {}) => {
   const { href } = attrs;
   if (!href || !isValidHref(href)) return null;
-  const target = attrs.target ?? DEFAULT_TARGET;
+  const target = attrs.target ?? DEFAULT_LINK_TARGET;
   return {
     attrs: {
       class: null,
       href,
+      // `Mark` is the POST-parse shape, where `rel` is always a string. This value is PRE-parse: a
+      // non-`_blank` link whose source omits `rel` deliberately stays undefined so the schema's
+      // `.default()` supplies it. Hence the cast — the old implicit `rel: string` parameter was
+      // making the same claim, just without saying so.
       rel: ensureSafeRel(attrs.rel, target),
       target
     },

package/dist/server/index.mjs

@@ -2402,13 +2402,19 @@ var isSkipping = (stack = []) => stack.some(({ skip }) => skip);
 var makeDoc = (content, blockSpacing) => TiptapDocument.parse({ attrs: { blockSpacing }, content });
 
 // src/transforms/htmlToTiptap/isValidHref.ts
-var DYNAMIC_TOKEN_REGEX2 = /^\{\{\s*[A-Za-z]+\s*\}\}$/;
+var RELATIVE_BASE = "https://x.invalid";
 var ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]);
 var isValidHref = (href) => {
   if (!href) return false;
   if (href === "#") return true;
-  if (DYNAMIC_TOKEN_REGEX2.test(href)) return true;
-  if (href.startsWith("/") && !href.startsWith("//")) return true;
+  if (DYNAMIC_TOKEN_REGEX.test(href)) return true;
+  if (href.startsWith("/")) {
+    try {
+      return new URL(href, RELATIVE_BASE).origin === RELATIVE_BASE;
+    } catch {
+      return false;
+    }
+  }
   try {
     const url = new URL(href);
     return ALLOWED_PROTOCOLS.has(url.protocol);
@@ -2417,26 +2423,32 @@ var isValidHref = (href) => {
   }
 };
 
-// src/transforms/htmlToTiptap/buildLinkMark.ts
-var DEFAULT_TARGET = "_blank";
-var DEFAULT_REL = "noopener noreferrer nofollow";
+// src/transforms/htmlToTiptap/linkSafety.ts
+var DEFAULT_LINK_TARGET = "_blank";
+var DEFAULT_LINK_REL = "noopener noreferrer nofollow";
 var ensureSafeRel = (rel, target) => {
-  if (target !== "_blank") return rel;
+  if (target !== DEFAULT_LINK_TARGET) return rel;
   const sourceTokens = (rel ?? "").split(/\s+/).filter(Boolean);
-  if (sourceTokens.length === 0) return DEFAULT_REL;
+  if (sourceTokens.length === 0) return DEFAULT_LINK_REL;
   const tokens = new Set(sourceTokens.filter((token) => token.toLowerCase() !== "opener"));
   tokens.add("noopener");
   tokens.add("noreferrer");
   return Array.from(tokens).join(" ");
 };
+
+// src/transforms/htmlToTiptap/buildLinkMark.ts
 var buildLinkMark = (attrs = {}) => {
   const { href } = attrs;
   if (!href || !isValidHref(href)) return null;
-  const target = attrs.target ?? DEFAULT_TARGET;
+  const target = attrs.target ?? DEFAULT_LINK_TARGET;
   return {
     attrs: {
       class: null,
       href,
+      // `Mark` is the POST-parse shape, where `rel` is always a string. This value is PRE-parse: a
+      // non-`_blank` link whose source omits `rel` deliberately stays undefined so the schema's
+      // `.default()` supplies it. Hence the cast — the old implicit `rel: string` parameter was
+      // making the same claim, just without saying so.
       rel: ensureSafeRel(attrs.rel, target),
       target
     },

package/dist/transforms/htmlToTiptap/linkSafety.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The schema defaults for an `<a>` mark when a payload omits them. Match `TiptapText` in
+ * `~/schema/widgets/checkout-and-beyond/text` so anything resolving a link BEFORE (or without) a parse
+ * lands on the same effective values the downstream parse would have used.
+ */
+export declare const DEFAULT_LINK_TARGET = "_blank";
+export declare const DEFAULT_LINK_REL = "noopener noreferrer nofollow";
+/**
+ * Forces `noopener noreferrer` on every `_blank` link to defend against reverse-tabnabbing
+ * (window.opener attacks). When the source omits `rel` entirely, fall back to the schema default
+ * (`noopener noreferrer nofollow`). When source `rel` is non-empty, preserve the existing tokens, drop
+ * `opener`, and ensure the safe pair is present.
+ *
+ * Non-`_blank` targets pass through UNCHANGED — they can't be tabnabbed. That includes passing `undefined`
+ * straight back: `TiptapText`'s `rel: z.string().default('noopener noreferrer nofollow')` fires on
+ * `undefined` only, so substituting `''` here would silently strip `nofollow` off every `_self` link at
+ * parse time. The absent value is the signal that the schema default should apply.
+ */
+export declare const ensureSafeRel: (rel: string | undefined, target: string) => string | undefined;

package/dist/transforms/index.cjs

@@ -1837,13 +1837,19 @@ var isSkipping = (stack = []) => stack.some(({ skip }) => skip);
 var makeDoc = (content, blockSpacing) => TiptapDocument.parse({ attrs: { blockSpacing }, content });
 
 // src/transforms/htmlToTiptap/isValidHref.ts
-var DYNAMIC_TOKEN_REGEX2 = /^\{\{\s*[A-Za-z]+\s*\}\}$/;
+var RELATIVE_BASE = "https://x.invalid";
 var ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]);
 var isValidHref = (href) => {
   if (!href) return false;
   if (href === "#") return true;
-  if (DYNAMIC_TOKEN_REGEX2.test(href)) return true;
-  if (href.startsWith("/") && !href.startsWith("//")) return true;
+  if (DYNAMIC_TOKEN_REGEX.test(href)) return true;
+  if (href.startsWith("/")) {
+    try {
+      return new URL(href, RELATIVE_BASE).origin === RELATIVE_BASE;
+    } catch {
+      return false;
+    }
+  }
   try {
     const url = new URL(href);
     return ALLOWED_PROTOCOLS.has(url.protocol);
@@ -1852,26 +1858,32 @@ var isValidHref = (href) => {
   }
 };
 
-// src/transforms/htmlToTiptap/buildLinkMark.ts
-var DEFAULT_TARGET = "_blank";
-var DEFAULT_REL = "noopener noreferrer nofollow";
+// src/transforms/htmlToTiptap/linkSafety.ts
+var DEFAULT_LINK_TARGET = "_blank";
+var DEFAULT_LINK_REL = "noopener noreferrer nofollow";
 var ensureSafeRel = (rel, target) => {
-  if (target !== "_blank") return rel;
+  if (target !== DEFAULT_LINK_TARGET) return rel;
   const sourceTokens = (rel ?? "").split(/\s+/).filter(Boolean);
-  if (sourceTokens.length === 0) return DEFAULT_REL;
+  if (sourceTokens.length === 0) return DEFAULT_LINK_REL;
   const tokens = new Set(sourceTokens.filter((token) => token.toLowerCase() !== "opener"));
   tokens.add("noopener");
   tokens.add("noreferrer");
   return Array.from(tokens).join(" ");
 };
+
+// src/transforms/htmlToTiptap/buildLinkMark.ts
 var buildLinkMark = (attrs = {}) => {
   const { href } = attrs;
   if (!href || !isValidHref(href)) return null;
-  const target = attrs.target ?? DEFAULT_TARGET;
+  const target = attrs.target ?? DEFAULT_LINK_TARGET;
   return {
     attrs: {
       class: null,
       href,
+      // `Mark` is the POST-parse shape, where `rel` is always a string. This value is PRE-parse: a
+      // non-`_blank` link whose source omits `rel` deliberately stays undefined so the schema's
+      // `.default()` supplies it. Hence the cast — the old implicit `rel: string` parameter was
+      // making the same claim, just without saying so.
       rel: ensureSafeRel(attrs.rel, target),
       target
     },

package/dist/transforms/index.mjs

@@ -1778,13 +1778,19 @@ var isSkipping = (stack = []) => stack.some(({ skip }) => skip);
 var makeDoc = (content, blockSpacing) => TiptapDocument.parse({ attrs: { blockSpacing }, content });
 
 // src/transforms/htmlToTiptap/isValidHref.ts
-var DYNAMIC_TOKEN_REGEX2 = /^\{\{\s*[A-Za-z]+\s*\}\}$/;
+var RELATIVE_BASE = "https://x.invalid";
 var ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]);
 var isValidHref = (href) => {
   if (!href) return false;
   if (href === "#") return true;
-  if (DYNAMIC_TOKEN_REGEX2.test(href)) return true;
-  if (href.startsWith("/") && !href.startsWith("//")) return true;
+  if (DYNAMIC_TOKEN_REGEX.test(href)) return true;
+  if (href.startsWith("/")) {
+    try {
+      return new URL(href, RELATIVE_BASE).origin === RELATIVE_BASE;
+    } catch {
+      return false;
+    }
+  }
   try {
     const url = new URL(href);
     return ALLOWED_PROTOCOLS.has(url.protocol);
@@ -1793,26 +1799,32 @@ var isValidHref = (href) => {
   }
 };
 
-// src/transforms/htmlToTiptap/buildLinkMark.ts
-var DEFAULT_TARGET = "_blank";
-var DEFAULT_REL = "noopener noreferrer nofollow";
+// src/transforms/htmlToTiptap/linkSafety.ts
+var DEFAULT_LINK_TARGET = "_blank";
+var DEFAULT_LINK_REL = "noopener noreferrer nofollow";
 var ensureSafeRel = (rel, target) => {
-  if (target !== "_blank") return rel;
+  if (target !== DEFAULT_LINK_TARGET) return rel;
   const sourceTokens = (rel ?? "").split(/\s+/).filter(Boolean);
-  if (sourceTokens.length === 0) return DEFAULT_REL;
+  if (sourceTokens.length === 0) return DEFAULT_LINK_REL;
   const tokens = new Set(sourceTokens.filter((token) => token.toLowerCase() !== "opener"));
   tokens.add("noopener");
   tokens.add("noreferrer");
   return Array.from(tokens).join(" ");
 };
+
+// src/transforms/htmlToTiptap/buildLinkMark.ts
 var buildLinkMark = (attrs = {}) => {
   const { href } = attrs;
   if (!href || !isValidHref(href)) return null;
-  const target = attrs.target ?? DEFAULT_TARGET;
+  const target = attrs.target ?? DEFAULT_LINK_TARGET;
   return {
     attrs: {
       class: null,
       href,
+      // `Mark` is the POST-parse shape, where `rel` is always a string. This value is PRE-parse: a
+      // non-`_blank` link whose source omits `rel` deliberately stays undefined so the schema's
+      // `.default()` supplies it. Hence the cast — the old implicit `rel: string` parameter was
+      // making the same claim, just without saying so.
       rel: ensureSafeRel(attrs.rel, target),
       target
     },

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rebuy/rebuy",
-    "version": "3.23.0",
+    "version": "3.24.0",
     "description": "Shared zod schemas, legacy-to-CAB widget transforms, and server orchestrators for Rebuy's Shopify consumers (rebuy-api, admin-nextjs, rebuy-shopify-extensions)",
     "license": "MIT",
     "author": "Rebuy, Inc.",
@@ -12,6 +12,11 @@
             "import": "./dist/index.mjs",
             "require": "./dist/index.cjs"
         },
+        "./cab": {
+            "types": "./dist/cab/index.d.ts",
+            "import": "./dist/cab/index.mjs",
+            "require": "./dist/cab/index.cjs"
+        },
         "./client": {
             "types": "./dist/client.d.ts",
             "import": "./dist/client.mjs",
@@ -79,6 +84,9 @@
     "types": "./dist/index.d.ts",
     "typesVersions": {
         "*": {
+            "cab": [
+                "./dist/cab/index.d.ts"
+            ],
             "client": [
                 "./dist/client.d.ts"
             ],