@rebuy/rebuy 3.23.0 → 3.25.0

package/dist/schema/widgets/checkout-and-beyond/monetize.d.ts

@@ -1,7 +1,21 @@
 import { z } from 'zod';
 import { CABSection, type SectionDetails } from './shared';
 import { CABVariableFields } from './variables';
+/**
+ * The ads engine's own verdict on the hydrated request, echoed for the render beacon (REB-24362):
+ * `testing` is server-final (the engine can force it, e.g. an armed offers-testing fixture) and
+ * `requestId` is its `ad_requests` row. Present only alongside hydrated `offers`.
+ */
+export declare const CABMonetizeAds: z.ZodObject<{
+    requestId: z.ZodOptional<z.ZodString>;
+    testing: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type CABMonetizeAds = z.infer<typeof CABMonetizeAds>;
 export declare const CABMonetizeSection: z.ZodObject<{
+    ads: z.ZodOptional<z.ZodObject<{
+        requestId: z.ZodOptional<z.ZodString>;
+        testing: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
     name: z.ZodOptional<z.ZodString>;
     offers: z.ZodOptional<z.ZodArray<z.ZodLazy<z.ZodType<CABSection, unknown, z.core.$ZodTypeInternals<CABSection, unknown>>>>>;
     privacyPolicyUrl: z.ZodOptional<z.ZodString>;
@@ -197,6 +211,7 @@ export declare const CABMonetizeSection: z.ZodObject<{
 }, z.core.$strip>;
 /** Twin of the schema above — `offers` makes this a recursive node (see recursiveTwins.test.ts). */
 export type CABMonetizeSection = CABVariableFields & {
+    ads?: CABMonetizeAds;
     name?: string;
     offers?: CABSection[];
     privacyPolicyUrl?: string;

package/dist/schema/widgets/checkout-and-beyond/regex.d.ts

@@ -1,7 +1,29 @@
 /** Matches a valid array index string (e.g., "0", "1", "42"). */
 export declare const ARRAY_INDEX_STRING: RegExp;
-/** Matches a dynamic token. */
+/**
+ * VALIDATION grammar: whether a whole value IS a dynamic token. Gates what may be STORED (a link href in
+ * `text.ts`, an image source in `image.ts`), so widening it is a schema shape change that ripples to every
+ * consumer. Deliberately narrow — letters only.
+ */
 export declare const DYNAMIC_TOKEN_REGEX: RegExp;
+/**
+ * DETECTION grammar: whether a value still CONTAINS a token after interpolation, i.e. one that failed to
+ * bind. Deliberately NOT derived from the validation grammar above — the two pull in opposite directions.
+ * Validation must stay narrow to keep stored values predictable; detection must be as wide as what
+ * `interpolateAndSanitize` binds in the CANONICAL double-brace spelling, because anything it misses there
+ * is a dead link handed to a renderer. Hence `[A-Za-z0-9_]+` on the key: `resolveKey` camelizes legacy
+ * snake_case (`{{utm_source}}` binds to `utmSource`), so those spellings have to be detectable too.
+ *
+ * Still double-brace only, and still no `.`: that is what keeps third-party click macros — Google Ads'
+ * `{placement}`, Meta's `{{ad.id}}` — out of it. Nothing binds those names today, and dropping a working
+ * ad link is worse than leaving a dead one.
+ *
+ * BOTH exclusions are deliberate carve-outs rather than faithful widenings. `TOKEN_REGEX` quantifies open
+ * and close braces independently, so `{slug}` and `{{slug}` bind yet go undetected; its key class is
+ * `[^{}\s]+`, so a dotted name would bind too if anything were ever registered under one. Each keeps a
+ * probably-dead link, known and tolerated as the cheaper error.
+ */
+export declare const DYNAMIC_TOKEN_ANYWHERE_REGEX: RegExp;
 /** Matches a valid hex color code. */
 export declare const HEX_COLOR_REGEX: RegExp;
 /**

package/dist/server/adsEngine.d.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { type CabUserConfig } from '../schema/cabShopConfig';
+import { type CABMonetizeAds } from '../schema/widgets/checkout-and-beyond/monetize';
 import { type MonetizeInput, type ServerContext } from '../server/shared';
 /**
  * A single ads-engine offer. The `*_url` fields are tracking endpoints the engine returns fully
@@ -35,8 +36,16 @@ export declare const isTestingRequest: (input: MonetizeInput, isProduction: bool
  * (total preferred over subtotal). Empty values are omitted.
  */
 export declare const buildAdsParams: (input: MonetizeInput, publisherKey: string, supplyKey: string, testing: boolean, userAgent?: string, ipAddress?: string) => Record<string, string>;
-/** The engine offers plus the shop's display name (for the header copy), resolved on the same config read. */
+/**
+ * The engine offers plus the shop's display name (for the header copy), resolved on the same config
+ * read, plus `ads` — what the engine decided about the request, for the render beacon to echo verbatim
+ * (REB-24362): `testing` is the engine's response flag OR-ed with the flag we sent (never only our own
+ * rule, because the engine can force it server-side) and `requestId` is its `ad_requests` row id. Present
+ * only once the engine was actually called (absent on every early return, where there is no request to
+ * describe).
+ */
 export type AdsEngineResult = {
+    ads?: CABMonetizeAds;
     offers: AdsEngineOffer[];
     storeName?: string;
 };

package/dist/server/index.cjs

@@ -1579,8 +1579,14 @@ var CABDiscountSection = import_zod19.z.object({
 // src/schema/widgets/checkout-and-beyond/monetize.ts
 var import_uuid8 = require("uuid");
 var import_zod20 = require("zod");
+var CABMonetizeAds = import_zod20.z.object({
+  requestId: import_zod20.z.string().optional(),
+  /** Defaulted here, never in the beacon: absence of information is `ads` itself being absent. */
+  testing: import_zod20.z.boolean().default(false)
+});
 var CABMonetizeSection = import_zod20.z.object({
   ...CABVariableFields,
+  ads: CABMonetizeAds.optional(),
   name: import_zod20.z.string().optional(),
   /**
    * Server-hydrated offer cards (inline hydration): when `/cab/sections` was asked with a `monetize`
@@ -2453,13 +2459,19 @@ var isSkipping = (stack = []) => stack.some(({ skip }) => skip);
 var makeDoc = (content, blockSpacing) => TiptapDocument.parse({ attrs: { blockSpacing }, content });
 
 // src/transforms/htmlToTiptap/isValidHref.ts
-var DYNAMIC_TOKEN_REGEX2 = /^\{\{\s*[A-Za-z]+\s*\}\}$/;
+var RELATIVE_BASE = "https://x.invalid";
 var ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]);
 var isValidHref = (href) => {
   if (!href) return false;
   if (href === "#") return true;
-  if (DYNAMIC_TOKEN_REGEX2.test(href)) return true;
-  if (href.startsWith("/") && !href.startsWith("//")) return true;
+  if (DYNAMIC_TOKEN_REGEX.test(href)) return true;
+  if (href.startsWith("/")) {
+    try {
+      return new URL(href, RELATIVE_BASE).origin === RELATIVE_BASE;
+    } catch {
+      return false;
+    }
+  }
   try {
     const url = new URL(href);
     return ALLOWED_PROTOCOLS.has(url.protocol);
@@ -2468,26 +2480,32 @@ var isValidHref = (href) => {
   }
 };
 
-// src/transforms/htmlToTiptap/buildLinkMark.ts
-var DEFAULT_TARGET = "_blank";
-var DEFAULT_REL = "noopener noreferrer nofollow";
+// src/transforms/htmlToTiptap/linkSafety.ts
+var DEFAULT_LINK_TARGET = "_blank";
+var DEFAULT_LINK_REL = "noopener noreferrer nofollow";
 var ensureSafeRel = (rel, target) => {
-  if (target !== "_blank") return rel;
+  if (target !== DEFAULT_LINK_TARGET) return rel;
   const sourceTokens = (rel ?? "").split(/\s+/).filter(Boolean);
-  if (sourceTokens.length === 0) return DEFAULT_REL;
+  if (sourceTokens.length === 0) return DEFAULT_LINK_REL;
   const tokens = new Set(sourceTokens.filter((token) => token.toLowerCase() !== "opener"));
   tokens.add("noopener");
   tokens.add("noreferrer");
   return Array.from(tokens).join(" ");
 };
+
+// src/transforms/htmlToTiptap/buildLinkMark.ts
 var buildLinkMark = (attrs = {}) => {
   const { href } = attrs;
   if (!href || !isValidHref(href)) return null;
-  const target = attrs.target ?? DEFAULT_TARGET;
+  const target = attrs.target ?? DEFAULT_LINK_TARGET;
   return {
     attrs: {
       class: null,
       href,
+      // `Mark` is the POST-parse shape, where `rel` is always a string. This value is PRE-parse: a
+      // non-`_blank` link whose source omits `rel` deliberately stays undefined so the schema's
+      // `.default()` supplies it. Hence the cast — the old implicit `rel: string` parameter was
+      // making the same claim, just without saying so.
       rel: ensureSafeRel(attrs.rel, target),
       target
     },
@@ -4278,7 +4296,15 @@ var AdsEngineResponse = import_zod28.z.object({
       const result = AdsEngineOffer.safeParse(offer);
       return result.success ? [result.data] : [];
     })
-  )
+  ),
+  /**
+   * Server-decided facts about THIS ads request, echoed so the render beacon can copy them (REB-24362).
+   * `testing` is the engine's final verdict — it can be true when the caller sent false (an armed
+   * offers-testing fixture on a test store forces it, REB-24467). Both optional: an older engine or a
+   * non-JSON body must not fail the parse and drop the offers.
+   */
+  request_id: import_zod28.z.string().optional().catch(void 0),
+  testing: import_zod28.z.boolean().optional().catch(void 0)
 });
 var adsHost = (host) => `offers.${host}`;
 var isTestingRequest = (input, isProduction) => !isProduction || !!input.testing || input.customerEmail?.toLowerCase() === TEST_CUSTOMER_EMAIL;
@@ -4326,19 +4352,21 @@ var fetchAdsEngineOffers = async (input, ctx, prefetched) => {
   if (!publisherKey) return { offers: [], storeName };
   const isProduction = ctx.host === REBUY_ENGINE_HOST;
   const supplyKey = isProduction ? SUPPLY_KEY.production : SUPPLY_KEY.staging;
+  const testing = isTestingRequest(input, isProduction);
   const upstream = await ctx.fetchUpstream(
     "/api/v1/offers",
-    buildAdsParams(
-      input,
-      publisherKey,
-      supplyKey,
-      isTestingRequest(input, isProduction),
-      ctx.userAgent,
-      ctx.ipAddress
-    ),
+    buildAdsParams(input, publisherKey, supplyKey, testing, ctx.userAgent, ctx.ipAddress),
     { host: adsHost(ctx.host) }
   );
-  return { offers: AdsEngineResponse.parse(upstream).offers, storeName };
+  const response = AdsEngineResponse.parse(upstream);
+  return {
+    ads: {
+      ...response.request_id && { requestId: response.request_id },
+      testing: testing || response.testing === true
+    },
+    offers: response.offers,
+    storeName
+  };
 };
 
 // src/transforms/htmlToPlainText.ts
@@ -4537,7 +4565,7 @@ var composeOfferCard = (offer, input, storeName) => {
 
 // src/server/monetizeOffers.ts
 var fetchMonetizeOffers = async (input, ctx, prefetched) => {
-  const { offers: engineOffers, storeName } = await fetchAdsEngineOffers(input, ctx, prefetched);
+  const { ads, offers: engineOffers, storeName } = await fetchAdsEngineOffers(input, ctx, prefetched);
   const composed = engineOffers.map((offer) => composeOfferCard(offer, input, storeName));
   const offers = composed.filter((card) => card !== void 0);
   if (offers.length < composed.length)
@@ -4545,7 +4573,7 @@ var fetchMonetizeOffers = async (input, ctx, prefetched) => {
       detail: `${composed.length - offers.length} monetize offer(s) failed to compose`,
       kind: "monetizeOffer"
     });
-  return { offers };
+  return { ...ads && { ads }, offers };
 };
 
 // src/server/salvageSections.ts
@@ -4639,7 +4667,7 @@ var hydrateMonetizeMarkers = async (converted, input, ctx, config) => {
   const first = findMonetizeMarker(converted);
   if (!first) return;
   try {
-    const { offers } = await fetchMonetizeOffers(
+    const { ads, offers } = await fetchMonetizeOffers(
       {
         ...input.monetize,
         privacyPolicyUrl: first.privacyPolicyUrl,
@@ -4650,6 +4678,7 @@ var hydrateMonetizeMarkers = async (converted, input, ctx, config) => {
       config ?? void 0
     );
     first.offers = offers;
+    if (ads) first.ads = ads;
   } catch (err) {
     ctx.reportDrift?.({
       detail: `inline hydration failed: ${err instanceof Error ? err.message : String(err)}`,

package/dist/server/index.mjs

@@ -1528,8 +1528,14 @@ var CABDiscountSection = z19.object({
 // src/schema/widgets/checkout-and-beyond/monetize.ts
 import { v7 as uuidv78 } from "uuid";
 import { z as z20 } from "zod";
+var CABMonetizeAds = z20.object({
+  requestId: z20.string().optional(),
+  /** Defaulted here, never in the beacon: absence of information is `ads` itself being absent. */
+  testing: z20.boolean().default(false)
+});
 var CABMonetizeSection = z20.object({
   ...CABVariableFields,
+  ads: CABMonetizeAds.optional(),
   name: z20.string().optional(),
   /**
    * Server-hydrated offer cards (inline hydration): when `/cab/sections` was asked with a `monetize`
@@ -2402,13 +2408,19 @@ var isSkipping = (stack = []) => stack.some(({ skip }) => skip);
 var makeDoc = (content, blockSpacing) => TiptapDocument.parse({ attrs: { blockSpacing }, content });
 
 // src/transforms/htmlToTiptap/isValidHref.ts
-var DYNAMIC_TOKEN_REGEX2 = /^\{\{\s*[A-Za-z]+\s*\}\}$/;
+var RELATIVE_BASE = "https://x.invalid";
 var ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]);
 var isValidHref = (href) => {
   if (!href) return false;
   if (href === "#") return true;
-  if (DYNAMIC_TOKEN_REGEX2.test(href)) return true;
-  if (href.startsWith("/") && !href.startsWith("//")) return true;
+  if (DYNAMIC_TOKEN_REGEX.test(href)) return true;
+  if (href.startsWith("/")) {
+    try {
+      return new URL(href, RELATIVE_BASE).origin === RELATIVE_BASE;
+    } catch {
+      return false;
+    }
+  }
   try {
     const url = new URL(href);
     return ALLOWED_PROTOCOLS.has(url.protocol);
@@ -2417,26 +2429,32 @@ var isValidHref = (href) => {
   }
 };
 
-// src/transforms/htmlToTiptap/buildLinkMark.ts
-var DEFAULT_TARGET = "_blank";
-var DEFAULT_REL = "noopener noreferrer nofollow";
+// src/transforms/htmlToTiptap/linkSafety.ts
+var DEFAULT_LINK_TARGET = "_blank";
+var DEFAULT_LINK_REL = "noopener noreferrer nofollow";
 var ensureSafeRel = (rel, target) => {
-  if (target !== "_blank") return rel;
+  if (target !== DEFAULT_LINK_TARGET) return rel;
   const sourceTokens = (rel ?? "").split(/\s+/).filter(Boolean);
-  if (sourceTokens.length === 0) return DEFAULT_REL;
+  if (sourceTokens.length === 0) return DEFAULT_LINK_REL;
   const tokens = new Set(sourceTokens.filter((token) => token.toLowerCase() !== "opener"));
   tokens.add("noopener");
   tokens.add("noreferrer");
   return Array.from(tokens).join(" ");
 };
+
+// src/transforms/htmlToTiptap/buildLinkMark.ts
 var buildLinkMark = (attrs = {}) => {
   const { href } = attrs;
   if (!href || !isValidHref(href)) return null;
-  const target = attrs.target ?? DEFAULT_TARGET;
+  const target = attrs.target ?? DEFAULT_LINK_TARGET;
   return {
     attrs: {
       class: null,
       href,
+      // `Mark` is the POST-parse shape, where `rel` is always a string. This value is PRE-parse: a
+      // non-`_blank` link whose source omits `rel` deliberately stays undefined so the schema's
+      // `.default()` supplies it. Hence the cast — the old implicit `rel: string` parameter was
+      // making the same claim, just without saying so.
       rel: ensureSafeRel(attrs.rel, target),
       target
     },
@@ -4227,7 +4245,15 @@ var AdsEngineResponse = z28.object({
       const result = AdsEngineOffer.safeParse(offer);
       return result.success ? [result.data] : [];
     })
-  )
+  ),
+  /**
+   * Server-decided facts about THIS ads request, echoed so the render beacon can copy them (REB-24362).
+   * `testing` is the engine's final verdict — it can be true when the caller sent false (an armed
+   * offers-testing fixture on a test store forces it, REB-24467). Both optional: an older engine or a
+   * non-JSON body must not fail the parse and drop the offers.
+   */
+  request_id: z28.string().optional().catch(void 0),
+  testing: z28.boolean().optional().catch(void 0)
 });
 var adsHost = (host) => `offers.${host}`;
 var isTestingRequest = (input, isProduction) => !isProduction || !!input.testing || input.customerEmail?.toLowerCase() === TEST_CUSTOMER_EMAIL;
@@ -4275,19 +4301,21 @@ var fetchAdsEngineOffers = async (input, ctx, prefetched) => {
   if (!publisherKey) return { offers: [], storeName };
   const isProduction = ctx.host === REBUY_ENGINE_HOST;
   const supplyKey = isProduction ? SUPPLY_KEY.production : SUPPLY_KEY.staging;
+  const testing = isTestingRequest(input, isProduction);
   const upstream = await ctx.fetchUpstream(
     "/api/v1/offers",
-    buildAdsParams(
-      input,
-      publisherKey,
-      supplyKey,
-      isTestingRequest(input, isProduction),
-      ctx.userAgent,
-      ctx.ipAddress
-    ),
+    buildAdsParams(input, publisherKey, supplyKey, testing, ctx.userAgent, ctx.ipAddress),
     { host: adsHost(ctx.host) }
   );
-  return { offers: AdsEngineResponse.parse(upstream).offers, storeName };
+  const response = AdsEngineResponse.parse(upstream);
+  return {
+    ads: {
+      ...response.request_id && { requestId: response.request_id },
+      testing: testing || response.testing === true
+    },
+    offers: response.offers,
+    storeName
+  };
 };
 
 // src/transforms/htmlToPlainText.ts
@@ -4486,7 +4514,7 @@ var composeOfferCard = (offer, input, storeName) => {
 
 // src/server/monetizeOffers.ts
 var fetchMonetizeOffers = async (input, ctx, prefetched) => {
-  const { offers: engineOffers, storeName } = await fetchAdsEngineOffers(input, ctx, prefetched);
+  const { ads, offers: engineOffers, storeName } = await fetchAdsEngineOffers(input, ctx, prefetched);
   const composed = engineOffers.map((offer) => composeOfferCard(offer, input, storeName));
   const offers = composed.filter((card) => card !== void 0);
   if (offers.length < composed.length)
@@ -4494,7 +4522,7 @@ var fetchMonetizeOffers = async (input, ctx, prefetched) => {
       detail: `${composed.length - offers.length} monetize offer(s) failed to compose`,
       kind: "monetizeOffer"
     });
-  return { offers };
+  return { ...ads && { ads }, offers };
 };
 
 // src/server/salvageSections.ts
@@ -4588,7 +4616,7 @@ var hydrateMonetizeMarkers = async (converted, input, ctx, config) => {
   const first = findMonetizeMarker(converted);
   if (!first) return;
   try {
-    const { offers } = await fetchMonetizeOffers(
+    const { ads, offers } = await fetchMonetizeOffers(
       {
         ...input.monetize,
         privacyPolicyUrl: first.privacyPolicyUrl,
@@ -4599,6 +4627,7 @@ var hydrateMonetizeMarkers = async (converted, input, ctx, config) => {
       config ?? void 0
     );
     first.offers = offers;
+    if (ads) first.ads = ads;
   } catch (err) {
     ctx.reportDrift?.({
       detail: `inline hydration failed: ${err instanceof Error ? err.message : String(err)}`,

package/dist/server/monetizeOffers.d.ts

@@ -1,7 +1,9 @@
 import { type CabUserConfig } from '../schema/cabShopConfig';
-import { type CABSection } from '../schema/widgets/checkout-and-beyond';
+import { type CABMonetizeAds, type CABSection } from '../schema/widgets/checkout-and-beyond';
 import { type MonetizeInput, type ServerContext } from '../server/shared';
+/** Cards plus the engine's own verdict on the request (`ads`), absent when the engine was never called. */
 export type MonetizeOffers = {
+    ads?: CABMonetizeAds;
     offers: CABSection[];
 };
 /**

package/dist/server/requestSchemas.d.ts

@@ -290,6 +290,7 @@ export declare const WidgetSettingsInputSchema: z.ZodObject<{
             }, z.core.$strip>>;
             subtotal: z.ZodNumber;
         }, z.core.$strip>;
+        testing: z.ZodOptional<z.ZodBoolean>;
         country: z.ZodOptional<z.ZodString>;
         customerId: z.ZodOptional<z.ZodString>;
         visitorId: z.ZodOptional<z.ZodString>;
@@ -304,7 +305,6 @@ export declare const WidgetSettingsInputSchema: z.ZodObject<{
             thank_you_page: "thank_you_page";
         }>;
         sessionId: z.ZodOptional<z.ZodString>;
-        testing: z.ZodOptional<z.ZodBoolean>;
         timezone: z.ZodOptional<z.ZodString>;
         transactionId: z.ZodOptional<z.ZodString>;
         transactionItems: z.ZodOptional<z.ZodArray<z.ZodObject<{

package/dist/transforms/htmlToTiptap/linkSafety.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The schema defaults for an `<a>` mark when a payload omits them. Match `TiptapText` in
+ * `~/schema/widgets/checkout-and-beyond/text` so anything resolving a link BEFORE (or without) a parse
+ * lands on the same effective values the downstream parse would have used.
+ */
+export declare const DEFAULT_LINK_TARGET = "_blank";
+export declare const DEFAULT_LINK_REL = "noopener noreferrer nofollow";
+/**
+ * Forces `noopener noreferrer` on every `_blank` link to defend against reverse-tabnabbing
+ * (window.opener attacks). When the source omits `rel` entirely, fall back to the schema default
+ * (`noopener noreferrer nofollow`). When source `rel` is non-empty, preserve the existing tokens, drop
+ * `opener`, and ensure the safe pair is present.
+ *
+ * Non-`_blank` targets pass through UNCHANGED — they can't be tabnabbed. That includes passing `undefined`
+ * straight back: `TiptapText`'s `rel: z.string().default('noopener noreferrer nofollow')` fires on
+ * `undefined` only, so substituting `''` here would silently strip `nofollow` off every `_self` link at
+ * parse time. The absent value is the signal that the schema default should apply.
+ */
+export declare const ensureSafeRel: (rel: string | undefined, target: string) => string | undefined;

package/dist/transforms/index.cjs

@@ -963,8 +963,14 @@ var CABDiscountSection = import_zod13.z.object({
 // src/schema/widgets/checkout-and-beyond/monetize.ts
 var import_uuid8 = require("uuid");
 var import_zod14 = require("zod");
+var CABMonetizeAds = import_zod14.z.object({
+  requestId: import_zod14.z.string().optional(),
+  /** Defaulted here, never in the beacon: absence of information is `ads` itself being absent. */
+  testing: import_zod14.z.boolean().default(false)
+});
 var CABMonetizeSection = import_zod14.z.object({
   ...CABVariableFields,
+  ads: CABMonetizeAds.optional(),
   name: import_zod14.z.string().optional(),
   /**
    * Server-hydrated offer cards (inline hydration): when `/cab/sections` was asked with a `monetize`
@@ -1837,13 +1843,19 @@ var isSkipping = (stack = []) => stack.some(({ skip }) => skip);
 var makeDoc = (content, blockSpacing) => TiptapDocument.parse({ attrs: { blockSpacing }, content });
 
 // src/transforms/htmlToTiptap/isValidHref.ts
-var DYNAMIC_TOKEN_REGEX2 = /^\{\{\s*[A-Za-z]+\s*\}\}$/;
+var RELATIVE_BASE = "https://x.invalid";
 var ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]);
 var isValidHref = (href) => {
   if (!href) return false;
   if (href === "#") return true;
-  if (DYNAMIC_TOKEN_REGEX2.test(href)) return true;
-  if (href.startsWith("/") && !href.startsWith("//")) return true;
+  if (DYNAMIC_TOKEN_REGEX.test(href)) return true;
+  if (href.startsWith("/")) {
+    try {
+      return new URL(href, RELATIVE_BASE).origin === RELATIVE_BASE;
+    } catch {
+      return false;
+    }
+  }
   try {
     const url = new URL(href);
     return ALLOWED_PROTOCOLS.has(url.protocol);
@@ -1852,26 +1864,32 @@ var isValidHref = (href) => {
   }
 };
 
-// src/transforms/htmlToTiptap/buildLinkMark.ts
-var DEFAULT_TARGET = "_blank";
-var DEFAULT_REL = "noopener noreferrer nofollow";
+// src/transforms/htmlToTiptap/linkSafety.ts
+var DEFAULT_LINK_TARGET = "_blank";
+var DEFAULT_LINK_REL = "noopener noreferrer nofollow";
 var ensureSafeRel = (rel, target) => {
-  if (target !== "_blank") return rel;
+  if (target !== DEFAULT_LINK_TARGET) return rel;
   const sourceTokens = (rel ?? "").split(/\s+/).filter(Boolean);
-  if (sourceTokens.length === 0) return DEFAULT_REL;
+  if (sourceTokens.length === 0) return DEFAULT_LINK_REL;
   const tokens = new Set(sourceTokens.filter((token) => token.toLowerCase() !== "opener"));
   tokens.add("noopener");
   tokens.add("noreferrer");
   return Array.from(tokens).join(" ");
 };
+
+// src/transforms/htmlToTiptap/buildLinkMark.ts
 var buildLinkMark = (attrs = {}) => {
   const { href } = attrs;
   if (!href || !isValidHref(href)) return null;
-  const target = attrs.target ?? DEFAULT_TARGET;
+  const target = attrs.target ?? DEFAULT_LINK_TARGET;
   return {
     attrs: {
       class: null,
       href,
+      // `Mark` is the POST-parse shape, where `rel` is always a string. This value is PRE-parse: a
+      // non-`_blank` link whose source omits `rel` deliberately stays undefined so the schema's
+      // `.default()` supplies it. Hence the cast — the old implicit `rel: string` parameter was
+      // making the same claim, just without saying so.
       rel: ensureSafeRel(attrs.rel, target),
       target
     },

package/dist/transforms/index.mjs

@@ -904,8 +904,14 @@ var CABDiscountSection = z13.object({
 // src/schema/widgets/checkout-and-beyond/monetize.ts
 import { v7 as uuidv78 } from "uuid";
 import { z as z14 } from "zod";
+var CABMonetizeAds = z14.object({
+  requestId: z14.string().optional(),
+  /** Defaulted here, never in the beacon: absence of information is `ads` itself being absent. */
+  testing: z14.boolean().default(false)
+});
 var CABMonetizeSection = z14.object({
   ...CABVariableFields,
+  ads: CABMonetizeAds.optional(),
   name: z14.string().optional(),
   /**
    * Server-hydrated offer cards (inline hydration): when `/cab/sections` was asked with a `monetize`
@@ -1778,13 +1784,19 @@ var isSkipping = (stack = []) => stack.some(({ skip }) => skip);
 var makeDoc = (content, blockSpacing) => TiptapDocument.parse({ attrs: { blockSpacing }, content });
 
 // src/transforms/htmlToTiptap/isValidHref.ts
-var DYNAMIC_TOKEN_REGEX2 = /^\{\{\s*[A-Za-z]+\s*\}\}$/;
+var RELATIVE_BASE = "https://x.invalid";
 var ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]);
 var isValidHref = (href) => {
   if (!href) return false;
   if (href === "#") return true;
-  if (DYNAMIC_TOKEN_REGEX2.test(href)) return true;
-  if (href.startsWith("/") && !href.startsWith("//")) return true;
+  if (DYNAMIC_TOKEN_REGEX.test(href)) return true;
+  if (href.startsWith("/")) {
+    try {
+      return new URL(href, RELATIVE_BASE).origin === RELATIVE_BASE;
+    } catch {
+      return false;
+    }
+  }
   try {
     const url = new URL(href);
     return ALLOWED_PROTOCOLS.has(url.protocol);
@@ -1793,26 +1805,32 @@ var isValidHref = (href) => {
   }
 };
 
-// src/transforms/htmlToTiptap/buildLinkMark.ts
-var DEFAULT_TARGET = "_blank";
-var DEFAULT_REL = "noopener noreferrer nofollow";
+// src/transforms/htmlToTiptap/linkSafety.ts
+var DEFAULT_LINK_TARGET = "_blank";
+var DEFAULT_LINK_REL = "noopener noreferrer nofollow";
 var ensureSafeRel = (rel, target) => {
-  if (target !== "_blank") return rel;
+  if (target !== DEFAULT_LINK_TARGET) return rel;
   const sourceTokens = (rel ?? "").split(/\s+/).filter(Boolean);
-  if (sourceTokens.length === 0) return DEFAULT_REL;
+  if (sourceTokens.length === 0) return DEFAULT_LINK_REL;
   const tokens = new Set(sourceTokens.filter((token) => token.toLowerCase() !== "opener"));
   tokens.add("noopener");
   tokens.add("noreferrer");
   return Array.from(tokens).join(" ");
 };
+
+// src/transforms/htmlToTiptap/buildLinkMark.ts
 var buildLinkMark = (attrs = {}) => {
   const { href } = attrs;
   if (!href || !isValidHref(href)) return null;
-  const target = attrs.target ?? DEFAULT_TARGET;
+  const target = attrs.target ?? DEFAULT_LINK_TARGET;
   return {
     attrs: {
       class: null,
       href,
+      // `Mark` is the POST-parse shape, where `rel` is always a string. This value is PRE-parse: a
+      // non-`_blank` link whose source omits `rel` deliberately stays undefined so the schema's
+      // `.default()` supplies it. Hence the cast — the old implicit `rel: string` parameter was
+      // making the same claim, just without saying so.
       rel: ensureSafeRel(attrs.rel, target),
       target
     },

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rebuy/rebuy",
-    "version": "3.23.0",
+    "version": "3.25.0",
     "description": "Shared zod schemas, legacy-to-CAB widget transforms, and server orchestrators for Rebuy's Shopify consumers (rebuy-api, admin-nextjs, rebuy-shopify-extensions)",
     "license": "MIT",
     "author": "Rebuy, Inc.",
@@ -12,6 +12,11 @@
             "import": "./dist/index.mjs",
             "require": "./dist/index.cjs"
         },
+        "./cab": {
+            "types": "./dist/cab/index.d.ts",
+            "import": "./dist/cab/index.mjs",
+            "require": "./dist/cab/index.cjs"
+        },
         "./client": {
             "types": "./dist/client.d.ts",
             "import": "./dist/client.mjs",
@@ -79,6 +84,9 @@
     "types": "./dist/index.d.ts",
     "typesVersions": {
         "*": {
+            "cab": [
+                "./dist/cab/index.d.ts"
+            ],
             "client": [
                 "./dist/client.d.ts"
             ],