@rebuy/rebuy 3.26.0 → 3.27.0

package/dist/schema/index.d.ts

@@ -2,7 +2,13 @@ export * from './cabShopConfig';
 export * from './metadata';
 export * from './offerProduct';
 export * from './postPurchaseEligibility';
+export * from './postPurchaseExitPolicy';
 export * from './postPurchaseIdentity';
+export * from './postPurchaseOrderDecision';
+export * from './postPurchasePolicy';
+export * from './postPurchaseSelection';
+export * from './postPurchaseSession';
+export * from './postPurchaseSessionClose';
 export * from './postPurchaseShadow';
 export * from './postPurchaseSkipTrace';
 export * from './product';

package/dist/schema/postPurchaseEligibility.d.ts

@@ -5,8 +5,8 @@ import { z } from 'zod';
  * — that half is Offer/product-specific and stays out of this Slice. Only the skip-reason vocabulary a
  * skip trace records travels with the Decision contract.
  */
-export declare const PostPurchaseSkipReason: z.ZodEnum<{
+export declare const PostPurchaseSkipReasonSchema: z.ZodEnum<{
     empty: "empty";
     "no-eligible-subscription": "no-eligible-subscription";
 }>;
-export type PostPurchaseSkipReason = z.infer<typeof PostPurchaseSkipReason>;
+export type PostPurchaseSkipReason = z.infer<typeof PostPurchaseSkipReasonSchema>;

package/dist/schema/postPurchaseExitPolicy.d.ts

@@ -0,0 +1,20 @@
+import { z } from 'zod';
+/**
+ * Whether an additional delay applies when the session's client leaves after close, and why — projected
+ * from the admitted purchase's snapshot when one exists, else from the selected Flow. `unavailable` when
+ * neither could be resolved; a failed projection never undoes closure or blocks the purchase it followed.
+ *
+ * Both branches are `.strict()`: a producer that resolved a real delay but mis-set `status` must get a
+ * 4xx, not have `delayMs`/`source` silently stripped down to a bare `{ status: 'unavailable' }`.
+ */
+export declare const ExitPolicySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    status: z.ZodLiteral<"unavailable">;
+}, z.core.$strict>, z.ZodObject<{
+    delayMs: z.ZodNumber;
+    source: z.ZodEnum<{
+        admitted: "admitted";
+        "selected-flow": "selected-flow";
+    }>;
+    status: z.ZodLiteral<"available">;
+}, z.core.$strict>], "status">;
+export type ExitPolicy = z.infer<typeof ExitPolicySchema>;

package/dist/schema/postPurchaseIdentity.d.ts

@@ -1,11 +1,14 @@
 import { z } from 'zod';
 export declare const PostPurchaseTimestampSchema: z.ZodNumber;
 export declare const PostPurchaseOrderIdSchema: z.ZodString;
+/** Expects a pre-lowercased domain — Shopify shop slugs are always lowercase, so this doesn't normalize case. */
 export declare const ShopifyDomainSchema: z.ZodString;
 export declare const DecideRequestSchema: z.ZodObject<{
     checkoutToken: z.ZodString;
     shop: z.ZodString;
 }, z.core.$strip>;
+/** Shared with any post-purchase contract that carries the id of the app that opened it. */
+export declare const PostPurchaseAppIdSchema: z.ZodString;
 /** A Decision entry: which Flow and node in its tree, which Split (widgetTraffic share) and Widget won. */
 export declare const DecisionEntrySchema: z.ZodObject<{
     blockId: z.ZodNumber;
@@ -16,3 +19,9 @@ export declare const DecisionEntrySchema: z.ZodObject<{
     widgetId: z.ZodNumber;
     widgetTraffic: z.ZodNumber;
 }, z.core.$strip>;
+export type DecideRequest = z.infer<typeof DecideRequestSchema>;
+export type DecisionEntry = z.infer<typeof DecisionEntrySchema>;
+export type PostPurchaseAppId = z.infer<typeof PostPurchaseAppIdSchema>;
+export type PostPurchaseOrderId = z.infer<typeof PostPurchaseOrderIdSchema>;
+export type PostPurchaseTimestamp = z.infer<typeof PostPurchaseTimestampSchema>;
+export type ShopifyDomain = z.infer<typeof ShopifyDomainSchema>;

package/dist/schema/postPurchaseOrderDecision.d.ts

@@ -0,0 +1,10 @@
+import { z } from 'zod';
+/** Which side may still write this order's session-decision row: the session that claimed it first, or the release-authority sweep once nothing claims it. */
+export declare const OrderDecisionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    owner: z.ZodLiteral<"session">;
+    sessionId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    owner: z.ZodLiteral<"release">;
+    sessionId: z.ZodNull;
+}, z.core.$strip>], "owner">;
+export type OrderDecision = z.infer<typeof OrderDecisionSchema>;

package/dist/schema/postPurchasePolicy.d.ts

@@ -0,0 +1,62 @@
+import { z } from 'zod';
+export declare const HoldSettingSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    durationMinutes: z.ZodNumber;
+    enabled: z.ZodLiteral<true>;
+}, z.core.$strip>, z.ZodObject<{
+    durationMinutes: z.ZodNull;
+    enabled: z.ZodLiteral<false>;
+}, z.core.$strip>], "enabled">;
+/** What the shop and its Flow each configure for the post-purchase hold, before either is applied. */
+export declare const TimingSettingsSchema: z.ZodObject<{
+    flowHold: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        durationMinutes: z.ZodNumber;
+        enabled: z.ZodLiteral<true>;
+    }, z.core.$strip>, z.ZodObject<{
+        durationMinutes: z.ZodNull;
+        enabled: z.ZodLiteral<false>;
+    }, z.core.$strip>], "enabled">;
+    shopHold: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        durationMinutes: z.ZodNumber;
+        enabled: z.ZodLiteral<true>;
+    }, z.core.$strip>, z.ZodObject<{
+        durationMinutes: z.ZodNull;
+        enabled: z.ZodLiteral<false>;
+    }, z.core.$strip>], "enabled">;
+}, z.core.$strip>;
+/**
+ * The hold resolved for one session, captured once and never recomputed: the shop hold overrides the
+ * Flow hold, which overrides the native (order-only) deadline. `sessionDeadline` still takes the earlier
+ * of the estimated native deadline and `startedAt + durationMinutes`, so a configured hold only ever
+ * shortens the window, never extends it past the native estimate.
+ *
+ * The refine below enforces that precedence rather than merely documenting it: `source` and
+ * `durationMinutes` must match whichever hold the shop-over-flow-over-native rule actually selects, so a
+ * snapshot claiming `source: 'flow'` while the shop hold is enabled — or carrying a duration under
+ * `source: 'native'` — can't parse. Since a resolved snapshot is captured once and never recomputed, a
+ * contradictory one would otherwise stay durable for the session's whole lifetime.
+ */
+export declare const SessionPolicySchema: z.ZodObject<{
+    flowHold: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        durationMinutes: z.ZodNumber;
+        enabled: z.ZodLiteral<true>;
+    }, z.core.$strip>, z.ZodObject<{
+        durationMinutes: z.ZodNull;
+        enabled: z.ZodLiteral<false>;
+    }, z.core.$strip>], "enabled">;
+    shopHold: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        durationMinutes: z.ZodNumber;
+        enabled: z.ZodLiteral<true>;
+    }, z.core.$strip>, z.ZodObject<{
+        durationMinutes: z.ZodNull;
+        enabled: z.ZodLiteral<false>;
+    }, z.core.$strip>], "enabled">;
+    durationMinutes: z.ZodNullable<z.ZodNumber>;
+    source: z.ZodEnum<{
+        shop: "shop";
+        flow: "flow";
+        native: "native";
+    }>;
+}, z.core.$strip>;
+export type HoldSetting = z.infer<typeof HoldSettingSchema>;
+export type TimingSettings = z.infer<typeof TimingSettingsSchema>;
+export type SessionPolicy = z.infer<typeof SessionPolicySchema>;

package/dist/schema/postPurchaseSelection.d.ts

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+/**
+ * Selection evidence only — a distinct issuer and purpose from Shopify's own post-purchase token or from
+ * purchase admission, so a selection claim can never be replayed as either.
+ */
+export declare const SelectionClaimsSchema: z.ZodObject<{
+    checkoutToken: z.ZodString;
+    shop: z.ZodString;
+    appId: z.ZodString;
+    entry: z.ZodObject<{
+        blockId: z.ZodNumber;
+        blockIndex: z.ZodString;
+        blockParentIndex: z.ZodString;
+        flowId: z.ZodNumber;
+        sectionId: z.ZodNumber;
+        widgetId: z.ZodNumber;
+        widgetTraffic: z.ZodNumber;
+    }, z.core.$strip>;
+    iss: z.ZodLiteral<"rebuy-api">;
+    purpose: z.ZodLiteral<"post-purchase-selection">;
+}, z.core.$strip>;
+/** What starts a session: the checkout identity, plus a selection token carried forward from `shouldRender`. */
+export declare const SessionStartRequestSchema: z.ZodObject<{
+    checkoutToken: z.ZodString;
+    shop: z.ZodString;
+    selectionToken: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type SelectionClaims = z.infer<typeof SelectionClaimsSchema>;
+export type SessionStartRequest = z.infer<typeof SessionStartRequestSchema>;

package/dist/schema/postPurchaseSession.d.ts

@@ -0,0 +1,112 @@
+import { z } from 'zod';
+/** One checkout's session identity — the Decide identity plus which app opened it. */
+export declare const SessionIdentitySchema: z.ZodObject<{
+    checkoutToken: z.ZodString;
+    shop: z.ZodString;
+    appId: z.ZodString;
+}, z.core.$strip>;
+/** The order this session anchors to, and the source its native-deadline estimate came from. */
+export declare const SessionOrderTimingSchema: z.ZodObject<{
+    nativeDeadline: z.ZodNumber;
+    orderCreatedAt: z.ZodNumber;
+    orderId: z.ZodString;
+    timingSource: z.ZodLiteral<"shopify-order-created-at">;
+}, z.core.$strip>;
+/**
+ * A session once every field that gates rendering — order anchor, entry, policy, deadline — is set. The
+ * three refines enforce the only ordering that makes a session coherent: it can't start before the order
+ * it anchors to was created, its resolved deadline can't sit before the moment it started, and — per the
+ * "only ever shortens the window" invariant `postPurchasePolicy.ts` documents — that deadline can never
+ * exceed the native (order-only) one.
+ */
+export declare const ReadySessionTimingSchema: z.ZodObject<{
+    nativeDeadline: z.ZodNumber;
+    orderCreatedAt: z.ZodNumber;
+    orderId: z.ZodString;
+    timingSource: z.ZodLiteral<"shopify-order-created-at">;
+    deadline: z.ZodNumber;
+    entry: z.ZodObject<{
+        blockId: z.ZodNumber;
+        blockIndex: z.ZodString;
+        blockParentIndex: z.ZodString;
+        flowId: z.ZodNumber;
+        sectionId: z.ZodNumber;
+        widgetId: z.ZodNumber;
+        widgetTraffic: z.ZodNumber;
+    }, z.core.$strip>;
+    policySnapshot: z.ZodObject<{
+        flowHold: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            durationMinutes: z.ZodNumber;
+            enabled: z.ZodLiteral<true>;
+        }, z.core.$strip>, z.ZodObject<{
+            durationMinutes: z.ZodNull;
+            enabled: z.ZodLiteral<false>;
+        }, z.core.$strip>], "enabled">;
+        shopHold: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            durationMinutes: z.ZodNumber;
+            enabled: z.ZodLiteral<true>;
+        }, z.core.$strip>, z.ZodObject<{
+            durationMinutes: z.ZodNull;
+            enabled: z.ZodLiteral<false>;
+        }, z.core.$strip>], "enabled">;
+        durationMinutes: z.ZodNullable<z.ZodNumber>;
+        source: z.ZodEnum<{
+            shop: "shop";
+            flow: "flow";
+            native: "native";
+        }>;
+    }, z.core.$strip>;
+    startedAt: z.ZodNumber;
+}, z.core.$strip>;
+/** The `/session/start` response: not purchase admission, just the recorded native timing. */
+export declare const SessionStartResponseSchema: z.ZodObject<{
+    data: z.ZodObject<{
+        phase: z.ZodLiteral<"render">;
+        serverNow: z.ZodNumber;
+        session: z.ZodObject<{
+            nativeDeadline: z.ZodNumber;
+            orderCreatedAt: z.ZodNumber;
+            orderId: z.ZodString;
+            timingSource: z.ZodLiteral<"shopify-order-created-at">;
+            deadline: z.ZodNumber;
+            entry: z.ZodObject<{
+                blockId: z.ZodNumber;
+                blockIndex: z.ZodString;
+                blockParentIndex: z.ZodString;
+                flowId: z.ZodNumber;
+                sectionId: z.ZodNumber;
+                widgetId: z.ZodNumber;
+                widgetTraffic: z.ZodNumber;
+            }, z.core.$strip>;
+            policySnapshot: z.ZodObject<{
+                flowHold: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    durationMinutes: z.ZodNumber;
+                    enabled: z.ZodLiteral<true>;
+                }, z.core.$strip>, z.ZodObject<{
+                    durationMinutes: z.ZodNull;
+                    enabled: z.ZodLiteral<false>;
+                }, z.core.$strip>], "enabled">;
+                shopHold: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    durationMinutes: z.ZodNumber;
+                    enabled: z.ZodLiteral<true>;
+                }, z.core.$strip>, z.ZodObject<{
+                    durationMinutes: z.ZodNull;
+                    enabled: z.ZodLiteral<false>;
+                }, z.core.$strip>], "enabled">;
+                durationMinutes: z.ZodNullable<z.ZodNumber>;
+                source: z.ZodEnum<{
+                    shop: "shop";
+                    flow: "flow";
+                    native: "native";
+                }>;
+            }, z.core.$strip>;
+            startedAt: z.ZodNumber;
+        }, z.core.$strip>;
+        workflowPhase: z.ZodLiteral<"start">;
+    }, z.core.$strip>;
+    successful: z.ZodLiteral<true>;
+}, z.core.$strip>;
+export type ReadySessionTiming = z.infer<typeof ReadySessionTimingSchema>;
+export type SessionIdentity = z.infer<typeof SessionIdentitySchema>;
+export type SessionOrderTiming = z.infer<typeof SessionOrderTimingSchema>;
+export type SessionStartResponse = z.infer<typeof SessionStartResponseSchema>;

package/dist/schema/postPurchaseSessionClose.d.ts

@@ -0,0 +1,25 @@
+import { z } from 'zod';
+/** The durable record of when a session ended — recording closure, never undoing admitted work. */
+export declare const SessionClosureSchema: z.ZodObject<{
+    closedAt: z.ZodNumber;
+    status: z.ZodLiteral<"closed">;
+}, z.core.$strip>;
+/**
+ * `/session/close` needs only the checkout identity that opened the session, not the app id — `.strict()`
+ * so an app id (or any other unknown field) on this public, unauthenticated surface is a 4xx, matching
+ * `SessionStartRequestSchema`, rather than being silently stripped.
+ */
+export declare const SessionCloseRequestSchema: z.ZodObject<{
+    checkoutToken: z.ZodString;
+    shop: z.ZodString;
+}, z.core.$strict>;
+export declare const SessionCloseResponseSchema: z.ZodObject<{
+    data: z.ZodObject<{
+        closedAt: z.ZodNumber;
+        status: z.ZodLiteral<"closed">;
+    }, z.core.$strip>;
+    successful: z.ZodLiteral<true>;
+}, z.core.$strip>;
+export type SessionClosure = z.infer<typeof SessionClosureSchema>;
+export type SessionCloseRequest = z.infer<typeof SessionCloseRequestSchema>;
+export type SessionCloseResponse = z.infer<typeof SessionCloseResponseSchema>;

package/dist/schema/postPurchaseShadow.d.ts

@@ -15,6 +15,61 @@ export declare const PostPurchaseShadowSelectionSchema: z.ZodDiscriminatedUnion<
     verdict: z.ZodLiteral<"skip">;
 }, z.core.$strip>], "verdict">;
 export type PostPurchaseShadowSelection = z.infer<typeof PostPurchaseShadowSelectionSchema>;
+/**
+ * The shadow report's fields WITHOUT the status/differences cross-field refinements below — the derivable
+ * base. `PostPurchaseShadowReportSchema` was a plain `ZodObject` before those refinements were added, and
+ * zod 4 rejects `.omit()`/`.pick()`/`.partial()` on an object schema carrying checks (see
+ * `src/schema/widgets/checkout-and-beyond/image.ts:74-82` for the same tradeoff): a consumer already
+ * deriving from the published schema would start throwing at module-eval. Derive from this instead when
+ * you need the unavailable three; everything that parses a wire report uses
+ * {@link PostPurchaseShadowReportSchema}.
+ */
+export declare const PostPurchaseShadowReportFields: z.ZodObject<{
+    differences: z.ZodArray<z.ZodEnum<{
+        entry: "entry";
+        verdict: "verdict";
+        targeting: "targeting";
+        "incomplete-capture": "incomplete-capture";
+        "unsupported-configuration": "unsupported-configuration";
+    }>>;
+    legacySelection: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        entry: z.ZodObject<{
+            blockId: z.ZodNumber;
+            blockIndex: z.ZodString;
+            blockParentIndex: z.ZodString;
+            flowId: z.ZodNumber;
+            sectionId: z.ZodNumber;
+            widgetId: z.ZodNumber;
+            widgetTraffic: z.ZodNumber;
+        }, z.core.$strip>;
+        verdict: z.ZodLiteral<"render">;
+    }, z.core.$strip>, z.ZodObject<{
+        verdict: z.ZodLiteral<"skip">;
+    }, z.core.$strip>], "verdict">;
+    phase: z.ZodLiteral<"shouldRender">;
+    sampleId: z.ZodString;
+    serverSelection: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        entry: z.ZodObject<{
+            blockId: z.ZodNumber;
+            blockIndex: z.ZodString;
+            blockParentIndex: z.ZodString;
+            flowId: z.ZodNumber;
+            sectionId: z.ZodNumber;
+            widgetId: z.ZodNumber;
+            widgetTraffic: z.ZodNumber;
+        }, z.core.$strip>;
+        verdict: z.ZodLiteral<"render">;
+    }, z.core.$strip>, z.ZodObject<{
+        verdict: z.ZodLiteral<"skip">;
+    }, z.core.$strip>], "verdict">>;
+    status: z.ZodEnum<{
+        match: "match";
+        diverged: "diverged";
+        incomplete: "incomplete";
+    }>;
+    targetingFlowIds: z.ZodArray<z.ZodNumber>;
+    workflowPhase: z.ZodLiteral<"decide">;
+}, z.core.$strip>;
 /**
  * A shadow comparison between the legacy client-side selection and the Decider's own — wire-only. The
  * sampled request/capture shape (`ShadowSampleSchema` upstream, with its Flow-listing and product data)
@@ -22,8 +77,8 @@ export type PostPurchaseShadowSelection = z.infer<typeof PostPurchaseShadowSelec
  */
 export declare const PostPurchaseShadowReportSchema: z.ZodObject<{
     differences: z.ZodArray<z.ZodEnum<{
-        verdict: "verdict";
         entry: "entry";
+        verdict: "verdict";
         targeting: "targeting";
         "incomplete-capture": "incomplete-capture";
         "unsupported-configuration": "unsupported-configuration";

package/dist/schema/postPurchaseSkipTrace.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 export declare const POST_PURCHASE_SKIP_LIMIT = 32;
 /** This request's verified reads, not a claim about the path of a competing committed winner. */
-export declare const PostPurchaseSkipTrace: z.ZodArray<z.ZodObject<{
+export declare const PostPurchaseSkipTraceSchema: z.ZodArray<z.ZodObject<{
     entry: z.ZodObject<{
         blockId: z.ZodNumber;
         blockIndex: z.ZodString;
@@ -16,4 +16,4 @@ export declare const PostPurchaseSkipTrace: z.ZodArray<z.ZodObject<{
         "no-eligible-subscription": "no-eligible-subscription";
     }>;
 }, z.core.$strip>>;
-export type PostPurchaseSkipTrace = z.infer<typeof PostPurchaseSkipTrace>;
+export type PostPurchaseSkipTrace = z.infer<typeof PostPurchaseSkipTraceSchema>;

package/dist/server/requestSchemas.d.ts

@@ -270,6 +270,7 @@ export declare const WidgetSettingsInputSchema: z.ZodObject<{
     monetize: z.ZodOptional<z.ZodObject<{
         language: z.ZodOptional<z.ZodString>;
         currency: z.ZodOptional<z.ZodString>;
+        sessionId: z.ZodOptional<z.ZodString>;
         cart: z.ZodObject<{
             attributes: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 key: z.ZodString;
@@ -304,7 +305,6 @@ export declare const WidgetSettingsInputSchema: z.ZodObject<{
             order_status: "order_status";
             thank_you_page: "thank_you_page";
         }>;
-        sessionId: z.ZodOptional<z.ZodString>;
         timezone: z.ZodOptional<z.ZodString>;
         transactionId: z.ZodOptional<z.ZodString>;
         transactionItems: z.ZodOptional<z.ZodArray<z.ZodObject<{

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rebuy/rebuy",
-    "version": "3.26.0",
+    "version": "3.27.0",
     "description": "Shared zod schemas, legacy-to-CAB widget transforms, and server orchestrators for Rebuy's Shopify consumers (rebuy-api, admin-nextjs, rebuy-shopify-extensions)",
     "license": "MIT",
     "author": "Rebuy, Inc.",