@rebuy/rebuy 3.53.0 → 3.55.0

package/dist/routes.cjs

@@ -41,4 +41,4 @@ var apiRoutes = {
     sections: { method: "get", path: "/cab/sections" }
   }
 };
-var UPSTREAM_SUFFIXES = ["enigneyuber.com", "rebuycloud.dev", "rebuyengine.com", "trycloudflare.com"];
+var UPSTREAM_SUFFIXES = ["enigneyuber.com", "rebuycloud.dev", "rebuyengine.com"];

package/dist/routes.d.ts

@@ -42,7 +42,9 @@ export declare const apiRoutes: {
  * Hosts a non-production upstream override may point at (suffix match; subdomains allowed). The single
  * allowlist consumed by BOTH rebuy-api's `resolveUpstream` (the `X-Rebuy-Upstream` header guard) and the
  * checkout extension's `resolveUpstream` (the `hostName` block setting), so the two can never drift — a
- * host only one side accepts is silently dropped to production on the other. `trycloudflare.com` covers
- * local systems exposed via a `cloudflared` quick tunnel.
+ * host only one side accepts is silently dropped to production on the other. This list is the SSRF boundary:
+ * only Rebuy-owned zones belong on it. `trycloudflare.com` was removed (REB-24999) because anyone can mint a
+ * `cloudflared` quick tunnel under it, which let any caller point our pods at a host they control. To expose a
+ * local engine, run a named Cloudflare tunnel on a `rebuycloud.dev` hostname instead.
  */
-export declare const UPSTREAM_SUFFIXES: readonly ["enigneyuber.com", "rebuycloud.dev", "rebuyengine.com", "trycloudflare.com"];
+export declare const UPSTREAM_SUFFIXES: readonly ["enigneyuber.com", "rebuycloud.dev", "rebuyengine.com"];

package/dist/routes.mjs

@@ -16,7 +16,7 @@ var apiRoutes = {
     sections: { method: "get", path: "/cab/sections" }
   }
 };
-var UPSTREAM_SUFFIXES = ["enigneyuber.com", "rebuycloud.dev", "rebuyengine.com", "trycloudflare.com"];
+var UPSTREAM_SUFFIXES = ["enigneyuber.com", "rebuycloud.dev", "rebuyengine.com"];
 export {
   UPSTREAM_SUFFIXES,
   apiRoutes

package/dist/schema/postPurchaseProductSource.d.ts

@@ -4,7 +4,10 @@ export declare const PostPurchaseAmount: z.ZodString;
 export declare const PostPurchaseProductId: z.ZodNumber;
 export declare const PostPurchaseVariantId: z.ZodNumber;
 /**
- * The data-source product/variant response shape `normalizePostPurchaseProduct` validates.
+ * The data-source product/variant response shape `normalizePostPurchaseProduct` validates, one product at a
+ * time (`readPostPurchaseProductSource`, Slice 102): a product this rejects is dropped with a `product` drift,
+ * and only the envelope fails the read. A product's `productIndex` is always its position in the raw `data`
+ * array, never among the survivors, so a drop never renumbers the members Decision and Render identify.
  *
  * `metadata.productQuantity` is **new behaviour**, kept per decision 15 because the rebuild already implemented
  * it: legacy `initializeProduct.ts:100-104` read it, but its schema stripped `metadata` first, so no merchant ever