@rebuy/rebuy 3.57.0 → 3.59.0

package/dist/gwp/index.cjs

@@ -37,8 +37,8 @@ var getValidGwpProductIds = (matchedRules = []) => new Set(
 
 // src/gwp/hasUnsupportedRuleTypes.ts
 var UNSUPPORTED_RULE_TYPES = ["url", "order_tag"];
-var UNSUPPORTED_RULE_TYPE_PREFIX = "geolocation_";
-var isUnsupportedType = (type = "") => UNSUPPORTED_RULE_TYPES.includes(type) || type.startsWith(UNSUPPORTED_RULE_TYPE_PREFIX);
+var UNSUPPORTED_RULE_TYPE_FRAGMENT = "geolocation";
+var isUnsupportedType = (type = "") => UNSUPPORTED_RULE_TYPES.includes(type) || type.includes(UNSUPPORTED_RULE_TYPE_FRAGMENT);
 var ruleHasUnsupportedType = (rule) => (rule.logic ?? []).some((group) => (group.rules ?? []).some((item) => isUnsupportedType(item.type)));
 var hasUnsupportedRuleTypes = (metadata) => [...metadata?.matchedRules ?? [], ...metadata?.unmatchedRules ?? []].some(ruleHasUnsupportedType);
 

package/dist/gwp/index.mjs

@@ -5,8 +5,8 @@ var getValidGwpProductIds = (matchedRules = []) => new Set(
 
 // src/gwp/hasUnsupportedRuleTypes.ts
 var UNSUPPORTED_RULE_TYPES = ["url", "order_tag"];
-var UNSUPPORTED_RULE_TYPE_PREFIX = "geolocation_";
-var isUnsupportedType = (type = "") => UNSUPPORTED_RULE_TYPES.includes(type) || type.startsWith(UNSUPPORTED_RULE_TYPE_PREFIX);
+var UNSUPPORTED_RULE_TYPE_FRAGMENT = "geolocation";
+var isUnsupportedType = (type = "") => UNSUPPORTED_RULE_TYPES.includes(type) || type.includes(UNSUPPORTED_RULE_TYPE_FRAGMENT);
 var ruleHasUnsupportedType = (rule) => (rule.logic ?? []).some((group) => (group.rules ?? []).some((item) => isUnsupportedType(item.type)));
 var hasUnsupportedRuleTypes = (metadata) => [...metadata?.matchedRules ?? [], ...metadata?.unmatchedRules ?? []].some(ruleHasUnsupportedType);
 

package/dist/index.cjs

@@ -1698,7 +1698,7 @@ var OfferProductDiscount = import_zod5.z.object({
   type: import_zod5.z.string()
 });
 var OfferProductOption = import_zod5.z.object({
-  id: import_zod5.z.number(),
+  id: import_zod5.z.number().optional(),
   name: import_zod5.z.string(),
   position: import_zod5.z.number(),
   values: import_zod5.z.array(import_zod5.z.string())
@@ -1710,7 +1710,7 @@ var OfferProductVariant = import_zod5.z.object({
   inventoryManagement: import_zod5.z.string().nullable(),
   inventoryPolicy: import_zod5.z.string(),
   inventoryQuantity: import_zod5.z.number(),
-  link: import_zod5.z.string(),
+  link: import_zod5.z.string().optional(),
   option1: import_zod5.z.string(),
   option2: import_zod5.z.string().nullable(),
   option3: import_zod5.z.string().nullable(),
@@ -1723,12 +1723,12 @@ var OfferProduct = import_zod5.z.object({
   id: import_zod5.z.number(),
   image: import_zod5.z.object({ src: import_zod5.z.string() }).nullish(),
   /**
-   * `variantIds` is optional: the engine omits `variant_ids` (rather than sending `[]`) on an image tied to no
+   * `variantIds` is nullish: the engine omits `variant_ids` (rather than sending `[]`) on an image tied to no
    * variant — seen live on the `recommended` data source while `top_sellers` sends `[]` for the same image
-   * (REB-24958). A missing list means "not variant-specific", exactly like `[]`, so the image keeps its `src`
-   * and the product is never dropped over it.
+   * (REB-24958). A missing (or `null`) list means "not variant-specific", exactly like `[]`, so the image
+   * keeps its `src` and the product is never dropped over it.
    */
-  images: import_zod5.z.array(import_zod5.z.object({ src: import_zod5.z.string(), variantIds: import_zod5.z.array(import_zod5.z.number()).optional() })).nullish(),
+  images: import_zod5.z.array(import_zod5.z.object({ src: import_zod5.z.string(), variantIds: import_zod5.z.array(import_zod5.z.number()).nullish() })).nullish(),
   link: import_zod5.z.string().optional(),
   metafields: import_zod5.z.array(import_zod5.z.object({ key: import_zod5.z.string(), namespace: import_zod5.z.string(), value: import_zod5.z.string() })).optional(),
   options: import_zod5.z.array(OfferProductOption),
@@ -3313,7 +3313,15 @@ var StsCompensationProgressSchema = import_zod42.z.union([
   AttemptSchema2,
   FinishedSchema.extend({ status: import_zod42.z.enum(["removed", "failed", "unknown"]) })
 ]);
-var StsReviewReasonSchema = import_zod42.z.enum(["refund-unknown", "compensation-failed", "compensation-unknown"]);
+var StsReviewReasonSchema = import_zod42.z.enum([
+  "refund-unknown",
+  "compensation-failed",
+  "compensation-unknown",
+  "charge-unconfirmed",
+  "refund-lost",
+  "compensation-lost",
+  "refund-owed"
+]);
 var StsReviewProgressSchema = import_zod42.z.strictObject({
   markedAt: PostPurchaseTimestampSchema,
   marker: AcceptedMetafieldResultSchema.shape.status,
@@ -3325,6 +3333,12 @@ var reviewReason = (refund, compensation) => {
     return `compensation-${compensation.status}`;
   return null;
 };
+var judgedReason = (refund, compensation) => {
+  if (refund === null) return "charge-unconfirmed";
+  if (refund.status === "attempted") return "refund-lost";
+  if (compensation?.status === "attempted") return "compensation-lost";
+  return compensation?.status === "removed" ? "refund-owed" : null;
+};
 var StsProgressSchema = import_zod42.z.strictObject({
   compensation: StsCompensationProgressSchema.nullable(),
   operationId: PurchaseReceiptSchema.shape.operationId,
@@ -3333,10 +3347,11 @@ var StsProgressSchema = import_zod42.z.strictObject({
 }).refine(
   ({ compensation, refund }) => compensation === null || refund?.status === "failed",
   "Compensation follows a known refund failure only"
-).refine(
-  ({ compensation, refund, review }) => (review?.reason ?? null) === reviewReason(refund, compensation),
-  "Review must match the unresolved outcome"
-);
+).refine(({ compensation, refund, review }) => {
+  const resolved = reviewReason(refund, compensation);
+  const reason = review?.reason ?? null;
+  return reason === resolved || resolved === null && reason === judgedReason(refund, compensation);
+}, "Review must match the unresolved outcome");
 
 // src/schema/postPurchaseFollowups.ts
 var RequiredHealthSchema = import_zod43.z.union([
@@ -4918,8 +4933,10 @@ var PurchaseRecoveryRequestSchema = DecideRequestSchema.strict();
 var PurchaseRecoveryResponseSchema = import_zod84.z.object({
   data: import_zod84.z.object({
     /**
-     * Strict, so a client pinned before a new optional field rejects a reply that carries it rather than
-     * stripping it. Release the client before rebuy-api starts emitting a field added here.
+     * Strict, so rebuy-api (which validates its own reply against this schema) can never emit a field the
+     * contract does not name. cab-post-purchase reads recovery with hand guards that ignore extra keys, so
+     * the strictness never reaches it: release rebuy-api (the pin bump) first, then the client that reads a
+     * field added here.
      */
     operation: import_zod84.z.object({
       /** Absent from a rebuy-api that predates it. */

package/dist/index.mjs

@@ -1218,7 +1218,7 @@ var OfferProductDiscount = z5.object({
   type: z5.string()
 });
 var OfferProductOption = z5.object({
-  id: z5.number(),
+  id: z5.number().optional(),
   name: z5.string(),
   position: z5.number(),
   values: z5.array(z5.string())
@@ -1230,7 +1230,7 @@ var OfferProductVariant = z5.object({
   inventoryManagement: z5.string().nullable(),
   inventoryPolicy: z5.string(),
   inventoryQuantity: z5.number(),
-  link: z5.string(),
+  link: z5.string().optional(),
   option1: z5.string(),
   option2: z5.string().nullable(),
   option3: z5.string().nullable(),
@@ -1243,12 +1243,12 @@ var OfferProduct = z5.object({
   id: z5.number(),
   image: z5.object({ src: z5.string() }).nullish(),
   /**
-   * `variantIds` is optional: the engine omits `variant_ids` (rather than sending `[]`) on an image tied to no
+   * `variantIds` is nullish: the engine omits `variant_ids` (rather than sending `[]`) on an image tied to no
    * variant — seen live on the `recommended` data source while `top_sellers` sends `[]` for the same image
-   * (REB-24958). A missing list means "not variant-specific", exactly like `[]`, so the image keeps its `src`
-   * and the product is never dropped over it.
+   * (REB-24958). A missing (or `null`) list means "not variant-specific", exactly like `[]`, so the image
+   * keeps its `src` and the product is never dropped over it.
    */
-  images: z5.array(z5.object({ src: z5.string(), variantIds: z5.array(z5.number()).optional() })).nullish(),
+  images: z5.array(z5.object({ src: z5.string(), variantIds: z5.array(z5.number()).nullish() })).nullish(),
   link: z5.string().optional(),
   metafields: z5.array(z5.object({ key: z5.string(), namespace: z5.string(), value: z5.string() })).optional(),
   options: z5.array(OfferProductOption),
@@ -2833,7 +2833,15 @@ var StsCompensationProgressSchema = z42.union([
   AttemptSchema2,
   FinishedSchema.extend({ status: z42.enum(["removed", "failed", "unknown"]) })
 ]);
-var StsReviewReasonSchema = z42.enum(["refund-unknown", "compensation-failed", "compensation-unknown"]);
+var StsReviewReasonSchema = z42.enum([
+  "refund-unknown",
+  "compensation-failed",
+  "compensation-unknown",
+  "charge-unconfirmed",
+  "refund-lost",
+  "compensation-lost",
+  "refund-owed"
+]);
 var StsReviewProgressSchema = z42.strictObject({
   markedAt: PostPurchaseTimestampSchema,
   marker: AcceptedMetafieldResultSchema.shape.status,
@@ -2845,6 +2853,12 @@ var reviewReason = (refund, compensation) => {
     return `compensation-${compensation.status}`;
   return null;
 };
+var judgedReason = (refund, compensation) => {
+  if (refund === null) return "charge-unconfirmed";
+  if (refund.status === "attempted") return "refund-lost";
+  if (compensation?.status === "attempted") return "compensation-lost";
+  return compensation?.status === "removed" ? "refund-owed" : null;
+};
 var StsProgressSchema = z42.strictObject({
   compensation: StsCompensationProgressSchema.nullable(),
   operationId: PurchaseReceiptSchema.shape.operationId,
@@ -2853,10 +2867,11 @@ var StsProgressSchema = z42.strictObject({
 }).refine(
   ({ compensation, refund }) => compensation === null || refund?.status === "failed",
   "Compensation follows a known refund failure only"
-).refine(
-  ({ compensation, refund, review }) => (review?.reason ?? null) === reviewReason(refund, compensation),
-  "Review must match the unresolved outcome"
-);
+).refine(({ compensation, refund, review }) => {
+  const resolved = reviewReason(refund, compensation);
+  const reason = review?.reason ?? null;
+  return reason === resolved || resolved === null && reason === judgedReason(refund, compensation);
+}, "Review must match the unresolved outcome");
 
 // src/schema/postPurchaseFollowups.ts
 var RequiredHealthSchema = z43.union([
@@ -4438,8 +4453,10 @@ var PurchaseRecoveryRequestSchema = DecideRequestSchema.strict();
 var PurchaseRecoveryResponseSchema = z84.object({
   data: z84.object({
     /**
-     * Strict, so a client pinned before a new optional field rejects a reply that carries it rather than
-     * stripping it. Release the client before rebuy-api starts emitting a field added here.
+     * Strict, so rebuy-api (which validates its own reply against this schema) can never emit a field the
+     * contract does not name. cab-post-purchase reads recovery with hand guards that ignore extra keys, so
+     * the strictness never reaches it: release rebuy-api (the pin bump) first, then the client that reads a
+     * field added here.
      */
     operation: z84.object({
       /** Absent from a rebuy-api that predates it. */

package/dist/schema/offerProduct.d.ts

@@ -21,7 +21,7 @@ export declare const OfferProduct: z.ZodObject<{
     }, z.core.$strip>>>;
     images: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
         src: z.ZodString;
-        variantIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+        variantIds: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodNumber>>>;
     }, z.core.$strip>>>>;
     link: z.ZodOptional<z.ZodString>;
     metafields: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -30,7 +30,7 @@ export declare const OfferProduct: z.ZodObject<{
         value: z.ZodString;
     }, z.core.$strip>>>;
     options: z.ZodArray<z.ZodObject<{
-        id: z.ZodNumber;
+        id: z.ZodOptional<z.ZodNumber>;
         name: z.ZodString;
         position: z.ZodNumber;
         values: z.ZodArray<z.ZodString>;
@@ -46,7 +46,7 @@ export declare const OfferProduct: z.ZodObject<{
         inventoryManagement: z.ZodNullable<z.ZodString>;
         inventoryPolicy: z.ZodString;
         inventoryQuantity: z.ZodNumber;
-        link: z.ZodString;
+        link: z.ZodOptional<z.ZodString>;
         option1: z.ZodString;
         option2: z.ZodNullable<z.ZodString>;
         option3: z.ZodNullable<z.ZodString>;

package/dist/schema/postPurchaseFollowups.d.ts

@@ -169,6 +169,10 @@ export declare const AcceptedFollowupsResponseSchema: z.ZodObject<{
                     "refund-unknown": "refund-unknown";
                     "compensation-failed": "compensation-failed";
                     "compensation-unknown": "compensation-unknown";
+                    "charge-unconfirmed": "charge-unconfirmed";
+                    "refund-lost": "refund-lost";
+                    "compensation-lost": "compensation-lost";
+                    "refund-owed": "refund-owed";
                 }>;
             }, z.core.$strict>>;
         }, z.core.$strict>>;

package/dist/schema/postPurchaseRecovery.d.ts

@@ -152,6 +152,10 @@ export declare const PurchaseRecoveryResponseSchema: z.ZodObject<{
                         "refund-unknown": "refund-unknown";
                         "compensation-failed": "compensation-failed";
                         "compensation-unknown": "compensation-unknown";
+                        "charge-unconfirmed": "charge-unconfirmed";
+                        "refund-lost": "refund-lost";
+                        "compensation-lost": "compensation-lost";
+                        "refund-owed": "refund-owed";
                     }>;
                 }, z.core.$strict>>;
             }, z.core.$strict>>;

package/dist/schema/postPurchaseSts.d.ts

@@ -36,11 +36,25 @@ export declare const StsCompensationProgressSchema: z.ZodUnion<readonly [z.ZodOb
  * Why the STS is left for a person; `marker` is the `subscription_rollback_failed` metafield write. A
  * `marker` of `unavailable` means the marker could not be written, NOT that no review is needed: the review
  * stands whatever the marker status.
+ *
+ * The first three follow from a finished step. The rest are a server's judgement the steps cannot show, so
+ * each is allowed (never required) beside one state only:
+ * - `charge-unconfirmed`: the server sweep could not confirm the charge (no result reported in time, or an
+ * Unknown one), so no step will ever start. Without it a late `/purchases/accepted` reads as not started,
+ * which looks pending forever.
+ * - `refund-lost` / `compensation-lost`: that step was sent but its outcome was never saved, so it stays
+ * `attempted` and may have moved money.
+ * - `refund-owed`: the rollback removed the subscription line, but apiv2's removal never refunds, so the
+ * buyer may still have been charged for it.
  */
 export declare const StsReviewReasonSchema: z.ZodEnum<{
     "refund-unknown": "refund-unknown";
     "compensation-failed": "compensation-failed";
     "compensation-unknown": "compensation-unknown";
+    "charge-unconfirmed": "charge-unconfirmed";
+    "refund-lost": "refund-lost";
+    "compensation-lost": "compensation-lost";
+    "refund-owed": "refund-owed";
 }>;
 export declare const StsReviewProgressSchema: z.ZodObject<{
     markedAt: z.ZodNumber;
@@ -56,12 +70,18 @@ export declare const StsReviewProgressSchema: z.ZodObject<{
         "refund-unknown": "refund-unknown";
         "compensation-failed": "compensation-failed";
         "compensation-unknown": "compensation-unknown";
+        "charge-unconfirmed": "charge-unconfirmed";
+        "refund-lost": "refund-lost";
+        "compensation-lost": "compensation-lost";
+        "refund-owed": "refund-owed";
     }>;
 }, z.core.$strict>;
 /**
  * The refund-compensation saga of one admitted STS, `null` steps not yet started. Compensation follows a
  * known refund failure only, and a review is recorded exactly when the outcome is unresolved (an unknown
- * refund, or a failed or unknown rollback), so a compensated or unresolved STS never reads as switched.
+ * refund, or a failed or unknown rollback), so a compensated or unresolved STS never reads as switched. A
+ * server may also record a review the steps cannot show (an unconfirmed charge, a lost step, a refund owed
+ * after the rollback), only beside the one state it applies to.
  */
 export declare const StsProgressSchema: z.ZodObject<{
     compensation: z.ZodNullable<z.ZodUnion<readonly [z.ZodObject<{
@@ -107,6 +127,10 @@ export declare const StsProgressSchema: z.ZodObject<{
             "refund-unknown": "refund-unknown";
             "compensation-failed": "compensation-failed";
             "compensation-unknown": "compensation-unknown";
+            "charge-unconfirmed": "charge-unconfirmed";
+            "refund-lost": "refund-lost";
+            "compensation-lost": "compensation-lost";
+            "refund-owed": "refund-owed";
         }>;
     }, z.core.$strict>>;
 }, z.core.$strict>;

package/dist/server/index.cjs

@@ -81,8 +81,8 @@ var getValidGwpProductIds = (matchedRules = []) => new Set(
 
 // src/gwp/hasUnsupportedRuleTypes.ts
 var UNSUPPORTED_RULE_TYPES = ["url", "order_tag"];
-var UNSUPPORTED_RULE_TYPE_PREFIX = "geolocation_";
-var isUnsupportedType = (type = "") => UNSUPPORTED_RULE_TYPES.includes(type) || type.startsWith(UNSUPPORTED_RULE_TYPE_PREFIX);
+var UNSUPPORTED_RULE_TYPE_FRAGMENT = "geolocation";
+var isUnsupportedType = (type = "") => UNSUPPORTED_RULE_TYPES.includes(type) || type.includes(UNSUPPORTED_RULE_TYPE_FRAGMENT);
 var ruleHasUnsupportedType = (rule) => (rule.logic ?? []).some((group) => (group.rules ?? []).some((item) => isUnsupportedType(item.type)));
 var hasUnsupportedRuleTypes = (metadata) => [...metadata?.matchedRules ?? [], ...metadata?.unmatchedRules ?? []].some(ruleHasUnsupportedType);
 
@@ -364,7 +364,7 @@ var OfferProductDiscount = import_zod3.z.object({
   type: import_zod3.z.string()
 });
 var OfferProductOption = import_zod3.z.object({
-  id: import_zod3.z.number(),
+  id: import_zod3.z.number().optional(),
   name: import_zod3.z.string(),
   position: import_zod3.z.number(),
   values: import_zod3.z.array(import_zod3.z.string())
@@ -376,7 +376,7 @@ var OfferProductVariant = import_zod3.z.object({
   inventoryManagement: import_zod3.z.string().nullable(),
   inventoryPolicy: import_zod3.z.string(),
   inventoryQuantity: import_zod3.z.number(),
-  link: import_zod3.z.string(),
+  link: import_zod3.z.string().optional(),
   option1: import_zod3.z.string(),
   option2: import_zod3.z.string().nullable(),
   option3: import_zod3.z.string().nullable(),
@@ -389,12 +389,12 @@ var OfferProduct = import_zod3.z.object({
   id: import_zod3.z.number(),
   image: import_zod3.z.object({ src: import_zod3.z.string() }).nullish(),
   /**
-   * `variantIds` is optional: the engine omits `variant_ids` (rather than sending `[]`) on an image tied to no
+   * `variantIds` is nullish: the engine omits `variant_ids` (rather than sending `[]`) on an image tied to no
    * variant — seen live on the `recommended` data source while `top_sellers` sends `[]` for the same image
-   * (REB-24958). A missing list means "not variant-specific", exactly like `[]`, so the image keeps its `src`
-   * and the product is never dropped over it.
+   * (REB-24958). A missing (or `null`) list means "not variant-specific", exactly like `[]`, so the image
+   * keeps its `src` and the product is never dropped over it.
    */
-  images: import_zod3.z.array(import_zod3.z.object({ src: import_zod3.z.string(), variantIds: import_zod3.z.array(import_zod3.z.number()).optional() })).nullish(),
+  images: import_zod3.z.array(import_zod3.z.object({ src: import_zod3.z.string(), variantIds: import_zod3.z.array(import_zod3.z.number()).nullish() })).nullish(),
   link: import_zod3.z.string().optional(),
   metafields: import_zod3.z.array(import_zod3.z.object({ key: import_zod3.z.string(), namespace: import_zod3.z.string(), value: import_zod3.z.string() })).optional(),
   options: import_zod3.z.array(OfferProductOption),
@@ -426,6 +426,8 @@ var filterByB2bAvailability = async (products, input, ctx) => {
           productIds: products.map(productGid),
           shopifyShopDomain: input.shop
         },
+        /** admin-api verifies it (REB-25081); absent, the call is unauthenticated (log-only there until enforced). */
+        ...ctx.sessionToken && { headers: { Authorization: `Bearer ${ctx.sessionToken}` } },
         host: ctx.host,
         method: "POST"
       }
@@ -6192,6 +6194,10 @@ var reportOncePerResponse = (response, report, events) => {
   }
 };
 
+// src/server/postPurchaseSellingPlanRequirement.ts
+var requiresOwnSellingPlan = (product) => product.requiresSellingPlan === true;
+var requiresUnsuppliedSellingPlan = (product) => requiresOwnSellingPlan(product) && !product.sellingPlanGroups?.length;
+
 // src/server/readPostPurchaseProductSource.ts
 var Envelope = PostPurchaseProductSource.extend({ data: import_zod45.z.array(import_zod45.z.unknown()) });
 var Product3 = PostPurchaseProductSource.shape.data.element;
@@ -6204,9 +6210,9 @@ var readPostPurchaseProductSource = (response, report) => {
     const parsed = Product3.safeParse(raw);
     if (parsed.success) {
       rememberPostPurchaseProductSource(parsed.data, response, productIndex);
-      if (parsed.data.requiresSellingPlan && !parsed.data.sellingPlanGroups.length)
+      if (requiresUnsuppliedSellingPlan(parsed.data))
         drift.push({
-          detail: `Dropped post-purchase product ${parsed.data.id}: data.${productIndex}.requiresSellingPlan`,
+          detail: `Ineligible post-purchase product ${parsed.data.id}: data.${productIndex}.requiresSellingPlan`,
           kind: "product"
         });
       return [{ product: parsed.data, productIndex }];
@@ -6397,19 +6403,20 @@ var readPostPurchaseModernPlans = (raw, allocations) => {
 };
 
 // src/server/postPurchasePlanCatalog.ts
+var hasLegacyPlanGroups = ({ sellingPlanGroups }) => typeof sellingPlanGroups[0]?.id === "number";
 var projectPostPurchasePlanCatalog = (normalized, report) => {
   const { data } = normalized;
-  if (data.length === 1 && data[0].variants.length > 1) return null;
   if (normalized.emptiedByDrop && !data.length) return null;
+  if (data.length === 1 && data[0].variants.length > 1) return null;
   try {
-    if (data.length !== 1 || data[0].variants.length !== 1) throw new Error("Ambiguous product");
+    if (data.length !== 1 || data[0].variants.length !== 1) throw new Error("No single product and variant");
     const product = data[0];
     const variant2 = product.variants[0];
     if (variant2.productId !== product.id) throw new Error("Foreign variant");
     const groups = product.sellingPlanGroups;
     const required = groups.map((group) => group.requiresSellingPlan);
     if (required.some((flag) => flag !== required[0])) throw new Error("Conflicting requirement");
-    const plans = typeof groups[0]?.id === "number" ? readPostPurchaseLegacyPlans(groups[0], variant2.id) : readPostPurchaseModernPlans(groups, variant2.sellingPlanAllocations);
+    const plans = hasLegacyPlanGroups(product) ? readPostPurchaseLegacyPlans(groups[0], variant2.id) : readPostPurchaseModernPlans(groups, variant2.sellingPlanAllocations);
     const unique = /* @__PURE__ */ new Map();
     for (const plan of plans) {
       const previous = unique.get(plan.id);
@@ -6422,8 +6429,7 @@ var projectPostPurchasePlanCatalog = (normalized, report) => {
         discountPercentage: postPurchasePlanDiscountPercentage(variant2.price, plan.adjustment)
       })),
       productId: product.id,
-      // REB-25048: a v2 product flags the requirement on itself and carries no selling plan groups
-      requiresSellingPlan: (required[0] ?? false) || product.requiresSellingPlan === true,
+      requiresSellingPlan: (required[0] ?? false) || requiresOwnSellingPlan(product),
       variantId: variant2.id
     });
   } catch {
@@ -6976,7 +6982,7 @@ var oneTimeUnavailable = (normalized, allowCollection, quantity3) => {
     return "Only fixed one-time configuration is supported";
   const product = data[0];
   const variant2 = product.variants[0];
-  if (product.productGroupVariants.length || product.requiresSellingPlan === true || product.sellingPlanGroups?.some((group) => group.requiresSellingPlan))
+  if (product.productGroupVariants.length || requiresOwnSellingPlan(product) || product.sellingPlanGroups?.some((group) => group.requiresSellingPlan))
     return "A one-time variant without product groups or a required selling plan is required";
   if (!postPurchaseVariantAvailable(variant2)) return VARIANT_UNAVAILABLE;
   if (variant2.productId !== product.id) throw new Error("Product variant identity mismatch");
@@ -7647,7 +7653,7 @@ var reportUnreadableStsLine = (product, field, report) => {
 };
 var postPurchaseStsLine = (normalized, product, lines, variantId, report) => {
   if (!product.sellingPlanGroups?.length || product.productGroupVariants.length) return void 0;
-  const modern = typeof product.sellingPlanGroups[0].id !== "number";
+  const modern = !hasLegacyPlanGroups(product);
   for (const [index, variant2] of product.variants.entries()) {
     const matched = lines.filter((line) => line.sellingPlanId === void 0 && line.variantId === variant2.id);
     const data = [{ ...product, variants: [variant2] }];
@@ -7655,7 +7661,7 @@ var postPurchaseStsLine = (normalized, product, lines, variantId, report) => {
       const unread = [];
       if (projectPostPurchasePlanCatalog({ ...normalized, data }, (event) => unread.push(event))?.plans.length)
         return { data, line: matched[0] };
-      const field = modern && !PostPurchasePlanAllocations.safeParse(variant2.sellingPlanAllocations).success ? `variants.${index}.sellingPlanAllocations` : unread.length ? "sellingPlanGroups" : void 0;
+      const field = modern && !PostPurchasePlanAllocations.safeParse(variant2.sellingPlanAllocations).success ? `variants.${index}.sellingPlanAllocations` : !unread.length ? void 0 : variant2.productId === product.id ? "sellingPlanGroups" : `variants.${index}.productId`;
       if (report && field) reportUnreadableStsLine(product, field, report);
     }
   }
@@ -8097,7 +8103,7 @@ var eligibility = (normalized, product, excluded) => {
   if (product.productGroupVariants.length) {
     const group = readPostPurchaseGroup(product, normalized.effective, excluded);
     if (!group.entries.length) return void 0;
-    return group.entries.map(({ product: option }) => postPurchaseMemberEligibility(normalized, option)).some(Boolean);
+    return group.entries.map(({ product: option }) => eligibility(normalized, option)).some(Boolean);
   }
   if (!product.variants.length) return false;
   const variants = projectPostPurchaseVariantCatalog(product, normalized.effective).variants;

package/dist/server/index.mjs

@@ -8,8 +8,8 @@ var getValidGwpProductIds = (matchedRules = []) => new Set(
 
 // src/gwp/hasUnsupportedRuleTypes.ts
 var UNSUPPORTED_RULE_TYPES = ["url", "order_tag"];
-var UNSUPPORTED_RULE_TYPE_PREFIX = "geolocation_";
-var isUnsupportedType = (type = "") => UNSUPPORTED_RULE_TYPES.includes(type) || type.startsWith(UNSUPPORTED_RULE_TYPE_PREFIX);
+var UNSUPPORTED_RULE_TYPE_FRAGMENT = "geolocation";
+var isUnsupportedType = (type = "") => UNSUPPORTED_RULE_TYPES.includes(type) || type.includes(UNSUPPORTED_RULE_TYPE_FRAGMENT);
 var ruleHasUnsupportedType = (rule) => (rule.logic ?? []).some((group) => (group.rules ?? []).some((item) => isUnsupportedType(item.type)));
 var hasUnsupportedRuleTypes = (metadata) => [...metadata?.matchedRules ?? [], ...metadata?.unmatchedRules ?? []].some(ruleHasUnsupportedType);
 
@@ -291,7 +291,7 @@ var OfferProductDiscount = z3.object({
   type: z3.string()
 });
 var OfferProductOption = z3.object({
-  id: z3.number(),
+  id: z3.number().optional(),
   name: z3.string(),
   position: z3.number(),
   values: z3.array(z3.string())
@@ -303,7 +303,7 @@ var OfferProductVariant = z3.object({
   inventoryManagement: z3.string().nullable(),
   inventoryPolicy: z3.string(),
   inventoryQuantity: z3.number(),
-  link: z3.string(),
+  link: z3.string().optional(),
   option1: z3.string(),
   option2: z3.string().nullable(),
   option3: z3.string().nullable(),
@@ -316,12 +316,12 @@ var OfferProduct = z3.object({
   id: z3.number(),
   image: z3.object({ src: z3.string() }).nullish(),
   /**
-   * `variantIds` is optional: the engine omits `variant_ids` (rather than sending `[]`) on an image tied to no
+   * `variantIds` is nullish: the engine omits `variant_ids` (rather than sending `[]`) on an image tied to no
    * variant — seen live on the `recommended` data source while `top_sellers` sends `[]` for the same image
-   * (REB-24958). A missing list means "not variant-specific", exactly like `[]`, so the image keeps its `src`
-   * and the product is never dropped over it.
+   * (REB-24958). A missing (or `null`) list means "not variant-specific", exactly like `[]`, so the image
+   * keeps its `src` and the product is never dropped over it.
    */
-  images: z3.array(z3.object({ src: z3.string(), variantIds: z3.array(z3.number()).optional() })).nullish(),
+  images: z3.array(z3.object({ src: z3.string(), variantIds: z3.array(z3.number()).nullish() })).nullish(),
   link: z3.string().optional(),
   metafields: z3.array(z3.object({ key: z3.string(), namespace: z3.string(), value: z3.string() })).optional(),
   options: z3.array(OfferProductOption),
@@ -353,6 +353,8 @@ var filterByB2bAvailability = async (products, input, ctx) => {
           productIds: products.map(productGid),
           shopifyShopDomain: input.shop
         },
+        /** admin-api verifies it (REB-25081); absent, the call is unauthenticated (log-only there until enforced). */
+        ...ctx.sessionToken && { headers: { Authorization: `Bearer ${ctx.sessionToken}` } },
         host: ctx.host,
         method: "POST"
       }
@@ -6119,6 +6121,10 @@ var reportOncePerResponse = (response, report, events) => {
   }
 };
 
+// src/server/postPurchaseSellingPlanRequirement.ts
+var requiresOwnSellingPlan = (product) => product.requiresSellingPlan === true;
+var requiresUnsuppliedSellingPlan = (product) => requiresOwnSellingPlan(product) && !product.sellingPlanGroups?.length;
+
 // src/server/readPostPurchaseProductSource.ts
 var Envelope = PostPurchaseProductSource.extend({ data: z45.array(z45.unknown()) });
 var Product3 = PostPurchaseProductSource.shape.data.element;
@@ -6131,9 +6137,9 @@ var readPostPurchaseProductSource = (response, report) => {
     const parsed = Product3.safeParse(raw);
     if (parsed.success) {
       rememberPostPurchaseProductSource(parsed.data, response, productIndex);
-      if (parsed.data.requiresSellingPlan && !parsed.data.sellingPlanGroups.length)
+      if (requiresUnsuppliedSellingPlan(parsed.data))
         drift.push({
-          detail: `Dropped post-purchase product ${parsed.data.id}: data.${productIndex}.requiresSellingPlan`,
+          detail: `Ineligible post-purchase product ${parsed.data.id}: data.${productIndex}.requiresSellingPlan`,
           kind: "product"
         });
       return [{ product: parsed.data, productIndex }];
@@ -6324,19 +6330,20 @@ var readPostPurchaseModernPlans = (raw, allocations) => {
 };
 
 // src/server/postPurchasePlanCatalog.ts
+var hasLegacyPlanGroups = ({ sellingPlanGroups }) => typeof sellingPlanGroups[0]?.id === "number";
 var projectPostPurchasePlanCatalog = (normalized, report) => {
   const { data } = normalized;
-  if (data.length === 1 && data[0].variants.length > 1) return null;
   if (normalized.emptiedByDrop && !data.length) return null;
+  if (data.length === 1 && data[0].variants.length > 1) return null;
   try {
-    if (data.length !== 1 || data[0].variants.length !== 1) throw new Error("Ambiguous product");
+    if (data.length !== 1 || data[0].variants.length !== 1) throw new Error("No single product and variant");
     const product = data[0];
     const variant2 = product.variants[0];
     if (variant2.productId !== product.id) throw new Error("Foreign variant");
     const groups = product.sellingPlanGroups;
     const required = groups.map((group) => group.requiresSellingPlan);
     if (required.some((flag) => flag !== required[0])) throw new Error("Conflicting requirement");
-    const plans = typeof groups[0]?.id === "number" ? readPostPurchaseLegacyPlans(groups[0], variant2.id) : readPostPurchaseModernPlans(groups, variant2.sellingPlanAllocations);
+    const plans = hasLegacyPlanGroups(product) ? readPostPurchaseLegacyPlans(groups[0], variant2.id) : readPostPurchaseModernPlans(groups, variant2.sellingPlanAllocations);
     const unique = /* @__PURE__ */ new Map();
     for (const plan of plans) {
       const previous = unique.get(plan.id);
@@ -6349,8 +6356,7 @@ var projectPostPurchasePlanCatalog = (normalized, report) => {
         discountPercentage: postPurchasePlanDiscountPercentage(variant2.price, plan.adjustment)
       })),
       productId: product.id,
-      // REB-25048: a v2 product flags the requirement on itself and carries no selling plan groups
-      requiresSellingPlan: (required[0] ?? false) || product.requiresSellingPlan === true,
+      requiresSellingPlan: (required[0] ?? false) || requiresOwnSellingPlan(product),
       variantId: variant2.id
     });
   } catch {
@@ -6903,7 +6909,7 @@ var oneTimeUnavailable = (normalized, allowCollection, quantity3) => {
     return "Only fixed one-time configuration is supported";
   const product = data[0];
   const variant2 = product.variants[0];
-  if (product.productGroupVariants.length || product.requiresSellingPlan === true || product.sellingPlanGroups?.some((group) => group.requiresSellingPlan))
+  if (product.productGroupVariants.length || requiresOwnSellingPlan(product) || product.sellingPlanGroups?.some((group) => group.requiresSellingPlan))
     return "A one-time variant without product groups or a required selling plan is required";
   if (!postPurchaseVariantAvailable(variant2)) return VARIANT_UNAVAILABLE;
   if (variant2.productId !== product.id) throw new Error("Product variant identity mismatch");
@@ -7574,7 +7580,7 @@ var reportUnreadableStsLine = (product, field, report) => {
 };
 var postPurchaseStsLine = (normalized, product, lines, variantId, report) => {
   if (!product.sellingPlanGroups?.length || product.productGroupVariants.length) return void 0;
-  const modern = typeof product.sellingPlanGroups[0].id !== "number";
+  const modern = !hasLegacyPlanGroups(product);
   for (const [index, variant2] of product.variants.entries()) {
     const matched = lines.filter((line) => line.sellingPlanId === void 0 && line.variantId === variant2.id);
     const data = [{ ...product, variants: [variant2] }];
@@ -7582,7 +7588,7 @@ var postPurchaseStsLine = (normalized, product, lines, variantId, report) => {
       const unread = [];
       if (projectPostPurchasePlanCatalog({ ...normalized, data }, (event) => unread.push(event))?.plans.length)
         return { data, line: matched[0] };
-      const field = modern && !PostPurchasePlanAllocations.safeParse(variant2.sellingPlanAllocations).success ? `variants.${index}.sellingPlanAllocations` : unread.length ? "sellingPlanGroups" : void 0;
+      const field = modern && !PostPurchasePlanAllocations.safeParse(variant2.sellingPlanAllocations).success ? `variants.${index}.sellingPlanAllocations` : !unread.length ? void 0 : variant2.productId === product.id ? "sellingPlanGroups" : `variants.${index}.productId`;
       if (report && field) reportUnreadableStsLine(product, field, report);
     }
   }
@@ -8024,7 +8030,7 @@ var eligibility = (normalized, product, excluded) => {
   if (product.productGroupVariants.length) {
     const group = readPostPurchaseGroup(product, normalized.effective, excluded);
     if (!group.entries.length) return void 0;
-    return group.entries.map(({ product: option }) => postPurchaseMemberEligibility(normalized, option)).some(Boolean);
+    return group.entries.map(({ product: option }) => eligibility(normalized, option)).some(Boolean);
   }
   if (!product.variants.length) return false;
   const variants = projectPostPurchaseVariantCatalog(product, normalized.effective).variants;

package/dist/server/postPurchasePlanCatalog.d.ts

@@ -1,6 +1,9 @@
 import { PostPurchasePlanCatalog } from '../schema/postPurchasePlanCatalog';
 import type { normalizePostPurchaseProduct } from '../server/normalizePostPurchaseProduct';
 import type { Reporter } from '../server/shared';
+type Product = ReturnType<typeof normalizePostPurchaseProduct>['data'][number];
+/** v1 selling-plan groups carry numeric ids and their plans on the group; modern ones key plans per variant. */
+export declare const hasLegacyPlanGroups: ({ sellingPlanGroups }: Pick<Product, "sellingPlanGroups">) => boolean;
 /**
  * Optional inspection data survives unsupported preparation without changing its purchase authority. Each plan
  * carries its own display saving on this variant's price, so the switch label needs no client maths.
@@ -12,3 +15,4 @@ import type { Reporter } from '../server/shared';
  * not a second fault: each drop was already reported, so it answers null without another report.
  */
 export declare const projectPostPurchasePlanCatalog: (normalized: ReturnType<typeof normalizePostPurchaseProduct>, report?: Reporter) => PostPurchasePlanCatalog | null;
+export {};

package/dist/server/postPurchaseSellingPlanRequirement.d.ts

@@ -0,0 +1,14 @@
+type Requiring = {
+    requiresSellingPlan?: boolean | null;
+    sellingPlanGroups?: unknown[];
+};
+/**
+ * REB-25048: a v2 product flags `requires_selling_plan` on itself rather than on its selling plan groups. It is
+ * never sold one-time, and a product that also has groups is offered subscription-only. Legacy read only the first
+ * group's flag, so under Product Type `both` it dropped such a product where the rebuild offers it subscription-only
+ * (accepted deviation, connscoding on npm-rebuy #117: neither sells it one-time).
+ */
+export declare const requiresOwnSellingPlan: (product: Requiring) => boolean;
+/** Requires a selling plan with no group to supply one: no purchasable mode is left, so eligibility drops it. */
+export declare const requiresUnsuppliedSellingPlan: (product: Requiring) => boolean;
+export {};

package/dist/server/postPurchaseSts.d.ts

@@ -17,7 +17,9 @@ export declare const stsAllowed: ({ effective, original }: Pick<Normalized, "eff
  * plan; (2) it sits on exactly one one-time line, since two make the refunded quantity ambiguous; (3) a grouped
  * product is never an STS member; (4) the bound variant is the purchased line's, not the product's selected
  * variant, and subscription is the only mode. The first such variant in catalog order wins, unless `variantId`
- * names one.
+ * names one. Two more differences from legacy are accepted (connscoding, npm-rebuy #109): a subscription line
+ * beside a one-time line of the same variant still gets STS, where legacy's first match on the variant offered
+ * none; and the quantity is fixed at the whole one-time line, where legacy let the buyer change it.
  *
  * `report` hears a candidate (a purchased, in-stock variant on exactly one one-time line) whose plan data cannot be
  * read, since it then silently switches nothing: a modern selling-plan variant whose `sellingPlanAllocations` is

package/dist/server/shared.d.ts

@@ -28,12 +28,12 @@ export type UpstreamFetch = (path: string, params: Record<string, string>, optio
 /**
  * A drift signal the orchestrators emit when a per-item payload salvage drops something: a malformed
  * offer product (or a post-purchase data-source product, `product`, named by id and dotted path), an
- * invalid/unknown section stubbed out, an unreadable rule verdict, a shop-config
- * entry the shared schema inerted (`shopConfig`), unreadable selectable-gift milestones
- * (`giftMilestones` — the widget's gifts are then kept), or a post-purchase product's malformed selected review
- * metafield (`reviews` — the reviews are then omitted; it names the product and the field, never the value). Distinct from a hard {@link UpstreamError} — the
- * request still succeeds (degraded), so this is the only trace that an upstream contract moved. Optional
- * on {@link ServerContext}; the host (rebuy-api) wires it to its logger.
+ * invalid/unknown section stubbed out, an unreadable rule verdict, a shop-config entry the shared schema
+ * inerted (`shopConfig`), unreadable selectable-gift milestones (`giftMilestones` — the widget's gifts are
+ * then kept), or a post-purchase product's malformed selected review metafield (`reviews` — the reviews are
+ * then omitted; it names the product and the field, never the value). Distinct from a hard
+ * {@link UpstreamError} — the request still succeeds (degraded), so this is the only trace that an upstream
+ * contract moved. Optional on {@link ServerContext}; the host (rebuy-api) wires it to its logger.
  */
 export type ServerDrift = {
     detail: string;
@@ -55,10 +55,19 @@ export declare const isEmptyObject: (x: unknown) => boolean;
 export type ServerContext = {
     fetchUpstream: UpstreamFetch;
     host: string;
-    /** Buyer request IP forwarded to the ads engine (the checkout worker can't read it; rebuy-api extracts it). Without it DSPs see one datacenter IP for all traffic — geo/IVT-flagging risk. Monetize only. */
+    /**
+     * Buyer request IP forwarded to the ads engine (the checkout worker can't read it; rebuy-api extracts it).
+     * Without it DSPs see one datacenter IP for all traffic — geo/IVT-flagging risk. Monetize only.
+     */
     ipAddress?: string;
     /** Optional sink for {@link ServerDrift} — a degraded-but-successful payload salvage. */
     reportDrift?: (event: ServerDrift) => void;
+    /**
+     * The checkout extension's Shopify session token (the bare JWT, no `Bearer ` prefix), as the host received
+     * it. Forwarded unread to admin-api's B2B availability check, which verifies it and binds the shop and the
+     * company location to the buyer it names (REB-25081). Never logged. B2B data-source filtering only.
+     */
+    sessionToken?: string;
     /** Browser user-agent forwarded to the ads engine (the checkout worker can't read it). Monetize only. */
     userAgent?: string;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rebuy/rebuy",
-    "version": "3.57.0",
+    "version": "3.59.0",
     "description": "Shared zod schemas, legacy-to-CAB widget transforms, and server orchestrators for Rebuy's Shopify consumers (rebuy-api, admin-nextjs, rebuy-shopify-extensions)",
     "license": "MIT",
     "author": "Rebuy, Inc.",