@rebuy/rebuy 3.58.0 → 3.59.0

package/dist/server/index.cjs

@@ -426,6 +426,8 @@ var filterByB2bAvailability = async (products, input, ctx) => {
           productIds: products.map(productGid),
           shopifyShopDomain: input.shop
         },
+        /** admin-api verifies it (REB-25081); absent, the call is unauthenticated (log-only there until enforced). */
+        ...ctx.sessionToken && { headers: { Authorization: `Bearer ${ctx.sessionToken}` } },
         host: ctx.host,
         method: "POST"
       }

package/dist/server/index.mjs

@@ -353,6 +353,8 @@ var filterByB2bAvailability = async (products, input, ctx) => {
           productIds: products.map(productGid),
           shopifyShopDomain: input.shop
         },
+        /** admin-api verifies it (REB-25081); absent, the call is unauthenticated (log-only there until enforced). */
+        ...ctx.sessionToken && { headers: { Authorization: `Bearer ${ctx.sessionToken}` } },
         host: ctx.host,
         method: "POST"
       }

package/dist/server/shared.d.ts

@@ -62,6 +62,12 @@ export type ServerContext = {
     ipAddress?: string;
     /** Optional sink for {@link ServerDrift} — a degraded-but-successful payload salvage. */
     reportDrift?: (event: ServerDrift) => void;
+    /**
+     * The checkout extension's Shopify session token (the bare JWT, no `Bearer ` prefix), as the host received
+     * it. Forwarded unread to admin-api's B2B availability check, which verifies it and binds the shop and the
+     * company location to the buyer it names (REB-25081). Never logged. B2B data-source filtering only.
+     */
+    sessionToken?: string;
     /** Browser user-agent forwarded to the ads engine (the checkout worker can't read it). Monetize only. */
     userAgent?: string;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rebuy/rebuy",
-    "version": "3.58.0",
+    "version": "3.59.0",
     "description": "Shared zod schemas, legacy-to-CAB widget transforms, and server orchestrators for Rebuy's Shopify consumers (rebuy-api, admin-nextjs, rebuy-shopify-extensions)",
     "license": "MIT",
     "author": "Rebuy, Inc.",