@openlup/platform 0.17.0 → 0.19.0

package/src/promotions/promotionQuoteAcceptance.ts

@@ -0,0 +1,291 @@
+import type { ShippingTerms } from "../shipping/index.js";
+import type { ResolvedAcquisitionTerms } from "../pricing/index.js";
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { z } from "zod";
+import type { CommerceQuote, CommerceQuoteDiscount } from "../pricing/index.js";
+import type { PromotionAcceptanceTelemetry } from "./promotionAcceptanceTelemetry.js";
+import {
+  projectPromotionQuoteMoney,
+  promotionQuoteMoneySections,
+  PROMOTION_QUOTE_MONEY_SECTIONS,
+  stableJson,
+  type PromotionQuoteMismatchField,
+} from "./promotionQuoteBinding.js";
+export const PROMOTION_ACCEPTANCE_MAX_TTL_MS = 72 * 60 * 60 * 1_000;
+export const PROMOTION_ACCEPTANCE_CLOCK_SKEW_MS = 60_000;
+const payloadSchema = z.object({
+  v: z.literal(1),
+  kid: z.string().regex(/^[0-9a-f]{16}$/),
+  iat: z.number().int().nonnegative(),
+  exp: z.number().int().positive(),
+  engine: z.literal("promotion-engine.v2"),
+  requestBinding: z.string().regex(/^[0-9a-f]{64}$/),
+  codeBinding: z.string().regex(/^[0-9a-f]{64}$/),
+  quoteBinding: z.string().regex(/^[0-9a-f]{64}$/),
+  // Legacy payloads still parse, but their whole-quote binding is rejected.
+  // Quote refresh issues a new money-bound token; missing sections report other.
+  sectionBindings: z.object(Object.fromEntries(PROMOTION_QUOTE_MONEY_SECTIONS
+    .map((section) => [section, z.string().regex(/^[0-9a-f]{64}$/)])) as Record<
+      PromotionQuoteMoneySectionKey, z.ZodString>).strict().optional(),
+  totalMinor: z.number().int().nonnegative(),
+  currency: z.string().length(3),
+}).strict();
+type PromotionQuoteMoneySectionKey = (typeof PROMOTION_QUOTE_MONEY_SECTIONS)[number];
+export interface PromotionAcceptanceKeyring {
+  current: string;
+  previous?: string | null;
+}
+export type PromotionAcceptanceDiagnostic = {
+  accepted: boolean;
+  reason: PromotionAcceptanceTelemetry["reason"];
+  keySlot: PromotionAcceptanceTelemetry["keySlot"];
+  expiryBucket: PromotionAcceptanceTelemetry["expiryBucket"];
+  /** Present only on `quote_mismatch`: which money section diverged. */
+  mismatchField?: PromotionQuoteMismatchField;
+};
+
+export function createPromotionQuoteAcceptance<Request extends { promoCodes: string[] }>({ projectRequest }: { projectRequest(request: Request): unknown }) {
+  function issuePromotionQuoteAcceptance(input: {
+    request: Request;
+    quote: CommerceQuote;
+    acquisitionTerms?: ResolvedAcquisitionTerms;
+    shippingTerms?: ShippingTerms;
+    keyring: PromotionAcceptanceKeyring;
+    now?: Date;
+  }): string | null {
+    return issuePromotionQuoteAcceptanceWithOutcome(input).token;
+  }
+
+  function issuePromotionQuoteAcceptanceWithOutcome(input: {
+    request: Request;
+    quote: CommerceQuote;
+    acquisitionTerms?: ResolvedAcquisitionTerms;
+    shippingTerms?: ShippingTerms;
+    keyring: PromotionAcceptanceKeyring;
+    now?: Date;
+  }): { token: string | null; diagnostic: PromotionAcceptanceDiagnostic } {
+    const evidence = v2Discounts(input.quote);
+    if (evidence.length === 0 && !input.acquisitionTerms && !input.shippingTerms) return {
+      token: null,
+      diagnostic: rejected("no_v2_adjustment"),
+    };
+    assertSecret(input.keyring.current);
+    const nowMs = (input.now ?? new Date()).getTime();
+    const codeExpiry = Math.min(...evidence.map((discount) =>
+      discount.promotionCodeValidTo ? Date.parse(discount.promotionCodeValidTo) : Number.POSITIVE_INFINITY));
+    const exp = Math.min(nowMs + PROMOTION_ACCEPTANCE_MAX_TTL_MS, codeExpiry);
+    if (!Number.isFinite(exp) || exp <= nowMs) return {
+      token: null,
+      diagnostic: rejected("ttl_invalid"),
+    };
+    const payload = payloadSchema.parse({
+      v: 1,
+      kid: keyId(input.keyring.current),
+      iat: nowMs,
+      exp,
+      engine: "promotion-engine.v2",
+      requestBinding: requestBinding(input.request, input.keyring.current),
+      codeBinding: codeBinding(input.request.promoCodes, input.keyring.current),
+      quoteBinding: quoteBinding(input.quote, input.keyring.current, input.acquisitionTerms, input.shippingTerms),
+      sectionBindings: sectionBindings(input.quote, input.keyring.current, input.acquisitionTerms, input.shippingTerms),
+      totalMinor: input.quote.totalGross.amountMinor,
+      currency: input.quote.totalGross.currency,
+    });
+    const encoded = Buffer.from(JSON.stringify(payload)).toString("base64url");
+    return {
+      token: `${encoded}.${sign(encoded, input.keyring.current)}`,
+      diagnostic: {
+        accepted: true,
+        reason: "issued",
+        keySlot: "current",
+        expiryBucket: expiryBucket(exp, nowMs),
+      },
+    };
+  }
+
+  function verifyPromotionQuoteAcceptance(input: {
+    token: string;
+    request: Request;
+    quote: CommerceQuote;
+    acquisitionTerms?: ResolvedAcquisitionTerms;
+    shippingTerms?: ShippingTerms;
+    expectedTotal: { amountMinor: number; currency: string };
+    keyring: PromotionAcceptanceKeyring;
+    now?: Date;
+  }): boolean {
+    return verifyPromotionQuoteAcceptanceWithOutcome(input).accepted;
+  }
+
+  function verifyPromotionQuoteAcceptanceWithOutcome(input: {
+    token: string;
+    request: Request;
+    quote: CommerceQuote;
+    acquisitionTerms?: ResolvedAcquisitionTerms;
+    shippingTerms?: ShippingTerms;
+    expectedTotal: { amountMinor: number; currency: string };
+    keyring: PromotionAcceptanceKeyring;
+    now?: Date;
+  }): PromotionAcceptanceDiagnostic {
+    const verified = verifyEnvelopeWithOutcome(input.token, input.keyring, input.now ?? new Date());
+    if (verified.verified === false) return verified.diagnostic;
+    const { payload, secret } = verified;
+    const base = { keySlot: verified.keySlot, expiryBucket: verified.expiryBucket };
+    if (payload.requestBinding !== requestBinding(input.request, secret)) {
+      return { accepted: false, reason: "request_mismatch", ...base };
+    }
+    if (payload.codeBinding !== codeBinding(input.request.promoCodes, secret)) {
+      return { accepted: false, reason: "code_mismatch", ...base };
+    }
+    if (payload.quoteBinding !== quoteBinding(input.quote, secret, input.acquisitionTerms, input.shippingTerms)) {
+      const mismatchField = namedMismatchField(payload.sectionBindings, input.quote, secret, input.acquisitionTerms, input.shippingTerms);
+      return { accepted: false, reason: "quote_mismatch", mismatchField, ...base };
+    }
+    if (payload.totalMinor !== input.expectedTotal.amountMinor) {
+      return { accepted: false, reason: "total_mismatch", ...base };
+    }
+    if (payload.currency !== input.expectedTotal.currency) {
+      return { accepted: false, reason: "currency_mismatch", ...base };
+    }
+    if (v2Discounts(input.quote).length === 0 && !input.acquisitionTerms && !input.shippingTerms) {
+      return { accepted: false, reason: "no_v2_adjustment_in_quote", ...base };
+    }
+    return { accepted: true, reason: "accepted", ...base };
+  }
+
+  function verifyEnvelopeWithOutcome(
+    token: string,
+    keyring: PromotionAcceptanceKeyring,
+    now: Date,
+  ): ({
+    verified: true;
+    payload: z.infer<typeof payloadSchema>;
+    secret: string;
+    keySlot: "current" | "previous";
+    expiryBucket: PromotionAcceptanceTelemetry["expiryBucket"];
+  } | { verified: false; diagnostic: PromotionAcceptanceDiagnostic }) {
+    const [encoded, signature, extra] = token.split(".");
+    if (!encoded || !signature || extra || encoded.length > 8_192 || signature.length !== 43) {
+      return { verified: false, diagnostic: rejected("malformed") };
+    }
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    } catch {
+      return { verified: false, diagnostic: rejected("malformed") };
+    }
+    const payload = payloadSchema.safeParse(parsed);
+    if (!payload.success) return { verified: false, diagnostic: rejected("malformed") };
+    const candidates = [
+      { slot: "current" as const, secret: keyring.current },
+      { slot: "previous" as const, secret: keyring.previous },
+    ].filter((candidate): candidate is { slot: "current" | "previous"; secret: string } =>
+      typeof candidate.secret === "string" && candidate.secret.length >= 32);
+    const candidate = candidates.find((value) => keyId(value.secret) === payload.data.kid);
+    if (!candidate) return { verified: false, diagnostic: rejected("unknown_key") };
+    if (!safeEqual(signature, sign(encoded, candidate.secret))) {
+      return { verified: false, diagnostic: rejected("signature_invalid") };
+    }
+    const nowMs = now.getTime();
+    const safeBase = { keySlot: candidate.slot, expiryBucket: expiryBucket(payload.data.exp, nowMs) };
+    if (payload.data.exp <= payload.data.iat ||
+      payload.data.exp - payload.data.iat > PROMOTION_ACCEPTANCE_MAX_TTL_MS) {
+      return { verified: false, diagnostic: { accepted: false, reason: "ttl_invalid", ...safeBase } };
+    }
+    if (payload.data.iat > nowMs + PROMOTION_ACCEPTANCE_CLOCK_SKEW_MS) {
+      return { verified: false, diagnostic: { accepted: false, reason: "not_yet_valid", ...safeBase } };
+    }
+    if (nowMs >= payload.data.exp) {
+      return { verified: false, diagnostic: { accepted: false, reason: "expired", ...safeBase } };
+    }
+    return {
+      verified: true,
+      payload: payload.data,
+      secret: candidate.secret,
+      keySlot: candidate.slot,
+      expiryBucket: expiryBucket(payload.data.exp, nowMs),
+    };
+  }
+
+  function rejected(reason: PromotionAcceptanceTelemetry["reason"]): PromotionAcceptanceDiagnostic {
+    return { accepted: false, reason, keySlot: "none", expiryBucket: "none" };
+  }
+
+  function expiryBucket(exp: number, now: number): PromotionAcceptanceTelemetry["expiryBucket"] {
+    const remaining = exp - now;
+    if (remaining <= 0) return "expired";
+    if (remaining < 60 * 60 * 1_000) return "lt_1h";
+    if (remaining < 24 * 60 * 60 * 1_000) return "1_24h";
+    return "24_72h";
+  }
+
+  function v2Discounts(quote: CommerceQuote): CommerceQuoteDiscount[] {
+    return quote.discounts.filter((discount) =>
+      discount.promotionEngineVersion === "promotion-engine.v2" &&
+      discount.reasonCode === "promotion_code_v2");
+  }
+
+  function requestBinding(request: Request, secret: string): string {
+    return hmac(secret, stableJson(projectRequest(request)));
+  }
+
+  function codeBinding(codes: readonly string[], secret: string): string {
+    return hmac(secret, stableJson([...new Set(codes.map((code) => code.trim().toUpperCase()))].sort()));
+  }
+
+  function quoteBinding(quote: CommerceQuote, secret: string, acquisitionTerms?: ResolvedAcquisitionTerms, shippingTerms?: ShippingTerms): string {
+    return hmac(secret, stableJson(projectPromotionQuoteMoney(quote, acquisitionTerms, shippingTerms)));
+  }
+
+  function sectionBindings(
+    quote: CommerceQuote,
+    secret: string,
+    acquisitionTerms?: ResolvedAcquisitionTerms,
+    shippingTerms?: ShippingTerms,
+  ): Record<PromotionQuoteMoneySectionKey, string> {
+    const sections = promotionQuoteMoneySections(quote, acquisitionTerms, shippingTerms);
+    return Object.fromEntries(PROMOTION_QUOTE_MONEY_SECTIONS
+      .map((section) => [section, hmac(secret, stableJson(sections[section]))])) as Record<
+        PromotionQuoteMoneySectionKey, string>;
+  }
+
+  /**
+   * The verifier holds only the issuer's HMACs, never the issued quote, so the
+   * differing section is found by comparing per-section hashes in a fixed order.
+   */
+  function namedMismatchField(
+    issued: Record<PromotionQuoteMoneySectionKey, string> | undefined,
+    quote: CommerceQuote,
+    secret: string,
+    acquisitionTerms?: ResolvedAcquisitionTerms,
+    shippingTerms?: ShippingTerms,
+  ): PromotionQuoteMismatchField {
+    if (!issued) return "other";
+    const verified = sectionBindings(quote, secret, acquisitionTerms, shippingTerms);
+    return PROMOTION_QUOTE_MONEY_SECTIONS
+      .find((section) => issued[section] !== verified[section]) ?? "other";
+  }
+
+  function keyId(secret: string): string {
+    return createHash("sha256").update(secret).digest("hex").slice(0, 16);
+  }
+
+  function hmac(secret: string, value: string): string {
+    return createHmac("sha256", secret).update(value).digest("hex");
+  }
+
+  function sign(encoded: string, secret: string): string {
+    return createHmac("sha256", secret).update(encoded).digest("base64url");
+  }
+
+  function safeEqual(left: string, right: string): boolean {
+    const a = Buffer.from(left);
+    const b = Buffer.from(right);
+    return a.length === b.length && timingSafeEqual(a, b);
+  }
+
+  function assertSecret(secret: string): void {
+    if (secret.length < 32) throw new Error("promotion_acceptance_secret_invalid");
+  }
+
+  return { issuePromotionQuoteAcceptance, issuePromotionQuoteAcceptanceWithOutcome, verifyPromotionQuoteAcceptance, verifyPromotionQuoteAcceptanceWithOutcome };
+}

package/src/promotions/promotionQuoteBinding.ts

@@ -0,0 +1,163 @@
+import type { ShippingTerms } from "../shipping/index.js";
+import { acquisitionQuoteBinding, type ResolvedAcquisitionTerms } from "../pricing/index.js";
+import type {
+  CommerceMoney,
+  CommerceQuote,
+  CommerceQuoteDiscount,
+} from "../pricing/index.js";
+
+/**
+ * The canonical money projection an acceptance token binds.
+ *
+ * ⛔ The token protects **what the customer pays**, never how it was presented
+ * or which server-only evidence produced it. Everything outside this projection
+ * is deliberately unbound: `label`, `reasonCode`, `customerSemantic`, `code`,
+ * `promotionCodeRevision`, `promotionCodeScopes`, `promotionMinimumReferenceMinor`,
+ * `promotionCodeValidTo`, `floorApplied`, `context`, `codeRejections`,
+ * `codeRejectionDetails`, `pricingComponents` and `catalogFacts`. Those differ
+ * legitimately between the two surfaces that share one token — the public quote
+ * route signs the contract-parsed public projection while the checkout guard
+ * verifies the raw server-authoritative quote, which carries `catalogFacts`
+ * (with a per-request `atTime`) that the public projection strips — so binding
+ * them turned every strict-path v2 code checkout into a permanent rejection.
+ *
+ * What stays bound is every amount and every discount identity: change a price,
+ * a quantity, a tax split, shipping, a discount amount, which promotion granted
+ * it, or what it applies to, and the token stops verifying.
+ */
+export interface PromotionQuoteMoneyLine {
+  sku: string;
+  quantity: number;
+  unitPriceGross: CommerceMoney;
+  lineSubtotalGross: CommerceMoney;
+  tax: {
+    vatRateBps: number;
+    netAmount: CommerceMoney;
+    vatAmount: CommerceMoney;
+    grossAmount: CommerceMoney;
+  };
+}
+
+export interface PromotionQuoteMoneyDiscount {
+  promotionId: string;
+  appliesTo: CommerceQuoteDiscount["appliesTo"];
+  amountOffMinor: number;
+  promotionCodeId: string | null;
+  promotionDefinitionFingerprint: string | null;
+  promotionBenefitKind: NonNullable<CommerceQuoteDiscount["promotionBenefitKind"]> | null;
+  promotionBenefitValueBps: number | null;
+  promotionBenefitValueMinor: number | null;
+}
+
+export interface PromotionQuoteMoneyProjection {
+  acquisitionTerms?: ResolvedAcquisitionTerms;
+  shippingTerms?: ShippingTerms;
+  currency: string;
+  totalGross: CommerceMoney;
+  netTotal: CommerceMoney;
+  taxTotal: CommerceMoney;
+  subtotalGross: CommerceMoney;
+  discountTotalGross: CommerceMoney;
+  shippingGross: CommerceMoney | null;
+  shippingDiscountGross: CommerceMoney | null;
+  lines: PromotionQuoteMoneyLine[];
+  discounts: PromotionQuoteMoneyDiscount[];
+}
+
+/** The five sections the token hashes separately so a mismatch can name itself. */
+export const PROMOTION_QUOTE_MONEY_SECTIONS = [
+  "lines",
+  "discounts",
+  "shipping",
+  "totals",
+  "currency",
+] as const;
+
+export type PromotionQuoteMoneySection = (typeof PROMOTION_QUOTE_MONEY_SECTIONS)[number];
+
+/** `other` is the honest answer for a token minted before section bindings existed. */
+export const PROMOTION_QUOTE_MISMATCH_FIELDS = [
+  ...PROMOTION_QUOTE_MONEY_SECTIONS,
+  "other",
+] as const;
+
+export type PromotionQuoteMismatchField = (typeof PROMOTION_QUOTE_MISMATCH_FIELDS)[number];
+
+/**
+ * Discount order is preserved: the promotion engine emits its lanes
+ * deterministically, so a reordering is a real evaluation difference.
+ */
+export function projectPromotionQuoteMoney(quote: CommerceQuote, acquisitionTerms?: ResolvedAcquisitionTerms, shippingTerms?: ShippingTerms): PromotionQuoteMoneyProjection {
+  return {
+    ...acquisitionQuoteBinding(acquisitionTerms),
+    currency: quote.currency,
+    totalGross: quote.totalGross,
+    netTotal: quote.netTotal,
+    taxTotal: quote.taxTotal,
+    subtotalGross: quote.subtotalGross,
+    discountTotalGross: quote.discountTotalGross,
+    shippingGross: quote.shippingGross ?? null,
+    shippingDiscountGross: quote.shippingDiscountGross ?? null,
+    ...(shippingTerms ? { shippingTerms } : {}),
+    lines: quote.lines.map((line) => ({
+      sku: line.sku,
+      quantity: line.quantity,
+      unitPriceGross: line.unitPriceGross,
+      lineSubtotalGross: line.lineSubtotalGross,
+      tax: {
+        vatRateBps: line.tax.vatRateBps,
+        netAmount: line.tax.netAmount,
+        vatAmount: line.tax.vatAmount,
+        grossAmount: line.tax.grossAmount,
+      },
+    })),
+    discounts: quote.discounts.map((discount) => ({
+      promotionId: discount.promotionId,
+      appliesTo: discount.appliesTo,
+      amountOffMinor: discount.amountOffMinor,
+      promotionCodeId: discount.promotionCodeId ?? null,
+      promotionDefinitionFingerprint: discount.promotionDefinitionFingerprint ?? null,
+      promotionBenefitKind: discount.promotionBenefitKind ?? null,
+      promotionBenefitValueBps: discount.promotionBenefitValueBps ?? null,
+      promotionBenefitValueMinor: discount.promotionBenefitValueMinor ?? null,
+    })),
+  };
+}
+
+/** Same projection, partitioned. The union of these five sections is the whole projection. */
+export function promotionQuoteMoneySections(
+  quote: CommerceQuote,
+  acquisitionTerms?: ResolvedAcquisitionTerms,
+  shippingTerms?: ShippingTerms,
+): Record<PromotionQuoteMoneySection, unknown> {
+  const money = projectPromotionQuoteMoney(quote, acquisitionTerms, shippingTerms);
+  return {
+    lines: money.lines,
+    discounts: money.discounts,
+    shipping: {
+      shippingGross: money.shippingGross,
+      shippingDiscountGross: money.shippingDiscountGross,
+      ...(money.shippingTerms ? { shippingTerms: money.shippingTerms } : {}),
+    },
+    totals: {
+      ...acquisitionQuoteBinding(money.acquisitionTerms),
+      totalGross: money.totalGross,
+      netTotal: money.netTotal,
+      taxTotal: money.taxTotal,
+      subtotalGross: money.subtotalGross,
+      discountTotalGross: money.discountTotalGross,
+    },
+    currency: money.currency,
+  };
+}
+
+/** Key-sorted, `undefined`-dropping JSON. Every acceptance binding hashes this shape. */
+export function stableJson(value: unknown): string {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).filter(([, item]) => item !== undefined)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}

package/src/promotions/quoteAcquisitionBinding.ts

@@ -0,0 +1,7 @@
+import type { PromotionRow } from "@openlup/core/promo";
+import type { AcquisitionFinancialPolicy } from "../pricing/index.js";
+
+export interface QuoteAcquisitionBinding<Request = unknown> {
+  financialPolicy: AcquisitionFinancialPolicy<PromotionRow>;
+  capability(request: Request): unknown;
+}

package/src/promotions/quoteAutomaticPromotions.ts

@@ -0,0 +1,84 @@
+import { selectAcquisitionTerms, assertAcquisitionTermsCapability, ACQUISITION_TERMS_CAPABILITY } from "../pricing/index.js";
+import type { QuoteAcquisitionBinding } from "./quoteAcquisitionBinding.js";
+import type { CreateQuoteRequest } from "../pricing/index.js";
+import { PROMOTION_ENGINE_V2 } from "../pricing/index.js";
+import type { CreateQuoteOptions } from "../pricing/index.js";
+import type { CommercePromoDataPort } from "./promoDataPort.js";
+import type { createQuotePromoDiscounts, QuoteDiscountResult } from "./quotePromoDiscounts.js";
+import type { createQuotePromotionV2 } from "./quotePromotionV2.js";
+
+export function createQuoteAutomaticPromotions<Request extends CreateQuoteRequest & { visitorId?: string }>({ resolveEmailEligibility, evaluateOrderTotalDiscounts, evaluateAutomaticPromotionV2, legacyPromotionDataPort, acquisition }: {
+  acquisition?: QuoteAcquisitionBinding<Request>;
+  resolveEmailEligibility(request: Request): boolean;
+  evaluateOrderTotalDiscounts: ReturnType<typeof createQuotePromoDiscounts>["evaluateOrderTotalDiscounts"];
+  evaluateAutomaticPromotionV2: ReturnType<typeof createQuotePromotionV2>["evaluateAutomaticPromotionV2"];
+  legacyPromotionDataPort: ReturnType<typeof createQuotePromotionV2>["legacyPromotionDataPort"];
+}) {
+  async function resolveAutomaticQuotePromotions(input: {
+    promoDataPort?: CommercePromoDataPort;
+    request: Request;
+    options?: CreateQuoteOptions;
+    regionCode: string;
+    referenceProductMinor: number;
+    subtotalGrossMinor: number;
+    shippingGrossMinor: number;
+    atTime: string;
+  }): Promise<QuoteDiscountResult> {
+    if (!input.promoDataPort) return { discounts: [], codeRejections: [] };
+
+    let promoDataPort = input.promoDataPort;
+    let selection = null;
+    let acquisitionCapability: unknown;
+    if (acquisition) {
+      const clientId = input.options?.clientId ?? null;
+      const [paid, allRows] = await Promise.all([
+        clientId ? promoDataPort.countPaidOrdersByMode(clientId) : Promise.resolve({ oneTime: 0, subscription: 0 }),
+        promoDataPort.listActivePromotions(),
+      ]);
+      const existingSubscriber = input.request.mode === "subscription" && paid.subscription > 0;
+      const rows = existingSubscriber ? allRows.filter((row) =>
+        !acquisition.financialPolicy.facts(row).metadataPresent && row.eligibility.first_subscription_purchase !== true) : allRows;
+      promoDataPort = { ...promoDataPort, listActivePromotions: async () => rows, countPaidOrdersByMode: async () => paid };
+      selection = input.request.mode === "subscription" && !existingSubscriber
+        ? selectAcquisitionTerms(rows, input.atTime, input.regionCode, acquisition.financialPolicy) : null;
+      acquisitionCapability = acquisition.capability(input.request);
+      assertAcquisitionTermsCapability(selection, acquisitionCapability, input.options?.pricingPolicy?.promotionEngineVersion);
+    }
+    const emailEligibilityConfirmed = resolveEmailEligibility(input.request);
+    if (input.options?.pricingPolicy?.promotionEngineVersion === PROMOTION_ENGINE_V2) {
+      return evaluateAutomaticPromotionV2({
+        promoDataPort,
+        clientId: input.options.clientId ?? null,
+        visitorId: input.request.visitorId ?? null,
+        mode: input.request.mode,
+        promoCodes: input.request.promoCodes,
+        regionCode: input.regionCode,
+        referenceProductMinor: input.referenceProductMinor,
+        currentProductMinor: input.subtotalGrossMinor,
+        shippingMinor: input.shippingGrossMinor,
+        atTime: input.atTime,
+        emailEligibilityConfirmed,
+        ...(acquisition ? { acquisitionCapability } : {}),
+      });
+    }
+
+    const pending = evaluateOrderTotalDiscounts({
+      promoDataPort: legacyPromotionDataPort(promoDataPort),
+      clientId: input.options?.clientId ?? null,
+      visitorId: input.request.visitorId ?? null,
+      mode: input.request.mode,
+      promoCodes: input.request.promoCodes,
+      regionCode: input.regionCode,
+      subtotalGrossMinor: input.subtotalGrossMinor,
+      shippingGrossMinor: input.shippingGrossMinor,
+      atTime: input.atTime,
+      emailEligibilityConfirmed,
+    });
+    if (!acquisition) return pending;
+    const result = await pending;
+    return selection && acquisitionCapability === ACQUISITION_TERMS_CAPABILITY
+      ? { ...result, acquisitionTerms: selection.terms } : result;
+  }
+
+  return { resolveAutomaticQuotePromotions };
+}