@rebuy/rebuy 3.16.3 → 3.17.0

package/dist/gwp/index.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/gwp/index.ts
 var gwp_exports = {};
 __export(gwp_exports, {
+  GIFT_KINDS: () => GIFT_KINDS,
   getValidGwpProductIds: () => getValidGwpProductIds,
   hasLostDiscount: () => hasLostDiscount,
   hasUnsupportedRuleTypes: () => hasUnsupportedRuleTypes,
@@ -50,3 +51,6 @@ var isDefinitiveRuleAnswer = (metadata) => metadata != null && (metadata.matched
 // src/gwp/shouldRemoveGift.ts
 var hasLostDiscount = (gift) => !gift.discounted && gift.cost > 0;
 var shouldRemoveGift = (gift, validIds) => !validIds.has(gift.productId) || hasLostDiscount(gift);
+
+// src/gwp/types.ts
+var GIFT_KINDS = ["gwp", "sgwp"];

package/dist/gwp/index.mjs

@@ -19,7 +19,11 @@ var isDefinitiveRuleAnswer = (metadata) => metadata != null && (metadata.matched
 // src/gwp/shouldRemoveGift.ts
 var hasLostDiscount = (gift) => !gift.discounted && gift.cost > 0;
 var shouldRemoveGift = (gift, validIds) => !validIds.has(gift.productId) || hasLostDiscount(gift);
+
+// src/gwp/types.ts
+var GIFT_KINDS = ["gwp", "sgwp"];
 export {
+  GIFT_KINDS,
   getValidGwpProductIds,
   hasLostDiscount,
   hasUnsupportedRuleTypes,

package/dist/gwp/types.d.ts

@@ -1,17 +1,39 @@
-/** A gift-with-purchase cart line the client asks the server to validate. */
+/**
+ * The attribution a gift line carries, as the wire tags it: `gwp` = `Rebuy Gift with Purchase`, `sgwp` =
+ * `Rebuy Selectable Gift with Purchase`. `gwp` lines run the GWP rules; `sgwp` lines are judged against their
+ * widget's milestones (REB-24363).
+ */
+export declare const GIFT_KINDS: readonly ["gwp", "sgwp"];
+export type GiftKind = (typeof GIFT_KINDS)[number];
+/**
+ * A gift cart line the client asks the server to validate (GWP or selectable GWP — see {@link GiftKind}).
+ * This is the WIRE shape — what a client sends, `z.input` of the server's `GiftInputSchema` — so the two
+ * REB-24363 fields are optional here: a client that predates them sends GWP lines only, and the schema
+ * defaults fill them (`kind: 'gwp'`, `quantity: 1`) before the server reads either. The parsed twin
+ * (`GiftInput`, `./server`) carries both as required.
+ */
 export type GwpGift = {
     /**
-     * The gift line's total in the buyer's MARKET currency, MAJOR units (e.g. `19.99`) — a
-     * Function-discounted (free) gift is `0`. Only the zero/non-zero distinction is read
-     * (`cost > 0` ⇒ the gift lost its discount), so the exact unit isn't load-bearing; send the
-     * Shopify cart-line total as-is.
+     * The gift line's total in the buyer's MARKET (presentment) currency, MAJOR units (e.g. `19.99`) — a
+     * Function-discounted (free) gift is `0`. Send the Shopify cart-line total as-is; both the unit and the
+     * magnitude are contractual. A `gwp` line only has its zero/non-zero read (`cost > 0` ⇒ the gift lost
+     * its discount), but an `sgwp` line's cost is subtracted from the subtotal its milestones are judged
+     * against (×100, ÷ the FX rate), so a minor-unit or unit-price value there would over-subtract and
+     * silently strip earned gifts (REB-24363).
      */
     cost: number;
     /** Whether the Shopify Function discount is currently allocated to the line. */
     discounted: boolean;
+    /** Which attribution the line carries; omitted by clients that predate the field (reads as `gwp`). */
+    kind?: GiftKind;
     /** Shopify cart-line id to remove. */
     lineId: string;
     productId: number;
+    /**
+     * The line's unit count; the selectable-GWP verdict trims surplus units against milestone capacity.
+     * Omitted by clients that predate the field (reads as one unit — a GWP verdict is whole-line anyway).
+     */
+    quantity?: number;
     /** The Rebuy widget that added the gift (`_widget_id`). */
     widgetId: number;
 };

package/dist/server/giftValidation.d.ts

@@ -1,22 +1,20 @@
-import { type GiftValidationInput, type ServerContext } from '../server/shared';
+import { type GiftValidationInput, type GiftValidationResponse, type ServerContext } from '../server/shared';
 /**
- * Validates gift lines per widget and returns the cart-line ids to remove (the complete receipt).
- * Per widget: resolve its data-source path, evaluate its rules against the cart (`limit: 0`), then
- * drop gifts that no longer qualify OR lost their discount.
+ * Validates the gift lines and returns the receipt. The two gift kinds get independent verdicts, each
+ * filling its own list — so a line id can never land in both: GWP (`gwp`) lines are judged whole-line by
+ * their widget's rules and fill `remove` ({@link validateGwpGifts}); selectable GWP (`sgwp`) lines are
+ * trimmed to their widget's milestone capacity and fill `adjust` (target quantity, `0` = remove —
+ * {@link validateSelectableGifts}). A selectable gift may be legitimately priced, so the GWP charged-gift
+ * rule never touches it. Both halves fail safe per widget, so a degraded answer for one widget never
+ * disturbs another's verdict.
  *
- * The two removal reasons are NOT symmetric. **Qualification loss** (a gift's product no longer matches
- * the rules) needs the engine's answer, so it is **fail-safe**: any error, a missing endpoint, a
- * non-definitive rule answer (no metadata, or metadata with neither rule array — the tolerated-empty-2xx
- * path), or unsupported rule types (`url`/`order_tag`) → don't drop on qualification (never remove a
- * genuinely-qualified gift on uncertainty). A definitive answer removes a gift its matched-rule product
- * output omits; when that output yields NO ids at all, only a confirmed miss ({@link isConfirmedRuleMiss}:
- * `unmatchedRules` populated, `matchedRules` empty) removes — a matched rule with a non-product output
- * (collection/endpoint/tag) or a zero-rule ruleset proves nothing, so those keep the gifts (REB-23842,
- * matching the React extension). **Discount loss** ({@link hasLostDiscount}: `!discounted && cost > 0`) is cart-observable
- * and needs NO engine answer, so it removes the gift on EVERY path, degraded or not — a buyer must not keep
- * paying for a "gift" because the rule engine was degraded. (React removed on any successful fetch; this
- * splits the observable discount-loss out of the qualification fail-safe rather than gating both behind it.)
+ * The receipt's one-verdict-per-line invariant (`GiftValidationResponseSchema`) is upheld HERE, not by the
+ * client: nothing stops a buggy watcher sending one `lineId` twice — under both kinds (a line carrying
+ * both attributions, or a double push), or as `sgwp` under two widgets — which would otherwise land it in
+ * both lists, or twice in `adjust` with conflicting targets, and fail the response schema at the route — a
+ * 500 where the feature promises fail-safe. The strictest verdict wins: removal over any target (a removed
+ * line has no quantity left), and the smallest target among duplicates (each is a trim, so the smallest can
+ * never exceed what was sent). `remove` is likewise named once per line (a `gwp` line sent under two
+ * widgets is removed by both legs), so a client issuing one cart mutation per entry never removes twice.
  */
-export declare const validateGifts: (input: GiftValidationInput, ctx: ServerContext) => Promise<{
-    remove: string[];
-}>;
+export declare const validateGifts: (input: GiftValidationInput, ctx: ServerContext) => Promise<GiftValidationResponse>;

package/dist/server/giftWidgets.d.ts

@@ -0,0 +1,37 @@
+import { z } from 'zod';
+import { type GiftKind } from '../gwp';
+import { type GiftInput, type Reporter, type ServerContext } from '../server/shared';
+/**
+ * One selectable-GWP milestone, RAW (snake_case) as the retired React validator read it: `unlock_price` in
+ * shop MAJOR units, `selectable_product_quantity` in units (a non-negative whole count — a fractional or
+ * negative capacity is nonsense, so it is malformed rather than summed).
+ *
+ * `unlock_price` is deliberately NOT bounded below. A negative or zero price is a legitimate "always
+ * unlocked" tier (the progress-bar converter tolerates the same via `Number(...) || 0`), and it only
+ * grants ITS OWN capacity. Rejecting it would mark the whole list malformed, which keeps every gift the
+ * widget added — unlimited capacity, a strictly worse degradation than the one avoided.
+ */
+export declare const SgwpMilestoneSchema: z.ZodObject<{
+    selectable_product_quantity: z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>, z.ZodCoercedNumber<string | number>>, z.ZodNumber>;
+    unlock_price: z.ZodPipe<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>, z.ZodCoercedNumber<string | number>>;
+}, z.core.$strip>;
+/** One parsed selectable-GWP milestone: the shop-major-unit unlock price and the gift units it grants. */
+export type SgwpMilestone = z.infer<typeof SgwpMilestoneSchema>;
+/**
+ * One gift widget's raw settings from the engine (the `data` envelope unwrapped, so a deleted widget's
+ * `{ data: null }` reads as `null`). Throws on an upstream failure — every caller fails safe (keeps the
+ * widget's gifts), so the throw is the signal, not a bug.
+ */
+export declare const fetchGiftWidgetSettings: (widgetId: number, shop: string, ctx: ServerContext) => Promise<unknown>;
+/** A GWP widget's data-source path from its raw settings `endpoint` (uniform across widget types). */
+export declare const readDataSourcePath: (settings: unknown) => string | undefined;
+/**
+ * A selectable-GWP widget's milestones from its raw settings. Absent or empty milestones are an empty list
+ * (the widget has nothing to judge against — silent). A MALFORMED list also reads as empty, because the
+ * fail-safe direction is to keep the gifts, but that is a settings-contract drift, so it is reported — with
+ * the first issue's path AND message, since the likeliest real drift (`milestones` is an object, not an
+ * array) fails at the top level, where the path is empty and only the message says what arrived.
+ */
+export declare const readMilestones: (settings: unknown, report?: Reporter) => SgwpMilestone[];
+/** The gifts of one `kind`, grouped by widget in request order (insertion-ordered map; lines keep their order within a widget). */
+export declare const groupGiftsByWidget: (gifts: GiftInput[], kind: GiftKind) => Map<number, GiftInput[]>;

package/dist/server/index.cjs

@@ -25,8 +25,10 @@ __export(server_exports, {
   CartInputSchema: () => CartInputSchema,
   CartLineInputSchema: () => CartLineInputSchema,
   DataSourceInputSchema: () => DataSourceInputSchema,
+  GiftAdjustmentSchema: () => GiftAdjustmentSchema,
   GiftInputSchema: () => GiftInputSchema,
   GiftValidationInputSchema: () => GiftValidationInputSchema,
+  GiftValidationResponseSchema: () => GiftValidationResponseSchema,
   MonetizeInputSchema: () => MonetizeInputSchema,
   MonetizeTransactionItemSchema: () => MonetizeTransactionItemSchema,
   NotFoundError: () => NotFoundError,
@@ -71,6 +73,9 @@ var isDefinitiveRuleAnswer = (metadata) => metadata != null && (metadata.matched
 var hasLostDiscount = (gift) => !gift.discounted && gift.cost > 0;
 var shouldRemoveGift = (gift, validIds) => !validIds.has(gift.productId) || hasLostDiscount(gift);
 
+// src/gwp/types.ts
+var GIFT_KINDS = ["gwp", "sgwp"];
+
 // src/schema/metadata.ts
 var import_zod2 = require("zod");
 
@@ -430,6 +435,14 @@ var NotFoundError = class extends Error {
   }
 };
 
+// src/server/shopSubtotal.ts
+var shopCurrencyRate = (cart) => {
+  const rate = cart.currencyRate ?? 1;
+  return Number.isFinite(rate) && rate > 0 ? rate : 1;
+};
+var shopSubtotalCents = (cart) => Math.round((cart.subtotal - (cart.discountTotal ?? 0)) / shopCurrencyRate(cart));
+var toShopCents = (majorPresentment, rate) => Math.round(majorPresentment * 100 / rate);
+
 // src/schema/cabShopConfig.ts
 var import_zod6 = require("zod");
 
@@ -3923,9 +3936,7 @@ var buildEngineParams = (input, key) => {
     variant_id: variantId
   }));
   const itemCount = cart.items.reduce((total, { quantity }) => total + quantity, 0);
-  const currencyRate = cart.currencyRate ?? 1;
-  const rate = Number.isFinite(currencyRate) && currencyRate > 0 ? currencyRate : 1;
-  const subtotal = Math.round((cart.subtotal - (cart.discountTotal ?? 0)) / rate);
+  const subtotal = shopSubtotalCents(cart);
   return {
     cart: {
       attributes: encodeAttributes(cart.attributes),
@@ -4398,26 +4409,92 @@ var convertWidgetSettings = async (input, ctx) => {
   return experiment && isCABTree(result) ? { ...result, experiment } : result;
 };
 
-// src/server/giftValidation.ts
-var resolveDataSourcePath = async (widgetId, shop, ctx) => {
-  const raw = await ctx.fetchUpstream("/api/v1/widgets/settings", { id: String(widgetId), shop }, { host: ctx.host });
-  const data = raw && typeof raw === "object" && "data" in raw ? raw.data : raw;
-  const endpoint = deepCamelCase(data)?.endpoint;
+// src/server/giftWidgets.ts
+var import_zod29 = require("zod");
+var SettingsNumber = import_zod29.z.union([
+  import_zod29.z.number(),
+  import_zod29.z.string().trim().regex(/^-?\d+(\.\d+)?$/)
+]).pipe(import_zod29.z.coerce.number());
+var SgwpMilestoneSchema = import_zod29.z.object({
+  selectable_product_quantity: SettingsNumber.pipe(import_zod29.z.number().int().nonnegative()),
+  unlock_price: SettingsNumber
+});
+var fetchGiftWidgetSettings = async (widgetId, shop, ctx) => unwrapData(await ctx.fetchUpstream("/api/v1/widgets/settings", { id: String(widgetId), shop }, { host: ctx.host }));
+var readDataSourcePath = (settings) => {
+  const endpoint = deepCamelCase(settings)?.endpoint;
   return typeof endpoint === "string" && endpoint ? endpoint : void 0;
 };
-var groupByWidget = (gifts) => {
+var readMilestones = (settings, report) => {
+  const raw = settings && typeof settings === "object" ? settings.milestones : void 0;
+  if (raw == null) return [];
+  const parsed = import_zod29.z.array(SgwpMilestoneSchema).safeParse(raw);
+  if (parsed.success) return parsed.data;
+  report?.({
+    detail: [
+      "selectable-gift milestones unreadable",
+      ...parsed.error.issues.slice(0, 1).map((issue) => [issue.path.join("."), issue.message].filter(Boolean).join(": "))
+    ].join(": "),
+    kind: "giftMilestones"
+  });
+  return [];
+};
+var groupGiftsByWidget = (gifts, kind) => {
   const byWidget = /* @__PURE__ */ new Map();
   for (const gift of gifts) {
+    if (gift.kind !== kind) continue;
     byWidget.set(gift.widgetId, [...byWidget.get(gift.widgetId) ?? [], gift]);
   }
   return byWidget;
 };
-var validateGifts = async (input, ctx) => {
+
+// src/server/sgwpCapacity.ts
+var sgwpQualifyingSubtotalCents = (cart, gifts) => {
+  const giftMajor = gifts.filter((gift) => gift.kind === "sgwp").reduce((total, gift) => total + gift.cost, 0);
+  return shopSubtotalCents(cart) - toShopCents(giftMajor, shopCurrencyRate(cart));
+};
+var unlockedCapacity = (milestones, subtotalCents) => milestones.reduce(
+  (capacity, milestone) => Math.round(milestone.unlock_price * 100) <= subtotalCents ? capacity + milestone.selectable_product_quantity : capacity,
+  0
+);
+
+// src/server/sgwpValidation.ts
+var computeSgwpAdjustments = (gifts, capacity) => {
+  let surplus = gifts.reduce((units, gift) => units + gift.quantity, 0) - capacity;
+  const adjust = [];
+  for (const gift of gifts) {
+    if (surplus <= 0) break;
+    const trimmed = Math.min(gift.quantity, surplus);
+    adjust.push({ lineId: gift.lineId, quantity: gift.quantity - trimmed });
+    surplus -= trimmed;
+  }
+  return adjust;
+};
+var validateSelectableGifts = async (input, ctx) => {
+  const byWidget = groupGiftsByWidget(input.gifts, "sgwp");
+  if (byWidget.size === 0) return [];
+  const subtotalCents = sgwpQualifyingSubtotalCents(input.cart, input.gifts);
   const perWidget = await Promise.all(
-    [...groupByWidget(input.gifts)].map(async ([widgetId, gifts]) => {
+    [...byWidget].map(async ([widgetId, gifts]) => {
+      try {
+        const settings = await fetchGiftWidgetSettings(widgetId, input.shop, ctx);
+        const milestones = readMilestones(settings, ctx.reportDrift);
+        if (milestones.length === 0) return [];
+        return computeSgwpAdjustments(gifts, unlockedCapacity(milestones, subtotalCents));
+      } catch {
+        return [];
+      }
+    })
+  );
+  return perWidget.flat();
+};
+
+// src/server/giftValidation.ts
+var validateGwpGifts = async (input, ctx) => {
+  const perWidget = await Promise.all(
+    [...groupGiftsByWidget(input.gifts, "gwp")].map(async ([widgetId, gifts]) => {
       const discountLost = gifts.filter(hasLostDiscount).map((gift) => gift.lineId);
       try {
-        const dataSourcePath = await resolveDataSourcePath(widgetId, input.shop, ctx);
+        const dataSourcePath = readDataSourcePath(await fetchGiftWidgetSettings(widgetId, input.shop, ctx));
         if (!dataSourcePath) return discountLost;
         const { metadata } = await fetchDataSourceResults(
           {
@@ -4450,7 +4527,17 @@ var validateGifts = async (input, ctx) => {
       }
     })
   );
-  return { remove: perWidget.flat() };
+  return perWidget.flat();
+};
+var validateGifts = async (input, ctx) => {
+  const [remove, adjust] = await Promise.all([validateGwpGifts(input, ctx), validateSelectableGifts(input, ctx)]);
+  const removed = new Set(remove);
+  const targets = /* @__PURE__ */ new Map();
+  for (const { lineId, quantity } of adjust) {
+    if (removed.has(lineId)) continue;
+    targets.set(lineId, Math.min(quantity, targets.get(lineId) ?? quantity));
+  }
+  return { adjust: [...targets].map(([lineId, quantity]) => ({ lineId, quantity })), remove: [...removed] };
 };
 
 // src/server/analytics.ts
@@ -4572,7 +4659,7 @@ var postAnalyticsEvents = async (input, ctx) => {
 };
 
 // src/server/requestSchemas.ts
-var import_zod29 = require("zod");
+var import_zod30 = require("zod");
 var REQUEST_BOUNDS = {
   /** Cart-level attributes per cart. */
   CART_ATTRIBUTES_MAX: 100,
@@ -4603,42 +4690,42 @@ var REQUEST_BOUNDS = {
   /** Rich ads transaction lines — the engine's ads contract. */
   TRANSACTION_ITEMS_MAX: 50
 };
-var KeyValue = import_zod29.z.object({
-  key: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX),
-  value: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_VALUE_MAX).optional()
+var KeyValue = import_zod30.z.object({
+  key: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX),
+  value: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_VALUE_MAX).optional()
 });
-var CartLineInputSchema = import_zod29.z.object({
-  productId: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
-  properties: import_zod29.z.array(KeyValue).max(REQUEST_BOUNDS.LINE_PROPERTIES_MAX).optional(),
-  quantity: import_zod29.z.number(),
-  subscriptionId: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
-  variantId: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX)
+var CartLineInputSchema = import_zod30.z.object({
+  productId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
+  properties: import_zod30.z.array(KeyValue).max(REQUEST_BOUNDS.LINE_PROPERTIES_MAX).optional(),
+  quantity: import_zod30.z.number(),
+  subscriptionId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  variantId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX)
 });
-var CartInputSchema = import_zod29.z.object({
-  attributes: import_zod29.z.array(KeyValue).max(REQUEST_BOUNDS.CART_ATTRIBUTES_MAX).optional(),
+var CartInputSchema = import_zod30.z.object({
+  attributes: import_zod30.z.array(KeyValue).max(REQUEST_BOUNDS.CART_ATTRIBUTES_MAX).optional(),
   /**
    * Presentment-per-shop-currency FX rate (buyer price ÷ shop price, e.g. `1.35` for a USD shop
    * selling in CAD). Money rule thresholds are authored in SHOP currency, so the engine subtotal is
    * divided by this before evaluation. Omit (or send 1) when the cart is already in the shop's currency.
    */
-  currencyRate: import_zod29.z.number().optional(),
+  currencyRate: import_zod30.z.number().optional(),
   /** Applied discount codes; the engine evaluates `discount_code` rules against them (sent as `[{code}]`). */
-  discountCodes: import_zod29.z.array(import_zod29.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX)).max(REQUEST_BOUNDS.DISCOUNT_CODES_MAX).optional(),
+  discountCodes: import_zod30.z.array(import_zod30.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX)).max(REQUEST_BOUNDS.DISCOUNT_CODES_MAX).optional(),
   /** Presentment cents of cart-level discount allocations, subtracted from `subtotal` for the engine. */
-  discountTotal: import_zod29.z.number().optional(),
-  items: import_zod29.z.array(CartLineInputSchema).max(REQUEST_BOUNDS.CART_ITEMS_MAX),
+  discountTotal: import_zod30.z.number().optional(),
+  items: import_zod30.z.array(CartLineInputSchema).max(REQUEST_BOUNDS.CART_ITEMS_MAX),
   /** Presentment subtotal in cents. */
-  subtotal: import_zod29.z.number()
+  subtotal: import_zod30.z.number()
 });
-var UserConfigInputSchema = import_zod29.z.object({ shop: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX) });
-var DataSourceInputSchema = import_zod29.z.object({
+var UserConfigInputSchema = import_zod30.z.object({ shop: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX) });
+var DataSourceInputSchema = import_zod30.z.object({
   cart: CartInputSchema,
   /**
    * Numeric Shopify company-location id when the buyer is a B2B session (`buyerIdentity.purchasingCompany`).
    * Present ⇒ the orchestrator filters results by the location's catalog via admin-api (REB-23713); the
    * client's country-context market check is bypassed for B2B (it false-negatives B2B-catalog products).
    */
-  companyLocationId: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  companyLocationId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
   /**
    * Buyer's market country (ISO 3166-1 alpha-2) — forwarded to the engine as the `country_code` PARAM
    * when the shop's markets toggle is on (REB-21688; the sink was the `X-Country-Code` header under
@@ -4647,16 +4734,16 @@ var DataSourceInputSchema = import_zod29.z.object({
    * uppercase (the wire value is forwarded verbatim as the param) so a case-sensitive engine lookup
    * can't silently miss a lowercase code — `adsEngine.ts` uppercases for the same reason.
    */
-  country: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).regex(/^[A-Za-z]{2}$/, "must be an ISO 3166-1 alpha-2 country code (e.g. CA)").transform((value) => value.toUpperCase()).optional(),
-  customerId: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
-  dataSourcePath: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX),
+  country: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).regex(/^[A-Za-z]{2}$/, "must be an ISO 3166-1 alpha-2 country code (e.g. CA)").transform((value) => value.toUpperCase()).optional(),
+  customerId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  dataSourcePath: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX),
   /**
    * Engine `filter_inputs` override: `'no'` keeps in-cart (input) products in the results/rule
    * outputs — gift validation sends it so a gift's own product can appear in its answer. Omitted = the
    * engine's default filtering.
    */
-  filterInputs: import_zod29.z.enum(["no", "yes"]).optional(),
-  integrations: import_zod29.z.record(import_zod29.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX), import_zod29.z.boolean()).refine((record) => Object.keys(record).length <= REQUEST_BOUNDS.INTEGRATION_KEYS_MAX, {
+  filterInputs: import_zod30.z.enum(["no", "yes"]).optional(),
+  integrations: import_zod30.z.record(import_zod30.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX), import_zod30.z.boolean()).refine((record) => Object.keys(record).length <= REQUEST_BOUNDS.INTEGRATION_KEYS_MAX, {
     message: `Too many integration keys (max ${REQUEST_BOUNDS.INTEGRATION_KEYS_MAX})`
   }).optional(),
   /**
@@ -4669,20 +4756,31 @@ var DataSourceInputSchema = import_zod29.z.object({
    * request header) fails the regex. Callers should send the buyer's resolved locale (e.g. Shopify
    * checkout's `localization.language.isoCode`), not the request header verbatim.
    */
-  language: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).regex(/^[A-Za-z0-9-]+$/, "must be a single BCP-47 tag (e.g. fr-CA), not a q-value list").optional(),
-  limit: import_zod29.z.number().max(REQUEST_BOUNDS.LIMIT_MAX),
-  productType: import_zod29.z.enum(["both", "one-time", "subscription"]).optional(),
-  shop: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
-  visitorId: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
+  language: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).regex(/^[A-Za-z0-9-]+$/, "must be a single BCP-47 tag (e.g. fr-CA), not a q-value list").optional(),
+  limit: import_zod30.z.number().max(REQUEST_BOUNDS.LIMIT_MAX),
+  productType: import_zod30.z.enum(["both", "one-time", "subscription"]).optional(),
+  shop: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
+  visitorId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
 });
-var GiftInputSchema = import_zod29.z.object({
-  cost: import_zod29.z.number(),
-  discounted: import_zod29.z.boolean(),
-  lineId: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
-  productId: import_zod29.z.number(),
-  widgetId: import_zod29.z.number()
+var GiftInputSchema = import_zod30.z.object({
+  cost: import_zod30.z.number(),
+  discounted: import_zod30.z.boolean(),
+  /**
+   * Which gift attribution the line carries (REB-24363). Defaults to `gwp` because a client that predates
+   * the field only ever sent GWP lines — without the default an older extension's request would 422.
+   */
+  kind: import_zod30.z.enum(GIFT_KINDS).default("gwp"),
+  lineId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
+  productId: import_zod30.z.number(),
+  /**
+   * The line's unit count (REB-24363) — the selectable-GWP verdict trims surplus units against milestone
+   * capacity. The second deliberate default: a client predating the field sent only GWP lines, whose
+   * verdict is whole-line, so a missing quantity reads as one unit rather than 422ing the older request.
+   */
+  quantity: import_zod30.z.number().int().min(1).default(1),
+  widgetId: import_zod30.z.number()
 });
-var GiftValidationInputSchema = import_zod29.z.object({
+var GiftValidationInputSchema = import_zod30.z.object({
   cart: CartInputSchema,
   /**
    * Buyer's market country — threaded into the per-widget data-source evaluations, which forward it to
@@ -4691,59 +4789,76 @@ var GiftValidationInputSchema = import_zod29.z.object({
    * turns markets off); regex-bound and uppercase-normalized for the same reasons as
    * `DataSourceInputSchema`'s `country`.
    */
-  country: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).regex(/^[A-Za-z]{2}$/, "must be an ISO 3166-1 alpha-2 country code (e.g. CA)").transform((value) => value.toUpperCase()).optional(),
-  customerId: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
-  gifts: import_zod29.z.array(GiftInputSchema).max(REQUEST_BOUNDS.GIFTS_MAX),
+  country: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).regex(/^[A-Za-z]{2}$/, "must be an ISO 3166-1 alpha-2 country code (e.g. CA)").transform((value) => value.toUpperCase()).optional(),
+  customerId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  gifts: import_zod30.z.array(GiftInputSchema).max(REQUEST_BOUNDS.GIFTS_MAX),
   /**
    * Buyer's checkout language — threaded into the per-widget data-source evaluations, which normalize
    * and forward it as the engine `locale` param under the same markets-toggle gate (REB-21688). MUST be
    * a single BCP-47 tag, for the same reason as `DataSourceInputSchema`'s `language` above.
    */
-  language: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).regex(/^[A-Za-z0-9-]+$/, "must be a single BCP-47 tag (e.g. fr-CA), not a q-value list").optional(),
-  shop: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
-  visitorId: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
+  language: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).regex(/^[A-Za-z0-9-]+$/, "must be a single BCP-47 tag (e.g. fr-CA), not a q-value list").optional(),
+  shop: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
+  visitorId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
+});
+var GiftAdjustmentSchema = import_zod30.z.object({
+  lineId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
+  quantity: import_zod30.z.number().int().nonnegative()
 });
-var MonetizeTransactionItemSchema = import_zod29.z.object({
-  id: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
-  priceCents: import_zod29.z.number(),
-  quantity: import_zod29.z.number(),
-  title: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX),
-  type: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX)
+var GiftValidationResponseSchema = import_zod30.z.object({
+  adjust: import_zod30.z.array(GiftAdjustmentSchema).max(REQUEST_BOUNDS.GIFTS_MAX).default([]),
+  remove: import_zod30.z.array(import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX)).max(REQUEST_BOUNDS.GIFTS_MAX).refine(
+    (remove) => new Set(remove).size === remove.length,
+    "a line id may appear at most once in `remove`"
+  )
+}).refine(
+  ({ adjust, remove }) => !adjust.some(({ lineId }) => remove.includes(lineId)),
+  "a line id may not appear in both `remove` and `adjust`"
+).refine(
+  ({ adjust }) => new Set(adjust.map(({ lineId }) => lineId)).size === adjust.length,
+  "a line id may appear at most once in `adjust`"
+);
+var MonetizeTransactionItemSchema = import_zod30.z.object({
+  id: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
+  priceCents: import_zod30.z.number(),
+  quantity: import_zod30.z.number(),
+  title: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX),
+  type: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX)
 });
-var MonetizeInputSchema = import_zod29.z.object({
+var MonetizeInputSchema = import_zod30.z.object({
   cart: CartInputSchema,
   /** Client-minted render-beacon correlation id; forwarded to the ads engine as `client_request_id`. */
-  clientRequestId: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
-  country: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
-  currency: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  clientRequestId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  country: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  currency: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
   /** Ads-targeting identity/geo/locale fields (React parity); folded into the engine query verbatim. */
-  customerEmail: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX).optional(),
-  customerFirstName: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX).optional(),
-  customerId: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
-  customerLastName: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX).optional(),
-  language: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  customerEmail: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX).optional(),
+  customerFirstName: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX).optional(),
+  customerId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  customerLastName: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX).optional(),
+  language: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
   /** Buyer-facing order name (e.g. `#1001`) for the server-composed "Order … Confirmed" chrome line. */
-  orderName: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX).optional(),
+  orderName: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_TEXT_MAX).optional(),
   /** Ads surface label, forwarded verbatim; `customer_account` is measured/floored as its own surface (the account-area order list). */
-  placement: import_zod29.z.enum(["customer_account", "order_status", "thank_you_page"]),
+  placement: import_zod30.z.enum(["customer_account", "order_status", "thank_you_page"]),
   /** Privacy Policy footer href — the Monetize widget's `privacy_policy_url` setting (React parity). */
-  privacyPolicyUrl: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_URL_MAX).optional(),
+  privacyPolicyUrl: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_URL_MAX).optional(),
   /** 30-min rolling session id (React parity); used for the ads `session_id`, else the visitor id. */
-  sessionId: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
-  shop: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
+  sessionId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  shop: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
   /** Editor/QA indicator; OR-ed into the ads-engine `testing` flag so it stays out of billing/reporting. */
-  testing: import_zod29.z.boolean().optional(),
-  timezone: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  testing: import_zod30.z.boolean().optional(),
+  timezone: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
   /** Decorated (numeric) order id → the ads `transaction_id`. */
-  transactionId: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  transactionId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
   /** Rich per-line ads items; capped at the engine's ads contract. Preferred over `cart.items`. */
-  transactionItems: import_zod29.z.array(MonetizeTransactionItemSchema).max(REQUEST_BOUNDS.TRANSACTION_ITEMS_MAX).optional(),
+  transactionItems: import_zod30.z.array(MonetizeTransactionItemSchema).max(REQUEST_BOUNDS.TRANSACTION_ITEMS_MAX).optional(),
   /** Order total in presentment cents (React prefers total over subtotal); else `cart.subtotal`. */
-  transactionTotal: import_zod29.z.number().optional(),
-  visitorId: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
-  zipCode: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
+  transactionTotal: import_zod30.z.number().optional(),
+  visitorId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  zipCode: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
 });
-var WidgetSettingsInputSchema = import_zod29.z.object({
+var WidgetSettingsInputSchema = import_zod30.z.object({
   /**
    * Same domain as `CabShopConfig.cacheKey`, for the same reason: this side WINS the orchestrator's
    * `input.cacheKey ?? config.shop.cacheKey` (and an explicit value skips the config read entirely), so
@@ -4751,9 +4866,9 @@ var WidgetSettingsInputSchema = import_zod29.z.object({
    * and pin the edge copy permanently stale. `.catch(undefined)` because a bogus buster should degrade
    * the read to un-busted, never 400 a widget render.
    */
-  cacheKey: import_zod29.z.number().int().positive().optional().catch(void 0),
-  id: import_zod29.z.number(),
-  key: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  cacheKey: import_zod30.z.number().int().positive().optional().catch(void 0),
+  id: import_zod30.z.number(),
+  key: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
   /**
    * Monetize context for inline hydration: when present AND the widget converts to a Monetize marker,
    * the server fetches/composes the offer cards inside this same request (no second `/cab/monetize`
@@ -4762,23 +4877,23 @@ var WidgetSettingsInputSchema = import_zod29.z.object({
    * `privacyPolicyUrl` comes from the widget settings server-side (more authoritative than a relay).
    */
   monetize: MonetizeInputSchema.omit({ privacyPolicyUrl: true, shop: true }).optional(),
-  shop: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
+  shop: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
   /** Stable per-buyer id; when present, enables sticky server-side A/B variant selection. */
-  visitorId: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
+  visitorId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
 });
-var AnalyticsEventInputSchema = import_zod29.z.object({
-  name: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX),
-  properties: import_zod29.z.record(import_zod29.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX), import_zod29.z.unknown()).optional(),
-  sentAt: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
+var AnalyticsEventInputSchema = import_zod30.z.object({
+  name: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX),
+  properties: import_zod30.z.record(import_zod30.z.string().max(REQUEST_BOUNDS.STRING_KEY_MAX), import_zod30.z.unknown()).optional(),
+  sentAt: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
 });
-var AnalyticsInputSchema = import_zod29.z.object({
+var AnalyticsInputSchema = import_zod30.z.object({
   /** Rebuy cart token (the `r_cart_token` cart attribute), when available — primary aggregation key. */
-  cartToken: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  cartToken: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
   /** Shopify checkout token, when available — drives cart/checkout aggregation downstream. */
-  checkoutToken: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
-  events: import_zod29.z.array(AnalyticsEventInputSchema).max(REQUEST_BOUNDS.EVENTS_MAX),
-  shop: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
-  visitorId: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
+  checkoutToken: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional(),
+  events: import_zod30.z.array(AnalyticsEventInputSchema).max(REQUEST_BOUNDS.EVENTS_MAX),
+  shop: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
+  visitorId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX),
   /** The widget id (smartBlockId) the events belong to. */
-  widgetId: import_zod29.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
+  widgetId: import_zod30.z.string().max(REQUEST_BOUNDS.STRING_ID_MAX).optional()
 });