@sonatel-os/strapi-plugin-tcg 0.2.0 → 0.3.0

package/README.md

@@ -16,7 +16,7 @@ It was built to move **Jambaar** (the Dakar 2026 Youth Olympics card game) off i
 | **Live**          | **Boosts**: multiply the odds of any rarity for a time window, season-wide or on one pack; presets like "Golden hour". Open/sold-out drops, rewards running low.                                                                                                                  | `GET /live`                                                                                                                |
 | **Pulls**         | Dashboard rarity split vs target, audit log with seed, roll, **odds snapshot**, **pity** flag and **mint number**.                                                                                                                                                                | `POST /pulls/scan`, `GET /pulls/history`, `GET /pulls/cooldowns`                                                           |
 | **Collection**    | Per-player view with completion, rank, sets, badges, mint numbers.                                                                                                                                                                                                                | `GET /collection`, `GET /collection/stats`                                                                                 |
-| **Trades**        | Counts on the dashboard.                                                                                                                                                                                                                                                          | `POST /trades/offer`, `POST /trades/scan`, `…/accept`, `…/reject`, `…/cancel`, `GET /trades/active`, `GET /trades/history` |
+| **Trades**        | A handshake both players confirm: the initiator's offer (QR) → a receiver joins → proposes cards → the initiator confirms (atomic swap) or declines. Both screens poll `GET /trades/offer/:id` (`status`, `role`, both sides' cards). Counts on the dashboard.                                                                                                                                                                                                                                                          | `POST /trades/offer`, `POST /trades/scan`, `GET …/offer/:id`, `…/join`, `…/propose`, `…/confirm`, `…/decline`, `…/reject`, `…/cancel`, `GET /trades/active`, `GET /trades/history` |
 | **Rewards**       | **Catalog** with tiers, stock, per-player limit, booth, availability window and a **cost builder**: N cards of a rarity (or at least a rarity), a specific card, a complete set (owned or handed in).                                                                             | `GET /rewards`, `GET /rewards/eligibility`                                                                                 |
 | **Booth**         | Type or scan a redemption code, see the cards and the reward, hand it over or cancel and give the cards back (stock released).                                                                                                                                                    | `POST /redemptions`, `GET /redemptions/:id`, `GET /redemptions/history`                                                    |
 | **Sets & badges** | **Sets** are collection goals and reward costs. **Badges** are achievements with rules (pulls, rarity pulls, packs visited, streak, completion, mint ≤ N, scanned a drop, set complete…), secret or visible; nine starters seeded per season.                                     | `GET /sets`, `GET /badges`                                                                                                 |
@@ -104,7 +104,7 @@ Clients branch on `code` (see `server/src/constants.js`), never on the French me
 
 Pulls are deterministic and auditable: `sha256(player:pack:pullNumber:timestamp)` seeds a Mulberry32 PRNG; the first roll picks the rarity from the season's cumulative table, the second picks a card by weight inside that rarity (falling back to the whole pool). Seed, roll, rarity and a verification hash are stored on every pull, and the Audit screen shows them. The Simulate tab runs the same engine 2 000 times against a pack without writing anything.
 
-QR tokens are HMAC-signed (`p.<pack>.<nonce>.<exp>.<sig>` / `t.<offer>.<player>.<nonce>.<exp>.<sig>`), expire, and are single-use: consumed nonces are written to `tcg_nonces` so replay protection works across restarts and pods. Expired nonces and trade offers are swept every minute.
+QR tokens are HMAC-signed. A **static** drop code (`s.<drop>.<sig>`, the printed poster) never expires and is bounded per player by the drop's cooldown and caps. A **rotating** drop code (`d.<drop>.<nonce>.<exp>.<sig>`, the booth screen) is valid until it rotates and every player may scan it **once** — the ledger key is nonce + player, so a crowd around one screen all get their card; the cooldown is the player's, not the code's. Trade tokens burn their nonce globally. Consumed nonces live in `tcg_nonces` so replay protection works across restarts and pods; expired nonces and trade offers are swept every minute. A drop can hand out several cards per scan (`cardsPerPull`, 1–10): one scan counts once against the cooldown and the daily limits, every card is minted and recorded (`isExtra` on the extra pulls), and the response carries `cards[]` next to the first `card`.
 
 ## Permissions
 

package/dist/_chunks/{App-DvvgeCGs.js → App-B-WZGNkc.js}

@@ -7,9 +7,9 @@ const admin = require("@strapi/strapi/admin");
 const reactRouterDom = require("react-router-dom");
 const reactIntl = require("react-intl");
 const styledComponents = require("styled-components");
-const api = require("./api-Aney2S9e.js");
+const api = require("./api-hTExOv_J.js");
 const react = require("react");
-const index = require("./index-DXuaf32J.js");
+const index = require("./index-CRbzJppw.js");
 const QR = require("qrcode");
 const _interopDefault = (e) => e && e.__esModule ? e : { default: e };
 const QR__default = /* @__PURE__ */ _interopDefault(QR);
@@ -3071,6 +3071,7 @@ const DropEditPage = () => {
         maxScansTotal: drop.maxScansTotal ?? "",
         maxScansPerPlayer: drop.maxScansPerPlayer ?? "",
         cooldownMs: drop.cooldownMs ?? "",
+        cardsPerPull: drop.cardsPerPull ?? 1,
         sortOrder: drop.sortOrder ?? 0
       });
     if (drop && !pool)
@@ -3118,6 +3119,7 @@ const DropEditPage = () => {
           maxScansTotal: num(form.maxScansTotal),
           maxScansPerPlayer: num(form.maxScansPerPlayer),
           cooldownMs: num(form.cooldownMs),
+          cardsPerPull: Math.min(10, Math.max(1, Number(form.cardsPerPull) || 1)),
           sortOrder: Number(form.sortOrder) || 0
         }
       }).unwrap();
@@ -3170,7 +3172,7 @@ const DropEditPage = () => {
         drop.pack?.name,
         drop.mode === "static" ? "printed QR" : "rotating QR",
         `${drop.scanCount ?? 0} scans`
-      ].filter(Boolean).join(" · ") + `${drop.maxScansTotal != null ? ` / ${drop.maxScansTotal}` : ""}`,
+      ].filter(Boolean).join(" · ") + `${drop.maxScansTotal != null ? ` / ${drop.maxScansTotal}` : ""}${Number(drop.cardsPerPull) > 1 ? ` · ${drop.cardsPerPull} cards per scan` : ""}`,
       intro: {
         id: "drop-edit",
         title: "Setting up this drop",
@@ -3407,6 +3409,18 @@ const DropEditPage = () => {
                     }
                   )
                 ] }) }),
+                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 4, s: 12, children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { name: "cardsPerPull", style: { width: "100%" }, children: [
+                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "Cards per scan" }),
+                  /* @__PURE__ */ jsxRuntime.jsx(
+                    designSystem.NumberInput,
+                    {
+                      value: Number(form.cardsPerPull) || 1,
+                      onValueChange: (v) => set("cardsPerPull", v ?? 1),
+                      disabled: ro
+                    }
+                  ),
+                  /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Hint, { children: "1 to 10. One scan counts once against the cooldown and the daily limits." })
+                ] }) }),
                 /* @__PURE__ */ jsxRuntime.jsx(designSystem.Grid.Item, { col: 12, children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { name: "description", style: { width: "100%" }, children: [
                   /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "Description (shown to players)" }),
                   /* @__PURE__ */ jsxRuntime.jsx(

package/dist/_chunks/{App-j9qu2-To.mjs → App-CS_cVYEI.mjs}

@@ -5,9 +5,9 @@ import { Page, useRBAC, useNotification } from "@strapi/strapi/admin";
 import { useNavigate, useParams, Routes, Route, NavLink } from "react-router-dom";
 import { useIntl } from "react-intl";
 import { styled } from "styled-components";
-import { u as useGetSeasonsQuery, E as Eyebrow, I as Intro, S as SPRING$1, a as useGetDashboardQuery, b as useGetLeaderboardQuery, c as useGetRewardsQuery, d as useGetSetsQuery, e as useGetBadgesQuery, f as Empty, g as Section, h as SetupSteps, i as StatTile, j as Sparkline, k as fmtNumber, R as RarityBadge, B as Bar, t as timeAgo, C as Card, P as Pill, l as StatusBadge, m as fmtDate, n as useGetSeasonDefaultsQuery, o as useGetSeasonQuery, p as useCreateSeasonMutation, q as useUpdateSeasonMutation, r as useDeleteSeasonMutation, s as errorMessage, v as useGetCardsQuery, w as useCreateCardMutation, x as useUpdateCardMutation, y as useDeleteCardMutation, z as rarityOf, A as useGetPacksQuery, D as useCreatePackMutation, F as useGetPackQuery, G as useUpdatePackMutation, H as useSetPackCardsMutation, J as useDeletePackMutation, K as useCreateDropMutation, L as useLazySimulatePackQuery, M as useGetPlayersQuery, N as fmtDateTime, O as useGetPlayerQuery, Q as useSetPlayerActiveMutation, T as useGrantCardMutation, U as useLazyGetRedemptionQuery, V as useFulfillRedemptionMutation, W as useCancelRedemptionMutation, X as useGetRedemptionsQuery, Y as Mono, Z as useGetPullsQuery, _ as useGetDropQuery, $ as useUpdateDropMutation, a0 as useSetDropCardsMutation, a1 as useDeleteDropMutation, a2 as useRotateDropSecretMutation, a3 as useDropQRMutation, a4 as useGetBoostsQuery, a5 as useCreateBoostMutation, a6 as useUpdateBoostMutation, a7 as useDeleteBoostMutation, a8 as useCreateRewardMutation, a9 as useUpdateRewardMutation, aa as useDeleteRewardMutation, ab as useCreateSetMutation, ac as useUpdateSetMutation, ad as useDeleteSetMutation, ae as useCreateBadgeMutation, af as useUpdateBadgeMutation, ag as useDeleteBadgeMutation, ah as useSeedBadgesMutation } from "./api-DACN35Y5.mjs";
+import { u as useGetSeasonsQuery, E as Eyebrow, I as Intro, S as SPRING$1, a as useGetDashboardQuery, b as useGetLeaderboardQuery, c as useGetRewardsQuery, d as useGetSetsQuery, e as useGetBadgesQuery, f as Empty, g as Section, h as SetupSteps, i as StatTile, j as Sparkline, k as fmtNumber, R as RarityBadge, B as Bar, t as timeAgo, C as Card, P as Pill, l as StatusBadge, m as fmtDate, n as useGetSeasonDefaultsQuery, o as useGetSeasonQuery, p as useCreateSeasonMutation, q as useUpdateSeasonMutation, r as useDeleteSeasonMutation, s as errorMessage, v as useGetCardsQuery, w as useCreateCardMutation, x as useUpdateCardMutation, y as useDeleteCardMutation, z as rarityOf, A as useGetPacksQuery, D as useCreatePackMutation, F as useGetPackQuery, G as useUpdatePackMutation, H as useSetPackCardsMutation, J as useDeletePackMutation, K as useCreateDropMutation, L as useLazySimulatePackQuery, M as useGetPlayersQuery, N as fmtDateTime, O as useGetPlayerQuery, Q as useSetPlayerActiveMutation, T as useGrantCardMutation, U as useLazyGetRedemptionQuery, V as useFulfillRedemptionMutation, W as useCancelRedemptionMutation, X as useGetRedemptionsQuery, Y as Mono, Z as useGetPullsQuery, _ as useGetDropQuery, $ as useUpdateDropMutation, a0 as useSetDropCardsMutation, a1 as useDeleteDropMutation, a2 as useRotateDropSecretMutation, a3 as useDropQRMutation, a4 as useGetBoostsQuery, a5 as useCreateBoostMutation, a6 as useUpdateBoostMutation, a7 as useDeleteBoostMutation, a8 as useCreateRewardMutation, a9 as useUpdateRewardMutation, aa as useDeleteRewardMutation, ab as useCreateSetMutation, ac as useUpdateSetMutation, ad as useDeleteSetMutation, ae as useCreateBadgeMutation, af as useUpdateBadgeMutation, ag as useDeleteBadgeMutation, ah as useSeedBadgesMutation } from "./api-BgR-fpDp.mjs";
 import { useState, useEffect, useMemo, createContext, useContext, useRef } from "react";
-import { P as PLUGIN_ID, a as PERMISSIONS } from "./index-DSm3eEtn.mjs";
+import { P as PLUGIN_ID, a as PERMISSIONS } from "./index-ClDgxnnH.mjs";
 import QR from "qrcode";
 const KEY = "tcg.season";
 const SeasonContext = createContext({
@@ -3067,6 +3067,7 @@ const DropEditPage = () => {
         maxScansTotal: drop.maxScansTotal ?? "",
         maxScansPerPlayer: drop.maxScansPerPlayer ?? "",
         cooldownMs: drop.cooldownMs ?? "",
+        cardsPerPull: drop.cardsPerPull ?? 1,
         sortOrder: drop.sortOrder ?? 0
       });
     if (drop && !pool)
@@ -3114,6 +3115,7 @@ const DropEditPage = () => {
           maxScansTotal: num(form.maxScansTotal),
           maxScansPerPlayer: num(form.maxScansPerPlayer),
           cooldownMs: num(form.cooldownMs),
+          cardsPerPull: Math.min(10, Math.max(1, Number(form.cardsPerPull) || 1)),
           sortOrder: Number(form.sortOrder) || 0
         }
       }).unwrap();
@@ -3166,7 +3168,7 @@ const DropEditPage = () => {
         drop.pack?.name,
         drop.mode === "static" ? "printed QR" : "rotating QR",
         `${drop.scanCount ?? 0} scans`
-      ].filter(Boolean).join(" · ") + `${drop.maxScansTotal != null ? ` / ${drop.maxScansTotal}` : ""}`,
+      ].filter(Boolean).join(" · ") + `${drop.maxScansTotal != null ? ` / ${drop.maxScansTotal}` : ""}${Number(drop.cardsPerPull) > 1 ? ` · ${drop.cardsPerPull} cards per scan` : ""}`,
       intro: {
         id: "drop-edit",
         title: "Setting up this drop",
@@ -3403,6 +3405,18 @@ const DropEditPage = () => {
                     }
                   )
                 ] }) }),
+                /* @__PURE__ */ jsx(Grid.Item, { col: 4, s: 12, children: /* @__PURE__ */ jsxs(Field.Root, { name: "cardsPerPull", style: { width: "100%" }, children: [
+                  /* @__PURE__ */ jsx(Field.Label, { children: "Cards per scan" }),
+                  /* @__PURE__ */ jsx(
+                    NumberInput,
+                    {
+                      value: Number(form.cardsPerPull) || 1,
+                      onValueChange: (v) => set("cardsPerPull", v ?? 1),
+                      disabled: ro
+                    }
+                  ),
+                  /* @__PURE__ */ jsx(Field.Hint, { children: "1 to 10. One scan counts once against the cooldown and the daily limits." })
+                ] }) }),
                 /* @__PURE__ */ jsx(Grid.Item, { col: 12, children: /* @__PURE__ */ jsxs(Field.Root, { name: "description", style: { width: "100%" }, children: [
                   /* @__PURE__ */ jsx(Field.Label, { children: "Description (shown to players)" }),
                   /* @__PURE__ */ jsx(

package/dist/_chunks/{SettingsPage-Bxa_71iT.js → SettingsPage-DNWXuY8j.js}

@@ -3,8 +3,8 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const jsxRuntime = require("react/jsx-runtime");
 const designSystem = require("@strapi/design-system");
 const admin = require("@strapi/strapi/admin");
-const api = require("./api-Aney2S9e.js");
-const index = require("./index-DXuaf32J.js");
+const api = require("./api-hTExOv_J.js");
+const index = require("./index-CRbzJppw.js");
 const Row = ({ k, v, hint, tone }) => /* @__PURE__ */ jsxRuntime.jsxs(
   designSystem.Flex,
   {

package/dist/_chunks/{SettingsPage-BcJXkWnW.mjs → SettingsPage-fGiEcX6l.mjs}

@@ -1,8 +1,8 @@
 import { jsx, jsxs } from "react/jsx-runtime";
 import { Grid, Box, Flex, Typography, Badge } from "@strapi/design-system";
 import { Page, Layouts } from "@strapi/strapi/admin";
-import { ai as useGetSettingsQuery, I as Intro, g as Section, Y as Mono } from "./api-DACN35Y5.mjs";
-import { a as PERMISSIONS } from "./index-DSm3eEtn.mjs";
+import { ai as useGetSettingsQuery, I as Intro, g as Section, Y as Mono } from "./api-BgR-fpDp.mjs";
+import { a as PERMISSIONS } from "./index-ClDgxnnH.mjs";
 const Row = ({ k, v, hint, tone }) => /* @__PURE__ */ jsxs(
   Flex,
   {

package/dist/_chunks/{api-DACN35Y5.mjs → api-BgR-fpDp.mjs}

@@ -6,7 +6,7 @@ import { EmptyDocuments } from "@strapi/icons/symbols";
 import { useNavigate } from "react-router-dom";
 import { styled, css, keyframes } from "styled-components";
 import { adminApi } from "@strapi/strapi/admin";
-import { P as PLUGIN_ID } from "./index-DSm3eEtn.mjs";
+import { P as PLUGIN_ID } from "./index-ClDgxnnH.mjs";
 const fmtDateTime = (value, locale) => {
   if (!value) return "—";
   try {

package/dist/_chunks/{api-Aney2S9e.js → api-hTExOv_J.js}

@@ -7,7 +7,7 @@ const symbols = require("@strapi/icons/symbols");
 const reactRouterDom = require("react-router-dom");
 const styledComponents = require("styled-components");
 const admin = require("@strapi/strapi/admin");
-const index = require("./index-DXuaf32J.js");
+const index = require("./index-CRbzJppw.js");
 const fmtDateTime = (value, locale) => {
   if (!value) return "—";
   try {

package/dist/_chunks/{index-DXuaf32J.js → index-CRbzJppw.js}

@@ -63,7 +63,7 @@ const index = {
       intlLabel: { id: `${PLUGIN_ID}.menu.label`, defaultMessage: "TCG" },
       permissions: PERMISSIONS.access,
       Component: async () => {
-        const { App } = await Promise.resolve().then(() => require("./App-DvvgeCGs.js"));
+        const { App } = await Promise.resolve().then(() => require("./App-B-WZGNkc.js"));
         return App;
       }
     });
@@ -76,7 +76,7 @@ const index = {
           intlLabel: { id: `${PLUGIN_ID}.settings.link`, defaultMessage: "Configuration" },
           permissions: PERMISSIONS.settingsRead,
           Component: async () => {
-            const { SettingsPage } = await Promise.resolve().then(() => require("./SettingsPage-Bxa_71iT.js"));
+            const { SettingsPage } = await Promise.resolve().then(() => require("./SettingsPage-DNWXuY8j.js"));
             return SettingsPage;
           }
         }

package/dist/_chunks/{index-DSm3eEtn.mjs → index-ClDgxnnH.mjs}

@@ -62,7 +62,7 @@ const index = {
       intlLabel: { id: `${PLUGIN_ID}.menu.label`, defaultMessage: "TCG" },
       permissions: PERMISSIONS.access,
       Component: async () => {
-        const { App } = await import("./App-j9qu2-To.mjs");
+        const { App } = await import("./App-CS_cVYEI.mjs");
         return App;
       }
     });
@@ -75,7 +75,7 @@ const index = {
           intlLabel: { id: `${PLUGIN_ID}.settings.link`, defaultMessage: "Configuration" },
           permissions: PERMISSIONS.settingsRead,
           Component: async () => {
-            const { SettingsPage } = await import("./SettingsPage-BcJXkWnW.mjs");
+            const { SettingsPage } = await import("./SettingsPage-fGiEcX6l.mjs");
             return SettingsPage;
           }
         }

package/dist/admin/index.js

@@ -1,3 +1,3 @@
 "use strict";
-const index = require("../_chunks/index-DXuaf32J.js");
+const index = require("../_chunks/index-CRbzJppw.js");
 module.exports = index.index;

package/dist/admin/index.mjs

@@ -1,4 +1,4 @@
-import { i } from "../_chunks/index-DSm3eEtn.mjs";
+import { i } from "../_chunks/index-ClDgxnnH.mjs";
 export {
   i as default
 };