@sonatel-os/strapi-plugin-tcg 0.2.0 → 0.3.1

package/dist/server/index.js

@@ -45,20 +45,46 @@ const RBAC = Object.freeze({
   SETTINGS_READ: "settings.read",
   SETTINGS_WRITE: "settings.write"
 });
-const SEASON_STATUS = Object.freeze({ DRAFT: "draft", ACTIVE: "active", ARCHIVED: "archived" });
-const PACK_KIND = Object.freeze({ LOCATION: "location", BOOSTER: "booster", EVENT: "event" });
+const SEASON_STATUS = Object.freeze({
+  DRAFT: "draft",
+  ACTIVE: "active",
+  ARCHIVED: "archived"
+});
+const PACK_KIND = Object.freeze({
+  LOCATION: "location",
+  BOOSTER: "booster",
+  EVENT: "event"
+});
 const ACQUISITION = Object.freeze({ PULL: "pull", TRADE: "trade", GRANT: "grant" });
 const TRADE_STATUS = Object.freeze({
   PENDING: "pending",
+  // the QR is shown, nobody has joined
+  JOINED: "joined",
+  // a receiver read the offer and is choosing what to give
+  PROPOSED: "proposed",
+  // the receiver proposed cards; the initiator confirms or declines
   ACCEPTED: "accepted",
   REJECTED: "rejected",
   EXPIRED: "expired",
   CANCELLED: "cancelled"
 });
-const REDEMPTION_STATUS = Object.freeze({ PENDING: "pending", FULFILLED: "fulfilled", CANCELLED: "cancelled" });
+const TRADE_OPEN_STATUSES = Object.freeze([
+  TRADE_STATUS.PENDING,
+  TRADE_STATUS.JOINED,
+  TRADE_STATUS.PROPOSED
+]);
+const REDEMPTION_STATUS = Object.freeze({
+  PENDING: "pending",
+  FULFILLED: "fulfilled",
+  CANCELLED: "cancelled"
+});
 const NONCE_KIND = Object.freeze({ PACK: "pack", TRADE: "trade", DROP: "drop" });
 const DROP_MODE = Object.freeze({ STATIC: "static", ROTATING: "rotating" });
-const POOL_MODE = Object.freeze({ INHERIT: "inherit", EXTEND: "extend", OVERRIDE: "override" });
+const POOL_MODE = Object.freeze({
+  INHERIT: "inherit",
+  EXTEND: "extend",
+  OVERRIDE: "override"
+});
 const DEFAULT_DROP_NAME = "Entrée";
 const MAX_PULL_RETRIES = 3;
 const COST_RULE = Object.freeze({
@@ -96,10 +122,24 @@ const BADGE_RULE = Object.freeze({
   // { type:'scan_drop', drop:<slug> }
 });
 const DEFAULT_RARITIES = Object.freeze([
-  { key: "common", label: "Common", probability: 0.5, color: "#7A7A86", scoreMin: 10, scoreMax: 30 },
+  {
+    key: "common",
+    label: "Common",
+    probability: 0.5,
+    color: "#7A7A86",
+    scoreMin: 10,
+    scoreMax: 30
+  },
   { key: "rare", label: "Rare", probability: 0.3, color: "#00BFFF", scoreMin: 35, scoreMax: 55 },
   { key: "epic", label: "Epic", probability: 0.15, color: "#A020F0", scoreMin: 60, scoreMax: 80 },
-  { key: "legendary", label: "Legendary", probability: 0.05, color: "#FFD700", scoreMin: 85, scoreMax: 100 }
+  {
+    key: "legendary",
+    label: "Legendary",
+    probability: 0.05,
+    color: "#FFD700",
+    scoreMin: 85,
+    scoreMax: 100
+  }
 ]);
 const DEFAULT_EDITIONS = Object.freeze([
   { key: "standard", label: "Standard" },
@@ -118,7 +158,9 @@ const DEFAULT_LIMITS = Object.freeze({
   qrTokenTtlMs: 5 * 60 * 1e3,
   staticScanCooldownMs: 24 * 60 * 60 * 1e3,
   pityRareAfter: 0,
-  pityLegendaryAfter: 0
+  pityLegendaryAfter: 0,
+  /** Points a completed set adds to the collector's score (utils/score.js). */
+  setCompletionBonus: 50
 });
 const DEFAULT_RANK_TIERS = Object.freeze([
   { key: "legend", label: "Legend", minPercent: 100 },
@@ -568,6 +610,12 @@ const attributes$f = {
   cooldownMs: {
     type: "integer"
   },
+  cardsPerPull: {
+    type: "integer",
+    min: 1,
+    max: 10,
+    "default": 1
+  },
   scanCount: {
     type: "integer",
     "default": 0,
@@ -1424,6 +1472,10 @@ const attributes$4 = {
   },
   mintNumber: {
     type: "integer"
+  },
+  isExtra: {
+    type: "boolean",
+    "default": false
   }
 };
 const schema$4 = {
@@ -1441,7 +1493,7 @@ const info$3 = {
   singularName: "trade-offer",
   pluralName: "trade-offers",
   displayName: "TCG Trade Offer",
-  description: "A pending P2P proposal carried by a QR code."
+  description: "A P2P exchange: the initiator's QR, a receiver who joins and proposes cards, the initiator's confirmation."
 };
 const options$3 = {
   draftAndPublish: false
@@ -1469,6 +1521,8 @@ const attributes$3 = {
     type: "enumeration",
     "enum": [
       "pending",
+      "joined",
+      "proposed",
       "accepted",
       "rejected",
       "expired",
@@ -1488,6 +1542,23 @@ const attributes$3 = {
   expiresAt: {
     type: "datetime",
     required: true
+  },
+  receiver: {
+    type: "relation",
+    relation: "manyToOne",
+    target: "plugin::tcg.player"
+  },
+  receiverCardIds: {
+    type: "json"
+  },
+  joinedAt: {
+    type: "datetime"
+  },
+  proposedAt: {
+    type: "datetime"
+  },
+  declinedAt: {
+    type: "datetime"
   }
 };
 const schema$3 = {
@@ -1776,7 +1847,10 @@ const game = ({ strapi }) => {
   return {
     // ── Player ───────────────────────────────────────────────────────────
     me: handle(strapi, async (ctx) => {
-      ok(ctx, { ...svc("format").player(ctx.state.tcgPlayer), isNew: Boolean(ctx.state.tcgPlayerIsNew) });
+      ok(ctx, {
+        ...svc("format").player(ctx.state.tcgPlayer),
+        isNew: Boolean(ctx.state.tcgPlayerIsNew)
+      });
     }),
     updateMe: handle(strapi, async (ctx) => {
       const { displayName, avatarUrl } = body(ctx);
@@ -1794,12 +1868,19 @@ const game = ({ strapi }) => {
     packs: handle(strapi, async (ctx) => {
       const season2 = await seasonOf(ctx);
       const packs = await svc("pack").list(season2);
-      ok(ctx, packs.map((p) => svc("format").pack(p)));
+      ok(
+        ctx,
+        packs.map((p) => svc("format").pack(p))
+      );
     }),
     pack: handle(strapi, async (ctx) => {
       const season2 = await seasonOf(ctx);
       const pack2 = await svc("pack").findOne(season2, ctx.params.slug);
-      const [pool, drops, exclusiveIds] = await Promise.all([svc("pack").pool(pack2), svc("drop").list(pack2, { includeInactive: false }), svc("drop").exclusiveCardIds(season2)]);
+      const [pool, drops, exclusiveIds] = await Promise.all([
+        svc("pack").pool(pack2),
+        svc("drop").list(pack2, { includeInactive: false }),
+        svc("drop").exclusiveCardIds(season2)
+      ]);
       ok(ctx, {
         ...svc("format").pack(pack2),
         cards: pool.filter((c) => !exclusiveIds.has(c.id) || c.isExclusive).map((c) => ({ ...svc("format").card(c, season2), isExclusive: c.isExclusive })),
@@ -1819,7 +1900,11 @@ const game = ({ strapi }) => {
           windows.push({ ...v, pack: { id: pack2.documentId, name: pack2.name, slug: pack2.slug } });
         }
       }
-      ok(ctx, { boosts: await svc("boost").liveNow(season2), drops: windows, serverTime: /* @__PURE__ */ new Date() });
+      ok(ctx, {
+        boosts: await svc("boost").liveNow(season2),
+        drops: windows,
+        serverTime: /* @__PURE__ */ new Date()
+      });
     }),
     sets: handle(strapi, async (ctx) => {
       const season2 = await seasonOf(ctx);
@@ -1834,8 +1919,13 @@ const game = ({ strapi }) => {
     rewards: handle(strapi, async (ctx) => {
       const season2 = await seasonOf(ctx);
       const rewards = await svc("reward").list(season2, { includeInactive: false });
-      const sets = Object.fromEntries((await svc("set").list(season2)).map((x) => [x.slug, { name: x.name }]));
-      ok(ctx, rewards.map((r) => svc("reward").format(r, season2, sets)));
+      const sets = Object.fromEntries(
+        (await svc("set").list(season2)).map((x) => [x.slug, { name: x.name }])
+      );
+      ok(
+        ctx,
+        rewards.map((r) => svc("reward").format(r, season2, sets))
+      );
     }),
     rewardEligibility: handle(strapi, async (ctx) => {
       const season2 = await seasonOf(ctx);
@@ -1844,8 +1934,16 @@ const game = ({ strapi }) => {
     cards: handle(strapi, async (ctx) => {
       const season2 = await seasonOf(ctx);
       const page = parsePagination(ctx.query);
-      const { items, total } = await svc("card").list(season2, { rarity: ctx.query.rarity, edition: ctx.query.edition, isActive: true }, page);
-      ctx.body = paged(items.map((c) => svc("format").card(c, season2)), total, page);
+      const { items, total } = await svc("card").list(
+        season2,
+        { rarity: ctx.query.rarity, edition: ctx.query.edition, isActive: true },
+        page
+      );
+      ctx.body = paged(
+        items.map((c) => svc("format").card(c, season2)),
+        total,
+        page
+      );
     }),
     card: handle(strapi, async (ctx) => {
       const card2 = await svc("card").findOne(ctx.params.id);
@@ -1856,7 +1954,12 @@ const game = ({ strapi }) => {
     collection: handle(strapi, async (ctx) => {
       const season2 = await seasonOf(ctx);
       const page = parsePagination(ctx.query);
-      const { items, total } = await svc("collection").list(ctx.state.tcgPlayer, season2, { rarity: ctx.query.rarity }, page);
+      const { items, total } = await svc("collection").list(
+        ctx.state.tcgPlayer,
+        season2,
+        { rarity: ctx.query.rarity },
+        page
+      );
       ctx.body = paged(items, total, page);
     }),
     collectionStats: handle(strapi, async (ctx) => {
@@ -1881,17 +1984,34 @@ const game = ({ strapi }) => {
     // ── Trades ───────────────────────────────────────────────────────────
     createOffer: handle(strapi, async (ctx) => {
       const season2 = await seasonOf(ctx);
-      created(ctx, await svc("trade").createOffer(ctx.state.tcgPlayer, season2, { cardIds: body(ctx).cardIds }));
+      created(
+        ctx,
+        await svc("trade").createOffer(ctx.state.tcgPlayer, season2, { cardIds: body(ctx).cardIds })
+      );
     }),
     scanOffer: handle(strapi, async (ctx) => {
       ok(ctx, await svc("trade").scan(ctx.state.tcgPlayer, String(body(ctx).qrToken ?? "")));
     }),
     getOffer: handle(strapi, async (ctx) => {
       const offer = await svc("trade").findOffer(ctx.params.id);
-      ok(ctx, await svc("trade").describe(offer, offer.season));
+      ok(ctx, await svc("trade").describe(offer, offer.season, ctx.state.tcgPlayer));
     }),
-    acceptOffer: handle(strapi, async (ctx) => {
-      ok(ctx, await svc("trade").accept(ctx.state.tcgPlayer, ctx.params.id, { cardIds: body(ctx).cardIds }));
+    joinOffer: handle(strapi, async (ctx) => {
+      ok(ctx, await svc("trade").join(ctx.state.tcgPlayer, ctx.params.id));
+    }),
+    proposeOffer: handle(strapi, async (ctx) => {
+      ok(
+        ctx,
+        await svc("trade").propose(ctx.state.tcgPlayer, ctx.params.id, {
+          cardIds: body(ctx).cardIds
+        })
+      );
+    }),
+    confirmOffer: handle(strapi, async (ctx) => {
+      ok(ctx, await svc("trade").confirm(ctx.state.tcgPlayer, ctx.params.id));
+    }),
+    declineOffer: handle(strapi, async (ctx) => {
+      ok(ctx, await svc("trade").decline(ctx.state.tcgPlayer, ctx.params.id));
     }),
     rejectOffer: handle(strapi, async (ctx) => {
       ok(ctx, await svc("trade").reject(ctx.state.tcgPlayer, ctx.params.id));
@@ -1913,10 +2033,15 @@ const game = ({ strapi }) => {
     createRedemption: handle(strapi, async (ctx) => {
       const season2 = await seasonOf(ctx);
       const { cardIds, rewardId } = body(ctx);
-      created(ctx, await svc("redemption").create(ctx.state.tcgPlayer, season2, { cardIds, rewardId }));
+      created(
+        ctx,
+        await svc("redemption").create(ctx.state.tcgPlayer, season2, { cardIds, rewardId })
+      );
     }),
     getRedemption: handle(strapi, async (ctx) => {
-      const rec = await svc("redemption").findOne(ctx.params.id, { forPlayer: ctx.state.tcgPlayer });
+      const rec = await svc("redemption").findOne(ctx.params.id, {
+        forPlayer: ctx.state.tcgPlayer
+      });
       ok(ctx, svc("format").redemption(rec));
     }),
     redemptionHistory: handle(strapi, async (ctx) => {
@@ -2305,7 +2430,12 @@ const contentApi = [
   { method: "GET", path: "/cards/:id", handler: "game.card", config: CATALOG },
   { method: "GET", path: "/live", handler: "game.live", config: CATALOG },
   { method: "GET", path: "/rewards", handler: "game.rewards", config: CATALOG },
-  { method: "GET", path: "/rewards/eligibility", handler: "game.rewardEligibility", config: PLAYER },
+  {
+    method: "GET",
+    path: "/rewards/eligibility",
+    handler: "game.rewardEligibility",
+    config: PLAYER
+  },
   { method: "GET", path: "/sets", handler: "game.sets", config: PLAYER },
   { method: "GET", path: "/badges", handler: "game.badges", config: PLAYER },
   // collection
@@ -2321,12 +2451,35 @@ const contentApi = [
   { method: "GET", path: "/trades/active", handler: "game.activeOffers", config: PLAYER },
   { method: "GET", path: "/trades/history", handler: "game.tradeHistory", config: PLAYER },
   { method: "GET", path: "/trades/offer/:id", handler: "game.getOffer", config: PLAYER },
-  { method: "POST", path: "/trades/offer/:id/accept", handler: "game.acceptOffer", config: PLAYER },
+  { method: "POST", path: "/trades/offer/:id/join", handler: "game.joinOffer", config: PLAYER },
+  {
+    method: "POST",
+    path: "/trades/offer/:id/propose",
+    handler: "game.proposeOffer",
+    config: PLAYER
+  },
+  {
+    method: "POST",
+    path: "/trades/offer/:id/confirm",
+    handler: "game.confirmOffer",
+    config: PLAYER
+  },
+  {
+    method: "POST",
+    path: "/trades/offer/:id/decline",
+    handler: "game.declineOffer",
+    config: PLAYER
+  },
   { method: "POST", path: "/trades/offer/:id/reject", handler: "game.rejectOffer", config: PLAYER },
   { method: "POST", path: "/trades/offer/:id/cancel", handler: "game.cancelOffer", config: PLAYER },
   // redemptions
   { method: "POST", path: "/redemptions", handler: "game.createRedemption", config: PLAYER },
-  { method: "GET", path: "/redemptions/history", handler: "game.redemptionHistory", config: PLAYER },
+  {
+    method: "GET",
+    path: "/redemptions/history",
+    handler: "game.redemptionHistory",
+    config: PLAYER
+  },
   { method: "GET", path: "/redemptions/:id", handler: "game.getRedemption", config: PLAYER }
 ];
 const can = (...actions) => ({
@@ -2495,34 +2648,55 @@ const qr = ({ strapi }) => ({
   },
   /** @param {Object} drop @param {number} ttlMs */
   forDrop(drop2, ttlMs) {
-    if (drop2.mode === DROP_MODE.STATIC) return { ...signStaticToken(drop2.documentId, this.secretOf(drop2)), mode: DROP_MODE.STATIC, expiresAt: null };
-    return { ...signDropToken(drop2.documentId, this.secretOf(drop2), ttlMs), mode: DROP_MODE.ROTATING };
+    if (drop2.mode === DROP_MODE.STATIC)
+      return {
+        ...signStaticToken(drop2.documentId, this.secretOf(drop2)),
+        mode: DROP_MODE.STATIC,
+        expiresAt: null
+      };
+    return {
+      ...signDropToken(drop2.documentId, this.secretOf(drop2), ttlMs),
+      mode: DROP_MODE.ROTATING
+    };
   },
   forTrade(offer, player2, ttlMs) {
-    return signTradeToken(offer.documentId, player2.documentId, strapi.plugin("tcg").service("settings").qrGlobalSecret(), ttlMs);
+    return signTradeToken(
+      offer.documentId,
+      player2.documentId,
+      strapi.plugin("tcg").service("settings").qrGlobalSecret(),
+      ttlMs
+    );
   },
   /**
-   * Verifies signature + expiry; burns the nonce for rotating/trade tokens. Throws TcgError.
+   * Verifies signature + expiry; burns the nonce for rotating/trade tokens — per player for a drop code, so
+   * the same displayed code serves everyone around the screen, once each. Throws TcgError.
    * @param {string} token
    * @param {string} secret
    * @param {'drop'|'trade'} kind
+   * @param {{ playerId?: string }} [scope] - the scanning player's documentId (drops)
    */
-  async consume(token, secret, kind2) {
+  async consume(token, secret, kind2, scope = {}) {
     const result = verifyToken(token, secret);
     if (!result.valid) {
-      if (result.reason === "expired") throw badRequest(ERROR_CODES.QR_EXPIRED, "Ce QR code a expiré.");
+      if (result.reason === "expired")
+        throw badRequest(ERROR_CODES.QR_EXPIRED, "Ce QR code a expiré.");
       throw badRequest(ERROR_CODES.QR_INVALID, "QR code invalide.");
     }
     if (result.kind !== kind2) throw badRequest(ERROR_CODES.QR_INVALID, "QR code invalide.");
     if (!result.nonce) return result;
-    const seen = await strapi.db.query(UID.NONCE).findOne({ where: { nonce: result.nonce }, select: ["id"] });
-    if (seen) throw badRequest(ERROR_CODES.QR_REUSED, "Ce QR code a déjà été utilisé.");
+    const key = kind2 === "drop" && scope.playerId ? `${result.nonce}:${scope.playerId}` : result.nonce;
+    const seen = await strapi.db.query(UID.NONCE).findOne({ where: { nonce: key }, select: ["id"] });
+    if (seen) throw badRequest(ERROR_CODES.QR_REUSED, "Vous avez déjà scanné ce QR code.");
     try {
       await strapi.db.query(UID.NONCE).create({
-        data: { nonce: result.nonce, kind: kind2 === "drop" ? NONCE_KIND.DROP : NONCE_KIND.TRADE, expiresAt: new Date(result.expiresAt) }
+        data: {
+          nonce: key,
+          kind: kind2 === "drop" ? NONCE_KIND.DROP : NONCE_KIND.TRADE,
+          expiresAt: new Date(result.expiresAt)
+        }
       });
     } catch (err) {
-      throw badRequest(ERROR_CODES.QR_REUSED, "Ce QR code a déjà été utilisé.");
+      throw badRequest(ERROR_CODES.QR_REUSED, "Vous avez déjà scanné ce QR code.");
     }
     return result;
   },
@@ -2531,6 +2705,39 @@ const qr = ({ strapi }) => ({
     return count ?? 0;
   }
 });
+const rarityPoints = (season2, rarityKey) => {
+  const table = season2?.rarities?.length ? season2.rarities : DEFAULT_RARITIES;
+  const idx = table.findIndex((r) => r.key === rarityKey);
+  const meta = table[idx] ?? DEFAULT_RARITIES.find((r) => r.key === rarityKey) ?? null;
+  const min = Number(meta?.scoreMin);
+  const max = Number(meta?.scoreMax);
+  if (Number.isFinite(min) && Number.isFinite(max) && max >= min)
+    return Math.round((min + max) / 2);
+  return 10 + Math.max(0, idx) * 20;
+};
+const cardPoints = (card2, season2) => {
+  const own = Number(card2?.score);
+  if (Number.isFinite(own) && own > 0) return Math.round(own);
+  return rarityPoints(season2, card2?.rarity);
+};
+const standingOf = (distinctCards, totalCards, sets, season2, limits = {}) => {
+  const ownedIds = new Set(distinctCards.map((c) => String(c.id)));
+  const cardScore = distinctCards.reduce((sum, c) => sum + cardPoints(c, season2), 0);
+  const setsCompleted = (sets ?? []).filter(
+    (s) => (s.cards ?? []).length > 0 && s.cards.every((c) => ownedIds.has(String(c.id)))
+  ).length;
+  const bonus = Math.max(0, Number(limits.setCompletionBonus) || 0);
+  return {
+    uniqueCards: distinctCards.length,
+    totalCards,
+    cardScore,
+    setsCompleted,
+    setBonus: setsCompleted * bonus,
+    score: cardScore + setsCompleted * bonus
+  };
+};
+const compareStandings = (a, b) => b.score - a.score || b.uniqueCards - a.uniqueCards || b.totalCards - a.totalCards;
+const rankAmong = (mine, all) => 1 + all.filter((s) => compareStandings(s, mine) < 0).length;
 const mediaUrl = (media) => media && typeof media === "object" ? media.url ?? null : null;
 const format = () => ({
   rarityMeta(season2, key) {
@@ -2549,6 +2756,7 @@ const format = () => ({
       rarityColor: rarity.color,
       edition: card2.edition ?? "standard",
       score: card2.score ?? 0,
+      points: cardPoints(card2, season2),
       imageUrl: mediaUrl(card2.image),
       attributes: card2.attributes ?? {},
       lore: card2.lore ?? null,
@@ -2610,7 +2818,13 @@ const format = () => ({
   },
   /** Admin-only view: includes msisdn. */
   playerAdmin(player2) {
-    return player2 ? { ...this.player(player2), externalId: player2.externalId ?? null, msisdn: player2.msisdn ?? null, isActive: player2.isActive, meta: player2.meta ?? {} } : null;
+    return player2 ? {
+      ...this.player(player2),
+      externalId: player2.externalId ?? null,
+      msisdn: player2.msisdn ?? null,
+      isActive: player2.isActive,
+      meta: player2.meta ?? {}
+    } : null;
   },
   playerCard(pc, season2) {
     if (!pc) return null;
@@ -2638,7 +2852,16 @@ const format = () => ({
       note: r.note ?? null,
       player: r.player ? this.player(r.player) : void 0,
       season: r.season ? { id: r.season.documentId, name: r.season.name, slug: r.season.slug } : void 0,
-      reward: r.reward ? { id: r.reward.documentId, name: r.reward.name, slug: r.reward.slug, tier: r.reward.tier ?? null, booth: r.reward.booth ?? null, imageUrl: mediaUrl(r.reward.image), stock: r.reward.stock ?? null, claimed: r.reward.claimed ?? 0 } : r.rewardName ? { name: r.rewardName } : null
+      reward: r.reward ? {
+        id: r.reward.documentId,
+        name: r.reward.name,
+        slug: r.reward.slug,
+        tier: r.reward.tier ?? null,
+        booth: r.reward.booth ?? null,
+        imageUrl: mediaUrl(r.reward.image),
+        stock: r.reward.stock ?? null,
+        claimed: r.reward.claimed ?? 0
+      } : r.rewardName ? { name: r.rewardName } : null
     };
   }
 });
@@ -3041,44 +3264,91 @@ const pull = ({ strapi }) => ({
   async scan(player2, qrToken) {
     const plugin = strapi.plugin("tcg");
     const peek = peekToken(qrToken);
-    if (!peek || peek.kind !== "drop") throw badRequest(ERROR_CODES.QR_INVALID, "QR code invalide.");
+    if (!peek || peek.kind !== "drop")
+      throw badRequest(ERROR_CODES.QR_INVALID, "QR code invalide.");
     const drop2 = await plugin.service("drop").byDocumentId(peek.dropId);
     const pack2 = drop2.pack;
     const season2 = pack2?.season;
-    if (!pack2 || !pack2.isActive) throw unprocessable(ERROR_CODES.PACK_INACTIVE, "Ce pack n'est plus disponible.");
-    if (!season2 || season2.status !== "active") throw unprocessable(ERROR_CODES.SEASON_INACTIVE, "Cette saison n'est pas en cours.");
+    if (!pack2 || !pack2.isActive)
+      throw unprocessable(ERROR_CODES.PACK_INACTIVE, "Ce pack n'est plus disponible.");
+    if (!season2 || season2.status !== "active")
+      throw unprocessable(ERROR_CODES.SEASON_INACTIVE, "Cette saison n'est pas en cours.");
     if (peek.mode !== drop2.mode) throw badRequest(ERROR_CODES.QR_INVALID, "QR code invalide.");
-    if (!plugin.service("drop").isOpen(drop2)) throw unprocessable(ERROR_CODES.DROP_CLOSED, "Ce point n'est pas ouvert en ce moment.", { startsAt: drop2.startsAt, endsAt: drop2.endsAt });
-    if (drop2.maxScansTotal != null && drop2.scanCount >= drop2.maxScansTotal) throw unprocessable(ERROR_CODES.DROP_SOLD_OUT, "Toutes les cartes de ce point ont été distribuées.");
+    if (!plugin.service("drop").isOpen(drop2))
+      throw unprocessable(ERROR_CODES.DROP_CLOSED, "Ce point n'est pas ouvert en ce moment.", {
+        startsAt: drop2.startsAt,
+        endsAt: drop2.endsAt
+      });
+    if (drop2.maxScansTotal != null && drop2.scanCount >= drop2.maxScansTotal)
+      throw unprocessable(
+        ERROR_CODES.DROP_SOLD_OUT,
+        "Toutes les cartes de ce point ont été distribuées."
+      );
     const limits = plugin.service("season").limitsOf(season2);
-    await plugin.service("qr").consume(qrToken, plugin.service("qr").secretOf(drop2), "drop");
+    await plugin.service("qr").consume(qrToken, plugin.service("qr").secretOf(drop2), "drop", {
+      playerId: player2.documentId
+    });
     const now = /* @__PURE__ */ new Date();
     const owned = await strapi.db.query(UID.PLAYER_CARD).count({ where: { player: player2.id, card: { season: season2.id } } });
-    if (owned >= limits.maxCollectionSize) throw unprocessable(ERROR_CODES.COLLECTION_FULL, `Collection pleine (${limits.maxCollectionSize} cartes max).`);
+    if (owned >= limits.maxCollectionSize)
+      throw unprocessable(
+        ERROR_CODES.COLLECTION_FULL,
+        `Collection pleine (${limits.maxCollectionSize} cartes max).`
+      );
     const cooldownMs = drop2.cooldownMs ?? (drop2.mode === DROP_MODE.STATIC ? Math.max(limits.pullCooldownMs, limits.staticScanCooldownMs) : limits.pullCooldownMs);
-    const lastHere = await strapi.db.query(UID.PULL).findOne({ where: { player: player2.id, drop: drop2.id }, orderBy: { pulledAt: "desc" }, select: ["pulledAt"] });
+    const lastHere = await strapi.db.query(UID.PULL).findOne({
+      where: { player: player2.id, drop: drop2.id, isExtra: false },
+      orderBy: { pulledAt: "desc" },
+      select: ["pulledAt"]
+    });
     if (lastHere) {
       const elapsed = now.getTime() - new Date(lastHere.pulledAt).getTime();
       if (elapsed < cooldownMs) {
         const remainingSeconds = Math.ceil((cooldownMs - elapsed) / 1e3);
-        throw unprocessable(ERROR_CODES.COOLDOWN_ACTIVE, remainingSeconds > 3600 ? `Revenez dans ${Math.ceil(remainingSeconds / 3600)} h.` : `Patientez encore ${remainingSeconds} s.`, { remainingSeconds });
+        throw unprocessable(
+          ERROR_CODES.COOLDOWN_ACTIVE,
+          remainingSeconds > 3600 ? `Revenez dans ${Math.ceil(remainingSeconds / 3600)} h.` : `Patientez encore ${remainingSeconds} s.`,
+          { remainingSeconds }
+        );
       }
     }
     if (drop2.maxScansPerPlayer != null) {
-      const mine = await strapi.db.query(UID.PULL).count({ where: { player: player2.id, drop: drop2.id } });
-      if (mine >= drop2.maxScansPerPlayer) throw unprocessable(ERROR_CODES.DROP_PLAYER_LIMIT, `Vous avez déjà obtenu vos ${drop2.maxScansPerPlayer} carte(s) ici.`);
+      const mine = await strapi.db.query(UID.PULL).count({ where: { player: player2.id, drop: drop2.id, isExtra: false } });
+      if (mine >= drop2.maxScansPerPlayer)
+        throw unprocessable(
+          ERROR_CODES.DROP_PLAYER_LIMIT,
+          `Vous avez déjà obtenu vos ${drop2.maxScansPerPlayer} carte(s) ici.`
+        );
     }
     const since = startOfToday$1();
     const [packToday, totalToday] = await Promise.all([
-      strapi.db.query(UID.PULL).count({ where: { player: player2.id, pack: pack2.id, pulledAt: { $gte: since } } }),
-      strapi.db.query(UID.PULL).count({ where: { player: player2.id, season: season2.id, pulledAt: { $gte: since } } })
+      strapi.db.query(UID.PULL).count({
+        where: { player: player2.id, pack: pack2.id, pulledAt: { $gte: since }, isExtra: false }
+      }),
+      strapi.db.query(UID.PULL).count({
+        where: {
+          player: player2.id,
+          season: season2.id,
+          pulledAt: { $gte: since },
+          isExtra: false
+        }
+      })
     ]);
-    if (packToday >= limits.maxDailyPullsPerPack) throw unprocessable(ERROR_CODES.DAILY_LIMIT_PACK, `Limite atteinte pour ce pack aujourd'hui (${limits.maxDailyPullsPerPack}).`);
-    if (totalToday >= limits.maxDailyPullsTotal) throw unprocessable(ERROR_CODES.DAILY_LIMIT_TOTAL, `Limite quotidienne atteinte (${limits.maxDailyPullsTotal}).`);
+    if (packToday >= limits.maxDailyPullsPerPack)
+      throw unprocessable(
+        ERROR_CODES.DAILY_LIMIT_PACK,
+        `Limite atteinte pour ce pack aujourd'hui (${limits.maxDailyPullsPerPack}).`
+      );
+    if (totalToday >= limits.maxDailyPullsTotal)
+      throw unprocessable(
+        ERROR_CODES.DAILY_LIMIT_TOTAL,
+        `Limite quotidienne atteinte (${limits.maxDailyPullsTotal}).`
+      );
     const raw = await plugin.service("drop").rawPool(drop2, pack2);
     const exclusiveIds = await plugin.service("drop").exclusiveCardIds(season2);
     let pool = prunePool(raw, exclusiveIds);
-    if (pool.length === 0) throw unprocessable(ERROR_CODES.PACK_EMPTY, "Aucune carte disponible ici pour le moment.");
+    if (pool.length === 0)
+      throw unprocessable(ERROR_CODES.PACK_EMPTY, "Aucune carte disponible ici pour le moment.");
     const boosts = await plugin.service("boost").activeFor(season2, pack2, drop2);
     const multipliers = plugin.service("boost").combine(boosts);
     const recent = await strapi.db.query(UID.PULL).findMany({
@@ -3088,65 +3358,113 @@ const pull = ({ strapi }) => ({
       select: ["rarity"]
     });
     const minRarity = pityFloor(recent, season2.rarities ?? [], limits);
-    let result = null;
-    let mintNumber = null;
-    for (let attempt = 0; attempt < MAX_PULL_RETRIES && pool.length; attempt += 1) {
-      result = pull$1({ playerId: player2.documentId, dropId: drop2.documentId, pullNumber: totalToday + 1 + attempt, pool, rarities: season2.rarities ?? [], multipliers, minRarity });
-      if (!result.card) break;
-      mintNumber = await this.claimSlot(UID.CARD, result.card.id, "minted", "supplyCap");
-      if (mintNumber != null) break;
-      pool = pool.filter((c) => c.id !== result.card.id);
-      result = null;
-    }
-    if (!result?.card || mintNumber == null) throw unprocessable(ERROR_CODES.PACK_EMPTY, "Plus de cartes disponibles ici.");
-    if (drop2.maxScansTotal != null) {
-      const slot = await this.claimSlot(UID.DROP, drop2.id, "scanCount", "maxScansTotal");
-      if (slot == null) throw unprocessable(ERROR_CODES.DROP_SOLD_OUT, "Toutes les cartes de ce point ont été distribuées.");
-    } else {
-      await this.claimSlot(UID.DROP, drop2.id, "scanCount", null);
-    }
-    const alreadyOwned = await strapi.db.query(UID.PLAYER_CARD).count({ where: { player: player2.id, card: result.card.id } });
-    const playerCard2 = await strapi.db.transaction(async () => {
-      const pc = await strapi.db.query(UID.PLAYER_CARD).create({
-        data: { player: player2.id, card: result.card.id, pack: pack2.id, acquiredFrom: ACQUISITION.PULL, acquiredAt: now, mintNumber }
-      });
-      await strapi.db.query(UID.PULL).create({
-        data: {
-          player: player2.id,
-          pack: pack2.id,
-          drop: drop2.id,
-          card: result.card.id,
-          season: season2.id,
-          seed: String(result.seed),
-          roll: result.roll,
-          rarity: result.rarity,
-          verificationHash: result.verificationHash,
-          qrToken: peek.mode === DROP_MODE.STATIC ? null : qrToken,
-          pulledAt: now,
-          odds: result.odds,
-          pity: result.pity,
-          mintNumber
+    const count = Math.max(1, Math.min(10, Number(drop2.cardsPerPull) || 1));
+    const format2 = plugin.service("format");
+    const cards = [];
+    for (let n = 0; n < count; n += 1) {
+      let result = null;
+      let mintNumber = null;
+      for (let attempt = 0; attempt < MAX_PULL_RETRIES && pool.length; attempt += 1) {
+        result = pull$1({
+          playerId: player2.documentId,
+          dropId: drop2.documentId,
+          pullNumber: totalToday + 1 + n * MAX_PULL_RETRIES + attempt,
+          pool,
+          rarities: season2.rarities ?? [],
+          multipliers,
+          minRarity: n === 0 ? minRarity : null
+        });
+        if (!result.card) break;
+        mintNumber = await this.claimSlot(UID.CARD, result.card.id, "minted", "supplyCap");
+        if (mintNumber != null) break;
+        pool = pool.filter((c) => c.id !== result.card.id);
+        result = null;
+      }
+      if (!result?.card || mintNumber == null) {
+        if (n === 0) throw unprocessable(ERROR_CODES.PACK_EMPTY, "Plus de cartes disponibles ici.");
+        break;
+      }
+      if (n === 0) {
+        if (drop2.maxScansTotal != null) {
+          const slot = await this.claimSlot(UID.DROP, drop2.id, "scanCount", "maxScansTotal");
+          if (slot == null)
+            throw unprocessable(
+              ERROR_CODES.DROP_SOLD_OUT,
+              "Toutes les cartes de ce point ont été distribuées."
+            );
+        } else {
+          await this.claimSlot(UID.DROP, drop2.id, "scanCount", null);
         }
+      }
+      const alreadyOwned = await strapi.db.query(UID.PLAYER_CARD).count({ where: { player: player2.id, card: result.card.id } });
+      const playerCard2 = await strapi.db.transaction(async () => {
+        const pc = await strapi.db.query(UID.PLAYER_CARD).create({
+          data: {
+            player: player2.id,
+            card: result.card.id,
+            pack: pack2.id,
+            acquiredFrom: ACQUISITION.PULL,
+            acquiredAt: now,
+            mintNumber
+          }
+        });
+        await strapi.db.query(UID.PULL).create({
+          data: {
+            player: player2.id,
+            pack: pack2.id,
+            drop: drop2.id,
+            card: result.card.id,
+            season: season2.id,
+            seed: String(result.seed),
+            roll: result.roll,
+            rarity: result.rarity,
+            verificationHash: result.verificationHash,
+            qrToken: peek.mode === DROP_MODE.STATIC ? null : qrToken,
+            pulledAt: now,
+            odds: result.odds,
+            pity: result.pity,
+            mintNumber,
+            isExtra: n > 0
+          }
+        });
+        await strapi.db.query(UID.PLAYER).update({
+          where: { id: player2.id },
+          data: { totalCards: (player2.totalCards ?? 0) + n + 1, lastActiveAt: now }
+        });
+        return pc;
       });
-      await strapi.db.query(UID.PLAYER).update({ where: { id: player2.id }, data: { totalCards: (player2.totalCards ?? 0) + 1, lastActiveAt: now } });
-      return pc;
-    });
-    strapi.log.info(`[tcg] pull ${player2.code} ← ${result.card.name} #${mintNumber} (${result.rarity}${result.pity ? ", pity" : ""}) @ ${pack2.slug}/${drop2.slug}${boosts.length ? ` boosts=${boosts.map((b) => b.name).join("+")}` : ""}`);
-    const format2 = plugin.service("format");
-    const unlocked = await plugin.service("badge").evaluate(player2, season2, { event: "pull", card: result.card.documentId });
-    return {
-      playerCardId: playerCard2.documentId,
-      card: { ...format2.card(result.card, season2), mintNumber },
-      pull: {
+      cards.push({
+        playerCardId: playerCard2.documentId,
+        card: { ...format2.card(result.card, season2), mintNumber },
         rarity: result.rarity,
-        isNew: alreadyOwned === 0,
+        isNew: alreadyOwned === 0 && !cards.some((c) => c.card.id === result.card.documentId),
         pity: result.pity,
         odds: result.odds,
-        boosts: boosts.map((b) => ({ name: b.name, multipliers: b.multipliers })),
         isExclusive: Boolean(result.card.isExclusive),
+        verificationHash: result.verificationHash,
+        mintNumber
+      });
+      strapi.log.info(
+        `[tcg] pull ${player2.code} ← ${result.card.name} #${mintNumber} (${result.rarity}${result.pity ? ", pity" : ""}${n > 0 ? ", extra" : ""}) @ ${pack2.slug}/${drop2.slug}${boosts.length ? ` boosts=${boosts.map((b) => b.name).join("+")}` : ""}`
+      );
+    }
+    const first = cards[0];
+    const unlocked = await plugin.service("badge").evaluate(player2, season2, { event: "pull", card: first.card.id });
+    return {
+      playerCardId: first.playerCardId,
+      card: first.card,
+      cards,
+      pull: {
+        rarity: first.rarity,
+        isNew: first.isNew,
+        pity: first.pity,
+        odds: first.odds,
+        boosts: boosts.map((b) => ({ name: b.name, multipliers: b.multipliers })),
+        isExclusive: first.isExclusive,
+        cardCount: cards.length,
         pack: { id: pack2.documentId, name: pack2.name, slug: pack2.slug },
         drop: { id: drop2.documentId, name: drop2.name, slug: drop2.slug },
-        verificationHash: result.verificationHash,
+        verificationHash: first.verificationHash,
         pulledAt: now
       },
       unlocked
@@ -3155,7 +3473,13 @@ const pull = ({ strapi }) => ({
   async history(player2, season2, page) {
     const where = { player: player2.id, season: season2.id };
     const [items, total] = await Promise.all([
-      strapi.db.query(UID.PULL).findMany({ where, populate: { card: { populate: { image: true } }, pack: true, drop: true }, orderBy: { pulledAt: "desc" }, offset: page.offset, limit: page.limit }),
+      strapi.db.query(UID.PULL).findMany({
+        where,
+        populate: { card: { populate: { image: true } }, pack: true, drop: true },
+        orderBy: { pulledAt: "desc" },
+        offset: page.offset,
+        limit: page.limit
+      }),
       strapi.db.query(UID.PULL).count({ where })
     ]);
     const format2 = strapi.plugin("tcg").service("format");
@@ -3180,7 +3504,11 @@ const pull = ({ strapi }) => ({
     const limits = plugin.service("season").limitsOf(season2);
     const packs = await plugin.service("pack").list(season2);
     const since = startOfToday$1();
-    const todays = await strapi.db.query(UID.PULL).findMany({ where: { player: player2.id, season: season2.id, pulledAt: { $gte: since } }, populate: { pack: { select: ["id"] } }, select: ["pulledAt"] });
+    const todays = await strapi.db.query(UID.PULL).findMany({
+      where: { player: player2.id, season: season2.id, pulledAt: { $gte: since }, isExtra: false },
+      populate: { pack: { select: ["id"] } },
+      select: ["pulledAt"]
+    });
     const countByPack = {};
     for (const p of todays) countByPack[p.pack?.id] = (countByPack[p.pack?.id] ?? 0) + 1;
     const totalToday = todays.length;
@@ -3190,10 +3518,21 @@ const pull = ({ strapi }) => ({
       const drops = await plugin.service("drop").list(pack2, { includeInactive: false });
       const dropStates = [];
       for (const drop2 of drops) {
-        const last = await strapi.db.query(UID.PULL).findOne({ where: { player: player2.id, drop: drop2.id }, orderBy: { pulledAt: "desc" }, select: ["pulledAt"] });
+        const last = await strapi.db.query(UID.PULL).findOne({
+          where: { player: player2.id, drop: drop2.id, isExtra: false },
+          orderBy: { pulledAt: "desc" },
+          select: ["pulledAt"]
+        });
         const cooldownMs = drop2.cooldownMs ?? (drop2.mode === DROP_MODE.STATIC ? Math.max(limits.pullCooldownMs, limits.staticScanCooldownMs) : limits.pullCooldownMs);
         const remaining = last ? Math.max(0, cooldownMs - (now - new Date(last.pulledAt).getTime())) : 0;
-        dropStates.push({ drop: { id: drop2.documentId, name: drop2.name, slug: drop2.slug }, isOpen: plugin.service("drop").isOpen(drop2), cooldownRemainingMs: remaining, cooldownRemainingSeconds: Math.ceil(remaining / 1e3) });
+        dropStates.push({
+          drop: { id: drop2.documentId, name: drop2.name, slug: drop2.slug },
+          isOpen: plugin.service("drop").isOpen(drop2),
+          cooldownRemainingMs: remaining,
+          cooldownRemainingSeconds: Math.ceil(remaining / 1e3),
+          cooldownUntil: remaining > 0 ? new Date(now + remaining) : null,
+          cardsPerPull: Math.max(1, Number(drop2.cardsPerPull) || 1)
+        });
       }
       const pullsToday = countByPack[pack2.id] ?? 0;
       const anyReady = dropStates.some((d) => d.isOpen && d.cooldownRemainingMs === 0);
@@ -3234,22 +3573,11 @@ const collection = ({ strapi }) => ({
     return [...new Set(rows.map((r) => r.card?.id).filter(Boolean))];
   },
   /**
-   * Global rank = 1 + number of players owning more distinct season cards. Uses the link tables
-   * Strapi 5 creates for relations, resolved from metadata so table names never get hardcoded.
+   * Global rank = 1 + the number of collectors with a better standing: rarity-weighted score, then distinct
+   * cards, then total cards (utils/score.js). Null before the first card.
    */
-  async rank(player2, season2, myUnique) {
-    if (myUnique === 0) return null;
-    const knex = strapi.db.connection;
-    const md = strapi.db.metadata.get(UID.PLAYER_CARD);
-    const pcTable = md.tableName;
-    const playerLnk = md.attributes.player.joinTable;
-    const cardLnk = md.attributes.card.joinTable;
-    const cardMd = strapi.db.metadata.get(UID.CARD);
-    const seasonLnk = cardMd.attributes.season.joinTable;
-    const seasonId = season2.id;
-    const sub = knex(`${pcTable} as pc`).join(`${playerLnk.name} as pl`, "pl." + playerLnk.joinColumn.name, "pc.id").join(`${cardLnk.name} as cl`, "cl." + cardLnk.joinColumn.name, "pc.id").join(`${seasonLnk.name} as sl`, "sl." + seasonLnk.joinColumn.name, "cl." + cardLnk.inverseJoinColumn.name).where("sl." + seasonLnk.inverseJoinColumn.name, seasonId).groupBy("pl." + playerLnk.inverseJoinColumn.name).select("pl." + playerLnk.inverseJoinColumn.name + " as player_id").countDistinct("cl." + cardLnk.inverseJoinColumn.name + " as unique_cards");
-    const row = await knex.from(sub.as("ranked")).where("ranked.unique_cards", ">", myUnique).count("* as better").first();
-    return Number(row?.better ?? 0) + 1;
+  async rank(player2, season2) {
+    return (await strapi.plugin("tcg").service("stats").standingFor(player2, season2)).rank;
   },
   async stats(player2, season2) {
     const plugin = strapi.plugin("tcg");
@@ -3285,16 +3613,26 @@ const collection = ({ strapi }) => ({
       populate: { pack: { select: ["id"] }, card: { select: ["id"] } }
     });
     const byPack = packs.map((p) => {
-      const cardIds = [...new Set(packRows.filter((r) => r.pack?.id === p.id).map((r) => r.card?.id).filter(Boolean))];
+      const cardIds = [
+        ...new Set(
+          packRows.filter((r) => r.pack?.id === p.id).map((r) => r.card?.id).filter(Boolean)
+        )
+      ];
       const collected = cardIds.filter((id) => ownedIds.has(id)).length;
-      return { pack: format2.pack(p), collected, total: cardIds.length, isComplete: cardIds.length > 0 && collected === cardIds.length };
+      return {
+        pack: format2.pack(p),
+        collected,
+        total: cardIds.length,
+        isComplete: cardIds.length > 0 && collected === cardIds.length
+      };
     });
     const tier = plugin.service("season").tierFor(season2, completion);
-    const [sets, badges, metrics, live] = await Promise.all([
+    const [sets, badges, metrics, live, standing] = await Promise.all([
       plugin.service("set").list(season2, { includeInactive: false }),
       plugin.service("badge").forPlayer(player2, season2),
       plugin.service("badge").metrics(player2, season2),
-      plugin.service("boost").liveNow(season2)
+      plugin.service("boost").liveNow(season2),
+      plugin.service("stats").standingFor(player2, season2)
     ]);
     return {
       sets: plugin.service("set").progress(sets, ownedIds, season2),
@@ -3305,7 +3643,13 @@ const collection = ({ strapi }) => ({
       uniqueCards: ownedIds.size,
       catalogTotal,
       completionPercentage: completion,
-      globalRank: await this.rank(player2, season2, ownedIds.size),
+      globalRank: standing.rank,
+      score: standing.score,
+      scoreBreakdown: {
+        cards: standing.cardScore,
+        setBonus: standing.setBonus,
+        setsCompleted: standing.setsCompleted
+      },
       rankTier: { key: tier.key, label: tier.label },
       season: format2.season(season2),
       byRarity,
@@ -3319,7 +3663,14 @@ const collection = ({ strapi }) => ({
     const mintNumber = await strapi.plugin("tcg").service("pull").claimSlot(UID.CARD, card2.id, "minted", null);
     const pc = await strapi.db.transaction(async () => {
       const row = await strapi.db.query(UID.PLAYER_CARD).create({
-        data: { player: player2.id, card: card2.id, pack: pack2?.id ?? null, acquiredFrom: "grant", acquiredAt: now, mintNumber }
+        data: {
+          player: player2.id,
+          card: card2.id,
+          pack: pack2?.id ?? null,
+          acquiredFrom: "grant",
+          acquiredAt: now,
+          mintNumber
+        }
       });
       await strapi.db.query(UID.PLAYER).update({ where: { id: player2.id }, data: { totalCards: (player2.totalCards ?? 0) + 1 } });
       return row;
@@ -3331,28 +3682,46 @@ const trade = ({ strapi }) => ({
   /** Player-card rows owned by `player` among `documentIds`; throws if any is missing. */
   async ownedRows(player2, documentIds, season2) {
     const ids = [...new Set((documentIds ?? []).map(String))];
-    if (ids.length === 0) throw badRequest(ERROR_CODES.VALIDATION, "Sélectionnez au moins une carte.");
+    if (ids.length === 0)
+      throw badRequest(ERROR_CODES.VALIDATION, "Sélectionnez au moins une carte.");
     const rows = await strapi.db.query(UID.PLAYER_CARD).findMany({
-      where: { player: player2.id, documentId: { $in: ids }, ...season2 ? { card: { season: season2.id } } : {} },
+      where: {
+        player: player2.id,
+        documentId: { $in: ids },
+        ...season2 ? { card: { season: season2.id } } : {}
+      },
       populate: { card: { populate: { image: true } } }
     });
-    if (rows.length !== ids.length) throw badRequest(ERROR_CODES.CARD_NOT_OWNED, "Vous ne possédez pas toutes ces cartes.");
+    if (rows.length !== ids.length)
+      throw badRequest(ERROR_CODES.CARD_NOT_OWNED, "Vous ne possédez pas toutes ces cartes.");
     return rows;
   },
   async createOffer(player2, season2, { cardIds }) {
     const plugin = strapi.plugin("tcg");
     const limits = plugin.service("season").limitsOf(season2);
     if ((cardIds ?? []).length > limits.maxCardsPerTrade) {
-      throw unprocessable(ERROR_CODES.TRADE_TOO_MANY_CARDS, `Maximum ${limits.maxCardsPerTrade} cartes par échange.`);
+      throw unprocessable(
+        ERROR_CODES.TRADE_TOO_MANY_CARDS,
+        `Maximum ${limits.maxCardsPerTrade} cartes par échange.`
+      );
     }
-    const active = await strapi.db.query(UID.TRADE_OFFER).count({ where: { initiator: player2.id, status: TRADE_STATUS.PENDING } });
+    const active = await strapi.db.query(UID.TRADE_OFFER).count({ where: { initiator: player2.id, status: { $in: TRADE_OPEN_STATUSES } } });
     if (active >= limits.maxActiveTradeOffers) {
-      throw unprocessable(ERROR_CODES.TRADE_LIMIT, `Maximum ${limits.maxActiveTradeOffers} offres actives.`);
+      throw unprocessable(
+        ERROR_CODES.TRADE_LIMIT,
+        `Maximum ${limits.maxActiveTradeOffers} offres actives.`
+      );
     }
     const rows = await this.ownedRows(player2, cardIds, season2);
     const expiresAt = new Date(Date.now() + limits.tradeOfferExpiryMs);
     const offer = await strapi.db.query(UID.TRADE_OFFER).create({
-      data: { initiator: player2.id, season: season2.id, status: TRADE_STATUS.PENDING, offeredCardIds: rows.map((r) => r.documentId), expiresAt }
+      data: {
+        initiator: player2.id,
+        season: season2.id,
+        status: TRADE_STATUS.PENDING,
+        offeredCardIds: rows.map((r) => r.documentId),
+        expiresAt
+      }
     });
     const { token } = plugin.service("qr").forTrade(offer, player2, limits.tradeOfferExpiryMs);
     await strapi.db.query(UID.TRADE_OFFER).update({ where: { id: offer.id }, data: { qrToken: token } });
@@ -3368,68 +3737,184 @@ const trade = ({ strapi }) => ({
   async findOffer(documentId) {
     const offer = await strapi.db.query(UID.TRADE_OFFER).findOne({
       where: { documentId },
-      populate: { initiator: true, season: true }
+      populate: { initiator: true, receiver: true, season: true }
     });
     if (!offer) throw notFound(ERROR_CODES.TRADE_NOT_FOUND, "Offre introuvable.");
     return offer;
   },
+  /** Alive and not past its expiry; otherwise the status names why. */
   assertOpen(offer) {
-    if (offer.status !== TRADE_STATUS.PENDING) throw unprocessable(ERROR_CODES.TRADE_INVALID_STATUS, `Cette offre est ${offer.status}.`);
-    if (/* @__PURE__ */ new Date() > new Date(offer.expiresAt)) throw unprocessable(ERROR_CODES.TRADE_EXPIRED, "Cette offre a expiré.");
+    if (!TRADE_OPEN_STATUSES.includes(offer.status))
+      throw unprocessable(ERROR_CODES.TRADE_INVALID_STATUS, `Cette offre est ${offer.status}.`);
+    if (/* @__PURE__ */ new Date() > new Date(offer.expiresAt))
+      throw unprocessable(ERROR_CODES.TRADE_EXPIRED, "Cette offre a expiré.");
   },
-  async describe(offer, season2) {
+  async cardsOf(ids, season2) {
     const format2 = strapi.plugin("tcg").service("format");
+    if (!ids?.length) return [];
     const rows = await strapi.db.query(UID.PLAYER_CARD).findMany({
-      where: { documentId: { $in: offer.offeredCardIds ?? [] } },
+      where: { documentId: { $in: ids } },
       populate: { card: { populate: { image: true } } }
     });
+    return rows.map((r) => format2.playerCard(r, season2));
+  },
+  /**
+   * The offer as both players see it: who is on each side, what each side puts in, where the
+   * handshake stands. `role` is the caller's seat when a player is given.
+   */
+  async describe(offer, season2, viewer = null) {
+    const [offeredCards, receiverCards] = await Promise.all([
+      this.cardsOf(offer.offeredCardIds, season2),
+      this.cardsOf(offer.receiverCardIds, season2)
+    ]);
+    const who = (p) => p ? { code: p.code, displayName: p.displayName } : null;
+    const role = !viewer ? null : offer.initiator?.id === viewer.id ? "initiator" : offer.receiver?.id === viewer.id ? "receiver" : null;
     return {
       id: offer.documentId,
       status: offer.status,
       expiresAt: offer.expiresAt,
-      initiator: offer.initiator ? { code: offer.initiator.code, displayName: offer.initiator.displayName } : null,
-      offeredCards: rows.map((r) => format2.playerCard(r, season2))
+      initiator: who(offer.initiator),
+      receiver: who(offer.receiver),
+      offeredCards,
+      receiverCards,
+      joinedAt: offer.joinedAt ?? null,
+      proposedAt: offer.proposedAt ?? null,
+      declinedAt: offer.declinedAt ?? null,
+      role
     };
   },
-  /** The receiver scans the initiator's QR. The token is NOT burned here; acceptance burns it. */
+  /** The receiver scans the initiator's signed QR: same as joining by id. */
   async scan(player2, qrToken) {
     const peek = peekToken(qrToken);
-    if (!peek || peek.kind !== "trade") throw badRequest(ERROR_CODES.QR_INVALID, "QR code invalide.");
-    if (peek.playerId === player2.documentId) throw badRequest(ERROR_CODES.TRADE_SELF, "Vous ne pouvez pas scanner votre propre offre.");
+    if (!peek || peek.kind !== "trade")
+      throw badRequest(ERROR_CODES.QR_INVALID, "QR code invalide.");
     const offer = await this.findOffer(peek.offerId);
     if (offer.qrToken !== qrToken) throw badRequest(ERROR_CODES.QR_INVALID, "QR code invalide.");
-    this.assertOpen(offer);
-    return this.describe(offer, offer.season);
+    return this.join(player2, offer.documentId);
   },
   /**
-   * Atomic swap. `cardIds` are the receiver's player-card documentIds.
+   * A receiver takes the seat opposite the initiator. Idempotent for the same receiver; refused
+   * while another receiver holds the seat, so two phones cannot answer one QR at once.
    */
-  async accept(receiver, offerDocumentId, { cardIds }) {
+  async join(player2, offerDocumentId) {
+    const offer = await this.findOffer(offerDocumentId);
+    if (offer.initiator?.id === player2.id)
+      throw badRequest(ERROR_CODES.TRADE_SELF, "Vous ne pouvez pas rejoindre votre propre offre.");
+    this.assertOpen(offer);
+    if (offer.receiver && offer.receiver.id !== player2.id) {
+      throw unprocessable(
+        ERROR_CODES.TRADE_INVALID_STATUS,
+        "Un autre joueur est déjà sur cette offre."
+      );
+    }
+    if (!offer.receiver) {
+      await strapi.db.query(UID.TRADE_OFFER).update({
+        where: { id: offer.id },
+        data: {
+          receiver: player2.id,
+          status: TRADE_STATUS.JOINED,
+          joinedAt: /* @__PURE__ */ new Date(),
+          receiverCardIds: null,
+          declinedAt: null
+        }
+      });
+    }
+    return this.describe(await this.findOffer(offerDocumentId), offer.season, player2);
+  },
+  /** The receiver says what they give. Replaces a previous proposal; the initiator must confirm. */
+  async propose(player2, offerDocumentId, { cardIds }) {
     const plugin = strapi.plugin("tcg");
     const offer = await this.findOffer(offerDocumentId);
+    if (offer.initiator?.id === player2.id)
+      throw badRequest(
+        ERROR_CODES.TRADE_SELF,
+        "Vous ne pouvez pas proposer sur votre propre offre."
+      );
     this.assertOpen(offer);
-    if (offer.initiator?.id === receiver.id) throw badRequest(ERROR_CODES.TRADE_SELF, "Vous ne pouvez pas accepter votre propre offre.");
+    if (offer.receiver && offer.receiver.id !== player2.id) {
+      throw unprocessable(
+        ERROR_CODES.TRADE_INVALID_STATUS,
+        "Un autre joueur est déjà sur cette offre."
+      );
+    }
     const season2 = offer.season;
     const limits = plugin.service("season").limitsOf(season2);
     if ((cardIds ?? []).length > limits.maxCardsPerTrade) {
-      throw unprocessable(ERROR_CODES.TRADE_TOO_MANY_CARDS, `Maximum ${limits.maxCardsPerTrade} cartes par échange.`);
+      throw unprocessable(
+        ERROR_CODES.TRADE_TOO_MANY_CARDS,
+        `Maximum ${limits.maxCardsPerTrade} cartes par échange.`
+      );
+    }
+    const rows = await this.ownedRows(player2, cardIds, season2);
+    await strapi.db.query(UID.TRADE_OFFER).update({
+      where: { id: offer.id },
+      data: {
+        receiver: player2.id,
+        status: TRADE_STATUS.PROPOSED,
+        receiverCardIds: rows.map((r) => r.documentId),
+        joinedAt: offer.joinedAt ?? /* @__PURE__ */ new Date(),
+        proposedAt: /* @__PURE__ */ new Date(),
+        declinedAt: null
+      }
+    });
+    return this.describe(await this.findOffer(offerDocumentId), season2, player2);
+  },
+  /** The initiator sends the proposal back; the receiver keeps the seat and can propose again. */
+  async decline(player2, offerDocumentId) {
+    const offer = await this.findOffer(offerDocumentId);
+    if (offer.initiator?.id !== player2.id)
+      throw forbidden(
+        ERROR_CODES.TRADE_FORBIDDEN,
+        "Seul l’auteur de l’offre peut refuser une proposition."
+      );
+    this.assertOpen(offer);
+    if (offer.status !== TRADE_STATUS.PROPOSED)
+      throw unprocessable(ERROR_CODES.TRADE_INVALID_STATUS, "Aucune proposition à refuser.");
+    await strapi.db.query(UID.TRADE_OFFER).update({
+      where: { id: offer.id },
+      data: { status: TRADE_STATUS.JOINED, receiverCardIds: null, declinedAt: /* @__PURE__ */ new Date() }
+    });
+    return this.describe(await this.findOffer(offerDocumentId), offer.season, player2);
+  },
+  /**
+   * The initiator confirms the proposal: the atomic swap. Both players have said yes by now —
+   * the receiver by proposing, the initiator here.
+   */
+  async confirm(initiator, offerDocumentId) {
+    const plugin = strapi.plugin("tcg");
+    const offer = await this.findOffer(offerDocumentId);
+    if (offer.initiator?.id !== initiator.id)
+      throw forbidden(
+        ERROR_CODES.TRADE_FORBIDDEN,
+        "Seul l’auteur de l’offre peut confirmer l’échange."
+      );
+    this.assertOpen(offer);
+    if (offer.status !== TRADE_STATUS.PROPOSED || !offer.receiver)
+      throw unprocessable(ERROR_CODES.TRADE_INVALID_STATUS, "Aucune proposition à confirmer.");
+    const receiver = offer.receiver;
+    const season2 = offer.season;
+    const receiverRows = await strapi.db.query(UID.PLAYER_CARD).findMany({
+      where: { player: receiver.id, documentId: { $in: offer.receiverCardIds ?? [] } }
+    });
+    if (receiverRows.length !== (offer.receiverCardIds ?? []).length || receiverRows.length === 0) {
+      throw unprocessable(ERROR_CODES.CARD_NOT_OWNED, "L'autre joueur ne possède plus ces cartes.");
     }
-    const receiverRows = await this.ownedRows(receiver, cardIds, season2);
     const initiatorRows = await strapi.db.query(UID.PLAYER_CARD).findMany({
-      where: { player: offer.initiator.id, documentId: { $in: offer.offeredCardIds ?? [] } }
+      where: { player: initiator.id, documentId: { $in: offer.offeredCardIds ?? [] } }
     });
     if (initiatorRows.length !== (offer.offeredCardIds ?? []).length) {
-      throw unprocessable(ERROR_CODES.CARD_NOT_OWNED, "L'autre joueur ne possède plus ces cartes.");
+      throw unprocessable(ERROR_CODES.CARD_NOT_OWNED, "Vous ne possédez plus ces cartes.");
     }
     const now = /* @__PURE__ */ new Date();
     const trade2 = await strapi.db.transaction(async () => {
       const fresh = await strapi.db.query(UID.TRADE_OFFER).findOne({ where: { id: offer.id }, select: ["status"] });
-      if (fresh.status !== TRADE_STATUS.PENDING) throw unprocessable(ERROR_CODES.TRADE_INVALID_STATUS, "Offre déjà traitée.");
+      if (fresh.status !== TRADE_STATUS.PROPOSED)
+        throw unprocessable(ERROR_CODES.TRADE_INVALID_STATUS, "Offre déjà traitée.");
       await strapi.db.query(UID.TRADE_OFFER).update({ where: { id: offer.id }, data: { status: TRADE_STATUS.ACCEPTED } });
       const t = await strapi.db.query(UID.TRADE).create({
         data: {
           offer: offer.id,
-          initiator: offer.initiator.id,
+          initiator: initiator.id,
           receiver: receiver.id,
           season: season2.id,
           initiatorCardIds: initiatorRows.map((r) => r.documentId),
@@ -3438,53 +3923,127 @@ const trade = ({ strapi }) => ({
         }
       });
       for (const row of initiatorRows) {
-        await strapi.db.query(UID.PLAYER_CARD).update({ where: { id: row.id }, data: { player: receiver.id, acquiredFrom: ACQUISITION.TRADE, acquiredAt: now, sourceTrade: t.id } });
+        await strapi.db.query(UID.PLAYER_CARD).update({
+          where: { id: row.id },
+          data: {
+            player: receiver.id,
+            acquiredFrom: ACQUISITION.TRADE,
+            acquiredAt: now,
+            sourceTrade: t.id
+          }
+        });
       }
       for (const row of receiverRows) {
-        await strapi.db.query(UID.PLAYER_CARD).update({ where: { id: row.id }, data: { player: offer.initiator.id, acquiredFrom: ACQUISITION.TRADE, acquiredAt: now, sourceTrade: t.id } });
+        await strapi.db.query(UID.PLAYER_CARD).update({
+          where: { id: row.id },
+          data: {
+            player: initiator.id,
+            acquiredFrom: ACQUISITION.TRADE,
+            acquiredAt: now,
+            sourceTrade: t.id
+          }
+        });
       }
       const delta = receiverRows.length - initiatorRows.length;
       await strapi.db.query(UID.PLAYER).update({
-        where: { id: offer.initiator.id },
-        data: { totalTrades: (offer.initiator.totalTrades ?? 0) + 1, totalCards: Math.max(0, (offer.initiator.totalCards ?? 0) + delta), lastActiveAt: now }
+        where: { id: initiator.id },
+        data: {
+          totalTrades: (initiator.totalTrades ?? 0) + 1,
+          totalCards: Math.max(0, (initiator.totalCards ?? 0) + delta),
+          lastActiveAt: now
+        }
       });
       await strapi.db.query(UID.PLAYER).update({
         where: { id: receiver.id },
-        data: { totalTrades: (receiver.totalTrades ?? 0) + 1, totalCards: Math.max(0, (receiver.totalCards ?? 0) - delta), lastActiveAt: now }
+        data: {
+          totalTrades: (receiver.totalTrades ?? 0) + 1,
+          totalCards: Math.max(0, (receiver.totalCards ?? 0) - delta),
+          lastActiveAt: now
+        }
       });
       return t;
     });
-    strapi.log.info(`[tcg] trade ${offer.initiator.code} ⇄ ${receiver.code} (${initiatorRows.length}:${receiverRows.length})`);
+    strapi.log.info(
+      `[tcg] trade ${initiator.code} ⇄ ${receiver.code} (${initiatorRows.length}:${receiverRows.length})`
+    );
     const badge2 = plugin.service("badge");
-    const [unlocked] = await Promise.all([badge2.evaluate(receiver, season2, { event: "trade" }), badge2.evaluate(offer.initiator, season2, { event: "trade" })]);
-    return { id: trade2.documentId, offerId: offer.documentId, completedAt: now, received: initiatorRows.length, given: receiverRows.length, unlocked };
+    const [unlocked, receiverUnlocked] = await Promise.all([
+      badge2.evaluate(initiator, season2, { event: "trade" }),
+      badge2.evaluate(receiver, season2, { event: "trade" })
+    ]);
+    return {
+      id: trade2.documentId,
+      offerId: offer.documentId,
+      completedAt: now,
+      received: receiverRows.length,
+      given: initiatorRows.length,
+      unlocked,
+      receiverUnlocked
+    };
   },
+  /** The receiver leaves: the seat frees up, the initiator's QR stays valid for someone else. */
   async reject(player2, offerDocumentId) {
     const offer = await this.findOffer(offerDocumentId);
+    if (offer.initiator?.id === player2.id)
+      throw badRequest(ERROR_CODES.TRADE_SELF, "Utilisez « annuler » pour votre propre offre.");
+    if (!offer.receiver || offer.receiver.id !== player2.id)
+      throw forbidden(ERROR_CODES.TRADE_FORBIDDEN, "Vous n’êtes pas sur cette offre.");
     this.assertOpen(offer);
-    if (offer.initiator?.id === player2.id) throw badRequest(ERROR_CODES.TRADE_SELF, "Utilisez « annuler » pour votre propre offre.");
-    await strapi.db.query(UID.TRADE_OFFER).update({ where: { id: offer.id }, data: { status: TRADE_STATUS.REJECTED } });
+    await strapi.db.query(UID.TRADE_OFFER).update({
+      where: { id: offer.id },
+      data: {
+        status: TRADE_STATUS.PENDING,
+        receiver: null,
+        receiverCardIds: null,
+        joinedAt: null,
+        proposedAt: null,
+        declinedAt: null
+      }
+    });
     return { ok: true };
   },
   async cancel(player2, offerDocumentId) {
     const offer = await this.findOffer(offerDocumentId);
-    if (offer.initiator?.id !== player2.id) throw forbidden(ERROR_CODES.TRADE_FORBIDDEN, "Vous ne pouvez annuler que vos offres.");
-    if (offer.status !== TRADE_STATUS.PENDING) throw unprocessable(ERROR_CODES.TRADE_INVALID_STATUS, `Cette offre est déjà ${offer.status}.`);
+    if (offer.initiator?.id !== player2.id)
+      throw forbidden(ERROR_CODES.TRADE_FORBIDDEN, "Vous ne pouvez annuler que vos offres.");
+    if (!TRADE_OPEN_STATUSES.includes(offer.status))
+      throw unprocessable(
+        ERROR_CODES.TRADE_INVALID_STATUS,
+        `Cette offre est déjà ${offer.status}.`
+      );
     await strapi.db.query(UID.TRADE_OFFER).update({ where: { id: offer.id }, data: { status: TRADE_STATUS.CANCELLED } });
     return { ok: true };
   },
+  /** The player's live offers, on either seat, newest first — what a reopened screen resumes. */
   async activeOffers(player2, season2) {
     const offers = await strapi.db.query(UID.TRADE_OFFER).findMany({
-      where: { initiator: player2.id, season: season2.id, status: TRADE_STATUS.PENDING, expiresAt: { $gt: /* @__PURE__ */ new Date() } },
-      populate: { initiator: true },
+      where: {
+        season: season2.id,
+        status: { $in: TRADE_OPEN_STATUSES },
+        expiresAt: { $gt: /* @__PURE__ */ new Date() },
+        $or: [{ initiator: player2.id }, { receiver: player2.id }]
+      },
+      populate: { initiator: true, receiver: true },
       orderBy: { createdAt: "desc" }
     });
-    return Promise.all(offers.map((o) => this.describe(o, season2).then((d) => ({ ...d, qrToken: o.qrToken }))));
+    return Promise.all(
+      offers.map(
+        (o) => this.describe(o, season2, player2).then(
+          (d) => o.initiator?.id === player2.id ? { ...d, qrToken: o.qrToken } : d
+        )
+      )
+    );
   },
   async history(player2, season2, page) {
     const where = { season: season2.id, $or: [{ initiator: player2.id }, { receiver: player2.id }] };
     const [items, total] = await Promise.all([
-      strapi.db.query(UID.TRADE).findMany({ where, populate: { initiator: true, receiver: true }, orderBy: { completedAt: "desc" }, offset: page.offset, limit: page.limit }),
+      strapi.db.query(UID.TRADE).findMany({
+        where,
+        populate: { initiator: true, receiver: true },
+        orderBy: { completedAt: "desc" },
+        offset: page.offset,
+        limit: page.limit
+      }),
       strapi.db.query(UID.TRADE).count({ where })
     ]);
     return {
@@ -3492,17 +4051,20 @@ const trade = ({ strapi }) => ({
         id: t.documentId,
         completedAt: t.completedAt,
         role: t.initiator?.id === player2.id ? "initiator" : "receiver",
-        counterpart: (t.initiator?.id === player2.id ? t.receiver : t.initiator) ? { code: (t.initiator?.id === player2.id ? t.receiver : t.initiator).code, displayName: (t.initiator?.id === player2.id ? t.receiver : t.initiator).displayName } : null,
+        counterpart: (t.initiator?.id === player2.id ? t.receiver : t.initiator) ? {
+          code: (t.initiator?.id === player2.id ? t.receiver : t.initiator).code,
+          displayName: (t.initiator?.id === player2.id ? t.receiver : t.initiator).displayName
+        } : null,
         given: (t.initiator?.id === player2.id ? t.initiatorCardIds : t.receiverCardIds) ?? [],
         received: (t.initiator?.id === player2.id ? t.receiverCardIds : t.initiatorCardIds) ?? []
       })),
       total
     };
   },
-  /** Marks pending offers past their expiry. */
+  /** Marks live offers past their expiry. */
   async sweep() {
     const { count } = await strapi.db.query(UID.TRADE_OFFER).updateMany({
-      where: { status: TRADE_STATUS.PENDING, expiresAt: { $lt: /* @__PURE__ */ new Date() } },
+      where: { status: { $in: TRADE_OPEN_STATUSES }, expiresAt: { $lt: /* @__PURE__ */ new Date() } },
       data: { status: TRADE_STATUS.EXPIRED }
     });
     return count ?? 0;
@@ -3623,6 +4185,8 @@ const redemption = ({ strapi }) => ({
     return { items: items.map((r) => format2.redemption(r)), total };
   }
 });
+const STANDINGS_TTL_MS = 10 * 1e3;
+const STANDINGS_CACHE = /* @__PURE__ */ new Map();
 const startOfToday = () => {
   const d = /* @__PURE__ */ new Date();
   d.setHours(0, 0, 0, 0);
@@ -3657,15 +4221,31 @@ const stats = ({ strapi }) => ({
       strapi.db.query(UID.PULL).count({ where: { ...seasonWhere, pulledAt: { $gte: since } } }),
       strapi.db.query(UID.PULL).count({ where: seasonWhere }),
       strapi.db.query(UID.TRADE).count({ where: { ...seasonWhere, completedAt: { $gte: since } } }),
-      strapi.db.query(UID.TRADE_OFFER).count({ where: { ...seasonWhere, status: TRADE_STATUS.PENDING, expiresAt: { $gt: /* @__PURE__ */ new Date() } } }),
+      strapi.db.query(UID.TRADE_OFFER).count({
+        where: { ...seasonWhere, status: TRADE_STATUS.PENDING, expiresAt: { $gt: /* @__PURE__ */ new Date() } }
+      }),
       strapi.db.query(UID.REDEMPTION).count({ where: { ...seasonWhere, status: REDEMPTION_STATUS.PENDING } }),
-      strapi.db.query(UID.REDEMPTION).count({ where: { ...seasonWhere, status: REDEMPTION_STATUS.FULFILLED, fulfilledAt: { $gte: since } } }),
+      strapi.db.query(UID.REDEMPTION).count({
+        where: {
+          ...seasonWhere,
+          status: REDEMPTION_STATUS.FULFILLED,
+          fulfilledAt: { $gte: since }
+        }
+      }),
       season2 ? strapi.db.query(UID.CARD).count({ where: { season: season2.id, isActive: true } }) : Promise.resolve(0),
       season2 ? strapi.db.query(UID.PACK).count({ where: { season: season2.id, isActive: true } }) : Promise.resolve(0),
-      strapi.db.query(UID.PULL).findMany({ where: { ...seasonWhere, pulledAt: { $gte: week } }, select: ["pulledAt", "rarity"] }),
+      strapi.db.query(UID.PULL).findMany({
+        where: { ...seasonWhere, pulledAt: { $gte: week } },
+        select: ["pulledAt", "rarity"]
+      }),
       strapi.db.query(UID.PULL).findMany({
         where: seasonWhere,
-        populate: { player: { select: ["code", "displayName"] }, card: { select: ["name", "rarity"] }, pack: { select: ["name"] }, drop: { select: ["name"] } },
+        populate: {
+          player: { select: ["code", "displayName"] },
+          card: { select: ["name", "rarity"] },
+          pack: { select: ["name"] },
+          drop: { select: ["name"] }
+        },
         orderBy: { pulledAt: "desc" },
         limit: 8
       })
@@ -3674,24 +4254,47 @@ const stats = ({ strapi }) => ({
       const day = daysAgo(6 - i);
       const next = new Date(day);
       next.setDate(day.getDate() + 1);
-      return { day: day.toISOString().slice(0, 10), pulls: weekPulls.filter((p) => new Date(p.pulledAt) >= day && new Date(p.pulledAt) < next).length };
+      return {
+        day: day.toISOString().slice(0, 10),
+        pulls: weekPulls.filter((p) => new Date(p.pulledAt) >= day && new Date(p.pulledAt) < next).length
+      };
     });
     const rarities = season2?.rarities ?? [];
     const plugin = strapi.plugin("tcg");
     const [liveBoosts, rewards, drops] = season2 ? await Promise.all([
       plugin.service("boost").liveNow(season2),
       plugin.service("reward").list(season2, { includeInactive: false }),
-      strapi.db.query(UID.DROP).findMany({ where: { pack: { season: season2.id }, isActive: true }, populate: { pack: { select: ["name"] } } })
+      strapi.db.query(UID.DROP).findMany({
+        where: { pack: { season: season2.id }, isActive: true },
+        populate: { pack: { select: ["name"] } }
+      })
     ]) : [[], [], []];
-    const lowStock = rewards.filter((r) => r.stock != null).map((r) => ({ id: r.documentId, name: r.name, remaining: Math.max(0, r.stock - (r.claimed ?? 0)), stock: r.stock })).filter((r) => r.remaining <= Math.max(3, Math.ceil(r.stock * 0.1))).sort((a, b) => a.remaining - b.remaining);
-    const dropStates = drops.map((d) => ({ id: d.documentId, name: `${d.pack?.name ?? ""} · ${d.name}`, mode: d.mode, scans: d.scanCount ?? 0, cap: d.maxScansTotal ?? null, isOpen: plugin.service("drop").isOpen(d) }));
+    const lowStock = rewards.filter((r) => r.stock != null).map((r) => ({
+      id: r.documentId,
+      name: r.name,
+      remaining: Math.max(0, r.stock - (r.claimed ?? 0)),
+      stock: r.stock
+    })).filter((r) => r.remaining <= Math.max(3, Math.ceil(r.stock * 0.1))).sort((a, b) => a.remaining - b.remaining);
+    const dropStates = drops.map((d) => ({
+      id: d.documentId,
+      name: `${d.pack?.name ?? ""} · ${d.name}`,
+      mode: d.mode,
+      scans: d.scanCount ?? 0,
+      cap: d.maxScansTotal ?? null,
+      isOpen: plugin.service("drop").isOpen(d)
+    }));
     return {
       liveBoosts,
       lowStock,
       drops: dropStates,
       season: season2 ? { id: season2.documentId, name: season2.name, slug: season2.slug, status: season2.status } : null,
       players: { total: players, today: playersToday },
-      pulls: { today: pullsToday, total: pullsTotal, sparkline, distribution: distribution(weekPulls, rarities) },
+      pulls: {
+        today: pullsToday,
+        total: pullsTotal,
+        sparkline,
+        distribution: distribution(weekPulls, rarities)
+      },
       trades: { today: tradesToday, pendingOffers },
       redemptions: { pending: pendingRedemptions, fulfilledToday },
       catalog: { cards, packs },
@@ -3708,21 +4311,75 @@ const stats = ({ strapi }) => ({
       }))
     };
   },
-  /** Top collectors by distinct cards owned in a season (admin leaderboard). */
-  async leaderboard(season2, limit = 10) {
-    const rows = await strapi.db.query(UID.PLAYER_CARD).findMany({
-      where: { card: { season: season2.id } },
-      populate: { player: { select: ["id", "documentId", "code", "displayName"] }, card: { select: ["id"] } }
-    });
+  /**
+   * Every collector's standing in a season (utils/score.js), sorted. Computed from every player card of
+   * the season and cached a few seconds: the rank is asked on every stats screen.
+   * @returns {Promise<Array<{player: Object, uniqueCards: number, totalCards: number, cardScore: number, setsCompleted: number, setBonus: number, score: number}>>}
+   */
+  async standings(season2) {
+    const cached = STANDINGS_CACHE.get(season2.id);
+    if (cached && Date.now() - cached.at < STANDINGS_TTL_MS) return cached.value;
+    const plugin = strapi.plugin("tcg");
+    const [rows, sets] = await Promise.all([
+      strapi.db.query(UID.PLAYER_CARD).findMany({
+        where: { card: { season: season2.id } },
+        populate: {
+          player: { select: ["id", "documentId", "code", "displayName"] },
+          card: { select: ["id", "rarity", "score"] }
+        }
+      }),
+      plugin.service("set").list(season2, { includeInactive: false })
+    ]);
+    const limits = plugin.service("season").limitsOf(season2);
     const byPlayer = /* @__PURE__ */ new Map();
     for (const r of rows) {
       if (!r.player || !r.card) continue;
-      const entry = byPlayer.get(r.player.id) ?? { player: r.player, unique: /* @__PURE__ */ new Set(), total: 0 };
-      entry.unique.add(r.card.id);
+      const entry = byPlayer.get(r.player.id) ?? { player: r.player, cards: /* @__PURE__ */ new Map(), total: 0 };
+      entry.cards.set(r.card.id, r.card);
       entry.total += 1;
       byPlayer.set(r.player.id, entry);
     }
-    return [...byPlayer.values()].map((e) => ({ player: { id: e.player.documentId, code: e.player.code, displayName: e.player.displayName }, uniqueCards: e.unique.size, totalCards: e.total })).sort((a, b) => b.uniqueCards - a.uniqueCards || b.totalCards - a.totalCards).slice(0, limit).map((e, i) => ({ rank: i + 1, ...e }));
+    const value = [...byPlayer.values()].map((e) => ({
+      player: e.player,
+      ...standingOf([...e.cards.values()], e.total, sets, season2, limits)
+    })).sort(compareStandings);
+    STANDINGS_CACHE.set(season2.id, { at: Date.now(), value });
+    return value;
+  },
+  /** Forget the cached standings (after a grant, a trade…); they rebuild on the next read. */
+  invalidateStandings(season2) {
+    if (season2) STANDINGS_CACHE.delete(season2.id);
+    else STANDINGS_CACHE.clear();
+  },
+  /** Where one player stands: rank among every collector, and the score's parts. Null rank with no card. */
+  async standingFor(player2, season2) {
+    const all = await this.standings(season2);
+    const mine = all.find((s) => s.player.id === player2.id);
+    if (!mine)
+      return {
+        rank: null,
+        uniqueCards: 0,
+        totalCards: 0,
+        cardScore: 0,
+        setsCompleted: 0,
+        setBonus: 0,
+        score: 0
+      };
+    return { rank: rankAmong(mine, all), ...mine, player: void 0 };
+  },
+  /** Top collectors by score (admin leaderboard). */
+  async leaderboard(season2, limit = 10) {
+    const all = await this.standings(season2);
+    return all.slice(0, limit).map((e, i) => ({
+      rank: i + 1,
+      player: { id: e.player.documentId, code: e.player.code, displayName: e.player.displayName },
+      score: e.score,
+      cardScore: e.cardScore,
+      setBonus: e.setBonus,
+      setsCompleted: e.setsCompleted,
+      uniqueCards: e.uniqueCards,
+      totalCards: e.totalCards
+    }));
   },
   /** Recent pulls for the audit screen. */
   async pulls(season2, { playerCode, rarity }, page) {
@@ -3732,7 +4389,12 @@ const stats = ({ strapi }) => ({
     const [items, total] = await Promise.all([
       strapi.db.query(UID.PULL).findMany({
         where,
-        populate: { player: { select: ["code", "displayName"] }, card: { select: ["name", "rarity", "number"] }, pack: { select: ["name", "slug"] }, drop: { select: ["name", "slug"] } },
+        populate: {
+          player: { select: ["code", "displayName"] },
+          card: { select: ["name", "rarity", "number"] },
+          pack: { select: ["name", "slug"] },
+          drop: { select: ["name", "slug"] }
+        },
         orderBy: { pulledAt: "desc" },
         offset: page.offset,
         limit: page.limit
@@ -3784,10 +4446,16 @@ const drop = ({ strapi }) => ({
     return drop2;
   },
   validate(data) {
-    if (data.mode && !Object.values(DROP_MODE).includes(data.mode)) throw badRequest(ERROR_CODES.VALIDATION, "Mode invalide.");
-    if (data.poolMode && !Object.values(POOL_MODE).includes(data.poolMode)) throw badRequest(ERROR_CODES.VALIDATION, "Mode de pool invalide.");
+    if (data.mode && !Object.values(DROP_MODE).includes(data.mode))
+      throw badRequest(ERROR_CODES.VALIDATION, "Mode invalide.");
+    if (data.poolMode && !Object.values(POOL_MODE).includes(data.poolMode))
+      throw badRequest(ERROR_CODES.VALIDATION, "Mode de pool invalide.");
     for (const k of ["maxScansTotal", "maxScansPerPlayer", "cooldownMs"]) {
-      if (data[k] != null && data[k] !== "" && !(Number(data[k]) >= 0)) throw badRequest(ERROR_CODES.VALIDATION, `${k} invalide.`);
+      if (data[k] != null && data[k] !== "" && !(Number(data[k]) >= 0))
+        throw badRequest(ERROR_CODES.VALIDATION, `${k} invalide.`);
+    }
+    if (data.cardsPerPull != null && data.cardsPerPull !== "" && !(Number.isInteger(Number(data.cardsPerPull)) && Number(data.cardsPerPull) >= 1 && Number(data.cardsPerPull) <= 10)) {
+      throw badRequest(ERROR_CODES.VALIDATION, "cardsPerPull doit être entre 1 et 10.");
     }
   },
   async create(pack2, data) {
@@ -3810,13 +4478,19 @@ const drop = ({ strapi }) => ({
   async ensureDefault(pack2) {
     const existing = await strapi.db.query(UID.DROP).findOne({ where: { pack: pack2.id, isDefault: true } });
     if (existing) return existing;
-    return this.create(pack2, { name: DEFAULT_DROP_NAME, mode: DROP_MODE.STATIC, isDefault: true, poolMode: POOL_MODE.INHERIT });
+    return this.create(pack2, {
+      name: DEFAULT_DROP_NAME,
+      mode: DROP_MODE.STATIC,
+      isDefault: true,
+      poolMode: POOL_MODE.INHERIT
+    });
   },
   async update(pack2, ref, data) {
     const drop2 = await this.findOne(pack2, ref);
     this.validate(data);
     const { cards, pack: _p, secret: _s, scanCount: _c, isDefault: _d, ...rest } = data;
-    if (rest.slug && rest.slug !== drop2.slug) rest.slug = await uniqueSlug(strapi, UID.DROP, rest.slug, { pack: pack2.id });
+    if (rest.slug && rest.slug !== drop2.slug)
+      rest.slug = await uniqueSlug(strapi, UID.DROP, rest.slug, { pack: pack2.id });
     const updated = await strapi.documents(UID.DROP).update({ documentId: drop2.documentId, data: rest });
     if (Array.isArray(cards)) await this.setCards(pack2, drop2.documentId, cards);
     return updated;
@@ -3828,9 +4502,17 @@ const drop = ({ strapi }) => ({
   },
   async remove(pack2, ref) {
     const drop2 = await this.findOne(pack2, ref);
-    if (drop2.isDefault) throw badRequest(ERROR_CODES.VALIDATION, "Le point de scan par défaut ne peut pas être supprimé : désactivez-le.");
+    if (drop2.isDefault)
+      throw badRequest(
+        ERROR_CODES.VALIDATION,
+        "Le point de scan par défaut ne peut pas être supprimé : désactivez-le."
+      );
     const pulls = await strapi.db.query(UID.PULL).count({ where: { drop: drop2.id } });
-    if (pulls > 0) throw badRequest(ERROR_CODES.VALIDATION, "Ce point a des tirages : désactivez-le au lieu de le supprimer.");
+    if (pulls > 0)
+      throw badRequest(
+        ERROR_CODES.VALIDATION,
+        "Ce point a des tirages : désactivez-le au lieu de le supprimer."
+      );
     await strapi.db.query(UID.DROP_CARD).deleteMany({ where: { drop: drop2.id } });
     await strapi.documents(UID.DROP).delete({ documentId: drop2.documentId });
     return { ok: true };
@@ -3839,15 +4521,28 @@ const drop = ({ strapi }) => ({
     const drop2 = await this.findOne(pack2, dropRef);
     const season2 = pack2.season?.id ? pack2.season : await strapi.db.query(UID.PACK).findOne({ where: { id: pack2.id }, populate: { season: true } }).then((p) => p.season);
     const docIds = [...new Set(entries.map((e) => typeof e === "string" ? e : e.card))];
-    const cards = docIds.length ? await strapi.db.query(UID.CARD).findMany({ where: { documentId: { $in: docIds }, season: season2.id }, select: ["id", "documentId"] }) : [];
-    if (cards.length !== docIds.length) throw badRequest(ERROR_CODES.VALIDATION, "Certaines cartes ne font pas partie de cette saison.");
+    const cards = docIds.length ? await strapi.db.query(UID.CARD).findMany({
+      where: { documentId: { $in: docIds }, season: season2.id },
+      select: ["id", "documentId"]
+    }) : [];
+    if (cards.length !== docIds.length)
+      throw badRequest(
+        ERROR_CODES.VALIDATION,
+        "Certaines cartes ne font pas partie de cette saison."
+      );
     const idByDoc = Object.fromEntries(cards.map((c) => [c.documentId, c.id]));
     await strapi.db.transaction(async () => {
       await strapi.db.query(UID.DROP_CARD).deleteMany({ where: { drop: drop2.id } });
       for (const e of entries) {
         const entry = typeof e === "string" ? { card: e } : e;
         await strapi.db.query(UID.DROP_CARD).create({
-          data: { drop: drop2.id, card: idByDoc[entry.card], weight: Number.isFinite(Number(entry.weight)) ? Number(entry.weight) : 100, isExclusive: Boolean(entry.isExclusive), isActive: entry.isActive !== false }
+          data: {
+            drop: drop2.id,
+            card: idByDoc[entry.card],
+            weight: Number.isFinite(Number(entry.weight)) ? Number(entry.weight) : 100,
+            isExclusive: Boolean(entry.isExclusive),
+            isActive: entry.isActive !== false
+          }
         });
       }
     });
@@ -3855,8 +4550,18 @@ const drop = ({ strapi }) => ({
   },
   async cards(pack2, ref) {
     const drop2 = await this.findOne(pack2, ref);
-    const rows = await strapi.db.query(UID.DROP_CARD).findMany({ where: { drop: drop2.id }, populate: { card: { populate: { image: true } } }, orderBy: { id: "asc" } });
-    return rows.filter((r) => r.card).map((r) => ({ id: r.documentId, weight: r.weight, isExclusive: r.isExclusive, isActive: r.isActive, card: r.card }));
+    const rows = await strapi.db.query(UID.DROP_CARD).findMany({
+      where: { drop: drop2.id },
+      populate: { card: { populate: { image: true } } },
+      orderBy: { id: "asc" }
+    });
+    return rows.filter((r) => r.card).map((r) => ({
+      id: r.documentId,
+      weight: r.weight,
+      isExclusive: r.isExclusive,
+      isActive: r.isActive,
+      card: r.card
+    }));
   },
   /**
    * Effective raw pool for a drop (before exclusivity/supply pruning): pack pool, drop pool, or both.
@@ -3870,25 +4575,46 @@ const drop = ({ strapi }) => ({
     });
     const ownEntries = own.filter((r) => r.card).map((r) => ({ ...r.card, weight: r.weight, isExclusive: r.isExclusive, source: "drop" }));
     const seen = new Set(ownEntries.map((c) => c.id));
-    return [...ownEntries, ...packPool.filter((c) => !seen.has(c.id)).map((c) => ({ ...c, source: "pack" }))];
+    return [
+      ...ownEntries,
+      ...packPool.filter((c) => !seen.has(c.id)).map((c) => ({ ...c, source: "pack" }))
+    ];
   },
   /** Card ids flagged exclusive on any pack-card or drop-card of a season. */
   async exclusiveCardIds(season2) {
     const [pc, dc] = await Promise.all([
-      strapi.db.query(UID.PACK_CARD).findMany({ where: { isExclusive: true, isActive: true, pack: { season: season2.id } }, populate: { card: { select: ["id"] } } }),
-      strapi.db.query(UID.DROP_CARD).findMany({ where: { isExclusive: true, isActive: true, drop: { pack: { season: season2.id } } }, populate: { card: { select: ["id"] } } })
+      strapi.db.query(UID.PACK_CARD).findMany({
+        where: { isExclusive: true, isActive: true, pack: { season: season2.id } },
+        populate: { card: { select: ["id"] } }
+      }),
+      strapi.db.query(UID.DROP_CARD).findMany({
+        where: { isExclusive: true, isActive: true, drop: { pack: { season: season2.id } } },
+        populate: { card: { select: ["id"] } }
+      })
     ]);
     return new Set([...pc, ...dc].map((r) => r.card?.id).filter(Boolean));
   },
   /** Where a card is exclusive, for the admin: [{ kind:'pack'|'drop', name, slug }]. */
   async exclusivityOf(cardId) {
     const [pc, dc] = await Promise.all([
-      strapi.db.query(UID.PACK_CARD).findMany({ where: { card: cardId, isExclusive: true }, populate: { pack: { select: ["name", "slug"] } } }),
-      strapi.db.query(UID.DROP_CARD).findMany({ where: { card: cardId, isExclusive: true }, populate: { drop: { select: ["name", "slug"], populate: { pack: { select: ["name"] } } } } })
+      strapi.db.query(UID.PACK_CARD).findMany({
+        where: { card: cardId, isExclusive: true },
+        populate: { pack: { select: ["name", "slug"] } }
+      }),
+      strapi.db.query(UID.DROP_CARD).findMany({
+        where: { card: cardId, isExclusive: true },
+        populate: {
+          drop: { select: ["name", "slug"], populate: { pack: { select: ["name"] } } }
+        }
+      })
     ]);
     return [
       ...pc.filter((r) => r.pack).map((r) => ({ kind: "pack", name: r.pack.name, slug: r.pack.slug })),
-      ...dc.filter((r) => r.drop).map((r) => ({ kind: "drop", name: `${r.drop.pack?.name ?? ""} · ${r.drop.name}`, slug: r.drop.slug }))
+      ...dc.filter((r) => r.drop).map((r) => ({
+        kind: "drop",
+        name: `${r.drop.pack?.name ?? ""} · ${r.drop.name}`,
+        slug: r.drop.slug
+      }))
     ];
   },
   /** Booth / poster token. */
@@ -3901,7 +4627,10 @@ const drop = ({ strapi }) => ({
   /** Public shape, exclusives revealed as count (+ names unless the drop is secret). */
   async publicView(drop2, pack2, season2) {
     const format2 = strapi.plugin("tcg").service("format");
-    const own = drop2.poolMode === POOL_MODE.INHERIT ? [] : await strapi.db.query(UID.DROP_CARD).findMany({ where: { drop: drop2.id, isActive: true, isExclusive: true }, populate: { card: true } });
+    const own = drop2.poolMode === POOL_MODE.INHERIT ? [] : await strapi.db.query(UID.DROP_CARD).findMany({
+      where: { drop: drop2.id, isActive: true, isExclusive: true },
+      populate: { card: true }
+    });
     return {
       id: drop2.documentId,
       name: drop2.name,
@@ -3910,12 +4639,18 @@ const drop = ({ strapi }) => ({
       mode: drop2.mode,
       isDefault: drop2.isDefault,
       isOpen: this.isOpen(drop2),
+      cardsPerPull: Math.max(1, Number(drop2.cardsPerPull) || 1),
       startsAt: drop2.startsAt ?? null,
       endsAt: drop2.endsAt ?? null,
       soldOut: drop2.maxScansTotal != null && drop2.scanCount >= drop2.maxScansTotal,
       remaining: drop2.maxScansTotal != null ? Math.max(0, drop2.maxScansTotal - drop2.scanCount) : null,
       exclusiveCount: own.length,
-      exclusiveCards: drop2.isSecret ? [] : own.filter((r) => r.card).map((r) => ({ id: r.card.documentId, name: r.card.name, rarity: r.card.rarity, rarityColor: format2.rarityMeta(season2, r.card.rarity).color })),
+      exclusiveCards: drop2.isSecret ? [] : own.filter((r) => r.card).map((r) => ({
+        id: r.card.documentId,
+        name: r.card.name,
+        rarity: r.card.rarity,
+        rarityColor: format2.rarityMeta(season2, r.card.rarity).color
+      })),
       geo: drop2.geo ?? null
     };
   }