@stamprally/core 0.1.0 → 0.2.1

package/dist/index.cjs

@@ -31,15 +31,15 @@ function contextTypeMismatch(conditionType, expectedContextType, actualContextTy
 function assertNever(value) {
   throw new Error(`Unexpected condition: ${JSON.stringify(value)}`);
 }
-function evaluateConditionDetailed(condition, context, now) {
-  switch (condition.type) {
+function evaluateConditionDetailed(condition2, context, now) {
+  switch (condition2.type) {
     case "instant":
       return context.type === "instant" ? { ok: true, value: { conditionType: "instant" } } : contextTypeMismatch("instant", "instant", context.type);
     case "token":
       if (context.type !== "token") {
         return contextTypeMismatch("token", "token", context.type);
       }
-      return context.token === condition.token ? { ok: true, value: { conditionType: "token" } } : {
+      return context.token === condition2.token ? { ok: true, value: { conditionType: "token" } } : {
         ok: false,
         error: {
           code: "CONDITION_MISMATCH",
@@ -51,7 +51,7 @@ function evaluateConditionDetailed(condition, context, now) {
       if (context.type !== "geo") {
         return contextTypeMismatch("geo", "geo", context.type);
       }
-      if (!isValidCoordinate(condition.latitude, condition.longitude) || !isValidCoordinate(context.currentLatitude, context.currentLongitude) || !Number.isFinite(condition.radiusMeters) || condition.radiusMeters < 0) {
+      if (!isValidCoordinate(condition2.latitude, condition2.longitude) || !isValidCoordinate(context.currentLatitude, context.currentLongitude) || !Number.isFinite(condition2.radiusMeters) || condition2.radiusMeters < 0) {
         return {
           ok: false,
           error: {
@@ -62,12 +62,12 @@ function evaluateConditionDetailed(condition, context, now) {
         };
       }
       const distanceMeters = calculateDistanceMeters(
-        condition.latitude,
-        condition.longitude,
+        condition2.latitude,
+        condition2.longitude,
         context.currentLatitude,
         context.currentLongitude
       );
-      if (distanceMeters <= condition.radiusMeters) {
+      if (distanceMeters <= condition2.radiusMeters) {
         return { ok: true, value: { conditionType: "geo", distanceMeters } };
       }
       return {
@@ -77,8 +77,8 @@ function evaluateConditionDetailed(condition, context, now) {
           conditionType: "geo",
           reason: "OUTSIDE_RADIUS",
           distanceMeters,
-          radiusMeters: condition.radiusMeters,
-          differenceMeters: distanceMeters - condition.radiusMeters
+          radiusMeters: condition2.radiusMeters,
+          differenceMeters: distanceMeters - condition2.radiusMeters
         }
       };
     }
@@ -86,31 +86,31 @@ function evaluateConditionDetailed(condition, context, now) {
       if (context.type !== "composite") {
         return contextTypeMismatch("composite", "composite", context.type);
       }
-      if (condition.conditions.length !== context.contexts.length) {
+      if (condition2.conditions.length !== context.contexts.length) {
         return {
           ok: false,
           error: {
             code: "CONDITION_MISMATCH",
             conditionType: "composite",
             reason: "CONTEXT_LENGTH_MISMATCH",
-            expectedCount: condition.conditions.length,
+            expectedCount: condition2.conditions.length,
             actualCount: context.contexts.length
           }
         };
       }
       const failures = [];
       let matchedCount = 0;
-      for (const [index, childCondition] of condition.conditions.entries()) {
+      for (const [index, childCondition] of condition2.conditions.entries()) {
         const childContext = context.contexts[index];
         if (childContext === void 0) continue;
         const result = evaluateConditionDetailed(childCondition, childContext, now);
         if (result.ok) matchedCount += 1;
         else failures.push({ index, error: result.error });
       }
-      if (condition.operator === "AND" && failures.length === 0) {
+      if (condition2.operator === "AND" && failures.length === 0) {
         return { ok: true, value: { conditionType: "composite" } };
       }
-      if (condition.operator === "OR" && matchedCount > 0) {
+      if (condition2.operator === "OR" && matchedCount > 0) {
         return { ok: true, value: { conditionType: "composite" } };
       }
       return {
@@ -118,14 +118,14 @@ function evaluateConditionDetailed(condition, context, now) {
         error: {
           code: "CONDITION_MISMATCH",
           conditionType: "composite",
-          reason: condition.operator === "AND" ? "AND_CHILD_FAILED" : "OR_ALL_FAILED",
+          reason: condition2.operator === "AND" ? "AND_CHILD_FAILED" : "OR_ALL_FAILED",
           failures
         }
       };
     }
     case "time_window": {
-      const startsAt = Date.parse(condition.startsAt);
-      const endsAt = Date.parse(condition.endsAt);
+      const startsAt = Date.parse(condition2.startsAt);
+      const endsAt = Date.parse(condition2.endsAt);
       const currentTime = Date.parse(now);
       if (!Number.isFinite(currentTime)) {
         return {
@@ -135,8 +135,8 @@ function evaluateConditionDetailed(condition, context, now) {
             conditionType: "time_window",
             reason: "INVALID_NOW",
             now,
-            startsAt: condition.startsAt,
-            endsAt: condition.endsAt
+            startsAt: condition2.startsAt,
+            endsAt: condition2.endsAt
           }
         };
       }
@@ -148,8 +148,8 @@ function evaluateConditionDetailed(condition, context, now) {
             conditionType: "time_window",
             reason: "INVALID_TIME_WINDOW",
             now,
-            startsAt: condition.startsAt,
-            endsAt: condition.endsAt
+            startsAt: condition2.startsAt,
+            endsAt: condition2.endsAt
           }
         };
       }
@@ -161,20 +161,65 @@ function evaluateConditionDetailed(condition, context, now) {
             conditionType: "time_window",
             reason: currentTime < startsAt ? "BEFORE_START" : "AFTER_END",
             now,
-            startsAt: condition.startsAt,
-            endsAt: condition.endsAt
+            startsAt: condition2.startsAt,
+            endsAt: condition2.endsAt
           }
         };
       }
-      const childResult = evaluateConditionDetailed(condition.condition, context, now);
+      const childResult = evaluateConditionDetailed(condition2.condition, context, now);
       return childResult.ok ? { ok: true, value: { conditionType: "time_window" } } : childResult;
     }
     default:
-      return assertNever(condition);
+      return assertNever(condition2);
   }
 }
-function evaluateCondition(condition, context, now) {
-  return evaluateConditionDetailed(condition, context, now ?? "").ok;
+function evaluateCondition(condition2, context, now) {
+  return evaluateConditionDetailed(condition2, context, now ?? "").ok;
+}
+
+// src/engine/checkIn.ts
+function unwrapContext(input) {
+  if ("verificationContext" in input) {
+    return {
+      context: input.verificationContext,
+      now: input.now ?? (/* @__PURE__ */ new Date()).toISOString(),
+      ...input.expectedStampId === void 0 ? {} : { expectedStampId: input.expectedStampId },
+      alreadyClaimed: input.alreadyClaimed ?? false
+    };
+  }
+  return {
+    context: input,
+    now: "now" in input && typeof input.now === "string" ? input.now : (/* @__PURE__ */ new Date()).toISOString(),
+    ..."expectedStampId" in input && typeof input.expectedStampId === "string" ? { expectedStampId: input.expectedStampId } : {},
+    alreadyClaimed: "alreadyClaimed" in input && input.alreadyClaimed === true
+  };
+}
+function evaluateCheckIn(spot, input) {
+  const context = unwrapContext(input);
+  if (context.alreadyClaimed) {
+    return {
+      ok: false,
+      success: false,
+      code: "ALREADY_CLAIMED",
+      stampId: spot.id,
+      message: "This spot has already been claimed."
+    };
+  }
+  if (context.expectedStampId !== void 0 && context.expectedStampId !== spot.id) {
+    return {
+      ok: false,
+      success: false,
+      code: "ORDER_VIOLATION",
+      stampId: spot.id,
+      message: `The next required spot is '${context.expectedStampId}'.`
+    };
+  }
+  const evaluated = evaluateConditionDetailed(spot.condition, context.context, context.now);
+  if (evaluated.ok) {
+    return { ok: true, success: true, stampId: spot.id, checkedAt: context.now };
+  }
+  const code = evaluated.error.reason === "OUTSIDE_RADIUS" ? "OUT_OF_RANGE" : evaluated.error.reason === "BEFORE_START" || evaluated.error.reason === "AFTER_END" ? "EXPIRED" : evaluated.error.reason === "TOKEN_MISMATCH" ? "INVALID_PROOF" : "INVALID_CONTEXT";
+  return { ok: false, success: false, code, stampId: spot.id, message: evaluated.error.reason };
 }
 
 // src/engine/order.ts
@@ -206,6 +251,26 @@ function calculateProgress(state, config) {
   };
 }
 
+// src/engine/rewards.ts
+function hash(value) {
+  let result = 2166136261;
+  for (const character of value) {
+    result ^= character.codePointAt(0) ?? 0;
+    result = Math.imul(result, 16777619) >>> 0;
+  }
+  return result.toString(36).toUpperCase().padStart(7, "0");
+}
+function createClaimTicketNumber(rewardId, options = {}) {
+  const issuedAt = options.issuedAt ?? "";
+  const sequence = options.sequence ?? 0;
+  return `SR-${hash(`${rewardId}|${issuedAt}|${sequence}`)}`;
+}
+function issueClaimTicketNumber(reward, currentState, options = {}) {
+  if (currentState.claimTicketNumber !== void 0) return currentState;
+  const claimTicketNumber = reward.claimTicketNumber ?? createClaimTicketNumber(reward.id, options);
+  return { ...currentState, claimTicketNumber };
+}
+
 // src/detectors/types.ts
 function createDetectorError(detector, code, message, cause) {
   return cause === void 0 ? { detector, code, message } : { detector, code, message, cause };
@@ -410,9 +475,9 @@ function normalizePasscode(input, caseSensitive = false) {
   const normalized = input.normalize("NFKC").trim();
   return caseSensitive ? normalized : normalized.toUpperCase();
 }
-function verifyPasscode(inputCode, condition) {
-  const input = normalizePasscode(inputCode, condition.caseSensitive);
-  const expected = normalizePasscode(condition.passcode, condition.caseSensitive);
+function verifyPasscode(inputCode, condition2) {
+  const input = normalizePasscode(inputCode, condition2.caseSensitive);
+  const expected = normalizePasscode(condition2.passcode, condition2.caseSensitive);
   return input === expected ? { success: true } : {
     success: false,
     reason: "INVALID_PASSCODE",
@@ -549,12 +614,23 @@ function reconcileRewardStates(rewards, currentStates, acquiredStampCount, now)
     if (current?.status === "CONSUMED" || current?.status === "EXPIRED") {
       return current;
     }
+    if (reward.validUntil !== void 0 && Date.parse(reward.validUntil) <= Date.parse(now)) {
+      return { rewardId: reward.id, status: "EXPIRED" };
+    }
+    if (reward.maxStock !== void 0 && (current?.redeemedCount ?? 0) >= reward.maxStock) {
+      return {
+        rewardId: reward.id,
+        status: "EXPIRED",
+        ...current?.claimTicketNumber === void 0 ? {} : { claimTicketNumber: current.claimTicketNumber }
+      };
+    }
     if (acquiredStampCount >= reward.requiredStampCount) {
       if (current?.status === "AVAILABLE") return current;
       return {
         rewardId: reward.id,
         status: "AVAILABLE",
-        unlockedAt: current?.unlockedAt ?? now
+        unlockedAt: current?.unlockedAt ?? now,
+        ...current?.claimTicketNumber === void 0 ? {} : { claimTicketNumber: current.claimTicketNumber }
       };
     }
     if (current?.status === "LOCKED" && current.unlockedAt === void 0) return current;
@@ -575,6 +651,15 @@ function consumeReward(params) {
       error: { code: "NOT_AVAILABLE", rewardId: reward.id }
     };
   }
+  if (reward.validUntil !== void 0 && Date.parse(reward.validUntil) <= Date.parse(params.now)) {
+    return { ok: false, error: { code: "EXPIRED", rewardId: reward.id } };
+  }
+  if (reward.maxStock !== void 0 && (currentState.redeemedCount ?? 0) >= reward.maxStock) {
+    return { ok: false, error: { code: "OUT_OF_STOCK", rewardId: reward.id } };
+  }
+  if (reward.limitPerUser !== void 0 && (params.userRedemptionCount ?? currentState.userRedemptionCount ?? 0) >= reward.limitPerUser) {
+    return { ok: false, error: { code: "USER_LIMIT_REACHED", rewardId: reward.id } };
+  }
   if (reward.redemptionMethod === "staff_passcode") {
     const passcodeResult = reward.staffPasscode === void 0 ? null : verifyPasscode(params.inputPasscode ?? "", { passcode: reward.staffPasscode });
     if (passcodeResult === null || !passcodeResult.success) {
@@ -597,6 +682,8 @@ function consumeReward(params) {
       ...currentState,
       status: "CONSUMED",
       consumedAt: params.now,
+      ...reward.maxStock !== void 0 || params.userId !== void 0 || params.userRedemptionCount !== void 0 ? { redeemedCount: (currentState.redeemedCount ?? 0) + 1 } : {},
+      ...params.userId === void 0 ? {} : { userRedemptionCount: (currentState.userRedemptionCount ?? 0) + 1 },
       ...params.staffId === void 0 ? {} : { consumedByStaffId: params.staffId }
     }
   };
@@ -647,6 +734,14 @@ function processStamp(state, config, targetStampId, context, now) {
     updatedAt: now
   };
   const events = [{ type: "stampAcquired", record }];
+  if (nextRewards !== void 0) {
+    for (const rewardState of nextRewards) {
+      const previous = state.rewards?.find((item) => item.rewardId === rewardState.rewardId);
+      if (rewardState.status === "AVAILABLE" && previous?.status !== "AVAILABLE") {
+        events.push({ type: "rewardUnlocked", rewardId: rewardState.rewardId, unlockedAt: now });
+      }
+    }
+  }
   const completed = config.stamps.length > 0 && config.stamps.every((stamp) => nextState.records.some((item) => item.stampId === stamp.id));
   if (completed) {
     events.push({ type: "rallyCompleted", rallyId: config.id, completedAt: now });
@@ -1222,14 +1317,361 @@ var StampRallyClient = class {
 };
 
 // src/domain/i18n.ts
-function resolveLocalizedText(text, locale, fallbackLocale = "ja") {
-  if (text === void 0 || text === "") return "";
-  if (typeof text === "string") return text;
-  return text[locale] || text[fallbackLocale] || "";
+function resolveLocalizedText(text2, locale, fallbackLocale) {
+  if (text2 === void 0 || text2 === "") return "";
+  if (typeof text2 === "string") return text2;
+  const fallback = fallbackLocale ?? "ja";
+  return text2[locale] || text2[fallback] || "";
+}
+function toLocalizedString(text2) {
+  if (text2 === void 0) return { ja: "", en: "" };
+  return typeof text2 === "string" ? { ja: text2, en: "" } : {
+    ja: text2["ja"] ?? "",
+    en: text2["en"] ?? "",
+    ...text2
+  };
+}
+
+// src/domain/validation.ts
+var CURRENT_RALLY_CONFIG_VERSION = 2;
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function add(errors, path, code, message) {
+  errors.push({ path, code, message });
+}
+function hasText(value) {
+  if (typeof value === "string") return value.trim() !== "";
+  if (!isObject(value)) return false;
+  return Object.values(value).some((item) => typeof item === "string" && item.trim() !== "");
+}
+function validateCondition(value, path, errors) {
+  if (!isObject(value) || typeof value.type !== "string") {
+    add(errors, path, "INVALID_TYPE", "Condition must be an object with a type.");
+    return;
+  }
+  switch (value.type) {
+    case "instant":
+      return;
+    case "token":
+      if (typeof value.token !== "string" || value.token.trim() === "") {
+        add(errors, `${path}.token`, "REQUIRED", "Token must not be empty.");
+      }
+      return;
+    case "geo": {
+      const latitude = value.latitude;
+      const longitude = value.longitude;
+      if (typeof latitude !== "number" || !Number.isFinite(latitude) || latitude < -90 || latitude > 90 || typeof longitude !== "number" || !Number.isFinite(longitude) || longitude < -180 || longitude > 180) {
+        add(
+          errors,
+          path,
+          "INVALID_COORDINATES",
+          "Latitude must be between -90 and 90 and longitude between -180 and 180."
+        );
+      }
+      if (typeof value.radiusMeters !== "number" || !Number.isFinite(value.radiusMeters) || value.radiusMeters <= 0) {
+        add(errors, `${path}.radiusMeters`, "INVALID_RADIUS", "Radius must be greater than zero.");
+      }
+      return;
+    }
+    case "composite":
+      if (value.operator !== "AND" && value.operator !== "OR") {
+        add(errors, `${path}.operator`, "INVALID_TYPE", "Operator must be AND or OR.");
+      }
+      if (!Array.isArray(value.conditions)) {
+        add(errors, `${path}.conditions`, "INVALID_TYPE", "Composite conditions must be an array.");
+        return;
+      }
+      value.conditions.forEach((child, index) => {
+        validateCondition(child, `${path}.conditions[${index}]`, errors);
+      });
+      return;
+    case "time_window":
+      if (typeof value.startsAt !== "string" || Number.isNaN(Date.parse(value.startsAt))) {
+        add(errors, `${path}.startsAt`, "INVALID_DATE", "Start must be a valid ISO date.");
+      }
+      if (typeof value.endsAt !== "string" || Number.isNaN(Date.parse(value.endsAt))) {
+        add(errors, `${path}.endsAt`, "INVALID_DATE", "End must be a valid ISO date.");
+      }
+      if (typeof value.startsAt === "string" && typeof value.endsAt === "string" && !Number.isNaN(Date.parse(value.startsAt)) && !Number.isNaN(Date.parse(value.endsAt)) && Date.parse(value.startsAt) >= Date.parse(value.endsAt)) {
+        add(errors, path, "INVALID_DATE", "Time window start must be before its end.");
+      }
+      validateCondition(value.condition, `${path}.condition`, errors);
+      return;
+    default:
+      add(errors, `${path}.type`, "INVALID_TYPE", "Unsupported condition type.");
+  }
+}
+function validateSpot(value, index, errors) {
+  const path = `stamps[${index}]`;
+  if (!isObject(value)) {
+    add(errors, path, "INVALID_TYPE", "Spot must be an object.");
+    return;
+  }
+  if (typeof value.id !== "string") add(errors, `${path}.id`, "REQUIRED", "Spot ID is required.");
+  else if (value.id.trim() === "")
+    add(errors, `${path}.id`, "EMPTY_STRING", "Spot ID must not be empty.");
+  if (value.name === void 0) add(errors, `${path}.name`, "REQUIRED", "Spot name is required.");
+  else if (!hasText(value.name))
+    add(errors, `${path}.name`, "EMPTY_STRING", "Spot name must not be empty.");
+  if (value.order !== void 0 && (typeof value.order !== "number" || !Number.isFinite(value.order))) {
+    add(errors, `${path}.order`, "INVALID_TYPE", "Spot order must be a finite number.");
+  }
+  validateCondition(value.condition, `${path}.condition`, errors);
+  for (const field of ["dependsOn", "requiresStampIds"]) {
+    if (value[field] !== void 0 && (!Array.isArray(value[field]) || value[field].some((item) => typeof item !== "string"))) {
+      add(errors, `${path}.${field}`, "INVALID_TYPE", `${field} must be an array of IDs.`);
+    }
+  }
+}
+function validateReward(value, index, stampCount, errors) {
+  const path = `rewards[${index}]`;
+  if (!isObject(value)) {
+    add(errors, path, "INVALID_TYPE", "Reward must be an object.");
+    return;
+  }
+  if (typeof value.id !== "string" || value.id.trim() === "") {
+    add(errors, `${path}.id`, "REQUIRED", "Reward ID must not be empty.");
+  }
+  if (!hasText(value.title)) {
+    add(errors, `${path}.title`, "EMPTY_STRING", "Reward title must not be empty.");
+  }
+  if (!hasText(value.description)) {
+    add(errors, `${path}.description`, "EMPTY_STRING", "Reward description must not be empty.");
+  }
+  const required = value.requiredStampCount;
+  if (typeof required !== "number" || !Number.isInteger(required) || required < 0 || required > stampCount) {
+    add(
+      errors,
+      `${path}.requiredStampCount`,
+      "INVALID_REWARD",
+      "Required stamps must be an integer within the rally."
+    );
+  }
+  if (value.validUntil !== void 0 && (typeof value.validUntil !== "string" || Number.isNaN(Date.parse(value.validUntil)))) {
+    add(errors, `${path}.validUntil`, "INVALID_DATE", "Reward expiry must be a valid ISO date.");
+  }
+  for (const field of ["maxStock", "limitPerUser"]) {
+    const count = value[field];
+    if (count !== void 0 && (typeof count !== "number" || !Number.isInteger(count) || count <= 0)) {
+      add(errors, `${path}.${field}`, "INVALID_REWARD", `${field} must be a positive integer.`);
+    }
+  }
+}
+function collectDependencies(spot) {
+  const dependencies = /* @__PURE__ */ new Set();
+  for (const field of ["dependsOn", "requiresStampIds"]) {
+    const values = spot[field];
+    if (Array.isArray(values)) {
+      for (const value of values) if (typeof value === "string") dependencies.add(value);
+    }
+  }
+  return [...dependencies];
+}
+function validateDag(stamps, errors) {
+  const graph = /* @__PURE__ */ new Map();
+  for (const value of stamps) {
+    if (!isObject(value) || typeof value.id !== "string") continue;
+    graph.set(value.id, [...graph.get(value.id) ?? [], ...collectDependencies(value)]);
+  }
+  const visiting = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  const visit = (id, path) => {
+    if (visiting.has(id)) {
+      add(errors, path, "CYCLE_DETECTED", `Dependency cycle detected at '${id}'.`);
+      return;
+    }
+    if (visited.has(id)) return;
+    visiting.add(id);
+    for (const dependency of graph.get(id) ?? [])
+      if (graph.has(dependency)) visit(dependency, path);
+    visiting.delete(id);
+    visited.add(id);
+  };
+  for (const id of graph.keys()) visit(id, `stamps[${id}]`);
+}
+function validateRallyConfig(config) {
+  const errors = [];
+  if (!isObject(config))
+    return {
+      valid: false,
+      errors: [{ path: "", code: "INVALID_TYPE", message: "Rally config must be an object." }]
+    };
+  if (typeof config.id !== "string") add(errors, "id", "REQUIRED", "Rally ID is required.");
+  else if (config.id.trim() === "")
+    add(errors, "id", "EMPTY_STRING", "Rally ID must not be empty.");
+  if (config.title !== void 0 && !hasText(config.title))
+    add(errors, "title", "EMPTY_STRING", "Rally title must not be empty.");
+  if (config.version !== void 0 && config.version !== CURRENT_RALLY_CONFIG_VERSION) {
+    add(
+      errors,
+      "version",
+      "INVALID_VERSION",
+      `Config version must be ${CURRENT_RALLY_CONFIG_VERSION}.`
+    );
+  }
+  for (const field of ["startDate", "endDate"]) {
+    if (config[field] !== void 0 && (typeof config[field] !== "string" || Number.isNaN(Date.parse(config[field])))) {
+      add(errors, field, "INVALID_DATE", `${field} must be a valid ISO date.`);
+    }
+  }
+  if (typeof config.startDate === "string" && typeof config.endDate === "string" && !Number.isNaN(Date.parse(config.startDate)) && !Number.isNaN(Date.parse(config.endDate)) && Date.parse(config.startDate) >= Date.parse(config.endDate)) {
+    add(errors, "startDate", "INVALID_DATE", "startDate must be before endDate.");
+  }
+  if (!Array.isArray(config.stamps)) {
+    add(errors, "stamps", "INVALID_TYPE", "stamps must be an array.");
+  } else {
+    config.stamps.forEach((spot, index) => {
+      validateSpot(spot, index, errors);
+    });
+    const ids = config.stamps.map(
+      (spot) => isObject(spot) && typeof spot.id === "string" ? spot.id : ""
+    );
+    ids.forEach((id, index) => {
+      if (id !== "" && ids.indexOf(id) !== index)
+        add(errors, `stamps[${index}].id`, "DUPLICATE_ID", `Duplicate spot ID '${id}'.`);
+    });
+    validateDag(config.stamps, errors);
+  }
+  if (config.rewards !== void 0 && !Array.isArray(config.rewards)) {
+    add(errors, "rewards", "INVALID_TYPE", "rewards must be an array.");
+  } else if (Array.isArray(config.rewards)) {
+    const stampCount = Array.isArray(config.stamps) ? config.stamps.length : 0;
+    config.rewards.forEach((reward, index) => {
+      validateReward(reward, index, stampCount, errors);
+    });
+    const ids = config.rewards.map(
+      (reward) => isObject(reward) && typeof reward.id === "string" ? reward.id : ""
+    );
+    ids.forEach((id, index) => {
+      if (id !== "" && ids.indexOf(id) !== index)
+        add(errors, `rewards[${index}].id`, "DUPLICATE_ID", `Duplicate reward ID '${id}'.`);
+    });
+    if (Array.isArray(config.stamps)) {
+      const stampIds = new Set(
+        config.stamps.map((spot) => isObject(spot) && typeof spot.id === "string" ? spot.id : "")
+      );
+      ids.forEach((id, index) => {
+        if (id !== "" && stampIds.has(id))
+          add(
+            errors,
+            `rewards[${index}].id`,
+            "DUPLICATE_ID",
+            `Reward ID '${id}' is already used by a spot.`
+          );
+      });
+    }
+  }
+  return { valid: errors.length === 0, errors };
+}
+
+// src/domain/migration.ts
+function isObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function text(value) {
+  if (typeof value === "string") return value;
+  if (!isObject2(value)) return void 0;
+  const entries = Object.entries(value).filter(([, item]) => typeof item === "string");
+  return entries.length === 0 ? void 0 : Object.fromEntries(entries);
+}
+function condition(value) {
+  if (!isObject2(value) || typeof value.type !== "string") return { type: "instant" };
+  switch (value.type) {
+    case "instant":
+      return { type: "instant" };
+    case "token":
+    case "passcode":
+      return {
+        type: "token",
+        token: typeof value.token === "string" ? value.token : typeof value.passcode === "string" ? value.passcode : ""
+      };
+    case "geo":
+      return {
+        type: "geo",
+        latitude: typeof value.latitude === "number" ? value.latitude : 0,
+        longitude: typeof value.longitude === "number" ? value.longitude : 0,
+        radiusMeters: typeof value.radiusMeters === "number" ? value.radiusMeters : typeof value.radius === "number" ? value.radius : 1
+      };
+    case "composite":
+      return {
+        type: "composite",
+        operator: value.operator === "OR" ? "OR" : "AND",
+        conditions: Array.isArray(value.conditions) ? value.conditions.map(condition) : []
+      };
+    case "time_window":
+      return {
+        type: "time_window",
+        startsAt: typeof value.startsAt === "string" ? value.startsAt : "1970-01-01T00:00:00.000Z",
+        endsAt: typeof value.endsAt === "string" ? value.endsAt : "9999-12-31T23:59:59.999Z",
+        condition: condition(value.condition)
+      };
+    default:
+      return { type: "instant" };
+  }
 }
-function toLocalizedString(text) {
-  if (text === void 0) return { ja: "", en: "" };
-  return typeof text === "string" ? { ja: text, en: "" } : { ...text };
+function migrateSpot(value, index) {
+  const source = isObject2(value) ? value : {};
+  const id = typeof source.id === "string" && source.id.trim() !== "" ? source.id.trim() : `spot-${index + 1}`;
+  const description = text(source.description);
+  const hint = text(source.hint);
+  return {
+    id,
+    name: text(source.name) ?? `Spot ${index + 1}`,
+    ...description === void 0 ? {} : { description },
+    ...hint === void 0 ? {} : { hint },
+    condition: condition(
+      source.condition ?? (typeof source.token === "string" ? { type: "token", token: source.token } : void 0)
+    ),
+    ...typeof source.order === "number" ? { order: source.order } : {},
+    ...typeof source.deckId === "string" ? { deckId: source.deckId } : {},
+    ...typeof source.groupId === "string" ? { groupId: source.groupId } : {},
+    ...typeof source.guideId === "string" ? { guideId: source.guideId } : {},
+    ...typeof source.iconUrl === "string" ? { iconUrl: source.iconUrl } : {},
+    ...typeof source.imageUrl === "string" ? { imageUrl: source.imageUrl } : {},
+    ...typeof source.externalUrl === "string" ? { externalUrl: source.externalUrl } : {},
+    ...typeof source.redirectUrlAfterClaim === "string" ? { redirectUrlAfterClaim: source.redirectUrlAfterClaim } : {},
+    ...isObject2(source.metadata) ? { metadata: source.metadata } : {},
+    ...Array.isArray(source.dependsOn) ? { dependsOn: source.dependsOn.filter((item) => typeof item === "string") } : {}
+  };
+}
+function migrateReward(value, index) {
+  const source = isObject2(value) ? value : {};
+  return {
+    id: typeof source.id === "string" && source.id.trim() !== "" ? source.id.trim() : `reward-${index + 1}`,
+    title: text(source.title) ?? `Reward ${index + 1}`,
+    description: text(source.description) ?? "",
+    type: source.type === "digital" ? "digital" : "in_person",
+    redemptionMethod: source.redemptionMethod === "staff_passcode" || source.redemptionMethod === "view_only" ? source.redemptionMethod : "manual_slide",
+    requiredStampCount: typeof source.requiredStampCount === "number" && Number.isFinite(source.requiredStampCount) ? Math.max(0, Math.trunc(source.requiredStampCount)) : 0,
+    ...typeof source.digitalContentUrl === "string" ? { digitalContentUrl: source.digitalContentUrl } : {},
+    ...typeof source.staffPasscode === "string" ? { staffPasscode: source.staffPasscode } : {},
+    ...typeof source.validUntil === "string" ? { validUntil: source.validUntil } : {},
+    ...typeof source.maxStock === "number" ? { maxStock: source.maxStock } : {},
+    ...typeof source.limitPerUser === "number" ? { limitPerUser: source.limitPerUser } : {},
+    ...typeof source.claimTicketNumber === "string" ? { claimTicketNumber: source.claimTicketNumber } : {}
+  };
+}
+function migrateRallyConfig(raw) {
+  const source = isObject2(raw) ? raw : {};
+  const rawStamps = Array.isArray(source.stamps) ? source.stamps : Array.isArray(source.spots) ? source.spots : [];
+  const rawRewards = Array.isArray(source.rewards) ? source.rewards : [];
+  const id = typeof source.id === "string" && source.id.trim() !== "" ? source.id.trim() : "migrated-rally";
+  const title = text(source.title);
+  const description = text(source.description);
+  const theme = isObject2(source.theme) ? source.theme : void 0;
+  return {
+    id,
+    ...title === void 0 ? {} : { title },
+    ...description === void 0 ? {} : { description },
+    stamps: rawStamps.map(migrateSpot),
+    ...rawRewards.length === 0 ? {} : { rewards: rawRewards.map(migrateReward) },
+    ...typeof source.isSequential === "boolean" ? { isSequential: source.isSequential } : {},
+    ...theme === void 0 ? {} : { theme },
+    version: CURRENT_RALLY_CONFIG_VERSION,
+    ...typeof source.startDate === "string" ? { startDate: source.startDate } : typeof source.startsAt === "string" ? { startDate: source.startsAt } : {},
+    ...typeof source.endDate === "string" ? { endDate: source.endDate } : typeof source.endsAt === "string" ? { endDate: source.endsAt } : {}
+  };
 }
 
 // src/domain/models.ts
@@ -1244,6 +1686,15 @@ var DEFAULT_SHEET_THEME = {
   fontFamily: "serif"
 };
 
+// src/domain/publicConfig.ts
+function stripSensitiveConfig(config) {
+  const rewards = config.rewards?.map(({ staffPasscode: _staffPasscode, ...reward }) => reward);
+  return {
+    ...config,
+    ...rewards === void 0 ? {} : { rewards }
+  };
+}
+
 // src/domain/themePresets.ts
 var THEME_PRESETS = [
   {
@@ -1343,6 +1794,126 @@ var THEME_PRESETS = [
   }
 ];
 
+// src/security/snapshotToken.ts
+var encoder = new TextEncoder();
+function cryptoApi() {
+  if (globalThis.crypto === void 0 || globalThis.crypto.subtle === void 0) {
+    throw new Error("Web Crypto API is unavailable in this environment.");
+  }
+  return globalThis.crypto;
+}
+function secretBytes(secretKey) {
+  return typeof secretKey === "string" ? encoder.encode(secretKey) : new Uint8Array(secretKey);
+}
+function webCryptoBytes(bytes) {
+  return bytes.buffer;
+}
+function base64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return globalThis.btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+}
+function fromBase64Url(value) {
+  const base64 = value.replaceAll("-", "+").replaceAll("_", "/");
+  const padded = `${base64}${"=".repeat((4 - base64.length % 4) % 4)}`;
+  const binary = globalThis.atob(padded);
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+async function importHmacKey(secret) {
+  return cryptoApi().subtle.importKey(
+    "raw",
+    webCryptoBytes(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign", "verify"]
+  );
+}
+async function importAesKey(secret) {
+  const digest = await cryptoApi().subtle.digest("SHA-256", webCryptoBytes(secret));
+  return cryptoApi().subtle.importKey("raw", digest, "AES-GCM", false, ["encrypt", "decrypt"]);
+}
+function isExpired(payload, now) {
+  if (typeof payload.exp === "number" && now >= payload.exp * 1e3) return true;
+  return payload.expiresAt !== void 0 && Date.parse(payload.expiresAt) <= now;
+}
+async function createSignedSnapshotToken(payload, secretKey) {
+  const api = cryptoApi();
+  const secret = secretBytes(secretKey);
+  const iv = api.getRandomValues(new Uint8Array(12));
+  const plaintext = encoder.encode(JSON.stringify(payload));
+  const encrypted = new Uint8Array(
+    await api.subtle.encrypt(
+      { name: "AES-GCM", iv: webCryptoBytes(iv) },
+      await importAesKey(secret),
+      webCryptoBytes(plaintext)
+    )
+  );
+  const body = base64Url(new Uint8Array([...iv, ...encrypted]));
+  const signature = new Uint8Array(
+    await api.subtle.sign("HMAC", await importHmacKey(secret), encoder.encode(body))
+  );
+  return `sr2.${body}.${base64Url(signature)}`;
+}
+async function verifySnapshotToken(token, secretKey, now = Date.now()) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3 || parts[0] !== "sr2") {
+      return {
+        ok: false,
+        valid: false,
+        error: { code: "MALFORMED", message: "Snapshot token is malformed." }
+      };
+    }
+    const [, body, encodedSignature] = parts;
+    if (body === void 0 || encodedSignature === void 0) {
+      return {
+        ok: false,
+        valid: false,
+        error: { code: "MALFORMED", message: "Snapshot token is malformed." }
+      };
+    }
+    const secret = secretBytes(secretKey);
+    const validSignature = await cryptoApi().subtle.verify(
+      "HMAC",
+      await importHmacKey(secret),
+      webCryptoBytes(fromBase64Url(encodedSignature)),
+      webCryptoBytes(encoder.encode(body))
+    );
+    if (!validSignature) {
+      return {
+        ok: false,
+        valid: false,
+        error: { code: "INVALID_SIGNATURE", message: "Snapshot token signature is invalid." }
+      };
+    }
+    const encrypted = fromBase64Url(body);
+    if (encrypted.length <= 12) throw new Error("Invalid encrypted payload.");
+    const payloadText = await cryptoApi().subtle.decrypt(
+      { name: "AES-GCM", iv: webCryptoBytes(encrypted.slice(0, 12)) },
+      await importAesKey(secret),
+      webCryptoBytes(encrypted.slice(12))
+    );
+    const payload = JSON.parse(new TextDecoder().decode(payloadText));
+    if (typeof payload !== "object" || payload === null || Array.isArray(payload))
+      throw new Error("Invalid payload.");
+    if (isExpired(payload, now)) {
+      return {
+        ok: false,
+        valid: false,
+        error: { code: "EXPIRED", message: "Snapshot token has expired." }
+      };
+    }
+    return { ok: true, valid: true, payload };
+  } catch {
+    return {
+      ok: false,
+      valid: false,
+      error: { code: "DECRYPTION_FAILED", message: "Snapshot token could not be verified." }
+    };
+  }
+}
+
+exports.CURRENT_RALLY_CONFIG_VERSION = CURRENT_RALLY_CONFIG_VERSION;
 exports.DEFAULT_SHEET_THEME = DEFAULT_SHEET_THEME;
 exports.InMemoryStorage = InMemoryStorage;
 exports.IndexedDBAdapter = IndexedDBAdapter;
@@ -1353,6 +1924,9 @@ exports.THEME_PRESETS = THEME_PRESETS;
 exports.calculateDistanceMeters = calculateDistanceMeters;
 exports.calculateProgress = calculateProgress;
 exports.consumeReward = consumeReward;
+exports.createClaimTicketNumber = createClaimTicketNumber;
+exports.createSignedSnapshotToken = createSignedSnapshotToken;
+exports.evaluateCheckIn = evaluateCheckIn;
 exports.evaluateCondition = evaluateCondition;
 exports.evaluateConditionDetailed = evaluateConditionDetailed;
 exports.exportProgressToken = exportProgressToken;
@@ -1363,13 +1937,18 @@ exports.isNfcSupported = isNfcSupported;
 exports.isQrSupported = isQrSupported;
 exports.isRewardState = isRewardState;
 exports.isStampRallyState = isStampRallyState;
+exports.issueClaimTicketNumber = issueClaimTicketNumber;
+exports.migrateRallyConfig = migrateRallyConfig;
 exports.normalizePasscode = normalizePasscode;
 exports.processStamp = processStamp;
 exports.readNfcContext = readNfcContext;
 exports.readQrContext = readQrContext;
 exports.reconcileRewardStates = reconcileRewardStates;
 exports.resolveLocalizedText = resolveLocalizedText;
+exports.stripSensitiveConfig = stripSensitiveConfig;
 exports.toLocalizedString = toLocalizedString;
+exports.validateRallyConfig = validateRallyConfig;
 exports.verifyPasscode = verifyPasscode;
+exports.verifySnapshotToken = verifySnapshotToken;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map