@stamprally/core 0.10.0 → 0.11.0

package/dist/index.cjs

@@ -989,6 +989,7 @@ var StampRallyClient = class {
   #storage;
   #options;
   #config;
+  #offlineQueue;
   #userId;
   #state = null;
   #initialization = null;
@@ -998,6 +999,7 @@ var StampRallyClient = class {
     this.#options = isStorage(storageOrOptions) ? { storage: storageOrOptions } : storageOrOptions;
     this.#storage = this.#options.storage ?? new InMemoryStorage();
     this.#userId = this.#options.userId ?? null;
+    this.#offlineQueue = this.#options.offlineQueue;
   }
   getConfig() {
     return this.#config;
@@ -1008,6 +1010,12 @@ var StampRallyClient = class {
   getUserId() {
     return this.#userId;
   }
+  get syncState() {
+    return this.#offlineQueue?.syncState ?? "idle";
+  }
+  get pendingCount() {
+    return this.#offlineQueue?.pendingCount ?? 0;
+  }
   subscribe(listener) {
     this.#listeners.add(listener);
     return () => this.#listeners.delete(listener);
@@ -1111,8 +1119,21 @@ var StampRallyClient = class {
       };
       const remote = this.#options.syncAdapter?.checkIn;
       if (options.sync !== false && remote !== void 0) {
-        const result = await remote(request);
-        return result.ok ? this.#commitCheckIn(result) : this.#fail(result.error);
+        try {
+          const result = await remote(request);
+          return result.ok ? this.#commitCheckIn(result) : this.#fail(result.error);
+        } catch (error) {
+          if (this.#offlineQueue === void 0) throw error;
+          await this.#offlineQueue.enqueueCheckIn(request);
+          const record2 = { stampId: spotId, acquiredAt: now };
+          const next2 = this.#reconcile({
+            ...current,
+            records: [...current.records, record2],
+            updatedAt: now
+          });
+          await this.#storage.save(next2);
+          return this.#commitCheckIn({ ok: true, value: { state: next2, record: record2 } });
+        }
       }
       const record = { stampId: spotId, acquiredAt: now };
       const next = this.#reconcile({
@@ -1154,8 +1175,22 @@ var StampRallyClient = class {
       };
       const remote = this.#options.syncAdapter?.claimReward;
       if (options.sync !== false && remote !== void 0) {
-        const result = await remote(request);
-        return result.ok ? this.#commitClaim(result) : this.#fail(result.error);
+        try {
+          const result = await remote(request);
+          return result.ok ? this.#commitClaim(result) : this.#fail(result.error);
+        } catch (error) {
+          if (this.#offlineQueue === void 0) throw error;
+          await this.#offlineQueue.enqueueClaimReward(request);
+          const next2 = {
+            ...current,
+            rewards: current.rewards.map(
+              (item) => item.rewardId === rewardId ? local.value : item
+            ),
+            updatedAt: now
+          };
+          await this.#storage.save(next2);
+          return this.#commitClaim({ ok: true, value: { state: next2, reward: local.value } });
+        }
       }
       const next = {
         ...current,
@@ -1169,6 +1204,18 @@ var StampRallyClient = class {
   sync(adapter = this.#options.syncAdapter) {
     return this.#enqueue(async () => {
       const current = await this.initialize();
+      if (this.#offlineQueue !== void 0 && adapter !== void 0) {
+        await this.#offlineQueue.sync(async (operation) => {
+          if (operation.kind === "checkIn") {
+            if (adapter.checkIn === void 0)
+              throw new Error("No check-in sync adapter is configured.");
+            return adapter.checkIn(operation.request);
+          }
+          if (adapter.claimReward === void 0)
+            throw new Error("No reward sync adapter is configured.");
+          return adapter.claimReward(operation.request);
+        });
+      }
       if (adapter?.sync === void 0) {
         this.#emitEvent({ type: "sync", state: current });
         return;
@@ -1182,6 +1229,9 @@ var StampRallyClient = class {
       this.#emitEvent({ type: "sync", state: next });
     });
   }
+  retrySync() {
+    return this.sync();
+  }
   reset() {
     return this.#enqueue(async () => {
       await this.#storage.remove(this.#config.id, this.#userId);
@@ -1263,6 +1313,205 @@ var StampRallyClient = class {
   }
 };
 
+// src/client/offlineQueue.ts
+var MemoryQueueStorage = class {
+  #values = /* @__PURE__ */ new Map();
+  async load(key) {
+    return this.#values.get(key) ?? [];
+  }
+  async save(key, operations) {
+    this.#values.set(key, structuredClone(operations));
+  }
+};
+var LocalStorageQueueStorage = class {
+  constructor(storage) {
+    this.storage = storage;
+  }
+  storage;
+  async load(key) {
+    const value = this.storage.getItem(key);
+    if (value === null) return [];
+    try {
+      const parsed = JSON.parse(value);
+      return Array.isArray(parsed) ? parsed : [];
+    } catch {
+      return [];
+    }
+  }
+  async save(key, operations) {
+    this.storage.setItem(key, JSON.stringify(operations));
+  }
+};
+var IndexedDBOfflineQueueStorage = class {
+  #providedFactory;
+  #databaseName;
+  #databasePromise = null;
+  constructor(options = {}) {
+    this.#providedFactory = options.indexedDB;
+    this.#databaseName = options.databaseName ?? "stamprally-offline-queue";
+  }
+  async load(key) {
+    const database = await this.#open();
+    return new Promise((resolve, reject) => {
+      const request = database.transaction("operations", "readonly").objectStore("operations").get(key);
+      request.onsuccess = () => resolve(Array.isArray(request.result) ? request.result : []);
+      request.onerror = () => reject(request.error ?? new Error("Failed to read offline queue."));
+    });
+  }
+  async save(key, operations) {
+    const database = await this.#open();
+    return new Promise((resolve, reject) => {
+      const transaction = database.transaction("operations", "readwrite");
+      transaction.objectStore("operations").put(structuredClone(operations), key);
+      transaction.oncomplete = () => resolve();
+      transaction.onerror = () => reject(transaction.error ?? new Error("Failed to save offline queue."));
+      transaction.onabort = () => reject(transaction.error ?? new Error("Offline queue write aborted."));
+    });
+  }
+  #open() {
+    if (this.#databasePromise !== null) return this.#databasePromise;
+    let factory = this.#providedFactory;
+    if (factory === void 0)
+      factory = globalThis.indexedDB;
+    if (factory === void 0 || factory === null)
+      return Promise.reject(new Error("IndexedDB is unavailable in this environment."));
+    this.#databasePromise = new Promise((resolve, reject) => {
+      const request = factory.open(this.#databaseName, 1);
+      request.onupgradeneeded = () => {
+        if (!request.result.objectStoreNames.contains("operations"))
+          request.result.createObjectStore("operations");
+      };
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error ?? new Error("Failed to open offline queue."));
+    }).catch((error) => {
+      this.#databasePromise = null;
+      throw error;
+    });
+    return this.#databasePromise;
+  }
+};
+function defaultStorage(databaseName) {
+  try {
+    const indexedDB = globalThis.indexedDB;
+    if (indexedDB !== void 0)
+      return new IndexedDBOfflineQueueStorage({
+        indexedDB,
+        ...databaseName === void 0 ? {} : { databaseName }
+      });
+    const storage = globalThis.localStorage;
+    if (storage !== void 0 && storage !== null) return new LocalStorageQueueStorage(storage);
+  } catch {
+  }
+  return new MemoryQueueStorage();
+}
+function operationId(operation) {
+  return operation.kind === "checkIn" ? `checkIn:${operation.request.rallyId}:${operation.request.userId ?? "anonymous"}:${operation.request.idempotencyKey}` : `claimReward:${operation.request.rallyId}:${operation.request.userId ?? "anonymous"}:${operation.request.idempotencyKey}`;
+}
+var OfflineQueue = class {
+  #storage;
+  #key;
+  #conflictPolicy;
+  #onSyncConflict;
+  #operations = [];
+  #loaded = false;
+  #state = "idle";
+  #error = null;
+  #sender;
+  #syncPromise = null;
+  constructor(options = {}) {
+    if (options.storage !== void 0) this.#storage = options.storage;
+    else if (options.storageLike !== void 0 && options.storageLike !== null)
+      this.#storage = new LocalStorageQueueStorage(options.storageLike);
+    else this.#storage = defaultStorage(options.databaseName);
+    this.#key = options.key ?? "stamprally:offline-queue";
+    this.#conflictPolicy = options.conflictPolicy ?? "server_wins";
+    this.#onSyncConflict = options.onSyncConflict;
+  }
+  get syncState() {
+    return this.#state;
+  }
+  get pendingCount() {
+    return this.#operations.length;
+  }
+  get error() {
+    return this.#error;
+  }
+  get operations() {
+    return this.#operations;
+  }
+  async initialize() {
+    if (this.#loaded) return;
+    this.#operations = [...await this.#storage.load(this.#key)];
+    this.#loaded = true;
+  }
+  setSender(sender) {
+    this.#sender = sender;
+  }
+  async enqueue(operation) {
+    await this.initialize();
+    const id2 = operationId(operation);
+    if (this.#operations.some((item) => operationId(item) === id2)) return;
+    this.#operations = [...this.#operations, operation];
+    await this.#storage.save(this.#key, this.#operations);
+  }
+  async enqueueCheckIn(request) {
+    return this.enqueue({ kind: "checkIn", request });
+  }
+  async enqueueClaimReward(request) {
+    return this.enqueue({ kind: "claimReward", request });
+  }
+  async clear() {
+    await this.initialize();
+    this.#operations = [];
+    await this.#storage.save(this.#key, this.#operations);
+  }
+  async sync(sender = this.#sender) {
+    await this.initialize();
+    if (sender === void 0) throw new Error("OfflineQueue.sync requires a sender.");
+    if (this.#syncPromise !== null) return this.#syncPromise;
+    this.#sender = sender;
+    this.#syncPromise = this.#run(sender).finally(() => {
+      this.#syncPromise = null;
+    });
+    return this.#syncPromise;
+  }
+  async retrySync(sender = this.#sender) {
+    return this.sync(sender);
+  }
+  async #run(sender) {
+    this.#state = "syncing";
+    this.#error = null;
+    try {
+      while (this.#operations.length > 0) {
+        const operation = this.#operations[0];
+        if (operation === void 0) break;
+        let result;
+        try {
+          result = await sender(operation);
+        } catch (cause) {
+          throw cause instanceof Error ? cause : new Error(String(cause));
+        }
+        if ("conflict" in result && result.conflict === true)
+          await this.resolveConflict(operation, result.localState, result.serverState);
+        this.#operations = this.#operations.slice(1);
+        await this.#storage.save(this.#key, this.#operations);
+      }
+      this.#state = "idle";
+    } catch (cause) {
+      this.#state = "error";
+      this.#error = cause instanceof Error ? cause : new Error(String(cause));
+      throw this.#error;
+    }
+  }
+  async resolveConflict(operation, localState, serverState) {
+    const configured = this.#onSyncConflict;
+    const policy = (typeof configured === "function" ? await configured({ operation, localState, serverState }) : configured) ?? this.#conflictPolicy;
+    if (policy === "merge") {
+      return;
+    }
+  }
+};
+
 // src/crypto/token.ts
 var encoder = new TextEncoder();
 var decoder = new TextDecoder();
@@ -1395,27 +1644,6 @@ async function decryptPayload(body, secret) {
   );
 }
 
-// src/domain/i18n.ts
-function updateLocalizedField(current, locale, newValue) {
-  if (typeof current === "string" || current === void 0)
-    return { [locale]: newValue };
-  return { ...current, [locale]: newValue };
-}
-function resolveLocalizedText(text, locale, fallbackLocale) {
-  if (text === void 0 || text === "") return "";
-  if (typeof text === "string") return text;
-  const fallback = fallbackLocale === void 0 ? Object.values(text).find((value) => typeof value === "string") : text[fallbackLocale];
-  return text[locale] || fallback || "";
-}
-function toLocalizedString(text) {
-  if (text === void 0) return { ja: "", en: "" };
-  return typeof text === "string" ? { ja: text, en: "" } : {
-    ja: text["ja"] ?? "",
-    en: text["en"] ?? "",
-    ...text
-  };
-}
-
 // src/domain/models.ts
 var DEFAULT_SHEET_THEME = {
   primaryColor: "#9e551e",
@@ -1460,7 +1688,7 @@ function toPublicConfig(config) {
     rewards: config.rewards.map(
       ({ digitalContentUrl: _content, staffPasscode: _passcode, ...reward2 }) => reward2
     ),
-    ...config.metadata === void 0 ? {} : { metadata: config.metadata },
+    ...config.publicMetadata !== void 0 ? { metadata: config.publicMetadata } : config.metadata === void 0 ? {} : { metadata: config.metadata },
     ...config.serverEndpoint === void 0 ? {} : { serverEndpoint: config.serverEndpoint }
   };
 }
@@ -1519,6 +1747,118 @@ function isPublicConfig(value) {
   });
 }
 
+// src/domain/configTransform.ts
+var PRIVATE_KEYS = /* @__PURE__ */ new Set([
+  "staffPasscode",
+  "serverMetadata",
+  "inventory",
+  "secretToken",
+  "secretParams",
+  "digitalContentUrl",
+  "code",
+  "tagId"
+]);
+var SENSITIVE_KEY_PATTERN = /^(?:api[_-]?key|access[_-]?token|auth[_-]?token|password|private[_-]?key|secret)$/i;
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isPrivateKey(key) {
+  return PRIVATE_KEYS.has(key) || SENSITIVE_KEY_PATTERN.test(key);
+}
+function sanitizeValue(value, customFilter, seen) {
+  if (Array.isArray(value)) {
+    if (seen.has(value)) return void 0;
+    seen.add(value);
+    const items = value.map((item) => sanitizeValue(item, customFilter, seen)).filter((item) => item !== void 0);
+    return items;
+  }
+  if (!isRecord2(value)) return value;
+  if (seen.has(value)) return void 0;
+  seen.add(value);
+  const result = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (isPrivateKey(key) || customFilter?.(key, item) === false) continue;
+    const sanitized = sanitizeValue(item, customFilter, seen);
+    if (sanitized !== void 0) result[key] = sanitized;
+  }
+  return result;
+}
+function sanitizeSpot(spot2, customFilter) {
+  return sanitizeValue(
+    toPublicConfig({
+      id: "__spot__",
+      version: "1",
+      title: "__spot__",
+      spots: [spot2],
+      rewards: []
+    }).spots[0],
+    customFilter,
+    /* @__PURE__ */ new WeakSet()
+  );
+}
+function sanitizeReward(reward2, customFilter) {
+  return sanitizeValue(
+    toPublicConfig({
+      id: "__reward__",
+      version: "1",
+      title: "__reward__",
+      spots: [],
+      rewards: [reward2]
+    }).rewards[0],
+    customFilter,
+    /* @__PURE__ */ new WeakSet()
+  );
+}
+function sanitizeAdminConfig(admin, customFilter) {
+  const publicConfig = toPublicConfig(admin);
+  const sanitized = sanitizeValue(publicConfig, customFilter, /* @__PURE__ */ new WeakSet());
+  sanitized.spots = admin.spots.map((spot2) => sanitizeSpot(spot2, customFilter));
+  sanitized.rewards = admin.rewards.map((reward2) => sanitizeReward(reward2, customFilter));
+  return sanitized;
+}
+function validatePublicConfigSafety(publicConfig) {
+  const leakedKeys = [];
+  const seen = /* @__PURE__ */ new WeakSet();
+  const visit = (value, path) => {
+    if (Array.isArray(value)) {
+      value.forEach((item, index) => {
+        visit(item, `${path}[${index}]`);
+      });
+      return;
+    }
+    if (!isRecord2(value) || seen.has(value)) return;
+    seen.add(value);
+    for (const [key, item] of Object.entries(value)) {
+      const nextPath = path === "$" ? key : `${path}.${key}`;
+      if (isPrivateKey(key)) leakedKeys.push(nextPath);
+      visit(item, nextPath);
+    }
+  };
+  visit(publicConfig, "$");
+  return { safe: leakedKeys.length === 0, leakedKeys };
+}
+
+// src/domain/i18n.ts
+function updateLocalizedField(current, locale, newValue) {
+  if (typeof current === "string" || current === void 0)
+    return { [locale]: newValue };
+  return { ...current, [locale]: newValue };
+}
+function resolveLocalizedText(text, locale, fallbackLocale) {
+  if (text === void 0 || text === "") return "";
+  if (typeof text === "string") return text;
+  const fallback = fallbackLocale === void 0 ? Object.values(text).find((value) => typeof value === "string") : text[fallbackLocale];
+  return text[locale] || fallback || "";
+}
+function toLocalizedString(text) {
+  if (text === void 0) return { ja: "", en: "" };
+  return typeof text === "string" ? { ja: text, en: "" } : {
+    ja: text["ja"] ?? "",
+    en: text["en"] ?? "",
+    ...text
+  };
+}
+
 // src/domain/themePresets.ts
 var THEME_PRESETS = [
   {
@@ -1627,7 +1967,7 @@ var ConfigValidationError = class extends Error {
   errors;
   name = "ConfigValidationError";
 };
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasOwn(value, key) {
@@ -1666,7 +2006,7 @@ function finiteNumber(value, key, path, errors, minimum) {
 }
 function localizedText(value, path, errors) {
   if (typeof value === "string") return;
-  if (!isRecord2(value)) {
+  if (!isRecord3(value)) {
     add(errors, path, "Expected a string or a locale map.", "invalid_localized_text");
     return;
   }
@@ -1676,7 +2016,7 @@ function localizedText(value, path, errors) {
   }
 }
 function theme(value, path, errors) {
-  if (!isRecord2(value)) {
+  if (!isRecord3(value)) {
     add(errors, path, "Expected a theme object.", "invalid_type");
     return;
   }
@@ -1701,7 +2041,7 @@ function externalReferences(value, path, errors) {
   }
   value.forEach((item, index) => {
     const itemPath = `${path}[${index}]`;
-    if (!isRecord2(item)) {
+    if (!isRecord3(item)) {
       add(errors, itemPath, "Expected an object.", "invalid_type");
       return;
     }
@@ -1711,7 +2051,7 @@ function externalReferences(value, path, errors) {
   });
 }
 function condition(value, path, errors, isPublic) {
-  if (!isRecord2(value)) {
+  if (!isRecord3(value)) {
     add(errors, path, "Expected a condition object.", "invalid_type");
     return;
   }
@@ -1761,14 +2101,14 @@ function condition(value, path, errors, isPublic) {
     requiredString(value, "validatorName", path, errors);
     if (isPublic && hasOwn(value, "secretParams"))
       add(errors, `${path}.secretParams`, "Private field is not allowed.", "private_field");
-    if (!isPublic && hasOwn(value, "secretParams") && !isRecord2(value.secretParams))
+    if (!isPublic && hasOwn(value, "secretParams") && !isRecord3(value.secretParams))
       add(errors, `${path}.secretParams`, "Expected an object.", "invalid_type");
     return;
   }
   add(errors, `${path}.type`, "Unknown condition type.", "invalid_enum");
 }
 function unlockCondition(value, path, errors) {
-  if (!isRecord2(value)) {
+  if (!isRecord3(value)) {
     add(errors, path, "Expected an unlock condition object.", "invalid_type");
     return;
   }
@@ -1803,7 +2143,7 @@ function unlockCondition(value, path, errors) {
   add(errors, `${path}.type`, "Unknown unlock condition type.", "invalid_enum");
 }
 function spot(value, path, errors, isPublic) {
-  if (!isRecord2(value)) {
+  if (!isRecord3(value)) {
     add(errors, path, "Expected a spot object.", "invalid_type");
     return;
   }
@@ -1840,7 +2180,7 @@ function spot(value, path, errors, isPublic) {
     });
 }
 function reward(value, path, errors, isPublic) {
-  if (!isRecord2(value)) {
+  if (!isRecord3(value)) {
     add(errors, path, "Expected a reward object.", "invalid_type");
     return;
   }
@@ -1883,7 +2223,7 @@ function reward(value, path, errors, isPublic) {
 }
 function validate(value, isPublic) {
   const errors = [];
-  if (!isRecord2(value)) {
+  if (!isRecord3(value)) {
     add(errors, "$", "Expected a configuration object.", "invalid_type");
     return errors;
   }
@@ -1904,10 +2244,12 @@ function validate(value, isPublic) {
     });
   if (!isPublic) {
     optionalString(value, "staffPasscode", "$", errors);
-    if (hasOwn(value, "inventory") && value.inventory !== void 0 && !isRecord2(value.inventory))
+    if (hasOwn(value, "inventory") && value.inventory !== void 0 && !isRecord3(value.inventory))
       add(errors, "$.inventory", "Expected an object.", "invalid_type");
-    if (hasOwn(value, "serverMetadata") && value.serverMetadata !== void 0 && !isRecord2(value.serverMetadata))
+    if (hasOwn(value, "serverMetadata") && value.serverMetadata !== void 0 && !isRecord3(value.serverMetadata))
       add(errors, "$.serverMetadata", "Expected an object.", "invalid_type");
+    if (hasOwn(value, "publicMetadata") && value.publicMetadata !== void 0 && !isRecord3(value.publicMetadata))
+      add(errors, "$.publicMetadata", "Expected an object.", "invalid_type");
     optionalString(value, "serverEndpoint", "$", errors);
   } else {
     for (const key of ["staffPasscode", "serverMetadata", "inventory"])
@@ -2057,9 +2399,12 @@ async function verifySnapshotToken(token, secretKey, now = Date.now()) {
 
 exports.ConfigValidationError = ConfigValidationError;
 exports.DEFAULT_SHEET_THEME = DEFAULT_SHEET_THEME;
+exports.InMemoryOfflineQueueStorage = MemoryQueueStorage;
 exports.InMemoryStorage = InMemoryStorage;
 exports.IndexedDBAdapter = IndexedDBAdapter;
+exports.IndexedDBOfflineQueueStorage = IndexedDBOfflineQueueStorage;
 exports.LocalStorageAdapter = LocalStorageAdapter;
+exports.OfflineQueue = OfflineQueue;
 exports.StampRallyClient = StampRallyClient;
 exports.StorageAdapterError = StorageAdapterError;
 exports.THEME_PRESETS = THEME_PRESETS;
@@ -2094,10 +2439,12 @@ exports.reconcileRewardStates = reconcileRewardStates;
 exports.resolveLocalizedText = resolveLocalizedText;
 exports.safeParseAdminConfig = safeParseAdminConfig;
 exports.safeParsePublicConfig = safeParsePublicConfig;
+exports.sanitizeAdminConfig = sanitizeAdminConfig;
 exports.storageKey = storageKey;
 exports.toLocalizedString = toLocalizedString;
 exports.toPublicConfig = toPublicConfig;
 exports.updateLocalizedField = updateLocalizedField;
+exports.validatePublicConfigSafety = validatePublicConfigSafety;
 exports.verifyPasscode = verifyPasscode;
 exports.verifySecureToken = verifySecureToken;
 exports.verifySnapshotToken = verifySnapshotToken;