@stamprally/core 0.13.0 → 0.15.0

package/README.md

@@ -1,4 +1,4 @@
-# @stamprally/core
+# @stamprally/core v0.15.0
 
 Dependency-free domain models, immutable state transitions, storage adapters, browser detectors, and safe configuration parsers.
 
@@ -7,7 +7,7 @@ import { InMemoryStorage, StampRallyClient, type PublicRallyConfig } from "@stam
 
 const config: PublicRallyConfig = {
   id: "city-tour",
-  version: "0.9.1",
+  version: "0.15.0",
   title: "City Tour",
   spots: [{ id: "station", orderIndex: 0, name: "Central Station", conditions: [{ type: "passcode" }] }],
   rewards: [],
@@ -23,7 +23,7 @@ The browser detectors `getCurrentGeoContext`, `readNfcContext`, and `readQrConte
 
 `InMemoryStorage`, `LocalStorageAdapter`, and `IndexedDBAdapter` implement `StampStorage`. `updateLocalizedField` updates one locale without dropping existing translations.
 
-## v0.13 offline synchronization
+## v0.15.0 offline synchronization
 
 Configure `OfflineQueue` with `rallyId` and `userId` to persist pending work under
 `stamprally:queue:<rallyId>:<userId-or-anonymous>`. `switchUser` loads the other
@@ -32,6 +32,10 @@ timestamps, and gives `CONSUMED` reward states priority; `server_wins` uses the
 server state unchanged. Sync adapters may return `ACCEPTED`, `REJECTED_PERMANENT`,
 or `RETRYABLE_ERROR`; only the first two remove an operation.
 
+When no authenticated user is supplied, the client creates a persistent UUID v4
+`anonymousSessionId` and includes it in sync requests. Queue replay uses Web Locks
+when available and supports bounded exponential backoff through `retryOptions`.
+
 `evaluateSpotStatus` derives `UNCLAIMED`, `CLAIMED`, `LOCKED`, or `VERIFYING`
 without mutating state. A spot with incomplete `prerequisites` is `LOCKED` and
 must not be verified by a client or viewer.

package/dist/index.cjs

@@ -61,7 +61,9 @@ function calculateProgress(state, config) {
   const acquired = new Set(
     state.records.map((record) => record.stampId).filter((id2) => ids.has(id2))
   );
-  const remaining = config.spots.filter((spot2) => !acquired.has(spot2.id));
+  const remaining = config.spots.filter(
+    (spot2) => !acquired.has(spot2.id) && (spot2.prerequisites === void 0 || spot2.prerequisites.every((id2) => acquired.has(id2)))
+  );
   return {
     acquired: acquired.size,
     total: config.spots.length,
@@ -615,7 +617,13 @@ function cloneState(state) {
   return {
     ...state,
     records: state.records.map(cloneRecord),
-    ...state.rewards === void 0 ? {} : { rewards: state.rewards.map(cloneRewardState) }
+    ...state.rewards === void 0 ? {} : { rewards: state.rewards.map(cloneRewardState) },
+    ...state.inventory === void 0 ? {} : {
+      inventory: {
+        ...state.inventory,
+        ...state.inventory.rewardRemaining === void 0 ? {} : { rewardRemaining: { ...state.inventory.rewardRemaining } }
+      }
+    }
   };
 }
 function isRecord(value) {
@@ -635,7 +643,7 @@ function isRewardState(value) {
 function isStampRallyState(value) {
   if (typeof value !== "object" || value === null) return false;
   const state = value;
-  return typeof state.rallyId === "string" && (typeof state.userId === "string" || state.userId === null) && typeof state.updatedAt === "string" && Array.isArray(state.records) && state.records.every(isRecord) && (state.rewards === void 0 || Array.isArray(state.rewards) && state.rewards.every(isRewardState));
+  return typeof state.rallyId === "string" && (typeof state.userId === "string" || state.userId === null) && typeof state.updatedAt === "string" && Array.isArray(state.records) && state.records.every(isRecord) && (state.rewards === void 0 || Array.isArray(state.rewards) && state.rewards.every(isRewardState)) && (state.inventory === void 0 || typeof state.inventory === "object" && state.inventory !== null && !Array.isArray(state.inventory) && (state.inventory.sharedRemaining === void 0 || typeof state.inventory.sharedRemaining === "number" && Number.isInteger(state.inventory.sharedRemaining) && state.inventory.sharedRemaining >= 0) && (state.inventory.rewardRemaining === void 0 || typeof state.inventory.rewardRemaining === "object" && state.inventory.rewardRemaining !== null && !Array.isArray(state.inventory.rewardRemaining)));
 }
 function isValidDate(value) {
   return typeof value === "string" && !Number.isNaN(Date.parse(value));
@@ -680,6 +688,35 @@ var InMemoryStorage = class {
 function storageKey(rallyId, userId) {
   return `stamprally:${rallyId}:${userId ?? "anonymous"}`;
 }
+function createAnonymousSessionId(storage) {
+  const key = "stamprally:anonymous-session-id";
+  try {
+    const browserStorage = typeof window === "undefined" ? null : window.localStorage;
+    const value = storage?.getItem(key) ?? browserStorage?.getItem(key);
+    if (value !== null && value !== void 0 && isUuidV4(value)) return value;
+    const generated = randomUuidV4();
+    (storage ?? browserStorage)?.setItem(key, generated);
+    return generated;
+  } catch {
+    return randomUuidV4();
+  }
+}
+function isUuidV4(value) {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
+function randomUuidV4() {
+  const cryptoApi3 = globalThis.crypto;
+  if (cryptoApi3?.randomUUID !== void 0) return cryptoApi3.randomUUID();
+  if (cryptoApi3?.getRandomValues !== void 0) {
+    const bytes2 = cryptoApi3.getRandomValues(new Uint8Array(16));
+    bytes2[6] = (bytes2[6] ?? 0) & 15 | 64;
+    bytes2[8] = (bytes2[8] ?? 0) & 63 | 128;
+    const hex = Array.from(bytes2, (byte) => byte.toString(16).padStart(2, "0")).join("");
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+  }
+  const random = `${Date.now().toString(16)}${Math.random().toString(16).slice(2)}`.padEnd(32, "0").slice(0, 32);
+  return `${random.slice(0, 8)}-${random.slice(8, 12)}-4${random.slice(13, 16)}-8${random.slice(17, 20)}-${random.slice(20)}`;
+}
 var defaultStorageWarningHandler = (error) => {
   console.warn(`[@stamprally/core] ${error.message}`, error);
 };
@@ -1069,6 +1106,7 @@ var StampRallyClient = class {
   #config;
   #offlineQueue;
   #userId;
+  #anonymousSessionId;
   #state = null;
   #initialization = null;
   #queue = Promise.resolve();
@@ -1076,7 +1114,8 @@ var StampRallyClient = class {
     this.#config = config;
     this.#options = isStorage(storageOrOptions) ? { storage: storageOrOptions } : storageOrOptions;
     this.#storage = this.#options.storage ?? new InMemoryStorage();
-    this.#userId = this.#options.userId ?? null;
+    this.#anonymousSessionId = this.#options.anonymousSessionId ?? createAnonymousSessionId();
+    this.#userId = this.#options.userId ?? this.#anonymousSessionId;
     this.#offlineQueue = this.#options.offlineQueue;
     this.#offlineQueue?.setSyncResultListener((event) => this.#handleOfflineSyncResult(event));
   }
@@ -1089,6 +1128,9 @@ var StampRallyClient = class {
   getUserId() {
     return this.#userId;
   }
+  getAnonymousSessionId() {
+    return this.#anonymousSessionId;
+  }
   get syncState() {
     return this.#offlineQueue?.syncState ?? "idle";
   }
@@ -1126,11 +1168,12 @@ var StampRallyClient = class {
   }
   switchUser(newUserId) {
     return this.#enqueue(async () => {
-      if (this.#userId === newUserId && this.#state !== null) return this.#state;
-      this.#userId = newUserId;
+      const nextUserId = newUserId ?? this.#anonymousSessionId;
+      if (this.#userId === nextUserId && this.#state !== null) return this.#state;
+      this.#userId = nextUserId;
       this.#state = null;
       this.#initialization = null;
-      await this.#offlineQueue?.switchUser(newUserId);
+      await this.#offlineQueue?.switchUser(nextUserId);
       return this.initialize();
     });
   }
@@ -1198,7 +1241,8 @@ var StampRallyClient = class {
         proofData,
         idempotencyKey: options.idempotencyKey ?? id("check-in"),
         now,
-        state: current
+        state: current,
+        ...this.#userId === this.#anonymousSessionId ? { anonymousSessionId: this.#anonymousSessionId } : {}
       };
       const remote = this.#options.syncAdapter?.checkIn;
       if (options.sync !== false && remote !== void 0) {
@@ -1254,7 +1298,8 @@ var StampRallyClient = class {
         idempotencyKey: options.idempotencyKey ?? id("claim"),
         now,
         options,
-        state: current
+        state: current,
+        ...this.#userId === this.#anonymousSessionId ? { anonymousSessionId: this.#anonymousSessionId } : {}
       };
       const remote = this.#options.syncAdapter?.claimReward;
       if (options.sync !== false && remote !== void 0) {
@@ -1306,13 +1351,10 @@ var StampRallyClient = class {
       const serverState = await adapter.sync({
         rallyId: this.#config.id,
         userId: this.#userId,
-        state: this.#state ?? current
-      });
-      const localState = this.#state ?? current;
-      const merged = this.#offlineQueue === void 0 ? serverState : resolveRallyStateConflict(serverState, localState, {
-        policy: this.#offlineQueue.conflictPolicy
+        state: this.#state ?? current,
+        ...this.#userId === this.#anonymousSessionId ? { anonymousSessionId: this.#anonymousSessionId } : {}
       });
-      const next = this.#reconcile(merged);
+      const next = this.#reconcile(serverState);
       await this.#storage.save(next);
       this.#state = next;
       this.#emit(next);
@@ -1524,6 +1566,16 @@ function errorValue(value, fallbackCode) {
   if (typeof value === "string") return { code: fallbackCode, message: value };
   return { code: fallbackCode, message: "Offline operation was rejected." };
 }
+var syncLocks = /* @__PURE__ */ new Map();
+var SYNC_LOCK_TTL_MS = 3e4;
+var DEFAULT_RETRY_OPTIONS = {
+  maxRetries: 0,
+  initialIntervalMs: 250,
+  backoffMultiplier: 2
+};
+function randomId() {
+  return globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+}
 var OfflineQueue = class {
   #storage;
   #configuredKey;
@@ -1538,6 +1590,12 @@ var OfflineQueue = class {
   #sender;
   #syncPromise = null;
   #syncResultListener;
+  #synchronizeInstances;
+  #retryOptions;
+  #instanceId = randomId();
+  #lockStorage;
+  #storageListener;
+  #channel = null;
   constructor(options = {}) {
     if (options.storage !== void 0) this.#storage = options.storage;
     else if (options.storageLike !== void 0 && options.storageLike !== null)
@@ -1548,6 +1606,18 @@ var OfflineQueue = class {
     this.#userId = options.userId ?? null;
     this.#conflictPolicy = options.conflictPolicy ?? "server_wins";
     this.#onSyncConflict = options.onSyncConflict;
+    this.#synchronizeInstances = options.synchronizeInstances ?? true;
+    const retryOptions = {
+      ...DEFAULT_RETRY_OPTIONS,
+      ...options.retryOptions ?? options.syncRetryOptions ?? options.retry ?? {}
+    };
+    this.#retryOptions = {
+      maxRetries: Math.max(0, Math.floor(retryOptions.maxRetries)),
+      initialIntervalMs: Math.max(0, retryOptions.initialIntervalMs),
+      backoffMultiplier: Math.max(1, retryOptions.backoffMultiplier)
+    };
+    this.#lockStorage = options.storageLike ?? globalThis.localStorage ?? null;
+    if (this.#synchronizeInstances) this.#subscribeToExternalChanges();
   }
   get syncState() {
     return this.#state;
@@ -1578,9 +1648,19 @@ var OfflineQueue = class {
   }
   async initialize() {
     if (this.#loaded) return;
-    this.#operations = [...await this.#storage.load(this.#storageKey())];
+    this.#operations = (await this.#storage.load(this.#storageKey())).map(normalizeOperation);
     this.#loaded = true;
   }
+  /** Releases browser listeners when the queue is no longer used. */
+  dispose() {
+    const windowLike = globalThis.window;
+    if (windowLike !== void 0 && this.#storageListener !== void 0)
+      windowLike.removeEventListener("storage", this.#storageListener);
+    this.#storageListener = void 0;
+    this.#channel?.close();
+    this.#channel = null;
+    this.#releaseSyncLock();
+  }
   /** Selects a rally/user queue scope and loads its pending operations. */
   async setScope(rallyId, userId) {
     if (this.#configuredKey !== void 0) {
@@ -1613,8 +1693,9 @@ var OfflineQueue = class {
     await this.initialize();
     const id2 = operationId(operation);
     if (this.#operations.some((item) => operationId(item) === id2)) return;
-    this.#operations = [...this.#operations, operation];
+    this.#operations = [...this.#operations, { ...operation, status: "PENDING", attempts: 0 }];
     await this.#storage.save(this.#storageKey(), this.#operations);
+    this.#announceChange();
   }
   async enqueueCheckIn(request) {
     return this.enqueue({ kind: "checkIn", request });
@@ -1626,6 +1707,7 @@ var OfflineQueue = class {
     await this.initialize();
     this.#operations = [];
     await this.#storage.save(this.#storageKey(), this.#operations);
+    this.#announceChange();
   }
   async sync(sender = this.#sender) {
     await this.initialize();
@@ -1641,35 +1723,83 @@ var OfflineQueue = class {
     return this.sync(sender);
   }
   async #run(sender) {
+    const locks = globalThis.navigator?.locks;
+    if (locks !== void 0) {
+      let callbackStarted = false;
+      try {
+        const acquired = await locks.request(
+          `stamprally:${this.#storageKey()}:sync`,
+          { ifAvailable: true },
+          async (lock) => {
+            if (lock === null) {
+              await this.#reloadFromStorage();
+              this.#state = "idle";
+              return false;
+            }
+            callbackStarted = true;
+            await this.#runWithStorageLock(sender);
+            return true;
+          }
+        );
+        if (!acquired) return;
+        return;
+      } catch (error) {
+        if (callbackStarted) throw error;
+      }
+    }
+    await this.#runWithStorageLock(sender);
+  }
+  async #runWithStorageLock(sender) {
     this.#state = "syncing";
     this.#error = null;
+    if (!this.#acquireSyncLock()) {
+      await this.#reloadFromStorage();
+      this.#state = "idle";
+      return;
+    }
     try {
       while (this.#operations.length > 0) {
         const operation = this.#operations[0];
         if (operation === void 0) break;
-        let rawResult;
-        try {
-          rawResult = await sender(operation);
-        } catch (cause) {
-          throw new Error(errorValue(cause, "RETRYABLE_ERROR").message);
-        }
-        const response = this.#normalizeResponse(rawResult);
-        if (response.status === "RETRYABLE_ERROR") {
+        let attempt = 0;
+        let response;
+        while (true) {
+          await this.#updateOperationStatus("IN_FLIGHT", attempt);
+          try {
+            response = this.#normalizeResponse(await sender(operation));
+          } catch (cause) {
+            response = {
+              status: "RETRYABLE_ERROR",
+              error: errorValue(cause, "RETRYABLE_ERROR")
+            };
+          }
+          if (response.status !== "RETRYABLE_ERROR") break;
           const error2 = errorValue(response.error ?? response.reason, "RETRYABLE_ERROR");
+          await this.#updateOperationStatus("PENDING", attempt + 1);
           await this.#syncResultListener?.({ operation, status: response.status, error: error2 });
-          throw new Error(error2.message);
+          if (attempt >= this.#retryOptions.maxRetries) throw new Error(error2.message);
+          const interval = this.#retryOptions.initialIntervalMs * this.#retryOptions.backoffMultiplier ** attempt;
+          await new Promise((resolve) => setTimeout(resolve, Math.max(0, interval)));
+          attempt += 1;
         }
         const result = response.result;
         const state = response.state ?? (result !== void 0 && "conflict" in result && result.conflict === true ? await this.resolveConflict(operation, result.localState, result.serverState) : result !== void 0 && "ok" in result && result.ok ? result.value.state : void 0);
         const error = response.status === "REJECTED_PERMANENT" ? errorValue(response.error ?? response.reason, "REJECTED_PERMANENT") : void 0;
+        await this.#updateOperationStatus(
+          response.status === "ACCEPTED" ? "ACCEPTED" : "REJECTED",
+          attempt + 1
+        );
+        const fallbackState = response.status === "REJECTED_PERMANENT" ? operation.request.state : void 0;
+        const eventState = state ?? fallbackState;
         this.#operations = this.#operations.slice(1);
         await this.#storage.save(this.#storageKey(), this.#operations);
+        this.#announceChange();
         await this.#syncResultListener?.({
           operation,
           ...result === void 0 ? {} : { result },
           status: response.status,
           ...error === void 0 ? {} : { error },
-          ...state === void 0 ? {} : { state }
+          ...eventState === void 0 ? {} : { state: eventState }
         });
       }
       this.#state = "idle";
@@ -1677,6 +1807,87 @@ var OfflineQueue = class {
       this.#state = "error";
       this.#error = cause instanceof Error ? cause : new Error(String(cause));
       throw this.#error;
+    } finally {
+      this.#releaseSyncLock();
+    }
+  }
+  async #updateOperationStatus(status, attempts) {
+    const operation = this.#operations[0];
+    if (operation === void 0) return;
+    this.#operations = [{ ...operation, status, attempts }, ...this.#operations.slice(1)];
+    await this.#storage.save(this.#storageKey(), this.#operations);
+    this.#announceChange();
+  }
+  #subscribeToExternalChanges() {
+    const windowLike = globalThis.window;
+    if (windowLike !== void 0) {
+      this.#storageListener = (event) => {
+        if (event.key === this.#storageKey()) void this.#reloadFromStorage();
+      };
+      windowLike.addEventListener("storage", this.#storageListener);
+    }
+    const Channel = globalThis.BroadcastChannel;
+    if (Channel !== void 0) {
+      try {
+        this.#channel = new Channel("stamprally:queue-sync");
+        this.#channel.addEventListener("message", (event) => {
+          if (typeof event.data === "object" && event.data !== null && "key" in event.data && event.data.key === this.#storageKey())
+            void this.#reloadFromStorage();
+        });
+      } catch {
+        this.#channel = null;
+      }
+    }
+  }
+  #announceChange() {
+    this.#channel?.postMessage({ key: this.#storageKey(), owner: this.#instanceId });
+  }
+  async #reloadFromStorage() {
+    if (this.#state === "syncing") return;
+    try {
+      this.#operations = (await this.#storage.load(this.#storageKey())).map(normalizeOperation);
+      this.#loaded = true;
+    } catch {
+    }
+  }
+  #lockKey() {
+    return `${this.#storageKey()}:sync-lock`;
+  }
+  #acquireSyncLock() {
+    const key = this.#lockKey();
+    const now = Date.now();
+    const local = syncLocks.get(key);
+    if (local !== void 0 && local.expiresAt > now && local.owner !== this.#instanceId)
+      return false;
+    if (this.#lockStorage !== null) {
+      try {
+        const existing = this.#lockStorage.getItem(key);
+        if (existing !== null) {
+          const parsed = JSON.parse(existing);
+          if (typeof parsed === "object" && parsed !== null && typeof parsed.expiresAt === "number" && parsed.expiresAt > now && parsed.owner !== this.#instanceId)
+            return false;
+        }
+        this.#lockStorage.setItem(
+          key,
+          JSON.stringify({ owner: this.#instanceId, expiresAt: now + SYNC_LOCK_TTL_MS })
+        );
+      } catch {
+      }
+    }
+    syncLocks.set(key, { owner: this.#instanceId, expiresAt: now + SYNC_LOCK_TTL_MS });
+    return true;
+  }
+  #releaseSyncLock() {
+    const key = this.#lockKey();
+    const current = syncLocks.get(key);
+    if (current?.owner === this.#instanceId) syncLocks.delete(key);
+    if (this.#lockStorage !== null) {
+      try {
+        const value = this.#lockStorage.getItem(key);
+        if (value !== null && JSON.parse(value).owner === this.#instanceId)
+          this.#lockStorage.removeItem?.(key);
+      } catch {
+      }
     }
   }
   #storageKey() {
@@ -1704,6 +1915,13 @@ var OfflineQueue = class {
     return resolveRallyStateConflict(serverState, localState, { policy });
   }
 };
+function normalizeOperation(operation) {
+  return {
+    ...operation,
+    status: operation.status === "IN_FLIGHT" ? "PENDING" : operation.status ?? "PENDING",
+    attempts: operation.attempts ?? 0
+  };
+}
 
 // src/crypto/token.ts
 var encoder = new TextEncoder();
@@ -2272,6 +2490,8 @@ function condition(value, path, errors, isPublic) {
     finiteNumber(value, "latitude", path, errors);
     finiteNumber(value, "longitude", path, errors);
     finiteNumber(value, "radiusMeters", path, errors, 0);
+    if (typeof value.radiusMeters === "number" && value.radiusMeters <= 0)
+      add(errors, `${path}.radiusMeters`, "Expected a radius greater than 0.", "out_of_range");
     if (typeof value.latitude === "number" && (value.latitude < -90 || value.latitude > 90))
       add(errors, `${path}.latitude`, "Expected a latitude between -90 and 90.", "out_of_range");
     if (typeof value.longitude === "number" && (value.longitude < -180 || value.longitude > 180))
@@ -2439,21 +2659,112 @@ function validate(value, isPublic) {
     optionalString(value, "staffPasscode", "$", errors);
     if (hasOwn(value, "inventory") && value.inventory !== void 0 && !isRecord3(value.inventory))
       add(errors, "$.inventory", "Expected an object.", "invalid_type");
+    if (hasOwn(value, "inventoryMode") && value.inventoryMode !== void 0 && value.inventoryMode !== "shared" && value.inventoryMode !== "per_reward")
+      add(errors, "$.inventoryMode", "Expected shared or per_reward.", "invalid_enum");
     if (hasOwn(value, "serverMetadata") && value.serverMetadata !== void 0 && !isRecord3(value.serverMetadata))
       add(errors, "$.serverMetadata", "Expected an object.", "invalid_type");
     if (hasOwn(value, "publicMetadata") && value.publicMetadata !== void 0 && !isRecord3(value.publicMetadata))
       add(errors, "$.publicMetadata", "Expected an object.", "invalid_type");
     optionalString(value, "serverEndpoint", "$", errors);
   } else {
-    for (const key of ["staffPasscode", "serverMetadata", "inventory"])
+    for (const key of ["staffPasscode", "serverMetadata", "inventory", "inventoryMode"])
       if (hasOwn(value, key))
         add(errors, `$.${key}`, "Private field is not allowed.", "private_field");
     optionalString(value, "serverEndpoint", "$", errors);
   }
   return errors;
 }
+function validateRallyConfigRelations(config) {
+  const errors = [];
+  const spotIds = /* @__PURE__ */ new Set();
+  const rewardIds = /* @__PURE__ */ new Set();
+  const orderIndexes = /* @__PURE__ */ new Map();
+  config.spots.forEach((spot2, index) => {
+    if (spotIds.has(spot2.id))
+      add(errors, `spots[${index}].id`, "Spot ID must be unique.", "duplicate_spot_id");
+    spotIds.add(spot2.id);
+    const previousIndex = orderIndexes.get(spot2.orderIndex);
+    if (previousIndex !== void 0)
+      add(
+        errors,
+        `spots[${index}].orderIndex`,
+        `orderIndex duplicates spots[${previousIndex}].`,
+        "duplicate_order_index"
+      );
+    else orderIndexes.set(spot2.orderIndex, index);
+    if (spot2.orderIndex < 0)
+      add(
+        errors,
+        `spots[${index}].orderIndex`,
+        "orderIndex must not be negative.",
+        "negative_order_index"
+      );
+    spot2.prerequisites?.forEach((prerequisite, prerequisiteIndex) => {
+      if (!spotIds.has(prerequisite) && !config.spots.some((candidate) => candidate.id === prerequisite))
+        add(
+          errors,
+          `spots[${index}].prerequisites[${prerequisiteIndex}]`,
+          "Prerequisite spot does not exist.",
+          "missing_prerequisite"
+        );
+    });
+  });
+  config.rewards.forEach((reward2, index) => {
+    if (rewardIds.has(reward2.id))
+      add(errors, `rewards[${index}].id`, "Reward ID must be unique.", "duplicate_reward_id");
+    rewardIds.add(reward2.id);
+    const visit = (condition2, path) => {
+      if (condition2.type === "stamps")
+        condition2.stampIds.forEach((stampId, stampIndex) => {
+          if (!spotIds.has(stampId))
+            add(
+              errors,
+              `${path}.stampIds[${stampIndex}]`,
+              "Referenced spot does not exist.",
+              "missing_reward_spot"
+            );
+        });
+      else if (condition2.type === "all" || condition2.type === "any")
+        condition2.conditions.forEach((nested, nestedIndex) => {
+          visit(nested, `${path}.conditions[${nestedIndex}]`);
+        });
+    };
+    reward2.conditions?.forEach((condition2, conditionIndex) => {
+      visit(condition2, `rewards[${index}].conditions[${conditionIndex}]`);
+    });
+  });
+  const visiting = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  const cycleNodes = /* @__PURE__ */ new Set();
+  const visitSpot = (spotId) => {
+    if (visiting.has(spotId)) {
+      cycleNodes.add(spotId);
+      return;
+    }
+    if (visited.has(spotId)) return;
+    visiting.add(spotId);
+    const spot2 = config.spots.find((candidate) => candidate.id === spotId);
+    spot2?.prerequisites?.forEach(visitSpot);
+    visiting.delete(spotId);
+    visited.add(spotId);
+  };
+  config.spots.forEach((spot2) => {
+    visitSpot(spot2.id);
+  });
+  cycleNodes.forEach((spotId) => {
+    const index = config.spots.findIndex((spot2) => spot2.id === spotId);
+    add(
+      errors,
+      `spots[${index}].prerequisites`,
+      "Prerequisites must form a DAG.",
+      "cyclic_prerequisites"
+    );
+  });
+  return errors;
+}
 function safeParseAdminConfig(input) {
-  const errors = validate(input, false);
+  const errors = [...validate(input, false)];
+  if (errors.length === 0) errors.push(...validateRallyConfigRelations(input));
   return errors.length === 0 ? { success: true, data: input } : { success: false, errors };
 }
 function parseAdminConfig(input) {
@@ -2462,7 +2773,8 @@ function parseAdminConfig(input) {
   return result.data;
 }
 function safeParsePublicConfig(input) {
-  const errors = validate(input, true);
+  const errors = [...validate(input, true)];
+  if (errors.length === 0) errors.push(...validateRallyConfigRelations(input));
   return errors.length === 0 ? { success: true, data: input } : { success: false, errors };
 }
 function parsePublicConfig(input) {
@@ -2605,6 +2917,7 @@ exports.assertPublicConfig = assertPublicConfig;
 exports.calculateDistanceMeters = calculateDistanceMeters;
 exports.calculateProgress = calculateProgress;
 exports.consumeReward = consumeReward;
+exports.createAnonymousSessionId = createAnonymousSessionId;
 exports.createClaimTicketNumber = createClaimTicketNumber;
 exports.createSecureToken = createSecureToken;
 exports.createSignedSnapshotToken = createSignedSnapshotToken;
@@ -2641,6 +2954,7 @@ exports.toLocalizedString = toLocalizedString;
 exports.toPublicConfig = toPublicConfig;
 exports.updateLocalizedField = updateLocalizedField;
 exports.validatePublicConfigSafety = validatePublicConfigSafety;
+exports.validateRallyConfigRelations = validateRallyConfigRelations;
 exports.verifyPasscode = verifyPasscode;
 exports.verifySecureToken = verifySecureToken;
 exports.verifySnapshotToken = verifySnapshotToken;