@stamprally/server 0.8.0 → 0.10.0

package/dist/index.js

@@ -1,6 +1,4 @@
-import { consumeReward, processStamp, createSecureToken, reconcileRewardStates } from '@stamprally/core';
-
-// src/index.ts
+import { reconcileRewardStates, consumeReward, evaluateConditionDetailed } from '@stamprally/core';
 
 // src/persistence.ts
 var InMemoryServerPersistenceAdapter = class {
@@ -8,46 +6,78 @@ var InMemoryServerPersistenceAdapter = class {
   #idempotent = /* @__PURE__ */ new Map();
   #states = /* @__PURE__ */ new Map();
   #stocks;
+  #stockDefaults;
+  #claims = /* @__PURE__ */ new Map();
+  #claimRecords = [];
   #auditLogs = [];
   constructor(options = {}) {
-    this.#stocks = new Map(Object.entries(options.stocks ?? {}));
+    this.#stocks = /* @__PURE__ */ new Map();
+    this.#stockDefaults = /* @__PURE__ */ new Map();
+    for (const [key, stock] of Object.entries(options.stocks ?? {})) {
+      if (key.includes(":")) this.#stocks.set(key, stock);
+      else this.#stockDefaults.set(key, stock);
+    }
+  }
+  #key(rallyId, key) {
+    return `${rallyId}:${key}`;
   }
-  async acquireLock(lockKey, ttlMs) {
+  #stockKey(rallyId, rewardId) {
+    const scopedKey = `${rallyId}:${rewardId}`;
+    if (this.#stocks.has(scopedKey)) return scopedKey;
+    const defaultStock = this.#stockDefaults.get(rewardId);
+    if (defaultStock !== void 0) {
+      this.#stocks.set(scopedKey, defaultStock);
+      return scopedKey;
+    }
+    return scopedKey;
+  }
+  async acquireLock(rallyId, key, ttlMs) {
+    const scopedKey = this.#key(rallyId, key);
     const now2 = Date.now();
-    const expiresAt = this.#locks.get(lockKey);
-    if (expiresAt !== void 0 && expiresAt > now2) return false;
-    this.#locks.set(lockKey, now2 + Math.max(1, ttlMs));
+    const until = this.#locks.get(scopedKey);
+    if (until !== void 0 && until > now2) return false;
+    this.#locks.set(scopedKey, now2 + Math.max(1, ttlMs));
     return true;
   }
-  async releaseLock(lockKey) {
-    this.#locks.delete(lockKey);
-  }
-  async decrementRewardStock(rewardId) {
-    const stock = this.#stocks.get(rewardId);
-    if (stock === void 0) return { success: true, remainingStock: Number.POSITIVE_INFINITY };
-    if (stock <= 0) return { success: false, remainingStock: 0 };
-    const remainingStock = stock - 1;
-    this.#stocks.set(rewardId, remainingStock);
-    return { success: true, remainingStock };
-  }
-  async getIdempotentResult(idempotencyKey) {
-    const entry = this.#idempotent.get(idempotencyKey);
-    if (entry === void 0) return null;
-    if (entry.expiresAt <= Date.now()) {
-      this.#idempotent.delete(idempotencyKey);
+  async releaseLock(rallyId, key) {
+    this.#locks.delete(this.#key(rallyId, key));
+  }
+  async getRewardStock(rallyId, rewardId) {
+    return this.#stocks.get(this.#stockKey(rallyId, rewardId)) ?? null;
+  }
+  async decrementRewardStock(rallyId, rewardId) {
+    const key = this.#stockKey(rallyId, rewardId);
+    const current = this.#stocks.get(key);
+    if (current === void 0) return { success: true, remainingStock: Number.POSITIVE_INFINITY };
+    if (current <= 0) return { success: false, remainingStock: 0 };
+    this.#stocks.set(key, current - 1);
+    return { success: true, remainingStock: current - 1 };
+  }
+  async restoreRewardStock(rallyId, rewardId) {
+    const key = this.#stockKey(rallyId, rewardId);
+    const current = this.#stocks.get(key);
+    if (current !== void 0) this.#stocks.set(key, current + 1);
+  }
+  async getIdempotentResult(rallyId, key) {
+    const value = this.#idempotent.get(this.#key(rallyId, key));
+    if (value === void 0 || value.expiresAt <= Date.now()) {
+      this.#idempotent.delete(this.#key(rallyId, key));
       return null;
     }
-    return structuredClone(entry.value);
+    return structuredClone(value.value);
   }
-  async saveIdempotentResult(idempotencyKey, result, ttlMs) {
-    this.#idempotent.set(idempotencyKey, {
+  async saveIdempotentResult(rallyId, key, result, ttlMs) {
+    this.#idempotent.set(this.#key(rallyId, key), {
       value: structuredClone(result),
       expiresAt: Date.now() + Math.max(1, ttlMs)
     });
   }
+  async getUserClaimCount(rallyId, userId, rewardId) {
+    return this.#claims.get(`${rallyId}:${userId}:${rewardId}`) ?? 0;
+  }
   async getUserState(rallyId, userId) {
-    const state = this.#states.get(`${rallyId}:${userId}`);
-    return state === void 0 ? null : structuredClone(state);
+    const value = this.#states.get(`${rallyId}:${userId}`);
+    return value === void 0 ? null : structuredClone(value);
   }
   async saveUserState(rallyId, userId, state) {
     this.#states.set(`${rallyId}:${userId}`, structuredClone(state));
@@ -58,78 +88,84 @@ var InMemoryServerPersistenceAdapter = class {
   getAuditLogs() {
     return structuredClone(this.#auditLogs);
   }
+  async recordUserClaim(params) {
+    const { rallyId, userId, rewardId } = params;
+    const key = `${rallyId}:${userId}:${rewardId}`;
+    this.#claims.set(key, (this.#claims.get(key) ?? 0) + 1);
+    this.#claimRecords.push(structuredClone(params));
+  }
+  async incrementUserClaimCount(rallyId, userId, rewardId) {
+    const key = `${rallyId}:${userId}:${rewardId}`;
+    this.#claims.set(key, (this.#claims.get(key) ?? 0) + 1);
+  }
+  getClaimRecords() {
+    return structuredClone(this.#claimRecords);
+  }
+  recordClaim(paramsOrRallyId, userId, rewardId) {
+    const params = typeof paramsOrRallyId === "string" ? {
+      rallyId: paramsOrRallyId,
+      userId: userId ?? "",
+      rewardId: rewardId ?? "",
+      ticketNumber: "",
+      timestamp: Date.now()
+    } : paramsOrRallyId;
+    return this.recordUserClaim(params);
+  }
 };
-function distanceMeters(aLat, aLon, bLat, bLon) {
-  const radians = (degrees) => degrees * Math.PI / 180;
-  const dLat = radians(bLat - aLat);
-  const dLon = radians(bLon - aLon);
-  const latA = radians(aLat);
-  const latB = radians(bLat);
-  const value = Math.sin(dLat / 2) ** 2 + Math.cos(latA) * Math.cos(latB) * Math.sin(dLon / 2) ** 2;
-  return 6371e3 * 2 * Math.asin(Math.sqrt(Math.min(1, value)));
-}
-function initialState(config, now2) {
-  return {
-    rallyId: config.id,
-    records: [],
-    rewards: reconcileRewardStates(
-      config.rewards.map((reward) => ({ ...reward, description: reward.description ?? "" })),
-      [],
-      0,
-      now2
-    ),
-    updatedAt: now2
-  };
-}
 function json(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
     headers: { "content-type": "application/json; charset=utf-8" }
   });
 }
-function requestBody(request) {
-  return request.json().then((value) => {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
-    return value;
-  }).catch(() => null);
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requestId(prefix) {
+  return `${prefix}-${globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random().toString(36).slice(2)}`}`;
 }
-function adminReward(reward) {
-  return { ...reward, description: reward.description ?? "" };
+function now(options, requested) {
+  return requested ?? options.now?.() ?? (/* @__PURE__ */ new Date()).toISOString();
 }
-function matchesCondition(condition, context, customValidators) {
-  switch (condition.type) {
-    case "qr":
-      return context.type === "qr" && context.token === condition.secretToken;
-    case "passcode":
-      return context.type === "passcode" && (condition.caseSensitive === false ? context.code.toLocaleLowerCase() === condition.code.toLocaleLowerCase() : context.code === condition.code);
-    case "gps":
-      return context.type === "gps" && distanceMeters(
-        condition.latitude,
-        condition.longitude,
-        context.latitude,
-        context.longitude
-      ) <= condition.radiusMeters;
-    case "custom":
-      return customValidators?.[condition.validatorName]?.(
-        context.type === "custom" ? context.value : void 0,
-        condition
-      ) ?? false;
-  }
+function initialState(config, userId, timestamp) {
+  return {
+    rallyId: config.id,
+    userId,
+    records: [],
+    rewards: reconcileRewardStates(config.rewards, [], 0, timestamp),
+    updatedAt: timestamp
+  };
+}
+function getProof(context) {
+  return context.type === "qr" ? context.token : context.type === "passcode" ? context.code : context.type === "gps" ? { latitude: context.latitude, longitude: context.longitude } : context.type === "nfc" ? context.tagId : context.value;
+}
+async function evaluate(condition, context, validator, base) {
+  if (condition.type !== "custom") return evaluateConditionDetailed(condition, context).ok;
+  if (validator === void 0) return false;
+  const validationContext = {
+    rallyId: base.rallyId,
+    spotId: base.spotId,
+    proofData: getProof(context),
+    condition,
+    userState: base.state
+  };
+  const result = typeof validator === "function" ? await validator(validationContext) : await validator.validate(validationContext);
+  return result === true || typeof result === "object" && result.valid;
 }
-function audit(request, status, now2, errorCode) {
+function audit(rallyId, userId, action, resourceId, key, status, timestamp, code) {
   return {
-    id: `audit-${globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random().toString(36).slice(2)}`}`,
-    timestamp: now2,
-    rallyId: request.rallyId,
-    userId: request.userId,
-    action: "CHECK_IN",
-    resourceId: request.spotId,
+    id: requestId("audit"),
+    timestamp,
+    rallyId,
+    userId,
+    action,
+    resourceId,
     status,
-    idempotencyKey: request.idempotencyKey,
-    ...errorCode === void 0 ? {} : { metadata: { errorCode } }
+    idempotencyKey: key,
+    ...code === void 0 ? {} : { metadata: { errorCode: code } }
   };
 }
-var UniversalRallyServer = class {
+var StampRallyServer = class {
   #config;
   #persistence;
   #options;
@@ -138,185 +174,94 @@ var UniversalRallyServer = class {
     this.#persistence = persistence;
     this.#options = options;
   }
-  /** Web Standard endpoint handler. Authentication, when configured, supplies the user identity. */
+  async handle(request) {
+    if (request.method !== "POST")
+      return json({ ok: false, code: "METHOD_NOT_ALLOWED", message: "POST is required." }, 405);
+    const path = new URL(request.url).pathname;
+    if (path.endsWith("/check-in")) return this.handleCheckIn(request);
+    if (path.endsWith("/claim-reward")) return this.handleClaimReward(request);
+    if (path.endsWith("/sync")) return this.handleSync(request);
+    return json({ ok: false, code: "NOT_FOUND", message: "Route not found." }, 404);
+  }
   async handleCheckIn(request) {
-    const body = await requestBody(request);
-    const userId = await this.#authenticatedUser(request, body?.userId);
-    if (this.#options.authenticate !== void 0 && userId === null)
-      return json(
-        { ok: false, error: { code: "UNAUTHORIZED", message: "Authentication is required." } },
-        401
-      );
-    if (body === null || userId === null || body.rallyId !== this.#config.id || body.spotId === "" || body.idempotencyKey === "")
+    const body = await this.#body(request);
+    const userId = await this.#user(request, body?.userId);
+    if (body === null || userId === null || body.rallyId !== this.#config.id || body.spotId === "" || body.idempotencyKey === "" || body.context === void 0)
       return json(
         {
           ok: false,
-          error: {
-            code: "INVALID_REQUEST",
-            message: "rallyId, spotId, and idempotencyKey are required."
-          }
+          code: "INVALID_REQUEST",
+          message: "rallyId, spotId, context, and idempotencyKey are required."
         },
         400
       );
-    if (body.context === void 0)
-      return json(
-        { ok: false, error: { code: "INVALID_REQUEST", message: "context is required." } },
-        400
-      );
     const result = await this.checkIn({ ...body, userId });
-    return result.ok ? json(result) : json(result, result.code === "SPOT_NOT_FOUND" ? 404 : 422);
+    return json(result, result.ok ? 200 : result.code === "SPOT_NOT_FOUND" ? 404 : 422);
   }
   async handleClaimReward(request) {
-    const body = await requestBody(request);
-    const userId = await this.#authenticatedUser(request, body?.userId);
-    if (this.#options.authenticate !== void 0 && userId === null)
-      return json(
-        { ok: false, error: { code: "UNAUTHORIZED", message: "Authentication is required." } },
-        401
-      );
+    const body = await this.#body(request);
+    const userId = await this.#user(request, body?.userId);
     if (body === null || userId === null || body.rallyId !== this.#config.id || body.rewardId === "" || body.idempotencyKey === "")
       return json(
         {
           ok: false,
-          error: {
-            code: "INVALID_REQUEST",
-            message: "rallyId, rewardId, and idempotencyKey are required."
-          }
+          code: "INVALID_REQUEST",
+          message: "rallyId, rewardId, and idempotencyKey are required."
         },
         400
       );
-    const key = `claim-reward:${body.rallyId}:${userId}:${body.rewardId}:${body.idempotencyKey}`;
-    const previous = await this.#persistence.getIdempotentResult(key);
-    if (previous !== null) return json(previous, previous.ok ? 200 : 422);
-    const reward = this.#config.rewards.find((item) => item.id === body.rewardId);
-    if (reward === void 0) {
-      const failure = {
-        ok: false,
-        code: "REWARD_NOT_FOUND",
-        message: "Reward was not found."
-      };
-      return json(await this.#rememberClaim(key, failure, body, userId), 404);
-    }
-    const timestamp = body.now ?? this.#options.now?.() ?? (/* @__PURE__ */ new Date()).toISOString();
-    const current = await this.sync(body.rallyId, userId);
-    const currentReward = current.rewards?.find((item) => item.rewardId === reward.id) ?? {
-      rewardId: reward.id,
-      status: "LOCKED"
-    };
-    const userClaims = await this.#getUserClaimCount(userId, reward.id);
-    const local = consumeReward({
-      reward: adminReward(reward),
-      currentState: currentReward,
-      now: timestamp,
-      userId,
-      userRedemptionCount: userClaims,
-      ...body.staffPasscode === void 0 ? {} : { inputPasscode: body.staffPasscode },
-      ...body.staffId === void 0 ? {} : { staffId: body.staffId }
-    });
-    if (!local.ok)
-      return json(
-        await this.#rememberClaim(
-          key,
-          {
-            ok: false,
-            code: local.error.code,
-            message: "Reward cannot be claimed.",
-            error: local.error
-          },
-          body,
-          userId
-        ),
-        422
-      );
-    const stock = await this.#persistence.decrementRewardStock(reward.id);
-    if (!stock.success)
-      return json(
-        await this.#rememberClaim(
-          key,
-          { ok: false, code: "OUT_OF_STOCK", message: "Reward is out of stock." },
-          body,
-          userId
-        ),
-        422
-      );
-    const next = {
-      ...current,
-      rewards: (current.rewards ?? []).map(
-        (item) => item.rewardId === reward.id ? local.value : item
-      ),
-      updatedAt: timestamp
-    };
-    await this.#persistence.saveUserState(body.rallyId, userId, next);
-    const success = local.value.claimTicketNumber === void 0 ? { ok: true, state: next } : { ok: true, state: next, claimTicketNumber: local.value.claimTicketNumber };
-    await this.#persistence.saveIdempotentResult(
-      key,
-      success,
-      this.#options.idempotencyTtlMs ?? 864e5
-    );
-    await this.#persistence.recordAuditLog({
-      id: `audit-${globalThis.crypto?.randomUUID?.() ?? Date.now()}`,
-      timestamp,
-      rallyId: body.rallyId,
-      userId,
-      action: "CLAIM_REWARD",
-      resourceId: reward.id,
-      status: "SUCCESS",
-      idempotencyKey: body.idempotencyKey
-    });
-    return json(success);
+    const result = await this.claimReward({ ...body, userId });
+    return json(result, result.ok ? 200 : result.code === "REWARD_NOT_FOUND" ? 404 : 422);
   }
   async handleSync(request) {
-    const body = await requestBody(request);
-    const userId = await this.#authenticatedUser(request, body?.userId);
-    if (this.#options.authenticate !== void 0 && userId === null)
-      return json(
-        { ok: false, error: { code: "UNAUTHORIZED", message: "Authentication is required." } },
-        401
-      );
+    const body = await this.#body(request);
+    const userId = await this.#user(request, body?.userId);
     if (body === null || userId === null || body.rallyId !== this.#config.id)
-      return json(
-        { ok: false, error: { code: "INVALID_REQUEST", message: "rallyId is required." } },
-        400
-      );
+      return json({ ok: false, code: "INVALID_REQUEST", message: "rallyId is required." }, 400);
     return json({ ok: true, state: await this.sync(body.rallyId, userId) });
   }
-  async handle(request) {
-    if (request.method !== "POST")
-      return json({ ok: false, error: { code: "METHOD_NOT_ALLOWED" } }, 405);
-    const path = new URL(request.url).pathname;
-    if (path.endsWith("/check-in")) return this.handleCheckIn(request);
-    if (path.endsWith("/claim-reward")) return this.handleClaimReward(request);
-    if (path.endsWith("/sync")) return this.handleSync(request);
-    return json({ ok: false, error: { code: "NOT_FOUND" } }, 404);
-  }
   async checkIn(request) {
     const key = `check-in:${request.rallyId}:${request.userId}:${request.idempotencyKey}`;
-    const previous = await this.#persistence.getIdempotentResult(key);
+    const previous = await this.#persistence.getIdempotentResult(
+      request.rallyId,
+      key
+    );
     if (previous !== null) return previous;
     const lockKey = `state:${request.rallyId}:${request.userId}`;
-    const locked = await this.#persistence.acquireLock(lockKey, this.#options.lockTtlMs ?? 5e3);
-    if (!locked)
+    if (!await this.#persistence.acquireLock(
+      request.rallyId,
+      lockKey,
+      this.#options.lockTtlMs ?? 5e3
+    ))
       return { ok: false, code: "CONFLICT", message: "The user state is being updated." };
-    const now2 = request.now ?? this.#options.now?.() ?? (/* @__PURE__ */ new Date()).toISOString();
+    const timestamp = now(this.#options, request.now);
     try {
       const spot = this.#config.spots.find((item) => item.id === request.spotId);
       if (spot === void 0)
         return this.#remember(
           key,
           { ok: false, code: "SPOT_NOT_FOUND", message: "Spot was not found." },
-          request,
-          now2
+          request.rallyId,
+          request.userId,
+          "CHECK_IN",
+          request.spotId,
+          request.idempotencyKey,
+          timestamp
         );
-      const current = await this.#persistence.getUserState(request.rallyId, request.userId) ?? initialState(this.#config, now2);
+      const current = await this.#persistence.getUserState(request.rallyId, request.userId) ?? initialState(this.#config, request.userId, timestamp);
       if (current.records.some((record) => record.stampId === request.spotId))
         return this.#remember(
           key,
-          { ok: false, code: "ALREADY_CLAIMED", message: "Spot was already claimed." },
-          request,
-          now2
+          { ok: false, code: "STAMP_ALREADY_ACQUIRED", message: "Spot was already claimed." },
+          request.rallyId,
+          request.userId,
+          "CHECK_IN",
+          request.spotId,
+          request.idempotencyKey,
+          timestamp
         );
       const acquired = new Set(current.records.map((record) => record.stampId));
-      if (spot.prerequisites?.some((id2) => !acquired.has(id2)))
+      if (spot.prerequisites?.some((id) => !acquired.has(id)))
         return this.#remember(
           key,
           {
@@ -324,440 +269,234 @@ var UniversalRallyServer = class {
             code: "PREREQUISITES_NOT_MET",
             message: "Prerequisite spots are not complete."
           },
+          request.rallyId,
+          request.userId,
+          "CHECK_IN",
+          request.spotId,
+          request.idempotencyKey,
+          timestamp
+        );
+      for (const condition of spot.conditions)
+        if (!await evaluate(
+          condition,
+          request.context,
+          condition.type === "custom" ? this.#options.customValidators?.[condition.validatorName] : void 0,
+          { rallyId: request.rallyId, spotId: request.spotId, state: current }
+        ))
+          return this.#remember(
+            key,
+            { ok: false, code: "INVALID_PROOF", message: "Verification failed." },
+            request.rallyId,
+            request.userId,
+            "CHECK_IN",
+            request.spotId,
+            request.idempotencyKey,
+            timestamp
+          );
+      const next = {
+        ...current,
+        records: [...current.records, { stampId: request.spotId, acquiredAt: timestamp }],
+        rewards: reconcileRewardStates(
+          this.#config.rewards,
+          current.rewards,
+          current.records.length + 1,
+          timestamp
+        ),
+        updatedAt: timestamp
+      };
+      await this.#persistence.saveUserState(request.rallyId, request.userId, next);
+      return this.#remember(
+        key,
+        { ok: true, state: next },
+        request.rallyId,
+        request.userId,
+        "CHECK_IN",
+        request.spotId,
+        request.idempotencyKey,
+        timestamp
+      );
+    } finally {
+      await this.#persistence.releaseLock(request.rallyId, lockKey);
+    }
+  }
+  async claimReward(request) {
+    const key = `claim:${request.rallyId}:${request.userId}:${request.rewardId}:${request.idempotencyKey}`;
+    const previous = await this.#persistence.getIdempotentResult(
+      request.rallyId,
+      key
+    );
+    if (previous !== null) return previous;
+    const reward = this.#config.rewards.find((item) => item.id === request.rewardId);
+    if (reward === void 0)
+      return this.#rememberClaim(
+        key,
+        { ok: false, code: "REWARD_NOT_FOUND", message: "Reward was not found." },
+        request,
+        now(this.#options, request.now)
+      );
+    const lockKey = `reward:${request.rallyId}:${reward.id}`;
+    if (!await this.#persistence.acquireLock(
+      request.rallyId,
+      lockKey,
+      this.#options.lockTtlMs ?? 5e3
+    ))
+      return { ok: false, code: "CONFLICT", message: "The reward is being claimed." };
+    const timestamp = now(this.#options, request.now);
+    let decremented = false;
+    try {
+      const checked = await this.#persistence.getIdempotentResult(
+        request.rallyId,
+        key
+      );
+      if (checked !== null) return checked;
+      const current = await this.#persistence.getUserState(request.rallyId, request.userId) ?? initialState(this.#config, request.userId, timestamp);
+      const claimCount = await this.#persistence.getUserClaimCount(
+        request.rallyId,
+        request.userId,
+        reward.id
+      );
+      const storedReward = current.rewards.find((item) => item.rewardId === reward.id) ?? {
+        rewardId: reward.id,
+        status: "LOCKED"
+      };
+      const currentReward = reward.redemptionMethod === "server_claim" && storedReward.status === "CONSUMED" && (reward.userClaimLimit === void 0 || claimCount < reward.userClaimLimit) ? { ...storedReward, status: "AVAILABLE" } : storedReward;
+      const local = consumeReward({
+        reward,
+        currentState: currentReward,
+        now: timestamp,
+        userRedemptionCount: claimCount,
+        ...request.staffPasscode === void 0 ? {} : { inputPasscode: request.staffPasscode },
+        ...request.staffId === void 0 ? {} : { staffId: request.staffId }
+      });
+      if (!local.ok)
+        return this.#rememberClaim(
+          key,
+          { ok: false, code: local.error.code, message: "Reward cannot be claimed." },
           request,
-          now2
+          timestamp
         );
-      if (!spot.conditions.every(
-        (condition) => matchesCondition(condition, request.context, this.#options.customValidators)
-      ))
-        return this.#remember(
+      const stock = await this.#persistence.decrementRewardStock(request.rallyId, reward.id);
+      if (!stock.success)
+        return this.#rememberClaim(
           key,
-          { ok: false, code: "INVALID_PROOF", message: "Verification failed." },
+          { ok: false, code: "OUT_OF_STOCK", message: "Reward is out of stock." },
           request,
-          now2
+          timestamp
         );
-      const state = {
+      decremented = true;
+      const next = {
         ...current,
-        records: [...current.records, { stampId: request.spotId, acquiredAt: now2 }],
-        updatedAt: now2
+        rewards: current.rewards.map((item) => item.rewardId === reward.id ? local.value : item),
+        updatedAt: timestamp
+      };
+      try {
+        await this.#persistence.saveUserState(request.rallyId, request.userId, next);
+        const response = local.value.claimTicketNumber === void 0 ? { ok: true, state: next } : { ok: true, state: next, claimTicketNumber: local.value.claimTicketNumber };
+        await this.#persistence.recordUserClaim({
+          rallyId: request.rallyId,
+          userId: request.userId,
+          rewardId: reward.id,
+          ticketNumber: local.value.claimTicketNumber ?? "",
+          timestamp: Number.isNaN(Date.parse(timestamp)) ? Date.now() : Date.parse(timestamp)
+        });
+        await this.#persistence.recordAuditLog(
+          audit(
+            request.rallyId,
+            request.userId,
+            "CLAIM_REWARD",
+            reward.id,
+            request.idempotencyKey,
+            "SUCCESS",
+            timestamp
+          )
+        );
+        await this.#persistence.saveIdempotentResult(
+          request.rallyId,
+          key,
+          response,
+          this.#options.idempotencyTtlMs ?? 864e5
+        );
+        return response;
+      } catch (error) {
+        await this.#restoreRewardStock(request.rallyId, reward.id);
+        decremented = false;
+        throw error;
+      }
+    } catch (error) {
+      if (decremented) await this.#restoreRewardStock(request.rallyId, reward.id);
+      return {
+        ok: false,
+        code: "PERSISTENCE_FAILED",
+        message: error instanceof Error ? error.message : "Reward claim failed."
       };
-      await this.#persistence.saveUserState(request.rallyId, request.userId, state);
-      return this.#remember(key, { ok: true, state }, request, now2);
     } finally {
-      await this.#persistence.releaseLock(lockKey);
+      await this.#persistence.releaseLock(request.rallyId, lockKey);
     }
   }
   async sync(rallyId, userId) {
-    const now2 = this.#options.now?.() ?? (/* @__PURE__ */ new Date()).toISOString();
-    return await this.#persistence.getUserState(rallyId, userId) ?? initialState(this.#config, now2);
+    return await this.#persistence.getUserState(rallyId, userId) ?? initialState(this.#config, userId, now(this.#options));
   }
-  async #authenticatedUser(request, requestedUserId) {
-    const authenticated = await this.#options.authenticate?.(request);
-    if (this.#options.authenticate !== void 0) return authenticated ?? null;
-    return requestedUserId ?? null;
+  async #body(request) {
+    try {
+      const value = await request.json();
+      return isObject(value) ? value : null;
+    } catch {
+      return null;
+    }
   }
-  async #getUserClaimCount(userId, rewardId) {
-    const state = await this.#persistence.getUserState(this.#config.id, userId);
-    return state?.rewards?.find((item) => item.rewardId === rewardId)?.userRedemptionCount ?? 0;
+  async #user(request, requested) {
+    if (this.#options.authenticate !== void 0)
+      return await this.#options.authenticate(request) ?? null;
+    return requested ?? null;
   }
-  async #rememberClaim(key, result, request, userId) {
+  async #remember(key, result, rallyId, userId, action, resourceId, idempotencyKey, timestamp) {
+    await this.#persistence.recordAuditLog(
+      audit(
+        rallyId,
+        userId,
+        action,
+        resourceId,
+        idempotencyKey,
+        result.ok ? "SUCCESS" : "REJECTED",
+        timestamp,
+        result.ok ? void 0 : result.code
+      )
+    );
     await this.#persistence.saveIdempotentResult(
+      rallyId,
       key,
       result,
       this.#options.idempotencyTtlMs ?? 864e5
     );
-    await this.#persistence.recordAuditLog({
-      id: `audit-${globalThis.crypto?.randomUUID?.() ?? Date.now()}`,
-      timestamp: request.now ?? this.#options.now?.() ?? (/* @__PURE__ */ new Date()).toISOString(),
-      rallyId: request.rallyId,
-      userId,
-      action: "CLAIM_REWARD",
-      resourceId: request.rewardId,
-      status: "REJECTED",
-      idempotencyKey: request.idempotencyKey
-    });
     return result;
   }
-  async #remember(key, result, request, now2) {
+  async #rememberClaim(key, result, request, timestamp) {
     await this.#persistence.recordAuditLog(
-      audit(request, result.ok ? "SUCCESS" : "REJECTED", now2, result.ok ? void 0 : result.code)
+      audit(
+        request.rallyId,
+        request.userId,
+        "CLAIM_REWARD",
+        request.rewardId,
+        request.idempotencyKey,
+        "REJECTED",
+        timestamp,
+        result.ok ? void 0 : result.code
+      )
     );
     await this.#persistence.saveIdempotentResult(
+      request.rallyId,
       key,
       result,
       this.#options.idempotencyTtlMs ?? 864e5
     );
     return result;
   }
-};
-
-// src/index.ts
-var InMemoryServerStorage = class {
-  #states = /* @__PURE__ */ new Map();
-  #stocks;
-  #claims = /* @__PURE__ */ new Map();
-  #auditLogs = [];
-  constructor(options = {}) {
-    this.#stocks = new Map(Object.entries(options.stocks ?? {}));
-  }
-  async getRewardStock(rewardId) {
-    return this.#stocks.get(rewardId) ?? null;
-  }
-  async decrementRewardStock(rewardId) {
-    const stock = this.#stocks.get(rewardId);
-    if (stock === void 0) return true;
-    if (stock <= 0) return false;
-    this.#stocks.set(rewardId, stock - 1);
-    return true;
-  }
-  async getUserClaims(userId, rewardId) {
-    return this.#claims.get(`${userId}:${rewardId}`) ?? 0;
-  }
-  async recordAuditLog(log) {
-    this.#auditLogs.push({ ...log });
-  }
-  async saveUserState(userId, state) {
-    this.#states.set(userId, cloneUserState(state));
-  }
-  async getUserState(userId) {
-    const state = this.#states.get(userId);
-    return state === void 0 ? null : cloneUserState(state);
-  }
-  getAuditLogs() {
-    return this.#auditLogs.map((log) => ({ ...log }));
-  }
-  recordClaim(userId, rewardId) {
-    const key = `${userId}:${rewardId}`;
-    this.#claims.set(key, (this.#claims.get(key) ?? 0) + 1);
-  }
-};
-function cloneUserState(state) {
-  return {
-    ...state,
-    records: state.records.map((record) => ({
-      ...record,
-      ...record.metadata === void 0 ? {} : { metadata: { ...record.metadata } }
-    })),
-    ...state.rewards === void 0 ? {} : { rewards: state.rewards.map((reward) => ({ ...reward })) }
-  };
-}
-function jsonResponse(body, status = 200) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json; charset=utf-8" }
-  });
-}
-function errorResponse(code, message, status) {
-  return jsonResponse({ ok: false, error: { code, message } }, status);
-}
-function isObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function contextForClaim(method, proofData) {
-  if (method === "token" || method === "qr" || method === "passcode") {
-    return {
-      type: "token",
-      token: isObject(proofData) && typeof proofData.token === "string" ? proofData.token : String(proofData ?? "")
-    };
-  }
-  if (method === "geo" || method === "geolocation") {
-    const value = isObject(proofData) ? proofData : {};
-    return {
-      type: "geo",
-      currentLatitude: typeof value.latitude === "number" ? value.latitude : typeof value.currentLatitude === "number" ? value.currentLatitude : Number.NaN,
-      currentLongitude: typeof value.longitude === "number" ? value.longitude : typeof value.currentLongitude === "number" ? value.currentLongitude : Number.NaN
-    };
-  }
-  return { type: "instant" };
-}
-function now() {
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
-function hasText(value) {
-  return typeof value === "string" && value.trim() !== "";
-}
-function safeProofData(value) {
-  return isObject(value) && typeof value.token === "string" ? { type: "token" } : value;
-}
-function proofFromContext(context) {
-  if (context?.type === "token") return { token: context.token };
-  if (context?.type === "geo") {
-    return { latitude: context.currentLatitude, longitude: context.currentLongitude };
-  }
-  return void 0;
-}
-function id(prefix) {
-  return `${prefix}-${globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random().toString(36).slice(2)}`}`;
-}
-var StampRallyServer = class {
-  #config;
-  #storage;
-  #idempotent = /* @__PURE__ */ new Map();
-  #claims = /* @__PURE__ */ new Map();
-  #queue = Promise.resolve();
-  constructor(config, storage) {
-    this.#config = config;
-    this.#storage = storage;
-  }
-  handle(request) {
-    const path = new URL(request.url).pathname;
-    if (request.method !== "POST")
-      return Promise.resolve(errorResponse("METHOD_NOT_ALLOWED", "POST is required.", 405));
-    if (path.endsWith("/check-in")) return this.verifyCheckIn(request);
-    if (path.endsWith("/claim-reward")) return this.claimReward(request);
-    if (path.endsWith("/sync")) return this.syncProgress(request);
-    return Promise.resolve(errorResponse("NOT_FOUND", "Route not found.", 404));
-  }
-  verifyCheckIn(request) {
-    return this.#enqueue(() => this.#verifyCheckIn(request));
-  }
-  claimReward(request) {
-    return this.#enqueue(() => this.#claimReward(request));
-  }
-  syncProgress(request) {
-    return this.#enqueue(() => this.#syncProgress(request));
-  }
-  #enqueue(operation) {
-    const next = this.#queue.then(operation, operation);
-    this.#queue = next.then(
-      () => void 0,
-      () => void 0
-    );
-    return next;
-  }
-  async #authenticate(request) {
-    return this.#config.authenticate === void 0 ? null : this.#config.authenticate(request);
-  }
-  async #parse(request) {
-    try {
-      const value = await request.json();
-      return isObject(value) ? value : null;
-    } catch {
-      return null;
-    }
-  }
-  async #verifyCheckIn(request) {
-    const authenticatedUser = await this.#authenticate(request);
-    const body = await this.#parse(request);
-    const userId = body?.userId ?? authenticatedUser;
-    if (userId === null || userId === void 0 || body === null || !hasText(userId) || !hasText(body.spotId) || !hasText(body.claimMethod) || !hasText(body.idempotencyKey)) {
-      return errorResponse(
-        "INVALID_REQUEST",
-        "userId, spotId, and idempotencyKey are required.",
-        400
-      );
-    }
-    if (authenticatedUser !== null && authenticatedUser !== userId)
-      return errorResponse("UNAUTHORIZED", "User identity does not match authentication.", 401);
-    const key = `check-in:${userId}:${body.idempotencyKey}`;
-    const previous = this.#idempotent.get(key);
-    if (previous !== void 0) return previous.clone();
-    const timestamp = now();
-    const current = await this.#storage.getUserState(userId) ?? emptyState(this.#config, timestamp);
-    const result = processStamp(
-      current,
-      this.#config,
-      body.spotId,
-      contextForClaim(body.claimMethod, body.proofData),
-      timestamp
-    );
-    if (!result.ok) {
-      await this.#audit(
-        userId,
-        "CHECK_IN",
-        body.spotId,
-        body.idempotencyKey,
-        "REJECTED",
-        safeProofData(body.proofData),
-        result.error
-      );
-      return this.#remember(key, jsonResponse({ ok: false, error: result.error }, 422));
-    }
-    const ttl = this.#config.proofTtlSeconds ?? 3600;
-    const token = await createSecureToken(
-      {
-        type: "stamp_claim",
-        rallyId: this.#config.id,
-        userId,
-        spotId: body.spotId,
-        acquiredAt: timestamp,
-        exp: Math.floor(Date.now() / 1e3) + ttl
-      },
-      this.#config.secretKey,
-      { encrypt: true }
-    );
-    await this.#storage.saveUserState(userId, result.value.nextState);
-    await this.#audit(
-      userId,
-      "CHECK_IN",
-      body.spotId,
-      body.idempotencyKey,
-      "SUCCESS",
-      safeProofData(body.proofData)
-    );
-    return this.#remember(
-      key,
-      jsonResponse({
-        ok: true,
-        state: result.value.nextState,
-        proof: {
-          token,
-          rallyId: this.#config.id,
-          userId,
-          spotId: body.spotId,
-          acquiredAt: timestamp
-        }
-      })
-    );
-  }
-  async #claimReward(request) {
-    const authenticatedUser = await this.#authenticate(request);
-    const body = await this.#parse(request);
-    const userId = body?.userId ?? authenticatedUser;
-    if (userId === null || userId === void 0 || body === null || !hasText(userId) || !hasText(body.rewardId) || !hasText(body.idempotencyKey))
-      return errorResponse(
-        "INVALID_REQUEST",
-        "userId, rewardId, and idempotencyKey are required.",
-        400
-      );
-    if (authenticatedUser !== null && authenticatedUser !== userId)
-      return errorResponse("UNAUTHORIZED", "User identity does not match authentication.", 401);
-    const key = `claim-reward:${userId}:${body.rewardId}:${body.idempotencyKey}`;
-    const previous = this.#idempotent.get(key);
-    if (previous !== void 0) return previous.clone();
-    const reward = this.#config.rewards?.find((item) => item.id === body.rewardId);
-    if (reward === void 0) {
-      await this.#audit(userId, "CLAIM_REWARD", body.rewardId, body.idempotencyKey, "REJECTED");
-      return this.#remember(key, errorResponse("REWARD_NOT_FOUND", "Reward was not found.", 404));
-    }
-    const timestamp = now();
-    const current = await this.#storage.getUserState(userId) ?? emptyState(this.#config, timestamp);
-    const rewardState = current.rewards?.find((item) => item.rewardId === reward.id);
-    if (rewardState === void 0) {
-      await this.#audit(userId, "CLAIM_REWARD", reward.id, body.idempotencyKey, "REJECTED");
-      return this.#remember(key, errorResponse("NOT_AVAILABLE", "Reward is not available.", 422));
-    }
-    const userClaims = Math.max(
-      await this.#storage.getUserClaims(userId, reward.id),
-      this.#claims.get(`${userId}:${reward.id}`) ?? 0
-    );
-    const stock = await this.#storage.getRewardStock(reward.id);
-    const userLimit = reward.userClaimLimit ?? reward.limitPerUser;
-    const canReclaimServerReward = reward.redemptionMethod === "server_claim" && (userLimit === void 0 || userClaims < userLimit) && (stock === null || stock > 0);
-    const claimableState = canReclaimServerReward && rewardState.status === "CONSUMED" ? { ...rewardState, status: "AVAILABLE" } : rewardState;
-    const local = consumeReward({
-      reward,
-      currentState: claimableState,
-      now: timestamp,
-      ...body.staffPasscode === void 0 ? {} : { inputPasscode: body.staffPasscode },
-      ...body.staffId === void 0 ? {} : { staffId: body.staffId },
-      userId,
-      userRedemptionCount: userClaims
-    });
-    if (!local.ok)
-      return this.#remember(
-        key,
-        await this.#rewardError(userId, reward.id, body.idempotencyKey, local.error)
-      );
-    if (stock !== null && !await this.#storage.decrementRewardStock(reward.id))
-      return this.#remember(
-        key,
-        await this.#rewardError(userId, reward.id, body.idempotencyKey, {
-          code: "OUT_OF_STOCK",
-          rewardId: reward.id
-        })
-      );
-    const nextState = {
-      ...current,
-      rewards: (current.rewards ?? []).map(
-        (item) => item.rewardId === reward.id ? local.value : item
-      ),
-      updatedAt: timestamp
-    };
-    await this.#storage.saveUserState(userId, nextState);
-    const claimKey = `${userId}:${reward.id}`;
-    this.#claims.set(claimKey, userClaims + 1);
-    if (this.#storage instanceof InMemoryServerStorage)
-      this.#storage.recordClaim(userId, reward.id);
-    await this.#audit(userId, "CLAIM_REWARD", reward.id, body.idempotencyKey, "SUCCESS", {
-      staffId: body.staffId
-    });
-    return this.#remember(
-      key,
-      jsonResponse({
-        ok: true,
-        state: nextState,
-        claimTicketNumber: local.value.claimTicketNumber
-      })
-    );
-  }
-  async #rewardError(userId, rewardId, key, error) {
-    await this.#audit(userId, "CLAIM_REWARD", rewardId, key, "REJECTED", void 0, error);
-    return jsonResponse({ ok: false, error }, 422);
-  }
-  async #syncProgress(request) {
-    const authenticatedUser = await this.#authenticate(request);
-    const body = await this.#parse(request);
-    if (body === null || body.userId === void 0)
-      return errorResponse("INVALID_REQUEST", "userId is required.", 400);
-    if (authenticatedUser !== null && authenticatedUser !== body.userId)
-      return errorResponse("UNAUTHORIZED", "User identity does not match authentication.", 401);
-    const queue = body.queue ?? body.operations ?? [];
-    for (const operation of queue) {
-      const userId = operation.userId ?? body.userId;
-      const spotId = operation.spotId ?? operation.stampId;
-      const claimMethod = operation.claimMethod ?? operation.context?.type;
-      if (!hasText(userId) || !hasText(spotId) || !hasText(claimMethod)) continue;
-      const synthetic = new Request(new URL("/api/check-in", request.url), {
-        method: "POST",
-        body: JSON.stringify({
-          userId,
-          spotId,
-          claimMethod,
-          proofData: operation.proofData ?? proofFromContext(operation.context),
-          idempotencyKey: operation.idempotencyKey
-        }),
-        headers: { "content-type": "application/json" }
-      });
-      await this.#verifyCheckIn(synthetic);
-    }
-    const timestamp = now();
-    const state = await this.#storage.getUserState(body.userId) ?? emptyState(this.#config, timestamp);
-    await this.#storage.saveUserState(body.userId, state);
-    return jsonResponse({ ok: true, state, accepted: queue.length });
-  }
-  async #audit(userId, action, resourceId, idempotencyKey, status, proofData, error) {
-    await this.#storage.recordAuditLog({
-      id: id("audit"),
-      timestamp: now(),
-      rallyId: this.#config.id,
-      userId,
-      action,
-      resourceId,
-      status,
-      idempotencyKey,
-      ...proofData === void 0 ? {} : { proofData },
-      ...error === void 0 ? {} : {
-        metadata: {
-          errorCode: isObject(error) && typeof error.code === "string" ? error.code : "UNKNOWN"
-        }
-      }
-    });
-  }
-  #remember(key, response) {
-    this.#idempotent.set(key, response.clone());
-    return response;
+  async #restoreRewardStock(rallyId, rewardId) {
+    if (this.#persistence.restoreRewardStock !== void 0)
+      await this.#persistence.restoreRewardStock(rallyId, rewardId);
   }
 };
-function emptyState(config, timestamp) {
-  return {
-    rallyId: config.id,
-    records: [],
-    ...config.rewards === void 0 ? {} : { rewards: reconcileRewardStates(config.rewards, [], 0, timestamp) },
-    updatedAt: timestamp
-  };
-}
 
-export { InMemoryServerPersistenceAdapter, InMemoryServerStorage, StampRallyServer, UniversalRallyServer };
+export { InMemoryServerPersistenceAdapter, StampRallyServer };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map