@gurulu/cli 0.4.7 → 1.0.1

package/scripts/test-identity-resolution.ts

@@ -1,804 +0,0 @@
-#!/usr/bin/env npx tsx
-/**
- * End-to-end test suite for the identity resolution system.
- *
- * Validates all recent identity features by calling the ingest API endpoints
- * directly over HTTP. Designed to run against a local (or staging) instance.
- *
- * Usage:
- *   npx tsx scripts/test-identity-resolution.ts
- *
- * Environment variables:
- *   TEST_BASE_URL        — API base (default: http://localhost:3000)
- *   TEST_SITE_ID         — Site id to use (must exist in Prisma with a valid token)
- *   TEST_SITE_TOKEN      — Bearer token for the test site
- *   CLICKHOUSE_URL       — ClickHouse HTTP endpoint (default: http://localhost:8123)
- *   CLICKHOUSE_DATABASE  — ClickHouse database (default: gurulu)
- */
-
-// ---------------------------------------------------------------------------
-// Config
-// ---------------------------------------------------------------------------
-
-const BASE_URL = process.env.TEST_BASE_URL || 'http://localhost:3000';
-const SITE_ID = process.env.TEST_SITE_ID || 'test-identity-validation';
-const SITE_TOKEN = process.env.TEST_SITE_TOKEN || '';
-const CH_URL = process.env.CLICKHOUSE_URL || 'http://localhost:8123';
-const CH_DB = process.env.CLICKHOUSE_DATABASE || 'gurulu';
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-let passCount = 0;
-let failCount = 0;
-let skipCount = 0;
-
-function uid(): string {
-  return crypto.randomUUID();
-}
-
-function log(status: 'PASS' | 'FAIL' | 'SKIP' | 'INFO', msg: string) {
-  const colors: Record<string, string> = {
-    PASS: '\x1b[32m',
-    FAIL: '\x1b[31m',
-    SKIP: '\x1b[33m',
-    INFO: '\x1b[36m',
-  };
-  const reset = '\x1b[0m';
-  console.log(`${colors[status]}[${status}]${reset} ${msg}`);
-  if (status === 'PASS') passCount++;
-  if (status === 'FAIL') failCount++;
-  if (status === 'SKIP') skipCount++;
-}
-
-function assert(condition: boolean, label: string, detail?: string): boolean {
-  if (condition) {
-    log('PASS', label);
-    return true;
-  }
-  log('FAIL', `${label}${detail ? ' — ' + detail : ''}`);
-  return false;
-}
-
-/** POST to /ingest/v1/identify */
-async function identify(body: Record<string, unknown>): Promise<Record<string, unknown>> {
-  const headers: Record<string, string> = {
-    'Content-Type': 'application/json',
-    Origin: 'http://localhost:3000',
-  };
-  if (SITE_TOKEN) headers['Authorization'] = `Bearer ${SITE_TOKEN}`;
-
-  const res = await fetch(`${BASE_URL}/ingest/v1/identify`, {
-    method: 'POST',
-    headers,
-    body: JSON.stringify({ site_id: SITE_ID, ...body }),
-  });
-  const json = (await res.json()) as Record<string, unknown>;
-  return { ...json, _status: res.status };
-}
-
-/** POST to /ingest/v1/collect */
-async function collect(events: Record<string, unknown>[]): Promise<Record<string, unknown>> {
-  const headers: Record<string, string> = {
-    'Content-Type': 'application/json',
-    Origin: 'http://localhost:3000',
-  };
-  if (SITE_TOKEN) headers['Authorization'] = `Bearer ${SITE_TOKEN}`;
-
-  const res = await fetch(`${BASE_URL}/ingest/v1/collect`, {
-    method: 'POST',
-    headers,
-    body: JSON.stringify({ site_id: SITE_ID, events }),
-  });
-  const json = (await res.json()) as Record<string, unknown>;
-  return { ...json, _status: res.status };
-}
-
-/** Query ClickHouse directly */
-async function chQuery(
-  query: string,
-  params?: Record<string, string | number>,
-): Promise<{ data: Record<string, unknown>[]; rows: number }> {
-  const url = new URL(CH_URL);
-  url.searchParams.set('database', CH_DB);
-  url.searchParams.set('default_format', 'JSON');
-  if (params) {
-    for (const [key, value] of Object.entries(params)) {
-      let v = String(value);
-      if (v.match(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.*Z$/)) {
-        v = v.replace('T', ' ').replace('Z', '');
-      }
-      url.searchParams.set(`param_${key}`, v);
-    }
-  }
-  const res = await fetch(url.toString(), {
-    method: 'POST',
-    body: query,
-    headers: { 'Content-Type': 'text/plain' },
-  });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new Error(`ClickHouse error ${res.status}: ${text}`);
-  }
-  return res.json() as Promise<{ data: Record<string, unknown>[]; rows: number }>;
-}
-
-/** Short delay to let async fire-and-forget writes settle */
-function wait(ms = 1500): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-// ---------------------------------------------------------------------------
-// Connectivity pre-check
-// ---------------------------------------------------------------------------
-
-async function preCheck(): Promise<boolean> {
-  log('INFO', `Base URL: ${BASE_URL}`);
-  log('INFO', `Site ID:  ${SITE_ID}`);
-  log('INFO', `CH URL:   ${CH_URL}`);
-
-  // Check API reachability
-  try {
-    const res = await fetch(`${BASE_URL}/api/status`, { signal: AbortSignal.timeout(5000) });
-    if (!res.ok) {
-      log('FAIL', `API not reachable (status ${res.status}) — is the dev server running?`);
-      return false;
-    }
-  } catch (err) {
-    log('FAIL', `API not reachable at ${BASE_URL} — ${(err as Error).message}`);
-    return false;
-  }
-
-  // Check that the site exists by attempting a minimal identify
-  const probe = await identify({
-    anonymous_id: uid(),
-    user_id: 'probe-' + uid(),
-  });
-  if ((probe._status as number) === 404) {
-    log('FAIL', `Site "${SITE_ID}" not found. Create it first or set TEST_SITE_ID.`);
-    return false;
-  }
-  if ((probe._status as number) === 401) {
-    log('FAIL', 'Auth failed — set TEST_SITE_TOKEN to the site Bearer token.');
-    return false;
-  }
-  if (probe.status !== 'ok') {
-    log('FAIL', `Unexpected probe response: ${JSON.stringify(probe)}`);
-    return false;
-  }
-
-  log('PASS', 'Pre-check: API reachable and site valid');
-  return true;
-}
-
-// ---------------------------------------------------------------------------
-// Test 1: Basic identify + claim creation
-// ---------------------------------------------------------------------------
-
-async function test01_basicIdentify() {
-  log('INFO', '--- Test 1: Basic identify + claim creation ---');
-
-  const anonId = uid();
-  const userId = 'user-' + uid().slice(0, 8);
-  const email = `test-${uid().slice(0, 6)}@identity-test.com`;
-
-  const res = await identify({
-    anonymous_id: anonId,
-    user_id: userId,
-    traits: { email },
-  });
-
-  assert(res.status === 'ok', 'T1: identify returned ok');
-  assert(typeof res.canonical_id === 'string' && (res.canonical_id as string).length > 0,
-    'T1: canonical_id is a non-empty string', `got: ${res.canonical_id}`);
-}
-
-// ---------------------------------------------------------------------------
-// Test 2: Phone E.164 normalization
-// ---------------------------------------------------------------------------
-
-async function test02_phoneNormalization() {
-  log('INFO', '--- Test 2: Phone E.164 normalization ---');
-
-  // 2a: Formatted phone with country code should normalize
-  const anonA = uid();
-  const resA = await identify({
-    anonymous_id: anonA,
-    user_id: 'phone-a-' + uid().slice(0, 8),
-    traits: { phone: '+90 (532) 123-4567' },
-  });
-  assert(resA.status === 'ok', 'T2a: Formatted phone accepted');
-  assert(typeof resA.canonical_id === 'string' && (resA.canonical_id as string).length > 0,
-    'T2a: canonical_id returned');
-
-  // 2b: Phone without country code should be silently ignored (no + prefix)
-  const anonB = uid();
-  const resB = await identify({
-    anonymous_id: anonB,
-    user_id: 'phone-b-' + uid().slice(0, 8),
-    traits: { phone: '5321234567' },
-  });
-  // Should still succeed (phone is optional) but the phone claim won't be created.
-  assert(resB.status === 'ok', 'T2b: Phone without country code — identify still ok');
-
-  // 2c: Valid E.164 phone
-  const anonC = uid();
-  const resC = await identify({
-    anonymous_id: anonC,
-    user_id: 'phone-c-' + uid().slice(0, 8),
-    traits: { phone: '+905321234567' },
-  });
-  assert(resC.status === 'ok', 'T2c: Valid E.164 phone accepted');
-  assert(typeof resC.canonical_id === 'string' && (resC.canonical_id as string).length > 0,
-    'T2c: canonical_id returned for E.164 phone');
-}
-
-// ---------------------------------------------------------------------------
-// Test 3: OAuth provider ID
-// ---------------------------------------------------------------------------
-
-async function test03_oauthProvider() {
-  log('INFO', '--- Test 3: OAuth provider ID ---');
-
-  // 3a: Known provider (google)
-  const anonA = uid();
-  const resA = await identify({
-    anonymous_id: anonA,
-    user_id: 'oauth-a-' + uid().slice(0, 8),
-    oauth_provider: 'google',
-    oauth_id: '118234567890',
-  });
-  assert(resA.status === 'ok', 'T3a: Google OAuth identify ok');
-  assert(typeof resA.canonical_id === 'string' && (resA.canonical_id as string).length > 0,
-    'T3a: canonical_id returned');
-
-  // 3b: Unknown provider should map to "custom:id"
-  const anonB = uid();
-  const resB = await identify({
-    anonymous_id: anonB,
-    user_id: 'oauth-b-' + uid().slice(0, 8),
-    oauth_provider: 'myapp',
-    oauth_id: '999888777',
-  });
-  assert(resB.status === 'ok', 'T3b: Unknown provider identify ok (maps to custom:id)');
-}
-
-// ---------------------------------------------------------------------------
-// Test 4: Cross-browser merge (same email)
-// ---------------------------------------------------------------------------
-
-async function test04_crossBrowserMerge() {
-  log('INFO', '--- Test 4: Cross-browser merge (same email) ---');
-
-  const sharedEmail = `merge-${uid().slice(0, 6)}@identity-test.com`;
-
-  // User A from browser 1
-  const anonA = uid();
-  const resA = await identify({
-    anonymous_id: anonA,
-    user_id: 'merge-a-' + uid().slice(0, 8),
-    traits: { email: sharedEmail },
-  });
-  assert(resA.status === 'ok', 'T4: User A identified');
-
-  // User B from browser 2 — same email
-  const anonB = uid();
-  const resB = await identify({
-    anonymous_id: anonB,
-    user_id: 'merge-b-' + uid().slice(0, 8),
-    traits: { email: sharedEmail },
-  });
-  assert(resB.status === 'ok', 'T4: User B identified');
-
-  // Both should resolve to the same canonical_id
-  assert(
-    resA.canonical_id === resB.canonical_id,
-    'T4: Both browsers merge to same canonical_id',
-    `A=${resA.canonical_id}, B=${resB.canonical_id}`,
-  );
-}
-
-// ---------------------------------------------------------------------------
-// Test 5: Cross-identifier merge (email + phone)
-// ---------------------------------------------------------------------------
-
-async function test05_crossIdentifierMerge() {
-  log('INFO', '--- Test 5: Cross-identifier merge (email + phone) ---');
-
-  const emailA = `xid-${uid().slice(0, 6)}@identity-test.com`;
-  const phoneB = `+9053${Math.floor(10000000 + Math.random() * 90000000)}`;
-
-  // User A: email only
-  const anonA = uid();
-  const resA = await identify({
-    anonymous_id: anonA,
-    user_id: 'xid-a-' + uid().slice(0, 8),
-    traits: { email: emailA },
-  });
-  assert(resA.status === 'ok', 'T5: User A (email) identified');
-  const canonA = resA.canonical_id;
-
-  // User B: phone only
-  const anonB = uid();
-  const resB = await identify({
-    anonymous_id: anonB,
-    user_id: 'xid-b-' + uid().slice(0, 8),
-    traits: { phone: phoneB },
-  });
-  assert(resB.status === 'ok', 'T5: User B (phone) identified');
-  const canonB = resB.canonical_id;
-
-  // Verify they start as different people
-  assert(canonA !== canonB, 'T5: Initially A and B are different persons',
-    `A=${canonA}, B=${canonB}`);
-
-  // User C: carries BOTH email + phone, triggering cross-identifier merge
-  const anonC = uid();
-  const resC = await identify({
-    anonymous_id: anonC,
-    user_id: 'xid-c-' + uid().slice(0, 8),
-    traits: { email: emailA, phone: phoneB },
-  });
-  assert(resC.status === 'ok', 'T5: User C (email+phone) identified');
-
-  // Check merge happened
-  const mergedCanon = resC.canonical_id;
-  // Re-identify A to see if they resolve to the merged person
-  const resA2 = await identify({
-    anonymous_id: anonA,
-    user_id: 'xid-a-' + uid().slice(0, 8),
-    traits: { email: emailA },
-  });
-  const resB2 = await identify({
-    anonymous_id: anonB,
-    user_id: 'xid-b-' + uid().slice(0, 8),
-    traits: { phone: phoneB },
-  });
-
-  assert(
-    resA2.canonical_id === mergedCanon,
-    'T5: After merge, A resolves to merged canonical',
-    `A2=${resA2.canonical_id}, merged=${mergedCanon}`,
-  );
-  assert(
-    resB2.canonical_id === mergedCanon,
-    'T5: After merge, B resolves to merged canonical',
-    `B2=${resB2.canonical_id}, merged=${mergedCanon}`,
-  );
-
-  // Check merge metadata in response
-  if (resC.merges) {
-    const merges = resC.merges as Array<Record<string, unknown>>;
-    assert(merges.length > 0, 'T5: Merge events present in response');
-    const m = merges[0];
-    assert(
-      typeof m.winner === 'string' && typeof m.loser === 'string',
-      'T5: Merge event has winner/loser',
-      `winner=${m.winner}, loser=${m.loser}`,
-    );
-  } else {
-    log('INFO', 'T5: No merge metadata in response (may have matched on first claim)');
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Test 6: Consent level enforcement
-// ---------------------------------------------------------------------------
-
-async function test06_consentEnforcement() {
-  log('INFO', '--- Test 6: Consent level enforcement ---');
-
-  // 6a: consent=none → consent_skipped
-  const resNone = await identify({
-    anonymous_id: uid(),
-    user_id: 'consent-none-' + uid().slice(0, 8),
-    traits: { email: `none-${uid().slice(0, 6)}@test.com` },
-    consent_level: 'none',
-  });
-  assert(resNone.consent_skipped === true, 'T6a: consent=none returns consent_skipped');
-  assert(resNone.canonical_id === null, 'T6a: consent=none returns null canonical_id');
-
-  // 6b: consent=analytics → only anonymous_id, no PII claims
-  const analyticsAnon = uid();
-  const resAnalytics = await identify({
-    anonymous_id: analyticsAnon,
-    user_id: 'consent-analytics-' + uid().slice(0, 8),
-    traits: { email: `analytics-${uid().slice(0, 6)}@test.com` },
-    consent_level: 'analytics',
-  });
-  assert(resAnalytics.status === 'ok', 'T6b: consent=analytics accepted');
-  assert(
-    typeof resAnalytics.canonical_id === 'string' && (resAnalytics.canonical_id as string).length > 0,
-    'T6b: consent=analytics still returns canonical_id (for anonymous_id claim)',
-  );
-
-  // 6c: consent=marketing → all claims
-  const marketingAnon = uid();
-  const marketingEmail = `marketing-${uid().slice(0, 6)}@test.com`;
-  const resMarketing = await identify({
-    anonymous_id: marketingAnon,
-    user_id: 'consent-mkt-' + uid().slice(0, 8),
-    traits: { email: marketingEmail },
-    consent_level: 'marketing',
-  });
-  assert(resMarketing.status === 'ok', 'T6c: consent=marketing accepted');
-  assert(typeof resMarketing.canonical_id === 'string', 'T6c: canonical_id returned');
-
-  // 6d: consent=full → all claims
-  const fullAnon = uid();
-  const fullEmail = `full-${uid().slice(0, 6)}@test.com`;
-  const resFull = await identify({
-    anonymous_id: fullAnon,
-    user_id: 'consent-full-' + uid().slice(0, 8),
-    traits: { email: fullEmail },
-    consent_level: 'full',
-  });
-  assert(resFull.status === 'ok', 'T6d: consent=full accepted');
-  assert(typeof resFull.canonical_id === 'string', 'T6d: canonical_id returned');
-}
-
-// ---------------------------------------------------------------------------
-// Test 7: Consent downgrade
-// ---------------------------------------------------------------------------
-
-async function test07_consentDowngrade() {
-  log('INFO', '--- Test 7: Consent downgrade ---');
-
-  const anonId = uid();
-  const userId = 'consent-dg-' + uid().slice(0, 8);
-  const email = `dg-${uid().slice(0, 6)}@test.com`;
-
-  // Step 1: identify with full consent and email
-  const res1 = await identify({
-    anonymous_id: anonId,
-    user_id: userId,
-    traits: { email },
-    consent_level: 'full',
-  });
-  assert(res1.status === 'ok', 'T7: Initial full-consent identify ok');
-  const canonId = res1.canonical_id as string;
-
-  // Step 2: Send $consent_update event downgrading to "none"
-  const consentEvent = {
-    anonymous_id: anonId,
-    session_id: uid(),
-    event_type: 'custom',
-    event_name: '$consent_update',
-    page_url: 'http://localhost:3000/',
-    page_title: 'Test',
-    referrer: '',
-    timestamp: new Date().toISOString(),
-    properties: JSON.stringify({
-      level: 'none',
-    }),
-  };
-  const collectRes = await collect([consentEvent]);
-  assert(
-    collectRes.status === 'ok' || (collectRes._status as number) === 200,
-    'T7: $consent_update event collected',
-  );
-
-  // Wait for async processing
-  await wait(2000);
-
-  // Step 3: Re-identify with email + consent=none → should be blocked
-  const res3 = await identify({
-    anonymous_id: anonId,
-    user_id: userId,
-    traits: { email: `new-${uid().slice(0, 6)}@test.com` },
-    consent_level: 'none',
-  });
-  assert(
-    res3.consent_skipped === true,
-    'T7: After consent downgrade, identify with consent=none is skipped',
-  );
-}
-
-// ---------------------------------------------------------------------------
-// Test 8: $identity_merge audit events in ClickHouse
-// ---------------------------------------------------------------------------
-
-async function test08_mergeAuditEvents() {
-  log('INFO', '--- Test 8: $identity_merge audit events ---');
-
-  const sharedEmail = `audit-${uid().slice(0, 6)}@identity-test.com`;
-
-  // Create two separate persons then merge via shared email
-  const anonA = uid();
-  const resA = await identify({
-    anonymous_id: anonA,
-    user_id: 'audit-a-' + uid().slice(0, 8),
-    traits: { email: sharedEmail },
-  });
-  assert(resA.status === 'ok', 'T8: Person A identified');
-
-  const anonB = uid();
-  const resB = await identify({
-    anonymous_id: anonB,
-    user_id: 'audit-b-' + uid().slice(0, 8),
-    traits: { email: sharedEmail },
-  });
-  assert(resB.status === 'ok', 'T8: Person B identified (should merge)');
-
-  // Wait for async ClickHouse write
-  await wait(3000);
-
-  // Query ClickHouse for merge events
-  try {
-    const result = await chQuery(
-      `SELECT winner_canonical_id, loser_canonical_id, merge_reason, claim_types_involved
-       FROM identity_merge_events
-       WHERE site_id = {p_site:String}
-       ORDER BY timestamp DESC
-       LIMIT 10`,
-      { p_site: SITE_ID },
-    );
-
-    if (result.rows === 0) {
-      log('SKIP', 'T8: No merge events in ClickHouse (merge may not have occurred if same person)');
-    } else {
-      const row = result.data[0];
-      assert(
-        typeof row.winner_canonical_id === 'string' && (row.winner_canonical_id as string).length > 0,
-        'T8: winner_canonical_id populated',
-      );
-      assert(
-        typeof row.loser_canonical_id === 'string' && (row.loser_canonical_id as string).length > 0,
-        'T8: loser_canonical_id populated',
-      );
-      assert(
-        typeof row.merge_reason === 'string' && (row.merge_reason as string).length > 0,
-        'T8: merge_reason populated',
-        `reason=${row.merge_reason}`,
-      );
-      log('INFO', `T8: Found ${result.rows} merge event(s). Latest: winner=${row.winner_canonical_id}, loser=${row.loser_canonical_id}, reason=${row.merge_reason}`);
-    }
-  } catch (err) {
-    log('SKIP', `T8: ClickHouse query failed — ${(err as Error).message}`);
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Test 9: Device fingerprint claim
-// ---------------------------------------------------------------------------
-
-async function test09_deviceFingerprint() {
-  log('INFO', '--- Test 9: Device fingerprint claim ---');
-
-  const anonId = uid();
-  const deviceId = 'fp_' + uid().slice(0, 12);
-
-  const res = await identify({
-    anonymous_id: anonId,
-    user_id: 'device-' + uid().slice(0, 8),
-    device_id: deviceId,
-    consent_level: 'full',
-  });
-
-  assert(res.status === 'ok', 'T9: Identify with device_id ok');
-  assert(
-    typeof res.canonical_id === 'string' && (res.canonical_id as string).length > 0,
-    'T9: canonical_id returned with device fingerprint',
-  );
-  // The device_id claim is created with confidence 0.6 — we can't directly
-  // verify the confidence from the API response, but the claim being
-  // processed without error is the key signal. Deeper verification would
-  // require a DB query.
-  log('INFO', 'T9: device_id claim processed (confidence 0.6 set internally)');
-}
-
-// ---------------------------------------------------------------------------
-// Test 10: ip_hash in events_raw
-// ---------------------------------------------------------------------------
-
-async function test10_ipHash() {
-  log('INFO', '--- Test 10: ip_hash in events_raw ---');
-
-  const anonId = uid();
-  const sessionId = uid();
-  const eventName = `test_iphash_${uid().slice(0, 6)}`;
-
-  const event = {
-    anonymous_id: anonId,
-    session_id: sessionId,
-    event_type: 'custom',
-    event_name: eventName,
-    page_url: 'http://localhost:3000/test-ip-hash',
-    page_title: 'IP Hash Test',
-    referrer: '',
-    timestamp: new Date().toISOString(),
-    properties: JSON.stringify({}),
-  };
-
-  const res = await collect([event]);
-  assert(
-    res.status === 'ok' || (res._status as number) === 200,
-    'T10: Event collected',
-  );
-
-  // Wait for ClickHouse write
-  await wait(2000);
-
-  try {
-    const result = await chQuery(
-      `SELECT ip_hash, ip
-       FROM events_raw
-       WHERE site_id = {p_site:String}
-         AND event_name = {p_name:String}
-       ORDER BY timestamp DESC
-       LIMIT 1`,
-      { p_site: SITE_ID, p_name: eventName },
-    );
-
-    if (result.rows === 0) {
-      log('SKIP', 'T10: Event not found in ClickHouse (may need longer wait)');
-    } else {
-      const row = result.data[0];
-      assert(
-        typeof row.ip_hash === 'string' && (row.ip_hash as string).length > 0,
-        'T10: ip_hash is populated',
-        `ip_hash=${row.ip_hash}`,
-      );
-      log('INFO', `T10: ip=${row.ip}, ip_hash=${row.ip_hash}`);
-    }
-  } catch (err) {
-    log('SKIP', `T10: ClickHouse query failed — ${(err as Error).message}`);
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Test 11: Consent=analytics blocks PII but allows anonymous_id
-// ---------------------------------------------------------------------------
-
-async function test11_analyticsConsentPIIBlock() {
-  log('INFO', '--- Test 11: Analytics consent — same email does NOT merge ---');
-
-  const sharedEmail = `analytics-pii-${uid().slice(0, 6)}@test.com`;
-
-  // User A with full consent — email claim created
-  const anonA = uid();
-  const resA = await identify({
-    anonymous_id: anonA,
-    user_id: 'apii-a-' + uid().slice(0, 8),
-    traits: { email: sharedEmail },
-    consent_level: 'full',
-  });
-  assert(resA.status === 'ok', 'T11: User A (full consent) identified');
-
-  // User B with analytics consent — email should be filtered out, so no merge
-  const anonB = uid();
-  const resB = await identify({
-    anonymous_id: anonB,
-    user_id: 'apii-b-' + uid().slice(0, 8),
-    traits: { email: sharedEmail },
-    consent_level: 'analytics',
-  });
-  assert(resB.status === 'ok', 'T11: User B (analytics consent) identified');
-  assert(
-    resA.canonical_id !== resB.canonical_id,
-    'T11: Different canonical_ids (email PII blocked at analytics level)',
-    `A=${resA.canonical_id}, B=${resB.canonical_id}`,
-  );
-}
-
-// ---------------------------------------------------------------------------
-// Test 12: Multiple identifies with same anonymous_id are stable
-// ---------------------------------------------------------------------------
-
-async function test12_idempotentIdentify() {
-  log('INFO', '--- Test 12: Idempotent identify (same anonymous_id) ---');
-
-  const anonId = uid();
-  const userId = 'idem-' + uid().slice(0, 8);
-  const email = `idem-${uid().slice(0, 6)}@test.com`;
-
-  const res1 = await identify({
-    anonymous_id: anonId,
-    user_id: userId,
-    traits: { email },
-  });
-  const res2 = await identify({
-    anonymous_id: anonId,
-    user_id: userId,
-    traits: { email },
-  });
-
-  assert(res1.status === 'ok' && res2.status === 'ok', 'T12: Both identifies ok');
-  assert(
-    res1.canonical_id === res2.canonical_id,
-    'T12: Same anonymous_id + email → same canonical_id',
-    `r1=${res1.canonical_id}, r2=${res2.canonical_id}`,
-  );
-}
-
-// ---------------------------------------------------------------------------
-// Cleanup
-// ---------------------------------------------------------------------------
-
-async function cleanup() {
-  log('INFO', '--- Cleanup ---');
-  // ClickHouse: delete test rows (lightweight_delete or ALTER TABLE DELETE)
-  // These are best-effort; if they fail (e.g., CH not available), that's ok.
-  try {
-    await chQuery(
-      `ALTER TABLE identity_merge_events DELETE WHERE site_id = {p_site:String}`,
-      { p_site: SITE_ID },
-    );
-    log('INFO', 'Cleaned identity_merge_events');
-  } catch {
-    log('INFO', 'Skipped identity_merge_events cleanup (table may not exist)');
-  }
-
-  try {
-    await chQuery(
-      `ALTER TABLE events_raw DELETE WHERE site_id = {p_site:String} AND event_name LIKE 'test_%'`,
-      { p_site: SITE_ID },
-    );
-    log('INFO', 'Cleaned test events from events_raw');
-  } catch {
-    log('INFO', 'Skipped events_raw cleanup');
-  }
-
-  try {
-    await chQuery(
-      `ALTER TABLE identity_map DELETE WHERE site_id = {p_site:String}`,
-      { p_site: SITE_ID },
-    );
-    log('INFO', 'Cleaned identity_map');
-  } catch {
-    log('INFO', 'Skipped identity_map cleanup');
-  }
-
-  // Note: Prisma cleanup (CanonicalPerson, IdentityClaim) is intentionally
-  // skipped — the test site should be a dedicated test tenant. If needed, add
-  // a Prisma-based cleanup via a separate admin endpoint or direct DB access.
-  log('INFO', 'Cleanup complete (ClickHouse only; Prisma records retained for inspection)');
-}
-
-// ---------------------------------------------------------------------------
-// Runner
-// ---------------------------------------------------------------------------
-
-async function main() {
-  console.log('\n========================================');
-  console.log(' Identity Resolution E2E Test Suite');
-  console.log('========================================\n');
-
-  const ready = await preCheck();
-  if (!ready) {
-    console.log('\nPre-check failed. Aborting.\n');
-    process.exit(1);
-  }
-
-  console.log('');
-
-  try {
-    await test01_basicIdentify();
-    await test02_phoneNormalization();
-    await test03_oauthProvider();
-    await test04_crossBrowserMerge();
-    await test05_crossIdentifierMerge();
-    await test06_consentEnforcement();
-    await test07_consentDowngrade();
-    await test08_mergeAuditEvents();
-    await test09_deviceFingerprint();
-    await test10_ipHash();
-    await test11_analyticsConsentPIIBlock();
-    await test12_idempotentIdentify();
-  } catch (err) {
-    log('FAIL', `Unhandled error: ${(err as Error).message}`);
-    console.error(err);
-  }
-
-  console.log('');
-  await cleanup();
-
-  console.log('\n========================================');
-  console.log(` Results: ${passCount} passed, ${failCount} failed, ${skipCount} skipped`);
-  console.log('========================================\n');
-
-  process.exit(failCount > 0 ? 1 : 0);
-}
-
-main();