@stardeck-customer-apps/testing 0.1.1 → 0.2.0

package/SKILL.md

@@ -85,6 +85,9 @@ describeWorkflow("checkout", () => {
   auth flows (`__stardeck:sess`).
 - `app.inbox` — emails sent through the email-sdk: `.latest(addr?)`,
   `.to(addr)`, `.all()`, `.count`, `.clear()`.
+- `app.identities` — the platform-identity directory created through
+  integrations-sdk `client.identities`: `.get(id)`, `.links(id)`, `.all()`,
+  `.count`, `.clear()`.
 - `app.query(sql, params?)` / `app.db` — direct database access for
   assertions and seeding.
 - `callRoute(handler, opts)` — invoke an App Router route handler with a real
@@ -104,6 +107,10 @@ describeWorkflow("checkout", () => {
 - `getSession()` / `requireAuth()` from project-auth — resolves the
   `asUser(...)` user (header fast path) or issued session cookies.
 - `EmailClient.send()` — captured in `app.inbox`, never delivered.
+- `client.identities` from integrations-sdk (create/get/update/list accounts &
+  persons, attach channel links) — served offline by the simulated directory;
+  `update` replaces the `profile` object (not a merge), like the control plane.
+  Inspect via `app.identities`. Merge/archive are dashboard-only — not simulated.
 - `next/headers` (`headers()`/`cookies()`) inside handlers under `callRoute`.
 
 ## Rules

package/dist/index.d.mts

@@ -43,6 +43,47 @@ interface TestInbox {
     clear(): void;
     get count(): number;
 }
+/**
+ * A platform identity captured by the simulated directory. Mirrors the `Identity`
+ * shape returned by @stardeck-customer-apps/integrations-sdk's `client.identities`
+ * — keep in sync.
+ */
+interface CapturedIdentity {
+    id: string;
+    type: "person" | "account";
+    parentId: string | null;
+    displayName: string | null;
+    profile: Record<string, unknown>;
+    status: "active" | "merged" | "archived";
+    mergedIntoId: string | null;
+    externalRef: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+/** A channel identifier / login attached to a person identity. */
+interface CapturedIdentityLink {
+    id: string;
+    identityId: string;
+    kind: string;
+    externalId: string;
+    verified: boolean;
+    createdAt: string;
+}
+/**
+ * Inspect the simulated platform-identity directory — the in-memory stand-in for
+ * the control plane that `client.identities` talks to in tests. Identities and
+ * links created by app code under test land here; assert on them like `inbox`.
+ */
+interface TestDirectory {
+    /** All identities, oldest first. */
+    all(): CapturedIdentity[];
+    /** A single identity by id, or undefined. */
+    get(id: string): CapturedIdentity | undefined;
+    /** Channel/login links attached to an identity. */
+    links(identityId: string): CapturedIdentityLink[];
+    clear(): void;
+    get count(): number;
+}
 interface TestAppOptions {
     /**
      * Path to the schema.sql snapshot generated by
@@ -70,6 +111,8 @@ interface TestApp {
     db: PGlite;
     /** Captured outbound email. */
     inbox: TestInbox;
+    /** Inspect the simulated platform-identity directory (`client.identities`). */
+    identities: TestDirectory;
     /** Convenience for raw SQL: `app.query("SELECT ...", [param])`. */
     query<T = Record<string, unknown>>(sql: string, params?: unknown[]): Promise<T[]>;
     /**
@@ -140,4 +183,4 @@ declare const TEST_ENV_DEFAULTS: {
 /** Default location of the DDL snapshot written by `generate-types`. */
 declare const DEFAULT_SCHEMA_PATH = "./src/generated/data-store-schema.sql";
 
-export { CONTROL_PLANE_TEST_URL, type CallRouteOptions, type CapturedEmail, DATA_STORE_TEST_HOST, DEFAULT_SCHEMA_PATH, type SessionTokens, TEST_ENV_DEFAULTS, type TestApp, type TestAppOptions, type TestInbox, type TestUser, WORKFLOW_NAME_PREFIX, callRoute, createTestApp, describeWorkflow, parseWorkflowName };
+export { CONTROL_PLANE_TEST_URL, type CallRouteOptions, type CapturedEmail, type CapturedIdentity, type CapturedIdentityLink, DATA_STORE_TEST_HOST, DEFAULT_SCHEMA_PATH, type SessionTokens, TEST_ENV_DEFAULTS, type TestApp, type TestAppOptions, type TestDirectory, type TestInbox, type TestUser, WORKFLOW_NAME_PREFIX, callRoute, createTestApp, describeWorkflow, parseWorkflowName };

package/dist/index.d.ts

@@ -43,6 +43,47 @@ interface TestInbox {
     clear(): void;
     get count(): number;
 }
+/**
+ * A platform identity captured by the simulated directory. Mirrors the `Identity`
+ * shape returned by @stardeck-customer-apps/integrations-sdk's `client.identities`
+ * — keep in sync.
+ */
+interface CapturedIdentity {
+    id: string;
+    type: "person" | "account";
+    parentId: string | null;
+    displayName: string | null;
+    profile: Record<string, unknown>;
+    status: "active" | "merged" | "archived";
+    mergedIntoId: string | null;
+    externalRef: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+/** A channel identifier / login attached to a person identity. */
+interface CapturedIdentityLink {
+    id: string;
+    identityId: string;
+    kind: string;
+    externalId: string;
+    verified: boolean;
+    createdAt: string;
+}
+/**
+ * Inspect the simulated platform-identity directory — the in-memory stand-in for
+ * the control plane that `client.identities` talks to in tests. Identities and
+ * links created by app code under test land here; assert on them like `inbox`.
+ */
+interface TestDirectory {
+    /** All identities, oldest first. */
+    all(): CapturedIdentity[];
+    /** A single identity by id, or undefined. */
+    get(id: string): CapturedIdentity | undefined;
+    /** Channel/login links attached to an identity. */
+    links(identityId: string): CapturedIdentityLink[];
+    clear(): void;
+    get count(): number;
+}
 interface TestAppOptions {
     /**
      * Path to the schema.sql snapshot generated by
@@ -70,6 +111,8 @@ interface TestApp {
     db: PGlite;
     /** Captured outbound email. */
     inbox: TestInbox;
+    /** Inspect the simulated platform-identity directory (`client.identities`). */
+    identities: TestDirectory;
     /** Convenience for raw SQL: `app.query("SELECT ...", [param])`. */
     query<T = Record<string, unknown>>(sql: string, params?: unknown[]): Promise<T[]>;
     /**
@@ -140,4 +183,4 @@ declare const TEST_ENV_DEFAULTS: {
 /** Default location of the DDL snapshot written by `generate-types`. */
 declare const DEFAULT_SCHEMA_PATH = "./src/generated/data-store-schema.sql";
 
-export { CONTROL_PLANE_TEST_URL, type CallRouteOptions, type CapturedEmail, DATA_STORE_TEST_HOST, DEFAULT_SCHEMA_PATH, type SessionTokens, TEST_ENV_DEFAULTS, type TestApp, type TestAppOptions, type TestInbox, type TestUser, WORKFLOW_NAME_PREFIX, callRoute, createTestApp, describeWorkflow, parseWorkflowName };
+export { CONTROL_PLANE_TEST_URL, type CallRouteOptions, type CapturedEmail, type CapturedIdentity, type CapturedIdentityLink, DATA_STORE_TEST_HOST, DEFAULT_SCHEMA_PATH, type SessionTokens, TEST_ENV_DEFAULTS, type TestApp, type TestAppOptions, type TestDirectory, type TestInbox, type TestUser, WORKFLOW_NAME_PREFIX, callRoute, createTestApp, describeWorkflow, parseWorkflowName };

package/dist/index.js

@@ -43,7 +43,7 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/test-app.ts
-var import_node_crypto3 = __toESM(require("crypto"));
+var import_node_crypto4 = __toESM(require("crypto"));
 var import_node_fs = require("fs");
 var import_node_path = require("path");
 
@@ -96,6 +96,8 @@ var state = globalSingleton("state", () => ({
   refreshSessions: /* @__PURE__ */ new Map(),
   emails: [],
   emailCounter: 0,
+  identities: /* @__PURE__ */ new Map(),
+  identityLinks: [],
   allowNetwork: false
 }));
 function requireDb() {
@@ -155,8 +157,8 @@ function verifyDeploymentAuthHeader(secret, header) {
     return null;
   }
   if (payload.type !== "deployment-request") return null;
-  const now = Math.floor(Date.now() / 1e3);
-  if (Math.abs(now - payload.timestamp) > TIMESTAMP_TOLERANCE_SECONDS) return null;
+  const now2 = Math.floor(Date.now() / 1e3);
+  if (Math.abs(now2 - payload.timestamp) > TIMESTAMP_TOLERANCE_SECONDS) return null;
   return payload;
 }
 
@@ -460,6 +462,7 @@ var FIELD_TYPE_TO_PG = {
   currency: "numeric",
   rating: "integer",
   relation: "uuid",
+  identity: "uuid",
   file_ref: "jsonb",
   file_refs: "jsonb",
   json: "jsonb"
@@ -637,6 +640,153 @@ function createInbox() {
   };
 }
 
+// src/simulator/identities.ts
+var import_node_crypto3 = __toESM(require("crypto"));
+var LINK_KINDS = /* @__PURE__ */ new Set([
+  "line",
+  "facebook",
+  "instagram",
+  "email",
+  "phone",
+  "project_auth_user",
+  "dashboard_user"
+]);
+function now() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function linksFor(identityId) {
+  return state.identityLinks.filter((l) => l.identityId === identityId);
+}
+async function readBody(request) {
+  try {
+    return await request.json();
+  } catch {
+    return {};
+  }
+}
+function handleList(request) {
+  const typeParam = new URL(request.url).searchParams.get("type");
+  const type = typeParam === "person" || typeParam === "account" ? typeParam : void 0;
+  const identities = [...state.identities.values()];
+  return success({ identities: type ? identities.filter((i) => i.type === type) : identities });
+}
+async function handleCreate(request) {
+  const body = await readBody(request);
+  const type = body.type;
+  if (type !== "person" && type !== "account") {
+    return failure("type must be 'person' or 'account'");
+  }
+  let parentId = null;
+  if (type === "person" && body.parentId) {
+    const parent = state.identities.get(body.parentId);
+    if (!parent) return failure("parent identity not found");
+    if (parent.type !== "account") {
+      return failure("a person's parent must be an account");
+    }
+    parentId = parent.id;
+  }
+  const identity = {
+    id: import_node_crypto3.default.randomUUID(),
+    type,
+    parentId,
+    displayName: body.displayName ?? null,
+    profile: body.profile ?? {},
+    status: "active",
+    mergedIntoId: null,
+    externalRef: body.externalRef ?? null,
+    createdAt: now(),
+    updatedAt: now()
+  };
+  state.identities.set(identity.id, identity);
+  return success({ identity });
+}
+function handleGet(identityId) {
+  const identity = state.identities.get(identityId);
+  if (!identity) return failure("identity not found", 404);
+  return success({ identity, links: linksFor(identityId) });
+}
+async function handleUpdate(identityId, request) {
+  const identity = state.identities.get(identityId);
+  if (!identity) return failure("identity not found", 404);
+  const body = await readBody(request);
+  if (body.displayName !== void 0) {
+    identity.displayName = body.displayName;
+  }
+  if (body.profile !== void 0) {
+    identity.profile = body.profile;
+  }
+  if (body.externalRef !== void 0) {
+    identity.externalRef = body.externalRef;
+  }
+  identity.updatedAt = now();
+  return success({ identity });
+}
+async function handleAttachLink(identityId, request) {
+  const identity = state.identities.get(identityId);
+  if (!identity) return failure("identity not found", 404);
+  if (identity.type !== "person") {
+    return failure("links attach only to a person identity");
+  }
+  if (identity.status !== "active") {
+    return failure("links attach only to active persons");
+  }
+  const body = await readBody(request);
+  const kind = body.kind;
+  const externalId = body.externalId;
+  if (typeof kind !== "string" || !LINK_KINDS.has(kind)) {
+    return failure(`kind must be one of: ${[...LINK_KINDS].join(", ")}`);
+  }
+  if (typeof externalId !== "string" || !externalId) {
+    return failure("externalId is required");
+  }
+  const existing = state.identityLinks.find((l) => l.kind === kind && l.externalId === externalId);
+  if (existing) {
+    if (existing.identityId === identityId) return success({ link: existing });
+    return failure("identifier already linked to another identity", 409);
+  }
+  const link = {
+    id: import_node_crypto3.default.randomUUID(),
+    identityId,
+    kind,
+    externalId,
+    verified: body.verified === true,
+    createdAt: now()
+  };
+  state.identityLinks.push(link);
+  return success({ link });
+}
+async function handleIdentitiesRequest(request, subPath) {
+  const method = request.method;
+  if (subPath === "" || subPath === "/") {
+    if (method === "GET") return handleList(request);
+    if (method === "POST") return handleCreate(request);
+  }
+  const linksMatch = subPath.match(/^\/([^/]+)\/links$/);
+  if (linksMatch && method === "POST") {
+    return handleAttachLink(linksMatch[1], request);
+  }
+  const singleMatch = subPath.match(/^\/([^/]+)$/);
+  if (singleMatch) {
+    if (method === "GET") return handleGet(singleMatch[1]);
+    if (method === "PATCH") return handleUpdate(singleMatch[1], request);
+  }
+  return failure(`No identities simulator for ${method} .../identities${subPath}`, 404);
+}
+function createDirectory() {
+  return {
+    all: () => [...state.identities.values()],
+    get: (id) => state.identities.get(id),
+    links: (identityId) => linksFor(identityId),
+    clear: () => {
+      state.identities.clear();
+      state.identityLinks = [];
+    },
+    get count() {
+      return state.identities.size;
+    }
+  };
+}
+
 // src/simulator/router.ts
 var fetchHolder = globalSingleton("fetch-holder", () => ({
   originalFetch: null
@@ -654,7 +804,8 @@ async function handleSimulatedRequest(request, url) {
   }
   const dataStoreMatch = url.pathname.match(/^\/api\/data-stores\/[^/]+(\/.*)?$/);
   const isEmail = url.pathname === "/api/email/send";
-  if (dataStoreMatch || isEmail) {
+  const identitiesMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/identities(\/.*)?$/);
+  if (dataStoreMatch || isEmail || identitiesMatch) {
     const authHeader = request.headers.get("X-Stardeck-Auth");
     if (!authHeader) {
       return failure("Missing authentication header", 401);
@@ -667,28 +818,31 @@ async function handleSimulatedRequest(request, url) {
   if (isEmail && request.method === "POST") {
     return handleEmailSend(request);
   }
+  if (identitiesMatch) {
+    return handleIdentitiesRequest(request, identitiesMatch[1] ?? "");
+  }
   if (dataStoreMatch) {
     const subPath = dataStoreMatch[1] ?? "";
     const db = requireDb();
-    const readBody = async () => await request.json();
+    const readBody2 = async () => await request.json();
     if (subPath === "/query" && request.method === "POST") {
-      return handleQuery(db, await readBody());
+      return handleQuery(db, await readBody2());
     }
     if (subPath === "/mutate" && request.method === "POST") {
-      return handleMutate(db, await readBody());
+      return handleMutate(db, await readBody2());
     }
     if (subPath === "/schema" && request.method === "GET") {
       return handleGetSchema(db);
     }
     if (subPath === "/schema/tables" && request.method === "POST") {
-      return handleCreateTable(db, await readBody());
+      return handleCreateTable(db, await readBody2());
     }
     if (subPath === "/schema/columns" && request.method === "POST") {
-      return handleAddColumn(db, await readBody());
+      return handleAddColumn(db, await readBody2());
     }
   }
   return failure(
-    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, auth verify/refresh, Neon /sql.`,
+    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, identities CRUD, auth verify/refresh, Neon /sql.`,
     404
   );
 }
@@ -773,9 +927,11 @@ async function createTestApp(options = {}) {
     throw error;
   }
   const inbox = createInbox();
+  const directory = createDirectory();
   const app = {
     db,
     inbox,
+    identities: directory,
     async query(sql, params = []) {
       const result = await db.query(sql, params);
       return result.rows;
@@ -791,8 +947,8 @@ async function createTestApp(options = {}) {
     issueSession(user) {
       const fullUser = buildUser(user);
       const tokens = {
-        accessToken: `test-access-${import_node_crypto3.default.randomUUID()}`,
-        refreshToken: `test-refresh-${import_node_crypto3.default.randomUUID()}`
+        accessToken: `test-access-${import_node_crypto4.default.randomUUID()}`,
+        refreshToken: `test-refresh-${import_node_crypto4.default.randomUUID()}`
       };
       state.sessions.set(tokens.accessToken, fullUser);
       state.refreshSessions.set(tokens.refreshToken, fullUser);
@@ -806,6 +962,8 @@ async function createTestApp(options = {}) {
       state.refreshSessions.clear();
       state.emails = [];
       state.emailCounter = 0;
+      state.identities.clear();
+      state.identityLinks = [];
     },
     async close() {
       state.db = null;
@@ -813,6 +971,8 @@ async function createTestApp(options = {}) {
       state.sessions.clear();
       state.refreshSessions.clear();
       state.emails = [];
+      state.identities.clear();
+      state.identityLinks = [];
       uninstallFetchRouter();
       await db.close();
     }

package/dist/index.mjs

@@ -1,5 +1,5 @@
 // src/test-app.ts
-import crypto3 from "crypto";
+import crypto4 from "crypto";
 import { readFileSync, existsSync } from "fs";
 import { resolve } from "path";
 
@@ -52,6 +52,8 @@ var state = globalSingleton("state", () => ({
   refreshSessions: /* @__PURE__ */ new Map(),
   emails: [],
   emailCounter: 0,
+  identities: /* @__PURE__ */ new Map(),
+  identityLinks: [],
   allowNetwork: false
 }));
 function requireDb() {
@@ -111,8 +113,8 @@ function verifyDeploymentAuthHeader(secret, header) {
     return null;
   }
   if (payload.type !== "deployment-request") return null;
-  const now = Math.floor(Date.now() / 1e3);
-  if (Math.abs(now - payload.timestamp) > TIMESTAMP_TOLERANCE_SECONDS) return null;
+  const now2 = Math.floor(Date.now() / 1e3);
+  if (Math.abs(now2 - payload.timestamp) > TIMESTAMP_TOLERANCE_SECONDS) return null;
   return payload;
 }
 
@@ -416,6 +418,7 @@ var FIELD_TYPE_TO_PG = {
   currency: "numeric",
   rating: "integer",
   relation: "uuid",
+  identity: "uuid",
   file_ref: "jsonb",
   file_refs: "jsonb",
   json: "jsonb"
@@ -593,6 +596,153 @@ function createInbox() {
   };
 }
 
+// src/simulator/identities.ts
+import crypto3 from "crypto";
+var LINK_KINDS = /* @__PURE__ */ new Set([
+  "line",
+  "facebook",
+  "instagram",
+  "email",
+  "phone",
+  "project_auth_user",
+  "dashboard_user"
+]);
+function now() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function linksFor(identityId) {
+  return state.identityLinks.filter((l) => l.identityId === identityId);
+}
+async function readBody(request) {
+  try {
+    return await request.json();
+  } catch {
+    return {};
+  }
+}
+function handleList(request) {
+  const typeParam = new URL(request.url).searchParams.get("type");
+  const type = typeParam === "person" || typeParam === "account" ? typeParam : void 0;
+  const identities = [...state.identities.values()];
+  return success({ identities: type ? identities.filter((i) => i.type === type) : identities });
+}
+async function handleCreate(request) {
+  const body = await readBody(request);
+  const type = body.type;
+  if (type !== "person" && type !== "account") {
+    return failure("type must be 'person' or 'account'");
+  }
+  let parentId = null;
+  if (type === "person" && body.parentId) {
+    const parent = state.identities.get(body.parentId);
+    if (!parent) return failure("parent identity not found");
+    if (parent.type !== "account") {
+      return failure("a person's parent must be an account");
+    }
+    parentId = parent.id;
+  }
+  const identity = {
+    id: crypto3.randomUUID(),
+    type,
+    parentId,
+    displayName: body.displayName ?? null,
+    profile: body.profile ?? {},
+    status: "active",
+    mergedIntoId: null,
+    externalRef: body.externalRef ?? null,
+    createdAt: now(),
+    updatedAt: now()
+  };
+  state.identities.set(identity.id, identity);
+  return success({ identity });
+}
+function handleGet(identityId) {
+  const identity = state.identities.get(identityId);
+  if (!identity) return failure("identity not found", 404);
+  return success({ identity, links: linksFor(identityId) });
+}
+async function handleUpdate(identityId, request) {
+  const identity = state.identities.get(identityId);
+  if (!identity) return failure("identity not found", 404);
+  const body = await readBody(request);
+  if (body.displayName !== void 0) {
+    identity.displayName = body.displayName;
+  }
+  if (body.profile !== void 0) {
+    identity.profile = body.profile;
+  }
+  if (body.externalRef !== void 0) {
+    identity.externalRef = body.externalRef;
+  }
+  identity.updatedAt = now();
+  return success({ identity });
+}
+async function handleAttachLink(identityId, request) {
+  const identity = state.identities.get(identityId);
+  if (!identity) return failure("identity not found", 404);
+  if (identity.type !== "person") {
+    return failure("links attach only to a person identity");
+  }
+  if (identity.status !== "active") {
+    return failure("links attach only to active persons");
+  }
+  const body = await readBody(request);
+  const kind = body.kind;
+  const externalId = body.externalId;
+  if (typeof kind !== "string" || !LINK_KINDS.has(kind)) {
+    return failure(`kind must be one of: ${[...LINK_KINDS].join(", ")}`);
+  }
+  if (typeof externalId !== "string" || !externalId) {
+    return failure("externalId is required");
+  }
+  const existing = state.identityLinks.find((l) => l.kind === kind && l.externalId === externalId);
+  if (existing) {
+    if (existing.identityId === identityId) return success({ link: existing });
+    return failure("identifier already linked to another identity", 409);
+  }
+  const link = {
+    id: crypto3.randomUUID(),
+    identityId,
+    kind,
+    externalId,
+    verified: body.verified === true,
+    createdAt: now()
+  };
+  state.identityLinks.push(link);
+  return success({ link });
+}
+async function handleIdentitiesRequest(request, subPath) {
+  const method = request.method;
+  if (subPath === "" || subPath === "/") {
+    if (method === "GET") return handleList(request);
+    if (method === "POST") return handleCreate(request);
+  }
+  const linksMatch = subPath.match(/^\/([^/]+)\/links$/);
+  if (linksMatch && method === "POST") {
+    return handleAttachLink(linksMatch[1], request);
+  }
+  const singleMatch = subPath.match(/^\/([^/]+)$/);
+  if (singleMatch) {
+    if (method === "GET") return handleGet(singleMatch[1]);
+    if (method === "PATCH") return handleUpdate(singleMatch[1], request);
+  }
+  return failure(`No identities simulator for ${method} .../identities${subPath}`, 404);
+}
+function createDirectory() {
+  return {
+    all: () => [...state.identities.values()],
+    get: (id) => state.identities.get(id),
+    links: (identityId) => linksFor(identityId),
+    clear: () => {
+      state.identities.clear();
+      state.identityLinks = [];
+    },
+    get count() {
+      return state.identities.size;
+    }
+  };
+}
+
 // src/simulator/router.ts
 var fetchHolder = globalSingleton("fetch-holder", () => ({
   originalFetch: null
@@ -610,7 +760,8 @@ async function handleSimulatedRequest(request, url) {
   }
   const dataStoreMatch = url.pathname.match(/^\/api\/data-stores\/[^/]+(\/.*)?$/);
   const isEmail = url.pathname === "/api/email/send";
-  if (dataStoreMatch || isEmail) {
+  const identitiesMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/identities(\/.*)?$/);
+  if (dataStoreMatch || isEmail || identitiesMatch) {
     const authHeader = request.headers.get("X-Stardeck-Auth");
     if (!authHeader) {
       return failure("Missing authentication header", 401);
@@ -623,28 +774,31 @@ async function handleSimulatedRequest(request, url) {
   if (isEmail && request.method === "POST") {
     return handleEmailSend(request);
   }
+  if (identitiesMatch) {
+    return handleIdentitiesRequest(request, identitiesMatch[1] ?? "");
+  }
   if (dataStoreMatch) {
     const subPath = dataStoreMatch[1] ?? "";
     const db = requireDb();
-    const readBody = async () => await request.json();
+    const readBody2 = async () => await request.json();
     if (subPath === "/query" && request.method === "POST") {
-      return handleQuery(db, await readBody());
+      return handleQuery(db, await readBody2());
     }
     if (subPath === "/mutate" && request.method === "POST") {
-      return handleMutate(db, await readBody());
+      return handleMutate(db, await readBody2());
     }
     if (subPath === "/schema" && request.method === "GET") {
       return handleGetSchema(db);
     }
     if (subPath === "/schema/tables" && request.method === "POST") {
-      return handleCreateTable(db, await readBody());
+      return handleCreateTable(db, await readBody2());
     }
     if (subPath === "/schema/columns" && request.method === "POST") {
-      return handleAddColumn(db, await readBody());
+      return handleAddColumn(db, await readBody2());
     }
   }
   return failure(
-    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, auth verify/refresh, Neon /sql.`,
+    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, identities CRUD, auth verify/refresh, Neon /sql.`,
     404
   );
 }
@@ -729,9 +883,11 @@ async function createTestApp(options = {}) {
     throw error;
   }
   const inbox = createInbox();
+  const directory = createDirectory();
   const app = {
     db,
     inbox,
+    identities: directory,
     async query(sql, params = []) {
       const result = await db.query(sql, params);
       return result.rows;
@@ -747,8 +903,8 @@ async function createTestApp(options = {}) {
     issueSession(user) {
       const fullUser = buildUser(user);
       const tokens = {
-        accessToken: `test-access-${crypto3.randomUUID()}`,
-        refreshToken: `test-refresh-${crypto3.randomUUID()}`
+        accessToken: `test-access-${crypto4.randomUUID()}`,
+        refreshToken: `test-refresh-${crypto4.randomUUID()}`
       };
       state.sessions.set(tokens.accessToken, fullUser);
       state.refreshSessions.set(tokens.refreshToken, fullUser);
@@ -762,6 +918,8 @@ async function createTestApp(options = {}) {
       state.refreshSessions.clear();
       state.emails = [];
       state.emailCounter = 0;
+      state.identities.clear();
+      state.identityLinks = [];
     },
     async close() {
       state.db = null;
@@ -769,6 +927,8 @@ async function createTestApp(options = {}) {
       state.sessions.clear();
       state.refreshSessions.clear();
       state.emails = [];
+      state.identities.clear();
+      state.identityLinks = [];
       uninstallFetchRouter();
       await db.close();
     }

package/dist/next/headers-shim.js

@@ -44,6 +44,8 @@ var state = globalSingleton("state", () => ({
   refreshSessions: /* @__PURE__ */ new Map(),
   emails: [],
   emailCounter: 0,
+  identities: /* @__PURE__ */ new Map(),
+  identityLinks: [],
   allowNetwork: false
 }));
 

package/dist/next/headers-shim.mjs

@@ -17,6 +17,8 @@ var state = globalSingleton("state", () => ({
   refreshSessions: /* @__PURE__ */ new Map(),
   emails: [],
   emailCounter: 0,
+  identities: /* @__PURE__ */ new Map(),
+  identityLinks: [],
   allowNetwork: false
 }));
 

package/dist/setup.js

@@ -38,6 +38,8 @@ var state = globalSingleton("state", () => ({
   refreshSessions: /* @__PURE__ */ new Map(),
   emails: [],
   emailCounter: 0,
+  identities: /* @__PURE__ */ new Map(),
+  identityLinks: [],
   allowNetwork: false
 }));
 function requireDb() {
@@ -89,8 +91,8 @@ function verifyDeploymentAuthHeader(secret, header) {
     return null;
   }
   if (payload.type !== "deployment-request") return null;
-  const now = Math.floor(Date.now() / 1e3);
-  if (Math.abs(now - payload.timestamp) > TIMESTAMP_TOLERANCE_SECONDS) return null;
+  const now2 = Math.floor(Date.now() / 1e3);
+  if (Math.abs(now2 - payload.timestamp) > TIMESTAMP_TOLERANCE_SECONDS) return null;
   return payload;
 }
 
@@ -394,6 +396,7 @@ var FIELD_TYPE_TO_PG = {
   currency: "numeric",
   rating: "integer",
   relation: "uuid",
+  identity: "uuid",
   file_ref: "jsonb",
   file_refs: "jsonb",
   json: "jsonb"
@@ -569,6 +572,139 @@ async function handleEmailSend(request) {
   return success({ resendId, fromAddress });
 }
 
+// src/simulator/identities.ts
+var import_node_crypto3 = __toESM(require("crypto"));
+var LINK_KINDS = /* @__PURE__ */ new Set([
+  "line",
+  "facebook",
+  "instagram",
+  "email",
+  "phone",
+  "project_auth_user",
+  "dashboard_user"
+]);
+function now() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function linksFor(identityId) {
+  return state.identityLinks.filter((l) => l.identityId === identityId);
+}
+async function readBody(request) {
+  try {
+    return await request.json();
+  } catch {
+    return {};
+  }
+}
+function handleList(request) {
+  const typeParam = new URL(request.url).searchParams.get("type");
+  const type = typeParam === "person" || typeParam === "account" ? typeParam : void 0;
+  const identities = [...state.identities.values()];
+  return success({ identities: type ? identities.filter((i) => i.type === type) : identities });
+}
+async function handleCreate(request) {
+  const body = await readBody(request);
+  const type = body.type;
+  if (type !== "person" && type !== "account") {
+    return failure("type must be 'person' or 'account'");
+  }
+  let parentId = null;
+  if (type === "person" && body.parentId) {
+    const parent = state.identities.get(body.parentId);
+    if (!parent) return failure("parent identity not found");
+    if (parent.type !== "account") {
+      return failure("a person's parent must be an account");
+    }
+    parentId = parent.id;
+  }
+  const identity = {
+    id: import_node_crypto3.default.randomUUID(),
+    type,
+    parentId,
+    displayName: body.displayName ?? null,
+    profile: body.profile ?? {},
+    status: "active",
+    mergedIntoId: null,
+    externalRef: body.externalRef ?? null,
+    createdAt: now(),
+    updatedAt: now()
+  };
+  state.identities.set(identity.id, identity);
+  return success({ identity });
+}
+function handleGet(identityId) {
+  const identity = state.identities.get(identityId);
+  if (!identity) return failure("identity not found", 404);
+  return success({ identity, links: linksFor(identityId) });
+}
+async function handleUpdate(identityId, request) {
+  const identity = state.identities.get(identityId);
+  if (!identity) return failure("identity not found", 404);
+  const body = await readBody(request);
+  if (body.displayName !== void 0) {
+    identity.displayName = body.displayName;
+  }
+  if (body.profile !== void 0) {
+    identity.profile = body.profile;
+  }
+  if (body.externalRef !== void 0) {
+    identity.externalRef = body.externalRef;
+  }
+  identity.updatedAt = now();
+  return success({ identity });
+}
+async function handleAttachLink(identityId, request) {
+  const identity = state.identities.get(identityId);
+  if (!identity) return failure("identity not found", 404);
+  if (identity.type !== "person") {
+    return failure("links attach only to a person identity");
+  }
+  if (identity.status !== "active") {
+    return failure("links attach only to active persons");
+  }
+  const body = await readBody(request);
+  const kind = body.kind;
+  const externalId = body.externalId;
+  if (typeof kind !== "string" || !LINK_KINDS.has(kind)) {
+    return failure(`kind must be one of: ${[...LINK_KINDS].join(", ")}`);
+  }
+  if (typeof externalId !== "string" || !externalId) {
+    return failure("externalId is required");
+  }
+  const existing = state.identityLinks.find((l) => l.kind === kind && l.externalId === externalId);
+  if (existing) {
+    if (existing.identityId === identityId) return success({ link: existing });
+    return failure("identifier already linked to another identity", 409);
+  }
+  const link = {
+    id: import_node_crypto3.default.randomUUID(),
+    identityId,
+    kind,
+    externalId,
+    verified: body.verified === true,
+    createdAt: now()
+  };
+  state.identityLinks.push(link);
+  return success({ link });
+}
+async function handleIdentitiesRequest(request, subPath) {
+  const method = request.method;
+  if (subPath === "" || subPath === "/") {
+    if (method === "GET") return handleList(request);
+    if (method === "POST") return handleCreate(request);
+  }
+  const linksMatch = subPath.match(/^\/([^/]+)\/links$/);
+  if (linksMatch && method === "POST") {
+    return handleAttachLink(linksMatch[1], request);
+  }
+  const singleMatch = subPath.match(/^\/([^/]+)$/);
+  if (singleMatch) {
+    if (method === "GET") return handleGet(singleMatch[1]);
+    if (method === "PATCH") return handleUpdate(singleMatch[1], request);
+  }
+  return failure(`No identities simulator for ${method} .../identities${subPath}`, 404);
+}
+
 // src/simulator/router.ts
 var fetchHolder = globalSingleton("fetch-holder", () => ({
   originalFetch: null
@@ -586,7 +722,8 @@ async function handleSimulatedRequest(request, url) {
   }
   const dataStoreMatch = url.pathname.match(/^\/api\/data-stores\/[^/]+(\/.*)?$/);
   const isEmail = url.pathname === "/api/email/send";
-  if (dataStoreMatch || isEmail) {
+  const identitiesMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/identities(\/.*)?$/);
+  if (dataStoreMatch || isEmail || identitiesMatch) {
     const authHeader = request.headers.get("X-Stardeck-Auth");
     if (!authHeader) {
       return failure("Missing authentication header", 401);
@@ -599,28 +736,31 @@ async function handleSimulatedRequest(request, url) {
   if (isEmail && request.method === "POST") {
     return handleEmailSend(request);
   }
+  if (identitiesMatch) {
+    return handleIdentitiesRequest(request, identitiesMatch[1] ?? "");
+  }
   if (dataStoreMatch) {
     const subPath = dataStoreMatch[1] ?? "";
     const db = requireDb();
-    const readBody = async () => await request.json();
+    const readBody2 = async () => await request.json();
     if (subPath === "/query" && request.method === "POST") {
-      return handleQuery(db, await readBody());
+      return handleQuery(db, await readBody2());
     }
     if (subPath === "/mutate" && request.method === "POST") {
-      return handleMutate(db, await readBody());
+      return handleMutate(db, await readBody2());
     }
     if (subPath === "/schema" && request.method === "GET") {
       return handleGetSchema(db);
     }
     if (subPath === "/schema/tables" && request.method === "POST") {
-      return handleCreateTable(db, await readBody());
+      return handleCreateTable(db, await readBody2());
     }
     if (subPath === "/schema/columns" && request.method === "POST") {
-      return handleAddColumn(db, await readBody());
+      return handleAddColumn(db, await readBody2());
     }
   }
   return failure(
-    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, auth verify/refresh, Neon /sql.`,
+    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, identities CRUD, auth verify/refresh, Neon /sql.`,
     404
   );
 }

package/dist/setup.mjs

@@ -14,6 +14,8 @@ var state = globalSingleton("state", () => ({
   refreshSessions: /* @__PURE__ */ new Map(),
   emails: [],
   emailCounter: 0,
+  identities: /* @__PURE__ */ new Map(),
+  identityLinks: [],
   allowNetwork: false
 }));
 function requireDb() {
@@ -65,8 +67,8 @@ function verifyDeploymentAuthHeader(secret, header) {
     return null;
   }
   if (payload.type !== "deployment-request") return null;
-  const now = Math.floor(Date.now() / 1e3);
-  if (Math.abs(now - payload.timestamp) > TIMESTAMP_TOLERANCE_SECONDS) return null;
+  const now2 = Math.floor(Date.now() / 1e3);
+  if (Math.abs(now2 - payload.timestamp) > TIMESTAMP_TOLERANCE_SECONDS) return null;
   return payload;
 }
 
@@ -370,6 +372,7 @@ var FIELD_TYPE_TO_PG = {
   currency: "numeric",
   rating: "integer",
   relation: "uuid",
+  identity: "uuid",
   file_ref: "jsonb",
   file_refs: "jsonb",
   json: "jsonb"
@@ -545,6 +548,139 @@ async function handleEmailSend(request) {
   return success({ resendId, fromAddress });
 }
 
+// src/simulator/identities.ts
+import crypto3 from "crypto";
+var LINK_KINDS = /* @__PURE__ */ new Set([
+  "line",
+  "facebook",
+  "instagram",
+  "email",
+  "phone",
+  "project_auth_user",
+  "dashboard_user"
+]);
+function now() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function linksFor(identityId) {
+  return state.identityLinks.filter((l) => l.identityId === identityId);
+}
+async function readBody(request) {
+  try {
+    return await request.json();
+  } catch {
+    return {};
+  }
+}
+function handleList(request) {
+  const typeParam = new URL(request.url).searchParams.get("type");
+  const type = typeParam === "person" || typeParam === "account" ? typeParam : void 0;
+  const identities = [...state.identities.values()];
+  return success({ identities: type ? identities.filter((i) => i.type === type) : identities });
+}
+async function handleCreate(request) {
+  const body = await readBody(request);
+  const type = body.type;
+  if (type !== "person" && type !== "account") {
+    return failure("type must be 'person' or 'account'");
+  }
+  let parentId = null;
+  if (type === "person" && body.parentId) {
+    const parent = state.identities.get(body.parentId);
+    if (!parent) return failure("parent identity not found");
+    if (parent.type !== "account") {
+      return failure("a person's parent must be an account");
+    }
+    parentId = parent.id;
+  }
+  const identity = {
+    id: crypto3.randomUUID(),
+    type,
+    parentId,
+    displayName: body.displayName ?? null,
+    profile: body.profile ?? {},
+    status: "active",
+    mergedIntoId: null,
+    externalRef: body.externalRef ?? null,
+    createdAt: now(),
+    updatedAt: now()
+  };
+  state.identities.set(identity.id, identity);
+  return success({ identity });
+}
+function handleGet(identityId) {
+  const identity = state.identities.get(identityId);
+  if (!identity) return failure("identity not found", 404);
+  return success({ identity, links: linksFor(identityId) });
+}
+async function handleUpdate(identityId, request) {
+  const identity = state.identities.get(identityId);
+  if (!identity) return failure("identity not found", 404);
+  const body = await readBody(request);
+  if (body.displayName !== void 0) {
+    identity.displayName = body.displayName;
+  }
+  if (body.profile !== void 0) {
+    identity.profile = body.profile;
+  }
+  if (body.externalRef !== void 0) {
+    identity.externalRef = body.externalRef;
+  }
+  identity.updatedAt = now();
+  return success({ identity });
+}
+async function handleAttachLink(identityId, request) {
+  const identity = state.identities.get(identityId);
+  if (!identity) return failure("identity not found", 404);
+  if (identity.type !== "person") {
+    return failure("links attach only to a person identity");
+  }
+  if (identity.status !== "active") {
+    return failure("links attach only to active persons");
+  }
+  const body = await readBody(request);
+  const kind = body.kind;
+  const externalId = body.externalId;
+  if (typeof kind !== "string" || !LINK_KINDS.has(kind)) {
+    return failure(`kind must be one of: ${[...LINK_KINDS].join(", ")}`);
+  }
+  if (typeof externalId !== "string" || !externalId) {
+    return failure("externalId is required");
+  }
+  const existing = state.identityLinks.find((l) => l.kind === kind && l.externalId === externalId);
+  if (existing) {
+    if (existing.identityId === identityId) return success({ link: existing });
+    return failure("identifier already linked to another identity", 409);
+  }
+  const link = {
+    id: crypto3.randomUUID(),
+    identityId,
+    kind,
+    externalId,
+    verified: body.verified === true,
+    createdAt: now()
+  };
+  state.identityLinks.push(link);
+  return success({ link });
+}
+async function handleIdentitiesRequest(request, subPath) {
+  const method = request.method;
+  if (subPath === "" || subPath === "/") {
+    if (method === "GET") return handleList(request);
+    if (method === "POST") return handleCreate(request);
+  }
+  const linksMatch = subPath.match(/^\/([^/]+)\/links$/);
+  if (linksMatch && method === "POST") {
+    return handleAttachLink(linksMatch[1], request);
+  }
+  const singleMatch = subPath.match(/^\/([^/]+)$/);
+  if (singleMatch) {
+    if (method === "GET") return handleGet(singleMatch[1]);
+    if (method === "PATCH") return handleUpdate(singleMatch[1], request);
+  }
+  return failure(`No identities simulator for ${method} .../identities${subPath}`, 404);
+}
+
 // src/simulator/router.ts
 var fetchHolder = globalSingleton("fetch-holder", () => ({
   originalFetch: null
@@ -562,7 +698,8 @@ async function handleSimulatedRequest(request, url) {
   }
   const dataStoreMatch = url.pathname.match(/^\/api\/data-stores\/[^/]+(\/.*)?$/);
   const isEmail = url.pathname === "/api/email/send";
-  if (dataStoreMatch || isEmail) {
+  const identitiesMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/identities(\/.*)?$/);
+  if (dataStoreMatch || isEmail || identitiesMatch) {
     const authHeader = request.headers.get("X-Stardeck-Auth");
     if (!authHeader) {
       return failure("Missing authentication header", 401);
@@ -575,28 +712,31 @@ async function handleSimulatedRequest(request, url) {
   if (isEmail && request.method === "POST") {
     return handleEmailSend(request);
   }
+  if (identitiesMatch) {
+    return handleIdentitiesRequest(request, identitiesMatch[1] ?? "");
+  }
   if (dataStoreMatch) {
     const subPath = dataStoreMatch[1] ?? "";
     const db = requireDb();
-    const readBody = async () => await request.json();
+    const readBody2 = async () => await request.json();
     if (subPath === "/query" && request.method === "POST") {
-      return handleQuery(db, await readBody());
+      return handleQuery(db, await readBody2());
     }
     if (subPath === "/mutate" && request.method === "POST") {
-      return handleMutate(db, await readBody());
+      return handleMutate(db, await readBody2());
     }
     if (subPath === "/schema" && request.method === "GET") {
       return handleGetSchema(db);
     }
     if (subPath === "/schema/tables" && request.method === "POST") {
-      return handleCreateTable(db, await readBody());
+      return handleCreateTable(db, await readBody2());
     }
     if (subPath === "/schema/columns" && request.method === "POST") {
-      return handleAddColumn(db, await readBody());
+      return handleAddColumn(db, await readBody2());
     }
   }
   return failure(
-    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, auth verify/refresh, Neon /sql.`,
+    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, identities CRUD, auth verify/refresh, Neon /sql.`,
     404
   );
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stardeck-customer-apps/testing",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Vitest test harness for Stardeck customer apps — in-process Postgres (PGlite) plus a control-plane simulator so the real Stardeck SDKs run unmodified in tests",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -78,6 +78,7 @@
     "@neondatabase/serverless": "^1.0.0",
     "@stardeck-customer-apps/data-store-sdk": "*",
     "@stardeck-customer-apps/email-sdk": "*",
+    "@stardeck-customer-apps/integrations-sdk": "*",
     "@stardeck-customer-apps/tsconfig": "*",
     "@types/node": "^24.10.1",
     "kysely": "^0.27.0",