@stardeck-customer-apps/testing 0.14.0 → 0.16.0

package/dist/setup.js

@@ -30,6 +30,23 @@ function globalSingleton(key, create) {
   return holder[symbol];
 }
 
+// src/constants.ts
+var TEST_DOMAIN_SUFFIX = ".stardeck.test";
+var CONTROL_PLANE_TEST_URL = "https://control-plane.stardeck.test";
+var DATA_STORE_TEST_HOST = "db.stardeck.test";
+var DATA_STORE_TEST_URL = `postgresql://test:test@${DATA_STORE_TEST_HOST}/main`;
+var STORAGE_TEST_URL = "https://storage.stardeck.test";
+var STORAGE_TEST_HOST = "storage.stardeck.test";
+var APP_TEST_ORIGIN = "http://localhost:3333";
+var TEST_ENV_DEFAULTS = {
+  CONTROL_PLANE_URL: CONTROL_PLANE_TEST_URL,
+  DEPLOYMENT_SECRET: "stardeck-test-deployment-secret",
+  ORGANIZATION_ID: "00000000-0000-4000-8000-00000000000a",
+  PROJECT_ID: "00000000-0000-4000-8000-00000000000b",
+  DEPLOYMENT_ID: "00000000-0000-4000-8000-00000000000c",
+  STORAGE_URL: STORAGE_TEST_URL
+};
+
 // src/state.ts
 var state = globalSingleton("state", () => ({
   db: null,
@@ -41,6 +58,10 @@ var state = globalSingleton("state", () => ({
   emailCounter: 0,
   identities: /* @__PURE__ */ new Map(),
   identityLinks: [],
+  identityClaims: /* @__PURE__ */ new Map(),
+  identityStaffAssistEnabled: false,
+  identitySuppressClaimDelivery: false,
+  identityAllowedReturnOrigins: /* @__PURE__ */ new Set([APP_TEST_ORIGIN]),
   checkouts: [],
   checkoutCounter: 0,
   sessionStatuses: /* @__PURE__ */ new Map(),
@@ -68,6 +89,9 @@ var state = globalSingleton("state", () => ({
   edgeBindings: /* @__PURE__ */ new Map(),
   edgeCapabilities: null,
   edgePeripheralCapabilities: /* @__PURE__ */ new Map(),
+  starlensCalls: [],
+  starlensReplies: [],
+  starlensDefaultReply: null,
   allowNetwork: false
 }));
 function requireDb() {
@@ -79,22 +103,6 @@ function requireDb() {
   return state.db;
 }
 
-// src/constants.ts
-var TEST_DOMAIN_SUFFIX = ".stardeck.test";
-var CONTROL_PLANE_TEST_URL = "https://control-plane.stardeck.test";
-var DATA_STORE_TEST_HOST = "db.stardeck.test";
-var DATA_STORE_TEST_URL = `postgresql://test:test@${DATA_STORE_TEST_HOST}/main`;
-var STORAGE_TEST_URL = "https://storage.stardeck.test";
-var STORAGE_TEST_HOST = "storage.stardeck.test";
-var TEST_ENV_DEFAULTS = {
-  CONTROL_PLANE_URL: CONTROL_PLANE_TEST_URL,
-  DEPLOYMENT_SECRET: "stardeck-test-deployment-secret",
-  ORGANIZATION_ID: "00000000-0000-4000-8000-00000000000a",
-  PROJECT_ID: "00000000-0000-4000-8000-00000000000b",
-  DEPLOYMENT_ID: "00000000-0000-4000-8000-00000000000c",
-  STORAGE_URL: STORAGE_TEST_URL
-};
-
 // src/simulator/hmac.ts
 var import_node_crypto = __toESM(require("crypto"));
 var TIMESTAMP_TOLERANCE_SECONDS = 300;
@@ -145,8 +153,8 @@ function json(body, status = 200) {
 function success(data) {
   return json({ success: true, data });
 }
-function failure(error, status = 400) {
-  return json({ success: false, error }, status);
+function failure(error, status = 400, code) {
+  return json({ success: false, error, ...code ? { code } : {} }, status);
 }
 async function readJsonBody(request) {
   try {
@@ -623,6 +631,12 @@ async function handleEmailSend(request) {
 var import_node_crypto3 = __toESM(require("crypto"));
 var ATTACH_LINK_KINDS = /* @__PURE__ */ new Set(["line", "facebook", "instagram", "email", "phone"]);
 var RESOLVE_KINDS = /* @__PURE__ */ new Set(["phone", "email", "line"]);
+var CLAIM_KINDS = /* @__PURE__ */ new Set(["email", "phone"]);
+var CLAIM_FLOWS = /* @__PURE__ */ new Set(["invite", "assist", "transfer"]);
+var DUPLICABLE_UNVERIFIED_KINDS = /* @__PURE__ */ new Set(["email", "phone"]);
+var CLAIM_TTL_MS = 48 * 60 * 60 * 1e3;
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var STAFF_ASSISTANCE_NOT_ENABLED = "STAFF_ASSISTANCE_NOT_ENABLED";
 var E164_PHONE = /^\+[1-9]\d{1,14}$/;
 var SEARCH_DEFAULT_LIMIT = 50;
 var SEARCH_MAX_LIMIT = 100;
@@ -705,6 +719,11 @@ function matchingLinks(kind, externalId) {
     (link) => link.kind === kind && comparableExternalId(link.kind, link.externalId) === comparable
   );
 }
+function sortedMatchingLinks(kind, externalId) {
+  return matchingLinks(kind, externalId).sort(
+    (a, b) => Number(b.verified) - Number(a.verified) || a.createdAt.localeCompare(b.createdAt) || state.identityLinks.indexOf(a) - state.identityLinks.indexOf(b)
+  );
+}
 function createPerson(displayName) {
   const createdAt = now();
   const identity = {
@@ -815,9 +834,10 @@ async function handleAttachLink(identityId, request) {
   );
   if ("error" in normalized) return failure(normalized.error);
   const { kind, externalId } = normalized;
-  const [existing] = matchingLinks(kind, externalId);
-  if (existing) {
-    if (existing.identityId === identityId) return success({ link: existing });
+  const matches = matchingLinks(kind, externalId);
+  const ownRow = matches.find((link2) => link2.identityId === identityId);
+  if (ownRow) return success({ link: ownRow });
+  if (!DUPLICABLE_UNVERIFIED_KINDS.has(kind) && matches.length > 0) {
     return failure("identifier already linked to another identity", 409);
   }
   const link = createUnverifiedLink(identityId, kind, externalId);
@@ -834,7 +854,7 @@ async function handleResolve(request) {
   if (body.displayName !== void 0 && typeof body.displayName !== "string") {
     return failure("displayName must be a string");
   }
-  const links = matchingLinks(normalized.kind, normalized.externalId);
+  const links = sortedMatchingLinks(normalized.kind, normalized.externalId);
   if (links.length > 0) {
     const canonicalIds = /* @__PURE__ */ new Set();
     for (const link of links) {
@@ -845,12 +865,15 @@ async function handleResolve(request) {
         return failure(`cannot resolve identity link: ${message}`, 409);
       }
     }
-    if (canonicalIds.size !== 1) {
+    const verifiedOwners = new Set(
+      links.filter((link) => link.verified).map((link) => link.identityId)
+    );
+    if (verifiedOwners.size > 1 || !DUPLICABLE_UNVERIFIED_KINDS.has(normalized.kind) && canonicalIds.size !== 1) {
       return failure("identifier is linked to multiple identities", 409);
     }
-    const canonicalId = [...canonicalIds][0];
-    const hasVerifiedLink = links.some((link) => link.verified);
-    if (provenance === "guest" && hasVerifiedLink) {
+    const [chosen] = links;
+    const canonicalId = canonicalIdentity(chosen.identityId).id;
+    if (provenance === "guest" && chosen.verified) {
       return success({ identityId: null, reason: "verified_conflict" });
     }
     return success({ identityId: canonicalId, created: false });
@@ -952,6 +975,116 @@ async function handleAliases(request) {
   }
   return success({ aliases });
 }
+function claimView(claim) {
+  const state_ = claim.state === "pending" && Date.parse(claim.expiresAt) <= Date.now() ? "expired" : claim.state;
+  return {
+    claimId: claim.claimId,
+    flow: claim.flow,
+    state: state_,
+    refusalReason: claim.refusalReason,
+    completedIdentityId: claim.completedIdentityId,
+    expiresAt: claim.expiresAt
+  };
+}
+function validateClaimStaff(flow, staff) {
+  if (flow === "invite") {
+    if (staff !== void 0) return { error: "staff is only accepted for assist or transfer" };
+    return { staffActorRef: null };
+  }
+  if (!staff || typeof staff !== "object") {
+    return { error: `staff is required for a ${flow} claim` };
+  }
+  const { actorRef, grant } = staff;
+  if (typeof actorRef !== "string" || actorRef.length === 0) {
+    return { error: "staff.actorRef is required" };
+  }
+  if (grant !== flow) return { error: `staff.grant must be '${flow}' for a ${flow} claim` };
+  return { staffActorRef: actorRef };
+}
+async function handleCreateClaim(request) {
+  const body = await readJsonBody(request);
+  const flow = body.flow;
+  if (typeof flow !== "string" || !CLAIM_FLOWS.has(flow)) {
+    return failure("flow must be one of: invite, assist, transfer");
+  }
+  if (typeof body.identityId !== "string" || !UUID.test(body.identityId)) {
+    return failure("identityId must be a uuid");
+  }
+  const normalized = normalizeLinkInput(
+    body.kind,
+    body.externalId,
+    CLAIM_KINDS,
+    "kind must be one of: email, phone"
+  );
+  if ("error" in normalized) return failure(normalized.error);
+  let returnTo = null;
+  if (body.returnTo !== void 0) {
+    if (typeof body.returnTo !== "string") return failure("returnTo must be a string");
+    let parsed;
+    try {
+      parsed = new URL(body.returnTo);
+    } catch {
+      return failure("returnTo must be an absolute URL");
+    }
+    returnTo = state.identityAllowedReturnOrigins.has(parsed.origin) ? body.returnTo : null;
+  }
+  if (body.deliver !== void 0 && typeof body.deliver !== "boolean") {
+    return failure("deliver must be a boolean");
+  }
+  const staff = validateClaimStaff(flow, body.staff);
+  if ("error" in staff) return failure(staff.error);
+  if (flow !== "invite" && !state.identityStaffAssistEnabled) {
+    return failure(
+      "staff-assisted profile claiming is not enabled for this project",
+      403,
+      STAFF_ASSISTANCE_NOT_ENABLED
+    );
+  }
+  const identity = state.identities.get(body.identityId);
+  if (!identity || identity.type !== "person" || identity.status !== "active") {
+    return failure("identity not found", 404);
+  }
+  const holdsContact = matchingLinks(normalized.kind, normalized.externalId).some(
+    (link) => link.identityId === identity.id
+  );
+  if (!holdsContact) {
+    return failure("identity does not hold that contact", 409);
+  }
+  const claimId = import_node_crypto3.default.randomUUID();
+  const deliver = body.deliver === true;
+  const handle = import_node_crypto3.default.randomBytes(32).toString("base64url");
+  const claim = {
+    claimId,
+    flow,
+    identityId: identity.id,
+    kind: normalized.kind,
+    externalId: normalized.externalId,
+    returnTo,
+    staffActorRef: staff.staffActorRef,
+    state: "pending",
+    refusalReason: null,
+    completedIdentityId: null,
+    claimantClerkUserId: null,
+    claimUrl: `${CONTROL_PLANE_TEST_URL}/claim/${handle}`,
+    delivered: deliver ? !state.identitySuppressClaimDelivery : null,
+    expiresAt: new Date(Date.now() + CLAIM_TTL_MS).toISOString(),
+    createdAt: now()
+  };
+  state.identityClaims.set(claimId, claim);
+  return success({
+    claimId,
+    claimUrl: claim.claimUrl,
+    expiresAt: claim.expiresAt,
+    // Absent unless asked for: an app delivering its own link must not read a
+    // missing field as "nothing was sent".
+    ...deliver ? { delivered: claim.delivered } : {}
+  });
+}
+function handleGetClaim(claimId) {
+  const claim = state.identityClaims.get(claimId);
+  if (!claim) return failure("claim not found", 404);
+  return success(claimView(claim));
+}
 async function handleIdentitiesRequest(request, subPath) {
   const method = request.method;
   if (subPath === "" || subPath === "/") {
@@ -967,6 +1100,13 @@ async function handleIdentitiesRequest(request, subPath) {
   if (subPath === "/search" && method === "GET") {
     return handleSearch(request);
   }
+  if (subPath === "/claims" && method === "POST") {
+    return handleCreateClaim(request);
+  }
+  const claimMatch = subPath.match(/^\/claims\/([^/]+)$/);
+  if (claimMatch && method === "GET") {
+    return handleGetClaim(decodeURIComponent(claimMatch[1]));
+  }
   const linksMatch = subPath.match(/^\/([^/]+)\/links$/);
   if (linksMatch && method === "POST") {
     return handleAttachLink(linksMatch[1], request);
@@ -2000,6 +2140,77 @@ async function handleEdgeRequest(request, subPath) {
   return edgeFailure(`No edge simulator for ${method} .../edge${subPath}`, 404);
 }
 
+// src/simulator/starlens.ts
+function starlensFailure(error, status, code) {
+  return json({ success: false, error, code }, status);
+}
+function nullFlagged(output, issues) {
+  const copy = JSON.parse(JSON.stringify(output ?? null));
+  for (const { path } of issues) {
+    const keys = path.replace(/^output\./, "").replace(/\[(\d+)\]/g, ".$1").split(".");
+    const last = keys.pop();
+    const parent = keys.reduce(
+      (o, k) => o != null && typeof o === "object" ? o[k] : void 0,
+      copy
+    );
+    if (parent != null && typeof parent === "object" && Object.prototype.hasOwnProperty.call(parent, last)) {
+      parent[last] = null;
+    }
+  }
+  return copy;
+}
+async function handleStarlensExtract(request, signedDeploymentId) {
+  const body = await readJsonBody(request);
+  if (signedDeploymentId !== null && body.deploymentId !== signedDeploymentId) {
+    return starlensFailure("Deployment ID mismatch", 401, "AUTHENTICATION_ERROR");
+  }
+  const inputs = Array.isArray(body.inputs) ? body.inputs : [];
+  if (inputs.length === 0) {
+    return starlensFailure(
+      "Validation failed \u2014 inputs: at least one input",
+      400,
+      "VALIDATION_ERROR"
+    );
+  }
+  const schema = body.schema;
+  if (!schema || schema.type !== "object" || typeof schema.properties !== "object") {
+    return starlensFailure(
+      "Validation failed \u2014 schema.properties is required",
+      400,
+      "VALIDATION_ERROR"
+    );
+  }
+  const call = {
+    version: typeof body.version === "string" ? body.version : "latest",
+    inputs: inputs.map((i) => ({
+      name: typeof i.filename === "string" ? i.filename : typeof i.url === "string" ? i.url : "upload",
+      mediaType: typeof i.mediaType === "string" ? i.mediaType : null,
+      source: typeof i.url === "string" ? "url" : "data"
+    })),
+    schema,
+    instructions: typeof body.instructions === "string" ? body.instructions : void 0
+  };
+  state.starlensCalls.push(call);
+  const reply = state.starlensReplies.shift() ?? state.starlensDefaultReply;
+  if (!reply) {
+    return starlensFailure(
+      "[stardeck-testing] No Starlens reply registered. Call app.starlens.mock({ output, issues }) or app.starlens.reject(reason) before the request.",
+      502,
+      "model_failed"
+    );
+  }
+  if ("reject" in reply) {
+    return starlensFailure(reply.reject, 422, "unsupported_document");
+  }
+  const issues = reply.issues ?? [];
+  return success({
+    version: call.version === "latest" ? "v1" : call.version,
+    output: nullFlagged(reply.output, issues),
+    issues,
+    usage: { inputTokens: 0, outputTokens: 0, cost: 0 }
+  });
+}
+
 // src/simulator/router.ts
 var fetchHolder = globalSingleton("fetch-holder", () => ({
   originalFetch: null
@@ -2021,7 +2232,8 @@ function requiresDeploymentHmac(request, url) {
     /^\/api\/deployments\/[^/]+\/integrations\/(slack|line|facebook)(\/.*)?$/
   );
   const edgeMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/edge(\/.*)?$/);
-  return !!(dataStoreMatch || isEmail || identitiesMatch || storeMatch || messagingMatch || edgeMatch);
+  const isStarlens = url.pathname === "/api/starlens/extract";
+  return !!(isStarlens || dataStoreMatch || isEmail || identitiesMatch || storeMatch || messagingMatch || edgeMatch);
 }
 function deploymentIdFromPath(url) {
   const match = url.pathname.match(/\/api\/deployments\/([^/]+)(?:\/|$)/);
@@ -2051,6 +2263,7 @@ async function handleSimulatedRequest(request, url) {
   );
   const edgeMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/edge(\/.*)?$/);
   const isStorageHost = url.hostname === STORAGE_TEST_HOST;
+  let signedDeploymentId = null;
   if (requiresDeploymentHmac(request, url)) {
     const authHeader = request.headers.get("X-Stardeck-Auth");
     if (!authHeader) {
@@ -2062,6 +2275,7 @@ async function handleSimulatedRequest(request, url) {
     if (!authPayload || pathDeploymentId !== null && authPayload.deploymentId !== pathDeploymentId) {
       return failure("Invalid authentication", 401);
     }
+    signedDeploymentId = authPayload.deploymentId;
   }
   if (isStorageHost) {
     return handleStorageRequest(request, url);
@@ -2082,6 +2296,9 @@ async function handleSimulatedRequest(request, url) {
   if (edgeMatch) {
     return handleEdgeRequest(request, edgeMatch[1] ?? "");
   }
+  if (url.pathname === "/api/starlens/extract" && request.method === "POST") {
+    return handleStarlensExtract(request, signedDeploymentId);
+  }
   if (dataStoreMatch) {
     const subPath = dataStoreMatch[1] ?? "";
     const db = requireDb();
@@ -2103,7 +2320,7 @@ async function handleSimulatedRequest(request, url) {
     }
   }
   return failure(
-    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, identities CRUD, payments store/checkout, storage upload/files, messaging send, edge print/display/bindings, auth verify/refresh, Neon /sql.`,
+    `[stardeck-testing] No simulator for ${request.method} ${url.pathname}. Supported: data-store query/mutate/schema, email send, identities CRUD, payments store/checkout, storage upload/files, messaging send, edge print/display/bindings, starlens extract, auth verify/refresh, Neon /sql.`,
     404
   );
 }