@stardeck-customer-apps/testing 0.18.0 → 0.19.0

package/SKILL.md

@@ -371,7 +371,11 @@ externalId })` helper models a trusted platform/channel link, and
   back `refused` / `owned_elsewhere`. That refusal is the one a leaked bearer
   link runs into, so test it. A profile that holds an email or phone is refused
   at `create` with a 409 (send an `invite`); one that gains a contact before
-  the link is used completes as `refused` / `protected`, and a link still
+  the link is used completes as `refused` / `protected`. The same holds for a
+  profile another one was merged into (`app.identities.merge(other, target)`):
+  `create` is a 409 and an outstanding link completes as `refused` /
+  `protected`, because a bearer link hands over one visit's profile, never
+  history staff folded into it. A link still
   outstanding when `.enableBearerLinks(false)` runs completes as `refused` /
   `expired`. People seeded with only a `dashboard_user` link (team members) are
   left out of `identities.list()` and `search()`, as on the platform.

package/dist/index.js

@@ -867,6 +867,9 @@ function isCurrentTeamMember(identityId) {
 function hasRecordedContact(identityId) {
   return linksFor(identityId).some((link) => link.kind === "email" || link.kind === "phone");
 }
+function hasAbsorbedIdentity(identityId) {
+  return [...state.identities.values()].some((identity) => identity.mergedIntoId === identityId);
+}
 function handleList(request) {
   const typeParam = new URL(request.url).searchParams.get("type");
   const type = typeParam === "person" || typeParam === "account" ? typeParam : void 0;
@@ -1217,6 +1220,9 @@ function createBearerClaim(body, returnTo) {
   if (hasRecordedContact(identity.id)) {
     return failure("identity has an email or phone on record; send an invite claim instead", 409);
   }
+  if (hasAbsorbedIdentity(identity.id)) {
+    return failure("another profile was merged into this identity; reception must connect it", 409);
+  }
   return mintClaim({
     flow: "bearer",
     identityId: identity.id,
@@ -1463,7 +1469,7 @@ function completeBearerClaim(claim, clerkUserId) {
     claim.state = "invalidated";
     return claim;
   }
-  const refusal = !state.identityBearerLinksEnabled ? "expired" : hasRecordedContact(claim.identityId) ? "protected" : ownedByAnotherLogin(claim.identityId, clerkUserId) ? "owned_elsewhere" : null;
+  const refusal = !state.identityBearerLinksEnabled ? "expired" : hasRecordedContact(claim.identityId) || hasAbsorbedIdentity(claim.identityId) ? "protected" : ownedByAnotherLogin(claim.identityId, clerkUserId) ? "owned_elsewhere" : null;
   if (refusal) {
     claim.state = "refused";
     claim.refusalReason = refusal;

package/dist/index.mjs

@@ -818,6 +818,9 @@ function isCurrentTeamMember(identityId) {
 function hasRecordedContact(identityId) {
   return linksFor(identityId).some((link) => link.kind === "email" || link.kind === "phone");
 }
+function hasAbsorbedIdentity(identityId) {
+  return [...state.identities.values()].some((identity) => identity.mergedIntoId === identityId);
+}
 function handleList(request) {
   const typeParam = new URL(request.url).searchParams.get("type");
   const type = typeParam === "person" || typeParam === "account" ? typeParam : void 0;
@@ -1168,6 +1171,9 @@ function createBearerClaim(body, returnTo) {
   if (hasRecordedContact(identity.id)) {
     return failure("identity has an email or phone on record; send an invite claim instead", 409);
   }
+  if (hasAbsorbedIdentity(identity.id)) {
+    return failure("another profile was merged into this identity; reception must connect it", 409);
+  }
   return mintClaim({
     flow: "bearer",
     identityId: identity.id,
@@ -1414,7 +1420,7 @@ function completeBearerClaim(claim, clerkUserId) {
     claim.state = "invalidated";
     return claim;
   }
-  const refusal = !state.identityBearerLinksEnabled ? "expired" : hasRecordedContact(claim.identityId) ? "protected" : ownedByAnotherLogin(claim.identityId, clerkUserId) ? "owned_elsewhere" : null;
+  const refusal = !state.identityBearerLinksEnabled ? "expired" : hasRecordedContact(claim.identityId) || hasAbsorbedIdentity(claim.identityId) ? "protected" : ownedByAnotherLogin(claim.identityId, clerkUserId) ? "owned_elsewhere" : null;
   if (refusal) {
     claim.state = "refused";
     claim.refusalReason = refusal;

package/dist/setup.js

@@ -769,6 +769,9 @@ function isCurrentTeamMember(identityId) {
 function hasRecordedContact(identityId) {
   return linksFor(identityId).some((link) => link.kind === "email" || link.kind === "phone");
 }
+function hasAbsorbedIdentity(identityId) {
+  return [...state.identities.values()].some((identity) => identity.mergedIntoId === identityId);
+}
 function handleList(request) {
   const typeParam = new URL(request.url).searchParams.get("type");
   const type = typeParam === "person" || typeParam === "account" ? typeParam : void 0;
@@ -1119,6 +1122,9 @@ function createBearerClaim(body, returnTo) {
   if (hasRecordedContact(identity.id)) {
     return failure("identity has an email or phone on record; send an invite claim instead", 409);
   }
+  if (hasAbsorbedIdentity(identity.id)) {
+    return failure("another profile was merged into this identity; reception must connect it", 409);
+  }
   return mintClaim({
     flow: "bearer",
     identityId: identity.id,

package/dist/setup.mjs

@@ -745,6 +745,9 @@ function isCurrentTeamMember(identityId) {
 function hasRecordedContact(identityId) {
   return linksFor(identityId).some((link) => link.kind === "email" || link.kind === "phone");
 }
+function hasAbsorbedIdentity(identityId) {
+  return [...state.identities.values()].some((identity) => identity.mergedIntoId === identityId);
+}
 function handleList(request) {
   const typeParam = new URL(request.url).searchParams.get("type");
   const type = typeParam === "person" || typeParam === "account" ? typeParam : void 0;
@@ -1095,6 +1098,9 @@ function createBearerClaim(body, returnTo) {
   if (hasRecordedContact(identity.id)) {
     return failure("identity has an email or phone on record; send an invite claim instead", 409);
   }
+  if (hasAbsorbedIdentity(identity.id)) {
+    return failure("another profile was merged into this identity; reception must connect it", 409);
+  }
   return mintClaim({
     flow: "bearer",
     identityId: identity.id,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stardeck-customer-apps/testing",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Vitest test harness for Stardeck customer apps — in-process Postgres (PGlite) plus a control-plane simulator so the real Stardeck SDKs run unmodified in tests",
   "main": "dist/index.js",
   "module": "dist/index.mjs",