@stardeck-customer-apps/testing 0.5.1 → 0.6.1

package/SKILL.md

@@ -2,8 +2,9 @@
 
 Vitest harness for Stardeck apps. Tests run against an **in-process Postgres
 (PGlite)** and a **simulated control plane**, so the real Stardeck SDKs
-(`data-store-sdk`, `email-sdk`, `project-auth`) execute their production code
-paths with no network, no mocks to write, and full determinism.
+(`data-store-sdk`, `email-sdk`, `project-auth`, and `integrations-sdk`) execute
+their production code paths with no network, no mocks to write, and full
+determinism.
 
 ## Setup (once per project)
 
@@ -102,6 +103,34 @@ const integrations = createIntegrationsClient();
 await integrations.line.push("U123", { type: "text", text: "Your order shipped" });
 expect(app.messages.channel("line").to("U123")[0].body.text).toMatch(/shipped/i);
 
+// Guest/counter identity resolution. `provenance` is selected by this trusted
+// server route; never copy it from a browser form or request body.
+const identity = await integrations.identities.resolveOrCreate({
+  kind: "email",
+  externalId: "guest@example.com",
+  provenance: "guest",
+  displayName: "Guest",
+});
+if (identity.identityId) {
+  const identityId = identity.identityId;
+  const aliases = await integrations.identities.getAliases(identityId);
+  const aliasSet = Object.values(aliases).find((ids) => ids.includes(identityId)) ?? [identityId];
+  expect(aliasSet).toContain(identityId);
+}
+
+// A staff POS route derives `staff` only after checking an authenticated staff
+// session and permission. A guest lookup against a verified link returns the
+// safe conflict branch instead of attributing activity to that customer.
+const staffIdentity = await integrations.identities.resolveOrCreate({
+  kind: "phone",
+  externalId: "+15550100",
+  provenance: "staff",
+});
+if (staffIdentity.identityId) {
+  const page = await integrations.identities.search({ query: "15550100", limit: 10 });
+  expect(page.items.map((item) => item.id)).toContain(staffIdentity.identityId);
+}
+
 // Receipt print + display
 import { createEdgeClient } from "@stardeck-customer-apps/edge-sdk/server";
 
@@ -132,7 +161,11 @@ expect(app.edge.latestDisplay()?.action).toBe("show");
   `.to(addr)`, `.all()`, `.count`, `.clear()`.
 - `app.identities` — the platform-identity directory created through
   integrations-sdk `client.identities`: `.get(id)`, `.links(id)`, `.all()`,
-  `.count`, `.clear()`.
+  `.count`, `.clear()`. The test-only `.seedVerifiedLink(id, { kind,
+externalId })` helper models a trusted platform/channel link, and
+  `.merge(sourceId, canonicalId)` models governed merge redirects. They are
+  setup helpers only; deployed app code cannot create verified links or merge
+  identities through the integrations SDK.
 - `app.payments` — checkouts created through payments-sdk:
   `.checkouts`, `.latest()`, `.setProducts()`, `.markPaid(id)`,
   `.deliverStripeEvent(handler, event)`, `.deliverBeamEvent(handler, event)`,
@@ -180,9 +213,27 @@ describe the code, and the owner can't tell from them what is or isn't covered.
   `asUser(...)` user (header fast path) or issued session cookies.
 - `EmailClient.send()` — captured in `app.inbox`, never delivered.
 - `client.identities` from integrations-sdk (create/get/update/list accounts &
-  persons, attach channel links) — served offline by the simulated directory;
-  `update` replaces the `profile` object (not a merge), like the control plane.
-  Inspect via `app.identities`. Merge/archive are dashboard-only — not simulated.
+  persons, attach channel links, guest/staff `resolveOrCreate`, paginated
+  `search`, and batch `getAliases`) — served offline by the simulated directory.
+  `resolveOrCreate` applies the production email contract (trim + ASCII-only
+  A–Z→a–z; Turkish İ is left unchanged), requires E.164 phone values, and
+  always writes an unverified link. A guest lookup of a verified link returns
+  `{ identityId: null, reason: "verified_conflict" }`; staff provenance may
+  resolve either verified or unverified links. `attachLink` accepts only
+  channel kinds (line/facebook/instagram/email/phone); login keys must be
+  seeded via `app.identities.seedVerifiedLink`. `attachLink(..., { verified:
+true })` remains source-compatible but the simulator (like the control plane)
+  ignores that flag and returns `verified: false`. `update` replaces the
+  `profile` object (not a merge), like the control plane. Inspect via
+  `app.identities`; merge/archive are privileged setup operations, with only
+  test-only merge modeling exposed above.
+- `session.user.identityId` is the platform-provisioned cross-app customer key.
+  `session.user.id` is the platform login key; it is not the key for customer
+  data. The simulator round-trips `identityId` through issued sessions while
+  preserving older users that omit it or set it to `null`.
+- For merge-correct reads, request aliases in batches and include every id in
+  the returned canonical set. Page directory UIs through `search({ query,
+cursor, limit })`; `list()` intentionally keeps its previous array shape.
 - `PaymentsServerClient` (Stripe checkout + Beam payment links, product list) —
   captured in `app.payments`; fulfill via `markPaid` (poll) or
   `deliverStripeEvent` / `deliverBeamEvent` (webhook push).

package/dist/index.d.mts

@@ -34,6 +34,8 @@ interface TestUser {
     permissions?: string[];
     organizationId?: string | null;
     projectId?: string | null;
+    /** Cross-app customer ownership key returned by the platform identity resolver. */
+    identityId?: string | null;
 }
 interface CapturedEmail {
     resendId: string;
@@ -103,6 +105,20 @@ interface TestDirectory {
     get(id: string): CapturedIdentity | undefined;
     /** Channel/login links attached to an identity. */
     links(identityId: string): CapturedIdentityLink[];
+    /**
+     * Test setup only: seed a platform-verified link. Deployment SDK writes are
+     * intentionally unverified; this helper models a trusted control-plane or
+     * channel source so guest conflict and adoption tests can be deterministic.
+     */
+    seedVerifiedLink(identityId: string, params: {
+        kind: string;
+        externalId: string;
+    }): CapturedIdentityLink;
+    /**
+     * Test setup only: govern a merge from one identity into an active canonical
+     * identity. The production integrations SDK does not expose merge operations.
+     */
+    merge(sourceIdentityId: string, canonicalIdentityId: string): void;
     clear(): void;
     get count(): number;
 }

package/dist/index.d.ts

@@ -34,6 +34,8 @@ interface TestUser {
     permissions?: string[];
     organizationId?: string | null;
     projectId?: string | null;
+    /** Cross-app customer ownership key returned by the platform identity resolver. */
+    identityId?: string | null;
 }
 interface CapturedEmail {
     resendId: string;
@@ -103,6 +105,20 @@ interface TestDirectory {
     get(id: string): CapturedIdentity | undefined;
     /** Channel/login links attached to an identity. */
     links(identityId: string): CapturedIdentityLink[];
+    /**
+     * Test setup only: seed a platform-verified link. Deployment SDK writes are
+     * intentionally unverified; this helper models a trusted control-plane or
+     * channel source so guest conflict and adoption tests can be deterministic.
+     */
+    seedVerifiedLink(identityId: string, params: {
+        kind: string;
+        externalId: string;
+    }): CapturedIdentityLink;
+    /**
+     * Test setup only: govern a merge from one identity into an active canonical
+     * identity. The production integrations SDK does not expose merge operations.
+     */
+    merge(sourceIdentityId: string, canonicalIdentityId: string): void;
     clear(): void;
     get count(): number;
 }

package/dist/index.js

@@ -155,6 +155,14 @@ var DEFAULT_SCHEMA_PATH = "./src/generated/data-store-schema.sql";
 // src/simulator/hmac.ts
 var import_node_crypto = __toESM(require("crypto"));
 var TIMESTAMP_TOLERANCE_SECONDS = 300;
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function isDeploymentAuthPayload(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const payload = value;
+  return payload.type === "deployment-request" && isNonEmptyString(payload.organizationId) && isNonEmptyString(payload.projectId) && isNonEmptyString(payload.deploymentId) && typeof payload.timestamp === "number" && Number.isSafeInteger(payload.timestamp) && isNonEmptyString(payload.nonce);
+}
 function verifyDeploymentAuthHeader(secret, header) {
   const dotIndex = header.lastIndexOf(".");
   if (dotIndex === -1) return null;
@@ -172,16 +180,16 @@ function verifyDeploymentAuthHeader(secret, header) {
   if (expectedBuf.length !== actualBuf.length || !import_node_crypto.default.timingSafeEqual(expectedBuf, actualBuf)) {
     return null;
   }
-  let payload;
+  let parsed;
   try {
-    payload = JSON.parse(payloadJson);
+    parsed = JSON.parse(payloadJson);
   } catch {
     return null;
   }
-  if (payload.type !== "deployment-request") return null;
+  if (!isDeploymentAuthPayload(parsed)) return null;
   const now3 = Math.floor(Date.now() / 1e3);
-  if (Math.abs(now3 - payload.timestamp) > TIMESTAMP_TOLERANCE_SECONDS) return null;
-  return payload;
+  if (Math.abs(now3 - parsed.timestamp) > TIMESTAMP_TOLERANCE_SECONDS) return null;
+  return parsed;
 }
 
 // src/simulator/http.ts
@@ -671,7 +679,8 @@ function createInbox() {
 
 // src/simulator/identities.ts
 var import_node_crypto3 = __toESM(require("crypto"));
-var LINK_KINDS = /* @__PURE__ */ new Set([
+var ATTACH_LINK_KINDS = /* @__PURE__ */ new Set(["line", "facebook", "instagram", "email", "phone"]);
+var TRUSTED_LINK_KINDS = /* @__PURE__ */ new Set([
   "line",
   "facebook",
   "instagram",
@@ -680,16 +689,130 @@ var LINK_KINDS = /* @__PURE__ */ new Set([
   "project_auth_user",
   "dashboard_user"
 ]);
+var RESOLVE_KINDS = /* @__PURE__ */ new Set(["phone", "email", "line"]);
+var E164_PHONE = /^\+[1-9]\d{1,14}$/;
+var SEARCH_DEFAULT_LIMIT = 50;
+var SEARCH_MAX_LIMIT = 100;
+function asciiLowercaseTrim(value) {
+  const trimmed = value.trim();
+  let out = "";
+  for (let i = 0; i < trimmed.length; i++) {
+    const code = trimmed.charCodeAt(i);
+    out += code >= 65 && code <= 90 ? String.fromCharCode(code + 32) : trimmed[i];
+  }
+  return out;
+}
+var IdentityGraphError = class extends Error {
+};
 function now() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 function linksFor(identityId) {
   return state.identityLinks.filter((l) => l.identityId === identityId);
 }
+function comparableExternalId(kind, externalId) {
+  if (kind === "email") return asciiLowercaseTrim(externalId);
+  return externalId;
+}
+function normalizeExternalId(kind, externalId) {
+  if (kind === "email") {
+    const normalized = asciiLowercaseTrim(externalId);
+    return normalized.length > 0 ? { externalId: normalized } : { error: "externalId is required" };
+  }
+  if (kind === "phone" && !E164_PHONE.test(externalId)) {
+    return { error: "phone externalId must be an E.164 number" };
+  }
+  return { externalId };
+}
+function normalizeLinkInput(kind, externalId, allowedKinds, kindError) {
+  if (typeof kind !== "string" || !allowedKinds.has(kind)) {
+    return { error: kindError };
+  }
+  if (typeof externalId !== "string" || externalId.length === 0) {
+    return { error: "externalId is required" };
+  }
+  const normalized = normalizeExternalId(kind, externalId);
+  if ("error" in normalized) return normalized;
+  return { kind, externalId: normalized.externalId };
+}
+function normalizeResolveInput(kind, externalId) {
+  const normalized = normalizeLinkInput(
+    kind,
+    externalId,
+    RESOLVE_KINDS,
+    "kind must be one of: phone, email, line"
+  );
+  if ("error" in normalized) return normalized;
+  return { kind: normalized.kind, externalId: normalized.externalId };
+}
+function canonicalIdentity(identityId) {
+  const visited = /* @__PURE__ */ new Set();
+  let identity = state.identities.get(identityId);
+  while (identity) {
+    if (visited.has(identity.id)) {
+      throw new IdentityGraphError("identity merge chain contains a cycle");
+    }
+    visited.add(identity.id);
+    if (identity.status === "archived") {
+      throw new IdentityGraphError("identity is archived");
+    }
+    if (identity.status === "active" && !identity.mergedIntoId) {
+      return identity;
+    }
+    if (!identity.mergedIntoId) {
+      throw new IdentityGraphError("identity merge chain has no active canonical target");
+    }
+    identity = state.identities.get(identity.mergedIntoId);
+  }
+  throw new IdentityGraphError("identity merge chain references a missing identity");
+}
+function matchingLinks(kind, externalId) {
+  const comparable = comparableExternalId(kind, externalId);
+  return state.identityLinks.filter(
+    (link) => link.kind === kind && comparableExternalId(link.kind, link.externalId) === comparable
+  );
+}
+function normalizedLinkKey(link) {
+  return `${link.kind}:${comparableExternalId(link.kind, link.externalId)}`;
+}
+function createPerson(displayName) {
+  const createdAt = now();
+  const identity = {
+    id: import_node_crypto3.default.randomUUID(),
+    type: "person",
+    parentId: null,
+    displayName,
+    profile: {},
+    status: "active",
+    mergedIntoId: null,
+    externalRef: null,
+    createdAt,
+    updatedAt: createdAt
+  };
+  state.identities.set(identity.id, identity);
+  return identity;
+}
+function createUnverifiedLink(identityId, kind, externalId) {
+  const link = {
+    id: import_node_crypto3.default.randomUUID(),
+    identityId,
+    kind,
+    externalId,
+    // Deployment credentials can attest provenance, but cannot manufacture a
+    // platform-verified fact. Trusted channel/control-plane setup uses the
+    // directory's test-only seedVerifiedLink helper instead.
+    verified: false,
+    createdAt: now()
+  };
+  state.identityLinks.push(link);
+  return link;
+}
 function handleList(request) {
   const typeParam = new URL(request.url).searchParams.get("type");
   const type = typeParam === "person" || typeParam === "account" ? typeParam : void 0;
-  const identities = [...state.identities.values()];
+  const identities = [...state.identities.values()].filter(
+    (identity) => identity.status !== "merged"
+  );
   return success({ identities: type ? identities.filter((i) => i.type === type) : identities });
 }
 async function handleCreate(request) {
@@ -707,6 +830,7 @@ async function handleCreate(request) {
     }
     parentId = parent.id;
   }
+  const createdAt = now();
   const identity = {
     id: import_node_crypto3.default.randomUUID(),
     type,
@@ -716,8 +840,8 @@ async function handleCreate(request) {
     status: "active",
     mergedIntoId: null,
     externalRef: body.externalRef ?? null,
-    createdAt: now(),
-    updatedAt: now()
+    createdAt,
+    updatedAt: createdAt
   };
   state.identities.set(identity.id, identity);
   return success({ identity });
@@ -753,36 +877,166 @@ async function handleAttachLink(identityId, request) {
     return failure("links attach only to active persons");
   }
   const body = await readJsonBody(request);
-  const kind = body.kind;
-  const externalId = body.externalId;
-  if (typeof kind !== "string" || !LINK_KINDS.has(kind)) {
-    return failure(`kind must be one of: ${[...LINK_KINDS].join(", ")}`);
-  }
-  if (typeof externalId !== "string" || !externalId) {
-    return failure("externalId is required");
-  }
-  const existing = state.identityLinks.find((l) => l.kind === kind && l.externalId === externalId);
+  const normalized = normalizeLinkInput(
+    body.kind,
+    body.externalId,
+    ATTACH_LINK_KINDS,
+    `kind must be one of: ${[...ATTACH_LINK_KINDS].join(", ")}`
+  );
+  if ("error" in normalized) return failure(normalized.error);
+  const { kind, externalId } = normalized;
+  const [existing] = matchingLinks(kind, externalId);
   if (existing) {
     if (existing.identityId === identityId) return success({ link: existing });
     return failure("identifier already linked to another identity", 409);
   }
-  const link = {
-    id: import_node_crypto3.default.randomUUID(),
-    identityId,
-    kind,
-    externalId,
-    verified: body.verified === true,
-    createdAt: now()
-  };
-  state.identityLinks.push(link);
+  const link = createUnverifiedLink(identityId, kind, externalId);
   return success({ link });
 }
+async function handleResolve(request) {
+  const body = await readJsonBody(request);
+  const normalized = normalizeResolveInput(body.kind, body.externalId);
+  if ("error" in normalized) return failure(normalized.error);
+  const provenance = body.provenance;
+  if (provenance !== "guest" && provenance !== "staff") {
+    return failure("provenance must be 'guest' or 'staff'");
+  }
+  if (body.displayName !== void 0 && typeof body.displayName !== "string") {
+    return failure("displayName must be a string");
+  }
+  const links = matchingLinks(normalized.kind, normalized.externalId);
+  if (links.length > 0) {
+    const canonicalIds = /* @__PURE__ */ new Set();
+    for (const link of links) {
+      try {
+        canonicalIds.add(canonicalIdentity(link.identityId).id);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "invalid identity merge chain";
+        return failure(`cannot resolve identity link: ${message}`, 409);
+      }
+    }
+    if (canonicalIds.size !== 1) {
+      return failure("identifier is linked to multiple identities", 409);
+    }
+    const canonicalId = [...canonicalIds][0];
+    const hasVerifiedLink = links.some((link) => link.verified);
+    if (provenance === "guest" && hasVerifiedLink) {
+      return success({ identityId: null, reason: "verified_conflict" });
+    }
+    return success({ identityId: canonicalId, created: false });
+  }
+  const displayName = body.displayName ?? null;
+  const identity = createPerson(displayName);
+  createUnverifiedLink(identity.id, normalized.kind, normalized.externalId);
+  return success({ identityId: identity.id, created: true });
+}
+function encodeSearchCursor(cursor) {
+  return Buffer.from(JSON.stringify(cursor), "utf8").toString("base64url");
+}
+function decodeSearchCursor(raw, query) {
+  try {
+    const rawParsed = JSON.parse(Buffer.from(raw, "base64url").toString("utf8"));
+    if (!rawParsed || typeof rawParsed !== "object" || Array.isArray(rawParsed)) return null;
+    const parsed = rawParsed;
+    if (typeof parsed.createdAt !== "string" || typeof parsed.id !== "string" || typeof parsed.query !== "string" || parsed.query !== query) {
+      return null;
+    }
+    return { createdAt: parsed.createdAt, id: parsed.id, query: parsed.query };
+  } catch {
+    return null;
+  }
+}
+function compareIdentityOrder(left, right) {
+  const byCreatedAt = left.createdAt.localeCompare(right.createdAt);
+  return byCreatedAt !== 0 ? byCreatedAt : left.id.localeCompare(right.id);
+}
+function identityMatchesQuery(identity, query) {
+  if (!query) return true;
+  if (identity.displayName?.toLowerCase().includes(query)) return true;
+  return state.identityLinks.some(
+    (link) => link.identityId === identity.id && comparableExternalId(link.kind, link.externalId).toLowerCase().includes(query)
+  );
+}
+function handleSearch(request) {
+  const url = new URL(request.url);
+  const query = (url.searchParams.get("query") ?? "").trim().toLowerCase();
+  const rawLimit = url.searchParams.get("limit");
+  let limit = SEARCH_DEFAULT_LIMIT;
+  if (rawLimit !== null) {
+    if (!/^\d+$/.test(rawLimit)) return failure("limit must be a positive integer");
+    limit = Number(rawLimit);
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > SEARCH_MAX_LIMIT) {
+      return failure(`limit must be between 1 and ${SEARCH_MAX_LIMIT}`);
+    }
+  }
+  const rawCursor = url.searchParams.get("cursor");
+  const cursor = rawCursor ? decodeSearchCursor(rawCursor, query) : null;
+  if (rawCursor && !cursor) return failure("cursor is invalid");
+  const identities = [...state.identities.values()].filter((identity) => identity.status === "active" && identity.mergedIntoId === null).filter((identity) => identityMatchesQuery(identity, query)).sort(compareIdentityOrder);
+  const start = cursor ? identities.findIndex((identity) => compareIdentityOrder(identity, cursor) > 0) : 0;
+  const pageStart = start < 0 ? identities.length : start;
+  const items = identities.slice(pageStart, pageStart + limit);
+  const hasMore = pageStart + items.length < identities.length;
+  const nextCursor = hasMore ? encodeSearchCursor({
+    createdAt: items[items.length - 1].createdAt,
+    id: items[items.length - 1].id,
+    query
+  }) : null;
+  return success({ items, nextCursor });
+}
+function aliasesForCanonical(canonicalId) {
+  const aliases = [canonicalId];
+  for (const identity of state.identities.values()) {
+    if (identity.id === canonicalId || identity.status !== "merged") continue;
+    try {
+      if (canonicalIdentity(identity.id).id === canonicalId) aliases.push(identity.id);
+    } catch {
+    }
+  }
+  return aliases;
+}
+async function handleAliases(request) {
+  const body = await readJsonBody(request);
+  if (!Array.isArray(body.identityIds)) {
+    return failure("identityIds must be an array");
+  }
+  if (body.identityIds.length === 0) {
+    return failure("identityIds must not be empty");
+  }
+  if (body.identityIds.length > 200) {
+    return failure("A maximum of 200 identity ids may be requested");
+  }
+  if (body.identityIds.some((identityId) => typeof identityId !== "string" || identityId.length === 0)) {
+    return failure("identityIds must contain non-empty strings");
+  }
+  const aliases = {};
+  for (const identityId of body.identityIds) {
+    let canonical;
+    try {
+      canonical = canonicalIdentity(identityId);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "invalid identity merge chain";
+      return failure(`cannot expand identity aliases: ${message}`, 409);
+    }
+    aliases[canonical.id] ??= aliasesForCanonical(canonical.id);
+  }
+  return success({ aliases });
+}
 async function handleIdentitiesRequest(request, subPath) {
   const method = request.method;
   if (subPath === "" || subPath === "/") {
     if (method === "GET") return handleList(request);
     if (method === "POST") return handleCreate(request);
   }
+  if (subPath === "/resolve" && method === "POST") {
+    return handleResolve(request);
+  }
+  if (subPath === "/aliases" && method === "POST") {
+    return handleAliases(request);
+  }
+  if (subPath === "/search" && method === "GET") {
+    return handleSearch(request);
+  }
   const linksMatch = subPath.match(/^\/([^/]+)\/links$/);
   if (linksMatch && method === "POST") {
     return handleAttachLink(linksMatch[1], request);
@@ -794,11 +1048,87 @@ async function handleIdentitiesRequest(request, subPath) {
   }
   return failure(`No identities simulator for ${method} .../identities${subPath}`, 404);
 }
+function seedVerifiedLink(identityId, params) {
+  const identity = state.identities.get(identityId);
+  if (!identity) throw new Error("identity not found");
+  if (identity.type !== "person") throw new Error("verified links attach only to persons");
+  if (identity.status !== "active") throw new Error("verified links attach only to active persons");
+  const normalized = normalizeLinkInput(
+    params.kind,
+    params.externalId,
+    TRUSTED_LINK_KINDS,
+    "unknown identity link kind"
+  );
+  if ("error" in normalized) throw new Error(normalized.error);
+  const { kind, externalId } = normalized;
+  const [existing] = matchingLinks(kind, externalId);
+  if (existing) {
+    if (existing.identityId !== identityId) {
+      throw new Error("identifier already linked to another identity");
+    }
+    existing.verified = true;
+    return existing;
+  }
+  const link = createUnverifiedLink(identityId, kind, externalId);
+  link.verified = true;
+  return link;
+}
+function merge(sourceIdentityId, canonicalIdentityId) {
+  const source = state.identities.get(sourceIdentityId);
+  if (!source) throw new Error("source identity not found");
+  if (source.status !== "active" || source.mergedIntoId !== null) {
+    throw new Error("source identity must be active and unmerged");
+  }
+  const canonical = state.identities.get(canonicalIdentityId);
+  if (!canonical) throw new Error("canonical identity not found");
+  if (canonical.status !== "active" || canonical.mergedIntoId !== null) {
+    throw new Error("canonical identity must be active and unmerged");
+  }
+  if (source.type !== canonical.type) {
+    throw new Error("identities must have the same type");
+  }
+  if (source.id === canonical.id) throw new Error("an identity cannot merge into itself");
+  const sourceLinks = state.identityLinks.filter((link) => link.identityId === source.id);
+  const canonicalLinks = state.identityLinks.filter((link) => link.identityId === canonical.id);
+  const otherLinks = state.identityLinks.filter(
+    (link) => link.identityId !== source.id && link.identityId !== canonical.id
+  );
+  for (const sourceLink of sourceLinks) {
+    const key = normalizedLinkKey(sourceLink);
+    if (otherLinks.some((otherLink) => normalizedLinkKey(otherLink) === key)) {
+      throw new Error("merge would conflict with a link owned by another identity");
+    }
+  }
+  const linksByKey = /* @__PURE__ */ new Map();
+  for (const canonicalLink of canonicalLinks) {
+    linksByKey.set(normalizedLinkKey(canonicalLink), canonicalLink);
+  }
+  const droppedSourceLinks = /* @__PURE__ */ new Set();
+  for (const sourceLink of sourceLinks) {
+    const key = normalizedLinkKey(sourceLink);
+    const existing = linksByKey.get(key);
+    if (existing) {
+      existing.verified = existing.verified || sourceLink.verified;
+      droppedSourceLinks.add(sourceLink);
+      continue;
+    }
+    sourceLink.identityId = canonical.id;
+    linksByKey.set(key, sourceLink);
+  }
+  if (droppedSourceLinks.size > 0) {
+    state.identityLinks = state.identityLinks.filter((link) => !droppedSourceLinks.has(link));
+  }
+  source.status = "merged";
+  source.mergedIntoId = canonical.id;
+  source.updatedAt = now();
+}
 function createDirectory() {
   return {
     all: () => [...state.identities.values()],
     get: (id) => state.identities.get(id),
     links: (identityId) => linksFor(identityId),
+    seedVerifiedLink,
+    merge,
     clear: () => {
       state.identities.clear();
       state.identityLinks = [];
@@ -1723,13 +2053,24 @@ function requiresDeploymentHmac(request, url) {
   const edgeMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/edge(\/.*)?$/);
   return !!(dataStoreMatch || isEmail || identitiesMatch || storeMatch || messagingMatch || edgeMatch);
 }
+function deploymentIdFromPath(url) {
+  const match = url.pathname.match(/\/api\/deployments\/([^/]+)(?:\/|$)/);
+  if (!match) return null;
+  try {
+    return decodeURIComponent(match[1]);
+  } catch {
+    return match[1];
+  }
+}
 async function handleSimulatedRequest(request, url) {
   if (url.pathname === "/sql") {
     return handleNeonSql(requireDb(), request);
   }
-  const authMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/auth\/(verify|refresh)$/);
+  const authMatch = url.pathname.match(
+    /^\/api\/deployments\/[^/]+\/auth\/(v2\/verify|verify|refresh)$/
+  );
   if (authMatch) {
-    return authMatch[1] === "verify" ? handleAuthVerify(request) : handleAuthRefresh(request);
+    return authMatch[1].endsWith("verify") ? handleAuthVerify(request) : handleAuthRefresh(request);
   }
   const dataStoreMatch = url.pathname.match(/^\/api\/data-stores\/[^/]+(\/.*)?$/);
   const isEmail = url.pathname === "/api/email/send";
@@ -1746,7 +2087,9 @@ async function handleSimulatedRequest(request, url) {
       return failure("Missing authentication header", 401);
     }
     const secret = process.env.DEPLOYMENT_SECRET;
-    if (!secret || !verifyDeploymentAuthHeader(secret, authHeader)) {
+    const authPayload = secret ? verifyDeploymentAuthHeader(secret, authHeader) : null;
+    const pathDeploymentId = deploymentIdFromPath(url);
+    if (!authPayload || pathDeploymentId !== null && authPayload.deploymentId !== pathDeploymentId) {
       return failure("Invalid authentication", 401);
     }
   }