feat(audience): warn and drop identify()/alias() calls with a malformed passport id

[nattb8]

Summary

Studios sometimes call identify() or alias() with identityType: 'passport' but pass their own internal user id instead of a real Passport id, and today nothing catches it, so bad data silently flows into the audience pipeline. This rejects the call (no event sent, userId untouched) and warns unconditionally (not gated behind debug) when the id doesn't match the shape Passport actually issues (connection|id or a bare UUID), so studios see the mistake immediately during local testing instead of finding it in the data warehouse later.

Test plan

• Unit tests for isPassportIdValid (core) covering valid pipe-form ids, valid UUIDs, whitespace padding, and invalid shapes
• Unit tests for identify()/alias(): malformed passport id warns and drops the call; warning fires without debug enabled; valid ids and non-passport identity types never warn
• Unit tests confirming a whitespace-padded valid passport id is stored/sent trimmed, not with the padding intact (the id that's validated and the id that's stored/sent must match)
• Sample-app UI affordance ("Fill invalid Passport ID example") and a fix so the sample app's success/drop mirroring reflects the real SDK outcome instead of always showing "ok"
• pnpm jest passes for packages/audience/core and packages/audience/sdk
• eslint passes on all changed files
• tsc --noEmit passes for packages/audience/sdk

[nx-cloud]

View your CI Pipeline Execution ↗ for commit b17e38b

Command	Status	Duration	Result
nx affected -t build,lint,test	✅ Succeeded	12s	View ↗
nx run-many -p @imtbl/sdk,@imtbl/checkout-widge...	✅ Succeeded	3s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-07-10 02:02:05 UTC

[github-actions]

✅ Audience Bundle Size — @imtbl/audience

Metric	Size	Delta vs main (3525609)
Gzipped	19783 bytes (19.31 KB)	+247 bytes
Raw (minified)	57964 bytes	+708 bytes

Budget: 24.00 KB gzipped (warn at 20.00 KB)

[github-actions]

✅ Pixel Bundle Size — @imtbl/pixel

Metric	Size	Delta vs main
Gzipped	6674 bytes (6.51 KB)	+1 bytes
Raw (minified)	18540 bytes	0 bytes

Budget: 10.00 KB gzipped (warn at 8.00 KB)

[JCSanPedro]

Something we should keep in mind, when we migrate from Auth0 -> Ory Kratos, the user id format will change. Will become UUIDs I think.

Hmm actually, probably need to consult with @brayansdt the implications of some of these things when we migrate.