feat(audience): mirror server-side event validation client-side [SDK-679]

[nattb8]

Summary

Ticket: SDK-679

Brings client-side validation in @imtbl/audience and @imtbl/pixel to parity with the ingest API. Invalid calls (bad id, wrong identity type, unrecognised consent level, etc.) now throw immediately instead of dropping silently with a console warning that's easy to miss in normal development; valid calls are unaffected and still enqueue as before. The passport-ID format check already covered part of this scope (predates this PR); this closes the rest.

Gap	Before	After
alias() equality check	Only rejected when the id and identityType both matched	Throws when the ids match alone — matches the backend exactly
Empty required fields (track()'s event name, identify()'s id, alias()'s ids)	Only enforced by TypeScript's compile-time types — doesn't stop an empty string from a loosely-typed or non-TS caller	Throws at runtime
identityType/fromType/toType, consent level	Only enforced by TypeScript's compile-time types	Throws at runtime against the backend's accepted values
Queued message timestamps	Re-checked only once, when the queue restores from localStorage on page load	Re-checked before every flush attempt, so a message that goes stale while queued (offline, backoff, backgrounded tab) is dropped locally instead of sent and rejected
collectContext() fields (userAgent, pageUrl, pagePath, pageReferrer, pageTitle)	Never truncated — a long query string in pageUrl was a realistic way to get a message rejected server-side	Truncated to the backend's limits

The two rows above the divider are the ones that changed from warn-and-drop to throw. The bottom two (stale queued messages, context field truncation) have no synchronous caller to throw to — those still report via onError/truncate silently, unchanged.

Also fixed the sample app (sdk-sample-app): its own onAlias() had a duplicate pre-check hardcoding the old equality rule (id + type both had to match), and a console.warn-sniffing hack to detect a dropped identify() call. Both are gone now: the pre-check matches the current rule, and identify()/alias() failures are caught directly from the thrown error like any other SDK call.

Test plan

• nx test passes: core (278), sdk (108 + 5 CDN-artifact), pixel (51) — includes new coverage for every row above, converted from console.warn spies to expect(...).toThrow()
• nx lint passes across core, sdk, pixel
• tsc --noEmit (typecheck) passes across all three packages, including the pinned type-level invariants in sdk.test-d.ts
• nx build passes across all three packages
• Verified in a running integration (not done here)

🤖 Generated with Claude Code

[nx-cloud]

View your CI Pipeline Execution ↗ for commit e01a327

Command	Status	Duration	Result
nx affected -t build,lint,test	✅ Succeeded	7s	View ↗
nx run-many -p @imtbl/sdk,@imtbl/checkout-widge...	✅ Succeeded	3s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-07-20 06:24:53 UTC

[github-actions]

✅ Pixel Bundle Size — @imtbl/pixel

Metric	Size	Delta vs main
Gzipped	6674 bytes (6.51 KB)	+367 bytes
Raw (minified)	17922 bytes	+898 bytes

Budget: 10.00 KB gzipped (warn at 8.00 KB)

[github-actions]

⚠️ Audience Bundle Size — @imtbl/audience

Metric	Size	Delta vs main (f397e7d)
Gzipped	21110 bytes (20.61 KB)	+364 bytes
Raw (minified)	61434 bytes	+1087 bytes

Budget: 24.00 KB gzipped (warn at 20.00 KB)

⚠️ Approaching budget — gzipped size exceeds 20.00 KB warning threshold.