feat: [SDK-5235] add a shared Identity Verification resolver for alias and token

[sherwinski]

Description

1 Line Summary

One resolver, src/core/executors/ivResolver.ts, decides the alias and the token for a user-addressed request under Identity Verification.

Details

Third pull request of the M3 stack for Identity Verification for Web SDK. Stacked on SDK-5234. Web mirror of Android ExecutorsIvExtensions.kt.

src/core/executors/ivResolver.ts

• IvBackendParams { alias: AliasPair; jwt?: string }. AliasPair is what every requests/api.ts function already takes, so call sites pass it through.
• resolveBackendParams(op, jwtTokenStore): alias switch plus token. The legacy values (onesignal_id alias, no token) come from a module-private helper that reads op._onesignalId. Under IV an owned operation addresses the user by external_id and carries the stored token for that user. An anonymous operation under IV logs an error and falls back to onesignal_id; the enqueue and start-up purges from M2 should keep that case out of the queue.
• resolveJwt(op, jwtTokenStore): token only, for endpoints that address a subscription by id or have no alias in the path.

Gates. The resolver gates on isIvBehaviorActive() itself. isIvBehaviorActive() implies isIvCodePathEnabled(), so a call site needs no outer gate; the resolver is a pure function of the gates and the operation. With the flag on and the requirement off (Phase 3) it returns the legacy values, so the request is identical to the legacy path. An earlier revision took onesignalId as a parameter and expected an outer gate at each call site; review dropped both. The 2 gates come from src/core/identityVerification.ts; the token store is a parameter, not a global read.

No executor uses the resolver yet. SDK-5236 wires the 6 executors. The bundle is unchanged.

Systems Affected

• WebSDK
• Backend
• Dashboard

Validation

Tests

Info

New src/core/executors/ivResolver.test.ts (10 tests), the web mirror of Android ExecutorsIvExtensionsTests.kt:

• resolveBackendParams: legacy when IV is inactive even with a stored token; legacy under Phase 3; external_id plus token when active; external_id and no token when none is stored; legacy plus an error log for an anonymous operation; the requirement alone turns IV on.
• resolveJwt: undefined when inactive even with a stored token; the stored token when active; undefined without a stored token; undefined and no log for an anonymous operation.

vp check, vp test (716 tests), and vp run build:prod pass.

Checklist

• All the automated tests pass or I explained why that is not possible
• I have personally tested this on my machine or explained why that is not possible
• I have included test coverage for these changes or explained why they are not needed

Programming Checklist
Interfaces:

• Don't use default export
• New interfaces are in model files

Functions:

• Don't use default export
• All function signatures have return types
• Helpers should not access any data but rather be given the data to operate on.

Typescript:

• No Typescript warnings
• Avoid silencing null/undefined warnings with the exclamation point

Other:

• Iteration: refrain from using elem of array syntax. Prefer forEach or use map
• Avoid using global OneSignal accessor for context if possible. Instead, we can pass it to function/constructor so that we don't call OneSignal.context

Screenshots

Info

Not needed. No user-visible change.

Checklist

• I have included screenshots/recordings of the intended results or explained why they are not needed

---

Related Tickets

• SDK-5235