[imit]

Someone deleted who signs in again now gets a fresh account with a new id. This adds the admin side, mirroring the JS SDK's previousAccounts / mergeUser.

SDK

• users.previous_accounts(id) lists the user's earlier, deleted accounts, newest first. Each has id, status, created_at, deleted_at, merged_into (once merged), the number of roles and passkeys, and its MFA methods.
• users.merge(id, from:) merges one of those into the live account.
  • Roles, object roles, passkeys, MFA methods and unused backup codes move over.
  • Meta and authorization attributes merge; the live account wins where both have a value.
  • History stays on the old account.
  • It answers { "user_id", "merged", "moved" => { "roles" => n, ... } }. Merging the same account twice is an APIError with code already_merged.
• YARD docs, a README entry and a CHANGELOG line.
• Unit tests against the fake API cover listing, merging, already_merged and an unknown account.

Live suite

• Signs a test identity in, gives it a role, deletes it with the secret key, and signs in again: a new id, and the old one is 404.
• previous_accounts lists the old account with its role.
• merge moves the role over (a check now allows), the old account shows merged_into, and a second merge is already_merged.
• Someone deactivated and then deleted is refused at sign-in (403 account_deactivated).
• Both accounts are cleaned up at the end.

Results

• bundle exec rake live against scute-api-v2 v24: 78 examples, 0 failures, 1 pending. The pending one is a skip: scute-ruby has no local decision engine for the policy snapshot.
• Unit suite: 85 examples, 0 failures. RuboCop is clean.

After the run, the suite's app has no users, agents, properties or policy left, and its settings are back to their defaults.