@arcblock/did-connect-service 4.1.21 → 4.1.23

package/dist/store/account-merge.d.ts

@@ -0,0 +1,167 @@
+/**
+ * Account-merge store operations (#149). Writers flatten aliases and keep
+ * the higher `roleLevel()` membership per instance. Callers pass a D1
+ * database; D1Store wraps these and invalidates membership cache.
+ */
+export declare const MERGE_START_TTL_SECONDS: number;
+export declare const MERGE_INTENT_TTL_MS: number;
+export declare const MERGE_START_CACHE_PREFIX = "merge-start:";
+/** Refuse a single merge batch that would monopolize D1 (#174). */
+export declare const MERGE_BATCH_MAX_STATEMENTS = 800;
+/** Fixed statements in every merge batch: alias insert, flatten, revoke A, revoke B, mark A, bump B. */
+export declare const MERGE_BATCH_FIXED_STATEMENTS = 6;
+export declare const MERGE_TOO_LARGE_ERROR = "Merge touches too many rows; split the accounts or handle this merge manually";
+/** Stable host-side warning codes. User copy lives in i18n.ts (#189). */
+export declare const MERGE_HOST_WARNINGS: readonly ["blocklet-owner-clash", "external-token-rebind"];
+export type MergeHostWarningCode = (typeof MERGE_HOST_WARNINGS)[number];
+export interface MergeCredential {
+    did: string;
+    provider: string;
+    id: string | null;
+}
+export interface MergeSkippedConflict extends MergeCredential {
+    reason: string;
+}
+export interface MergeMovedMembership {
+    instanceDid: string;
+    role: string;
+    invitedBy: string | null;
+    createdAt: string | null;
+    createdBy: string | null;
+}
+export interface MergeMergedMembership {
+    instanceDid: string;
+    fromRole: string;
+    intoRoleBefore: string;
+    keptRole: string;
+    fromRow: MergeMovedMembership;
+}
+export interface MergeAccessKey {
+    accessKeyId: string;
+    createdBy: string;
+}
+export interface MergeAliasCreated {
+    did: string;
+    canonicalDid: string;
+    reason: "merged";
+}
+export interface MergeAliasRewritten {
+    did: string;
+    fromCanonicalDid: string;
+    toCanonicalDid: string;
+}
+export interface MergeIntoRole {
+    instanceDid: string;
+    role: string;
+}
+export interface MergeSnapshot {
+    fromDid: string;
+    intoDid: string;
+    credentials: MergeCredential[];
+    skippedConflicts: MergeSkippedConflict[];
+    memberships: {
+        moved: MergeMovedMembership[];
+        merged: MergeMergedMembership[];
+    };
+    accessKeys: MergeAccessKey[];
+    aliasesCreated: MergeAliasCreated[];
+    aliasesRewritten: MergeAliasRewritten[];
+    intoPreMergeRoles: MergeIntoRole[];
+    didSpace: {
+        copied: false;
+        pointer: string;
+    };
+    hostWarnings: MergeHostWarningCode[];
+    fromPrimaryCredentialDid: string | null;
+    fromPasskeyCount: number;
+    intoPasskeyCount: number;
+    movedPasskeyCount: number;
+}
+export interface MergeIntentRow {
+    tokenHash: string;
+    fromDid: string;
+    intoDid: string;
+    expiresAt: string;
+    usedAt: string | null;
+}
+export interface MergePlanView {
+    fromDid: string;
+    intoDid: string;
+    credentials: MergeCredential[];
+    skippedConflicts: MergeSkippedConflict[];
+    memberships: MergeSnapshot["memberships"];
+    accessKeys: MergeAccessKey[];
+    aliasesCreated: MergeAliasCreated[];
+    aliasesRewritten: MergeAliasRewritten[];
+    intoPreMergeRoles: MergeIntoRole[];
+    didSpace: {
+        copied: false;
+        pointer: string;
+    };
+    hostWarnings: MergeHostWarningCode[];
+}
+/**
+ * Dry-run payload for the confirm page (#189). Counts + provider/role lists;
+ * no credential id, instanceDid, or accessKeyId (#176).
+ */
+export interface MergeConfirmPlan {
+    fromDid: string;
+    intoDid: string;
+    credentialCount: number;
+    credentialsByProvider: Array<{
+        provider: string;
+    }>;
+    skippedConflictCount: number;
+    skippedConflicts: Array<{
+        provider: string;
+        reason: string;
+    }>;
+    membershipMovedCount: number;
+    membershipMergedCount: number;
+    membershipChanges: Array<{
+        fromRole: string;
+        intoRoleBefore: string;
+        keptRole: string;
+    }>;
+    accessKeyCount: number;
+    aliasCreatedCount: number;
+    aliasRewrittenCount: number;
+    didSpace: {
+        copied: false;
+        pointer: string;
+    };
+    hostWarningCodes: MergeHostWarningCode[];
+    tooLarge: boolean;
+}
+export declare function mergeStartCacheKey(tokenHash: string): string;
+export declare function didSpacePointer(fromDid: string): string;
+export declare function higherRole(a: string, b: string): string;
+export declare function createMergeStartChallenge(): Promise<{
+    challenge: string;
+    tokenHash: string;
+    expiresAt: string;
+}>;
+export declare function createMergeIntentToken(): Promise<{
+    token: string;
+    tokenHash: string;
+    expiresAt: string;
+}>;
+export declare function hashMergeToken(token: string): Promise<string>;
+export declare function insertMergeIntent(db: D1Database, input: {
+    tokenHash: string;
+    fromDid: string;
+    intoDid: string;
+    expiresAt: string;
+}): Promise<void>;
+export declare function getMergeIntentByHash(db: D1Database, tokenHash: string): Promise<MergeIntentRow | null>;
+export declare function intentIsUsable(intent: MergeIntentRow, now?: number): "ok" | "used" | "expired";
+export declare function consumeMergeIntent(db: D1Database, tokenHash: string, usedAt: string): Promise<boolean>;
+export declare function buildMergeSnapshot(db: D1Database, fromDid: string, intoDid: string): Promise<MergeSnapshot>;
+export declare function toMergePlanView(snapshot: MergeSnapshot): MergePlanView;
+export declare function willMovePrimaryCredential(snapshot: MergeSnapshot): boolean;
+/** Same formula `commitMergeBatch` uses to size the D1 batch (#189). */
+export declare function countMergeStatements(snapshot: MergeSnapshot): number;
+export declare function toMergeConfirmPlan(snapshot: MergeSnapshot): MergeConfirmPlan;
+export declare function commitMergeBatch(db: D1Database, snapshot: MergeSnapshot, now: string): Promise<void>;
+export declare function hashSnapshot(snapshot: MergeSnapshot): Promise<string>;
+//# sourceMappingURL=account-merge.d.ts.map

package/dist/store/account-merge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-merge.d.ts","sourceRoot":"","sources":["../../src/store/account-merge.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,eAAO,MAAM,uBAAuB,QAAU,CAAC;AAC/C,eAAO,MAAM,mBAAmB,QAAiB,CAAC;AAClD,eAAO,MAAM,wBAAwB,iBAAiB,CAAC;AACvD,mEAAmE;AACnE,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,wGAAwG;AACxG,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,eAAO,MAAM,qBAAqB,kFAC+C,CAAC;AAElF,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,4DAA6D,CAAC;AAC9F,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IAC3D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;IACzC,WAAW,EAAE;QACX,KAAK,EAAE,oBAAoB,EAAE,CAAC;QAC9B,MAAM,EAAE,qBAAqB,EAAE,CAAC;KACjC,CAAC;IACF,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,cAAc,EAAE,iBAAiB,EAAE,CAAC;IACpC,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;IACxC,iBAAiB,EAAE,aAAa,EAAE,CAAC;IACnC,QAAQ,EAAE;QAAE,MAAM,EAAE,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;IACzC,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC1C,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,cAAc,EAAE,iBAAiB,EAAE,CAAC;IACpC,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;IACxC,iBAAiB,EAAE,aAAa,EAAE,CAAC;IACnC,QAAQ,EAAE;QAAE,MAAM,EAAE,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,YAAY,EAAE,oBAAoB,EAAE,CAAC;CACtC;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iBAAiB,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE;QAAE,MAAM,EAAE,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;IACzC,QAAQ,EAAE,OAAO,CAAC;CACnB;AAwBD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,wBAAsB,yBAAyB,IAAI,OAAO,CAAC;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAKD;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAK/G;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,UAAU,EACd,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAChF,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,UAAU,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAOhC;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,SAAa,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAIlG;AAED,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAa5G;AAoCD,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAiGjH;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,GAAG,aAAa,CActE;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAK1E;AAED,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CASpE;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,aAAa,GAAG,gBAAgB,CAyB5E;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,aAAa,EACvB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CA8Ff;AAED,wBAAsB,YAAY,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3E"}

package/dist/store/account-merge.js

@@ -0,0 +1,313 @@
+/**
+ * Account-merge store operations (#149). Writers flatten aliases and keep
+ * the higher `roleLevel()` membership per instance. Callers pass a D1
+ * database; D1Store wraps these and invalidates membership cache.
+ */
+import { roleLevel } from "../access/rbac.js";
+import { hashRefreshToken } from "../identity/refresh-tokens.js";
+const FLATTEN_DID_ALIASES_SQL = "UPDATE cs_did_aliases SET canonicalDid = ? WHERE canonicalDid = ?";
+export const MERGE_START_TTL_SECONDS = 10 * 60;
+export const MERGE_INTENT_TTL_MS = 10 * 60 * 1000;
+export const MERGE_START_CACHE_PREFIX = "merge-start:";
+/** Refuse a single merge batch that would monopolize D1 (#174). */
+export const MERGE_BATCH_MAX_STATEMENTS = 800;
+/** Fixed statements in every merge batch: alias insert, flatten, revoke A, revoke B, mark A, bump B. */
+export const MERGE_BATCH_FIXED_STATEMENTS = 6;
+export const MERGE_TOO_LARGE_ERROR = "Merge touches too many rows; split the accounts or handle this merge manually";
+/** Stable host-side warning codes. User copy lives in i18n.ts (#189). */
+export const MERGE_HOST_WARNINGS = ["blocklet-owner-clash", "external-token-rebind"];
+function randomToken() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+export function mergeStartCacheKey(tokenHash) {
+    return `${MERGE_START_CACHE_PREFIX}${tokenHash}`;
+}
+export function didSpacePointer(fromDid) {
+    return `/user/.archive/${fromDid}/`;
+}
+export function higherRole(a, b) {
+    return roleLevel(a) >= roleLevel(b) ? a : b;
+}
+export async function createMergeStartChallenge() {
+    const challenge = randomToken();
+    const tokenHash = await hashRefreshToken(challenge);
+    const expiresAt = new Date(Date.now() + MERGE_START_TTL_SECONDS * 1000).toISOString();
+    return { challenge, tokenHash, expiresAt };
+}
+export async function createMergeIntentToken() {
+    const token = randomToken();
+    const tokenHash = await hashRefreshToken(token);
+    const expiresAt = new Date(Date.now() + MERGE_INTENT_TTL_MS).toISOString();
+    return { token, tokenHash, expiresAt };
+}
+export async function hashMergeToken(token) {
+    return hashRefreshToken(token);
+}
+export async function insertMergeIntent(db, input) {
+    await db
+        .prepare(`INSERT INTO cs_merge_intents (tokenHash, fromDid, intoDid, expiresAt, usedAt)
+       VALUES (?, ?, ?, ?, NULL)`)
+        .bind(input.tokenHash, input.fromDid, input.intoDid, input.expiresAt)
+        .run();
+}
+export async function getMergeIntentByHash(db, tokenHash) {
+    return ((await db
+        .prepare("SELECT tokenHash, fromDid, intoDid, expiresAt, usedAt FROM cs_merge_intents WHERE tokenHash = ?")
+        .bind(tokenHash)
+        .first()) ?? null);
+}
+export function intentIsUsable(intent, now = Date.now()) {
+    if (intent.usedAt)
+        return "used";
+    if (new Date(intent.expiresAt).getTime() <= now)
+        return "expired";
+    return "ok";
+}
+export async function consumeMergeIntent(db, tokenHash, usedAt) {
+    await db
+        .prepare(`UPDATE cs_merge_intents SET usedAt = ?
+       WHERE tokenHash = ? AND usedAt IS NULL AND expiresAt > ?`)
+        .bind(usedAt, tokenHash, usedAt)
+        .run();
+    const row = await db
+        .prepare("SELECT usedAt FROM cs_merge_intents WHERE tokenHash = ?")
+        .bind(tokenHash)
+        .first();
+    return row?.usedAt === usedAt;
+}
+async function listConnected(db, userDid) {
+    const rows = await db
+        .prepare("SELECT did, provider, id, userDid FROM cs_connected_accounts WHERE userDid = ?")
+        .bind(userDid)
+        .all();
+    return rows.results ?? [];
+}
+async function listMembershipsForUser(db, userDid) {
+    const rows = await db
+        .prepare("SELECT user_did, instance_did, role, invited_by, created_at, created_by FROM cs_memberships WHERE user_did = ?")
+        .bind(userDid)
+        .all();
+    return rows.results ?? [];
+}
+async function listAccessKeysByCreator(db, createdBy) {
+    const rows = await db
+        .prepare("SELECT accessKeyId, createdBy FROM cs_access_keys WHERE createdBy = ?")
+        .bind(createdBy)
+        .all();
+    return rows.results ?? [];
+}
+async function listAliasesPointingAt(db, canonicalDid) {
+    const rows = await db
+        .prepare("SELECT did, canonicalDid FROM cs_did_aliases WHERE canonicalDid = ?")
+        .bind(canonicalDid)
+        .all();
+    return rows.results ?? [];
+}
+export async function buildMergeSnapshot(db, fromDid, intoDid) {
+    const [fromAccounts, intoAccounts, fromMemberships, intoMemberships, accessKeys, ancestorAliases, fromUser, intoUser] = await Promise.all([
+        listConnected(db, fromDid),
+        listConnected(db, intoDid),
+        listMembershipsForUser(db, fromDid),
+        listMembershipsForUser(db, intoDid),
+        listAccessKeysByCreator(db, fromDid),
+        listAliasesPointingAt(db, fromDid),
+        db
+            .prepare("SELECT primaryCredentialDid, passkeyCount FROM cs_users WHERE did = ?")
+            .bind(fromDid)
+            .first(),
+        db
+            .prepare("SELECT passkeyCount FROM cs_users WHERE did = ?")
+            .bind(intoDid)
+            .first(),
+    ]);
+    const intoByProviderId = new Set(intoAccounts.filter((a) => a.provider && a.id).map((a) => `${a.provider}\0${a.id}`));
+    const credentials = [];
+    const skippedConflicts = [];
+    for (const account of fromAccounts) {
+        const key = account.provider && account.id ? `${account.provider}\0${account.id}` : "";
+        if (key && intoByProviderId.has(key)) {
+            skippedConflicts.push({
+                did: account.did,
+                provider: account.provider,
+                id: account.id,
+                reason: "UNIQUE(provider,id)",
+            });
+            continue;
+        }
+        credentials.push({ did: account.did, provider: account.provider, id: account.id });
+    }
+    const intoByInstance = new Map(intoMemberships.map((m) => [m.instance_did, m]));
+    const moved = [];
+    const merged = [];
+    for (const row of fromMemberships) {
+        const existing = intoByInstance.get(row.instance_did);
+        const fromRow = {
+            instanceDid: row.instance_did,
+            role: row.role,
+            invitedBy: row.invited_by,
+            createdAt: row.created_at,
+            createdBy: row.created_by,
+        };
+        if (!existing) {
+            moved.push(fromRow);
+            continue;
+        }
+        merged.push({
+            instanceDid: row.instance_did,
+            fromRole: row.role,
+            intoRoleBefore: existing.role,
+            keptRole: higherRole(row.role, existing.role),
+            fromRow,
+        });
+    }
+    const intoPreMergeRoles = intoMemberships.map((m) => ({
+        instanceDid: m.instance_did,
+        role: m.role,
+    }));
+    const aliasesCreated = [{ did: fromDid, canonicalDid: intoDid, reason: "merged" }];
+    const aliasesRewritten = ancestorAliases
+        .filter((row) => row.did !== fromDid)
+        .map((row) => ({
+        did: row.did,
+        fromCanonicalDid: row.canonicalDid,
+        toCanonicalDid: intoDid,
+    }));
+    const movedPasskeyCount = credentials.filter((c) => c.provider === "passkey").length;
+    return {
+        fromDid,
+        intoDid,
+        credentials,
+        skippedConflicts,
+        memberships: { moved, merged },
+        accessKeys,
+        aliasesCreated,
+        aliasesRewritten,
+        intoPreMergeRoles,
+        didSpace: { copied: false, pointer: didSpacePointer(fromDid) },
+        hostWarnings: [...MERGE_HOST_WARNINGS],
+        fromPrimaryCredentialDid: fromUser?.primaryCredentialDid ?? null,
+        fromPasskeyCount: Number(fromUser?.passkeyCount ?? 0),
+        intoPasskeyCount: Number(intoUser?.passkeyCount ?? 0),
+        movedPasskeyCount,
+    };
+}
+export function toMergePlanView(snapshot) {
+    return {
+        fromDid: snapshot.fromDid,
+        intoDid: snapshot.intoDid,
+        credentials: snapshot.credentials,
+        skippedConflicts: snapshot.skippedConflicts,
+        memberships: snapshot.memberships,
+        accessKeys: snapshot.accessKeys,
+        aliasesCreated: snapshot.aliasesCreated,
+        aliasesRewritten: snapshot.aliasesRewritten,
+        intoPreMergeRoles: snapshot.intoPreMergeRoles,
+        didSpace: snapshot.didSpace,
+        hostWarnings: snapshot.hostWarnings,
+    };
+}
+export function willMovePrimaryCredential(snapshot) {
+    return Boolean(snapshot.fromPrimaryCredentialDid &&
+        snapshot.credentials.some((c) => c.did === snapshot.fromPrimaryCredentialDid));
+}
+/** Same formula `commitMergeBatch` uses to size the D1 batch (#189). */
+export function countMergeStatements(snapshot) {
+    return (snapshot.credentials.length +
+        (willMovePrimaryCredential(snapshot) ? 1 : 0) +
+        snapshot.memberships.moved.length +
+        2 * snapshot.memberships.merged.length +
+        snapshot.accessKeys.length +
+        MERGE_BATCH_FIXED_STATEMENTS);
+}
+export function toMergeConfirmPlan(snapshot) {
+    return {
+        fromDid: snapshot.fromDid,
+        intoDid: snapshot.intoDid,
+        credentialCount: snapshot.credentials.length,
+        credentialsByProvider: snapshot.credentials.map((c) => ({ provider: c.provider })),
+        skippedConflictCount: snapshot.skippedConflicts.length,
+        skippedConflicts: snapshot.skippedConflicts.map((row) => ({
+            provider: row.provider,
+            reason: row.reason,
+        })),
+        membershipMovedCount: snapshot.memberships.moved.length,
+        membershipMergedCount: snapshot.memberships.merged.length,
+        membershipChanges: snapshot.memberships.merged.map((row) => ({
+            fromRole: row.fromRole,
+            intoRoleBefore: row.intoRoleBefore,
+            keptRole: row.keptRole,
+        })),
+        accessKeyCount: snapshot.accessKeys.length,
+        aliasCreatedCount: snapshot.aliasesCreated.length,
+        aliasRewrittenCount: snapshot.aliasesRewritten.length,
+        didSpace: snapshot.didSpace,
+        hostWarningCodes: [...MERGE_HOST_WARNINGS],
+        tooLarge: countMergeStatements(snapshot) > MERGE_BATCH_MAX_STATEMENTS,
+    };
+}
+export async function commitMergeBatch(db, snapshot, now) {
+    const { fromDid, intoDid } = snapshot;
+    const stmts = [];
+    for (const cred of snapshot.credentials) {
+        stmts.push(db.prepare("UPDATE cs_connected_accounts SET userDid = ?, updatedAt = ? WHERE did = ?").bind(intoDid, now, cred.did));
+    }
+    const movedPrimary = willMovePrimaryCredential(snapshot);
+    if (movedPrimary) {
+        stmts.push(db
+            .prepare("UPDATE cs_users SET primaryCredentialDid = NULL, updatedAt = ? WHERE did = ?")
+            .bind(now, fromDid));
+    }
+    for (const row of snapshot.memberships.moved) {
+        stmts.push(db
+            .prepare("UPDATE cs_memberships SET user_did = ?, updated_at = ? WHERE user_did = ? AND instance_did = ?")
+            .bind(intoDid, now, fromDid, row.instanceDid));
+    }
+    for (const row of snapshot.memberships.merged) {
+        stmts.push(db
+            .prepare("UPDATE cs_memberships SET role = ?, updated_at = ? WHERE user_did = ? AND instance_did = ?")
+            .bind(row.keptRole, now, intoDid, row.instanceDid));
+        stmts.push(db
+            .prepare("DELETE FROM cs_memberships WHERE user_did = ? AND instance_did = ?")
+            .bind(fromDid, row.instanceDid));
+    }
+    for (const key of snapshot.accessKeys) {
+        stmts.push(db
+            .prepare("UPDATE cs_access_keys SET createdBy = ?, updatedAt = ? WHERE accessKeyId = ?")
+            .bind(intoDid, now, key.accessKeyId));
+    }
+    stmts.push(db
+        .prepare(`INSERT INTO cs_did_aliases (did, canonicalDid, reason, evidence, createdAt)
+         VALUES (?, ?, 'merged', NULL, ?)
+         ON CONFLICT(did) DO UPDATE SET
+           canonicalDid = excluded.canonicalDid,
+           reason = excluded.reason`)
+        .bind(fromDid, intoDid, now));
+    stmts.push(db.prepare(FLATTEN_DID_ALIASES_SQL).bind(intoDid, fromDid));
+    stmts.push(db
+        .prepare("UPDATE cs_refresh_tokens SET revokedAt = datetime('now') WHERE userDid = ? AND revokedAt IS NULL")
+        .bind(fromDid));
+    stmts.push(db
+        .prepare("UPDATE cs_refresh_tokens SET revokedAt = datetime('now') WHERE userDid = ? AND revokedAt IS NULL")
+        .bind(intoDid));
+    const fromPasskey = Math.max(0, snapshot.fromPasskeyCount - snapshot.movedPasskeyCount);
+    const intoPasskey = snapshot.intoPasskeyCount + snapshot.movedPasskeyCount;
+    stmts.push(db
+        .prepare(`UPDATE cs_users SET mergedInto = ?, mergedAt = ?, mergeSnapshot = ?, passkeyCount = ?, updatedAt = ?
+         WHERE did = ?`)
+        .bind(intoDid, now, JSON.stringify(snapshot), fromPasskey, now, fromDid));
+    stmts.push(db.prepare("UPDATE cs_users SET passkeyCount = ?, updatedAt = ? WHERE did = ?").bind(intoPasskey, now, intoDid));
+    const expected = countMergeStatements(snapshot);
+    if (stmts.length !== expected) {
+        throw new Error(`Merge statement count mismatch: expected ${expected}, built ${stmts.length}`);
+    }
+    if (stmts.length > MERGE_BATCH_MAX_STATEMENTS) {
+        throw new Error(`${MERGE_TOO_LARGE_ERROR} (${stmts.length})`);
+    }
+    await db.batch(stmts);
+}
+export async function hashSnapshot(snapshot) {
+    return hashRefreshToken(JSON.stringify(snapshot));
+}
+//# sourceMappingURL=account-merge.js.map

package/dist/store/account-merge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-merge.js","sourceRoot":"","sources":["../../src/store/account-merge.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,MAAM,uBAAuB,GAAG,mEAAmE,CAAC;AAEpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,CAAC;AAC/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAClD,MAAM,CAAC,MAAM,wBAAwB,GAAG,cAAc,CAAC;AACvD,mEAAmE;AACnE,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,wGAAwG;AACxG,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAChC,+EAA+E,CAAC;AAElF,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,sBAAsB,EAAE,uBAAuB,CAAU,CAAC;AAoI9F,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,GAAG,wBAAwB,GAAG,SAAS,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,kBAAkB,OAAO,GAAG,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAS,EAAE,CAAS;IAC7C,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAK7C,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACtF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAc,EACd,KAAiF;IAEjF,MAAM,EAAE;SACL,OAAO,CACN;iCAC2B,CAC5B;SACA,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC;SACpE,GAAG,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAc,EACd,SAAiB;IAEjB,OAAO,CACL,CAAC,MAAM,EAAE;SACN,OAAO,CAAC,iGAAiG,CAAC;SAC1G,IAAI,CAAC,SAAS,CAAC;SACf,KAAK,EAAkB,CAAC,IAAI,IAAI,CACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAsB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACrE,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IACjC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,GAAG;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAc,EAAE,SAAiB,EAAE,MAAc;IACxF,MAAM,EAAE;SACL,OAAO,CACN;gEAC0D,CAC3D;SACA,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC;SAC/B,GAAG,EAAE,CAAC;IACT,MAAM,GAAG,GAAG,MAAM,EAAE;SACjB,OAAO,CAAC,yDAAyD,CAAC;SAClE,IAAI,CAAC,SAAS,CAAC;SACf,KAAK,EAA6B,CAAC;IACtC,OAAO,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,EAAc,EAAE,OAAe;IAC1D,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,OAAO,CAAC,gFAAgF,CAAC;SACzF,IAAI,CAAC,OAAO,CAAC;SACb,GAAG,EAAgB,CAAC;IACvB,OAAO,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,EAAc,EAAE,OAAe;IACnE,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,OAAO,CACN,gHAAgH,CACjH;SACA,IAAI,CAAC,OAAO,CAAC;SACb,GAAG,EAAiB,CAAC;IACxB,OAAO,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,EAAc,EAAE,SAAiB;IACtE,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,OAAO,CAAC,uEAAuE,CAAC;SAChF,IAAI,CAAC,SAAS,CAAC;SACf,GAAG,EAAkB,CAAC;IACzB,OAAO,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,EAAc,EAAE,YAAoB;IACvE,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,OAAO,CAAC,qEAAqE,CAAC;SAC9E,IAAI,CAAC,YAAY,CAAC;SAClB,GAAG,EAAyC,CAAC;IAChD,OAAO,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAc,EAAE,OAAe,EAAE,OAAe;IACvF,MAAM,CAAC,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,CAAC,GACnH,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC;QAC1B,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC;QAC1B,sBAAsB,CAAC,EAAE,EAAE,OAAO,CAAC;QACnC,sBAAsB,CAAC,EAAE,EAAE,OAAO,CAAC;QACnC,uBAAuB,CAAC,EAAE,EAAE,OAAO,CAAC;QACpC,qBAAqB,CAAC,EAAE,EAAE,OAAO,CAAC;QAClC,EAAE;aACC,OAAO,CAAC,uEAAuE,CAAC;aAChF,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,EAAiE;QACzE,EAAE;aACC,OAAO,CAAC,iDAAiD,CAAC;aAC1D,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,EAA4B;KACrC,CAAC,CAAC;IAEL,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CACpF,CAAC;IAEF,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,MAAM,gBAAgB,GAA2B,EAAE,CAAC;IACpD,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,IAAI,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,gBAAgB,CAAC,IAAI,CAAC;gBACpB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,MAAM,EAAE,qBAAqB;aAC9B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,OAAO,GAAyB;YACpC,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;SAC1B,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,QAAQ,EAAE,GAAG,CAAC,IAAI;YAClB,cAAc,EAAE,QAAQ,CAAC,IAAI;YAC7B,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;YAC7C,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,iBAAiB,GAAoB,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;KACb,CAAC,CAAC,CAAC;IAEJ,MAAM,cAAc,GAAwB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxG,MAAM,gBAAgB,GAA0B,eAAe;SAC5D,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC;SACpC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,gBAAgB,EAAE,GAAG,CAAC,YAAY;QAClC,cAAc,EAAE,OAAO;KACxB,CAAC,CAAC,CAAC;IAEN,MAAM,iBAAiB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAErF,OAAO;QACL,OAAO;QACP,OAAO;QACP,WAAW;QACX,gBAAgB;QAChB,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;QAC9B,UAAU;QACV,cAAc;QACd,gBAAgB;QAChB,iBAAiB;QACjB,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE;QAC9D,YAAY,EAAE,CAAC,GAAG,mBAAmB,CAAC;QACtC,wBAAwB,EAAE,QAAQ,EAAE,oBAAoB,IAAI,IAAI;QAChE,gBAAgB,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,IAAI,CAAC,CAAC;QACrD,gBAAgB,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,IAAI,CAAC,CAAC;QACrD,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAuB;IACrD,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,YAAY,EAAE,QAAQ,CAAC,YAAY;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAuB;IAC/D,OAAO,OAAO,CACZ,QAAQ,CAAC,wBAAwB;QAC/B,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,wBAAwB,CAAC,CAChF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,oBAAoB,CAAC,QAAuB;IAC1D,OAAO,CACL,QAAQ,CAAC,WAAW,CAAC,MAAM;QAC3B,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM;QACjC,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM;QACtC,QAAQ,CAAC,UAAU,CAAC,MAAM;QAC1B,4BAA4B,CAC7B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAuB;IACxD,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,eAAe,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM;QAC5C,qBAAqB,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClF,oBAAoB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,MAAM;QACtD,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxD,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC;QACH,oBAAoB,EAAE,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM;QACvD,qBAAqB,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM;QACzD,iBAAiB,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3D,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC,CAAC;QACH,cAAc,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM;QAC1C,iBAAiB,EAAE,QAAQ,CAAC,cAAc,CAAC,MAAM;QACjD,mBAAmB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,MAAM;QACrD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,gBAAgB,EAAE,CAAC,GAAG,mBAAmB,CAAC;QAC1C,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,GAAG,0BAA0B;KACtE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAc,EACd,QAAuB,EACvB,GAAW;IAEX,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IACtC,MAAM,KAAK,GAA0B,EAAE,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,OAAO,CAAC,2EAA2E,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CACrH,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CACR,EAAE;aACC,OAAO,CAAC,8EAA8E,CAAC;aACvF,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CACtB,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CACR,EAAE;aACC,OAAO,CAAC,gGAAgG,CAAC;aACzG,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAChD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CACR,EAAE;aACC,OAAO,CAAC,4FAA4F,CAAC;aACrG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CACrD,CAAC;QACF,KAAK,CAAC,IAAI,CACR,EAAE;aACC,OAAO,CAAC,oEAAoE,CAAC;aAC7E,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAClC,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,EAAE;aACC,OAAO,CAAC,8EAA8E,CAAC;aACvF,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,CAAC,CACvC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CACR,EAAE;SACC,OAAO,CACN;;;;oCAI4B,CAC7B;SACA,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAC/B,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAEvE,KAAK,CAAC,IAAI,CACR,EAAE;SACC,OAAO,CAAC,kGAAkG,CAAC;SAC3G,IAAI,CAAC,OAAO,CAAC,CACjB,CAAC;IACF,KAAK,CAAC,IAAI,CACR,EAAE;SACC,OAAO,CAAC,kGAAkG,CAAC;SAC3G,IAAI,CAAC,OAAO,CAAC,CACjB,CAAC;IAEF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACxF,MAAM,WAAW,GAAG,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,iBAAiB,CAAC;IAC3E,KAAK,CAAC,IAAI,CACR,EAAE;SACC,OAAO,CACN;uBACe,CAChB;SACA,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,CAC3E,CAAC;IACF,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,OAAO,CAAC,mEAAmE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,CAChH,CAAC;IAEF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,WAAW,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,qBAAqB,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAuB;IACxD,OAAO,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/store/d1-store.d.ts

@@ -6,6 +6,44 @@
  */
 import type { BindHostResult } from "../blocklet-service-rpc-types.js";
 import type { AccessKeyInfo, AccessPolicyInfo, AuditLogInfo, CreateAccessKeyInput, CreateAccessPolicyInput, CreateAuditLogInput, CreateInvitationInput, CreateSecurityRuleInput, InvitationInfo, MemberInfo, SecurityRuleInfo, StoredAccessKey, StoredConnectedAccount, StoredInvitation, StoredUser, UpdateAccessKeyInput, UpdateAccessPolicyInput, UpdateSecurityRuleInput } from "../types.js";
+import { type MergeIntentRow, type MergeSnapshot } from "./account-merge.js";
+/** Allowed `cs_did_aliases.reason` values. Unknown reasons are rejected on write. */
+export declare const DID_ALIAS_REASONS: readonly ["merged", "chain-migrated"];
+export type DidAliasReason = (typeof DID_ALIAS_REASONS)[number];
+export interface UpsertDidAliasInput {
+    did: string;
+    canonicalDid: string;
+    reason: DidAliasReason;
+    evidence?: string | null;
+}
+/**
+ * Identity lookup: user DID → connected-account DID → alias source.
+ *
+ * The user arm excludes alias sources so a retained merged `cs_users(A)`
+ * row cannot hide alias `A→B` (#149 / SD-147). The connected-account arm
+ * excludes alias-source `ca.did` so a leftover wallet row on a
+ * chain-migrated OLD DID cannot hide `OLD→NEW` (#169). Skipped merge
+ * credentials are not alias sources; `getUserByDidOrConnectedAccount`
+ * follows `mergedInto` so those rows resolve to the surviving account
+ * (#176). Do not reorder the arms.
+ */
+export declare const GET_USER_BY_DID_OR_CONNECTED_ACCOUNT_SQL = "SELECT u.* FROM cs_users u\n WHERE u.did = ?\n   AND NOT EXISTS (SELECT 1 FROM cs_did_aliases a WHERE a.did = u.did)\nUNION ALL\nSELECT u.* FROM cs_connected_accounts ca\n JOIN cs_users u ON ca.userDid = u.did\n WHERE ca.did = ?\n   AND NOT EXISTS (SELECT 1 FROM cs_did_aliases a WHERE a.did = ca.did)\nUNION ALL\nSELECT u.* FROM cs_did_aliases a\n JOIN cs_users u ON a.canonicalDid = u.did WHERE a.did = ?\nLIMIT 1";
+/** Flatten ancestors when a canonical DID itself becomes an alias (one hop). */
+export declare const FLATTEN_DID_ALIASES_SQL = "UPDATE cs_did_aliases SET canonicalDid = ? WHERE canonicalDid = ?";
+/**
+ * Backfill `cs_users.primaryCredentialDid` from `sourceProvider`.
+ * Among matching connected-account rows, prefer `account.did === user.did`,
+ * else oldest `createdAt` (then `did` for a stable tie-break). Leave NULL
+ * when no row matches. Idempotent: already-set values are left alone.
+ */
+export declare const BACKFILL_PRIMARY_CREDENTIAL_SQL = "UPDATE cs_users\nSET primaryCredentialDid = picked.credDid\nFROM (\n  SELECT ownerDid, credDid FROM (\n    SELECT\n      u.did AS ownerDid,\n      ca.did AS credDid,\n      ROW_NUMBER() OVER (\n        PARTITION BY u.did\n        ORDER BY\n          CASE WHEN ca.did = u.did THEN 0 ELSE 1 END,\n          ca.createdAt ASC,\n          ca.did ASC\n      ) AS rn\n    FROM cs_users u\n    JOIN cs_connected_accounts ca\n      ON ca.userDid = u.did AND ca.provider = u.sourceProvider\n  ) ranked\n  WHERE rn = 1\n) picked\nWHERE cs_users.did = picked.ownerDid\n  AND cs_users.primaryCredentialDid IS NULL";
+/**
+ * Drop extra `(provider, id)` rows so UNIQUE(provider, id) can be created
+ * on a legacy database. Keep `did = userDid`, else the oldest `createdAt`
+ * (then `did`). `id IS NULL` rows are left alone — SQLite UNIQUE treats
+ * NULL as distinct.
+ */
+export declare const DEDUPE_CONNECTED_ACCOUNTS_SQL = "DELETE FROM cs_connected_accounts\nWHERE id IS NOT NULL\n  AND rowid IN (\n    SELECT rowid FROM (\n      SELECT\n        rowid,\n        ROW_NUMBER() OVER (\n          PARTITION BY provider, id\n          ORDER BY\n            CASE WHEN did = userDid THEN 0 ELSE 1 END,\n            COALESCE(createdAt, '') ASC,\n            did ASC\n        ) AS rn\n      FROM cs_connected_accounts\n      WHERE id IS NOT NULL\n    ) ranked\n    WHERE rn > 1\n  )";
 /** Session-JWT and OAuth refresh TTL. W4 aligns OAuth to this; do not invent a second constant. */
 export declare const REFRESH_TOKEN_TTL_SECONDS: number;
 export interface IssuedRefreshToken {
@@ -87,7 +125,7 @@ export declare class D1Store {
         assumeMigrated?: boolean;
     });
     /** Run schema migration. Idempotent — only executes once per isolate.
-     *  Optimized: merges CREATE TABLE/INDEX into batches, ALTER TABLE in parallel. */
+     *  Optimized: CREATE TABLE in a batch, ALTER TABLE in parallel, then indexes. */
     migrate(): Promise<void>;
     /** @internal Backwards-compatible alias for migrate(). */
     ensureSchema(): Promise<void>;
@@ -119,6 +157,12 @@ export declare class D1Store {
     }): Promise<void>;
     getUserByDid(did: string): Promise<StoredUser | null>;
     getUserByEmail(email: string): Promise<StoredUser | null>;
+    /**
+     * True iff another unmerged user shares `selfDid`'s verified email.
+     * Uses `lower(trim(email))` — do not call `getUserByEmail` (exact match,
+     * may return self). Users are global; no instanceDid filter. `SELECT 1 LIMIT 1`.
+     */
+    hasVerifiedEmailMergeCandidate(selfDid: string): Promise<boolean>;
     updateLastLogin(did: string, ip?: string, domain?: string): Promise<void>;
     incrementPasskeyCount(did: string): Promise<void>;
     getUserCount(): Promise<number>;
@@ -222,23 +266,41 @@ export declare class D1Store {
         userInfo?: string;
     }, actor: string): Promise<void>;
     /**
-     * Update a user's `sourceProvider` (the provider they registered with).
+     * Update a user's `sourceProvider` (display-only registration label).
      *
-     * Must stay in step with `relabelConnectedAccountProvider`: `handleUnbind`
-     * reads `sourceProvider` to refuse removing the registration account, so a
-     * relabel that left this field pointing at a provider the user no longer has
-     * a row for would silently disarm that guard.
+     * Security guards read `primaryCredentialDid`, not this field. Relabel is
+     * kept so profile `isMain` / audit display stay in step with the bound
+     * provider; it must not arm or disarm unbind / last-passkey checks.
      */
     updateUserSourceProvider(did: string, sourceProvider: string, actor: string): Promise<void>;
-    getConnectedAccountById(credentialId: string): Promise<StoredConnectedAccount | null>;
+    getConnectedAccountById(id: string, provider: string): Promise<StoredConnectedAccount | null>;
     getConnectedAccountByDid(did: string): Promise<StoredConnectedAccount | null>;
     updateCounter(did: string, counter: number): Promise<void>;
     getConnectedAccountsByUserDid(userDid: string): Promise<StoredConnectedAccount[]>;
     getConnectedAccountByProviderAndUser(provider: string, userDid: string): Promise<StoredConnectedAccount | null>;
     getConnectedAccountsByProviderAndUser(provider: string, userDid: string): Promise<StoredConnectedAccount[]>;
     getUserByDidOrConnectedAccount(did: string): Promise<StoredUser | null>;
+    /**
+     * Insert or update a one-hop DID alias. When `canonicalDid` is itself an
+     * alias, the write lands on that row's canonical. When `did` becomes an
+     * alias, every row pointing at it is rewritten in the same `db.batch`.
+     */
+    upsertDidAlias(input: UpsertDidAliasInput): Promise<void>;
+    upsertDidAliases(inputs: UpsertDidAliasInput[]): Promise<void>;
     decrementPasskeyCount(did: string): Promise<void>;
     updateConnectedAccountName(did: string, name: string, actor: string): Promise<void>;
+    /**
+     * Point `primaryCredentialDid` at a credential the user owns, or NULL.
+     * Rejects a pointer at another user's row so writers cannot cross tenants.
+     */
+    setPrimaryCredentialDid(userDid: string, credentialDid: string | null, actor?: string): Promise<void>;
+    /** Fill primary only when it is still NULL. Used after first credential insert. */
+    private maybeFillPrimaryCredentialDid;
+    /**
+     * Next primary among remaining credentials of the same user.
+     * Prefer `account.did === user.did`, else oldest `createdAt` (then `did`).
+     */
+    private pickReplacementPrimaryDid;
     deleteConnectedAccount(did: string): Promise<void>;
     createAccessKey(input: CreateAccessKeyInput): Promise<StoredAccessKey>;
     getAccessKeyById(accessKeyId: string): Promise<AccessKeyInfo | null>;
@@ -496,6 +558,12 @@ export declare class D1Store {
     rotateRefreshToken(oldPlaintext: string, rotationSecret: string): Promise<IssuedRefreshToken>;
     /** Revoke every token in a rotation family (theft containment). */
     revokeRefreshTokenFamily(familyId: string): Promise<void>;
+    /**
+     * Revoke every refresh family for a user (unbind / delete stop-loss).
+     * `cs_refresh_tokens` has no credential column — this is user-scoped, not
+     * per-provider. Uses `idx_refresh_tokens_userDid`. Does not touch access JWTs.
+     */
+    revokeRefreshTokensForUser(userDid: string): Promise<void>;
     /**
      * Look up a refresh token by plaintext. Used by the OAuth refresh grant.
      * Session-JWT rows have accessKeyId = NULL — callers must reject those.
@@ -526,6 +594,28 @@ export declare class D1Store {
             expiresAt: string;
         };
     }): Promise<void>;
+    createMergeStart(intoDid: string): Promise<{
+        challenge: string;
+        expiresAt: string;
+    }>;
+    getMergeStart(challenge: string): Promise<{
+        intoDid: string;
+    } | null>;
+    deleteMergeStart(challenge: string): Promise<void>;
+    createMergeIntent(fromDid: string, intoDid: string): Promise<{
+        token: string;
+        expiresAt: string;
+    }>;
+    getMergeIntent(tokenHash: string): Promise<MergeIntentRow | null>;
+    planAccountMerge(fromDid: string, intoDid: string): Promise<MergeSnapshot>;
+    commitAccountMerge(tokenHash: string, actorDid: string): Promise<{
+        ok: true;
+        snapshot: MergeSnapshot;
+    } | {
+        ok: false;
+        error: string;
+        status: number;
+    }>;
 }
 export {};
 //# sourceMappingURL=d1-store.d.ts.map