@arcblock/did-connect-service 4.1.22 → 4.1.24

package/dist/handlers/access-key-connect-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-key-connect-handler.js","sourceRoot":"","sources":["../../src/handlers/access-key-connect-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAe,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAgC,MAAM,iCAAiC,CAAC;AAI1G,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAG7D,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAclD,MAAM,OAAO,uBAAuB;IAC1B,KAAK,CAAU;IACf,IAAI,CAAO;IACX,gBAAgB,CAAmB;IACnC,WAAW,CAA2B;IACtC,kBAAkB,CAA8D;IAChF,MAAM,CAAS;IAEvB,YAAY,OAAgC;QAC1C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,WAAoB;QAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAEzB,6BAA6B;QAC7B,IACE,QAAQ,KAAK,qCAAqC;YAClD,OAAO,CAAC,MAAM,KAAK,KAAK,EACxB,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB;gBACzC,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC;gBAC5C,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;YACrB,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACpD,OAAO,IAAI,QAAQ,CACjB,yBAAyB,CACvB,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,EACjE,YAAY,CAAC,OAAO,CAAC,CACtB,EACD;gBACE,OAAO,EAAE;oBACP,cAAc,EAAE,0BAA0B;oBAC1C,eAAe,EAAE,UAAU;iBAC5B;aACF,CACF,CAAC;QACJ,CAAC;QAED,cAAc;QACd,IAAI,QAAQ,KAAK,6CAA6C,EAAE,CAAC;YAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAClE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,qBAAqB;QACrB,IACE,QAAQ,KAAK,+CAA+C;YAC5D,OAAO,CAAC,MAAM,KAAK,MAAM,EACzB,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,mBAAmB,CAAC,GAAQ;QACxC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACvD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IACtD,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,aAAa,CAAC,QAAiB;QAC3C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;YAC5D,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;QAED,uEAAuE;QACvE,mEAAmE;QACnE,IAAI,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACrC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;aACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;QAEtE,4CAA4C;QAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,6BAA6B,EAAE,CAAC;QACjD,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAE9E,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,qEAAqE;IAC7D,KAAK,CAAC,UAAU,CAAC,OAAgB;QACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;QAE7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QAED,0CAA0C;QAC1C,OAAO,YAAY,CAAC;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,WAAW,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;YAC1C,eAAe,EAAE,OAAO,CAAC,2BAA2B,IAAI,IAAI;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,oDAAoD;IAC5C,KAAK,CAAC,aAAa,CAAC,OAAgB;QAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,GAAG;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACtD,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,SAAS,CAAC,OAAgB,EAAE,WAAoB;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,IAAsD,CAAC;QAC3D,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAqD,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,UAAU,GAAI,MAAM,CAAC,IAAa,IAAI,OAAO,CAAC;QACpD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3F,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;YAChC,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,iBAAiB,MAAM,CAAC,aAAa,CAAC,qBAAqB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAC9F,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,gDAAgD;gBACzD,GAAG,EAAE,YAAY;gBACjB,aAAa;gBACb,UAAU;aACX,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,kDAAkD,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,GAAG;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;QAE7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oDAAoD,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5G,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iDAAiD,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;YACzG,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,0CAA0C,EAAE,EACrD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7H,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,mEAAmE;gBAC5E,GAAG,EAAE,YAAY;gBACjB,GAAG;aACJ,CAAC,CAAC;YACH,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,6FAA6F,EAAE,EACxG,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,iFAAiF;QACjF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC;YAC9D,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,eAAe,OAAO,CAAC,MAAM,IAAI,UAAU,EAAE;YACrD,SAAS,EAAE,MAAM,CAAC,GAAG;YACrB,QAAQ,EAAE,QAAQ;YAClB,WAAW;SACZ,CAAC,CAAC;QAEH,iDAAiD;QACjD,MAAM,SAAS,GAAG,MAAM,UAAU,CAChC,SAAS,CAAC,eAAe,EACzB,OAAO,CAAC,SAAS,CAClB,CAAC;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,GAAG,EAAE;YAC3C,MAAM,EAAE,WAAW;YACnB,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,wBAAwB,EAAE,SAAS;SACpC,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IACxE,CAAC;CACF;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,mBAAmB;SACrC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"access-key-connect-handler.js","sourceRoot":"","sources":["../../src/handlers/access-key-connect-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAe,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAgC,MAAM,iCAAiC,CAAC;AAI1G,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAG7D,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAElD,kFAAkF;AAClF,SAAS,cAAc,CAAmB,KAAQ;IAChD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAe,CAAC;AACpG,CAAC;AAcD,MAAM,OAAO,uBAAuB;IAC1B,KAAK,CAAU;IACf,IAAI,CAAO;IACX,gBAAgB,CAAmB;IACnC,WAAW,CAA2B;IACtC,kBAAkB,CAA8D;IAChF,MAAM,CAAS;IAEvB,YAAY,OAAgC;QAC1C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,WAAoB;QAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAEzB,6BAA6B;QAC7B,IACE,QAAQ,KAAK,qCAAqC;YAClD,OAAO,CAAC,MAAM,KAAK,KAAK,EACxB,CAAC;YACD,sEAAsE;YACtE,0EAA0E;YAC1E,6EAA6E;YAC7E,sEAAsE;YACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB;gBACtC,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC;gBAC5C,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,WAAW,GAAwC,QAAQ;gBAC/D,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE;gBACtD,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;YACrB,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACpD,OAAO,IAAI,QAAQ,CACjB,yBAAyB,CACvB,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,EACjE,YAAY,CAAC,OAAO,CAAC,CACtB,EACD;gBACE,OAAO,EAAE;oBACP,cAAc,EAAE,0BAA0B;oBAC1C,eAAe,EAAE,UAAU;iBAC5B;aACF,CACF,CAAC;QACJ,CAAC;QAED,cAAc;QACd,IAAI,QAAQ,KAAK,6CAA6C,EAAE,CAAC;YAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAClE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,qBAAqB;QACrB,IACE,QAAQ,KAAK,+CAA+C;YAC5D,OAAO,CAAC,MAAM,KAAK,MAAM,EACzB,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,mBAAmB,CAAC,GAAQ;QACxC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACvD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IACtD,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,aAAa,CAAC,QAAiB;QAC3C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;YAC5D,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;QAED,uEAAuE;QACvE,mEAAmE;QACnE,IAAI,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACrC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;aACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;QAEtE,4CAA4C;QAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,6BAA6B,EAAE,CAAC;QACjD,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAE9E,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,qEAAqE;IAC7D,KAAK,CAAC,UAAU,CAAC,OAAgB;QACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;QAE7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QAED,0CAA0C;QAC1C,OAAO,YAAY,CAAC;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,WAAW,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;YAC1C,eAAe,EAAE,OAAO,CAAC,2BAA2B,IAAI,IAAI;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,oDAAoD;IAC5C,KAAK,CAAC,aAAa,CAAC,OAAgB;QAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,GAAG;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACtD,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,SAAS,CAAC,OAAgB,EAAE,WAAoB;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,IAAsD,CAAC;QAC3D,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAqD,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,UAAU,GAAI,MAAM,CAAC,IAAa,IAAI,OAAO,CAAC;QACpD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3F,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;YAChC,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,iBAAiB,MAAM,CAAC,aAAa,CAAC,qBAAqB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAC9F,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,gDAAgD;gBACzD,GAAG,EAAE,YAAY;gBACjB,aAAa;gBACb,UAAU;aACX,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,kDAAkD,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,GAAG;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;QAE7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oDAAoD,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5G,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iDAAiD,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;YACzG,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,0CAA0C,EAAE,EACrD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7H,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,mEAAmE;gBAC5E,GAAG,EAAE,YAAY;gBACjB,GAAG;aACJ,CAAC,CAAC;YACH,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,6FAA6F,EAAE,EACxG,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,iFAAiF;QACjF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC;YAC9D,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,eAAe,OAAO,CAAC,MAAM,IAAI,UAAU,EAAE;YACrD,SAAS,EAAE,MAAM,CAAC,GAAG;YACrB,QAAQ,EAAE,QAAQ;YAClB,WAAW;SACZ,CAAC,CAAC;QAEH,iDAAiD;QACjD,MAAM,SAAS,GAAG,MAAM,UAAU,CAChC,SAAS,CAAC,eAAe,EACzB,OAAO,CAAC,SAAS,CAClB,CAAC;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,GAAG,EAAE;YAC3C,MAAM,EAAE,WAAW;YACnB,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,wBAAwB,EAAE,SAAS;SACpC,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IACxE,CAAC;CACF;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,mBAAmB;SACrC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/handlers/account-merge-handler.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Dual-auth account merge (#149 / SD-149 / SD-149c).
+ *
+ * Routes (under /.well-known/service/api/account/merge):
+ *   GET  /candidate — session-only boolean: another unmerged user shares
+ *                     this verified email. Query/body did/email are ignored.
+ *   POST /start     — B starts; returns a challenge bound to intoDid=B
+ *   POST /dry-run   — same plan as commit, no writes
+ *   POST /commit    — consume intent + atomic merge
+ * Unknown actions (including former /rollback) return explicit 404 JSON.
+ * GET /candidate is handled before the POST-only guard (#192).
+ *
+ * Prove-A uses the dedicated `merge-proof` DID Connect action (wallet
+ * description is not a login). See `completeMergeProof`.
+ */
+import { type Logger } from "../logger.js";
+import type { D1Store } from "../store/d1-store.js";
+export declare const MERGE_CHALLENGE_COOKIE = "connect_merge_challenge";
+export declare const MERGE_ROUTE_PREFIX = "/.well-known/service/api/account/merge";
+/** WalletHandlers action for prove-A. handleComplete mints only when the session has this action. */
+export declare const MERGE_PROOF_ACTION = "merge-proof";
+/** Shown on the wallet confirm screen for the merge-proof action (#170). */
+export declare const MERGE_PROOF_WALLET_DESCRIPTION = "Confirm merging this account into another account. This is not a login.";
+export interface AccountMergeHandlerOptions {
+    store: D1Store;
+    jwtSecret: string;
+    cookieName: string;
+    logger?: Logger;
+    appDid?: string;
+}
+/** Body only — query/cookie made the challenge injectable (#170). */
+export declare function extractMergeChallenge(_request: Request, body?: {
+    mergeChallenge?: unknown;
+}): string | undefined;
+export declare function completeMergeProof(opts: {
+    store: D1Store;
+    mergeChallenge: string | null | undefined;
+    fromDid: string;
+    appDid?: string | null;
+    ip?: string;
+    instanceDid?: string;
+}): Promise<Response | null>;
+export declare class AccountMergeHandler {
+    private readonly store;
+    private readonly jwtSecret;
+    private readonly cookieName;
+    private readonly logger;
+    private readonly appDid?;
+    constructor(options: AccountMergeHandlerOptions);
+    fetch(request: Request, instanceDid?: string): Promise<Response | null>;
+    private verifyCaller;
+    /**
+     * Boolean-only existence signal. `self` is the session DID — query/body
+     * `did`/`email` are not read (existence oracle). Users are global; this
+     * does not take instanceDid.
+     */
+    private handleCandidate;
+    private handleStart;
+    private loadUsableIntent;
+    private handleDryRun;
+    private handleCommit;
+}
+//# sourceMappingURL=account-merge-handler.d.ts.map

package/dist/handlers/account-merge-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-merge-handler.d.ts","sourceRoot":"","sources":["../../src/handlers/account-merge-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAY1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEpD,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAChE,eAAO,MAAM,kBAAkB,2CAA2C,CAAC;AAC3E,qGAAqG;AACrG,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAChD,4EAA4E;AAC5E,eAAO,MAAM,8BAA8B,4EACgC,CAAC;AAE5E,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAiBD,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,GAClC,MAAM,GAAG,SAAS,CAKpB;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqD3B;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAU;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;gBAErB,OAAO,EAAE,0BAA0B;IAQzC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YAoD/D,YAAY;IAS1B;;;;OAIG;YACW,eAAe;YAKf,WAAW;YAiCX,gBAAgB;YAkBhB,YAAY;YAwBZ,YAAY;CA+B3B"}

package/dist/handlers/account-merge-handler.js

@@ -0,0 +1,263 @@
+/**
+ * Dual-auth account merge (#149 / SD-149 / SD-149c).
+ *
+ * Routes (under /.well-known/service/api/account/merge):
+ *   GET  /candidate — session-only boolean: another unmerged user shares
+ *                     this verified email. Query/body did/email are ignored.
+ *   POST /start     — B starts; returns a challenge bound to intoDid=B
+ *   POST /dry-run   — same plan as commit, no writes
+ *   POST /commit    — consume intent + atomic merge
+ * Unknown actions (including former /rollback) return explicit 404 JSON.
+ * GET /candidate is handled before the POST-only guard (#192).
+ *
+ * Prove-A uses the dedicated `merge-proof` DID Connect action (wallet
+ * description is not a login). See `completeMergeProof`.
+ */
+import { requireJsonContentType } from "../identity/json-content-type.js";
+import { verifyJWT } from "../identity/jwt.js";
+import { consoleLogger } from "../logger.js";
+import { didSpacePointer, hashMergeToken, hashSnapshot, intentIsUsable, MERGE_START_TTL_SECONDS, toMergeConfirmPlan, toMergePlanView, } from "../store/account-merge.js";
+export const MERGE_CHALLENGE_COOKIE = "connect_merge_challenge";
+export const MERGE_ROUTE_PREFIX = "/.well-known/service/api/account/merge";
+/** WalletHandlers action for prove-A. handleComplete mints only when the session has this action. */
+export const MERGE_PROOF_ACTION = "merge-proof";
+/** Shown on the wallet confirm screen for the merge-proof action (#170). */
+export const MERGE_PROOF_WALLET_DESCRIPTION = "Confirm merging this account into another account. This is not a login.";
+function jsonResponse(data, status = 200, headers) {
+    return new Response(JSON.stringify(data), {
+        status,
+        headers: {
+            "Content-Type": "application/json",
+            "Cache-Control": "private, no-store",
+            ...headers,
+        },
+    });
+}
+function jsonError(error, status) {
+    return jsonResponse({ error }, status);
+}
+/** Body only — query/cookie made the challenge injectable (#170). */
+export function extractMergeChallenge(_request, body) {
+    if (typeof body?.mergeChallenge === "string" && body.mergeChallenge.trim()) {
+        return body.mergeChallenge.trim();
+    }
+    return undefined;
+}
+export async function completeMergeProof(opts) {
+    const challenge = typeof opts.mergeChallenge === "string" ? opts.mergeChallenge.trim() : "";
+    if (!challenge)
+        return null;
+    if (opts.appDid && opts.fromDid === opts.appDid) {
+        return jsonError("APP_SK is not evidence of account control", 403);
+    }
+    const start = await opts.store.getMergeStart(challenge);
+    if (!start) {
+        return jsonError("Invalid or expired merge challenge", 400);
+    }
+    if (opts.fromDid === start.intoDid) {
+        return jsonError("Cannot merge an account into itself", 400);
+    }
+    const fromUser = await opts.store.getUserByDid(opts.fromDid);
+    if (!fromUser) {
+        return jsonError("Source account not found", 400);
+    }
+    if (fromUser.mergedInto) {
+        return jsonError("Source account has already been merged", 403);
+    }
+    const intoUser = await opts.store.getUserByDid(start.intoDid);
+    if (!intoUser) {
+        return jsonError("Target account not found", 400);
+    }
+    if (intoUser.mergedInto) {
+        return jsonError("Target account has already been merged", 403);
+    }
+    const issued = await opts.store.createMergeIntent(opts.fromDid, start.intoDid);
+    await opts.store.deleteMergeStart(challenge);
+    await opts.store.createAuditLog({
+        action: "account.merge.proof",
+        operatorDid: opts.fromDid,
+        targetDid: start.intoDid,
+        metadata: { fromDid: opts.fromDid, intoDid: start.intoDid },
+        ip: opts.ip,
+        instanceDid: opts.instanceDid && opts.instanceDid !== "_global_" ? opts.instanceDid : undefined,
+    });
+    return jsonResponse({
+        ok: true,
+        mergeIntent: issued.token,
+        fromDid: opts.fromDid,
+        intoDid: start.intoDid,
+        expiresAt: issued.expiresAt,
+        didSpace: { copied: false, pointer: didSpacePointer(opts.fromDid) },
+    });
+}
+export class AccountMergeHandler {
+    store;
+    jwtSecret;
+    cookieName;
+    logger;
+    appDid;
+    constructor(options) {
+        this.store = options.store;
+        this.jwtSecret = options.jwtSecret;
+        this.cookieName = options.cookieName;
+        this.logger = options.logger ?? consoleLogger;
+        this.appDid = options.appDid;
+    }
+    async fetch(request, instanceDid) {
+        const url = new URL(request.url);
+        if (!url.pathname.startsWith(`${MERGE_ROUTE_PREFIX}/`))
+            return null;
+        const action = url.pathname.slice(MERGE_ROUTE_PREFIX.length + 1);
+        // GET /candidate must run before the POST-only guard. A `case "candidate"`
+        // inside the POST switch would 405 forever (#192).
+        if (action === "candidate") {
+            if (request.method !== "GET") {
+                return jsonError("Method not allowed", 405);
+            }
+            const caller = await this.verifyCaller(request);
+            if (!caller)
+                return jsonError("Authentication required", 401);
+            return this.handleCandidate(caller.did);
+        }
+        if (request.method !== "POST") {
+            return jsonError("Method not allowed", 405);
+        }
+        const rejected = requireJsonContentType(request);
+        if (rejected)
+            return rejected;
+        const caller = await this.verifyCaller(request);
+        if (!caller)
+            return jsonError("Authentication required", 401);
+        let body;
+        try {
+            const raw = await request.text();
+            if (!raw.trim())
+                return jsonError("Invalid request body", 400);
+            const parsed = JSON.parse(raw);
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+                return jsonError("Invalid request body", 400);
+            }
+            body = parsed;
+        }
+        catch {
+            return jsonError("Invalid request body", 400);
+        }
+        switch (action) {
+            case "start":
+                return this.handleStart(request, caller.did, instanceDid);
+            case "dry-run":
+                return this.handleDryRun(caller.did, body, instanceDid);
+            case "commit":
+                return this.handleCommit(caller.did, body, request, instanceDid);
+            default:
+                return jsonError("Not found", 404);
+        }
+    }
+    async verifyCaller(request) {
+        const cookie = request.headers.get("Cookie") ?? "";
+        const match = new RegExp(`${this.cookieName}=([^;]+)`).exec(cookie);
+        if (!match?.[1])
+            return null;
+        const payload = await verifyJWT(match[1], this.jwtSecret);
+        if (!payload || typeof payload.did !== "string" || !payload.did)
+            return null;
+        return { did: payload.did };
+    }
+    /**
+     * Boolean-only existence signal. `self` is the session DID — query/body
+     * `did`/`email` are not read (existence oracle). Users are global; this
+     * does not take instanceDid.
+     */
+    async handleCandidate(selfDid) {
+        const mergeCandidate = await this.store.hasVerifiedEmailMergeCandidate(selfDid);
+        return jsonResponse({ mergeCandidate });
+    }
+    async handleStart(request, callerDid, instanceDid) {
+        const user = await this.store.getUserByDid(callerDid);
+        if (!user)
+            return jsonError("Authentication required", 401);
+        if (user.mergedInto)
+            return jsonError("This account has already been merged", 403);
+        const started = await this.store.createMergeStart(callerDid);
+        // Gate Secure on https like the other handlers — over plain http the browser
+        // drops a Secure cookie, so the challenge would never come back on commit.
+        const isSecure = new URL(request.url).protocol === "https:";
+        const cookie = `${MERGE_CHALLENGE_COOKIE}=${started.challenge}; Path=/; Max-Age=${MERGE_START_TTL_SECONDS}; SameSite=Lax;${isSecure ? " Secure;" : ""} HttpOnly`;
+        this.logger.info({
+            message: "account merge started",
+            mod: "account-merge",
+            intoDid: callerDid,
+            instanceDid,
+        });
+        await this.store.createAuditLog({
+            action: "account.merge.start",
+            operatorDid: callerDid,
+            targetDid: callerDid,
+            metadata: { intoDid: callerDid },
+            instanceDid: instanceDid && instanceDid !== "_global_" ? instanceDid : undefined,
+        });
+        return jsonResponse({ challenge: started.challenge, intoDid: callerDid, expiresAt: started.expiresAt }, 200, { "Set-Cookie": cookie });
+    }
+    async loadUsableIntent(callerDid, body) {
+        const token = typeof body.mergeIntent === "string" ? body.mergeIntent.trim() : "";
+        if (!token)
+            return jsonError("Merge intent required", 403);
+        const tokenHash = await hashMergeToken(token);
+        const intent = await this.store.getMergeIntent(tokenHash);
+        if (!intent)
+            return jsonError("Invalid or expired merge intent", 400);
+        const status = intentIsUsable(intent);
+        if (status === "used")
+            return jsonError("Merge intent already used", 403);
+        if (status === "expired")
+            return jsonError("Merge intent expired", 403);
+        if (intent.intoDid !== callerDid)
+            return jsonError("Merge intent does not belong to this session", 403);
+        return { intent };
+    }
+    async handleDryRun(callerDid, body, instanceDid) {
+        const loaded = await this.loadUsableIntent(callerDid, body);
+        if (loaded instanceof Response)
+            return loaded;
+        const snapshot = await this.store.planAccountMerge(loaded.intent.fromDid, loaded.intent.intoDid);
+        await this.store.createAuditLog({
+            action: "account.merge.dry_run",
+            operatorDid: callerDid,
+            targetDid: loaded.intent.fromDid,
+            metadata: {
+                fromDid: loaded.intent.fromDid,
+                intoDid: loaded.intent.intoDid,
+                credentialCount: snapshot.credentials.length,
+                skippedConflictCount: snapshot.skippedConflicts.length,
+            },
+            instanceDid: instanceDid && instanceDid !== "_global_" ? instanceDid : undefined,
+        });
+        return jsonResponse(toMergeConfirmPlan(snapshot));
+    }
+    async handleCommit(callerDid, body, request, instanceDid) {
+        const loaded = await this.loadUsableIntent(callerDid, body);
+        if (loaded instanceof Response)
+            return loaded;
+        const result = await this.store.commitAccountMerge(loaded.intent.tokenHash, callerDid);
+        if (!result.ok)
+            return jsonError(result.error, result.status);
+        const snapshotHash = await hashSnapshot(result.snapshot);
+        await this.store.createAuditLog({
+            action: "account.merge",
+            operatorDid: callerDid,
+            targetDid: result.snapshot.fromDid,
+            metadata: {
+                fromDid: result.snapshot.fromDid,
+                intoDid: result.snapshot.intoDid,
+                snapshotHash,
+                credentials: result.snapshot.credentials.map((c) => c.did),
+                skipped: result.snapshot.skippedConflicts.length,
+            },
+            ip: request.headers.get("CF-Connecting-IP") ?? undefined,
+            instanceDid: instanceDid && instanceDid !== "_global_" ? instanceDid : undefined,
+        });
+        const plan = toMergePlanView(result.snapshot);
+        return jsonResponse({ ok: true, ...plan, snapshotHash });
+    }
+}
+//# sourceMappingURL=account-merge-handler.js.map

package/dist/handlers/account-merge-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-merge-handler.js","sourceRoot":"","sources":["../../src/handlers/account-merge-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAe,MAAM,cAAc,CAAC;AAC1D,OAAO,EACL,eAAe,EAEf,cAAc,EACd,YAAY,EACZ,cAAc,EACd,uBAAuB,EAEvB,kBAAkB,EAClB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AAGnC,MAAM,CAAC,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAChE,MAAM,CAAC,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AAC3E,qGAAqG;AACrG,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAChD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,8BAA8B,GACzC,yEAAyE,CAAC;AAU5E,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,OAAqB;IACtE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,mBAAmB;YACpC,GAAG,OAAO;SACX;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,MAAc;IAC9C,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,qBAAqB,CACnC,QAAiB,EACjB,IAAmC;IAEnC,IAAI,OAAO,IAAI,EAAE,cAAc,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAOxC;IACC,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/E,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAE7C,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;QAC9B,MAAM,EAAE,qBAAqB;QAC7B,WAAW,EAAE,IAAI,CAAC,OAAO;QACzB,SAAS,EAAE,KAAK,CAAC,OAAO;QACxB,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;QAC3D,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;KAChG,CAAC,CAAC;IAEH,OAAO,YAAY,CAAC;QAClB,EAAE,EAAE,IAAI;QACR,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;KACpE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,mBAAmB;IACb,KAAK,CAAU;IACf,SAAS,CAAS;IAClB,UAAU,CAAS;IACnB,MAAM,CAAS;IACf,MAAM,CAAU;IAEjC,YAAY,OAAmC;QAC7C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,WAAoB;QAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,kBAAkB,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEjE,2EAA2E;QAC3E,mDAAmD;QACnD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC7B,OAAO,SAAS,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAE9D,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;gBAAE,OAAO,SAAS,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,OAAO,SAAS,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,GAAG,MAAiC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC5D,KAAK,SAAS;gBACZ,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAC1D,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;YACnE;gBACE,OAAO,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,OAAgB;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAC7E,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,eAAe,CAAC,OAAe;QAC3C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;QAChF,OAAO,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,OAAgB,EAAE,SAAiB,EAAE,WAAoB;QACjF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;QAEnF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7D,6EAA6E;QAC7E,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC5D,MAAM,MAAM,GAAG,GAAG,sBAAsB,IAAI,OAAO,CAAC,SAAS,qBAAqB,uBAAuB,kBAAkB,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;QAEjK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,OAAO,EAAE,uBAAuB;YAChC,GAAG,EAAE,eAAe;YACpB,OAAO,EAAE,SAAS;YAClB,WAAW;SACZ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;YAC9B,MAAM,EAAE,qBAAqB;YAC7B,WAAW,EAAE,SAAS;YACtB,SAAS,EAAE,SAAS;YACpB,QAAQ,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE;YAChC,WAAW,EAAE,WAAW,IAAI,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SACjF,CAAC,CAAC;QAEH,OAAO,YAAY,CACjB,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAClF,GAAG,EACH,EAAE,YAAY,EAAE,MAAM,EAAE,CACzB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,SAAiB,EACjB,IAA6B;QAE7B,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAE3D,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;QAEtE,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;QAC1E,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;QACxE,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;QACxG,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,SAAiB,EACjB,IAA6B,EAC7B,WAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,MAAM,YAAY,QAAQ;YAAE,OAAO,MAAM,CAAC;QAE9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;YAC9B,MAAM,EAAE,uBAAuB;YAC/B,WAAW,EAAE,SAAS;YACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;YAChC,QAAQ,EAAE;gBACR,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;gBAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;gBAC9B,eAAe,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM;gBAC5C,oBAAoB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,MAAM;aACvD;YACD,WAAW,EAAE,WAAW,IAAI,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SACjF,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,SAAiB,EACjB,IAA6B,EAC7B,OAAgB,EAChB,WAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,MAAM,YAAY,QAAQ;YAAE,OAAO,MAAM,CAAC;QAE9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAE9D,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;YAC9B,MAAM,EAAE,eAAe;YACvB,WAAW,EAAE,SAAS;YACtB,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;YAClC,QAAQ,EAAE;gBACR,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;gBAChC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;gBAChC,YAAY;gBACZ,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC1D,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,MAAM;aACjD;YACD,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS;YACxD,WAAW,EAAE,WAAW,IAAI,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SACjF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAkB,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7D,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF"}

package/dist/handlers/auth-handler.d.ts

@@ -11,8 +11,10 @@
  *   const caller = await auth.verifyFull(req);  // auth gate
  *   if (!caller) return auth.unauthorized(req);
  */
+import type { GetAccountState } from "../identity/account-state.js";
 import type { AuthEntrypointInterface } from "../identity/auth-entrypoint.js";
 import { type Logger } from "../logger.js";
+import type { AppInfo } from "../package-branding.js";
 import type { CallerIdentity } from "../types.js";
 export interface AuthHandlerOptions {
     /** D1 database binding. */
@@ -42,11 +44,7 @@ export interface AuthHandlerOptions {
      * `appSk` (the per-instance / standalone canonical secret). */
     csrfSecret?: string;
     /** Application info shown to the wallet during DID Connect. */
-    appInfo?: {
-        name: string;
-        description?: string;
-        icon?: string;
-    };
+    appInfo?: AppInfo;
     /** Resend API key for email verification. Optional — can also be configured via Admin Settings (D1 email:config). */
     resendApiKey?: string;
     /** From address for verification emails. Optional — can also be configured via Admin Settings (D1 email:config). */
@@ -100,6 +98,12 @@ export interface AuthHandlerOptions {
      * tests never touch the network; defaults to the global `fetch`.
      */
     cimdFetch?: typeof fetch;
+    /**
+     * Host-injected chain account-state lookup for wallet login. Optional:
+     * omitted → today's behaviour. Forwarded into DIDConnectHandler.
+     * Always invoked as `getAccountState({ address, traceMigration: false })`.
+     */
+    getAccountState?: GetAccountState;
 }
 /** Membership record from the memberships table. */
 export interface StoredMembership {
@@ -123,9 +127,12 @@ export interface AuthHandler {
      * Handle auth-related routes: passkey API, team API, admin/invite pages, logout.
      * Returns a Response if the route matched, or null to let the caller continue.
      * @param context Optional instance context — instanceDid is passed to team/access key handlers.
+     *   `isServiceContext` has always been honored by the implementation; declaring it
+     *   here spares callers a cast to `Parameters<typeof route>[1]` to pass it.
      */
     route(request: Request, context?: {
         instanceDid?: string;
+        isServiceContext?: boolean;
     }): Promise<Response | null>;
     /** Verify JWT from cookie — lightweight, no DB query. */
     verify(request: Request): Promise<CallerIdentity | null>;

package/dist/handlers/auth-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-handler.d.ts","sourceRoot":"","sources":["../../src/handlers/auth-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAM9E,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAI1D,OAAO,KAAK,EAAE,cAAc,EAAQ,MAAM,aAAa,CAAC;AAgBxD,MAAM,WAAW,kBAAkB;IACjC,2BAA2B;IAC3B,EAAE,EAAE,UAAU,CAAC;IACf,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;qEAEiE;IACjE,IAAI,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC;IAC/C,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;mEAI+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAGhE,qHAAqH;IACrH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oHAAoH;IACpH,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,yDAAyD;IACzD,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,0DAA0D;IAC1D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mGAAmG;IACnG,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,gFAAgF;IAChF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAG9B,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kGAAkG;IAClG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,CAAC;IAGvB;;iDAE6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAGhB,wCAAwC;IACxC,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd;6EACyE;IACzE,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC;IAGvD;;qFAEiF;IACjF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAGvB,yEAAyE;IACzE,WAAW,CAAC,EAAE,OAAO,CAAC;IAGtB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2DAA2D;AAC3D,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAEtF,yDAAyD;IACzD,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAEzD,mEAAmE;IACnE,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAE7D,2CAA2C;IAC3C,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEhD;;;;OAIG;IACH,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAElD;;;;OAIG;IACH,eAAe,CACb,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GACjC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAElC;;;;;;OAMG;IACH,aAAa,CACX,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;KAAE,GACxC,OAAO,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,GAAG;QAAE,MAAM,EAAE,cAAc,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAEvE;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAEtF;;;OAGG;IACH,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAErF;;OAEG;IACH,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAigC1E"}
+{"version":3,"file":"auth-handler.d.ts","sourceRoot":"","sources":["../../src/handlers/auth-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAM9E,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAGtD,OAAO,KAAK,EAAE,cAAc,EAAQ,MAAM,aAAa,CAAC;AAiBxD,MAAM,WAAW,kBAAkB;IACjC,2BAA2B;IAC3B,EAAE,EAAE,UAAU,CAAC;IACf,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;qEAEiE;IACjE,IAAI,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC;IAC/C,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;mEAI+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,OAAO,CAAC;IAGlB,qHAAqH;IACrH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oHAAoH;IACpH,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,yDAAyD;IACzD,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,0DAA0D;IAC1D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mGAAmG;IACnG,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,gFAAgF;IAChF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAG9B,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kGAAkG;IAClG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,CAAC;IAGvB;;iDAE6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAGhB,wCAAwC;IACxC,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd;6EACyE;IACzE,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC;IAGvD;;qFAEiF;IACjF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAGvB,yEAAyE;IACzE,WAAW,CAAC,EAAE,OAAO,CAAC;IAGtB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAEzB;;;;OAIG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2DAA2D;AAC3D,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,KAAK,CACH,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAAE,GAC7D,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAE5B,yDAAyD;IACzD,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAEzD,mEAAmE;IACnE,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAE7D,2CAA2C;IAC3C,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEhD;;;;OAIG;IACH,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAElD;;;;OAIG;IACH,eAAe,CACb,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GACjC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAElC;;;;;;OAMG;IACH,aAAa,CACX,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;KAAE,GACxC,OAAO,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,GAAG;QAAE,MAAM,EAAE,cAAc,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAEvE;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAEtF;;;OAGG;IACH,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAErF;;OAEG;IACH,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CA+iC1E"}

package/dist/handlers/auth-handler.js

@@ -26,6 +26,7 @@ import { buildHomepageHTML } from "../pages/homepage.js";
 import { D1Store } from "../store/d1-store.js";
 import { AccessKeyConnectHandler } from "./access-key-connect-handler.js";
 import { AccessKeyHandler } from "./access-key-handler.js";
+import { AccountMergeHandler } from "./account-merge-handler.js";
 import { AdminInstanceHandler } from "./admin-instance-handler.js";
 import { AvatarHandler } from "./avatar-handler.js";
 import { BlockletJsHandler } from "./blocklet-js-handler.js";
@@ -43,6 +44,7 @@ export function createAuthHandler(options) {
     const store = new D1Store(options.db, { readSession: options.readSession });
     const jwtExpiresIn = options.jwtExpiresIn ?? 7 * 24 * 60 * 60;
     const cookieName = options.cookieName ?? "login_token";
+    const appInfo = options.appInfo ?? { name: options.appName };
     const defaultInstanceDid = options.instanceDid
         || (options.appSk ? fromSecretKey(normalizeSecretKey(options.appSk), APP_WALLET_TYPE).address : undefined);
     // App wallet for signResponse — used to sign session/refresh responses
@@ -50,7 +52,7 @@ export function createAuthHandler(options) {
     const passkey = new Auth({
         store,
         jwtSecret: options.jwtSecret,
-        rpName: options.appName,
+        rpName: appInfo.name,
         rpID: options.rpID,
         jwtExpiresIn,
         cookieName,
@@ -63,7 +65,7 @@ export function createAuthHandler(options) {
         r2: options.r2,
         resendApiKey: options.resendApiKey,
         emailFrom: options.emailFrom,
-        rpName: options.appName,
+        rpName: appInfo.name,
         logger,
     });
     const accessKeys = new AccessKeyHandler({ store, passkey });
@@ -96,11 +98,12 @@ export function createAuthHandler(options) {
             jwtExpiresIn,
             cookieName,
             rpID: options.rpID,
-            appInfo: options.appInfo,
+            appInfo,
             r2: options.r2,
             delegator: options.federationDelegator,
             delegation: options.federationDelegation,
             logger,
+            getAccountState: options.getAccountState,
         })
         : null;
     // OAuth: enabled when appSk is provided (configs come from D1 settings)
@@ -119,6 +122,13 @@ export function createAuthHandler(options) {
             logger,
         })
         : null;
+    const accountMerge = new AccountMergeHandler({
+        store,
+        jwtSecret: options.jwtSecret,
+        cookieName,
+        logger,
+        appDid: defaultInstanceDid,
+    });
     // Email login: enabled when appSk is provided.
     // resendApiKey/emailFrom can come from env vars OR D1 email:config (resolved at runtime).
     const emailLogin = options.appSk
@@ -135,6 +145,7 @@ export function createAuthHandler(options) {
             authMaster: options.authMaster,
             r2: options.r2,
             logger,
+            appName: appInfo.name,
         })
         : null;
     // Ticket handler: always enabled (used for federation ticket exchange)
@@ -164,6 +175,7 @@ export function createAuthHandler(options) {
         r2: options.r2,
         instanceDid: defaultInstanceDid,
         rpName: options.appName,
+        appInfo,
         ogGenerator: options.ogGenerator,
     });
     // Avatar: deterministic avatar endpoint (R2 → DB URL → DID SVG fallback)
@@ -177,7 +189,7 @@ export function createAuthHandler(options) {
             appDid: options.appDid,
             instanceDid: defaultInstanceDid,
             serverVersion: options.serverVersion,
-            rpName: options.appName,
+            appInfo,
         })
         : null;
     // Build the static methods array; email is resolved dynamically at request time
@@ -197,9 +209,14 @@ export function createAuthHandler(options) {
         let configSourceDid = effectiveDid;
         let masterOAuthOrigin;
         let configSettings;
+        // Branding is read from the LOCAL instance even in federation — a member site
+        // shows its own name, only login *methods* and theme come from the Master
+        // (same rule passkey-handler's getLoginPage applies).
+        let localSettingsMap;
         if (effectiveDid) {
             const localSettings = await store.listSettings(effectiveDid);
             const localMap = new Map(localSettings.map((s) => [s.key, s.value]));
+            localSettingsMap = localMap;
             // Federation check (from local settings map — no extra D1 query)
             const fedRole = localMap.get("federation:role");
             const fedEnabled = localMap.get("federation:enabled");
@@ -291,14 +308,34 @@ export function createAuthHandler(options) {
             if (idx >= 0)
                 methods.splice(idx, 1);
         }
-        return { methods, oauthProviders, masterOAuthOrigin };
+        // The app's display name, resolved the SAME way every other surface resolves
+        // it: operator-stored `app:branding.name` first, then `appInfo.name` (which
+        // already carries the host-supplied package name and the deployment default).
+        //
+        // This is returned rather than left out because AccessKeyConnectHandler takes
+        // this object as its WHOLE page-options value. Omitting appName here is what
+        // made the authorize page fall through to its generic i18n title
+        // ("Access Key Authorization") on every deployment, no matter how the app was
+        // branded — a page that names the wrong app is exactly the prompt a user
+        // should refuse to approve.
+        let appName = appInfo.name;
+        const localBrandingRaw = localSettingsMap?.get("app:branding");
+        if (localBrandingRaw) {
+            try {
+                const b = JSON.parse(localBrandingRaw);
+                if (typeof b.name === "string" && b.name)
+                    appName = b.name;
+            }
+            catch { /* keep appInfo.name */ }
+        }
+        return { methods, oauthProviders, masterOAuthOrigin, appName };
     }
     /** Render the homepage portal page. */
     async function serveHomepage(request, instanceDid) {
         const locale = detectLocale(request);
         const theme = detectTheme(request);
-        let appName = options.appName ?? "DID Connect";
-        let appDescription = "";
+        let appName = appInfo.name;
+        let appDescription = appInfo.description ?? "";
         const version = options.serverVersion ?? "1.0.0";
         const brandingDid = instanceDid || defaultInstanceDid;
         if (brandingDid) {
@@ -347,6 +384,7 @@ export function createAuthHandler(options) {
             pathname.startsWith("/.well-known/service/api/team/profile/") ||
             pathname.startsWith("/.well-known/service/api/team/invitations/") ||
             pathname.startsWith("/.well-known/service/api/did/") ||
+            pathname.startsWith("/.well-known/service/api/wallet/") ||
             pathname.startsWith("/.well-known/service/api/passkey") ||
             pathname.startsWith("/.well-known/service/api/oauth") ||
             pathname.startsWith("/.well-known/service/oauth/") ||
@@ -364,7 +402,9 @@ export function createAuthHandler(options) {
             pathname === "/.well-known/service/oauth/authorize" ||
             pathname === "/.well-known/service/oauth/register" ||
             pathname === "/.well-known/service/oauth/device_authorization" ||
-            pathname === "/.well-known/service/oauth/token") {
+            pathname === "/.well-known/service/oauth/token" ||
+            // Dual-auth merge: /.well-known/service/api/account/merge/{candidate,start,dry-run,commit}
+            pathname.startsWith("/.well-known/service/api/account/merge")) {
             return true;
         }
         // Public team invitation endpoints — info is read-only and handler-authorized;
@@ -744,6 +784,12 @@ export function createAuthHandler(options) {
                     return jsonResponse({ ok: false, error: "DB unreachable" }, 503);
                 }
             }
+            // Account merge (dual-auth). Three routes: start / dry-run / commit.
+            {
+                const r = await accountMerge.fetch(request, instanceDid || defaultInstanceDid);
+                if (r)
+                    return r;
+            }
             // DID Connect routes (wallet auth via WalletHandlers + complete endpoint)
             if (didConnect) {
                 const r = await didConnect.fetch(request, instanceDid || defaultInstanceDid);