fix: authorize verified offline data sync

node-agent/WxAgent.Core/AccountBindingMatcher.cs

@@ -29,5 +29,15 @@ public static class AccountBindingMatcher
             : new AccountMatch(null, nicknameMatches.Length == 0 ? "none" : "nickname", false);
     }
 
+    public static bool IsUniquelyMatchedToAccount(
+        string expectedAccountId,
+        UiAccountIdentity boundIdentity,
+        IReadOnlyList<DatabaseAccountIdentity> databaseAccounts)
+    {
+        if (string.IsNullOrWhiteSpace(expectedAccountId)) return false;
+        var match = Match(boundIdentity, databaseAccounts);
+        return match.IsMatched && string.Equals(match.AccountId, expectedAccountId, StringComparison.OrdinalIgnoreCase);
+    }
+
     private static string? Normalize(string? value) => string.IsNullOrWhiteSpace(value) ? null : value.Trim();
 }

node-agent/WxAgent.Core/RemoteAccountContext.cs

@@ -17,6 +17,29 @@ public sealed class RemoteAccountContext
         get { lock (_gate) return _snapshot; }
     }
 
+    public static string? SelectActiveAccountId(
+        bool uiSessionAvailable,
+        string? preferredAccountId,
+        IReadOnlyCollection<RemoteAccountIdentity> identities,
+        IReadOnlyCollection<string> liveBoundAccountIds)
+    {
+        ArgumentNullException.ThrowIfNull(identities);
+        ArgumentNullException.ThrowIfNull(liveBoundAccountIds);
+        if (!uiSessionAvailable) return null;
+
+        var liveBoundIds = liveBoundAccountIds.ToHashSet(StringComparer.OrdinalIgnoreCase);
+        var eligible = identities
+            .Where(identity => identity.Verified && liveBoundIds.Contains(identity.AccountId))
+            .ToArray();
+        if (!string.IsNullOrWhiteSpace(preferredAccountId))
+        {
+            var preferred = eligible.FirstOrDefault(identity =>
+                string.Equals(identity.AccountId, preferredAccountId, StringComparison.OrdinalIgnoreCase));
+            if (preferred is not null) return preferred.AccountId;
+        }
+        return eligible.Length == 1 ? eligible[0].AccountId : null;
+    }
+
     public RemoteAccountContextSnapshot SwitchTo(
         string accountId,
         IReadOnlyCollection<RemoteAccountIdentity> identities,