@antelopejs/dms 0.8.3 → 0.9.1

package/frontend-vue/dms.email.ts

@@ -1,7 +1,11 @@
 import type { Component } from "vue";
 import defaults from "./layers/dms-layout/app/app.config";
 
-/** Branding shared with transactional templates, without the browser module. */
+/**
+ * Branding shared with transactional templates, without the browser module.
+ * The loader merges the layout's app config into theirs as well; `branding`
+ * holds no array that the second merge would repeat.
+ */
 export const appConfig = { branding: defaults.branding };
 
 interface EmailModule {

package/frontend-vue/dms.frontend.ts

@@ -1,17 +1,17 @@
 import { defineAsyncComponent, type Component } from "vue";
 import {
   type DmsFrontendModule,
-  useDmsAppConfig,
   useDmsRuntimeConfig,
 } from "#dms/frontend-module";
-import { defu } from "defu";
-import appConfig from "./layers/dms-layout/app/app.config";
 import authMiddleware from "./layers/dms-auth/app/middleware/auth";
+import permissionsPreloadPlugin from "./layers/dms-auth/app/plugins/permissions-preload";
+import asyncDataScopePlugin from "./layers/dms-core/app/plugins/async-data-scope";
 import homepageRedirectMiddleware from "./layers/dms-layout/app/middleware/homepage-redirect.global";
 import moduleRoutingMiddleware from "./layers/dms-layout/app/middleware/module-routing.global";
 import pageLeaveGuardMiddleware from "./layers/dms-layout/app/middleware/page-leave-guard.global";
 import accessibilityPlugin from "./layers/dms-layout/app/plugins/accessibility";
 import colorModePlugin from "./layers/dms-layout/app/plugins/color-mode";
+import faviconPlugin from "./layers/dms-layout/app/plugins/favicon";
 import interfaceScalePlugin from "./layers/dms-layout/app/plugins/interface-scale";
 import fontPreloadPlugin from "./layers/dms-layout/app/plugins/font-preload";
 import permissionPreviewPrepaintPlugin from "./layers/dms-layout/app/plugins/permission-preview-prepaint";
@@ -19,6 +19,7 @@ import regionalPreferencesPlugin from "./layers/dms-layout/app/plugins/regional-
 import seoPlugin from "./layers/dms-layout/app/plugins/seo";
 import sidePanelHostPlugin from "./layers/dms-layout/app/plugins/side-panel-host";
 import onboardingMiddleware from "./layers/dms-onboarding/app/middleware/onboarding.global";
+import onboardingPreloadPlugin from "./layers/dms-onboarding/app/plugins/onboarding-preload";
 import registerPlugin from "./layers/dms-ui/app/plugins/register";
 import shortcutsPlugin from "./layers/dms-ui/app/plugins/shortcuts";
 import tableViewDisplaysPlugin from "./layers/dms-ui/app/plugins/table-view-displays";
@@ -164,6 +165,13 @@ function registerPlugins(sdk: Parameters<DmsFrontendModule["setup"]>[0]): void {
       await plugin.default(context);
     }, clientOnly);
   }
+  // Before any data is read: every key lives in the session's scope.
+  sdk.registerPlugin(asyncDataScopePlugin);
+  // First: the requests the middlewares wait on start with the app, alongside
+  // the ones the plugins below and the page make, instead of one after the
+  // other once the page has set up.
+  sdk.registerPlugin(onboardingPreloadPlugin);
+  sdk.registerPlugin(permissionsPreloadPlugin);
   sdk.registerPlugin(colorModePlugin);
   sdk.registerPlugin(permissionPreviewPrepaintPlugin);
   sdk.registerPlugin(fontPreloadPlugin);
@@ -171,6 +179,7 @@ function registerPlugins(sdk: Parameters<DmsFrontendModule["setup"]>[0]): void {
   sdk.registerPlugin(accessibilityPlugin);
   sdk.registerPlugin(regionalPreferencesPlugin);
   sdk.registerPlugin(seoPlugin);
+  sdk.registerPlugin(faviconPlugin);
   sdk.registerPlugin(sidePanelHostPlugin);
   sdk.registerPlugin(registerPlugin);
   sdk.registerPlugin(shortcutsPlugin);
@@ -195,12 +204,13 @@ function registerMiddleware(
 
 const frontendModule: DmsFrontendModule = {
   componentPrefix: "Dms",
+  // The layout's app config is not merged here: the loader applies every
+  // layer's `app/app.config.ts` before any module is set up, and a second
+  // merge would repeat the arrays defu concatenates.
   setup(sdk) {
     const runtimeDms = (useDmsRuntimeConfig().public as DmsPublicOptions).dms;
     if (runtimeDms && typeof window !== "undefined")
       runtimeDms.baseURL = window.location.origin;
-    const runtimeAppConfig = useDmsAppConfig();
-    Object.assign(runtimeAppConfig, defu(runtimeAppConfig, appConfig));
     registerPlugins(sdk);
     registerMiddleware(sdk);
     registerComponents(sdk);

package/frontend-vue/dms.server.ts

@@ -0,0 +1,74 @@
+import { defineDmsServer } from "#dms/server";
+import * as actions from "./layers/dms-auth/server/actions";
+import * as oauth from "./layers/dms-auth/server/oauth";
+import * as session from "./layers/dms-auth/server/session";
+import { renderHtml } from "./layers/dms-layout/server/html-render";
+
+// What the DMS serves from the frontend server: its session, sign-in and
+// provider sign-in routes, the session logic the server runs outside them,
+// the e-mail render the backend asks for, and the backend prefixes the
+// browser reaches through it. The renderer proxies no path on its own.
+export default defineDmsServer((server) => {
+  // The backend's API and the DMS's own routes (menu, page, page layouts,
+  // permissions, realtime), with the session's token added server-side.
+  server.registerBackendProxy("/api/**");
+  server.registerBackendProxy("/dms/**");
+
+  server.registerRoute("GET", "/api/_auth/session", session.readSessionRoute);
+  server.registerRoute(
+    "POST",
+    "/api/_auth/session",
+    session.refreshSessionRoute,
+  );
+  server.registerRoute("DELETE", "/api/_auth/session", session.logoutRoute);
+  server.registerRoute(
+    ["HEAD", "PUT", "PATCH", "OPTIONS"],
+    "/api/_auth/session",
+    session.sessionMethodNotAllowed,
+    { sameOrigin: false },
+  );
+
+  server.registerRoute("POST", "/auth/login", actions.login);
+  server.registerRoute("POST", "/auth/register", actions.signup);
+  server.registerRoute("POST", "/auth/verify-2fa", actions.verifyTwoFactor);
+  server.registerRoute(
+    "POST",
+    "/auth/request-2fa-email",
+    actions.requestTwoFactorEmail,
+  );
+  server.registerRoute("POST", "/auth/establish", actions.establish);
+  server.registerRoute("POST", "/auth/switch-account", actions.switchAccount);
+  server.registerRoute("POST", "/auth/switch-tenant", actions.switchTenant);
+  server.registerRoute(
+    "POST",
+    "/auth/validate-account",
+    actions.validateAccount,
+  );
+  server.registerRoute(
+    "POST",
+    "/auth/remove-account",
+    actions.removeStoredAccount,
+  );
+
+  server.registerRoute("GET", "/auth/oauth/:provider/start", oauth.oauthStart);
+  server.registerRoute(
+    "GET",
+    "/auth/oauth/:provider/callback",
+    oauth.oauthCallback,
+  );
+  server.registerRoute("POST", "/auth/oauth/handoff", oauth.oauthHandoff);
+
+  server.registerAuth({
+    signInPath: "/auth",
+    signInExempt: ["/auth/**", "/onboarding"],
+    refreshSession: session.renewSession,
+    publicSession: session.publicSession,
+  });
+
+  // The backend authenticates with a single-use service token, not a
+  // browser session, and its default `renderEndpoint` names this path.
+  server.registerRoute("POST", "/api/html/render", renderHtml, {
+    sameOrigin: false,
+    overridesBackend: true,
+  });
+});

package/frontend-vue/layers/dms-auth/app/composables/useLogout.ts

@@ -13,7 +13,7 @@ const FALLBACK_AUTH_ROUTE = "/auth";
  * Any "Preview as role" state goes too.
  */
 export function useLogout() {
-  const { user, clear: clearSession } = useUserSession<User>();
+  const { user, clear: clearSession } = useDmsUserSession<User>();
   const { accounts, removeAccount } = useMultiAccount();
   const { purge: purgePermissionPreviews } = usePermissionPreview();
 

package/frontend-vue/layers/dms-auth/app/composables/usePostLoginRedirect.ts

@@ -1,9 +1,22 @@
 type PostLoginDestination = string | (() => string | undefined);
 
+interface PostLoginRedirectOptions {
+  /**
+   * Open the destination in place of the current page in the history. For a
+   * page that consumed a one-time sign-in token (the OAuth completion, the
+   * second factor): back on it, the user would only meet a dead token, or a
+   * page sending them forward again.
+   */
+  replace?: boolean;
+}
+
 /** Refresh authenticated state before resolving and opening the destination. */
-export async function usePostLoginRedirect(redirectUrl?: PostLoginDestination) {
+export async function usePostLoginRedirect(
+  redirectUrl?: PostLoginDestination,
+  options: PostLoginRedirectOptions = {},
+) {
   const dmsApp = useDmsApp();
-  const { fetch: refreshUser, user } = useUserSession();
+  const { fetch: refreshUser, user } = useDmsUserSession();
   const { addCurrentAccount } = useMultiAccount();
   const siteLayout = useSiteLayout();
   const homepage = useHomepage();
@@ -24,5 +37,5 @@ export async function usePostLoginRedirect(redirectUrl?: PostLoginDestination) {
 
   const destination =
     typeof redirectUrl === "function" ? redirectUrl() : redirectUrl;
-  await navigateDms(destination || homepage);
+  await navigateDms(destination || homepage, options);
 }

package/frontend-vue/layers/dms-auth/app/custom-pages/auth/2fa.vue

@@ -115,7 +115,9 @@ async function verify() {
       },
     });
 
-    await usePostLoginRedirect();
+    // The sign-in token in this page's URL is spent: the destination takes
+    // its place in the history.
+    await usePostLoginRedirect(undefined, { replace: true });
   } catch (error: unknown) {
     pin.value = [];
     await showError(error, "page.2fa.error_title", {

package/frontend-vue/layers/dms-auth/app/custom-pages/auth/backup.vue

@@ -63,7 +63,9 @@ async function onSubmit(payload: FormSubmitEvent<Schema>) {
       },
     });
 
-    await usePostLoginRedirect();
+    // The sign-in token in this page's URL is spent: the destination takes
+    // its place in the history.
+    await usePostLoginRedirect(undefined, { replace: true });
   } catch (error: unknown) {
     // A wrong code shows under the field; an expired sign-in above the form.
     await showError(error, "page.backup.error_title", {

package/frontend-vue/layers/dms-auth/app/custom-pages/auth/forgot-validation.vue

@@ -19,7 +19,7 @@ const { formError, showFormError, clearFormError, showError } =
   useAuthFormError();
 
 if (!route.query.email) {
-  throw createError({
+  throw createDmsError({
     statusCode: HTTP_BAD_REQUEST,
     statusMessage: INVALID_REQUEST,
     message: "Missing required email parameter",

package/frontend-vue/layers/dms-auth/app/custom-pages/auth/oauth-complete.vue

@@ -2,6 +2,7 @@
 import { type OAuthHandoff, sanitizeRedirectPath } from "../../../shared/oauth";
 
 const OAUTH_FAILED_KEY = "error.oauth.failed";
+const IN_FLIGHT_COMPLETION_KEY = "__dmsInFlightOAuthCompletion";
 
 const route = useDmsRoute();
 const homepage = useHomepage();
@@ -39,7 +40,7 @@ const HANDOFF_ACTIONS: HandoffActions = {
       },
       REPLACE,
     ),
-  none: () => usePostLoginRedirect(redirect.value),
+  none: () => usePostLoginRedirect(redirect.value, REPLACE),
 };
 
 function runHandoffAction(handoff: OAuthHandoff): unknown {
@@ -56,7 +57,7 @@ function redirectToLoginWithError(): unknown {
   );
 }
 
-onMounted(async () => {
+async function completeOAuth(): Promise<void> {
   try {
     const handoff = await $fetch<OAuthHandoff>("/auth/oauth/handoff", {
       method: "POST",
@@ -65,7 +66,29 @@ onMounted(async () => {
   } catch {
     await dmsApp.runWithContext(() => redirectToLoginWithError());
   }
-});
+}
+
+// One completion per visit, held on the DMS app rather than by this instance.
+// The post-login redirect refreshes the site layout for the new identity,
+// which empties the page layout cache: the page unmounts this component and
+// mounts a new one while its layout is fetched again. Starting over from that
+// mount consumed the handoff once more and refreshed again, so the page
+// remounted in a loop instead of leaving. The new instance joins the running
+// completion; a later visit, once it has settled, starts its own.
+function joinCompletion(): Promise<void> {
+  const holder = dmsApp as unknown as Record<PropertyKey, unknown>;
+  const running = holder[IN_FLIGHT_COMPLETION_KEY] as Promise<void> | undefined;
+  if (running) return running;
+  const completion = completeOAuth().finally(() => {
+    if (holder[IN_FLIGHT_COMPLETION_KEY] === completion) {
+      holder[IN_FLIGHT_COMPLETION_KEY] = undefined;
+    }
+  });
+  holder[IN_FLIGHT_COMPLETION_KEY] = completion;
+  return completion;
+}
+
+onMounted(joinCompletion);
 </script>
 
 <template>

package/frontend-vue/layers/dms-auth/app/custom-pages/auth/recover.vue

@@ -23,7 +23,7 @@ const { formError, clearFormError, showError } = useAuthFormError();
 const form = useTemplateRef<AuthFormHandle>("form");
 
 if (!route.query.token || !route.query.email) {
-  throw createError({
+  throw createDmsError({
     statusCode: HTTP_BAD_REQUEST,
     statusMessage: INVALID_REQUEST,
     message: "Missing required authentication parameters",

package/frontend-vue/layers/dms-auth/app/custom-pages/auth/signup.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { onMounted, useTemplateRef } from "vue";
+import { useTemplateRef } from "vue";
 import * as z from "zod";
 import type { FormSubmitEvent } from "@nuxt/ui";
 import StageCard from "../../../../dms-layout/app/build/components/layout/StageCard.vue";
@@ -78,7 +78,6 @@ const config = useDmsRuntimeConfig();
 const homepage = useHomepage();
 const dmsApp = useDmsApp();
 const { formError, clearFormError, showError } = useAuthFormError();
-const { $authFetch } = useAuthFetch();
 const form = useTemplateRef<AuthFormHandle>("form");
 
 const route = useDmsRoute();
@@ -91,34 +90,32 @@ const hasInvitationToken = computed(
   () => typeof queryToken.value === "string" && queryToken.value !== "",
 );
 
-const invitationState = ref<InvitationState>(
-  hasInvitationToken.value ? "checking" : "invalid",
+// A revoked, replaced or expired link says so as the page opens, rather than
+// after the whole form was filled: checked with the page, so the server
+// renders the notice. The server answers with the very check the signup
+// runs; any other failure leaves the form to the signup to settle.
+const invitationCheck = useApiData(
+  () => (hasInvitationToken.value ? "/api/auth/validate-invite-token" : null),
+  {
+    method: "POST",
+    body: () => ({ token: queryToken.value, email: queryEmail.value }),
+  },
 );
+// The invitation can be retired while the form is open: the signup says so.
+const closedOnSignup = ref<ClosedInvitation>();
+const invitationState = computed<InvitationState>(() => {
+  if (!hasInvitationToken.value) return "invalid";
+  if (closedOnSignup.value) return closedOnSignup.value;
+  const { status, error } = invitationCheck;
+  if (status.value === "idle" || status.value === "pending") return "checking";
+  return error.value ? (closedInvitationOf(error.value) ?? "open") : "open";
+});
 const closedInvitation = computed(() =>
   invitationState.value in CLOSED_INVITATION_NOTICES
     ? CLOSED_INVITATION_NOTICES[invitationState.value as ClosedInvitation]
     : undefined,
 );
 
-// A revoked, replaced or expired link says so as the page opens, rather than
-// after the whole form was filled. The server answers with the very check the
-// signup runs; any other failure leaves the form to the signup to settle.
-async function checkInvitation(): Promise<void> {
-  try {
-    await $authFetch("/api/auth/validate-invite-token", {
-      method: "POST",
-      body: { token: queryToken.value, email: queryEmail.value },
-    });
-    invitationState.value = "open";
-  } catch (error: unknown) {
-    invitationState.value = closedInvitationOf(error) ?? "open";
-  }
-}
-
-onMounted(() => {
-  if (invitationState.value === "checking") void checkInvitation();
-});
-
 // The invitation link carries the language the invitee was invited in: the
 // page opens in it, and the footer switcher still lets them pick another one
 // before the account is created with whichever is current.
@@ -149,7 +146,7 @@ async function onSubmit(payload: FormSubmitEvent<Schema>) {
     isLoading.value = true;
     clearFormError();
 
-    await $fetch("/auth/signup", {
+    await $fetch("/auth/register", {
       method: "POST",
       body: {
         ...payload.data,
@@ -167,7 +164,7 @@ async function onSubmit(payload: FormSubmitEvent<Schema>) {
     // The invitation can be retired while the form is open.
     const closed = closedInvitationOf(error);
     if (closed) {
-      invitationState.value = closed;
+      closedOnSignup.value = closed;
       return;
     }
     // A refused value (an address already used) shows under its field;

package/frontend-vue/layers/dms-auth/app/custom-pages/auth/validate.vue

@@ -19,7 +19,7 @@ const { formError, showFormError, clearFormError, showError } =
   useAuthFormError();
 
 if (!route.query.id) {
-  throw createError({
+  throw createDmsError({
     statusCode: HTTP_BAD_REQUEST,
     statusMessage: INVALID_REQUEST,
     message: "Missing required id parameter",

package/frontend-vue/layers/dms-auth/app/middleware/auth.ts

@@ -10,12 +10,10 @@ function isAuthOptions(value: MiddlewareMeta): value is AuthMiddlewareOptions {
 }
 
 async function loadPermissionsIfNeeded() {
-  const { isLoaded, fetchPermissions } = usePermissions();
-
-  if (isLoaded.value) return;
+  const { loadPermissions } = usePermissions();
 
   try {
-    await fetchPermissions();
+    await loadPermissions();
   } catch {
     /* ignore — permissions load failure is not fatal here */
   }
@@ -26,7 +24,7 @@ function handleAuthenticatedUser(
   options: MiddlewareMeta,
 ) {
   const authConfig = useDmsRuntimeConfig().public.dms;
-  const { user } = useUserSession();
+  const { user } = useDmsUserSession();
 
   if (authConfig.mustValidateEmail && !user.value?.isValidated) {
     if (to.path === "/auth/validate") return;
@@ -76,14 +74,14 @@ export default defineDmsMiddleware(async (to) => {
   // is committed and rendered with its own status. Re-throwing it here would
   // reject the pending navigation the SSR render awaits, turning that 404 into
   // a 500 fallback render.
-  if (useError().value) return abortNavigation();
+  if (useDmsError().value) return abortDmsNavigation();
 
   const options = to.meta.auth as MiddlewareMeta | undefined;
   if (!options) return;
 
   if (await isPublicAccessRoute(to)) return;
 
-  const { loggedIn } = useUserSession();
+  const { loggedIn } = useDmsUserSession();
 
   if (loggedIn.value) {
     await loadPermissionsIfNeeded();

package/frontend-vue/layers/dms-auth/app/plugins/permissions-preload.ts

@@ -0,0 +1,17 @@
+/**
+ * Loads the permission set as the app starts when the `auth` middleware will
+ * need it, rather than once the middlewares ahead of it are done: the request
+ * runs alongside the others the render makes, and the middleware joins it.
+ *
+ * Only then: a signed-in user opening a registered page that is not public,
+ * which is when the middleware loads the set. Anywhere else nothing is asked
+ * that was not asked before. A failure stays the middleware's to handle.
+ */
+export default defineDmsPlugin(() => {
+  if (!useDmsUserSession().loggedIn.value) return;
+  const page = useSiteLayout().findMatchingRoute(useDmsRoute().path);
+  if (!page || page.metadata.publicAccess === true) return;
+  usePermissions()
+    .loadPermissions()
+    .catch(() => undefined);
+});

package/frontend-vue/layers/dms-auth/server/accounts.ts

@@ -0,0 +1,135 @@
+import { randomUUID } from "node:crypto";
+import type { DmsServerEvent, DmsSession } from "#dms/server";
+
+/**
+ * The accounts this browser is signed in to: an index of their descriptors,
+ * and one sealed cookie per account holding its refresh token. The frontend
+ * server scopes and seals the cookies; their names and contents are the DMS's,
+ * unchanged from when the renderer wrote them, so stored accounts survive the
+ * move.
+ */
+
+const ACCOUNT_INDEX_COOKIE = "dms_account_index";
+const ACCOUNT_COOKIE_PREFIX = "dms_account_";
+const MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
+const UUID =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+export interface AccountDescriptor {
+  accountId: string;
+  userId?: string;
+  email?: string;
+  name?: string;
+  activeTenantId?: string;
+  persistent: boolean;
+}
+
+export interface StoredAccount extends AccountDescriptor {
+  refreshToken?: string;
+}
+
+type AccountIndex = Record<string, AccountDescriptor>;
+
+interface SessionUser {
+  _id?: string;
+  id?: string;
+  email?: string;
+  name?: string;
+}
+
+/**
+ * Whether a session, or a stored account, outlives the browser. Only a login
+ * that left "keep me signed in" unchecked says no; a cookie written before
+ * the flag existed carries none, and keeps the lifetime it was given then.
+ */
+export function isPersistent(session?: { persistent?: unknown }): boolean {
+  return session?.persistent !== false;
+}
+
+function lifetime(persistent: boolean): number | undefined {
+  return persistent ? MAX_AGE_SECONDS : undefined;
+}
+
+function accountCookieName(accountId: string): string {
+  if (!UUID.test(accountId)) throw new Error("Invalid account id");
+  return `${ACCOUNT_COOKIE_PREFIX}${accountId.replaceAll("-", "")}`;
+}
+
+function descriptor(session: DmsSession, accountId: string): AccountDescriptor {
+  const user = (session.user ?? {}) as SessionUser;
+  return {
+    accountId,
+    userId: user._id ?? user.id,
+    email: user.email,
+    name: user.name,
+    activeTenantId: session.activeTenantId,
+    persistent: isPersistent(session),
+  };
+}
+
+export function readAccounts(event: DmsServerEvent): AccountIndex {
+  return event.cookies.readSealed<AccountIndex>(ACCOUNT_INDEX_COOKIE) ?? {};
+}
+
+function writeAccountIndex(event: DmsServerEvent, accounts: AccountIndex) {
+  const persistent = Object.values(accounts).some(isPersistent);
+  event.cookies.writeSealed(ACCOUNT_INDEX_COOKIE, accounts, {
+    maxAge: lifetime(persistent),
+  });
+}
+
+export function readAccount(
+  event: DmsServerEvent,
+  accountId: unknown,
+): StoredAccount | undefined {
+  if (typeof accountId !== "string" || !UUID.test(accountId)) return undefined;
+  return event.cookies.readSealed<StoredAccount>(accountCookieName(accountId));
+}
+
+export function storeAccount(
+  event: DmsServerEvent,
+  session: DmsSession,
+  accountId?: string,
+): AccountDescriptor {
+  const id = accountId ?? randomUUID();
+  const account = descriptor(session, id);
+  writeAccountIndex(event, { ...readAccounts(event), [id]: account });
+  event.cookies.writeSealed(
+    accountCookieName(id),
+    { refreshToken: session.refreshToken, ...account },
+    { maxAge: lifetime(account.persistent) },
+  );
+  return account;
+}
+
+function assertAccountInvariant(session: DmsSession, accountId: string) {
+  if (!accountId || session.accountId !== accountId)
+    throw new Error("Account session invariant violated");
+}
+
+/**
+ * Write `session` as the current one, and as one of the stored accounts. The
+ * frontend server stamps it with `updatedAt`, which lets the browser tell a
+ * page fetched before this write, and restored from its cache, from a
+ * current one.
+ */
+export function persistAccountSession(
+  event: DmsServerEvent,
+  session: DmsSession,
+  accountId?: string,
+): AccountDescriptor {
+  const id = accountId ?? session.accountId ?? randomUUID();
+  session.accountId = id;
+  const account = storeAccount(event, session, id);
+  assertAccountInvariant(session, account.accountId);
+  event.session.write(session);
+  return account;
+}
+
+export function removeAccount(event: DmsServerEvent, accountId: unknown) {
+  const accounts = { ...readAccounts(event) };
+  if (typeof accountId === "string") delete accounts[accountId];
+  writeAccountIndex(event, accounts);
+  if (typeof accountId === "string" && UUID.test(accountId))
+    event.cookies.clear(accountCookieName(accountId));
+}