@lvce-editor/auth-worker 3.15.0 → 3.16.1

package/dist/authWorkerMain.js

@@ -543,6 +543,9 @@ const restoreExistingError = (error, currentStack) => {
 };
 const restoreMethodNotFoundError = (error, currentStack) => {
   const restoredError = new JsonRpcError(error.message);
+  Object.assign(restoredError, {
+    code: error.code
+  });
   const parentStack = getParentStack(error);
   setStack(restoredError, `${parentStack}${NewLine}${currentStack}`);
   return restoredError;
@@ -562,9 +565,13 @@ const applyDataProperties = (restoredError, error) => {
     // @ts-ignore
     restoredError.codeFrame = error.data.codeFrame;
   }
-  if (error.data.code) {
+  if (typeof error.data.code === 'string' || typeof error.data.code === 'number') {
     // @ts-ignore
-    restoredError.code = error.data.code;
+    Object.defineProperty(restoredError, 'code', {
+      configurable: true,
+      value: error.data.code,
+      writable: true
+    });
   }
   if (error.data.type) {
     // @ts-ignore
@@ -585,7 +592,14 @@ const applyDirectProperties = (restoredError, error) => {
   }
 };
 const restoreMessageError = (error, _currentStack) => {
-  const restoredError = constructError(error.message, error.type, error.name);
+  const restoredError = constructError(error.message, error.type || error.data?.type, error.name);
+  if (typeof error.code === 'string' || typeof error.code === 'number') {
+    Object.defineProperty(restoredError, 'code', {
+      configurable: true,
+      value: error.code,
+      writable: true
+    });
+  }
   if (error.data) {
     applyDataProperties(restoredError, error);
   } else {
@@ -593,6 +607,23 @@ const restoreMessageError = (error, _currentStack) => {
   }
   return restoredError;
 };
+const getFallbackMessage = error => {
+  if (error && typeof error.message === 'string' && error.message) {
+    return error.message;
+  }
+  if (error && error.data) {
+    return getFallbackMessage(error.data);
+  }
+  const stringified = String(error);
+  if (stringified !== '[object Object]') {
+    return stringified;
+  }
+  try {
+    return JSON.stringify(error);
+  } catch {
+    return stringified;
+  }
+};
 const restoreJsonRpcError = error => {
   const currentStack = getCurrentStack();
   if (error && error instanceof Error) {
@@ -601,13 +632,13 @@ const restoreJsonRpcError = error => {
   if (error && error.code && error.code === MethodNotFound) {
     return restoreMethodNotFoundError(error, currentStack);
   }
+  if (error && error.error) {
+    return restoreJsonRpcError(error.error);
+  }
   if (error && error.message) {
     return restoreMessageError(error);
   }
-  if (typeof error === 'string') {
-    return new Error(`JsonRpc Error: ${error}`);
-  }
-  return new Error(`JsonRpc Error: ${error}`);
+  return new Error(`JsonRpc Error: ${getFallbackMessage(error)}`);
 };
 const unwrapJsonRpcResult = responseMessage => {
   if ('error' in responseMessage) {
@@ -664,9 +695,9 @@ const getErrorProperty = (error, prettyError) => {
   return {
     code: Custom,
     data: {
-      code: prettyError.code,
+      code: prettyError.code ?? error?.code,
       codeFrame: prettyError.codeFrame,
-      name: prettyError.name,
+      name: prettyError.name ?? error?.name,
       stack: getStack(prettyError),
       type: getErrorType(prettyError)
     },
@@ -701,7 +732,12 @@ const getErrorResponseSimple = (id, error) => {
   return {
     error: {
       code: Custom,
-      data: error,
+      data: error instanceof Error ? {
+        ...error,
+        code: 'code' in error ? error.code : undefined,
+        stack: error.stack,
+        type: error.name
+      } : error,
       // @ts-ignore
       message: error.message
     },
@@ -883,6 +919,9 @@ const logError = () => {
   // handled by renderer worker
 };
 const handleMessage = event => {
+  if (event.data === 'ready') {
+    return Promise.resolve();
+  }
   const actualRequiresSocket = event?.target?.requiresSocket || requiresSocket;
   const actualExecute = event?.target?.execute || execute;
   return handleJsonRpcMessage(event.target, event.data, actualExecute, event.target._resolve, preparePrettyError, logError, actualRequiresSocket);
@@ -1134,31 +1173,6 @@ const initializeOpenerWorker = async () => {
   set(rpc);
 };
 
-const state$3 = {
-  backendUrl: ''
-};
-const getAuthBackendUrl = () => {
-  return state$3.backendUrl;
-};
-const setAuthBackendUrl = backendUrl => {
-  state$3.backendUrl = backendUrl;
-};
-
-const state$2 = {
-  platform: Web
-};
-const getAuthPlatform = () => {
-  return state$2.platform;
-};
-const setAuthPlatform = value => {
-  state$2.platform = value;
-};
-
-const configure = options => {
-  setAuthBackendUrl(options.backendUrl);
-  setAuthPlatform(options.platform);
-};
-
 const millisecondsPerSecond = 1000;
 const getAccessTokenExpiresAt = (expiresIn, now = Date.now()) => {
   if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn) || expiresIn <= 0) {
@@ -1174,190 +1188,106 @@ const isAccessTokenValid = (accessToken, expiresAt, now = Date.now()) => {
   return Number.isFinite(expiresAtNumber) && expiresAtNumber > now;
 };
 
-const authStorageId = 'lvce-editor.auth';
-const deleteSecret = async key => {
-  await deleteSecret$1(authStorageId, key);
-};
-const getSecret = async key => {
-  return (await getSecret$1(authStorageId, key)) ?? '';
-};
-const storeSecret = async (key, value) => {
-  await storeSecret$1(authStorageId, key, value);
-};
-
-const databaseName = 'auth-worker';
-const objectStoreName = 'auth';
-const memoryStorage = new Map();
-const secretKeys = new Set(['accessToken', 'refreshToken']);
-const state$1 = {
-  databasePromise: undefined
-};
-
-// IndexedDB request objects are mutable browser primitives and cannot satisfy the readonly rule structurally.
-// eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types
-const requestToPromise = request => {
-  return new Promise((resolve, reject) => {
-    request.addEventListener('success', () => {
-      resolve(request.result);
-    });
-    request.addEventListener('error', () => {
-      reject(request.error ?? new Error('Persistent storage request failed.'));
+// One auth worker owns the registry. Serialize its storage transactions, not network requests.
+const createAccountSessions = storage => {
+  const state = {
+    tail: Promise.resolve()
+  };
+  const transact = operation => {
+    const previous = state.tail;
+    const result = (async () => {
+      await previous;
+      const value = await storage.read();
+      const registry = value ? JSON.parse(value) : {
+        accounts: [],
+        activeId: '',
+        revision: 0
+      };
+      return operation(registry);
+    })();
+    state.tail = (async () => {
+      try {
+        await result;
+      } catch {
+        // A rejected transaction must not block subsequent requests.
+      }
+    })();
+    return result;
+  };
+  const save = async registry => storage.write(JSON.stringify(registry));
+  const read = () => transact(async registry => registry);
+  const add = (account, revision) => transact(async registry => {
+    const accounts = [...registry.accounts.filter(item => item.id !== account.id), account];
+    const activeId = registry.revision === revision || !registry.activeId ? account.id : registry.activeId;
+    await save({
+      accounts,
+      activeId,
+      revision: registry.revision + 1
     });
   });
-};
-
-// eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types
-const transactionToPromise = transaction => {
-  return new Promise((resolve, reject) => {
-    transaction.addEventListener('complete', () => {
-      resolve();
-    });
-    transaction.addEventListener('abort', () => {
-      reject(transaction.error ?? new Error('Persistent storage transaction failed.'));
+  const select = id => transact(async registry => {
+    if (registry.accounts.every(account => account.id !== id)) {
+      throw new Error('Account is no longer available.');
+    }
+    await save({
+      ...registry,
+      activeId: id,
+      revision: registry.revision + 1
     });
-    transaction.addEventListener('error', () => {
-      reject(transaction.error ?? new Error('Persistent storage transaction failed.'));
+  });
+  const remove = id => transact(async registry => {
+    const accounts = registry.accounts.filter(account => account.id !== id);
+    const activeId = registry.activeId === id ? accounts[0]?.id || '' : registry.activeId;
+    await save({
+      accounts,
+      activeId,
+      revision: registry.revision + 1
     });
   });
-};
-const getDatabase = async () => {
-  if (typeof indexedDB === 'undefined') {
-    return undefined;
-  }
-  if (!state$1.databasePromise) {
-    state$1.databasePromise = new Promise((resolve, reject) => {
-      const request = indexedDB.open(databaseName, 1);
-      request.addEventListener('upgradeneeded', () => {
-        const database = request.result;
-        if (!database.objectStoreNames.contains(objectStoreName)) {
-          database.createObjectStore(objectStoreName);
-        }
-      });
-      request.addEventListener('success', () => {
-        resolve(request.result);
-      });
-      request.addEventListener('error', () => {
-        reject(request.error ?? new Error('Failed to open persistent auth storage.'));
-      });
+  const update = (account, session) => transact(async registry => {
+    // A logout or another login for this identity invalidates an old refresh result.
+    const accounts = registry.accounts.map(item => item.id === account.id && item.session.authRefreshToken === account.session.authRefreshToken ? {
+      ...item,
+      session
+    } : item);
+    await save({
+      ...registry,
+      accounts
     });
-  }
-  return state$1.databasePromise;
-};
-const getIndexedDbValue = async key => {
-  const database = await getDatabase();
-  if (!database) {
-    return memoryStorage.get(key) ?? '';
-  }
-  const transaction = database.transaction(objectStoreName, 'readonly');
-  const objectStore = transaction.objectStore(objectStoreName);
-  const value = await requestToPromise(objectStore.get(key));
-  return typeof value === 'string' ? value : '';
-};
-const setIndexedDbValue = async (key, value) => {
-  memoryStorage.set(key, value);
-  const database = await getDatabase();
-  if (!database) {
-    return;
-  }
-  const transaction = database.transaction(objectStoreName, 'readwrite');
-  const objectStore = transaction.objectStore(objectStoreName);
-  objectStore.put(value, key);
-  await transactionToPromise(transaction);
-};
-const clearIndexedDbValue = async key => {
-  memoryStorage.delete(key);
-  const database = await getDatabase();
-  if (!database) {
-    return;
-  }
-  const transaction = database.transaction(objectStoreName, 'readwrite');
-  const objectStore = transaction.objectStore(objectStoreName);
-  objectStore.delete(key);
-  await transactionToPromise(transaction);
-};
-const shouldUseSecretStorage = key => {
-  return getAuthPlatform() === Electron && secretKeys.has(key);
-};
-const getPersistentAuthValue = async key => {
-  if (!shouldUseSecretStorage(key)) {
-    return getIndexedDbValue(key);
-  }
-  const secret = await getSecret(key);
-  if (secret) {
-    return secret;
-  }
-  const legacyValue = await getIndexedDbValue(key);
-  if (!legacyValue) {
-    return '';
-  }
-  await storeSecret(key, legacyValue);
-  await clearIndexedDbValue(key);
-  return legacyValue;
-};
-const setPersistentAuthValue = async (key, value) => {
-  if (!shouldUseSecretStorage(key)) {
-    await setIndexedDbValue(key, value);
-    return;
-  }
-  if (value) {
-    await storeSecret(key, value);
-  } else {
-    await deleteSecret(key);
-  }
-  await clearIndexedDbValue(key);
-};
-const clearPersistentAuthValue = async key => {
-  if (shouldUseSecretStorage(key)) {
-    await Promise.all([deleteSecret(key), clearIndexedDbValue(key)]);
-    return;
-  }
-  await clearIndexedDbValue(key);
+  });
+  return {
+    add,
+    read,
+    remove,
+    select,
+    update
+  };
 };
 
-const callbackUrlKey = 'oidcCallbackUrl';
-const clientIdKey = 'oidcClientId';
-const pendingClientIdKey = 'pendingOidcClientId';
-const pendingCodeVerifierKey = 'pendingOidcCodeVerifier';
-const pendingRedirectUriKey = 'pendingOidcRedirectUri';
-const pendingStateKey = 'pendingOidcState';
-const clearOidcCallbackUrl = async () => {
-  await clearPersistentAuthValue(callbackUrlKey);
-};
-const clearStoredOidcClientId = async () => {
-  await clearPersistentAuthValue(clientIdKey);
-};
-const clearPendingOidcAuthState = async () => {
-  await Promise.all([clearPersistentAuthValue(pendingClientIdKey), clearPersistentAuthValue(pendingCodeVerifierKey), clearPersistentAuthValue(pendingRedirectUriKey), clearPersistentAuthValue(pendingStateKey)]);
+const state$4 = {
+  backendUrl: ''
 };
-const getOidcCallbackUrl = async () => {
-  return getPersistentAuthValue(callbackUrlKey);
+const getAuthBackendUrl = () => {
+  return state$4.backendUrl;
 };
-const getStoredOidcClientId = async () => {
-  return getPersistentAuthValue(clientIdKey);
+const setAuthBackendUrl = backendUrl => {
+  state$4.backendUrl = backendUrl;
 };
-const loadPendingOidcAuthState = async () => {
-  const [clientId, codeVerifier, redirectUri, state] = await Promise.all([getPersistentAuthValue(pendingClientIdKey), getPersistentAuthValue(pendingCodeVerifierKey), getPersistentAuthValue(pendingRedirectUriKey), getPersistentAuthValue(pendingStateKey)]);
-  if (!clientId || !codeVerifier || !redirectUri || !state) {
-    return undefined;
-  }
-  return {
-    clientId,
-    codeVerifier,
-    redirectUri,
-    state
-  };
+
+const state$3 = {
+  platform: Web
 };
-const saveOidcClientId = async clientId => {
-  await setPersistentAuthValue(clientIdKey, clientId);
+const getAuthPlatform = () => {
+  return state$3.platform;
 };
-const savePendingOidcAuthState = async value => {
-  await Promise.all([setPersistentAuthValue(pendingClientIdKey, value.clientId), setPersistentAuthValue(pendingCodeVerifierKey, value.codeVerifier), setPersistentAuthValue(pendingRedirectUriKey, value.redirectUri), setPersistentAuthValue(pendingStateKey, value.state)]);
+const setAuthPlatform = value => {
+  state$3.platform = value;
 };
 
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
   const NAME = 'oauth4webapi';
-  const VERSION = 'v3.8.7';
+  const VERSION = 'v3.8.8';
   USER_AGENT = `${NAME}/${VERSION}`;
 }
 function looseInstanceOf(input, expected) {
@@ -1711,9 +1641,7 @@ function parseWwwAuthenticateChallenges(response) {
         if (match = rest.match(quotedParamRE)) {
           [, key, value, rest] = match;
           if (value.includes('\\')) {
-            try {
-              value = JSON.parse(`"${value}"`);
-            } catch {}
+            value = value.replace(/\\([\s\S])/g, '$1');
           }
           parameters[key.toLowerCase()] = value;
           continue;
@@ -1847,7 +1775,7 @@ async function processGenericAccessTokenResponse(as, client, response, additiona
     assertString(json.id_token, '"response" body "id_token" property', INVALID_RESPONSE, {
       body: json
     });
-    const requiredClaims = ['aud', 'exp', 'iat', 'iss', 'sub'];
+    const requiredClaims = [];
     if (client.require_auth_time === true) {
       requiredClaims.push('auth_time');
     }
@@ -1858,27 +1786,9 @@ async function processGenericAccessTokenResponse(as, client, response, additiona
     const {
       claims,
       jwt
-    } = await validateJwt(json.id_token, checkSigningAlgorithm.bind(undefined, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported, 'RS256'), getClockSkew(client), getClockTolerance(client), decryptFn).then(validatePresence.bind(undefined, requiredClaims)).then(validateIssuer.bind(undefined, as)).then(validateAudience.bind(undefined, client.client_id));
-    if (Array.isArray(claims.aud) && claims.aud.length !== 1) {
-      if (claims.azp === undefined) {
-        throw OPE('ID Token "aud" (audience) claim includes additional untrusted audiences', JWT_CLAIM_COMPARISON, {
-          claims,
-          claim: 'aud'
-        });
-      }
-      if (claims.azp !== client.client_id) {
-        throw OPE('unexpected ID Token "azp" (authorized party) claim value', JWT_CLAIM_COMPARISON, {
-          expected: client.client_id,
-          claims,
-          claim: 'azp'
-        });
-      }
-    }
-    if (claims.auth_time !== undefined) {
-      assertNumber(claims.auth_time, true, 'ID Token "auth_time" (authentication time)', INVALID_RESPONSE, {
-        claims
-      });
-    }
+    } = await validateIdTokenClaims(as, client, json.id_token, requiredClaims, decryptFn);
+    validateIdTokenAuthorizedParty(client, claims);
+    validateIdTokenAuthTimeClaim(claims);
     jwtRefs.set(response, jwt);
     idTokenClaims.set(json, claims);
   }
@@ -1959,6 +1869,41 @@ function validatePresence(required, result) {
   }
   return result;
 }
+function validateStringClaim(claim, result) {
+  if (typeof result.claims[claim] !== 'string') {
+    throw OPE(`unexpected JWT "${claim}" (${jwtClaimNames[claim]}) claim type`, INVALID_RESPONSE, {
+      claims: result.claims
+    });
+  }
+  return result;
+}
+function validateIdTokenClaims(as, client, idToken, requiredClaims, decryptFn) {
+  return validateJwt(idToken, checkSigningAlgorithm.bind(undefined, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported, 'RS256'), getClockSkew(client), getClockTolerance(client), decryptFn).then(validatePresence.bind(undefined, ['aud', 'exp', 'iat', 'iss', 'sub', ...requiredClaims])).then(validateIssuer.bind(undefined, as)).then(validateAudience.bind(undefined, client.client_id)).then(validateStringClaim.bind(undefined, 'sub'));
+}
+function validateIdTokenAuthTimeClaim(claims) {
+  if (claims.auth_time !== undefined) {
+    assertNumber(claims.auth_time, true, 'ID Token "auth_time" (authentication time)', INVALID_RESPONSE, {
+      claims
+    });
+  }
+}
+function validateIdTokenAuthorizedParty(client, claims) {
+  if (Array.isArray(claims.aud) && claims.aud.length !== 1) {
+    if (claims.azp === undefined) {
+      throw OPE('ID Token "aud" (audience) claim includes additional untrusted audiences', JWT_CLAIM_COMPARISON, {
+        claims,
+        claim: 'aud'
+      });
+    }
+    if (claims.azp !== client.client_id) {
+      throw OPE('unexpected ID Token "azp" (authorized party) claim value', JWT_CLAIM_COMPARISON, {
+        expected: client.client_id,
+        claims,
+        claim: 'azp'
+      });
+    }
+  }
+}
 const WWW_AUTHENTICATE_CHALLENGE = 'OAUTH_WWW_AUTHENTICATE_CHALLENGE';
 const RESPONSE_BODY_ERROR = 'OAUTH_RESPONSE_BODY_ERROR';
 const UNSUPPORTED_OPERATION = 'OAUTH_UNSUPPORTED_OPERATION';
@@ -2175,89 +2120,32 @@ const getClient$1 = clientId => {
     client_id: clientId
   };
 };
-const refreshOidcTokens = async (backendUrl, clientId, refreshToken, requestTokenEndpoint = genericTokenEndpointRequest, processTokenEndpointResponse = processGenericTokenEndpointResponse) => {
+const exchangeAuthorizationCode = async (backendUrl, clientId, code, redirectUri, codeVerifier, requestTokenEndpoint = genericTokenEndpointRequest, processTokenEndpointResponse = processGenericTokenEndpointResponse) => {
   const authorizationServer = getAuthorizationServer$1(backendUrl);
   const client = getClient$1(clientId);
-  const response = await requestTokenEndpoint(authorizationServer, client, None(), 'refresh_token', new URLSearchParams({
-    refresh_token: refreshToken
+  const response = await requestTokenEndpoint(authorizationServer, client, None(), 'authorization_code', new URLSearchParams({
+    code,
+    code_verifier: codeVerifier,
+    redirect_uri: redirectUri
   }));
   const tokenResponse = await processTokenEndpointResponse(authorizationServer, client, response);
   return {
     accessToken: tokenResponse.access_token,
     expiresIn: typeof tokenResponse.expires_in === 'number' ? tokenResponse.expires_in : undefined,
-    refreshToken: typeof tokenResponse.refresh_token === 'string' ? tokenResponse.refresh_token : refreshToken
+    refreshToken: typeof tokenResponse.refresh_token === 'string' ? tokenResponse.refresh_token : ''
   };
 };
 
-const getAccessToken = async (options = {}, refreshTokens = refreshOidcTokens, now = Date.now()) => {
-  const [accessToken, accessTokenExpiresAt] = await Promise.all([getPersistentAuthValue('accessToken'), getPersistentAuthValue('accessTokenExpiresAt')]);
-  if (!options.refresh || options.refresh === 'if-needed' && isAccessTokenValid(accessToken, accessTokenExpiresAt, now)) {
-    return accessToken;
+const getCurrentHref = async () => {
+  try {
+    return await invoke('Layout.getHref');
+  } catch {
+    // ignore
   }
-  const [clientId, refreshToken] = await Promise.all([getStoredOidcClientId(), getPersistentAuthValue('refreshToken')]);
-  const backendUrl = getAuthBackendUrl();
-  if (!backendUrl || !clientId || !refreshToken) {
-    if (options.refresh === 'always') {
-      return '';
-    }
-    const expiresAt = Number(accessTokenExpiresAt);
-    return accessTokenExpiresAt && Number.isFinite(expiresAt) && expiresAt <= now ? '' : accessToken;
+  if (!globalThis.location || typeof globalThis.location.href !== 'string' || !globalThis.location.href) {
+    return '';
   }
-  const refreshedTokens = await refreshTokens(backendUrl, clientId, refreshToken);
-  const expiresAt = getAccessTokenExpiresAt(refreshedTokens.expiresIn, now);
-  await Promise.all([setPersistentAuthValue('accessToken', refreshedTokens.accessToken), setPersistentAuthValue('accessTokenExpiresAt', typeof expiresAt === 'number' ? String(expiresAt) : ''), setPersistentAuthValue('refreshToken', refreshedTokens.refreshToken)]);
-  return refreshedTokens.accessToken;
-};
-
-const handleMessagePort = async (port, rpcId) => {
-  const rpc = await create$4({
-    commandMap: commandMap,
-    isMessagePortOpen: true,
-    messagePort: port
-  });
-  if (rpcId) {
-    set$3(rpcId, rpc);
-  }
-};
-
-const getAuthorizationServer = backendUrl => {
-  return {
-    issuer: getBackendAuthUrl(backendUrl, '/oidc'),
-    jwks_uri: getBackendAuthUrl(backendUrl, '/oidc/jwks'),
-    token_endpoint: getBackendOidcTokenUrl(backendUrl)
-  };
-};
-const getClient = clientId => {
-  return {
-    client_id: clientId
-  };
-};
-const exchangeAuthorizationCode = async (backendUrl, clientId, code, redirectUri, codeVerifier, requestTokenEndpoint = genericTokenEndpointRequest, processTokenEndpointResponse = processGenericTokenEndpointResponse) => {
-  const authorizationServer = getAuthorizationServer(backendUrl);
-  const client = getClient(clientId);
-  const response = await requestTokenEndpoint(authorizationServer, client, None(), 'authorization_code', new URLSearchParams({
-    code,
-    code_verifier: codeVerifier,
-    redirect_uri: redirectUri
-  }));
-  const tokenResponse = await processTokenEndpointResponse(authorizationServer, client, response);
-  return {
-    accessToken: tokenResponse.access_token,
-    expiresIn: typeof tokenResponse.expires_in === 'number' ? tokenResponse.expires_in : undefined,
-    refreshToken: typeof tokenResponse.refresh_token === 'string' ? tokenResponse.refresh_token : ''
-  };
-};
-
-const getCurrentHref = async () => {
-  try {
-    return await invoke('Layout.getHref');
-  } catch {
-    // ignore
-  }
-  if (!globalThis.location || typeof globalThis.location.href !== 'string' || !globalThis.location.href) {
-    return '';
-  }
-  return globalThis.location.href;
+  return globalThis.location.href;
 };
 
 const getLoggedOutBackendAuthState = (authErrorMessage = '') => {
@@ -2298,6 +2186,188 @@ const getOidcUserName = async (backendUrl, accessToken, fetchFn = fetch) => {
   return typeof displayName === 'string' ? displayName : '';
 };
 
+const authStorageId = 'lvce-editor.auth';
+const deleteSecret = async key => {
+  await deleteSecret$1(authStorageId, key);
+};
+const getSecret = async key => {
+  return (await getSecret$1(authStorageId, key)) ?? '';
+};
+const storeSecret = async (key, value) => {
+  await storeSecret$1(authStorageId, key, value);
+};
+
+const databaseName = 'auth-worker';
+const objectStoreName = 'auth';
+const memoryStorage = new Map();
+const secretKeys = new Set(['accessToken', 'refreshToken', 'accountSessions']);
+const state$2 = {
+  databasePromise: undefined
+};
+
+// IndexedDB request objects are mutable browser primitives and cannot satisfy the readonly rule structurally.
+// eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types
+const requestToPromise = request => {
+  return new Promise((resolve, reject) => {
+    request.addEventListener('success', () => {
+      resolve(request.result);
+    });
+    request.addEventListener('error', () => {
+      reject(request.error ?? new Error('Persistent storage request failed.'));
+    });
+  });
+};
+
+// eslint-disable-next-line @typescript-eslint/prefer-readonly-parameter-types
+const transactionToPromise = transaction => {
+  return new Promise((resolve, reject) => {
+    transaction.addEventListener('complete', () => {
+      resolve();
+    });
+    transaction.addEventListener('abort', () => {
+      reject(transaction.error ?? new Error('Persistent storage transaction failed.'));
+    });
+    transaction.addEventListener('error', () => {
+      reject(transaction.error ?? new Error('Persistent storage transaction failed.'));
+    });
+  });
+};
+const getDatabase = async () => {
+  if (typeof indexedDB === 'undefined') {
+    return undefined;
+  }
+  if (!state$2.databasePromise) {
+    state$2.databasePromise = new Promise((resolve, reject) => {
+      const request = indexedDB.open(databaseName, 1);
+      request.addEventListener('upgradeneeded', () => {
+        const database = request.result;
+        if (!database.objectStoreNames.contains(objectStoreName)) {
+          database.createObjectStore(objectStoreName);
+        }
+      });
+      request.addEventListener('success', () => {
+        resolve(request.result);
+      });
+      request.addEventListener('error', () => {
+        reject(request.error ?? new Error('Failed to open persistent auth storage.'));
+      });
+    });
+  }
+  return state$2.databasePromise;
+};
+const getIndexedDbValue = async key => {
+  const database = await getDatabase();
+  if (!database) {
+    return memoryStorage.get(key) ?? '';
+  }
+  const transaction = database.transaction(objectStoreName, 'readonly');
+  const objectStore = transaction.objectStore(objectStoreName);
+  const value = await requestToPromise(objectStore.get(key));
+  return typeof value === 'string' ? value : '';
+};
+const setIndexedDbValue = async (key, value) => {
+  memoryStorage.set(key, value);
+  const database = await getDatabase();
+  if (!database) {
+    return;
+  }
+  const transaction = database.transaction(objectStoreName, 'readwrite');
+  const objectStore = transaction.objectStore(objectStoreName);
+  objectStore.put(value, key);
+  await transactionToPromise(transaction);
+};
+const clearIndexedDbValue = async key => {
+  memoryStorage.delete(key);
+  const database = await getDatabase();
+  if (!database) {
+    return;
+  }
+  const transaction = database.transaction(objectStoreName, 'readwrite');
+  const objectStore = transaction.objectStore(objectStoreName);
+  objectStore.delete(key);
+  await transactionToPromise(transaction);
+};
+const shouldUseSecretStorage = key => {
+  return getAuthPlatform() === Electron && secretKeys.has(key);
+};
+const getPersistentAuthValue = async key => {
+  if (!shouldUseSecretStorage(key)) {
+    return getIndexedDbValue(key);
+  }
+  const secret = await getSecret(key);
+  if (secret) {
+    return secret;
+  }
+  const legacyValue = await getIndexedDbValue(key);
+  if (!legacyValue) {
+    return '';
+  }
+  await storeSecret(key, legacyValue);
+  await clearIndexedDbValue(key);
+  return legacyValue;
+};
+const setPersistentAuthValue = async (key, value) => {
+  if (!shouldUseSecretStorage(key)) {
+    await setIndexedDbValue(key, value);
+    return;
+  }
+  if (value) {
+    await storeSecret(key, value);
+  } else {
+    await deleteSecret(key);
+  }
+  await clearIndexedDbValue(key);
+};
+const clearPersistentAuthValue = async key => {
+  if (shouldUseSecretStorage(key)) {
+    await Promise.all([deleteSecret(key), clearIndexedDbValue(key)]);
+    return;
+  }
+  await clearIndexedDbValue(key);
+};
+
+const callbackUrlKey = 'oidcCallbackUrl';
+const clientIdKey = 'oidcClientId';
+const pendingClientIdKey = 'pendingOidcClientId';
+const pendingCodeVerifierKey = 'pendingOidcCodeVerifier';
+const pendingRedirectUriKey = 'pendingOidcRedirectUri';
+const pendingReturnUrlKey = 'pendingOidcReturnUrl';
+const pendingStateKey = 'pendingOidcState';
+const clearOidcCallbackUrl = async () => {
+  await clearPersistentAuthValue(callbackUrlKey);
+};
+const clearStoredOidcClientId = async () => {
+  await clearPersistentAuthValue(clientIdKey);
+};
+const clearPendingOidcAuthState = async () => {
+  await Promise.all([clearPersistentAuthValue(pendingClientIdKey), clearPersistentAuthValue(pendingCodeVerifierKey), clearPersistentAuthValue(pendingRedirectUriKey), clearPersistentAuthValue(pendingReturnUrlKey), clearPersistentAuthValue(pendingStateKey)]);
+};
+const getOidcCallbackUrl = async () => {
+  return getPersistentAuthValue(callbackUrlKey);
+};
+const getStoredOidcClientId = async () => {
+  return getPersistentAuthValue(clientIdKey);
+};
+const loadPendingOidcAuthState = async () => {
+  const [clientId, codeVerifier, redirectUri, returnUrl, state] = await Promise.all([getPersistentAuthValue(pendingClientIdKey), getPersistentAuthValue(pendingCodeVerifierKey), getPersistentAuthValue(pendingRedirectUriKey), getPersistentAuthValue(pendingReturnUrlKey), getPersistentAuthValue(pendingStateKey)]);
+  if (!clientId || !codeVerifier || !redirectUri || !state) {
+    return undefined;
+  }
+  return {
+    clientId,
+    codeVerifier,
+    redirectUri,
+    returnUrl,
+    state
+  };
+};
+const saveOidcClientId = async clientId => {
+  await setPersistentAuthValue(clientIdKey, clientId);
+};
+const savePendingOidcAuthState = async value => {
+  await Promise.all([setPersistentAuthValue(pendingClientIdKey, value.clientId), setPersistentAuthValue(pendingCodeVerifierKey, value.codeVerifier), setPersistentAuthValue(pendingRedirectUriKey, value.redirectUri), setPersistentAuthValue(pendingReturnUrlKey, value.returnUrl), setPersistentAuthValue(pendingStateKey, value.state)]);
+};
+
 const normalizeRedirectUri = value => {
   const url = new URL(value);
   url.hash = '';
@@ -2352,18 +2422,139 @@ const completeBrowserOidcLogin = async backendUrl => {
   const authAccessTokenExpiresAt = getAccessTokenExpiresAt(exchanged.expiresIn);
   await clearPendingOidcAuthState();
   return {
-    authAccessToken: exchanged.accessToken,
-    ...(authAccessTokenExpiresAt && {
-      authAccessTokenExpiresAt
-    }),
-    authClientId: pendingAuthState.clientId,
-    authErrorMessage: '',
-    authRefreshToken: exchanged.refreshToken,
-    userName,
-    userState: exchanged.accessToken ? 'loggedIn' : 'loggedOut'
+    authAccessToken: exchanged.accessToken,
+    ...(authAccessTokenExpiresAt && {
+      authAccessTokenExpiresAt
+    }),
+    authClientId: pendingAuthState.clientId,
+    authErrorMessage: '',
+    authRefreshToken: exchanged.refreshToken,
+    userName,
+    userState: exchanged.accessToken ? 'loggedIn' : 'loggedOut'
+  };
+};
+
+const getAccountProfile = async (backendUrl, accessToken, fetchFn = fetch) => {
+  const response = await fetchFn(new URL('/account/me', backendUrl), {
+    headers: {
+      Accept: 'application/json',
+      Authorization: `Bearer ${accessToken}`
+    }
+  });
+  if (!response.ok) {
+    throw new Error('Unable to load the signed in account.');
+  }
+  const value = await response.json();
+  if (!value || typeof value.id !== 'string' || !value.id) {
+    throw new Error('The backend did not return an account identity.');
+  }
+  return {
+    displayName: typeof value.displayName === 'string' ? value.displayName : '',
+    email: typeof value.email === 'string' ? value.email : '',
+    id: value.id,
+    provider: typeof value.provider === 'string' ? value.provider : 'LVCE Editor'
+  };
+};
+
+const getBackendRefreshUrl = backendUrl => {
+  return getBackendAuthUrl(backendUrl, '/auth/refresh');
+};
+
+const delay = async ms => {
+  await new Promise(resolve => setTimeout(resolve, ms));
+};
+
+const state$1 = {
+  nextLoginResponse: undefined,
+  nextRefreshResponse: undefined
+};
+const setNextLoginResponse = response => {
+  state$1.nextLoginResponse = response;
+};
+const setNextRefreshResponse = response => {
+  state$1.nextRefreshResponse = response;
+};
+const clear = () => {
+  state$1.nextLoginResponse = undefined;
+  state$1.nextRefreshResponse = undefined;
+};
+const hasPendingMockLoginResponse = () => {
+  return !!state$1.nextLoginResponse;
+};
+const hasPendingMockRefreshResponse = () => {
+  return !!state$1.nextRefreshResponse;
+};
+const consumeNextLoginResponse = async () => {
+  if (!state$1.nextLoginResponse) {
+    return undefined;
+  }
+  const response = state$1.nextLoginResponse;
+  state$1.nextLoginResponse = undefined;
+  if (response.delay > 0) {
+    await delay(response.delay);
+  }
+  if (response.type === 'error') {
+    throw new Error(response.message);
+  }
+  return response.response;
+};
+const consumeNextRefreshResponse = async () => {
+  if (!state$1.nextRefreshResponse) {
+    return undefined;
+  }
+  const response = state$1.nextRefreshResponse;
+  state$1.nextRefreshResponse = undefined;
+  if (response.delay > 0) {
+    await new Promise(resolve => setTimeout(resolve, response.delay));
+  }
+  if (response.type === 'error') {
+    throw new Error(response.message);
+  }
+  return response.response;
+};
+
+const isObject = value => {
+  return !!value && typeof value === 'object';
+};
+
+const isBackendAuthResponse = value => {
+  return isObject(value);
+};
+
+const getNumber = (value, fallback = 0) => {
+  return typeof value === 'number' ? value : fallback;
+};
+
+const getString = (value, fallback = '') => {
+  return typeof value === 'string' ? value : fallback;
+};
+
+const getUserName = value => {
+  if (typeof value.userName === 'string') {
+    return value.userName;
+  }
+  return getString(value.user?.displayName);
+};
+const toBackendAuthState = value => {
+  return {
+    authAccessToken: getString(value.accessToken),
+    authErrorMessage: getString(value.error),
+    authRefreshToken: getString(value.refreshToken),
+    userName: getUserName(value),
+    userState: value.accessToken ? 'loggedIn' : 'loggedOut',
+    userSubscriptionPlan: getString(value.subscriptionPlan),
+    userSubscriptionStatus: getString(value.subscriptionStatus),
+    userUsedTokens: getNumber(value.usedTokens)
   };
 };
 
+const parseBackendAuthResponse = value => {
+  if (!isBackendAuthResponse(value)) {
+    return getLoggedOutBackendAuthState('Backend returned an invalid authentication response.');
+  }
+  return toBackendAuthState(value);
+};
+
 const accessTokenKey = 'accessToken';
 const accessTokenExpiresAtKey = 'accessTokenExpiresAt';
 const refreshTokenKey = 'refreshToken';
@@ -2436,6 +2627,32 @@ const persistLoginResult = async loginResult => {
   return loginResult;
 };
 
+const getAuthorizationServer = backendUrl => {
+  return {
+    issuer: getBackendAuthUrl(backendUrl, '/oidc'),
+    jwks_uri: getBackendAuthUrl(backendUrl, '/oidc/jwks'),
+    token_endpoint: getBackendOidcTokenUrl(backendUrl)
+  };
+};
+const getClient = clientId => {
+  return {
+    client_id: clientId
+  };
+};
+const refreshOidcTokens = async (backendUrl, clientId, refreshToken, requestTokenEndpoint = genericTokenEndpointRequest, processTokenEndpointResponse = processGenericTokenEndpointResponse) => {
+  const authorizationServer = getAuthorizationServer(backendUrl);
+  const client = getClient(clientId);
+  const response = await requestTokenEndpoint(authorizationServer, client, None(), 'refresh_token', new URLSearchParams({
+    refresh_token: refreshToken
+  }));
+  const tokenResponse = await processTokenEndpointResponse(authorizationServer, client, response);
+  return {
+    accessToken: tokenResponse.access_token,
+    expiresIn: typeof tokenResponse.expires_in === 'number' ? tokenResponse.expires_in : undefined,
+    refreshToken: typeof tokenResponse.refresh_token === 'string' ? tokenResponse.refresh_token : refreshToken
+  };
+};
+
 const clearStoredOidcAuth = async () => {
   await clearPersistedAuthSession();
 };
@@ -2474,163 +2691,6 @@ const restoreOidcAuth = async backendUrl => {
   }
 };
 
-const getBackendUrl = options => {
-  if (typeof options === 'number') {
-    return '';
-  }
-  return options.backendUrl || '';
-};
-const getPlatform = options => {
-  return typeof options === 'number' ? options : options.platform ?? Web;
-};
-const initialize = async options => {
-  const backendUrl = getBackendUrl(options);
-  configure({
-    backendUrl,
-    platform: getPlatform(options)
-  });
-  try {
-    if (backendUrl) {
-      const completedBrowserLogin = await completeBrowserOidcLogin(backendUrl);
-      if (completedBrowserLogin) {
-        return persistLoginResult(completedBrowserLogin);
-      }
-      const restoredOidcAuth = await restoreOidcAuth(backendUrl);
-      if (restoredOidcAuth) {
-        return persistLoginResult(restoredOidcAuth);
-      }
-    }
-    const persistedAuthSession = await getPersistedAuthSession();
-    if (persistedAuthSession) {
-      return persistedAuthSession;
-    }
-    return getLoggedOutBackendAuthState();
-  } catch (error) {
-    const authErrorMessage = error instanceof Error && error.message ? error.message : 'Backend authentication failed.';
-    return getLoggedOutBackendAuthState(authErrorMessage);
-  }
-};
-
-const getBackendLogoutUrl = backendUrl => {
-  return getBackendAuthUrl(backendUrl, '/auth/logout');
-};
-
-const logoutFromBackend = async backendUrl => {
-  if (!backendUrl) {
-    return;
-  }
-  try {
-    await fetch(getBackendLogoutUrl(backendUrl), {
-      credentials: 'include',
-      headers: {
-        Accept: 'application/json'
-      },
-      method: 'POST'
-    });
-  } catch {
-    // Ignore logout failures and still clear local auth state.
-  }
-};
-
-const getBackendRefreshUrl = backendUrl => {
-  return getBackendAuthUrl(backendUrl, '/auth/refresh');
-};
-
-const delay = async ms => {
-  await new Promise(resolve => setTimeout(resolve, ms));
-};
-
-const state = {
-  nextLoginResponse: undefined,
-  nextRefreshResponse: undefined
-};
-const setNextLoginResponse = response => {
-  state.nextLoginResponse = response;
-};
-const setNextRefreshResponse = response => {
-  state.nextRefreshResponse = response;
-};
-const clear = () => {
-  state.nextLoginResponse = undefined;
-  state.nextRefreshResponse = undefined;
-};
-const hasPendingMockLoginResponse = () => {
-  return !!state.nextLoginResponse;
-};
-const hasPendingMockRefreshResponse = () => {
-  return !!state.nextRefreshResponse;
-};
-const consumeNextLoginResponse = async () => {
-  if (!state.nextLoginResponse) {
-    return undefined;
-  }
-  const response = state.nextLoginResponse;
-  state.nextLoginResponse = undefined;
-  if (response.delay > 0) {
-    await delay(response.delay);
-  }
-  if (response.type === 'error') {
-    throw new Error(response.message);
-  }
-  return response.response;
-};
-const consumeNextRefreshResponse = async () => {
-  if (!state.nextRefreshResponse) {
-    return undefined;
-  }
-  const response = state.nextRefreshResponse;
-  state.nextRefreshResponse = undefined;
-  if (response.delay > 0) {
-    await new Promise(resolve => setTimeout(resolve, response.delay));
-  }
-  if (response.type === 'error') {
-    throw new Error(response.message);
-  }
-  return response.response;
-};
-
-const isObject = value => {
-  return !!value && typeof value === 'object';
-};
-
-const isBackendAuthResponse = value => {
-  return isObject(value);
-};
-
-const getNumber = (value, fallback = 0) => {
-  return typeof value === 'number' ? value : fallback;
-};
-
-const getString = (value, fallback = '') => {
-  return typeof value === 'string' ? value : fallback;
-};
-
-const getUserName = value => {
-  if (typeof value.userName === 'string') {
-    return value.userName;
-  }
-  return getString(value.user?.displayName);
-};
-const toBackendAuthState = value => {
-  return {
-    authAccessToken: getString(value.accessToken),
-    authErrorMessage: getString(value.error),
-    authRefreshToken: getString(value.refreshToken),
-    userName: getUserName(value),
-    userState: value.accessToken ? 'loggedIn' : 'loggedOut',
-    userSubscriptionPlan: getString(value.subscriptionPlan),
-    userSubscriptionStatus: getString(value.subscriptionStatus),
-    userUsedTokens: getNumber(value.usedTokens)
-  };
-};
-
-const parseBackendAuthResponse = value => {
-  if (!isBackendAuthResponse(value)) {
-    return getLoggedOutBackendAuthState('Backend returned an invalid authentication response.');
-  }
-  return toBackendAuthState(value);
-};
-
 const getPayload = async response => {
   try {
     return await response.json();
@@ -2638,7 +2698,7 @@ const getPayload = async response => {
     return undefined;
   }
 };
-const syncBackendAuth = async backendUrl => {
+const syncBackendAuth$1 = async backendUrl => {
   if (!backendUrl) {
     return getLoggedOutBackendAuthState('Backend URL is missing.');
   }
@@ -2688,7 +2748,7 @@ const waitForBackendLogin = async (backendUrl, timeoutMs = 30_000, pollIntervalM
   const deadline = Date.now() + timeoutMs;
   let lastErrorMessage = '';
   while (Date.now() < deadline) {
-    const authState = await syncBackendAuth(backendUrl);
+    const authState = await syncBackendAuth$1(backendUrl);
     if (authState.userState === 'loggedIn') {
       return authState;
     }
@@ -2700,6 +2760,13 @@ const waitForBackendLogin = async (backendUrl, timeoutMs = 30_000, pollIntervalM
   return getLoggedOutBackendAuthState(lastErrorMessage);
 };
 
+const getAccountLoginUrl = (backendUrl, authorizationUrl) => {
+  const url = new URL('/login', backendUrl);
+  url.searchParams.set('selectAccount', 'true');
+  url.searchParams.set('returnTo', authorizationUrl);
+  return url.href;
+};
+
 const getAuthUseRedirect = platform => {
   return platform !== Electron;
 };
@@ -3091,7 +3158,7 @@ const waitForElectronBackendLogin = async (backendUrl, uid, redirectUri, codeVer
   return getLoggedOutBackendAuthState('Timed out waiting for backend login.');
 };
 
-const getMockLoginResult = async signingInState => {
+const getMockLoginResult = async (signingInState, persistResult) => {
   if (!hasPendingMockLoginResponse()) {
     return undefined;
   }
@@ -3108,9 +3175,9 @@ const getMockLoginResult = async signingInState => {
       userState: 'loggedOut'
     };
   }
-  return persistLoginResult(getLoggedInState(signingInState, response));
+  return persistResult(getLoggedInState(signingInState, response));
 };
-const getInteractiveLoginResult = async (backendUrl, platform, signingInState) => {
+const getInteractiveLoginResult = async (backendUrl, platform, signingInState, persistResult, selectAccount) => {
   const authUseRedirect = getAuthUseRedirect(platform);
   const uid = 0;
   const {
@@ -3121,14 +3188,16 @@ const getInteractiveLoginResult = async (backendUrl, platform, signingInState) =
     state
   } = await getBackendLoginRequest(backendUrl, platform, uid);
   if (platform !== Electron) {
+    const returnUrl = await getCurrentHref();
     await savePendingOidcAuthState({
       clientId,
       codeVerifier,
       redirectUri,
+      returnUrl,
       state
     });
   }
-  await invoke$1('Open.openUrl', loginUrl, platform, authUseRedirect);
+  await invoke$1('Open.openUrl', selectAccount ? getAccountLoginUrl(backendUrl, loginUrl) : loginUrl, platform, authUseRedirect);
   if (platform !== Electron && authUseRedirect) {
     return signingInState;
   }
@@ -3136,12 +3205,12 @@ const getInteractiveLoginResult = async (backendUrl, platform, signingInState) =
   if (platform !== Electron) {
     await clearPendingOidcAuthState();
   }
-  return persistLoginResult({
+  return persistResult({
     ...authState,
     authClientId: clientId
   });
 };
-const handleClickLogin = async options => {
+const handleClickLogin = async (options, persistResult = persistLoginResult) => {
   const {
     backendUrl,
     platform
@@ -3158,11 +3227,11 @@ const handleClickLogin = async options => {
     userState: 'loggingIn'
   };
   try {
-    const mockLoginResult = await getMockLoginResult(signingInState);
+    const mockLoginResult = await getMockLoginResult(signingInState, persistResult);
     if (mockLoginResult) {
       return mockLoginResult;
     }
-    return getInteractiveLoginResult(backendUrl, platform, signingInState);
+    return getInteractiveLoginResult(backendUrl, platform, signingInState, persistResult, options.selectAccount === true);
   } catch (error) {
     await clearPendingOidcAuthState();
     const errorMessage = error instanceof Error && error.message ? error.message : 'Backend authentication failed.';
@@ -3173,17 +3242,252 @@ const handleClickLogin = async options => {
   }
 };
 
-const logout = async state => {
-  const loggingOutState = {
-    authErrorMessage: '',
-    userState: 'loggingOut'
-  };
-  await logoutFromBackend(state.backendUrl);
-  await Promise.all([clearOidcCallbackUrl(), clearPendingOidcAuthState(), clearPersistedAuthSession()]);
-  return {
-    ...loggingOutState,
-    ...getLoggedOutBackendAuthState()
-  };
+const storageKey = 'accountSessions';
+const accounts = createAccountSessions({
+  read: () => getPersistentAuthValue(storageKey),
+  write: value => setPersistentAuthValue(storageKey, value)
+});
+const refreshes = new Map();
+const state = {
+  login: undefined,
+  migration: undefined
+};
+const normalizeBackendUrl = backendUrl => new URL(backendUrl).origin;
+const addSession = async (backendUrl, session, revision) => {
+  if (session.userState !== 'loggedIn' || !session.authAccessToken) {
+    return;
+  }
+  const profile = await getAccountProfile(backendUrl, session.authAccessToken);
+  await accounts.add({
+    backendUrl,
+    id: `${backendUrl}/${profile.id}`,
+    profile,
+    session: {
+      ...session,
+      userName: profile.displayName
+    }
+  }, revision);
+};
+const migrate = async backendUrl => {
+  if (await getPersistentAuthValue(storageKey)) {
+    return;
+  }
+  const legacy = await getPersistedAuthSession();
+  if (legacy) {
+    if (legacy.authClientId && legacy.authRefreshToken) {
+      const tokens = await refreshOidcTokens(backendUrl, legacy.authClientId, legacy.authRefreshToken);
+      const authAccessTokenExpiresAt = getAccessTokenExpiresAt(tokens.expiresIn);
+      const {
+        authAccessTokenExpiresAt: _legacyExpiry,
+        ...legacySession
+      } = legacy;
+      await addSession(backendUrl, {
+        ...legacySession,
+        authAccessToken: tokens.accessToken,
+        ...(authAccessTokenExpiresAt && {
+          authAccessTokenExpiresAt
+        }),
+        authRefreshToken: tokens.refreshToken
+      }, 0);
+    } else {
+      await addSession(backendUrl, legacy, 0);
+    }
+  } else {
+    await setPersistentAuthValue(storageKey, JSON.stringify({
+      accounts: [],
+      activeId: '',
+      revision: 0
+    }));
+  }
+  // Clear legacy credentials only after the registry is durably committed.
+  await clearPersistedAuthSession();
+};
+const ensureMigrated = async (backendUrl = getAuthBackendUrl()) => {
+  const url = normalizeBackendUrl(backendUrl);
+  if (!state.migration) {
+    state.migration = (async () => {
+      try {
+        await migrate(url);
+      } catch (error) {
+        state.migration = undefined;
+        throw error;
+      }
+    })();
+  }
+  await state.migration;
+  return url;
+};
+const getActive = async backendUrl => {
+  const registry = await accounts.read();
+  return registry.accounts.find(account => account.id === registry.activeId && account.backendUrl === backendUrl);
+};
+const getCurrentState = async (backendUrl, authErrorMessage = '') => {
+  const account = await getActive(backendUrl);
+  return account ? {
+    ...account.session,
+    authErrorMessage
+  } : getLoggedOutBackendAuthState(authErrorMessage);
+};
+const refresh = async account => {
+  const {
+    backendUrl,
+    session
+  } = account;
+  if (!session.authClientId || !session.authRefreshToken) {
+    if (session.authAccessTokenExpiresAt && session.authAccessTokenExpiresAt <= Date.now()) {
+      await accounts.update(account, getLoggedOutBackendAuthState('Please sign in to this account again.'));
+    }
+    return;
+  }
+  const key = `${account.id}/${session.authRefreshToken}`;
+  const pending = refreshes.get(key);
+  if (pending) {
+    return pending;
+  }
+  const operation = (async () => {
+    const tokens = await refreshOidcTokens(backendUrl, session.authClientId, session.authRefreshToken);
+    const authAccessTokenExpiresAt = getAccessTokenExpiresAt(tokens.expiresIn);
+    const {
+      authAccessTokenExpiresAt: _previousExpiry,
+      ...previousSession
+    } = session;
+    await accounts.update(account, {
+      ...previousSession,
+      authAccessToken: tokens.accessToken,
+      ...(authAccessTokenExpiresAt && {
+        authAccessTokenExpiresAt
+      }),
+      authRefreshToken: tokens.refreshToken
+    });
+  })();
+  refreshes.set(key, operation);
+  try {
+    await operation;
+  } catch (error) {
+    // Network errors must not destroy a retained session. A rejected grant needs another login.
+    if (error && typeof error === 'object' && 'error' in error && error.error === 'invalid_grant') {
+      await accounts.update(account, getLoggedOutBackendAuthState('Please sign in to this account again.'));
+    }
+    throw error;
+  } finally {
+    refreshes.delete(key);
+  }
+};
+const getAccounts = async () => {
+  const backendUrl = await ensureMigrated();
+  const registry = await accounts.read();
+  return registry.accounts.filter(account => account.backendUrl === backendUrl).map(account => ({
+    ...account.profile,
+    active: account.id === registry.activeId,
+    color: 'blue',
+    id: account.id,
+    signedIn: account.session.userState === 'loggedIn'
+  }));
+};
+const getAccessToken = async (options = {}) => {
+  const backendUrl = await ensureMigrated();
+  const account = await getActive(backendUrl);
+  if (!account) {
+    return '';
+  }
+  if (options.refresh === 'always' || options.refresh === 'if-needed' && !isAccessTokenValid(account.session.authAccessToken || '', String(account.session.authAccessTokenExpiresAt || ''))) {
+    try {
+      await refresh(account);
+    } catch (error) {
+      const selected = await getActive(backendUrl);
+      if (selected?.id === account.id) {
+        throw error;
+      }
+    }
+  }
+  // A refresh belongs to the identity it started with; selection can change while it is in flight.
+  const current = await getActive(backendUrl);
+  if (current?.id !== account.id) {
+    return getAccessToken(options);
+  }
+  return current?.session.authAccessToken || '';
+};
+const initialize = async (options = {}) => {
+  if (typeof options.platform === 'number') {
+    setAuthPlatform(options.platform);
+  }
+  const backendUrl = await ensureMigrated(options.backendUrl);
+  const registry = await accounts.read();
+  const completed = await completeBrowserOidcLogin(backendUrl);
+  if (completed) {
+    await addSession(backendUrl, completed, registry.revision);
+    return getCurrentState(backendUrl, completed.authErrorMessage);
+  }
+  try {
+    await getAccessToken({
+      refresh: 'if-needed'
+    });
+    return getCurrentState(backendUrl);
+  } catch (error) {
+    return getCurrentState(backendUrl, error instanceof Error ? error.message : 'Unable to refresh the account.');
+  }
+};
+const login = async options => {
+  if (state.login) {
+    return state.login;
+  }
+  const operation = (async () => {
+    const backendUrl = await ensureMigrated(options.backendUrl);
+    const registry = await accounts.read();
+    const result = await handleClickLogin({
+      ...options,
+      selectAccount: registry.accounts.length > 0
+    }, async value => value);
+    await addSession(backendUrl, result, registry.revision);
+    return getCurrentState(backendUrl, result.authErrorMessage);
+  })();
+  state.login = operation;
+  try {
+    return await operation;
+  } finally {
+    state.login = undefined;
+  }
+};
+const useAccount = async id => {
+  const backendUrl = await ensureMigrated();
+  const registry = await accounts.read();
+  if (registry.accounts.every(account => !(account.id === id && account.backendUrl === backendUrl))) {
+    throw new Error('Account is no longer available.');
+  }
+  await accounts.select(id);
+  return getCurrentState(backendUrl);
+};
+const removeAccount = async id => {
+  const backendUrl = await ensureMigrated();
+  const registry = await accounts.read();
+  if (registry.accounts.some(account => account.id === id && account.backendUrl === backendUrl)) {
+    await accounts.remove(id);
+  }
+  return getCurrentState(backendUrl);
+};
+const logout = async () => {
+  const backendUrl = await ensureMigrated();
+  const account = await getActive(backendUrl);
+  return account ? removeAccount(account.id) : getLoggedOutBackendAuthState();
+};
+const syncBackendAuth = async backendUrl => initialize({
+  backendUrl
+});
+
+const configure = options => {
+  setAuthBackendUrl(options.backendUrl);
+  setAuthPlatform(options.platform);
+};
+
+const handleMessagePort = async (port, rpcId) => {
+  const rpc = await create$4({
+    commandMap: commandMap,
+    isMessagePortOpen: true,
+    messagePort: port
+  });
+  if (rpcId) {
+    set$3(rpcId, rpc);
+  }
 };
 
 const commandMap = {
@@ -3192,14 +3496,17 @@ const commandMap = {
   'Auth.consumeNextLoginResponse': consumeNextLoginResponse,
   'Auth.consumeNextRefreshResponse': consumeNextRefreshResponse,
   'Auth.getAccessToken': getAccessToken,
+  'Auth.getAccounts': getAccounts,
   'Auth.hasPendingMockLoginResponse': hasPendingMockLoginResponse,
   'Auth.hasPendingMockRefreshResponse': hasPendingMockRefreshResponse,
   'Auth.initialize': initialize,
-  'Auth.login': handleClickLogin,
+  'Auth.login': login,
   'Auth.logout': logout,
+  'Auth.removeAccount': removeAccount,
   'Auth.setNextLoginResponse': setNextLoginResponse,
   'Auth.setNextRefreshResponse': setNextRefreshResponse,
   'Auth.syncBackendAuth': syncBackendAuth,
+  'Auth.useAccount': useAccount,
   'HandleMessagePort.handleMessagePort': handleMessagePort,
   initialize: (_, port) => handleMessagePort(port, RendererWorker)
 };