@vertesia/ui 1.6.0-dev.20260912.110338Z → 1.6.0-dev.20260918.063824Z

package/lib/widgets/xml-viewer/hooks/useCollapsible.d.ts

@@ -1,8 +1,8 @@
 export declare function useCollapsible(level: number): {
     collapsed: boolean;
     buttonProps: {
-        role?: undefined;
         onClick?: undefined;
+        role?: undefined;
         style?: undefined;
     } | {
         onClick: () => void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vertesia/ui",
-  "version": "1.6.0-dev.20260912.110338Z",
+  "version": "1.6.0-dev.20260918.063824Z",
   "description": "Vertesia UI components and and hooks",
   "type": "module",
   "main": "./lib/index.js",
@@ -45,11 +45,11 @@
     "@radix-ui/react-switch": "^1.3.7",
     "@radix-ui/react-tabs": "^1.1.21",
     "@radix-ui/react-tooltip": "^1.2.16",
-    "@vertesia/client": "1.6.0-dev.20260912.110338Z",
-    "@vertesia/common": "1.6.0-dev.20260912.110338Z",
-    "@vertesia/fusion-ux": "1.6.0-dev.20260912.110338Z",
-    "@vertesia/json": "1.6.0-dev.20260912.110338Z",
-    "@vertesia/rich-text": "1.6.0-dev.20260912.110338Z",
+    "@vertesia/client": "1.6.0-dev.20260918.063824Z",
+    "@vertesia/common": "1.6.0-dev.20260918.063824Z",
+    "@vertesia/fusion-ux": "1.6.0-dev.20260918.063824Z",
+    "@vertesia/json": "1.6.0-dev.20260918.063824Z",
+    "@vertesia/rich-text": "1.6.0-dev.20260918.063824Z",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "aria-hidden": "^1.2.6",
@@ -58,30 +58,30 @@
     "cmdk": "^1.1.1",
     "dayjs": "^1.11.23",
     "debounce": "^3.0.0",
-    "dompurify": "^3.4.14",
+    "dompurify": "^3.4.15",
     "fast-xml-parser": "^5.11.1",
     "firebase": "^12.18.0",
-    "framer-motion": "^13.1.1",
-    "i18next": "^26.4.1",
+    "framer-motion": "^13.2.0",
+    "i18next": "^26.4.2",
     "jwt-decode": "^4.0.0",
-    "katex": "^0.18.5",
+    "katex": "^0.18.7",
     "lodash-es": "^4.18.1",
-    "lucide-react": "^1.38.0",
+    "lucide-react": "^1.42.0",
     "mermaid": "^11.17.2",
     "monaco-editor": "^0.56.0",
-    "motion": "^13.1.1",
+    "motion": "^13.2.0",
     "papaparse": "^5.7.0",
     "react": "19.2.8",
     "react-calendar": "^6.0.1",
     "react-date-picker": "^12.1.0",
     "react-dom": "19.2.8",
-    "react-error-boundary": "^6.1.4",
-    "react-i18next": "^17.0.12",
+    "react-error-boundary": "^6.1.5",
+    "react-i18next": "^17.0.13",
     "react-markdown": "^10.1.0",
     "react-pdf": "^10.5.0",
     "react-remove-scroll": "^2.7.2",
     "react-remove-scroll-bar": "^2.3.8",
-    "react-resizable-panels": "^4.12.3",
+    "react-resizable-panels": "^4.12.4",
     "react-style-singleton": "^2.2.3",
     "react-vega": "^8.0.0",
     "rehype-katex": "^7.0.1",
@@ -106,16 +106,16 @@
     "@types/node": "^24.13.3",
     "@types/papaparse": "^5.5.2",
     "@types/react": "19.2.18",
-    "@types/react-dom": "19.2.5",
+    "@types/react-dom": "19.2.7",
     "@vertesia/tsconfig": "0.1.0",
     "axe-core": "^4.13.0",
     "culori": "^4.0.2",
-    "i18next-cli": "^1.72.2",
+    "i18next-cli": "^1.73.1",
     "jsdom": "^30.0.1",
-    "rolldown": "1.2.6",
+    "rolldown": "1.2.8",
     "tailwindcss": "^4.3.3",
     "typescript": "7.0.2",
-    "vitest": "^4.1.11",
+    "vitest": "5.0.0",
     "vitest-axe": "^0.1.0",
     "wcag-contrast": "^3.0.0"
   },
@@ -188,7 +188,7 @@
     "url": "https://github.com/vertesia/composableai.git",
     "directory": "packages/ui"
   },
-  "gitHead": "504e8df031c3950ec324c865385caf460b1c1cd7",
+  "gitHead": "5e9878a6ab82875248b0696621bb957732d42377",
   "scripts": {
     "clean:lib": "rimraf ./lib ./tsconfig.tsbuildinfo",
     "clean": "rimraf ./node_modules ./lib ./tsconfig.tsbuildinfo",

package/src/env/index.test.ts

@@ -81,6 +81,27 @@ describe('VertesiaEnvironment runtime configuration', () => {
         expect(window.AUTH_MODE).toBeUndefined();
     });
 
+    it('uses the gateway broker ahead of an app build endpoint', () => {
+        vi.stubGlobal('window', {
+            __VERTESIA_RUNTIME_CONFIG__: { authMode: 'central', authUrl: 'https://auth.dev1.vertesia.io/' },
+        });
+        const env = new VertesiaEnvironment().init({
+            ...baseProps,
+            endpoints: { ...baseProps.endpoints, auth: 'https://internal-auth.vertesia.app/' },
+        });
+        expect(env.endpoints.auth).toBe('https://auth.dev1.vertesia.io/');
+        expect(window.AUTH_MODE).toBe('central');
+    });
+
+    it('preserves the app broker with an older central runtime contract', () => {
+        vi.stubGlobal('window', { __VERTESIA_RUNTIME_CONFIG__: { authMode: 'central' } });
+        const env = new VertesiaEnvironment().init({
+            ...baseProps,
+            endpoints: { ...baseProps.endpoints, auth: 'https://auth.dev1.vertesia.io/' },
+        });
+        expect(env.endpoints.auth).toBe('https://auth.dev1.vertesia.io/');
+    });
+
     it('accepts injected Central Auth mode without Firebase configuration', () => {
         vi.stubGlobal('window', {
             __VERTESIA_RUNTIME_CONFIG__: { authMode: 'central' },
@@ -192,3 +213,30 @@ describe('build-time default workspace', () => {
         expect(env.defaultAuthSelection).toEqual({ accountId: 'explicit' });
     });
 });
+
+describe('fixed Firebase tenant', () => {
+    afterEach(() => vi.unstubAllGlobals());
+
+    it('combines an app tenant with gateway credentials', () => {
+        vi.stubGlobal('window', {
+            __VERTESIA_RUNTIME_CONFIG__: {
+                authMode: 'firebase',
+                firebase: {
+                    apiKey: 'gateway',
+                    authDomain: 'app.example.com',
+                    projectId: 'project',
+                    appId: 'app',
+                },
+            },
+        });
+        const env = new VertesiaEnvironment().init(baseProps, { VITE_FIREBASE_TENANT_ID: ' example-tenant ' });
+        expect(env.firebase?.tenantId).toBe('example-tenant');
+        expect(env.firebase?.apiKey).toBe('gateway');
+    });
+
+    it('does not enable Firebase just because a tenant is supplied', () => {
+        vi.stubGlobal('window', {});
+        const env = new VertesiaEnvironment().init(baseProps, { VITE_FIREBASE_TENANT_ID: 'tenant' });
+        expect(env.firebase).toBeUndefined();
+    });
+});

package/src/env/index.ts

@@ -18,8 +18,8 @@ export interface EnvProps {
         /**
          * Central Auth broker that issues the sign-in redirect and hosts `/logout`.
          *
-         * Optional: when unset the session falls back to the long-standing broker, so an app that
-         * does not set it keeps its current behaviour exactly. Set it to move one environment at a
+         * Optional: when unset the session falls back to the first-party broker, so an app that
+         * does not set it uses auth.vertesia.io. Set it to move one environment at a
          * time onto a different broker.
          */
         auth?: string;
@@ -34,6 +34,8 @@ export interface EnvProps {
         projectId: string;
         appId?: string;
         providerType?: string;
+        /** Fixed Identity Platform tenant, preserved throughout sign-in. */
+        tenantId?: string;
     };
     /** Default workspace selection when the URL does not explicitly select an account or project. */
     defaultAuthSelection?: { accountId?: string; projectId?: string };
@@ -77,6 +79,8 @@ export type VertesiaRuntimeConfig =
       }
     | {
           authMode: 'central';
+          /** Broker selected by the serving gateway. Overrides build-time configuration. */
+          authUrl?: string;
       };
 
 declare global {
@@ -139,6 +143,15 @@ export class VertesiaEnvironment implements Readonly<EnvProps> {
         const runtimeConfig = injectedRuntimeConfig() ?? buildRuntimeConfig(buildEnv);
         const runtimeFirebase = runtimeConfig?.authMode === 'firebase' ? runtimeConfig.firebase : undefined;
         this._props = props && runtimeFirebase && !props.firebase ? { ...props, firebase: runtimeFirebase } : props;
+        const authUrl = runtimeConfig?.authMode === 'central' ? runtimeConfig.authUrl?.trim() : undefined;
+        if (this._props && authUrl) {
+            this._props = { ...this._props, endpoints: { ...this._props.endpoints, auth: authUrl } };
+        }
+        const tenantId =
+            typeof buildEnv?.VITE_FIREBASE_TENANT_ID === 'string' ? buildEnv.VITE_FIREBASE_TENANT_ID.trim() : '';
+        if (this._props?.firebase && tenantId && !this._props.firebase.tenantId) {
+            this._props = { ...this._props, firebase: { ...this._props.firebase, tenantId } };
+        }
         if (this._props && this._props.defaultAuthSelection === undefined && buildEnv) {
             const accountId =
                 typeof buildEnv.VITE_VERTESIA_ACCOUNT_ID === 'string'

package/src/features/agent/PayloadBuilder.tsx

@@ -332,7 +332,12 @@ export class PayloadBuilder {
                 this._model_options = interaction.model_options as ModelOptions | undefined;
                 if (interaction.runtime?.environment) {
                     const envId = interaction.runtime.environment;
-                    this.vertesia.environments.retrieve(envId).then((environment) => (this.environment = environment));
+                    this.vertesia.environments
+                        .retrieve(envId)
+                        .then((environment) => (this.environment = environment))
+                        .catch(() => {
+                            this.environment = undefined;
+                        });
                 }
             }
             this.onStateChanged();

package/src/features/agent/chat/AgentRunFeedback.test.tsx

@@ -1,8 +1,14 @@
 import { fireEvent, screen, waitFor } from '@testing-library/react';
 import type { AgentRunFeedbackEntry, AgentRunFeedbackPayload, AgentRunFeedbackStatus } from '@vertesia/common';
+import { AgentMessageType } from '@vertesia/common';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { renderWithProviders } from '../../../__tests__/test-utils.js';
-import { AgentRunFeedback, AgentRunFeedbackProvider, agentRunFeedbackReasonCodes } from './AgentRunFeedback';
+import {
+    AgentRunFeedback,
+    AgentRunFeedbackProvider,
+    agentRunFeedbackReasonCodes,
+    isAgentMessageRatable,
+} from './AgentRunFeedback';
 
 const mocks = vi.hoisted(() => {
     const recordFeedback = vi.fn();
@@ -38,6 +44,17 @@ function payloadOf(call: number): AgentRunFeedbackPayload {
     return mocks.recordFeedback.mock.calls[call][1] as AgentRunFeedbackPayload;
 }
 
+describe('isAgentMessageRatable', () => {
+    it('offers a rating on a final answer only, never on a streaming placeholder', () => {
+        expect(isAgentMessageRatable({ type: AgentMessageType.ANSWER, details: { streamed: true } })).toBe(true);
+        expect(isAgentMessageRatable({ type: AgentMessageType.ANSWER, details: undefined })).toBe(true);
+        expect(isAgentMessageRatable({ type: AgentMessageType.ANSWER, details: { source: 'streaming_summary' } })).toBe(
+            false,
+        );
+        expect(isAgentMessageRatable({ type: AgentMessageType.THOUGHT, details: undefined })).toBe(false);
+    });
+});
+
 describe('AgentRunFeedback', () => {
     beforeEach(() => {
         mocks.recordFeedback.mockReset();

package/src/features/agent/chat/AgentRunFeedback.tsx

@@ -1,6 +1,7 @@
 import {
     AGENT_RUN_FEEDBACK_COMMENT_MAX_LENGTH,
     type AgentMessage,
+    AgentMessageType,
     type AgentRunFeedbackEntry,
     type AgentRunFeedbackPayload,
     type AgentRunFeedbackRating,
@@ -61,6 +62,18 @@ export function agentMessageFeedbackId(message: Pick<AgentMessage, 'workstream_i
     return `${message.workstream_id || 'main'}:${message.timestamp}`;
 }
 
+/**
+ * Whether a transcript message can carry a rating. Only a final answer can: while an answer is
+ * still streaming, the transcript shows a placeholder stamped with the browser clock, and a
+ * rating keyed to that timestamp would never match the answer the worker eventually posts, so
+ * the same answer would end up rated twice.
+ */
+export function isAgentMessageRatable(message: Pick<AgentMessage, 'type' | 'details'>): boolean {
+    if (message.type !== AgentMessageType.ANSWER) return false;
+    const details = message.details as { source?: unknown } | undefined;
+    return details?.source !== 'streaming_summary';
+}
+
 /** Idempotency key for one submission; the server counts a retried id once. */
 function newFeedbackId(): string {
     if (typeof crypto !== 'undefined' && 'randomUUID' in crypto) return crypto.randomUUID();

package/src/features/agent/chat/ModernAgentConversation.test.tsx

@@ -1278,7 +1278,7 @@ describe('ModernAgentConversation send handling', () => {
             expect.objectContaining({ workstream_id: 'beta', status: 'running' }),
             expect.objectContaining({ workstream_id: 'gamma', status: 'completed' }),
         ]);
-        expect(latestRightPanelProps.activeTab).toBe('plan');
+        expect(latestRightPanelProps.activeTab).toBe('workstreams');
         expect(latestMessageInputProps.activeTaskCount).toBe(2);
         expect(latestMessageInputProps.activeWorkstreams).toEqual([
             expect.objectContaining({ workstream_id: 'alpha', status: 'running' }),

package/src/features/agent/chat/ModernAgentConversation.tsx

@@ -1554,7 +1554,7 @@ function ModernAgentConversationInner({
         showInput,
         showSlidingPanel,
         setShowSlidingPanel,
-    } = useAgentPlans(messages, interactive, isModal);
+    } = useAgentPlans(messages, interactive);
 
     const {
         openDocuments,
@@ -1938,9 +1938,10 @@ function ModernAgentConversationInner({
     // Unified right panel state
     // ────────────────────────────────────────────
     type RightPanelTab = 'plan' | 'workstreams' | 'documents' | 'uploads' | 'artifacts' | 'payload' | 'conversation';
-    const [rightPanelTab, setRightPanelTab] = useState<RightPanelTab>(
-        conversationContent || conversationTab ? 'conversation' : 'plan',
+    const [rightPanelTab, setRightPanelTab] = useState<RightPanelTab | undefined>(
+        conversationContent || conversationTab ? 'conversation' : undefined,
     );
+    const defaultRightPanelTab = plans.length > 0 || panelWorkstreams.length === 0 ? 'plan' : 'workstreams';
     const [selectedArtifactPath, setSelectedArtifactPath] = useState<string | null>(null);
     const [rightPanelWidth, setRightPanelWidth] = useState(400);
     const [isRightPanelResizing, setIsRightPanelResizing] = useState(false);
@@ -3085,8 +3086,8 @@ function ModernAgentConversationInner({
                                     conversationContent={conversationTab ? conversationAreaJsx : conversationContent}
                                     // Panel control
                                     onClose={handleCloseRightPanel}
-                                    defaultTab={rightPanelTab}
-                                    activeTab={rightPanelTab}
+                                    defaultTab={rightPanelTab ?? defaultRightPanelTab}
+                                    activeTab={rightPanelTab ?? defaultRightPanelTab}
                                     onTabChange={setRightPanelTab}
                                 />
                             </div>

package/src/features/agent/chat/ModernAgentOutput/AllMessagesMixed.tsx

@@ -29,7 +29,7 @@ import {
     Wrench,
 } from 'lucide-react';
 import React, { Component, type ReactNode, useCallback, useEffect, useMemo, useRef, useState } from 'react';
-import { AgentRunFeedback, agentMessageFeedbackId } from '../AgentRunFeedback';
+import { AgentRunFeedback, agentMessageFeedbackId, isAgentMessageRatable } from '../AgentRunFeedback';
 import { AnimatedThinkingDots, PulsatingCircle } from '../AnimatedThinkingDots';
 import { AskUserWidget, isAskUserOptions } from '../AskUserWidget';
 import { DocumentEditingActionCard, parseMarkdownEditingAction } from '../DocumentEditingActionCard.js';
@@ -823,7 +823,7 @@ function SummaryMessage({
                     </MarkdownRenderer>
                 </div>
             )}
-            {feedbackAgentRunId && message.type === AgentMessageType.ANSWER && (
+            {feedbackAgentRunId && isAgentMessageRatable(message) && (
                 <AgentRunFeedback
                     agentRunId={feedbackAgentRunId}
                     messageId={agentMessageFeedbackId(message)}

package/src/features/agent/chat/ModernAgentOutput/MessageItem.tsx

@@ -27,7 +27,7 @@ import type React from 'react';
 import { memo, useEffect, useMemo, useRef, useState } from 'react';
 import dayjs from '../../../../core/utils/dayjs.js';
 import { useDownloadFile } from '../../../store/objects/components/useDownloadFile.js';
-import { AgentRunFeedback, agentMessageFeedbackId } from '../AgentRunFeedback';
+import { AgentRunFeedback, agentMessageFeedbackId, isAgentMessageRatable } from '../AgentRunFeedback';
 import { PulsatingCircle } from '../AnimatedThinkingDots';
 import { AskUserWidget, isAskUserOptions } from '../AskUserWidget';
 import { DocumentEditingActionCard, parseMarkdownEditingAction } from '../DocumentEditingActionCard.js';
@@ -683,7 +683,7 @@ function MessageItemComponent({
                         )
                     )}
 
-                    {feedbackAgentRunId && message.type === AgentMessageType.ANSWER && (
+                    {feedbackAgentRunId && isAgentMessageRatable(message) && (
                         <AgentRunFeedback
                             agentRunId={feedbackAgentRunId}
                             messageId={agentMessageFeedbackId(message)}

package/src/features/agent/chat/hooks/useAgentPlans.test.ts

@@ -0,0 +1,52 @@
+import { act, cleanup, renderHook } from '@testing-library/react';
+import { type AgentMessage, AgentMessageType } from '@vertesia/common';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { useAgentPlans } from './useAgentPlans.js';
+
+const question: AgentMessage = {
+    timestamp: 1,
+    workflow_run_id: 'run-1',
+    workstream_id: 'main',
+    type: AgentMessageType.QUESTION,
+    message: 'Help with a task',
+};
+const plan: AgentMessage = {
+    ...question,
+    timestamp: 2,
+    type: AgentMessageType.PLAN,
+    details: { plan: [{ id: 1, goal: 'Review the task', status: 'pending' }] },
+};
+
+describe('useAgentPlans sidebar visibility', () => {
+    beforeEach(() => sessionStorage.clear());
+    afterEach(cleanup);
+
+    it('stays closed while history loads and when history has no plan', () => {
+        const { result, rerender } = renderHook(({ messages }) => useAgentPlans(messages, true), {
+            initialProps: { messages: [] as AgentMessage[] },
+        });
+        expect(result.current.showSlidingPanel).toBe(false);
+        rerender({ messages: [question] });
+        expect(result.current.showSlidingPanel).toBe(false);
+    });
+
+    it('opens when a plan arrives and resets for a new empty run', () => {
+        const { result, rerender } = renderHook(({ messages }) => useAgentPlans(messages, true), {
+            initialProps: { messages: [question] },
+        });
+        rerender({ messages: [question, plan] });
+        expect(result.current.showSlidingPanel).toBe(true);
+        expect(result.current.plans).toHaveLength(1);
+        rerender({ messages: [] });
+        expect(result.current.showSlidingPanel).toBe(false);
+    });
+
+    it('preserves manual opening when subsequent messages have no plan', () => {
+        const { result, rerender } = renderHook(({ messages }) => useAgentPlans(messages, true), {
+            initialProps: { messages: [question] },
+        });
+        act(() => result.current.setShowSlidingPanel(true));
+        rerender({ messages: [question, { ...question, timestamp: 3, type: AgentMessageType.ANSWER }] });
+        expect(result.current.showSlidingPanel).toBe(true);
+    });
+});

package/src/features/agent/chat/hooks/useAgentPlans.ts

@@ -18,14 +18,14 @@ export interface UseAgentPlansResult {
  * Key improvement: incremental processing. Instead of scanning ALL messages
  * on every change, tracks `lastProcessedIndex` and only scans new messages.
  */
-export function useAgentPlans(messages: AgentMessage[], interactive: boolean, isModal = false): UseAgentPlansResult {
+export function useAgentPlans(messages: AgentMessage[], interactive: boolean): UseAgentPlansResult {
     const [plans, setPlans] = useState<Array<{ plan: Plan; timestamp: number }>>([]);
     const [activePlanIndex, setActivePlanIndex] = useState<number>(0);
     const [workstreamStatusMap, setWorkstreamStatusMap] = useState<
         Map<number, Map<string, 'pending' | 'in_progress' | 'completed' | 'skipped'>>
     >(new Map());
     const [showInput, setShowInput] = useState(interactive);
-    const [showSlidingPanel, setShowSlidingPanel] = useState<boolean>(!isModal);
+    const [showSlidingPanel, setShowSlidingPanel] = useState<boolean>(false);
 
     // Incremental processing: track how far we've scanned
     const lastProcessedIndex = useRef<number>(-1);
@@ -38,12 +38,12 @@ export function useAgentPlans(messages: AgentMessage[], interactive: boolean, is
             setPlans([]);
             setActivePlanIndex(0);
             setWorkstreamStatusMap(new Map());
-            // Keep right panel open by default on desktop sessions.
-            setShowSlidingPanel(!isModal);
+            // Open automatically only once a plan is available.
+            setShowSlidingPanel(false);
             lastProcessedIndex.current = -1;
             knownPlanTimestamps.current.clear();
         }
-    }, [messages.length, isModal]);
+    }, [messages.length]);
 
     // Helper to determine showInput from the latest message
     const updateShowInput = useCallback(

package/src/features/store/objects/search/DocumentSearchContext.ts

@@ -176,9 +176,14 @@ export class DocumentSearch implements SearchInterface {
     }
 
     computeFacets(_query: ObjectSearchQuery) {
-        this._facetsRequest().then((facets) => {
-            this.facets.value = facets;
-        });
+        this._facetsRequest()
+            .then((facets) => {
+                this.facets.value = facets;
+            })
+            .catch((err: unknown) => {
+                const error = err instanceof Error ? err : new Error(String(err));
+                this.result.value = { ...this.result.value, error };
+            });
     }
 
     async _search(loadMore = false, noFacets = false): Promise<boolean> {

package/src/router/path.test.ts

@@ -1,20 +1,20 @@
-import { afterEach, describe, expect, it } from 'vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
 import { getMountBasename, joinPath, stripMountBasename, withMountBasename } from './path';
 
 // Simulate a served `<base href>` (or its absence) by stubbing document.querySelector + document.URL.
 function setBaseHref(href: string | null, docUrl = 'https://gw.example.com/x') {
-    (globalThis as { document?: unknown }).document = {
+    vi.stubGlobal('document', {
         URL: docUrl,
         querySelector: (sel: string) =>
             sel === 'base[href]' && href ? ({ href: new URL(href, docUrl).href } as unknown) : null,
-    };
+    });
 }
 
 const MOUNT = '/tenants/05948c_5ed5f4/apps/furniture-catalog/versions/20260620T064257113Z/app';
 
 describe('mount basename helpers', () => {
     afterEach(() => {
-        delete (globalThis as { document?: unknown }).document;
+        vi.unstubAllGlobals();
     });
 
     describe('getMountBasename', () => {
@@ -31,7 +31,7 @@ describe('mount basename helpers', () => {
             expect(getMountBasename()).toBe('');
         });
         it('returns "" when there is no document (SSR)', () => {
-            delete (globalThis as { document?: unknown }).document;
+            vi.stubGlobal('document', undefined);
             expect(getMountBasename()).toBe('');
         });
     });

package/src/session/UserSessionProvider.tsx

@@ -134,7 +134,7 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
             session.setSession = setSession;
             getComposableToken(selectedAccount, selectedProject, Env.devAuthToken)
                 .then((res) => {
-                    session.login(res.rawToken).then(() => setSession(session.clone()));
+                    return session.login(res.rawToken).then(() => setSession(session.clone()));
                 })
                 .catch((err) => {
                     if (surfaceAuthError(err)) return;
@@ -169,7 +169,7 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
             }
             getComposableToken(selectedAccount, selectedProject, token, false, shouldRedirectToCentralAuth())
                 .then((res) => {
-                    session.login(res.rawToken, { loadOnboardingStatus }).then(() => {
+                    return session.login(res.rawToken, { loadOnboardingStatus }).then(() => {
                         setSession(session.clone());
                         clearAuthHash();
                     });
@@ -238,7 +238,7 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
                         shouldRedirectToCentralAuth(),
                     )
                         .then((res) => {
-                            session
+                            return session
                                 .login(res.rawToken, { loadOnboardingStatus })
                                 .then(() => setSession(session.clone()));
                         })

package/src/session/auth/auth-flow.md

@@ -6,10 +6,22 @@ This document describes the authentication flow for the Vertesia user-facing app
 
 The authentication system uses:
 - **Firebase** for identity management and OAuth provider integration
-- **Central Auth** (internal-auth.vertesia.app) for centralized authentication flow
+- **Central Auth** (auth.vertesia.io) for centralized authentication flow
 - **STS (Security Token Service)** (sts.vertesia.io) to validate Firebase tokens and generate Vertesia JWT tokens
 - **Session state management** to validate redirects and prevent CSRF attacks
 
+### Central Auth endpoint selection
+
+`https://auth.vertesia.io/` is the default broker. Regional scaffolding can set
+`VITE_AUTH_ENDPOINT`; applications can also configure the `Env` initialization property `endpoints.auth` explicitly.
+For compatible generated app shells, a gateway-provided central runtime config
+(`window.__VERTESIA_RUNTIME_CONFIG__` with `authMode: 'central'` and `authUrl`)
+takes precedence over the build-time endpoint. A runtime config without `authUrl`
+retains the configured endpoint or default. Explicit Firebase mode uses direct
+Firebase authentication instead of the central broker.
+
+The diagrams below use the default hostname; redirects use the selected broker.
+
 ### STS Endpoints
 - Production/Preview: `https://sts.vertesia.io`
 - Staging: `https://sts.dev1.vertesia.io`
@@ -179,7 +191,7 @@ The authentication system uses:
 ┌──────────────────────┐    │ - Microsoft          │    ┌──────────────────────┐
 │ Build redirect URL:  │    └──────────┬───────────┘    │ Redirect to SSO      │
 │                      │               │                │ provider (Okta,      │
-│ internal-auth        │               ▼                │ Azure AD, etc.)      │
+│ auth.vertesia.io     │               ▼                │ Azure AD, etc.)      │
 │ .vertesia.app        │    ┌──────────────────────┐    └──────────┬───────────┘
 │ ?sts=...             │    │ Firebase OAuth       │               │
 │ &redirect_uri=...    │    │ redirect & return    │               ▼
@@ -329,7 +341,7 @@ The authentication system uses:
 
 ### Path A: Central Auth (Option 1) - Returns with JWT
 1. User clicks "Continue with Central Auth"
-2. Redirects to internal-auth.vertesia.app
+2. Redirects to auth.vertesia.io
 3. Central auth authenticates user and gets Firebase token
 4. **Central auth calls STS** (`POST sts.vertesia.io/token/issue` with Firebase token)
 5. **STS validates Firebase token and generates Vertesia JWT**
@@ -472,7 +484,7 @@ The authentication system uses:
                 │ Redirect to Central  │         │ getFirebaseAuth()    │
                 │ Auth for logout:     │         │   .signOut()         │
                 │                      │         │                      │
-                │ internal-auth        │         │ (Triggers            │
+                │ auth.vertesia.io     │         │ (Triggers            │
                 │  .vertesia.app       │         │  onAuthStateChanged  │
                 │  /logout             │         │  with anonymous user)│
                 │                      │         └──────────┬───────────┘
@@ -712,7 +724,7 @@ flowchart TB
     subgraph Option1[OPTION 1: CENTRAL AUTH]
         C1[Generate state<br/>Save to sessionStorage]
         C2[Get account/project<br/>from URL or localStorage]
-        C3[Build redirect URL:<br/>internal-auth.vertesia.app<br/>?sts=...&redirect_uri=...&state=...]
+        C3[Build redirect URL:<br/>auth.vertesia.io<br/>?sts=...&redirect_uri=...&state=...]
         C4[window.location.replace<br/>to central auth]
         C5[Central Auth Page<br/>User authenticates<br/>Gets Firebase token]
         C6[Central auth calls STS:<br/>POST sts.vertesia.io/token/issue<br/>Authorization: Bearer Firebase<br/>Body: type, account_id, project_id]
@@ -774,7 +786,7 @@ flowchart TB
 
     Check -->|YES| ShouldRedirect{shouldRedirectTo<br/>CentralAuth?}
 
-    ShouldRedirect -->|YES| RedirectLogout[Redirect to Central Auth<br/>for logout<br/><br/>internal-auth.vertesia.app<br/>/logout<br/><br/>Central auth handles<br/>Firebase logout]
+    ShouldRedirect -->|YES| RedirectLogout[Redirect to Central Auth<br/>for logout<br/><br/>auth.vertesia.io<br/>/logout<br/><br/>Central auth handles<br/>Firebase logout]
 
     ShouldRedirect -->|NO| FirebaseSignout[getFirebaseAuth.signOut<br/><br/>Triggers onAuthStateChanged<br/>with anonymous user]
 
@@ -837,7 +849,7 @@ flowchart TB
 sequenceDiagram
     actor User
     participant App as Composable UI
-    participant CentralAuth as Central Auth<br/>(internal-auth.vertesia.app)
+    participant CentralAuth as Central Auth<br/>(auth.vertesia.io)
     participant Firebase as Firebase Auth
     participant STS as STS<br/>(sts.vertesia.io)
 
@@ -1030,7 +1042,7 @@ flowchart TB
 
     Check -->|YES| ShouldRedirect{shouldRedirectTo<br/>CentralAuth?}
 
-    ShouldRedirect -->|YES| RedirectLogout[Redirect to Central Auth<br/>for logout<br/><br/>internal-auth.vertesia.app<br/>/logout<br/><br/>Central auth handles<br/>Firebase logout]
+    ShouldRedirect -->|YES| RedirectLogout[Redirect to Central Auth<br/>for logout<br/><br/>auth.vertesia.io<br/>/logout<br/><br/>Central auth handles<br/>Firebase logout]
 
     ShouldRedirect -->|NO| FirebaseSignout[getFirebaseAuth.signOut<br/><br/>Triggers onAuthStateChanged<br/>with anonymous user]
 
@@ -1078,7 +1090,7 @@ flowchart TB
         LO2[session.logout or<br/>session.signOut]
         LO3{authToken<br/>exists?}
         LO4{shouldRedirectTo<br/>CentralAuth?}
-        LO5[Redirect to Central Auth<br/>for logout<br/><br/>internal-auth.vertesia.app<br/>/logout<br/><br/>Central auth handles<br/>Firebase logout]
+        LO5[Redirect to Central Auth<br/>for logout<br/><br/>auth.vertesia.io<br/>/logout<br/><br/>Central auth handles<br/>Firebase logout]
         LO6[getFirebaseAuth.signOut<br/><br/>Triggers onAuthStateChanged<br/>with anonymous user]
         LO7[Clear session data:<br/>- authError = undefined<br/>- isLoading = false<br/>- authToken = undefined<br/>- typeRegistry = undefined]
         LO8[client.withAuthCallback<br/>undefined<br/><br/>Clear client auth]

package/src/session/auth/domainRouting.test.ts

@@ -77,7 +77,7 @@ describe('centralAuthUrl', () => {
     it('falls back to the default broker when no auth endpoint is configured', () => {
         initEnv(undefined);
         expect(centralAuthUrl()).toBe(DEFAULT_CENTRAL_AUTH_URL);
-        expect(DEFAULT_CENTRAL_AUTH_URL).toBe('https://internal-auth.vertesia.app/');
+        expect(DEFAULT_CENTRAL_AUTH_URL).toBe('https://auth.vertesia.io/');
     });
 
     it('uses the configured auth endpoint when one is set', () => {