@vertesia/ui 1.6.0-dev.20260918.090710Z → 1.6.0-dev.20260923.085325Z

package/src/i18n/locales/ko.json

@@ -395,6 +395,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "MCP 연결 관리",
     "mcpConnections.managedByApp": "앱에서 관리",
+    "mcpConnections.noAuthentication": "인증 없음",
     "mcpConnections.settings": "설정",
     "mcpConnections.subtitle": "이 대화에서 사용할 수 있는 MCP 서버를 관리합니다.",
     "mcpConnections.title": "MCP",
@@ -504,7 +505,7 @@
     "store.actions.changeContentTypeDesc": "선택한 문서의 콘텐츠 유형 변경",
     "store.actions.changeType": "유형 변경",
     "store.actions.chooseExistingCollections": "기존 컬렉션에서 선택",
-    "store.actions.chooseWorkflowRule": "시작할 워크플로 규칙을 선택하세요:",
+    "store.actions.chooseWorkflow": "시작할 워크플로를 선택하세요:",
     "store.actions.confirmDeleteAll": "선택한 모든 객체를 삭제하시겠습니까? 이 작업은 되돌릴 수 없습니다.",
     "store.actions.confirmDeleteSelected": "선택한 객체를 삭제하시겠습니까?\n이것은 컬렉션에서 제거하는 것이 아닙니다.",
     "store.actions.confirmRemoveFromCollection": "선택한 객체를 이 컬렉션에서 제거하시겠습니까?",
@@ -521,15 +522,18 @@
     "store.actions.exportProperties": "속성 내보내기",
     "store.actions.noCollectionContext": "컬렉션 컨텍스트가 없습니다",
     "store.actions.noObjectsSelected": "선택된 객체가 없습니다",
+    "store.actions.noWorkflowsAvailable": "사용 가능한 워크플로가 없습니다",
     "store.actions.pleaseSelectObjectsToDelete": "삭제할 객체를 선택해 주세요",
     "store.actions.pleaseSelectObjectsToRemove": "컬렉션에서 제거할 객체를 선택해 주세요",
     "store.actions.removeFromCollection": "컬렉션에서 제거",
     "store.actions.removeFromCollectionDesc": "이 컬렉션에서 선택한 객체 제거",
     "store.actions.selectCollection": "컬렉션 선택",
+    "store.actions.start": "시작",
     "store.actions.startWorkflow": "워크플로 시작",
-    "store.actions.startWorkflowByRule": "규칙으로 워크플로 시작",
     "store.actions.startWorkflowDesc": "선택한 객체에 대해 워크플로 시작",
     "store.actions.workflowStarted": "워크플로가 시작되었습니다",
+    "store.actions.workflowStartedOn_one": "{{count}}개 객체에 대해 {{name}}을(를) 시작했습니다",
+    "store.actions.workflowStartedOn_other": "{{count}}개 객체에 대해 {{name}}을(를) 시작했습니다",
     "store.allowedContentTypes": "허용된 콘텐츠 유형",
     "store.allowedContentTypesOptionalDescription": "컬렉션에 추가할 수 있는 콘텐츠 유형을 선택할 수 있습니다. 설정하지 않으면 모든 콘텐츠 유형이 허용됩니다.",
     "store.allowedContentTypesSelectDescription": "컬렉션에 추가할 수 있는 콘텐츠 유형을 선택하세요. 설정하지 않으면 모든 콘텐츠 유형이 허용됩니다.",

package/src/i18n/locales/pt.json

@@ -397,6 +397,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "Gerenciar conexões MCP",
     "mcpConnections.managedByApp": "Gerenciado pelo aplicativo",
+    "mcpConnections.noAuthentication": "Sem autenticação",
     "mcpConnections.settings": "Configurações",
     "mcpConnections.subtitle": "Gerencie os servidores MCP disponíveis para esta conversa.",
     "mcpConnections.title": "MCP",
@@ -507,7 +508,7 @@
     "store.actions.changeContentTypeDesc": "Alterar o tipo de conteúdo dos documentos selecionados",
     "store.actions.changeType": "Alterar tipo",
     "store.actions.chooseExistingCollections": "Escolher de coleções existentes",
-    "store.actions.chooseWorkflowRule": "Escolha uma regra de fluxo de trabalho para iniciar:",
+    "store.actions.chooseWorkflow": "Escolha um fluxo de trabalho para iniciar:",
     "store.actions.confirmDeleteAll": "Tem certeza de que deseja excluir todos os objetos selecionados? Esta ação não pode ser desfeita.",
     "store.actions.confirmDeleteSelected": "Tem certeza de que deseja excluir os objetos selecionados?\nIsso não os remove das coleções.",
     "store.actions.confirmRemoveFromCollection": "Tem certeza de que deseja remover os objetos selecionados desta coleção?",
@@ -524,15 +525,18 @@
     "store.actions.exportProperties": "Exportar propriedades",
     "store.actions.noCollectionContext": "Sem contexto de coleção",
     "store.actions.noObjectsSelected": "Nenhum objeto selecionado",
+    "store.actions.noWorkflowsAvailable": "Nenhum fluxo de trabalho disponível",
     "store.actions.pleaseSelectObjectsToDelete": "Por favor, selecione objetos para excluir",
     "store.actions.pleaseSelectObjectsToRemove": "Por favor, selecione objetos para remover da coleção",
     "store.actions.removeFromCollection": "Remover da coleção",
     "store.actions.removeFromCollectionDesc": "Remover os objetos selecionados desta coleção",
     "store.actions.selectCollection": "Selecionar coleção",
+    "store.actions.start": "Iniciar",
     "store.actions.startWorkflow": "Iniciar fluxo de trabalho",
-    "store.actions.startWorkflowByRule": "Iniciar um fluxo de trabalho por regra",
     "store.actions.startWorkflowDesc": "Iniciar um fluxo de trabalho nos objetos selecionados",
     "store.actions.workflowStarted": "Fluxo de trabalho iniciado",
+    "store.actions.workflowStartedOn_one": "{{name}} iniciado em {{count}} objeto",
+    "store.actions.workflowStartedOn_other": "{{name}} iniciado em {{count}} objetos",
     "store.allowedContentTypes": "Tipos de conteúdo permitidos",
     "store.allowedContentTypesOptionalDescription": "Opcionalmente selecione quais tipos de conteúdo podem ser adicionados à coleção. Se não definido, todos os tipos de conteúdo são permitidos.",
     "store.allowedContentTypesSelectDescription": "Selecione quais tipos de conteúdo podem ser adicionados à coleção. Se não definido, todos os tipos de conteúdo são permitidos.",

package/src/i18n/locales/ru.json

@@ -401,6 +401,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "Управление подключениями MCP",
     "mcpConnections.managedByApp": "Управляется приложением",
+    "mcpConnections.noAuthentication": "Без аутентификации",
     "mcpConnections.settings": "Настройки",
     "mcpConnections.subtitle": "Управляйте серверами MCP, доступными для этого разговора.",
     "mcpConnections.title": "MCP",
@@ -512,7 +513,7 @@
     "store.actions.changeContentTypeDesc": "Изменить тип контента выбранных документов",
     "store.actions.changeType": "Изменить тип",
     "store.actions.chooseExistingCollections": "Выбрать из существующих коллекций",
-    "store.actions.chooseWorkflowRule": "Выберите правило рабочего процесса для запуска:",
+    "store.actions.chooseWorkflow": "Выберите рабочий процесс для запуска:",
     "store.actions.confirmDeleteAll": "Вы уверены, что хотите удалить все выбранные объекты? Это действие нельзя отменить.",
     "store.actions.confirmDeleteSelected": "Вы уверены, что хотите удалить выбранные объекты?\nЭто не удаление из коллекций.",
     "store.actions.confirmRemoveFromCollection": "Вы уверены, что хотите удалить выбранные объекты из этой коллекции?",
@@ -529,15 +530,20 @@
     "store.actions.exportProperties": "Экспортировать свойства",
     "store.actions.noCollectionContext": "Нет контекста коллекции",
     "store.actions.noObjectsSelected": "Объекты не выбраны",
+    "store.actions.noWorkflowsAvailable": "Нет доступных рабочих процессов",
     "store.actions.pleaseSelectObjectsToDelete": "Пожалуйста, выберите объекты для удаления",
     "store.actions.pleaseSelectObjectsToRemove": "Пожалуйста, выберите объекты для удаления из коллекции",
     "store.actions.removeFromCollection": "Удалить из коллекции",
     "store.actions.removeFromCollectionDesc": "Удалить выбранные объекты из этой коллекции",
     "store.actions.selectCollection": "Выбрать коллекцию",
+    "store.actions.start": "Запустить",
     "store.actions.startWorkflow": "Запустить рабочий процесс",
-    "store.actions.startWorkflowByRule": "Запустить рабочий процесс по правилу",
     "store.actions.startWorkflowDesc": "Запустить рабочий процесс для выбранных объектов",
     "store.actions.workflowStarted": "Рабочий процесс запущен",
+    "store.actions.workflowStartedOn_few": "{{name}} запущен для {{count}} объектов",
+    "store.actions.workflowStartedOn_many": "{{name}} запущен для {{count}} объектов",
+    "store.actions.workflowStartedOn_one": "{{name}} запущен для {{count}} объекта",
+    "store.actions.workflowStartedOn_other": "{{name}} запущен для {{count}} объектов",
     "store.allowedContentTypes": "Допустимые типы контента",
     "store.allowedContentTypesOptionalDescription": "Дополнительно выберите, какие типы контента можно добавлять в коллекцию. Если не указано, допускаются все типы контента.",
     "store.allowedContentTypesSelectDescription": "Выберите, какие типы контента можно добавлять в коллекцию. Если не указано, допускаются все типы контента.",

package/src/i18n/locales/tr.json

@@ -395,6 +395,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "MCP bağlantılarını yönet",
     "mcpConnections.managedByApp": "Uygulama tarafından yönetiliyor",
+    "mcpConnections.noAuthentication": "Kimlik doğrulama yok",
     "mcpConnections.settings": "Ayarlar",
     "mcpConnections.subtitle": "Bu konuşma için kullanılabilen MCP sunucularını yönetin.",
     "mcpConnections.title": "MCP",
@@ -504,7 +505,7 @@
     "store.actions.changeContentTypeDesc": "Seçili belgelerin İçerik Türünü değiştirin",
     "store.actions.changeType": "Türü Değiştir",
     "store.actions.chooseExistingCollections": "Mevcut koleksiyonlardan seçin",
-    "store.actions.chooseWorkflowRule": "Başlatılacak bir iş akışı kuralı seçin:",
+    "store.actions.chooseWorkflow": "Başlatılacak bir iş akışı seçin:",
     "store.actions.confirmDeleteAll": "Seçili tüm nesneleri silmek istediğinizden emin misiniz? Bu işlem geri alınamaz.",
     "store.actions.confirmDeleteSelected": "Seçili nesneleri silmek istediğinizden emin misiniz?\nBu, koleksiyonlardan kaldırma işlemi değildir.",
     "store.actions.confirmRemoveFromCollection": "Seçili nesneleri bu koleksiyondan kaldırmak istediğinizden emin misiniz?",
@@ -521,15 +522,18 @@
     "store.actions.exportProperties": "Özellikleri Dışa Aktar",
     "store.actions.noCollectionContext": "Koleksiyon bağlamı yok",
     "store.actions.noObjectsSelected": "Nesne seçilmedi",
+    "store.actions.noWorkflowsAvailable": "Kullanılabilir iş akışı yok",
     "store.actions.pleaseSelectObjectsToDelete": "Lütfen silinecek nesneleri seçin",
     "store.actions.pleaseSelectObjectsToRemove": "Lütfen koleksiyondan kaldırılacak nesneleri seçin",
     "store.actions.removeFromCollection": "Koleksiyondan kaldır",
     "store.actions.removeFromCollectionDesc": "Seçili nesneleri bu koleksiyondan kaldır",
     "store.actions.selectCollection": "Koleksiyon Seçin",
+    "store.actions.start": "Başlat",
     "store.actions.startWorkflow": "İş Akışı Başlat",
-    "store.actions.startWorkflowByRule": "Kurala Göre İş Akışı Başlat",
     "store.actions.startWorkflowDesc": "Seçili nesneler üzerinde bir iş akışı başlat",
     "store.actions.workflowStarted": "İş akışı başlatıldı",
+    "store.actions.workflowStartedOn_one": "{{count}} nesne üzerinde {{name}} başlatıldı",
+    "store.actions.workflowStartedOn_other": "{{count}} nesne üzerinde {{name}} başlatıldı",
     "store.allowedContentTypes": "İzin Verilen İçerik Türleri",
     "store.allowedContentTypesOptionalDescription": "İsteğe bağlı olarak koleksiyona eklenebilecek içerik türlerini seçin. Ayarlanmamışsa tüm içerik türlerine izin verilir.",
     "store.allowedContentTypesSelectDescription": "Koleksiyona eklenebilecek içerik türlerini seçin. Ayarlanmamışsa tüm içerik türlerine izin verilir.",

package/src/i18n/locales/zh-TW.json

@@ -395,6 +395,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "管理 MCP 連線",
     "mcpConnections.managedByApp": "由應用程式管理",
+    "mcpConnections.noAuthentication": "無需驗證",
     "mcpConnections.settings": "設定",
     "mcpConnections.subtitle": "管理可用於此對話的 MCP 伺服器。",
     "mcpConnections.title": "MCP",
@@ -504,7 +505,7 @@
     "store.actions.changeContentTypeDesc": "變更選中文件的內容類型",
     "store.actions.changeType": "變更類型",
     "store.actions.chooseExistingCollections": "從現有集合中選擇",
-    "store.actions.chooseWorkflowRule": "選擇要啟動的工作流程規則：",
+    "store.actions.chooseWorkflow": "選擇要啟動的工作流程：",
     "store.actions.confirmDeleteAll": "確定要刪除所有選中的物件嗎？此操作無法復原。",
     "store.actions.confirmDeleteSelected": "確定要刪除選中的物件嗎？\n這不是從集合中移除。",
     "store.actions.confirmRemoveFromCollection": "確定要從此集合中移除所選物件嗎？",
@@ -521,15 +522,18 @@
     "store.actions.exportProperties": "匯出屬性",
     "store.actions.noCollectionContext": "沒有集合上下文",
     "store.actions.noObjectsSelected": "未選擇任何物件",
+    "store.actions.noWorkflowsAvailable": "沒有可用的工作流程",
     "store.actions.pleaseSelectObjectsToDelete": "請選擇要刪除的物件",
     "store.actions.pleaseSelectObjectsToRemove": "請選擇要從集合中移除的物件",
     "store.actions.removeFromCollection": "從集合中移除",
     "store.actions.removeFromCollectionDesc": "從此集合中移除所選物件",
     "store.actions.selectCollection": "選擇集合",
+    "store.actions.start": "啟動",
     "store.actions.startWorkflow": "啟動工作流程",
-    "store.actions.startWorkflowByRule": "按規則啟動工作流程",
     "store.actions.startWorkflowDesc": "對選中的物件啟動工作流程",
     "store.actions.workflowStarted": "工作流程已啟動",
+    "store.actions.workflowStartedOn_one": "已對 {{count}} 個物件啟動 {{name}}",
+    "store.actions.workflowStartedOn_other": "已對 {{count}} 個物件啟動 {{name}}",
     "store.allowedContentTypes": "允許的內容類型",
     "store.allowedContentTypesOptionalDescription": "可選擇限定可新增到集合中的內容類型。如果未設定，則允許所有內容類型。",
     "store.allowedContentTypesSelectDescription": "選擇可新增到集合中的內容類型。如果未設定，則允許所有內容類型。",

package/src/i18n/locales/zh.json

@@ -395,6 +395,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "管理 MCP 连接",
     "mcpConnections.managedByApp": "由应用管理",
+    "mcpConnections.noAuthentication": "无需身份验证",
     "mcpConnections.settings": "设置",
     "mcpConnections.subtitle": "管理可用于此对话的 MCP 服务器。",
     "mcpConnections.title": "MCP",
@@ -504,7 +505,7 @@
     "store.actions.changeContentTypeDesc": "更改选中文档的内容类型",
     "store.actions.changeType": "更改类型",
     "store.actions.chooseExistingCollections": "从现有集合中选择",
-    "store.actions.chooseWorkflowRule": "选择要启动的工作流规则：",
+    "store.actions.chooseWorkflow": "选择要启动的工作流：",
     "store.actions.confirmDeleteAll": "确定要删除所有选中的对象吗？此操作无法撤销。",
     "store.actions.confirmDeleteSelected": "确定要删除选中的对象吗？\n这不是从集合中移除。",
     "store.actions.confirmRemoveFromCollection": "确定要从此集合中移除所选对象吗？",
@@ -521,15 +522,18 @@
     "store.actions.exportProperties": "导出属性",
     "store.actions.noCollectionContext": "没有集合上下文",
     "store.actions.noObjectsSelected": "未选择任何对象",
+    "store.actions.noWorkflowsAvailable": "没有可用的工作流",
     "store.actions.pleaseSelectObjectsToDelete": "请选择要删除的对象",
     "store.actions.pleaseSelectObjectsToRemove": "请选择要从集合中移除的对象",
     "store.actions.removeFromCollection": "从集合中移除",
     "store.actions.removeFromCollectionDesc": "从此集合中移除所选对象",
     "store.actions.selectCollection": "选择集合",
+    "store.actions.start": "启动",
     "store.actions.startWorkflow": "启动工作流",
-    "store.actions.startWorkflowByRule": "按规则启动工作流",
     "store.actions.startWorkflowDesc": "对选中的对象启动工作流",
     "store.actions.workflowStarted": "工作流已启动",
+    "store.actions.workflowStartedOn_one": "已对 {{count}} 个对象启动 {{name}}",
+    "store.actions.workflowStartedOn_other": "已对 {{count}} 个对象启动 {{name}}",
     "store.allowedContentTypes": "允许的内容类型",
     "store.allowedContentTypesOptionalDescription": "可选择限定可添加到集合中的内容类型。如果未设置，则允许所有内容类型。",
     "store.allowedContentTypesSelectDescription": "选择可添加到集合中的内容类型。如果未设置，则允许所有内容类型。",

package/src/session/UserSession.test.ts

@@ -1,8 +1,12 @@
 import type { VertesiaClient } from '@vertesia/client';
 import { type AuthTokenPayload, PrincipalType } from '@vertesia/common';
-import { describe, expect, it, vi } from 'vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import * as composable from './auth/composable';
+import * as oauth from './auth/oauth';
 import { UserSession } from './UserSession';
 
+afterEach(() => vi.restoreAllMocks());
+
 const projectToken: AuthTokenPayload = {
     sub: 'test-user',
     name: 'Test User',
@@ -33,6 +37,16 @@ function createSession(onboardingProgress: () => Promise<Record<string, boolean>
 }
 
 describe('UserSession.fetchOnboardingStatus', () => {
+    it.each(['token', 'oauth'] as const)(
+        'does not load Studio onboarding for a default %s login',
+        async (authMethod) => {
+            const onboardingProgress = vi.fn(async () => ({ project_created: true }));
+            const { session } = createSession(onboardingProgress);
+            await session.login(encodeToken(projectToken), { authMethod });
+            expect(onboardingProgress).not.toHaveBeenCalled();
+            expect(session.onboardingComplete).toBeUndefined();
+        },
+    );
     it('skips onboarding before authentication without publishing a status', async () => {
         const onboardingProgress = vi.fn(async () => ({ project_created: true }));
         const { session, setSession } = createSession(onboardingProgress);
@@ -48,12 +62,12 @@ describe('UserSession.fetchOnboardingStatus', () => {
         const onboardingProgress = vi.fn(async () => ({ project_created: true }));
         const { session, setSession } = createSession(onboardingProgress);
 
-        await session.login(encodeToken({ ...projectToken, project: undefined }));
+        await session.login(encodeToken({ ...projectToken, project: undefined }), { loadOnboardingStatus: true });
         expect(onboardingProgress).not.toHaveBeenCalled();
         expect(session.onboardingComplete).toBeUndefined();
         expect(setSession).not.toHaveBeenCalled();
 
-        await session.login(encodeToken(projectToken));
+        await session.login(encodeToken(projectToken), { loadOnboardingStatus: true });
         expect(onboardingProgress).toHaveBeenCalledOnce();
         expect(session.onboardingComplete).toBe(true);
         expect(setSession).toHaveBeenCalledOnce();
@@ -102,3 +116,34 @@ describe('UserSession.signOut', () => {
         expect(logout).toHaveBeenCalledOnce();
     });
 });
+
+describe('UserSession credential provider', () => {
+    it('keeps the accepted token session after the fragment state is consumed', async () => {
+        const rawToken = encodeToken(projectToken);
+        vi.spyOn(composable, 'getComposableToken').mockResolvedValue({ rawToken, token: projectToken, error: false });
+        const acquireOAuth = vi.spyOn(oauth, 'getAppOAuthToken').mockResolvedValue('oauth-token');
+        // OAuth is configured again after the one-time fragment nonce is cleared.
+        vi.spyOn(oauth, 'usesAppOAuth').mockReturnValue(true);
+        const { session } = createSession(async () => ({}));
+        await session.login(rawToken, { loadOnboardingStatus: false });
+
+        await expect(session.authCallback).resolves.toBe(`Bearer ${rawToken}`);
+        await expect(session.clone().authCallback).resolves.toBe(`Bearer ${rawToken}`);
+        await session.refreshAuthToken();
+        expect(acquireOAuth).not.toHaveBeenCalled();
+    });
+
+    it('retains OAuth acquisition and refresh for OAuth logins and cloned sessions', async () => {
+        const rawToken = encodeToken({ ...projectToken, type: PrincipalType.OAuthAccess });
+        const acquireOAuth = vi.spyOn(oauth, 'getAppOAuthToken').mockResolvedValue(rawToken);
+        const acquireLegacy = vi.spyOn(composable, 'getComposableToken');
+        const { session } = createSession(async () => ({}));
+        await session.login(rawToken, { loadOnboardingStatus: false, authMethod: 'oauth' });
+
+        await expect(session.authCallback).resolves.toBe(`Bearer ${rawToken}`);
+        await expect(session.clone().authCallback).resolves.toBe(`Bearer ${rawToken}`);
+        await session.refreshAuthToken();
+        expect(acquireOAuth).toHaveBeenCalledWith(true);
+        expect(acquireLegacy).not.toHaveBeenCalled();
+    });
+});

package/src/session/UserSession.ts

@@ -8,17 +8,20 @@ import { getComposableToken } from './auth/composable';
 import { authReturnUrl, centralAuthUrl, mountRootUrl, shouldRedirectToCentralAuth } from './auth/domainRouting';
 import { getFirebaseAuth } from './auth/firebase';
 import { gatewayFetch, loadGatewaySession, logoutGatewaySession, usesGatewaySession } from './auth/gateway';
-import { clearAppOAuth, getAppOAuthToken, usesAppOAuth } from './auth/oauth';
+import { getAppOAuthToken, revokeAppOAuthSession } from './auth/oauth';
 
 import { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY } from './constants';
 
 export { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY };
 
 export interface UserSessionLoginOptions {
+    /** Studio-only onboarding; custom apps leave this disabled. */
     loadOnboardingStatus?: boolean;
+    authMethod?: 'token' | 'oauth';
 }
 
 class UserSession {
+    private authMethod: 'token' | 'oauth' = 'token';
     isLoading = true;
     client: VertesiaClient;
     authError?: Error;
@@ -80,7 +83,7 @@ class UserSession {
     }
 
     get rawAuthToken() {
-        if (usesAppOAuth()) return getAppOAuthToken();
+        if (this.authMethod === 'oauth') return getAppOAuthToken();
         if (usesGatewaySession())
             return Promise.reject(new Error('Gateway session credentials are not available to application JavaScript'));
         return getComposableToken().then((res) => {
@@ -104,9 +107,8 @@ class UserSession {
             this.setSession?.(this.clone());
             return payload;
         }
-        if (usesAppOAuth()) {
-            clearAppOAuth();
-            this.authToken = jwtDecode<AuthTokenPayload>(await getAppOAuthToken());
+        if (this.authMethod === 'oauth') {
+            this.authToken = jwtDecode<AuthTokenPayload>(await getAppOAuthToken(true));
             this.setSession?.(this.clone());
             return this.authToken;
         }
@@ -130,6 +132,8 @@ class UserSession {
     }
 
     async login(token: string, options: UserSessionLoginOptions = {}) {
+        // Bind credential lookup to the completed login, not the transient URL hash/state.
+        this.authMethod = options.authMethod ?? 'token';
         this.authError = undefined;
         this.isLoading = false;
         this.client.withAuthCallback(() => this.authCallback);
@@ -147,7 +151,7 @@ class UserSession {
         // notify the host app of the login
         Env.onLogin?.(this.authToken);
 
-        if (options.loadOnboardingStatus ?? true) {
+        if (options.loadOnboardingStatus) {
             await this.fetchOnboardingStatus();
         }
 
@@ -185,8 +189,15 @@ class UserSession {
             return;
         }
 
-        if (usesAppOAuth()) {
-            clearAppOAuth();
+        if (this.authMethod === 'oauth') {
+            void revokeAppOAuthSession()
+                .catch(() => undefined)
+                .finally(() => {
+                    const logoutUrl = new URL(centralAuthUrl());
+                    logoutUrl.pathname = '/logout';
+                    logoutUrl.searchParams.set('redirect_uri', authReturnUrl().toString());
+                    location.replace(logoutUrl.toString());
+                });
             this.client.withAuthCallback(undefined);
             this.authToken = undefined;
             this.authError = undefined;
@@ -336,6 +347,7 @@ class UserSession {
         session.isLoading = this.isLoading;
         session.authError = this.authError;
         session.authToken = this.authToken;
+        session.authMethod = this.authMethod;
         session.setSession = this.setSession;
         session.lastSelectedAccount = this.lastSelectedAccount;
         session.switchAccount = this.switchAccount;

package/src/session/UserSessionProvider.handoff.test.tsx

@@ -0,0 +1,103 @@
+import { cleanup, render, waitFor } from '@testing-library/react';
+import { type AuthTokenPayload, PrincipalType } from '@vertesia/common';
+import { Env } from '@vertesia/ui/env';
+import { useEffect } from 'react';
+import { afterEach, expect, it, vi } from 'vitest';
+import { generateAuthState } from './auth/authState';
+import { getComposableToken } from './auth/composable';
+import { usesAppOAuth } from './auth/oauth';
+import { useUserSession } from './UserSession';
+import { UserSessionProvider } from './UserSessionProvider';
+
+// Only the credential exchange boundary is stubbed. Provider selection, nonce consumption,
+// session cloning, and the SDK authorization callback run together.
+vi.mock('./auth/composable', async (original) => ({
+    ...(await original<typeof import('./auth/composable')>()),
+    getComposableToken: vi.fn(),
+}));
+afterEach(() => {
+    cleanup();
+    vi.clearAllMocks();
+    vi.unstubAllGlobals();
+    window.history.replaceState(null, '', '/');
+    sessionStorage.clear();
+    localStorage.clear();
+});
+
+it.each(
+    ['/oauth/device?user_code=ABCD-EFGH', '/oauth/authorize/request-id', '/cli'].flatMap((path) =>
+        ['token', 'oauth'].map((method) => ({ path, method })),
+    ),
+)('keeps the $method session API callback on $path', async ({ path, method }) => {
+    const issuer = 'https://sts.dev1.vertesia.io';
+    const clientId = 'https://api.dev1.vertesia.io/.well-known/oauth-client/vertesia-studio';
+    const claims: AuthTokenPayload = {
+        sub: 'user',
+        user_id: 'user',
+        name: 'Test User',
+        type: method === 'oauth' ? PrincipalType.OAuthAccess : PrincipalType.User,
+        iss: issuer,
+        apps: [],
+        accounts: [],
+        account_roles: [],
+        aud: issuer,
+        account: { id: 'a', name: 'Account' },
+        project: { id: 'p', name: 'Project', account: 'a' },
+        exp: Math.floor(Date.now() / 1000) + 3600,
+    };
+    const token = `e30.${btoa(JSON.stringify(claims))}.signature`;
+    Env.init({
+        name: 'test',
+        version: '1',
+        type: 'production',
+        isLocalDev: false,
+        isDocker: false,
+        endpoints: { studio: 'https://api.dev1.vertesia.io', zeno: 'https://api.dev1.vertesia.io', sts: issuer },
+        oauth: {
+            clientId,
+            redirectUri: `${window.location.origin}/oauth/callback`,
+        },
+    });
+    const url = new URL(path, window.location.origin);
+    url.searchParams.set('a', 'a');
+    url.searchParams.set('p', 'p');
+    if (method === 'token') {
+        const state = generateAuthState();
+        url.hash = `token=${token}&state=${state}`;
+        vi.mocked(getComposableToken).mockResolvedValue({ rawToken: token, token: claims, error: false });
+    } else {
+        // Seed only synthetic credentials and public fixture metadata, never runtime auth configuration.
+        sessionStorage.setItem(
+            'vertesia.oauth.access',
+            JSON.stringify({
+                token,
+                issuer,
+                clientId,
+            }),
+        );
+        vi.mocked(getComposableToken).mockRejectedValue(new Error('OAuth must not use the legacy exchange'));
+    }
+    window.history.replaceState(null, '', url.toString());
+    const received = vi.fn();
+    const failed = vi.fn();
+    function Probe() {
+        const session = useUserSession();
+        useEffect(() => {
+            if (session.user) void session.clone().authCallback.then(received).catch(failed);
+        }, [session]);
+        return <span>{session.user?.name}</span>;
+    }
+    const view = render(
+        <UserSessionProvider>
+            <Probe />
+        </UserSessionProvider>,
+    );
+    await view.findByText('Test User');
+    await waitFor(() => expect(window.location.hash).toBe(''));
+    expect(sessionStorage.getItem('auth_state')).toBeNull();
+    expect(usesAppOAuth()).toBe(true);
+    await waitFor(() => expect(received).toHaveBeenCalledWith(`Bearer ${token}`));
+    expect(failed).not.toHaveBeenCalled();
+    if (method === 'oauth') expect(getComposableToken).not.toHaveBeenCalled();
+    expect(sessionStorage.getItem('vertesia.oauth.transaction')).toBeNull();
+});