@vertesia/ui 1.6.0-dev.20261004.085740Z → 1.6.0-dev.20261008.064737Z

package/src/shell/login/SignInFlow.tsx

@@ -13,6 +13,7 @@
 import { useCallback, useEffect, useState } from 'react';
 import SignInAuthPending from './SignInAuthPending';
 import SignInEmailStep, { type TenantInfo } from './SignInEmailStep';
+import SignInPasswordStep from './SignInPasswordStep';
 import SignInProvidersStep from './SignInProvidersStep';
 import SignInReturningStep from './SignInReturningStep';
 import SignInTenantStep from './SignInTenantStep';
@@ -28,7 +29,7 @@ import {
 } from './signInUtils';
 
 /** The modes every host shares. Hosts may add their own; see the `M` parameter below. */
-export type SignInCoreMode = 'email' | 'providers' | 'tenant' | 'returning' | 'pending';
+export type SignInCoreMode = 'email' | 'providers' | 'tenant' | 'password' | 'returning' | 'pending';
 
 export interface SignInFlowOptions {
     /**
@@ -64,6 +65,8 @@ export interface SignInFlowController<M extends string = never> {
     pendingProvider: ProviderId | null;
     /** Email accepted: go to the tenant step when one resolved, otherwise the provider list. */
     onProceedFromEmail: (email: string, tenant?: TenantInfo) => void;
+    /** Show password entry when tenant discovery or a remembered provider requires it. */
+    onPasswordRequired: (email: string) => void;
     /** Back to the email step, dropping the resolved tenant. */
     onBack: () => void;
     /** "Not you?" — forget the remembered identity and sign out. */
@@ -92,7 +95,12 @@ export function useSignInFlow<M extends string = never>(options: SignInFlowOptio
     const onProceedFromEmail = useCallback((e: string, t: TenantInfo | undefined) => {
         setEmail(e);
         setTenant(t);
-        setMode(t ? 'tenant' : 'providers');
+        setMode(t?.provider === 'password' ? 'password' : t ? 'tenant' : 'providers');
+    }, []);
+
+    const onPasswordRequired = useCallback((e: string) => {
+        setEmail(e);
+        setMode('password');
     }, []);
 
     const onBack = useCallback(() => {
@@ -144,6 +152,7 @@ export function useSignInFlow<M extends string = never>(options: SignInFlowOptio
         setStoredSession,
         pendingProvider,
         onProceedFromEmail,
+        onPasswordRequired,
         onBack,
         onNotYou,
         onProviderClicked,
@@ -178,6 +187,15 @@ export function SignInFlowSteps({ flow, redirectTo }: SignInFlowStepsProps) {
     if (mode === 'pending' && pendingProvider) {
         return <SignInAuthPending provider={pendingProvider} />;
     }
+    if (mode === 'password' && email) {
+        return (
+            <SignInPasswordStep
+                email={email}
+                tenantName={tenant?.label || tenant?.name || storedSession?.tenantName || undefined}
+                onBack={flow.onBack}
+            />
+        );
+    }
     if (mode === 'tenant' && tenant) {
         return (
             <SignInTenantStep
@@ -185,6 +203,7 @@ export function SignInFlowSteps({ flow, redirectTo }: SignInFlowStepsProps) {
                 tenant={tenant}
                 onBack={flow.onBack}
                 onProviderClicked={() => flow.onProviderClicked((tenant.provider ?? 'oidc') as ProviderId)}
+                onPasswordRequired={flow.onPasswordRequired}
                 redirectTo={redirectTo}
             />
         );
@@ -195,6 +214,7 @@ export function SignInFlowSteps({ flow, redirectTo }: SignInFlowStepsProps) {
                 email={email}
                 onBack={flow.onBack}
                 onProviderClicked={flow.onProviderClicked}
+                onPasswordRequired={flow.onPasswordRequired}
                 redirectTo={redirectTo}
             />
         );
@@ -205,6 +225,7 @@ export function SignInFlowSteps({ flow, redirectTo }: SignInFlowStepsProps) {
                 session={storedSession}
                 onNotYou={flow.onNotYou}
                 onProviderClicked={flow.onProviderClicked}
+                onPasswordRequired={flow.onPasswordRequired}
                 redirectTo={redirectTo}
             />
         );

package/src/shell/login/SignInIcons.tsx

@@ -1,4 +1,4 @@
-import { LockKeyhole } from 'lucide-react';
+import { KeyRound, LockKeyhole } from 'lucide-react';
 import type { ComponentType, SVGProps } from 'react';
 import type { ProviderId } from './signInUtils';
 
@@ -58,6 +58,7 @@ export const PROVIDER_ICONS: Record<ProviderId, ComponentType<{ className?: stri
     github: GithubIcon,
     microsoft: MicrosoftIcon,
     oidc: OidcIcon,
+    password: KeyRound,
 };
 
 export function providerIcon(provider: ProviderId | string | undefined): ComponentType<{ className?: string }> {

package/src/shell/login/SignInPasswordStep.tsx

@@ -0,0 +1,103 @@
+import { Spinner } from '@vertesia/ui/core';
+import { useUITranslation } from '@vertesia/ui/i18n';
+import { ArrowRight } from 'lucide-react';
+import { useEffect, useRef, useState } from 'react';
+import {
+    SignInEmailRow,
+    SignInPasswordField,
+    SignInStepButton,
+    SignInStepHeader,
+    SignInStepLayout,
+} from './SignInPrimitives';
+import { type PasswordSignInFailure, signInWithPassword } from './signInUtils';
+
+interface SignInPasswordStepProps {
+    email: string;
+    tenantName?: string;
+    onBack: () => void;
+}
+
+/** Password sign-in for an address whose tenant issues passwords instead of federating an IdP. */
+export default function SignInPasswordStep({ email, tenantName, onBack }: SignInPasswordStepProps) {
+    const { t } = useUITranslation();
+    const [password, setPassword] = useState('');
+    const [failure, setFailure] = useState<PasswordSignInFailure | null>(null);
+    const [emptyError, setEmptyError] = useState(false);
+    const [loading, setLoading] = useState(false);
+    const inputRef = useRef<HTMLInputElement>(null);
+
+    useEffect(() => {
+        inputRef.current?.focus();
+    }, []);
+
+    const submit = async (e: React.FormEvent) => {
+        e.preventDefault();
+        if (loading) return;
+        if (!password) {
+            setEmptyError(true);
+            return;
+        }
+        setEmptyError(false);
+        setFailure(null);
+        setLoading(true);
+        const result = await signInWithPassword(email, password);
+        if (!result.ok) {
+            setFailure(result.reason);
+            setLoading(false);
+        }
+        // On success the spinner stays up: the session's auth-state listener finishes the login and
+        // unmounts this screen.
+    };
+
+    // Literal keys, one per failure, so i18next-cli extraction sees every message.
+    const failureMessage = (reason: PasswordSignInFailure) => {
+        switch (reason) {
+            case 'invalid-credentials':
+                return t('auth.password.invalidCredentials');
+            case 'too-many-attempts':
+                return t('auth.password.tooManyAttempts');
+            case 'not-password-tenant':
+                return t('auth.password.notAvailable');
+            case 'failed':
+                return t('auth.password.failed');
+        }
+    };
+    const error = emptyError ? t('auth.password.required') : failure ? failureMessage(failure) : undefined;
+
+    return (
+        <SignInStepLayout>
+            <SignInStepHeader
+                eyebrow={tenantName ?? t('auth.password.eyebrow')}
+                title={t('auth.password.title')}
+                body={t('auth.password.body')}
+            />
+
+            <SignInEmailRow email={email} actionLabel={t('auth.change')} onAction={onBack} />
+
+            <form onSubmit={submit} noValidate className={`flex flex-col ${error ? 'gap-2' : 'gap-6'}`}>
+                <SignInPasswordField
+                    inputRef={inputRef}
+                    label={t('auth.password.label')}
+                    value={password}
+                    onChange={(value) => {
+                        setPassword(value);
+                        if (emptyError) setEmptyError(false);
+                    }}
+                    invalid={!!error}
+                    error={error}
+                />
+
+                <SignInStepButton type="submit" disabled={loading}>
+                    {loading ? (
+                        <Spinner />
+                    ) : (
+                        <>
+                            <span>{t('auth.password.submit')}</span>
+                            <ArrowRight className="!size-3.5" />
+                        </>
+                    )}
+                </SignInStepButton>
+            </form>
+        </SignInStepLayout>
+    );
+}

package/src/shell/login/SignInPrimitives.tsx

@@ -366,6 +366,11 @@ export function SignInOrDivider({ children }: { children: ReactNode }) {
     );
 }
 
+const SIGNIN_INPUT_CLASS =
+    'h-[42px] px-3.5 rounded-md border border-border bg-background text-sm text-foreground placeholder:text-muted ' +
+    'outline-none transition focus:border-info focus:ring-4 focus:ring-info/15 ' +
+    'aria-[invalid=true]:border-destructive aria-[invalid=true]:ring-destructive/15';
+
 interface SignInEmailFieldProps {
     inputRef?: Ref<HTMLInputElement>;
     label: ReactNode;
@@ -396,7 +401,7 @@ export function SignInEmailField({
                 id="vt-login-email"
                 name="vt-login-email"
                 type="email"
-                className="h-[42px] px-3.5 rounded-md border border-border bg-background text-sm text-foreground placeholder:text-muted outline-none transition focus:border-info focus:ring-4 focus:ring-info/15 aria-[invalid=true]:border-destructive aria-[invalid=true]:ring-destructive/15"
+                className={SIGNIN_INPUT_CLASS}
                 placeholder={placeholder}
                 value={value}
                 onChange={(e) => onChange(e.target.value)}
@@ -417,3 +422,50 @@ export function SignInEmailField({
         </div>
     );
 }
+
+interface SignInPasswordFieldProps {
+    inputRef?: Ref<HTMLInputElement>;
+    label: ReactNode;
+    value: string;
+    onChange: (value: string) => void;
+    invalid?: boolean;
+    error?: ReactNode;
+}
+
+/**
+ * Labeled password input with an inline error. Unlike the email field it leaves password managers
+ * enabled: a password account's credential is issued once and is expected to be stored in one.
+ */
+export function SignInPasswordField({
+    inputRef,
+    label,
+    value,
+    onChange,
+    invalid = false,
+    error,
+}: SignInPasswordFieldProps) {
+    return (
+        <div className="flex flex-col gap-1.5">
+            <label htmlFor="vt-login-password" className="text-xs font-medium text-foreground/80">
+                {label}
+            </label>
+            <input
+                ref={inputRef}
+                id="vt-login-password"
+                name="vt-login-password"
+                type="password"
+                className={SIGNIN_INPUT_CLASS}
+                value={value}
+                onChange={(e) => onChange(e.target.value)}
+                aria-invalid={invalid}
+                aria-describedby={error ? 'vt-login-password-error' : undefined}
+                autoComplete="current-password"
+            />
+            {error && (
+                <div id="vt-login-password-error" role="alert" className="text-xs text-destructive">
+                    {error}
+                </div>
+            )}
+        </div>
+    );
+}

package/src/shell/login/SignInProvidersStep.tsx

@@ -1,27 +1,31 @@
 import { useUITranslation } from '@vertesia/ui/i18n';
 import { SignInEmailRow, SignInProviderButton, SignInStepHeader, SignInStepLayout } from './SignInPrimitives';
-import { type ProviderId, providerLabel, startSignIn } from './signInUtils';
+import { type ProviderId, providerLabel, type RedirectProviderId, startSignIn } from './signInUtils';
 
 interface SignInProvidersStepProps {
     email: string;
     onBack: () => void;
     onProviderClicked: (provider: ProviderId) => void;
+    /** The address resolved to a password tenant on retry, so the parent shows the password step. */
+    onPasswordRequired: (email: string) => void;
     redirectTo?: string;
 }
 
-const PROVIDERS: ProviderId[] = ['google', 'github', 'microsoft'];
+const PROVIDERS: RedirectProviderId[] = ['google', 'github', 'microsoft'];
 
 export default function SignInProvidersStep({
     email,
     onBack,
     onProviderClicked,
+    onPasswordRequired,
     redirectTo,
 }: SignInProvidersStepProps) {
     const { t } = useUITranslation();
 
-    const pick = async (provider: ProviderId) => {
+    const pick = async (provider: RedirectProviderId) => {
         onProviderClicked(provider);
-        await startSignIn(provider, email, redirectTo);
+        const result = await startSignIn(provider, email, redirectTo);
+        if (!result.ok && result.reason === 'password-required') onPasswordRequired(email);
     };
 
     return (

package/src/shell/login/SignInReturningStep.tsx

@@ -21,6 +21,8 @@ interface SignInReturningStepProps {
     session: LastSuccessfulLogin;
     onNotYou: () => void;
     onProviderClicked: (provider: ProviderId) => void;
+    /** The address signs in with a password, so the parent shows the password step instead. */
+    onPasswordRequired: (email: string) => void;
     redirectTo?: string;
 }
 
@@ -28,6 +30,7 @@ export default function SignInReturningStep({
     session,
     onNotYou,
     onProviderClicked,
+    onPasswordRequired,
     redirectTo,
 }: SignInReturningStepProps) {
     const { t } = useUITranslation();
@@ -36,14 +39,23 @@ export default function SignInReturningStep({
     const avatar = <SignInInitialsBadge initials={emailInitial(session.email)} />;
     // A stored tenantName means we resolved the user's organization.
     const hasTenant = !!session.tenantName;
+    const lastProvider = session.lastProvider;
     const primaryLabel =
-        session.lastProvider === 'oidc'
-            ? t('auth.continueWithSignIn')
-            : t('auth.continueWithProvider', { provider: providerLabel(session.lastProvider) });
+        lastProvider === 'password'
+            ? t('auth.password.continue')
+            : lastProvider === 'oidc'
+              ? t('auth.continueWithSignIn')
+              : t('auth.continueWithProvider', { provider: providerLabel(lastProvider) });
 
-    const continueWith = async (provider: ProviderId) => {
-        onProviderClicked(provider);
-        await startSignIn(provider, session.email, redirectTo);
+    const continueWithLastProvider = async () => {
+        if (lastProvider === 'password') {
+            onPasswordRequired(session.email);
+            return;
+        }
+        onProviderClicked(lastProvider);
+        // The stored provider can be stale: the address may now resolve to a password tenant.
+        const result = await startSignIn(lastProvider, session.email, redirectTo);
+        if (!result.ok && result.reason === 'password-required') onPasswordRequired(session.email);
     };
 
     return (
@@ -76,9 +88,9 @@ export default function SignInReturningStep({
 
             <div className="flex flex-col gap-2">
                 <SignInProviderButton
-                    provider={session.lastProvider}
+                    provider={lastProvider}
                     label={primaryLabel}
-                    onClick={() => continueWith(session.lastProvider)}
+                    onClick={continueWithLastProvider}
                     variant="filled"
                 />
                 <SignInStepButton variant="ghost" onClick={onNotYou}>

package/src/shell/login/SignInTenantStep.tsx

@@ -8,13 +8,15 @@ import {
     SignInStepLayout,
 } from './SignInPrimitives';
 import SignInWithProviderButton from './SignInWithProviderButton';
-import { type ProviderId, providerLabel } from './signInUtils';
+import { providerLabel, type RedirectProviderId } from './signInUtils';
 
 interface SignInTenantStepProps {
     email: string;
     tenant: TenantInfo;
     onBack: () => void;
     onProviderClicked: () => void;
+    /** The tenant re-resolved as a password tenant, so the parent shows the password step. */
+    onPasswordRequired: (email: string) => void;
     redirectTo?: string;
 }
 
@@ -32,12 +34,13 @@ export default function SignInTenantStep({
     tenant,
     onBack,
     onProviderClicked,
+    onPasswordRequired,
     redirectTo,
 }: SignInTenantStepProps) {
     const { t } = useUITranslation();
     const tenantName = tenant.label || tenant.name || t('auth.blocked.tenantFallback');
     // Brands keep their identity; anything else routes through OIDC.
-    const provider: ProviderId =
+    const provider: RedirectProviderId =
         tenant.provider === 'google' || tenant.provider === 'github' || tenant.provider === 'microsoft'
             ? tenant.provider
             : 'oidc';
@@ -68,6 +71,7 @@ export default function SignInTenantStep({
                     redirectTo={redirectTo}
                     variant="filled"
                     onClick={onProviderClicked}
+                    onPasswordRequired={() => onPasswordRequired(email)}
                 />
                 <SignInStepButton variant="ghost" onClick={onBack}>
                     {t('auth.tenant.notPartOf', { name: tenantName })}

package/src/shell/login/SignInWithProviderButton.tsx

@@ -1,15 +1,17 @@
 import { useUITranslation } from '@vertesia/ui/i18n';
 import { SignInProviderButton } from './SignInPrimitives';
-import { type ProviderId, providerLabel, startSignIn, startSignInWithoutTenant } from './signInUtils';
+import { providerLabel, type RedirectProviderId, startSignIn, startSignInWithoutTenant } from './signInUtils';
 
 interface SignInWithProviderButtonProps {
-    provider: ProviderId;
+    provider: RedirectProviderId;
     /** Email for the tenant-aware flow. Omit for a no-tenant sign-in (e.g. SignInModal). */
     email?: string;
     redirectTo?: string;
     variant?: 'outline' | 'filled';
     /** Fired on click, before the redirect. */
     onClick?: () => void;
+    /** Fired instead of a redirect when the email resolves to a password tenant. */
+    onPasswordRequired?: () => void;
 }
 
 // "Continue with <provider>" button that owns its sign-in redirect.
@@ -19,6 +21,7 @@ export default function SignInWithProviderButton({
     redirectTo,
     variant = 'outline',
     onClick,
+    onPasswordRequired,
 }: SignInWithProviderButtonProps) {
     const { t } = useUITranslation();
     const label =
@@ -26,15 +29,16 @@ export default function SignInWithProviderButton({
             ? t('auth.continueWithSignIn')
             : t('auth.continueWithProvider', { provider: providerLabel(provider) });
 
-    const signIn = () => {
+    const signIn = async () => {
         onClick?.();
-        if (email) {
-            void startSignIn(provider, email, redirectTo);
-        } else {
+        if (!email) {
             // OIDC needs a resolved tenant; the no-email path is only hit by no-tenant buttons.
             startSignInWithoutTenant(provider, redirectTo);
+            return;
         }
+        const result = await startSignIn(provider, email, redirectTo);
+        if (!result.ok && result.reason === 'password-required') onPasswordRequired?.();
     };
 
-    return <SignInProviderButton provider={provider} label={label} onClick={signIn} variant={variant} />;
+    return <SignInProviderButton provider={provider} label={label} onClick={() => void signIn()} variant={variant} />;
 }

package/src/shell/login/SigninScreen.tsx

@@ -18,7 +18,7 @@ import SignInRecoveryStep, { type SignInRecoveryKind } from './SignInRecoverySte
 import SignInRestrictedEnvStep from './SignInRestrictedEnvStep';
 import SignInTenantBlockedStep from './SignInTenantBlockedStep';
 import SignupForm from './SignupForm';
-import { isInviteRequiredError, readPendingSignin, resetSignInState } from './signInUtils';
+import { isInviteRequiredError, isTenantSignIn, readPendingSignin, resetSignInState } from './signInUtils';
 
 /** Presentation only: the shared screen still owns session gating and recovery transitions. */
 export interface SignInScreenViewProps {
@@ -152,7 +152,12 @@ function SigninScreenImpl({
     useEffect(() => {
         if (!authError) return;
         if (authError instanceof UserNotFoundError) {
-            setMode('signup');
+            if (isTenantSignIn()) {
+                setEmail(authError.email);
+                setMode('blocked');
+            } else {
+                setMode('signup');
+            }
         } else if (authError instanceof RestrictedEnvironmentError) {
             setMode('restricted');
         } else if (authError instanceof RequestedScopeUnavailableError) {
@@ -280,7 +285,7 @@ function SigninScreenImpl({
                 onUseDifferentAccount={useDifferentAccount}
             />
         );
-    } else if (mode === 'signup' && !localStorage.getItem('tenantName')) {
+    } else if (mode === 'signup' && !isTenantSignIn()) {
         content = <SignupForm onSignup={onSignup} goBack={startOver} />;
     } else {
         // Every remaining mode is a core one; an unmatched recovery mode falls through to the

package/src/shell/login/signInUtils.ts

@@ -1,17 +1,22 @@
 import { Env } from '@vertesia/ui/env';
 import { getFirebaseAuth, setFirebaseTenant } from '@vertesia/ui/session';
+import { FirebaseError } from 'firebase/app';
 import {
     type AuthProvider,
     signOut as firebaseSignOut,
     GithubAuthProvider,
     GoogleAuthProvider,
     OAuthProvider,
+    signInWithEmailAndPassword,
     signInWithRedirect,
 } from 'firebase/auth';
 
 // Matches auth-tenants.json `provider` values. Tenant context is derived from
 // email resolution at sign-in time, not encoded here.
-export type ProviderId = 'google' | 'github' | 'microsoft' | 'oidc';
+export type ProviderId = 'google' | 'github' | 'microsoft' | 'oidc' | 'password';
+
+/** Providers that sign in by redirecting to an identity provider. `password` signs in in place. */
+export type RedirectProviderId = Exclude<ProviderId, 'password'>;
 
 export interface LastSuccessfulLogin {
     email: string;
@@ -82,6 +87,13 @@ export function clearPendingSignin(): void {
     }
 }
 
+/**
+ * Detects a tenant sign-in by the key's presence, including tenants with an empty label or name.
+ */
+export function isTenantSignIn(): boolean {
+    return localStorage.getItem('tenantName') !== null;
+}
+
 /**
  * Promotes the pending sign-in record to the last-successful-login entry, stamping the
  * authenticated user's display name.
@@ -166,28 +178,28 @@ const buildOidcProvider: ProviderBuilder = (email) => {
     return p;
 };
 
-const PROVIDER_BUILDERS: Record<ProviderId, ProviderBuilder> = {
+const PROVIDER_BUILDERS: Record<RedirectProviderId, ProviderBuilder> = {
     google: buildGoogleProvider,
     github: buildGithubProvider,
     microsoft: buildMicrosoftProvider,
     oidc: buildOidcProvider,
 };
 
-function buildFirebaseProvider(idp: ProviderId, email?: string, redirectTo?: string): AuthProvider {
+function buildFirebaseProvider(idp: RedirectProviderId, email?: string, redirectTo?: string): AuthProvider {
     return PROVIDER_BUILDERS[idp](email, redirectTo);
 }
 
 export async function startSignIn(
-    provider: ProviderId,
+    provider: RedirectProviderId,
     email: string,
     redirectTo?: string,
-): Promise<{ ok: true } | { ok: false; reason: 'no-email' }> {
+): Promise<{ ok: true } | { ok: false; reason: 'no-email' | 'password-required' }> {
     if (!email) return { ok: false, reason: 'no-email' };
 
     // A tenant-mapped email uses the tenant's provider (overriding `provider`); otherwise use `provider`.
     const tenant = await setFirebaseTenant(email);
     const auth = getFirebaseAuth();
-    let effectiveIdp = provider;
+    let effectiveIdp: ProviderId = provider;
     let tenantName: string | undefined;
 
     if (tenant) {
@@ -201,20 +213,68 @@ export async function startSignIn(
         auth.tenantId = Env.firebase?.tenantId ?? null;
     }
 
+    // A password tenant has no identity provider to redirect to; its step collects the password.
+    if (effectiveIdp === 'password') return { ok: false, reason: 'password-required' };
+
     writePendingSignin({ email, provider: effectiveIdp, tenantName });
     void signInWithRedirect(auth, buildFirebaseProvider(effectiveIdp, email, redirectTo));
     return { ok: true };
 }
 
+export type PasswordSignInFailure = 'not-password-tenant' | 'invalid-credentials' | 'too-many-attempts' | 'failed';
+
+// Firebase reports an unknown user, a wrong password and a disabled user with distinct codes on
+// some SDK versions; they are folded into one answer so the form does not reveal which it was.
+const INVALID_CREDENTIAL_CODES = new Set([
+    'auth/invalid-credential',
+    'auth/invalid-email',
+    'auth/user-disabled',
+    'auth/user-not-found',
+    'auth/wrong-password',
+]);
+
+export function passwordFailureReason(err: unknown): Exclude<PasswordSignInFailure, 'not-password-tenant'> {
+    if (!(err instanceof FirebaseError)) return 'failed';
+    if (INVALID_CREDENTIAL_CODES.has(err.code)) return 'invalid-credentials';
+    if (err.code === 'auth/too-many-requests') return 'too-many-attempts';
+    return 'failed';
+}
+
+/**
+ * Signs in a user of a password tenant, in place — there is no redirect. Only an address whose
+ * domain resolves to a tenant configured for password sign-in may use it; the tenant is resolved
+ * again here rather than trusted from the caller, so a returning session cannot carry a stale one.
+ * On success the session's auth-state listener completes the login.
+ */
+export async function signInWithPassword(
+    email: string,
+    password: string,
+): Promise<{ ok: true } | { ok: false; reason: PasswordSignInFailure }> {
+    const tenant = await setFirebaseTenant(email);
+    if (!tenant) return { ok: false, reason: 'failed' };
+    if (tenant.provider !== 'password') return { ok: false, reason: 'not-password-tenant' };
+
+    const tenantName = tenant.label || tenant.name || undefined;
+    localStorage.setItem('tenantName', tenantName ?? '');
+    writePendingSignin({ email, provider: 'password', tenantName });
+    try {
+        await signInWithEmailAndPassword(getFirebaseAuth(), email, password);
+        return { ok: true };
+    } catch (err: unknown) {
+        clearPendingSignin();
+        return { ok: false, reason: passwordFailureReason(err) };
+    }
+}
+
 /** Starts sign-in without email discovery, preserving an explicitly configured tenant. */
-export function startSignInWithoutTenant(provider: ProviderId, redirectTo?: string): void {
+export function startSignInWithoutTenant(provider: RedirectProviderId, redirectTo?: string): void {
     const auth = getFirebaseAuth();
     localStorage.removeItem('tenantName');
     auth.tenantId = Env.firebase?.tenantId ?? null;
     void signInWithRedirect(
         auth,
         buildFirebaseProvider(
-            Env.firebase?.tenantId ? ((Env.firebase.providerType as ProviderId) ?? 'oidc') : provider,
+            Env.firebase?.tenantId ? ((Env.firebase.providerType as RedirectProviderId) ?? 'oidc') : provider,
             undefined,
             redirectTo,
         ),