@vertesia/ui 1.6.0-dev.20261004.085740Z → 1.6.0-dev.20261009.095813Z

package/src/i18n/locales/zh.json

@@ -139,6 +139,7 @@
     "agent.fullscreen": "全屏",
     "agent.hideActiveWorkstreams": "隐藏活跃工作流",
     "agent.hideDetails": "隐藏详情",
+    "agent.hideQuestions": "隐藏问题",
     "agent.hideSidebar": "隐藏侧边栏",
     "agent.hideThinkingDetails": "隐藏思考详情",
     "agent.inProgress": "进行中",
@@ -181,6 +182,7 @@
     "agent.pdfExportFailed": "PDF导出失败",
     "agent.pdfExportReady": "PDF导出已就绪",
     "agent.pending": "待处理",
+    "agent.pendingQuestions": "等待您的回复",
     "agent.plan": "计划",
     "agent.planProgress": "计划进度",
     "agent.plansWillAppear": "当代理创建计划时，将在此处显示",
@@ -225,6 +227,7 @@
     "agent.showDetails": "显示详情",
     "agent.showLess": "显示更少",
     "agent.showMore": "显示更多",
+    "agent.showQuestions": "显示问题",
     "agent.showSidebar": "显示侧边栏",
     "agent.showSystemArtifacts": "系统文件",
     "agent.staged": "已暂存",
@@ -246,6 +249,7 @@
     "agent.thinking": "思考中...",
     "agent.timeout": "已超时",
     "agent.toggleRightSidebar": "切换右侧边栏",
+    "agent.typeDifferentResponse": "或输入其他回复...",
     "agent.typeYourMessage": "输入消息...",
     "agent.typeYourResponse": "输入您的回复...",
     "agent.unableToOpenPrint": "无法打开打印预览",
@@ -286,6 +290,17 @@
     "auth.email.placeholder": "you@company.com",
     "auth.email.title": "欢迎使用 Vertesia",
     "auth.error": "错误：{{message}}",
+    "auth.password.body": "请输入此账户的密码。",
+    "auth.password.continue": "使用密码继续",
+    "auth.password.eyebrow": "密码登录",
+    "auth.password.failed": "无法登录，请重试。",
+    "auth.password.invalidCredentials": "电子邮件或密码不正确。",
+    "auth.password.label": "密码",
+    "auth.password.notAvailable": "此电子邮件不支持密码登录。",
+    "auth.password.required": "请输入密码。",
+    "auth.password.submit": "登录",
+    "auth.password.title": "输入密码",
+    "auth.password.tooManyAttempts": "尝试次数过多。请等待几分钟后重试。",
     "auth.pending.authenticating": "正在认证",
     "auth.pending.body": "请稍候 — 我们正在为您安全跳转。只需稍候片刻。",
     "auth.pending.cancel": "取消",

package/src/session/auth/composable.ts

@@ -116,17 +116,7 @@ function identityFromAcceptedToken(token: string): AuthenticatedIdentity | undef
     }
 }
 
-export function resolveAuthSelection(currentUrl: URL): { accountId?: string; projectId?: string } {
-    // A URL selection owns the whole pair: never attach an unrelated configured account/project.
-    const hasUrlScope = currentUrl.searchParams.has('a') || currentUrl.searchParams.has('p');
-    const defaults = hasUrlScope ? undefined : Env.defaultAuthSelection;
-    const urlAccount = currentUrl.searchParams.get('a') ?? defaults?.accountId;
-    const urlProject = currentUrl.searchParams.get('p') ?? defaults?.projectId;
-    // A project alone identifies its account, so the stored selection only fills in a missing project.
-    const stored = urlProject === undefined ? readScopeSelection(urlAccount) : undefined;
-
-    return { accountId: urlAccount ?? stored?.accountId, projectId: urlProject ?? stored?.projectId };
-}
+export { resolveAuthSelection } from '../scopeSelection';
 
 function decodeToken(token: string): AuthTokenPayload {
     return jwtDecode(token) as AuthTokenPayload;

package/src/session/auth/firebase.ts

@@ -92,10 +92,9 @@ export async function setFirebaseTenant(tenantEmail?: string) {
                 // Handle HTTP error responses
                 if (!response.ok) {
                     // If the error is 404 Not Found, no need to retry
+                    // How older servers answered "this address has no SSO tenant": an ordinary outcome.
                     if (response.status === 404) {
-                        Env.logger.warn('Firebase tenant was not found; continuing with the default tenant', {
-                            vertesia: { status: response.status },
-                        });
+                        Env.logger.debug('No Firebase tenant for this address; using the default tenant');
                         return;
                     }
 
@@ -103,10 +102,14 @@ export async function setFirebaseTenant(tenantEmail?: string) {
                     throw new Error(errorData?.error ?? `HTTP error ${response.status}`);
                 }
 
-                // Successfully got a response, parse it
-                const data = (await response.json()) as UIResolvedTenant;
+                // Successfully got a response, parse it. `null` means the address has no SSO tenant.
+                const data = (await response.json()) as UIResolvedTenant | null;
+                if (data === null) {
+                    Env.logger.debug('No Firebase tenant for this address; using the default tenant');
+                    return;
+                }
 
-                if (data?.firebaseTenantId) {
+                if (data.firebaseTenantId) {
                     const auth = getFirebaseAuth();
                     auth.tenantId = data.firebaseTenantId;
                     Env.firebase.providerType = data.provider ?? 'oidc';

package/src/session/auth/oauth.ts

@@ -1,6 +1,7 @@
-import type { AuthTokenPayload } from '@vertesia/common';
+import { type AuthTokenPayload, REQUESTED_SCOPE_UNAVAILABLE_ERROR_CODE } from '@vertesia/common';
 import { Env } from '@vertesia/ui/env';
 import { jwtDecode } from 'jwt-decode';
+import { forgetRejectedScopeSelection, resolveAuthSelection, type ScopeSelection } from '../scopeSelection';
 import { markCentralAuthRoundTripStarted } from './authRoundTrip';
 import { verifyAuthState } from './authState';
 import { usesGatewaySession } from './gateway';
@@ -61,6 +62,8 @@ interface Transaction {
     redirectUri: string;
     issuer: string;
     target: string;
+    rememberedScope?: ScopeSelection;
+    retryScope?: ScopeSelection;
 }
 
 export function clearAppOAuth(): void {
@@ -86,8 +89,9 @@ async function acquireToken(forceRefresh = false): Promise<string> {
     }
     const redirectUri = redirect.toString();
     if (new URL(redirectUri).origin !== window.location.origin) throw new Error('OAuth callback must be same-origin');
-    const issuer = Env.endpoints.sts.replace(/\/+$/, '');
-    const current = new URL(window.location.href);
+    const issuer = (config.issuer ? httpsUrl(config.issuer).toString() : Env.endpoints.sts).replace(/\/+$/, '');
+    let current = new URL(window.location.href);
+    let { accountId, projectId } = resolveAuthSelection(current);
     const callback = current.origin + current.pathname === new URL(redirectUri).origin + new URL(redirectUri).pathname;
     const state = callback ? current.searchParams.get('state') : null;
     const code = callback ? current.searchParams.get('code') : null;
@@ -109,7 +113,19 @@ async function acquireToken(forceRefresh = false): Promise<string> {
         ) {
             throw new Error('Invalid or expired OAuth login state');
         }
-        if (error || !code) throw new Error(`Application sign-in was not completed (${error || 'missing code'})`);
+        if (error === REQUESTED_SCOPE_UNAVAILABLE_ERROR_CODE && transaction.rememberedScope?.accountId) {
+            const target = new URL(transaction.target);
+            if (target.origin !== window.location.origin) throw new Error('Invalid OAuth return target');
+            forgetRejectedScopeSelection(transaction.rememberedScope.accountId, transaction.rememberedScope.projectId);
+            clearAppOAuth();
+            current = target;
+            window.history.replaceState(window.history.state, '', current);
+            accountId = transaction.retryScope?.accountId;
+            projectId = undefined;
+            transaction = undefined;
+        } else if (error || !code) {
+            throw new Error(`Application sign-in was not completed (${error || 'missing code'})`);
+        }
     } else {
         const raw = sessionStorage.getItem(TOKEN_KEY);
         if (raw) {
@@ -124,8 +140,8 @@ async function acquireToken(forceRefresh = false): Promise<string> {
                 config.offlineAccess &&
                 cached.clientId === clientId &&
                 cached.issuer === issuer &&
-                (!current.searchParams.get('p') || claims.project?.id === current.searchParams.get('p')) &&
-                (!current.searchParams.get('a') || claims.account?.id === current.searchParams.get('a'))
+                (!projectId || claims.project?.id === projectId) &&
+                (!accountId || claims.account?.id === accountId)
             )
                 refreshCredential =
                     refreshSession?.clientId === clientId && refreshSession.issuer === issuer
@@ -138,14 +154,19 @@ async function acquireToken(forceRefresh = false): Promise<string> {
                 cached.issuer === issuer &&
                 !forceRefresh &&
                 claims.exp > Date.now() / 1000 + (config.offlineAccess ? 300 : 30) &&
-                (!current.searchParams.get('p') || claims.project?.id === current.searchParams.get('p')) &&
-                (!current.searchParams.get('a') || claims.account?.id === current.searchParams.get('a'))
+                (!projectId || claims.project?.id === projectId) &&
+                (!accountId || claims.account?.id === accountId)
             ) {
                 return cached.token;
             }
         }
     }
-    const discovery = await fetch(`${issuer}/.well-known/oauth-authorization-server`);
+    const issuerUrl = new URL(issuer);
+    const discoveryUrl = new URL(
+        `/.well-known/oauth-authorization-server${issuerUrl.pathname.replace(/\/$/, '')}`,
+        issuerUrl.origin,
+    );
+    const discovery = await fetch(discoveryUrl);
     if (!discovery.ok) throw new Error(`OAuth discovery failed (${discovery.status})`);
     const metadata: {
         issuer: string;
@@ -158,7 +179,7 @@ async function acquireToken(forceRefresh = false): Promise<string> {
     const tokenEndpoint = httpsUrl(metadata.token_endpoint);
     const revocationEndpoint =
         metadata.revocation_endpoint === undefined ? undefined : httpsUrl(metadata.revocation_endpoint).toString();
-    const resource = new URL(metadata.issuer).toString();
+    const resource = config.resource ? httpsUrl(config.resource).toString() : new URL(metadata.issuer).toString();
     if (refreshCredential) {
         try {
             const response = await fetch(tokenEndpoint, {
@@ -184,8 +205,8 @@ async function acquireToken(forceRefresh = false): Promise<string> {
                     claims.iss.replace(/\/+$/, '') !== issuer ||
                     claims.client_id !== clientId ||
                     claims.exp <= Date.now() / 1000 ||
-                    (!!current.searchParams.get('a') && claims.account?.id !== current.searchParams.get('a')) ||
-                    (!!current.searchParams.get('p') && claims.project?.id !== current.searchParams.get('p'))
+                    (!!accountId && claims.account?.id !== accountId) ||
+                    (!!projectId && claims.project?.id !== projectId)
                 )
                     throw new OAuthLoginError('Invalid OAuth refresh identity');
                 sessionStorage.setItem(
@@ -272,6 +293,13 @@ async function acquireToken(forceRefresh = false): Promise<string> {
             throw new Error('Application CIMD does not allow this callback');
         if (!config.scopes && document.scope) scopes = document.scope.split(/\s+/);
     }
+    const explicitScope =
+        current.searchParams.has('a') || current.searchParams.has('p')
+            ? {
+                  accountId: current.searchParams.get('a') ?? undefined,
+                  projectId: current.searchParams.get('p') ?? undefined,
+              }
+            : Env.defaultAuthSelection;
     const verifier = randomValue();
     const next: Transaction = {
         state: randomValue(),
@@ -280,6 +308,11 @@ async function acquireToken(forceRefresh = false): Promise<string> {
         redirectUri,
         issuer,
         target: current.toString(),
+        rememberedScope:
+            accountId && explicitScope?.projectId === undefined && (!explicitScope?.accountId || projectId)
+                ? { accountId, projectId }
+                : undefined,
+        retryScope: explicitScope?.accountId ? { accountId: explicitScope.accountId } : undefined,
         created: Date.now(),
     };
     const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
@@ -297,10 +330,8 @@ async function acquireToken(forceRefresh = false): Promise<string> {
             : scopes.filter((s) => s !== 'offline_access')
         ).join(' '),
     );
-    const account = current.searchParams.get('a');
-    if (account) authorize.searchParams.set('account_id', account);
-    const project = current.searchParams.get('p');
-    if (project) authorize.searchParams.set('project_id', project);
+    if (accountId) authorize.searchParams.set('account_id', accountId);
+    if (projectId) authorize.searchParams.set('project_id', projectId);
     sessionStorage.setItem(TRANSACTION_KEY, JSON.stringify(next));
     markCentralAuthRoundTripStarted();
     window.location.replace(authorize.toString());

package/src/session/auth/vertesiaHosts.ts

@@ -1,54 +1,9 @@
 const LOOPBACK_IPV4 = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
 /** A single DNS label: alphanumeric, inner hyphens allowed. */
-export const LABEL = '[a-z0-9](?:[a-z0-9-]*[a-z0-9])?';
+const LABEL = '[a-z0-9](?:[a-z0-9-]*[a-z0-9])?';
 
 /** The region label is optional throughout, because each regional host has a global US alias. */
-export const REGION = `(?:${LABEL}\\.)?`;
-
-/**
- * Hostnames served by the UI backend — Vertesia's own code, not merely a Vertesia-owned name:
- *   `cloud.vertesia.io`, `cloud.us1.vertesia.io`                     — the Cloud UI
- *   `preprod.cloud.vertesia.io`, `preview.cloud.us1.vertesia.io`     — its preview/preprod tiers
- *   `acme.cloud.us1.vertesia.io`                                     — per-IdP-tenant branded hosts
- *   `dev-feat-x.ui.dev1.vertesia.io`                                 — dynamic per-branch dev envs
- *
- * Mirrors the load-balancer host rules (region-lb/main.tf: `cloud.${var.domain}`,
- * `*.cloud.${var.domain}`, `*.ui.${var.domain}`) rather than the DNS zone, so a name we merely own
- * is not trusted for what serves it.
- */
-export const FIRST_PARTY_HOST_PATTERNS: readonly RegExp[] = [
-    new RegExp(`^cloud\\.${REGION}vertesia\\.io$`),
-    new RegExp(`^${LABEL}\\.cloud\\.${REGION}vertesia\\.io$`),
-    new RegExp(`^${LABEL}\\.ui\\.${LABEL}\\.vertesia\\.io$`),
-];
-
-/**
- * Public app-gateway origins. Stable tiers use the `apps*` browser-facing host, while development
- * environments reach the gateway through its `*.api.*` Cloud Run route:
- *   `apps.us1.vertesia.io`, `apps-preview.us1.vertesia.io`
- *   `app-gateway-dev1.api.dev1.vertesia.io`, `app-gateway-us3.api.us3.vertesia.io`
- *
- * The second label is deliberately unconstrained. Branch environments do NOT each get a gateway —
- * they share their region's (`detectGatewayUrl` in packages/server-common/src/env/ServerEnv.ts:444
- * and `getAppgenServerBaseUrl` in packages/workflows/.../app_workspace/workspace-utils.ts), so the
- * host published to browsers is region-scoped, while the per-branch `app-gateway-dev-<branch>`
- * shape in the infrastructure README also exists. Matching `app-gateway-<anything>` covers both,
- * and every Cloud Run service named that way *is* a gateway (region-compute/main.tf:373).
- *
- * These serve every tenant's published application from one shared origin, and published assets
- * need no authentication — so this is generated, low-trust code sitting on a Vertesia-owned
- * hostname. Owning the domain is not the test; which backend serves the origin is.
- *
- * Two load-balancer variables can map further hostnames onto the same backend —
- * `appgen_host_aliases` and `appgen_preview_host_aliases` in
- * infrastructure/terraform/modules/region-lb/variables.tf. Both are empty in every region today; if
- * one is ever set, add the alias here too, or it silently falls through to the permissive branch of
- * Policy L and becomes an origin that may receive a token at any path.
- */
-export const GATEWAY_HOST_PATTERNS: readonly RegExp[] = [
-    new RegExp(`^apps(?:-preview|-preprod)?\\.${REGION}vertesia\\.io$`),
-    new RegExp(`^app-gateway-${LABEL}\\.api\\.${LABEL}\\.vertesia\\.io$`),
-];
+const REGION = `(?:${LABEL}\\.)?`;
 
 export function isLoopbackHostname(hostname: string): boolean {
     if (hostname === 'localhost' || hostname.endsWith('.localhost')) {

package/src/session/index.ts

@@ -8,7 +8,7 @@ export {
     redirectToCentralAuth,
 } from './auth/domainRouting';
 export * from './auth/firebase';
-export { isAppOAuthLoginPending, startAppOAuthLogin } from './auth/oauth';
+export { isAppOAuthLoginPending, revokeAppOAuthSession, startAppOAuthLogin } from './auth/oauth';
 export * from './auth/useAuthState';
 export * from './auth/useCurrentTenant';
 export * from './DevSessionProvider';

package/src/session/scopeSelection.ts

@@ -6,6 +6,7 @@
  * another tab's next token refresh. `localStorage` holds the last selection made in any tab, and
  * only seeds a tab that has no scope of its own yet (a new tab, or the app after a restart).
  */
+import { Env } from '@vertesia/ui/env';
 import { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY } from './constants';
 
 const TabAccountId_KEY = 'composableai.tabAccountId';
@@ -52,6 +53,18 @@ export function readScopeSelection(accountId?: string): ScopeSelection {
     return { accountId: account, projectId: projectId || undefined };
 }
 
+export function resolveAuthSelection(currentUrl: URL): { accountId?: string; projectId?: string } {
+    // A URL selection owns the whole pair: never attach an unrelated configured account/project.
+    const hasUrlScope = currentUrl.searchParams.has('a') || currentUrl.searchParams.has('p');
+    const defaults = hasUrlScope ? undefined : Env.defaultAuthSelection;
+    const urlAccount = currentUrl.searchParams.get('a') ?? defaults?.accountId;
+    const urlProject = currentUrl.searchParams.get('p') ?? defaults?.projectId;
+    // A project alone identifies its account, so the stored selection only fills in a missing project.
+    const stored = urlProject === undefined ? readScopeSelection(urlAccount) : undefined;
+
+    return { accountId: urlAccount ?? stored?.accountId, projectId: urlProject ?? stored?.projectId };
+}
+
 /** Make this the tab's scope and the default for new tabs. */
 export function rememberScopeSelection(accountId: string, projectId?: string): void {
     sessionSet(TabAccountId_KEY, accountId);

package/src/shell/AuthScreenPreview.tsx

@@ -95,6 +95,7 @@ export function AuthScreenPreview({
         setTenant: noop,
         setStoredSession: noop,
         onProceedFromEmail: noop,
+        onPasswordRequired: noop,
         onBack: noop,
         onNotYou: noop,
         onProviderClicked: noop,

package/src/shell/login/SignInFlow.tsx

@@ -13,6 +13,7 @@
 import { useCallback, useEffect, useState } from 'react';
 import SignInAuthPending from './SignInAuthPending';
 import SignInEmailStep, { type TenantInfo } from './SignInEmailStep';
+import SignInPasswordStep from './SignInPasswordStep';
 import SignInProvidersStep from './SignInProvidersStep';
 import SignInReturningStep from './SignInReturningStep';
 import SignInTenantStep from './SignInTenantStep';
@@ -28,7 +29,7 @@ import {
 } from './signInUtils';
 
 /** The modes every host shares. Hosts may add their own; see the `M` parameter below. */
-export type SignInCoreMode = 'email' | 'providers' | 'tenant' | 'returning' | 'pending';
+export type SignInCoreMode = 'email' | 'providers' | 'tenant' | 'password' | 'returning' | 'pending';
 
 export interface SignInFlowOptions {
     /**
@@ -64,6 +65,8 @@ export interface SignInFlowController<M extends string = never> {
     pendingProvider: ProviderId | null;
     /** Email accepted: go to the tenant step when one resolved, otherwise the provider list. */
     onProceedFromEmail: (email: string, tenant?: TenantInfo) => void;
+    /** Show password entry when tenant discovery or a remembered provider requires it. */
+    onPasswordRequired: (email: string) => void;
     /** Back to the email step, dropping the resolved tenant. */
     onBack: () => void;
     /** "Not you?" — forget the remembered identity and sign out. */
@@ -92,7 +95,12 @@ export function useSignInFlow<M extends string = never>(options: SignInFlowOptio
     const onProceedFromEmail = useCallback((e: string, t: TenantInfo | undefined) => {
         setEmail(e);
         setTenant(t);
-        setMode(t ? 'tenant' : 'providers');
+        setMode(t?.provider === 'password' ? 'password' : t ? 'tenant' : 'providers');
+    }, []);
+
+    const onPasswordRequired = useCallback((e: string) => {
+        setEmail(e);
+        setMode('password');
     }, []);
 
     const onBack = useCallback(() => {
@@ -144,6 +152,7 @@ export function useSignInFlow<M extends string = never>(options: SignInFlowOptio
         setStoredSession,
         pendingProvider,
         onProceedFromEmail,
+        onPasswordRequired,
         onBack,
         onNotYou,
         onProviderClicked,
@@ -178,6 +187,15 @@ export function SignInFlowSteps({ flow, redirectTo }: SignInFlowStepsProps) {
     if (mode === 'pending' && pendingProvider) {
         return <SignInAuthPending provider={pendingProvider} />;
     }
+    if (mode === 'password' && email) {
+        return (
+            <SignInPasswordStep
+                email={email}
+                tenantName={tenant?.label || tenant?.name || storedSession?.tenantName || undefined}
+                onBack={flow.onBack}
+            />
+        );
+    }
     if (mode === 'tenant' && tenant) {
         return (
             <SignInTenantStep
@@ -185,6 +203,7 @@ export function SignInFlowSteps({ flow, redirectTo }: SignInFlowStepsProps) {
                 tenant={tenant}
                 onBack={flow.onBack}
                 onProviderClicked={() => flow.onProviderClicked((tenant.provider ?? 'oidc') as ProviderId)}
+                onPasswordRequired={flow.onPasswordRequired}
                 redirectTo={redirectTo}
             />
         );
@@ -195,6 +214,7 @@ export function SignInFlowSteps({ flow, redirectTo }: SignInFlowStepsProps) {
                 email={email}
                 onBack={flow.onBack}
                 onProviderClicked={flow.onProviderClicked}
+                onPasswordRequired={flow.onPasswordRequired}
                 redirectTo={redirectTo}
             />
         );
@@ -205,6 +225,7 @@ export function SignInFlowSteps({ flow, redirectTo }: SignInFlowStepsProps) {
                 session={storedSession}
                 onNotYou={flow.onNotYou}
                 onProviderClicked={flow.onProviderClicked}
+                onPasswordRequired={flow.onPasswordRequired}
                 redirectTo={redirectTo}
             />
         );

package/src/shell/login/SignInIcons.tsx

@@ -1,4 +1,4 @@
-import { LockKeyhole } from 'lucide-react';
+import { KeyRound, LockKeyhole } from 'lucide-react';
 import type { ComponentType, SVGProps } from 'react';
 import type { ProviderId } from './signInUtils';
 
@@ -58,6 +58,7 @@ export const PROVIDER_ICONS: Record<ProviderId, ComponentType<{ className?: stri
     github: GithubIcon,
     microsoft: MicrosoftIcon,
     oidc: OidcIcon,
+    password: KeyRound,
 };
 
 export function providerIcon(provider: ProviderId | string | undefined): ComponentType<{ className?: string }> {

package/src/shell/login/SignInPasswordStep.tsx

@@ -0,0 +1,103 @@
+import { Spinner } from '@vertesia/ui/core';
+import { useUITranslation } from '@vertesia/ui/i18n';
+import { ArrowRight } from 'lucide-react';
+import { useEffect, useRef, useState } from 'react';
+import {
+    SignInEmailRow,
+    SignInPasswordField,
+    SignInStepButton,
+    SignInStepHeader,
+    SignInStepLayout,
+} from './SignInPrimitives';
+import { type PasswordSignInFailure, signInWithPassword } from './signInUtils';
+
+interface SignInPasswordStepProps {
+    email: string;
+    tenantName?: string;
+    onBack: () => void;
+}
+
+/** Password sign-in for an address whose tenant issues passwords instead of federating an IdP. */
+export default function SignInPasswordStep({ email, tenantName, onBack }: SignInPasswordStepProps) {
+    const { t } = useUITranslation();
+    const [password, setPassword] = useState('');
+    const [failure, setFailure] = useState<PasswordSignInFailure | null>(null);
+    const [emptyError, setEmptyError] = useState(false);
+    const [loading, setLoading] = useState(false);
+    const inputRef = useRef<HTMLInputElement>(null);
+
+    useEffect(() => {
+        inputRef.current?.focus();
+    }, []);
+
+    const submit = async (e: React.FormEvent) => {
+        e.preventDefault();
+        if (loading) return;
+        if (!password) {
+            setEmptyError(true);
+            return;
+        }
+        setEmptyError(false);
+        setFailure(null);
+        setLoading(true);
+        const result = await signInWithPassword(email, password);
+        if (!result.ok) {
+            setFailure(result.reason);
+            setLoading(false);
+        }
+        // On success the spinner stays up: the session's auth-state listener finishes the login and
+        // unmounts this screen.
+    };
+
+    // Literal keys, one per failure, so i18next-cli extraction sees every message.
+    const failureMessage = (reason: PasswordSignInFailure) => {
+        switch (reason) {
+            case 'invalid-credentials':
+                return t('auth.password.invalidCredentials');
+            case 'too-many-attempts':
+                return t('auth.password.tooManyAttempts');
+            case 'not-password-tenant':
+                return t('auth.password.notAvailable');
+            case 'failed':
+                return t('auth.password.failed');
+        }
+    };
+    const error = emptyError ? t('auth.password.required') : failure ? failureMessage(failure) : undefined;
+
+    return (
+        <SignInStepLayout>
+            <SignInStepHeader
+                eyebrow={tenantName ?? t('auth.password.eyebrow')}
+                title={t('auth.password.title')}
+                body={t('auth.password.body')}
+            />
+
+            <SignInEmailRow email={email} actionLabel={t('auth.change')} onAction={onBack} />
+
+            <form onSubmit={submit} noValidate className={`flex flex-col ${error ? 'gap-2' : 'gap-6'}`}>
+                <SignInPasswordField
+                    inputRef={inputRef}
+                    label={t('auth.password.label')}
+                    value={password}
+                    onChange={(value) => {
+                        setPassword(value);
+                        if (emptyError) setEmptyError(false);
+                    }}
+                    invalid={!!error}
+                    error={error}
+                />
+
+                <SignInStepButton type="submit" disabled={loading}>
+                    {loading ? (
+                        <Spinner />
+                    ) : (
+                        <>
+                            <span>{t('auth.password.submit')}</span>
+                            <ArrowRight className="!size-3.5" />
+                        </>
+                    )}
+                </SignInStepButton>
+            </form>
+        </SignInStepLayout>
+    );
+}

package/src/shell/login/SignInPrimitives.tsx

@@ -366,6 +366,11 @@ export function SignInOrDivider({ children }: { children: ReactNode }) {
     );
 }
 
+const SIGNIN_INPUT_CLASS =
+    'h-[42px] px-3.5 rounded-md border border-border bg-background text-sm text-foreground placeholder:text-muted ' +
+    'outline-none transition focus:border-info focus:ring-4 focus:ring-info/15 ' +
+    'aria-[invalid=true]:border-destructive aria-[invalid=true]:ring-destructive/15';
+
 interface SignInEmailFieldProps {
     inputRef?: Ref<HTMLInputElement>;
     label: ReactNode;
@@ -396,7 +401,7 @@ export function SignInEmailField({
                 id="vt-login-email"
                 name="vt-login-email"
                 type="email"
-                className="h-[42px] px-3.5 rounded-md border border-border bg-background text-sm text-foreground placeholder:text-muted outline-none transition focus:border-info focus:ring-4 focus:ring-info/15 aria-[invalid=true]:border-destructive aria-[invalid=true]:ring-destructive/15"
+                className={SIGNIN_INPUT_CLASS}
                 placeholder={placeholder}
                 value={value}
                 onChange={(e) => onChange(e.target.value)}
@@ -417,3 +422,50 @@ export function SignInEmailField({
         </div>
     );
 }
+
+interface SignInPasswordFieldProps {
+    inputRef?: Ref<HTMLInputElement>;
+    label: ReactNode;
+    value: string;
+    onChange: (value: string) => void;
+    invalid?: boolean;
+    error?: ReactNode;
+}
+
+/**
+ * Labeled password input with an inline error. Unlike the email field it leaves password managers
+ * enabled: a password account's credential is issued once and is expected to be stored in one.
+ */
+export function SignInPasswordField({
+    inputRef,
+    label,
+    value,
+    onChange,
+    invalid = false,
+    error,
+}: SignInPasswordFieldProps) {
+    return (
+        <div className="flex flex-col gap-1.5">
+            <label htmlFor="vt-login-password" className="text-xs font-medium text-foreground/80">
+                {label}
+            </label>
+            <input
+                ref={inputRef}
+                id="vt-login-password"
+                name="vt-login-password"
+                type="password"
+                className={SIGNIN_INPUT_CLASS}
+                value={value}
+                onChange={(e) => onChange(e.target.value)}
+                aria-invalid={invalid}
+                aria-describedby={error ? 'vt-login-password-error' : undefined}
+                autoComplete="current-password"
+            />
+            {error && (
+                <div id="vt-login-password-error" role="alert" className="text-xs text-destructive">
+                    {error}
+                </div>
+            )}
+        </div>
+    );
+}

package/src/shell/login/SignInProvidersStep.tsx

@@ -1,27 +1,31 @@
 import { useUITranslation } from '@vertesia/ui/i18n';
 import { SignInEmailRow, SignInProviderButton, SignInStepHeader, SignInStepLayout } from './SignInPrimitives';
-import { type ProviderId, providerLabel, startSignIn } from './signInUtils';
+import { type ProviderId, providerLabel, type RedirectProviderId, startSignIn } from './signInUtils';
 
 interface SignInProvidersStepProps {
     email: string;
     onBack: () => void;
     onProviderClicked: (provider: ProviderId) => void;
+    /** The address resolved to a password tenant on retry, so the parent shows the password step. */
+    onPasswordRequired: (email: string) => void;
     redirectTo?: string;
 }
 
-const PROVIDERS: ProviderId[] = ['google', 'github', 'microsoft'];
+const PROVIDERS: RedirectProviderId[] = ['google', 'github', 'microsoft'];
 
 export default function SignInProvidersStep({
     email,
     onBack,
     onProviderClicked,
+    onPasswordRequired,
     redirectTo,
 }: SignInProvidersStepProps) {
     const { t } = useUITranslation();
 
-    const pick = async (provider: ProviderId) => {
+    const pick = async (provider: RedirectProviderId) => {
         onProviderClicked(provider);
-        await startSignIn(provider, email, redirectTo);
+        const result = await startSignIn(provider, email, redirectTo);
+        if (!result.ok && result.reason === 'password-required') onPasswordRequired(email);
     };
 
     return (