@vertesia/ui 1.6.0-dev.20261008.064737Z → 1.6.0-dev.20261009.095813Z

package/src/features/agent/chat/ModernAgentOutput/agentMarkdownStyles.ts

@@ -0,0 +1,248 @@
+/** Prose styling used for agent/model message markdown, shared across the conversation UI. */
+export const AGENT_PROSE_CLASS = [
+    'agent-markdown vprose prose max-w-none break-words text-sm leading-6 text-foreground/80',
+    'prose-p:my-2 prose-p:leading-6 prose-li:my-0.5 prose-pre:my-3 prose-headings:tracking-normal',
+    'prose-headings:text-foreground prose-strong:text-foreground prose-code:text-foreground',
+    'prose-a:text-foreground prose-a:underline prose-a:decoration-muted prose-a:underline-offset-4',
+    'prose-p:text-foreground/80 prose-li:text-foreground/80 prose-li:marker:text-muted',
+].join(' ');
+
+// Shared with rendered regression checks so they exercise the styles the chat actually injects.
+export const agentMarkdownStyles = `
+/* Better vertical rhythm for markdown */
+.vprose > * + *:not(:where(.not-prose, .not-prose *)) {
+    margin-top: 0.625rem;
+}
+.vprose > h1 + *:not(:where(.not-prose, .not-prose *)),
+.vprose > h2 + *:not(:where(.not-prose, .not-prose *)),
+.vprose > h3 + *:not(:where(.not-prose, .not-prose *)) {
+    margin-top: 0.375rem;
+}
+/* Tables should read like part of the conversation, not a separate app grid. */
+.vprose table:not(:where(.not-prose, .not-prose *)) {
+    margin-top: 0.875rem;
+    margin-bottom: 0.875rem;
+    border-collapse: collapse;
+    width: 100%;
+    background: transparent;
+}
+.vprose th:not(:where(.not-prose, .not-prose *)),
+.vprose td:not(:where(.not-prose, .not-prose *)) {
+    padding: 0.5rem 0.625rem;
+    border: 0;
+    border-bottom: 1px solid color-mix(in oklch, var(--border) 70%, transparent);
+    background: transparent;
+    text-align: left;
+}
+.vprose thead th:not(:where(.not-prose, .not-prose *)) {
+    background: transparent;
+    font-weight: 600;
+    color: var(--muted);
+    font-size: 0.75rem;
+    text-transform: none;
+    letter-spacing: 0;
+}
+.vprose tbody tr:hover:not(:where(.not-prose, .not-prose *)) {
+    background: transparent;
+}
+/* Horizontal rules as section dividers */
+.vprose hr:not(:where(.not-prose, .not-prose *)) {
+    margin-top: 1rem;
+    margin-bottom: 1rem;
+    border-color: var(--border);
+}
+/* Better blockquote styling */
+.vprose blockquote:not(:where(.not-prose, .not-prose *)) {
+    margin-top: 0.875rem;
+    margin-bottom: 0.875rem;
+    padding-left: 1rem;
+    border-left-width: 3px;
+    border-left-color: var(--border);
+    color: var(--muted);
+}
+/* Code blocks */
+.vprose pre:not(:where(.not-prose, .not-prose *)) {
+    margin-top: 0.75rem;
+    margin-bottom: 0.75rem;
+    padding: 0.75rem;
+    border-radius: 0.5rem;
+    overflow-x: auto;
+    background-color: var(--muted-background);
+    color: var(--foreground);
+}
+.vprose pre code:not(:where(.not-prose, .not-prose *)) {
+    color: inherit;
+}
+
+/* Summary chat markdown: keep structure, but match the app's quieter conversation surface. */
+.agent-markdown:not(:where(.not-prose, .not-prose *)) {
+    color: color-mix(in oklch, var(--foreground) 78%, transparent);
+    font-size: 0.875rem;
+    line-height: 1.625;
+    overflow-x: auto;
+}
+.agent-markdown > * + *:not(:where(.not-prose, .not-prose *)) {
+    margin-top: 0.65rem;
+}
+.agent-markdown p:not(:where(.not-prose, .not-prose *)) {
+    margin-top: 0.5rem;
+    margin-bottom: 0.5rem;
+}
+.agent-markdown h1:not(:where(.not-prose, .not-prose *)),
+.agent-markdown h2:not(:where(.not-prose, .not-prose *)),
+.agent-markdown h3:not(:where(.not-prose, .not-prose *)),
+.agent-markdown h4:not(:where(.not-prose, .not-prose *)) {
+    margin-top: 1.2rem;
+    margin-bottom: 0.45rem;
+    color: var(--foreground);
+    font-weight: 650;
+    letter-spacing: 0;
+    line-height: 1.3;
+}
+.agent-markdown h1:not(:where(.not-prose, .not-prose *)) {
+    font-size: 1.2rem;
+}
+.agent-markdown h2:not(:where(.not-prose, .not-prose *)) {
+    font-size: 1.05rem;
+}
+.agent-markdown h3:not(:where(.not-prose, .not-prose *)),
+.agent-markdown h4:not(:where(.not-prose, .not-prose *)) {
+    font-size: 0.95rem;
+}
+.agent-markdown h1:first-child:not(:where(.not-prose, .not-prose *)),
+.agent-markdown h2:first-child:not(:where(.not-prose, .not-prose *)),
+.agent-markdown h3:first-child:not(:where(.not-prose, .not-prose *)),
+.agent-markdown h4:first-child:not(:where(.not-prose, .not-prose *)) {
+    margin-top: 0;
+}
+.agent-markdown hr:not(:where(.not-prose, .not-prose *)) {
+    margin: 1.15rem 0;
+    border: 0;
+    border-top: 1px solid var(--border);
+    opacity: 0.65;
+}
+.agent-markdown ul:not(:where(.not-prose, .not-prose *)),
+.agent-markdown ol:not(:where(.not-prose, .not-prose *)) {
+    margin-top: 0.55rem;
+    margin-bottom: 0.55rem;
+    padding-left: 1.25rem;
+}
+.agent-markdown li:not(:where(.not-prose, .not-prose *)) {
+    margin-top: 0.2rem;
+    margin-bottom: 0.2rem;
+    padding-left: 0.1rem;
+    color: inherit;
+}
+.agent-markdown li:not(:where(.not-prose, .not-prose *))::marker {
+    color: var(--muted);
+}
+.agent-markdown strong:not(:where(.not-prose, .not-prose *)) {
+    color: var(--foreground);
+    font-weight: 600;
+}
+.agent-markdown em:not(:where(.not-prose, .not-prose *)) {
+    color: color-mix(in oklch, var(--foreground) 72%, transparent);
+}
+.agent-markdown a:not(:where(.not-prose, .not-prose *)) {
+    color: var(--foreground);
+    text-decoration-color: var(--muted);
+    text-underline-offset: 3px;
+}
+.agent-markdown blockquote:not(:where(.not-prose, .not-prose *)) {
+    margin-top: 0.85rem;
+    margin-bottom: 0.85rem;
+    padding-left: 0.875rem;
+    border-left: 2px solid var(--border);
+    color: var(--muted);
+    font-style: normal;
+}
+.agent-markdown :not(pre) > code:not(:where(.not-prose, .not-prose *)) {
+    border: 1px solid var(--border);
+    border-radius: 0.375rem;
+    background: var(--muted-background);
+    color: var(--foreground);
+    padding: 0.1rem 0.35rem;
+    font-size: 0.8125em;
+    font-weight: 500;
+}
+.agent-markdown pre:not(:where(.not-prose, .not-prose *)) {
+    margin-top: 0.85rem;
+    margin-bottom: 0.85rem;
+    max-height: 32rem;
+    overflow: auto;
+    border: 1px solid var(--border);
+    border-radius: 0.75rem;
+    background: var(--muted-background);
+    color: var(--foreground);
+    padding: 0.875rem;
+    font-size: 0.8125rem;
+    line-height: 1.55;
+}
+.agent-markdown pre code:not(:where(.not-prose, .not-prose *)) {
+    border: 0;
+    background: transparent;
+    color: inherit;
+    padding: 0;
+    font-size: inherit;
+}
+.agent-markdown table:not(:where(.not-prose, .not-prose *)) {
+    display: table;
+    width: 100%;
+    max-width: 100%;
+    margin: 0.9rem 0 1rem;
+    border: 0;
+    border-collapse: collapse;
+    border-spacing: 0;
+    font-size: 0.8125rem;
+    table-layout: fixed;
+    background: transparent;
+}
+.agent-markdown thead:not(:where(.not-prose, .not-prose *)) {
+    background: transparent;
+}
+.agent-markdown th:not(:where(.not-prose, .not-prose *)),
+.agent-markdown td:not(:where(.not-prose, .not-prose *)) {
+    border: 0;
+    border-bottom: 1px solid color-mix(in oklch, var(--border) 70%, transparent);
+    background: transparent;
+    padding: 0.55rem 0.75rem;
+    text-align: left;
+    vertical-align: top;
+    overflow-wrap: anywhere;
+    word-break: normal;
+    white-space: normal;
+}
+.agent-markdown th:not(:where(.not-prose, .not-prose *)) {
+    color: var(--muted);
+    font-size: 0.75rem;
+    font-weight: 600;
+    letter-spacing: 0;
+    text-transform: none;
+    white-space: nowrap;
+}
+.agent-markdown td:not(:where(.not-prose, .not-prose *)) {
+    color: inherit;
+}
+.agent-markdown th + th:not(:where(.not-prose, .not-prose *)),
+.agent-markdown td + td:not(:where(.not-prose, .not-prose *)) {
+    padding-inline-start: 1.75rem;
+}
+.agent-markdown th:first-child:not(:where(.not-prose, .not-prose *)),
+.agent-markdown td:first-child:not(:where(.not-prose, .not-prose *)) {
+    min-width: 0;
+    width: auto;
+    white-space: normal;
+}
+.agent-markdown col:not(:where(.not-prose, .not-prose *)) {
+    width: var(--agent-markdown-table-column-width);
+}
+.agent-markdown tr:last-child td:not(:where(.not-prose, .not-prose *)) {
+    border-bottom: 0;
+}
+.agent-markdown tbody tr:nth-child(even):not(:where(.not-prose, .not-prose *)) {
+    background: transparent;
+}
+.agent-markdown tbody tr:hover:not(:where(.not-prose, .not-prose *)) {
+    background: transparent;
+}
+`;

package/src/i18n/locales/ar.json

@@ -261,6 +261,7 @@
     "agent.thinking": "جارٍ التفكير...",
     "agent.timeout": "انتهت المهلة",
     "agent.toggleRightSidebar": "تبديل الشريط الجانبي الأيمن",
+    "agent.typeDifferentResponse": "أو اكتب ردًا مختلفًا...",
     "agent.typeYourMessage": "اكتب رسالتك...",
     "agent.typeYourResponse": "اكتب ردك...",
     "agent.unableToOpenPrint": "تعذر فتح معاينة الطباعة",

package/src/i18n/locales/de.json

@@ -249,6 +249,7 @@
     "agent.thinking": "Denke nach...",
     "agent.timeout": "Zeitüberschreitung",
     "agent.toggleRightSidebar": "Rechte Seitenleiste umschalten",
+    "agent.typeDifferentResponse": "Oder geben Sie eine andere Antwort ein...",
     "agent.typeYourMessage": "Geben Sie Ihre Nachricht ein...",
     "agent.typeYourResponse": "Geben Sie Ihre Antwort ein...",
     "agent.unableToOpenPrint": "Druckvorschau konnte nicht geöffnet werden",

package/src/i18n/locales/en.json

@@ -322,6 +322,7 @@
     "agent.thinking": "Thinking...",
     "agent.timeout": "Timed out",
     "agent.toggleRightSidebar": "Toggle right sidebar",
+    "agent.typeDifferentResponse": "Or type a different response...",
     "agent.typeYourMessage": "Type your message...",
     "agent.typeYourResponse": "Type your response...",
     "agent.unableToOpenPrint": "Unable to open print preview",

package/src/i18n/locales/es.json

@@ -251,6 +251,7 @@
     "agent.thinking": "Pensando...",
     "agent.timeout": "Tiempo agotado",
     "agent.toggleRightSidebar": "Alternar panel lateral",
+    "agent.typeDifferentResponse": "O escribe una respuesta diferente...",
     "agent.typeYourMessage": "Escribe tu mensaje...",
     "agent.typeYourResponse": "Escribe tu respuesta...",
     "agent.unableToOpenPrint": "No se pudo abrir la vista previa de impresión",

package/src/i18n/locales/fr.json

@@ -251,6 +251,7 @@
     "agent.thinking": "Réflexion...",
     "agent.timeout": "Délai dépassé",
     "agent.toggleRightSidebar": "Basculer le panneau latéral",
+    "agent.typeDifferentResponse": "Ou saisissez une autre réponse...",
     "agent.typeYourMessage": "Saisissez votre message...",
     "agent.typeYourResponse": "Saisissez votre réponse...",
     "agent.unableToOpenPrint": "Impossible d'ouvrir l'aperçu d'impression",

package/src/i18n/locales/it.json

@@ -251,6 +251,7 @@
     "agent.thinking": "Sto pensando...",
     "agent.timeout": "Tempo scaduto",
     "agent.toggleRightSidebar": "Alterna pannello laterale",
+    "agent.typeDifferentResponse": "Oppure scrivi una risposta diversa...",
     "agent.typeYourMessage": "Scrivi il tuo messaggio...",
     "agent.typeYourResponse": "Scrivi la tua risposta...",
     "agent.unableToOpenPrint": "Impossibile aprire l'anteprima di stampa",

package/src/i18n/locales/ja.json

@@ -249,6 +249,7 @@
     "agent.thinking": "考え中...",
     "agent.timeout": "タイムアウト",
     "agent.toggleRightSidebar": "右サイドバーの切り替え",
+    "agent.typeDifferentResponse": "または別の回答を入力...",
     "agent.typeYourMessage": "メッセージを入力...",
     "agent.typeYourResponse": "回答を入力...",
     "agent.unableToOpenPrint": "印刷プレビューを開けません",

package/src/i18n/locales/ko.json

@@ -249,6 +249,7 @@
     "agent.thinking": "생각 중...",
     "agent.timeout": "시간 초과",
     "agent.toggleRightSidebar": "오른쪽 사이드바 전환",
+    "agent.typeDifferentResponse": "또는 다른 응답을 입력하세요...",
     "agent.typeYourMessage": "메시지를 입력하세요...",
     "agent.typeYourResponse": "응답을 입력하세요...",
     "agent.unableToOpenPrint": "인쇄 미리보기를 열 수 없습니다",

package/src/i18n/locales/pt.json

@@ -251,6 +251,7 @@
     "agent.thinking": "Pensando...",
     "agent.timeout": "Tempo esgotado",
     "agent.toggleRightSidebar": "Alternar painel lateral",
+    "agent.typeDifferentResponse": "Ou digite uma resposta diferente...",
     "agent.typeYourMessage": "Digite sua mensagem...",
     "agent.typeYourResponse": "Digite sua resposta...",
     "agent.unableToOpenPrint": "Não foi possível abrir a visualização de impressão",

package/src/i18n/locales/ru.json

@@ -255,6 +255,7 @@
     "agent.thinking": "Размышляю...",
     "agent.timeout": "Время ожидания истекло",
     "agent.toggleRightSidebar": "Переключить правую панель",
+    "agent.typeDifferentResponse": "Или введите другой ответ...",
     "agent.typeYourMessage": "Введите сообщение...",
     "agent.typeYourResponse": "Введите ваш ответ...",
     "agent.unableToOpenPrint": "Не удалось открыть предпросмотр печати",

package/src/i18n/locales/tr.json

@@ -249,6 +249,7 @@
     "agent.thinking": "Düşünüyor...",
     "agent.timeout": "Zaman aşımına uğradı",
     "agent.toggleRightSidebar": "Sağ kenar çubuğunu aç/kapat",
+    "agent.typeDifferentResponse": "Ya da farklı bir yanıt yazın...",
     "agent.typeYourMessage": "Mesajınızı yazın...",
     "agent.typeYourResponse": "Yanıtınızı yazın...",
     "agent.unableToOpenPrint": "Yazdırma önizlemesi açılamadı",

package/src/i18n/locales/zh-TW.json

@@ -249,6 +249,7 @@
     "agent.thinking": "思考中...",
     "agent.timeout": "已逾時",
     "agent.toggleRightSidebar": "切換右側邊欄",
+    "agent.typeDifferentResponse": "或輸入其他回覆...",
     "agent.typeYourMessage": "輸入訊息...",
     "agent.typeYourResponse": "輸入您的回覆...",
     "agent.unableToOpenPrint": "無法開啟列印預覽",

package/src/i18n/locales/zh.json

@@ -249,6 +249,7 @@
     "agent.thinking": "思考中...",
     "agent.timeout": "已超时",
     "agent.toggleRightSidebar": "切换右侧边栏",
+    "agent.typeDifferentResponse": "或输入其他回复...",
     "agent.typeYourMessage": "输入消息...",
     "agent.typeYourResponse": "输入您的回复...",
     "agent.unableToOpenPrint": "无法打开打印预览",

package/src/session/auth/composable.ts

@@ -116,17 +116,7 @@ function identityFromAcceptedToken(token: string): AuthenticatedIdentity | undef
     }
 }
 
-export function resolveAuthSelection(currentUrl: URL): { accountId?: string; projectId?: string } {
-    // A URL selection owns the whole pair: never attach an unrelated configured account/project.
-    const hasUrlScope = currentUrl.searchParams.has('a') || currentUrl.searchParams.has('p');
-    const defaults = hasUrlScope ? undefined : Env.defaultAuthSelection;
-    const urlAccount = currentUrl.searchParams.get('a') ?? defaults?.accountId;
-    const urlProject = currentUrl.searchParams.get('p') ?? defaults?.projectId;
-    // A project alone identifies its account, so the stored selection only fills in a missing project.
-    const stored = urlProject === undefined ? readScopeSelection(urlAccount) : undefined;
-
-    return { accountId: urlAccount ?? stored?.accountId, projectId: urlProject ?? stored?.projectId };
-}
+export { resolveAuthSelection } from '../scopeSelection';
 
 function decodeToken(token: string): AuthTokenPayload {
     return jwtDecode(token) as AuthTokenPayload;

package/src/session/auth/firebase.ts

@@ -92,10 +92,9 @@ export async function setFirebaseTenant(tenantEmail?: string) {
                 // Handle HTTP error responses
                 if (!response.ok) {
                     // If the error is 404 Not Found, no need to retry
+                    // How older servers answered "this address has no SSO tenant": an ordinary outcome.
                     if (response.status === 404) {
-                        Env.logger.warn('Firebase tenant was not found; continuing with the default tenant', {
-                            vertesia: { status: response.status },
-                        });
+                        Env.logger.debug('No Firebase tenant for this address; using the default tenant');
                         return;
                     }
 
@@ -103,10 +102,14 @@ export async function setFirebaseTenant(tenantEmail?: string) {
                     throw new Error(errorData?.error ?? `HTTP error ${response.status}`);
                 }
 
-                // Successfully got a response, parse it
-                const data = (await response.json()) as UIResolvedTenant;
+                // Successfully got a response, parse it. `null` means the address has no SSO tenant.
+                const data = (await response.json()) as UIResolvedTenant | null;
+                if (data === null) {
+                    Env.logger.debug('No Firebase tenant for this address; using the default tenant');
+                    return;
+                }
 
-                if (data?.firebaseTenantId) {
+                if (data.firebaseTenantId) {
                     const auth = getFirebaseAuth();
                     auth.tenantId = data.firebaseTenantId;
                     Env.firebase.providerType = data.provider ?? 'oidc';

package/src/session/auth/oauth.ts

@@ -1,6 +1,7 @@
-import type { AuthTokenPayload } from '@vertesia/common';
+import { type AuthTokenPayload, REQUESTED_SCOPE_UNAVAILABLE_ERROR_CODE } from '@vertesia/common';
 import { Env } from '@vertesia/ui/env';
 import { jwtDecode } from 'jwt-decode';
+import { forgetRejectedScopeSelection, resolveAuthSelection, type ScopeSelection } from '../scopeSelection';
 import { markCentralAuthRoundTripStarted } from './authRoundTrip';
 import { verifyAuthState } from './authState';
 import { usesGatewaySession } from './gateway';
@@ -61,6 +62,8 @@ interface Transaction {
     redirectUri: string;
     issuer: string;
     target: string;
+    rememberedScope?: ScopeSelection;
+    retryScope?: ScopeSelection;
 }
 
 export function clearAppOAuth(): void {
@@ -87,7 +90,8 @@ async function acquireToken(forceRefresh = false): Promise<string> {
     const redirectUri = redirect.toString();
     if (new URL(redirectUri).origin !== window.location.origin) throw new Error('OAuth callback must be same-origin');
     const issuer = (config.issuer ? httpsUrl(config.issuer).toString() : Env.endpoints.sts).replace(/\/+$/, '');
-    const current = new URL(window.location.href);
+    let current = new URL(window.location.href);
+    let { accountId, projectId } = resolveAuthSelection(current);
     const callback = current.origin + current.pathname === new URL(redirectUri).origin + new URL(redirectUri).pathname;
     const state = callback ? current.searchParams.get('state') : null;
     const code = callback ? current.searchParams.get('code') : null;
@@ -109,7 +113,19 @@ async function acquireToken(forceRefresh = false): Promise<string> {
         ) {
             throw new Error('Invalid or expired OAuth login state');
         }
-        if (error || !code) throw new Error(`Application sign-in was not completed (${error || 'missing code'})`);
+        if (error === REQUESTED_SCOPE_UNAVAILABLE_ERROR_CODE && transaction.rememberedScope?.accountId) {
+            const target = new URL(transaction.target);
+            if (target.origin !== window.location.origin) throw new Error('Invalid OAuth return target');
+            forgetRejectedScopeSelection(transaction.rememberedScope.accountId, transaction.rememberedScope.projectId);
+            clearAppOAuth();
+            current = target;
+            window.history.replaceState(window.history.state, '', current);
+            accountId = transaction.retryScope?.accountId;
+            projectId = undefined;
+            transaction = undefined;
+        } else if (error || !code) {
+            throw new Error(`Application sign-in was not completed (${error || 'missing code'})`);
+        }
     } else {
         const raw = sessionStorage.getItem(TOKEN_KEY);
         if (raw) {
@@ -124,8 +140,8 @@ async function acquireToken(forceRefresh = false): Promise<string> {
                 config.offlineAccess &&
                 cached.clientId === clientId &&
                 cached.issuer === issuer &&
-                (!current.searchParams.get('p') || claims.project?.id === current.searchParams.get('p')) &&
-                (!current.searchParams.get('a') || claims.account?.id === current.searchParams.get('a'))
+                (!projectId || claims.project?.id === projectId) &&
+                (!accountId || claims.account?.id === accountId)
             )
                 refreshCredential =
                     refreshSession?.clientId === clientId && refreshSession.issuer === issuer
@@ -138,8 +154,8 @@ async function acquireToken(forceRefresh = false): Promise<string> {
                 cached.issuer === issuer &&
                 !forceRefresh &&
                 claims.exp > Date.now() / 1000 + (config.offlineAccess ? 300 : 30) &&
-                (!current.searchParams.get('p') || claims.project?.id === current.searchParams.get('p')) &&
-                (!current.searchParams.get('a') || claims.account?.id === current.searchParams.get('a'))
+                (!projectId || claims.project?.id === projectId) &&
+                (!accountId || claims.account?.id === accountId)
             ) {
                 return cached.token;
             }
@@ -189,8 +205,8 @@ async function acquireToken(forceRefresh = false): Promise<string> {
                     claims.iss.replace(/\/+$/, '') !== issuer ||
                     claims.client_id !== clientId ||
                     claims.exp <= Date.now() / 1000 ||
-                    (!!current.searchParams.get('a') && claims.account?.id !== current.searchParams.get('a')) ||
-                    (!!current.searchParams.get('p') && claims.project?.id !== current.searchParams.get('p'))
+                    (!!accountId && claims.account?.id !== accountId) ||
+                    (!!projectId && claims.project?.id !== projectId)
                 )
                     throw new OAuthLoginError('Invalid OAuth refresh identity');
                 sessionStorage.setItem(
@@ -277,6 +293,13 @@ async function acquireToken(forceRefresh = false): Promise<string> {
             throw new Error('Application CIMD does not allow this callback');
         if (!config.scopes && document.scope) scopes = document.scope.split(/\s+/);
     }
+    const explicitScope =
+        current.searchParams.has('a') || current.searchParams.has('p')
+            ? {
+                  accountId: current.searchParams.get('a') ?? undefined,
+                  projectId: current.searchParams.get('p') ?? undefined,
+              }
+            : Env.defaultAuthSelection;
     const verifier = randomValue();
     const next: Transaction = {
         state: randomValue(),
@@ -285,6 +308,11 @@ async function acquireToken(forceRefresh = false): Promise<string> {
         redirectUri,
         issuer,
         target: current.toString(),
+        rememberedScope:
+            accountId && explicitScope?.projectId === undefined && (!explicitScope?.accountId || projectId)
+                ? { accountId, projectId }
+                : undefined,
+        retryScope: explicitScope?.accountId ? { accountId: explicitScope.accountId } : undefined,
         created: Date.now(),
     };
     const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
@@ -302,10 +330,8 @@ async function acquireToken(forceRefresh = false): Promise<string> {
             : scopes.filter((s) => s !== 'offline_access')
         ).join(' '),
     );
-    const account = current.searchParams.get('a');
-    if (account) authorize.searchParams.set('account_id', account);
-    const project = current.searchParams.get('p');
-    if (project) authorize.searchParams.set('project_id', project);
+    if (accountId) authorize.searchParams.set('account_id', accountId);
+    if (projectId) authorize.searchParams.set('project_id', projectId);
     sessionStorage.setItem(TRANSACTION_KEY, JSON.stringify(next));
     markCentralAuthRoundTripStarted();
     window.location.replace(authorize.toString());

package/src/session/auth/vertesiaHosts.ts

@@ -1,54 +1,9 @@
 const LOOPBACK_IPV4 = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
 /** A single DNS label: alphanumeric, inner hyphens allowed. */
-export const LABEL = '[a-z0-9](?:[a-z0-9-]*[a-z0-9])?';
+const LABEL = '[a-z0-9](?:[a-z0-9-]*[a-z0-9])?';
 
 /** The region label is optional throughout, because each regional host has a global US alias. */
-export const REGION = `(?:${LABEL}\\.)?`;
-
-/**
- * Hostnames served by the UI backend — Vertesia's own code, not merely a Vertesia-owned name:
- *   `cloud.vertesia.io`, `cloud.us1.vertesia.io`                     — the Cloud UI
- *   `preprod.cloud.vertesia.io`, `preview.cloud.us1.vertesia.io`     — its preview/preprod tiers
- *   `acme.cloud.us1.vertesia.io`                                     — per-IdP-tenant branded hosts
- *   `dev-feat-x.ui.dev1.vertesia.io`                                 — dynamic per-branch dev envs
- *
- * Mirrors the load-balancer host rules (region-lb/main.tf: `cloud.${var.domain}`,
- * `*.cloud.${var.domain}`, `*.ui.${var.domain}`) rather than the DNS zone, so a name we merely own
- * is not trusted for what serves it.
- */
-export const FIRST_PARTY_HOST_PATTERNS: readonly RegExp[] = [
-    new RegExp(`^cloud\\.${REGION}vertesia\\.io$`),
-    new RegExp(`^${LABEL}\\.cloud\\.${REGION}vertesia\\.io$`),
-    new RegExp(`^${LABEL}\\.ui\\.${LABEL}\\.vertesia\\.io$`),
-];
-
-/**
- * Public app-gateway origins. Stable tiers use the `apps*` browser-facing host, while development
- * environments reach the gateway through its `*.api.*` Cloud Run route:
- *   `apps.us1.vertesia.io`, `apps-preview.us1.vertesia.io`
- *   `app-gateway-dev1.api.dev1.vertesia.io`, `app-gateway-us3.api.us3.vertesia.io`
- *
- * The second label is deliberately unconstrained. Branch environments do NOT each get a gateway —
- * they share their region's (`detectGatewayUrl` in packages/server-common/src/env/ServerEnv.ts:444
- * and `getAppgenServerBaseUrl` in packages/workflows/.../app_workspace/workspace-utils.ts), so the
- * host published to browsers is region-scoped, while the per-branch `app-gateway-dev-<branch>`
- * shape in the infrastructure README also exists. Matching `app-gateway-<anything>` covers both,
- * and every Cloud Run service named that way *is* a gateway (region-compute/main.tf:373).
- *
- * These serve every tenant's published application from one shared origin, and published assets
- * need no authentication — so this is generated, low-trust code sitting on a Vertesia-owned
- * hostname. Owning the domain is not the test; which backend serves the origin is.
- *
- * Two load-balancer variables can map further hostnames onto the same backend —
- * `appgen_host_aliases` and `appgen_preview_host_aliases` in
- * infrastructure/terraform/modules/region-lb/variables.tf. Both are empty in every region today; if
- * one is ever set, add the alias here too, or it silently falls through to the permissive branch of
- * Policy L and becomes an origin that may receive a token at any path.
- */
-export const GATEWAY_HOST_PATTERNS: readonly RegExp[] = [
-    new RegExp(`^apps(?:-preview|-preprod)?\\.${REGION}vertesia\\.io$`),
-    new RegExp(`^app-gateway-${LABEL}\\.api\\.${LABEL}\\.vertesia\\.io$`),
-];
+const REGION = `(?:${LABEL}\\.)?`;
 
 export function isLoopbackHostname(hostname: string): boolean {
     if (hostname === 'localhost' || hostname.endsWith('.localhost')) {

package/src/session/index.ts

@@ -8,7 +8,7 @@ export {
     redirectToCentralAuth,
 } from './auth/domainRouting';
 export * from './auth/firebase';
-export { isAppOAuthLoginPending, startAppOAuthLogin } from './auth/oauth';
+export { isAppOAuthLoginPending, revokeAppOAuthSession, startAppOAuthLogin } from './auth/oauth';
 export * from './auth/useAuthState';
 export * from './auth/useCurrentTenant';
 export * from './DevSessionProvider';

package/src/session/scopeSelection.ts

@@ -6,6 +6,7 @@
  * another tab's next token refresh. `localStorage` holds the last selection made in any tab, and
  * only seeds a tab that has no scope of its own yet (a new tab, or the app after a restart).
  */
+import { Env } from '@vertesia/ui/env';
 import { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY } from './constants';
 
 const TabAccountId_KEY = 'composableai.tabAccountId';
@@ -52,6 +53,18 @@ export function readScopeSelection(accountId?: string): ScopeSelection {
     return { accountId: account, projectId: projectId || undefined };
 }
 
+export function resolveAuthSelection(currentUrl: URL): { accountId?: string; projectId?: string } {
+    // A URL selection owns the whole pair: never attach an unrelated configured account/project.
+    const hasUrlScope = currentUrl.searchParams.has('a') || currentUrl.searchParams.has('p');
+    const defaults = hasUrlScope ? undefined : Env.defaultAuthSelection;
+    const urlAccount = currentUrl.searchParams.get('a') ?? defaults?.accountId;
+    const urlProject = currentUrl.searchParams.get('p') ?? defaults?.projectId;
+    // A project alone identifies its account, so the stored selection only fills in a missing project.
+    const stored = urlProject === undefined ? readScopeSelection(urlAccount) : undefined;
+
+    return { accountId: urlAccount ?? stored?.accountId, projectId: urlProject ?? stored?.projectId };
+}
+
 /** Make this the tab's scope and the default for new tabs. */
 export function rememberScopeSelection(accountId: string, projectId?: string): void {
     sessionSet(TabAccountId_KEY, accountId);