@vertesia/ui 1.6.0-dev.20261008.064737Z → 1.6.0-dev.20261014.015055Z

package/src/i18n/locales/ar.json

@@ -261,8 +261,9 @@
     "agent.thinking": "جارٍ التفكير...",
     "agent.timeout": "انتهت المهلة",
     "agent.toggleRightSidebar": "تبديل الشريط الجانبي الأيمن",
+    "agent.typeDifferentResponse": "أو اكتب ردًا مختلفًا...",
     "agent.typeYourMessage": "اكتب رسالتك...",
-    "agent.typeYourResponse": "اكتب ردك...",
+    "agent.typeYourResponse": "أو اكتب ردًا مختلفًا...",
     "agent.unableToOpenPrint": "تعذر فتح معاينة الطباعة",
     "agent.unknownError": "خطأ غير معروف",
     "agent.unknownTime": "وقت غير معروف",
@@ -390,6 +391,10 @@
     "layout.searchPlaceholder": "بحث...",
     "layout.toggleNavigationMenu": "تبديل قائمة التنقل",
     "login.accept": "قبول",
+    "login.inviteActionFailed": "تعذّر تحديث هذه الدعوة. تم تحديث القائمة.",
+    "login.inviteRole": "الدور: {{role}}",
+    "login.invitedBy": "دعاك {{name}}",
+    "login.invitesIntro": "تمت دعوتك للانضمام إلى الحسابات التالية. اقبل كل دعوة أو ارفضها.",
     "login.reject": "رفض",
     "login.reviewInvites": "مراجعة الدعوات",
     "login.terminal.account": "الحساب",

package/src/i18n/locales/de.json

@@ -249,8 +249,9 @@
     "agent.thinking": "Denke nach...",
     "agent.timeout": "Zeitüberschreitung",
     "agent.toggleRightSidebar": "Rechte Seitenleiste umschalten",
+    "agent.typeDifferentResponse": "Oder geben Sie eine andere Antwort ein...",
     "agent.typeYourMessage": "Geben Sie Ihre Nachricht ein...",
-    "agent.typeYourResponse": "Geben Sie Ihre Antwort ein...",
+    "agent.typeYourResponse": "Oder geben Sie eine andere Antwort ein...",
     "agent.unableToOpenPrint": "Druckvorschau konnte nicht geöffnet werden",
     "agent.unknownError": "Unbekannter Fehler",
     "agent.unknownTime": "Unbekannte Zeit",
@@ -378,6 +379,10 @@
     "layout.searchPlaceholder": "Suchen...",
     "layout.toggleNavigationMenu": "Navigationsmenü umschalten",
     "login.accept": "Akzeptieren",
+    "login.inviteActionFailed": "Diese Einladung konnte nicht aktualisiert werden. Die Liste wurde aktualisiert.",
+    "login.inviteRole": "Rolle: {{role}}",
+    "login.invitedBy": "Eingeladen von {{name}}",
+    "login.invitesIntro": "Sie wurden eingeladen, den folgenden Konten beizutreten. Nehmen Sie jede Einladung an oder lehnen Sie sie ab.",
     "login.reject": "Ablehnen",
     "login.reviewInvites": "Einladungen überprüfen",
     "login.terminal.account": "Konto",

package/src/i18n/locales/en.json

@@ -322,8 +322,9 @@
     "agent.thinking": "Thinking...",
     "agent.timeout": "Timed out",
     "agent.toggleRightSidebar": "Toggle right sidebar",
+    "agent.typeDifferentResponse": "Or type a different response...",
     "agent.typeYourMessage": "Type your message...",
-    "agent.typeYourResponse": "Type your response...",
+    "agent.typeYourResponse": "Or type a different response...",
     "agent.unableToOpenPrint": "Unable to open print preview",
     "agent.unknownError": "Unknown error",
     "agent.unknownTime": "Unknown time",
@@ -688,6 +689,10 @@
     "layout.searchPlaceholder": "Search...",
     "layout.toggleNavigationMenu": "Toggle navigation menu",
     "login.accept": "Accept",
+    "login.inviteActionFailed": "This invite could not be updated. The list has been refreshed.",
+    "login.inviteRole": "Role: {{role}}",
+    "login.invitedBy": "Invited by {{name}}",
+    "login.invitesIntro": "You have been invited to join the following accounts. Accept or reject each invite.",
     "login.reject": "Reject",
     "login.reviewInvites": "Review Invites",
     "login.terminal.account": "Account",

package/src/i18n/locales/es.json

@@ -251,8 +251,9 @@
     "agent.thinking": "Pensando...",
     "agent.timeout": "Tiempo agotado",
     "agent.toggleRightSidebar": "Alternar panel lateral",
+    "agent.typeDifferentResponse": "O escribe una respuesta diferente...",
     "agent.typeYourMessage": "Escribe tu mensaje...",
-    "agent.typeYourResponse": "Escribe tu respuesta...",
+    "agent.typeYourResponse": "O escribe una respuesta diferente...",
     "agent.unableToOpenPrint": "No se pudo abrir la vista previa de impresión",
     "agent.unknownError": "Error desconocido",
     "agent.unknownTime": "Hora desconocida",
@@ -380,6 +381,10 @@
     "layout.searchPlaceholder": "Buscar...",
     "layout.toggleNavigationMenu": "Alternar menú de navegación",
     "login.accept": "Aceptar",
+    "login.inviteActionFailed": "No se pudo actualizar esta invitación. La lista se ha actualizado.",
+    "login.inviteRole": "Rol: {{role}}",
+    "login.invitedBy": "Invitado por {{name}}",
+    "login.invitesIntro": "Ha sido invitado a unirse a las siguientes cuentas. Acepte o rechace cada invitación.",
     "login.reject": "Rechazar",
     "login.reviewInvites": "Revisar invitaciones",
     "login.terminal.account": "Cuenta",

package/src/i18n/locales/fr.json

@@ -251,8 +251,9 @@
     "agent.thinking": "Réflexion...",
     "agent.timeout": "Délai dépassé",
     "agent.toggleRightSidebar": "Basculer le panneau latéral",
+    "agent.typeDifferentResponse": "Ou saisissez une autre réponse...",
     "agent.typeYourMessage": "Saisissez votre message...",
-    "agent.typeYourResponse": "Saisissez votre réponse...",
+    "agent.typeYourResponse": "Ou saisissez une autre réponse...",
     "agent.unableToOpenPrint": "Impossible d'ouvrir l'aperçu d'impression",
     "agent.unknownError": "Erreur inconnue",
     "agent.unknownTime": "Heure inconnue",
@@ -380,6 +381,10 @@
     "layout.searchPlaceholder": "Rechercher...",
     "layout.toggleNavigationMenu": "Afficher ou masquer le menu de navigation",
     "login.accept": "Accepter",
+    "login.inviteActionFailed": "Cette invitation n'a pas pu être mise à jour. La liste a été actualisée.",
+    "login.inviteRole": "Rôle : {{role}}",
+    "login.invitedBy": "Invité par {{name}}",
+    "login.invitesIntro": "Vous avez été invité à rejoindre les comptes suivants. Acceptez ou refusez chaque invitation.",
     "login.reject": "Refuser",
     "login.reviewInvites": "Examiner les invitations",
     "login.terminal.account": "Compte",

package/src/i18n/locales/it.json

@@ -251,8 +251,9 @@
     "agent.thinking": "Sto pensando...",
     "agent.timeout": "Tempo scaduto",
     "agent.toggleRightSidebar": "Alterna pannello laterale",
+    "agent.typeDifferentResponse": "Oppure scrivi una risposta diversa...",
     "agent.typeYourMessage": "Scrivi il tuo messaggio...",
-    "agent.typeYourResponse": "Scrivi la tua risposta...",
+    "agent.typeYourResponse": "Oppure scrivi una risposta diversa...",
     "agent.unableToOpenPrint": "Impossibile aprire l'anteprima di stampa",
     "agent.unknownError": "Errore sconosciuto",
     "agent.unknownTime": "Ora sconosciuta",
@@ -380,6 +381,10 @@
     "layout.searchPlaceholder": "Cerca...",
     "layout.toggleNavigationMenu": "Attiva o disattiva il menu di navigazione",
     "login.accept": "Accetta",
+    "login.inviteActionFailed": "Impossibile aggiornare questo invito. L'elenco è stato aggiornato.",
+    "login.inviteRole": "Ruolo: {{role}}",
+    "login.invitedBy": "Invitato da {{name}}",
+    "login.invitesIntro": "Sei stato invitato a unirti ai seguenti account. Accetta o rifiuta ogni invito.",
     "login.reject": "Rifiuta",
     "login.reviewInvites": "Rivedi inviti",
     "login.terminal.account": "Account",

package/src/i18n/locales/ja.json

@@ -249,8 +249,9 @@
     "agent.thinking": "考え中...",
     "agent.timeout": "タイムアウト",
     "agent.toggleRightSidebar": "右サイドバーの切り替え",
+    "agent.typeDifferentResponse": "または別の回答を入力...",
     "agent.typeYourMessage": "メッセージを入力...",
-    "agent.typeYourResponse": "回答を入力...",
+    "agent.typeYourResponse": "または別の回答を入力...",
     "agent.unableToOpenPrint": "印刷プレビューを開けません",
     "agent.unknownError": "不明なエラー",
     "agent.unknownTime": "不明な時刻",
@@ -378,6 +379,10 @@
     "layout.searchPlaceholder": "検索...",
     "layout.toggleNavigationMenu": "ナビゲーションメニューを切り替え",
     "login.accept": "承認",
+    "login.inviteActionFailed": "この招待を更新できませんでした。リストを更新しました。",
+    "login.inviteRole": "ロール: {{role}}",
+    "login.invitedBy": "招待者: {{name}}",
+    "login.invitesIntro": "次のアカウントへの参加に招待されています。各招待を承認または拒否してください。",
     "login.reject": "拒否",
     "login.reviewInvites": "招待を確認",
     "login.terminal.account": "アカウント",

package/src/i18n/locales/ko.json

@@ -249,8 +249,9 @@
     "agent.thinking": "생각 중...",
     "agent.timeout": "시간 초과",
     "agent.toggleRightSidebar": "오른쪽 사이드바 전환",
+    "agent.typeDifferentResponse": "또는 다른 응답을 입력하세요...",
     "agent.typeYourMessage": "메시지를 입력하세요...",
-    "agent.typeYourResponse": "응답을 입력하세요...",
+    "agent.typeYourResponse": "또는 다른 응답을 입력하세요...",
     "agent.unableToOpenPrint": "인쇄 미리보기를 열 수 없습니다",
     "agent.unknownError": "알 수 없는 오류",
     "agent.unknownTime": "알 수 없는 시간",
@@ -378,6 +379,10 @@
     "layout.searchPlaceholder": "검색...",
     "layout.toggleNavigationMenu": "탐색 메뉴 전환",
     "login.accept": "수락",
+    "login.inviteActionFailed": "이 초대를 업데이트할 수 없습니다. 목록을 새로 고쳤습니다.",
+    "login.inviteRole": "역할: {{role}}",
+    "login.invitedBy": "초대한 사람: {{name}}",
+    "login.invitesIntro": "다음 계정에 참여하도록 초대받았습니다. 각 초대를 수락하거나 거절하세요.",
     "login.reject": "거부",
     "login.reviewInvites": "초대 검토",
     "login.terminal.account": "계정",

package/src/i18n/locales/pt.json

@@ -251,8 +251,9 @@
     "agent.thinking": "Pensando...",
     "agent.timeout": "Tempo esgotado",
     "agent.toggleRightSidebar": "Alternar painel lateral",
+    "agent.typeDifferentResponse": "Ou digite uma resposta diferente...",
     "agent.typeYourMessage": "Digite sua mensagem...",
-    "agent.typeYourResponse": "Digite sua resposta...",
+    "agent.typeYourResponse": "Ou digite uma resposta diferente...",
     "agent.unableToOpenPrint": "Não foi possível abrir a visualização de impressão",
     "agent.unknownError": "Erro desconhecido",
     "agent.unknownTime": "Hora desconhecida",
@@ -380,6 +381,10 @@
     "layout.searchPlaceholder": "Pesquisar...",
     "layout.toggleNavigationMenu": "Alternar menu de navegação",
     "login.accept": "Aceitar",
+    "login.inviteActionFailed": "Não foi possível atualizar este convite. A lista foi atualizada.",
+    "login.inviteRole": "Função: {{role}}",
+    "login.invitedBy": "Convidado por {{name}}",
+    "login.invitesIntro": "Você foi convidado a participar das seguintes contas. Aceite ou recuse cada convite.",
     "login.reject": "Rejeitar",
     "login.reviewInvites": "Revisar convites",
     "login.terminal.account": "Conta",

package/src/i18n/locales/ru.json

@@ -255,8 +255,9 @@
     "agent.thinking": "Размышляю...",
     "agent.timeout": "Время ожидания истекло",
     "agent.toggleRightSidebar": "Переключить правую панель",
+    "agent.typeDifferentResponse": "Или введите другой ответ...",
     "agent.typeYourMessage": "Введите сообщение...",
-    "agent.typeYourResponse": "Введите ваш ответ...",
+    "agent.typeYourResponse": "Или введите другой ответ...",
     "agent.unableToOpenPrint": "Не удалось открыть предпросмотр печати",
     "agent.unknownError": "Неизвестная ошибка",
     "agent.unknownTime": "Неизвестное время",
@@ -384,6 +385,10 @@
     "layout.searchPlaceholder": "Поиск...",
     "layout.toggleNavigationMenu": "Переключить меню навигации",
     "login.accept": "Принять",
+    "login.inviteActionFailed": "Не удалось обновить это приглашение. Список обновлён.",
+    "login.inviteRole": "Роль: {{role}}",
+    "login.invitedBy": "Пригласил(а): {{name}}",
+    "login.invitesIntro": "Вас пригласили присоединиться к следующим аккаунтам. Примите или отклоните каждое приглашение.",
     "login.reject": "Отклонить",
     "login.reviewInvites": "Просмотреть приглашения",
     "login.terminal.account": "Аккаунт",

package/src/i18n/locales/tr.json

@@ -249,8 +249,9 @@
     "agent.thinking": "Düşünüyor...",
     "agent.timeout": "Zaman aşımına uğradı",
     "agent.toggleRightSidebar": "Sağ kenar çubuğunu aç/kapat",
+    "agent.typeDifferentResponse": "Ya da farklı bir yanıt yazın...",
     "agent.typeYourMessage": "Mesajınızı yazın...",
-    "agent.typeYourResponse": "Yanıtınızı yazın...",
+    "agent.typeYourResponse": "Ya da farklı bir yanıt yazın...",
     "agent.unableToOpenPrint": "Yazdırma önizlemesi açılamadı",
     "agent.unknownError": "Bilinmeyen hata",
     "agent.unknownTime": "Bilinmeyen zaman",
@@ -378,6 +379,10 @@
     "layout.searchPlaceholder": "Ara...",
     "layout.toggleNavigationMenu": "Gezinme menüsünü aç veya kapat",
     "login.accept": "Kabul Et",
+    "login.inviteActionFailed": "Bu davet güncellenemedi. Liste yenilendi.",
+    "login.inviteRole": "Rol: {{role}}",
+    "login.invitedBy": "Davet eden: {{name}}",
+    "login.invitesIntro": "Aşağıdaki hesaplara katılmaya davet edildiniz. Her daveti kabul edin veya reddedin.",
     "login.reject": "Reddet",
     "login.reviewInvites": "Davetleri İncele",
     "login.terminal.account": "Hesap",

package/src/i18n/locales/zh-TW.json

@@ -249,8 +249,9 @@
     "agent.thinking": "思考中...",
     "agent.timeout": "已逾時",
     "agent.toggleRightSidebar": "切換右側邊欄",
+    "agent.typeDifferentResponse": "或輸入其他回覆...",
     "agent.typeYourMessage": "輸入訊息...",
-    "agent.typeYourResponse": "輸入您的回覆...",
+    "agent.typeYourResponse": "或輸入其他回覆...",
     "agent.unableToOpenPrint": "無法開啟列印預覽",
     "agent.unknownError": "未知錯誤",
     "agent.unknownTime": "未知時間",
@@ -378,6 +379,10 @@
     "layout.searchPlaceholder": "搜尋...",
     "layout.toggleNavigationMenu": "切換導覽選單",
     "login.accept": "接受",
+    "login.inviteActionFailed": "無法更新此邀請。清單已重新整理。",
+    "login.inviteRole": "角色：{{role}}",
+    "login.invitedBy": "邀請人：{{name}}",
+    "login.invitesIntro": "您已受邀加入以下帳戶。請接受或拒絕每個邀請。",
     "login.reject": "拒絕",
     "login.reviewInvites": "查看邀請",
     "login.terminal.account": "帳戶",

package/src/i18n/locales/zh.json

@@ -249,8 +249,9 @@
     "agent.thinking": "思考中...",
     "agent.timeout": "已超时",
     "agent.toggleRightSidebar": "切换右侧边栏",
+    "agent.typeDifferentResponse": "或输入其他回复...",
     "agent.typeYourMessage": "输入消息...",
-    "agent.typeYourResponse": "输入您的回复...",
+    "agent.typeYourResponse": "或输入其他回复...",
     "agent.unableToOpenPrint": "无法打开打印预览",
     "agent.unknownError": "未知错误",
     "agent.unknownTime": "未知时间",
@@ -378,6 +379,10 @@
     "layout.searchPlaceholder": "搜索...",
     "layout.toggleNavigationMenu": "切换导航菜单",
     "login.accept": "接受",
+    "login.inviteActionFailed": "无法更新此邀请。列表已刷新。",
+    "login.inviteRole": "角色：{{role}}",
+    "login.invitedBy": "邀请人：{{name}}",
+    "login.invitesIntro": "您已被邀请加入以下账户。请接受或拒绝每个邀请。",
     "login.reject": "拒绝",
     "login.reviewInvites": "查看邀请",
     "login.terminal.account": "账户",

package/src/i18n/rtl.ts

@@ -29,6 +29,9 @@ export const SUPPORTED_LANGUAGES = [
 
 export type SupportedLanguage = (typeof SUPPORTED_LANGUAGES)[number];
 
+/** Where `LanguageProvider` persists the chosen language; the boot runtime reads it too. */
+export const LANGUAGE_STORAGE_KEY = 'vertesia-ui-language';
+
 export const RTL_LANGUAGES: ReadonlySet<string> = new Set(['ar', 'he', 'fa', 'ur']);
 
 export function isRTL(lng?: string): boolean {
@@ -42,8 +45,8 @@ export function isRTL(lng?: string): boolean {
  *   2. base-language fallback (`pt-BR` -> `pt`)
  *   3. `'en'` fallback
  *
- * The inline FOUC script in `index.html` must reimplement this same logic
- * verbatim (it cannot import ESM before bundle load).
+ * The pre-React boot runtime (`../boot/index.ts`) reimplements this same logic
+ * in its inline script, which runs before any bundle loads.
  */
 export function resolveLanguage(raw: string | undefined | null): SupportedLanguage {
     if (!raw) return 'en';

package/src/session/UserSessionProvider.tsx

@@ -280,10 +280,17 @@ export function UserSessionProvider({ children, loadOnboardingStatus = false }:
                         })
                         .catch((err) => {
                             if (surfaceAuthError(err)) return;
-                            console.error('Unexpected failure while fetching a user token', err);
-                            Env.logger.error('Unexpected failure while fetching a user token', {
-                                vertesia: { account_id: selectedAccount, project_id: selectedProject, error: err },
-                            });
+                            // A customer-domain user without an invite is an expected sign-in outcome, already
+                            // logged at warn where the 403 is received.
+                            const inviteRequired =
+                                err instanceof Error &&
+                                err.message === 'Customer-domain user requires an invite to join';
+                            if (!inviteRequired) {
+                                console.error('Unexpected failure while fetching a user token', err);
+                                Env.logger.error('Unexpected failure while fetching a user token', {
+                                    vertesia: { account_id: selectedAccount, project_id: selectedProject, error: err },
+                                });
+                            }
                             session.logout();
                             session.isLoading = false;
                             session.authError = err;

package/src/session/auth/composable.ts

@@ -116,17 +116,7 @@ function identityFromAcceptedToken(token: string): AuthenticatedIdentity | undef
     }
 }
 
-export function resolveAuthSelection(currentUrl: URL): { accountId?: string; projectId?: string } {
-    // A URL selection owns the whole pair: never attach an unrelated configured account/project.
-    const hasUrlScope = currentUrl.searchParams.has('a') || currentUrl.searchParams.has('p');
-    const defaults = hasUrlScope ? undefined : Env.defaultAuthSelection;
-    const urlAccount = currentUrl.searchParams.get('a') ?? defaults?.accountId;
-    const urlProject = currentUrl.searchParams.get('p') ?? defaults?.projectId;
-    // A project alone identifies its account, so the stored selection only fills in a missing project.
-    const stored = urlProject === undefined ? readScopeSelection(urlAccount) : undefined;
-
-    return { accountId: urlAccount ?? stored?.accountId, projectId: urlProject ?? stored?.projectId };
-}
+export { resolveAuthSelection } from '../scopeSelection';
 
 function decodeToken(token: string): AuthTokenPayload {
     return jwtDecode(token) as AuthTokenPayload;

package/src/session/auth/firebase.ts

@@ -92,10 +92,9 @@ export async function setFirebaseTenant(tenantEmail?: string) {
                 // Handle HTTP error responses
                 if (!response.ok) {
                     // If the error is 404 Not Found, no need to retry
+                    // How older servers answered "this address has no SSO tenant": an ordinary outcome.
                     if (response.status === 404) {
-                        Env.logger.warn('Firebase tenant was not found; continuing with the default tenant', {
-                            vertesia: { status: response.status },
-                        });
+                        Env.logger.debug('No Firebase tenant for this address; using the default tenant');
                         return;
                     }
 
@@ -103,10 +102,14 @@ export async function setFirebaseTenant(tenantEmail?: string) {
                     throw new Error(errorData?.error ?? `HTTP error ${response.status}`);
                 }
 
-                // Successfully got a response, parse it
-                const data = (await response.json()) as UIResolvedTenant;
+                // Successfully got a response, parse it. `null` means the address has no SSO tenant.
+                const data = (await response.json()) as UIResolvedTenant | null;
+                if (data === null) {
+                    Env.logger.debug('No Firebase tenant for this address; using the default tenant');
+                    return;
+                }
 
-                if (data?.firebaseTenantId) {
+                if (data.firebaseTenantId) {
                     const auth = getFirebaseAuth();
                     auth.tenantId = data.firebaseTenantId;
                     Env.firebase.providerType = data.provider ?? 'oidc';

package/src/session/auth/oauth.ts

@@ -1,6 +1,7 @@
-import type { AuthTokenPayload } from '@vertesia/common';
+import { type AuthTokenPayload, REQUESTED_SCOPE_UNAVAILABLE_ERROR_CODE } from '@vertesia/common';
 import { Env } from '@vertesia/ui/env';
 import { jwtDecode } from 'jwt-decode';
+import { forgetRejectedScopeSelection, resolveAuthSelection, type ScopeSelection } from '../scopeSelection';
 import { markCentralAuthRoundTripStarted } from './authRoundTrip';
 import { verifyAuthState } from './authState';
 import { usesGatewaySession } from './gateway';
@@ -12,7 +13,14 @@ const MAX_TRANSACTION_AGE = 10 * 60_000;
 let pending: Promise<string> | undefined;
 // Long-lived credentials never enter browser storage. A reload resumes via the broker when access expires.
 let refreshSession:
-    | { token: string; clientId: string; issuer: string; tokenEndpoint: string; revocationEndpoint?: string }
+    | {
+          token: string;
+          clientId: string;
+          issuer: string;
+          resource?: string;
+          tokenEndpoint: string;
+          revocationEndpoint?: string;
+      }
     | undefined;
 
 export class OAuthLoginError extends Error {}
@@ -60,7 +68,10 @@ interface Transaction {
     clientId: string;
     redirectUri: string;
     issuer: string;
+    resource?: string;
     target: string;
+    rememberedScope?: ScopeSelection;
+    retryScope?: ScopeSelection;
 }
 
 export function clearAppOAuth(): void {
@@ -87,7 +98,14 @@ async function acquireToken(forceRefresh = false): Promise<string> {
     const redirectUri = redirect.toString();
     if (new URL(redirectUri).origin !== window.location.origin) throw new Error('OAuth callback must be same-origin');
     const issuer = (config.issuer ? httpsUrl(config.issuer).toString() : Env.endpoints.sts).replace(/\/+$/, '');
-    const current = new URL(window.location.href);
+    // A token is issued for one audience. The default audience follows the issuer, which is already part of every
+    // stored credential's identity; a configured one is recorded alongside it, so changing it never reuses a token,
+    // refresh session or login transaction issued for the previous audience.
+    const configuredResource = config.resource ? httpsUrl(config.resource).toString() : undefined;
+    const sameClient = (stored: { clientId: string; issuer: string; resource?: string }) =>
+        stored.clientId === clientId && stored.issuer === issuer && stored.resource === configuredResource;
+    let current = new URL(window.location.href);
+    let { accountId, projectId } = resolveAuthSelection(current);
     const callback = current.origin + current.pathname === new URL(redirectUri).origin + new URL(redirectUri).pathname;
     const state = callback ? current.searchParams.get('state') : null;
     const code = callback ? current.searchParams.get('code') : null;
@@ -101,15 +119,26 @@ async function acquireToken(forceRefresh = false): Promise<string> {
         if (
             !transaction ||
             transaction.state !== state ||
-            transaction.clientId !== clientId ||
+            !sameClient(transaction) ||
             transaction.redirectUri !== redirectUri ||
-            transaction.issuer !== issuer ||
             Date.now() - transaction.created > MAX_TRANSACTION_AGE ||
             transaction.created > Date.now()
         ) {
             throw new Error('Invalid or expired OAuth login state');
         }
-        if (error || !code) throw new Error(`Application sign-in was not completed (${error || 'missing code'})`);
+        if (error === REQUESTED_SCOPE_UNAVAILABLE_ERROR_CODE && transaction.rememberedScope?.accountId) {
+            const target = new URL(transaction.target);
+            if (target.origin !== window.location.origin) throw new Error('Invalid OAuth return target');
+            forgetRejectedScopeSelection(transaction.rememberedScope.accountId, transaction.rememberedScope.projectId);
+            clearAppOAuth();
+            current = target;
+            window.history.replaceState(window.history.state, '', current);
+            accountId = transaction.retryScope?.accountId;
+            projectId = undefined;
+            transaction = undefined;
+        } else if (error || !code) {
+            throw new Error(`Application sign-in was not completed (${error || 'missing code'})`);
+        }
     } else {
         const raw = sessionStorage.getItem(TOKEN_KEY);
         if (raw) {
@@ -117,29 +146,25 @@ async function acquireToken(forceRefresh = false): Promise<string> {
                 token: string;
                 clientId: string;
                 issuer: string;
+                resource?: string;
                 refreshToken?: string;
             };
             const claims = jwtDecode<AuthTokenPayload>(cached.token);
             if (
                 config.offlineAccess &&
-                cached.clientId === clientId &&
-                cached.issuer === issuer &&
-                (!current.searchParams.get('p') || claims.project?.id === current.searchParams.get('p')) &&
-                (!current.searchParams.get('a') || claims.account?.id === current.searchParams.get('a'))
+                sameClient(cached) &&
+                (!projectId || claims.project?.id === projectId) &&
+                (!accountId || claims.account?.id === accountId)
             )
-                refreshCredential =
-                    refreshSession?.clientId === clientId && refreshSession.issuer === issuer
-                        ? refreshSession.token
-                        : undefined;
+                refreshCredential = refreshSession && sameClient(refreshSession) ? refreshSession.token : undefined;
             // Discard credentials persisted by older SDK versions rather than loading them into the new session.
             if (cached.refreshToken) sessionStorage.removeItem(TOKEN_KEY);
             if (
-                cached.clientId === clientId &&
-                cached.issuer === issuer &&
+                sameClient(cached) &&
                 !forceRefresh &&
                 claims.exp > Date.now() / 1000 + (config.offlineAccess ? 300 : 30) &&
-                (!current.searchParams.get('p') || claims.project?.id === current.searchParams.get('p')) &&
-                (!current.searchParams.get('a') || claims.account?.id === current.searchParams.get('a'))
+                (!projectId || claims.project?.id === projectId) &&
+                (!accountId || claims.account?.id === accountId)
             ) {
                 return cached.token;
             }
@@ -163,7 +188,7 @@ async function acquireToken(forceRefresh = false): Promise<string> {
     const tokenEndpoint = httpsUrl(metadata.token_endpoint);
     const revocationEndpoint =
         metadata.revocation_endpoint === undefined ? undefined : httpsUrl(metadata.revocation_endpoint).toString();
-    const resource = config.resource ? httpsUrl(config.resource).toString() : new URL(metadata.issuer).toString();
+    const resource = configuredResource ?? new URL(metadata.issuer).toString();
     if (refreshCredential) {
         try {
             const response = await fetch(tokenEndpoint, {
@@ -189,8 +214,8 @@ async function acquireToken(forceRefresh = false): Promise<string> {
                     claims.iss.replace(/\/+$/, '') !== issuer ||
                     claims.client_id !== clientId ||
                     claims.exp <= Date.now() / 1000 ||
-                    (!!current.searchParams.get('a') && claims.account?.id !== current.searchParams.get('a')) ||
-                    (!!current.searchParams.get('p') && claims.project?.id !== current.searchParams.get('p'))
+                    (!!accountId && claims.account?.id !== accountId) ||
+                    (!!projectId && claims.project?.id !== projectId)
                 )
                     throw new OAuthLoginError('Invalid OAuth refresh identity');
                 sessionStorage.setItem(
@@ -199,12 +224,14 @@ async function acquireToken(forceRefresh = false): Promise<string> {
                         token: grant.access_token,
                         clientId,
                         issuer,
+                        resource: configuredResource,
                     }),
                 );
                 refreshSession = {
                     token: grant.refresh_token ?? refreshCredential,
                     clientId,
                     issuer,
+                    resource: configuredResource,
                     tokenEndpoint: tokenEndpoint.toString(),
                     revocationEndpoint,
                 };
@@ -246,6 +273,7 @@ async function acquireToken(forceRefresh = false): Promise<string> {
                 token: grant.access_token,
                 clientId,
                 issuer,
+                resource: configuredResource,
             }),
         );
         refreshSession =
@@ -254,6 +282,7 @@ async function acquireToken(forceRefresh = false): Promise<string> {
                       token: grant.refresh_token,
                       clientId,
                       issuer,
+                      resource: configuredResource,
                       tokenEndpoint: tokenEndpoint.toString(),
                       revocationEndpoint,
                   }
@@ -277,6 +306,13 @@ async function acquireToken(forceRefresh = false): Promise<string> {
             throw new Error('Application CIMD does not allow this callback');
         if (!config.scopes && document.scope) scopes = document.scope.split(/\s+/);
     }
+    const explicitScope =
+        current.searchParams.has('a') || current.searchParams.has('p')
+            ? {
+                  accountId: current.searchParams.get('a') ?? undefined,
+                  projectId: current.searchParams.get('p') ?? undefined,
+              }
+            : Env.defaultAuthSelection;
     const verifier = randomValue();
     const next: Transaction = {
         state: randomValue(),
@@ -284,7 +320,13 @@ async function acquireToken(forceRefresh = false): Promise<string> {
         clientId,
         redirectUri,
         issuer,
+        resource: configuredResource,
         target: current.toString(),
+        rememberedScope:
+            accountId && explicitScope?.projectId === undefined && (!explicitScope?.accountId || projectId)
+                ? { accountId, projectId }
+                : undefined,
+        retryScope: explicitScope?.accountId ? { accountId: explicitScope.accountId } : undefined,
         created: Date.now(),
     };
     const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
@@ -302,10 +344,8 @@ async function acquireToken(forceRefresh = false): Promise<string> {
             : scopes.filter((s) => s !== 'offline_access')
         ).join(' '),
     );
-    const account = current.searchParams.get('a');
-    if (account) authorize.searchParams.set('account_id', account);
-    const project = current.searchParams.get('p');
-    if (project) authorize.searchParams.set('project_id', project);
+    if (accountId) authorize.searchParams.set('account_id', accountId);
+    if (projectId) authorize.searchParams.set('project_id', projectId);
     sessionStorage.setItem(TRANSACTION_KEY, JSON.stringify(next));
     markCentralAuthRoundTripStarted();
     window.location.replace(authorize.toString());