@hexclave/js 1.0.19 → 1.0.20

package/dist/lib/hexclave-app/project-configs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../../../src/lib/hexclave-app/project-configs/index.ts"],"mappings":";;;KAMY,aAAA;EAAA,SACD,aAAA;EAAA,SACA,iBAAA;EAAA,SACA,gBAAA;EAAA,SACA,cAAA;EAAA,SACA,yBAAA;EAAA,SACA,yBAAA;EAAA,SACA,cAAA,EAAgB,mBAAA;EAAA,SAChB,gBAAA;EAAA,SACA,gBAAA;AAAA;AAAA,KAGC,mBAAA;EAAA,SACD,EAAA;AAAA;;;;KAMC,kBAAA;EAAA,SACD,aAAA;EAAA,SACA,iBAAA;EAAA,SACA,gBAAA;EAAA,SACA,cAAA;EAAA,SACA,yBAAA;EAAA,SACA,yBAAA;EAAA,SACA,cAAA;EAAA,SACA,cAAA,EAAgB,wBAAA;EAAA,SAChB,WAAA,GAAc,gBAAA;EAAA,SACd,UAAA;EAAA,SACA,OAAA,EAAS,iBAAA;EAAA,SACT,kBAAA;EAAA,SACA,6BAAA,EAA+B,mBAAA;EAAA,SAC/B,4BAAA,EAA8B,mBAAA;EAAA,SAC9B,sBAAA,EAAwB,mBAAA;EAAA,SACxB,yBAAA;EAAA,SACA,gBAAA;EAAA,SACA,gBAAA;AAAA;AAAA,KAGC,gBAAA;EAER,IAAA;EACA,UAAA;EACA,WAAA;EACA,IAAA;EACA,IAAA;EACA,QAAA;EACA,QAAA;AAAA;EAGA,IAAA;AAAA;AAAA,KAIQ,iBAAA;EACV,MAAA;EACA,WAAA;AAAA;AAAA,KAGU,wBAAA;EACV,EAAA;AAAA;EAEM,IAAA;AAAA;EAEF,IAAA;EACA,QAAA;EACA,YAAA;EACA,gBAAA;EACA,iBAAA;EACA,cAAA;AAAA,KAEA,mBAAA;AAAA,KAEM,+BAAA;EACV,OAAA;IACE,MAAA;IACA,WAAA;EAAA;EAEF,cAAA,GAAiB,wBAAA;EACjB,aAAA;EACA,iBAAA;EACA,gBAAA;EACA,cAAA;EACA,yBAAA;EACA,yBAAA;EACA,cAAA;EACA,kBAAA;EACA,WAAA,GAAc,gBAAA;EACd,UAAA;EACA,6BAAA;IAAkC,EAAA;EAAA;EAClC,4BAAA;IAAiC,EAAA;EAAA;EACjC,sBAAA;IAA2B,EAAA;EAAA;EAC3B,yBAAA;EACA,gBAAA;EACA,gBAAA;AAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../../src/lib/hexclave-app/project-configs/index.ts"],"mappings":";;;KAMY,aAAA;EAAA,SACD,aAAA;EAAA,SACA,iBAAA;EAAA,SACA,gBAAA;EAAA,SACA,cAAA;EAAA,SACA,yBAAA;EAAA,SACA,yBAAA;EAAA,SACA,cAAA,EAAgB,mBAAA;EAAA,SAChB,gBAAA;EAAA,SACA,gBAAA;AAAA;AAAA,KAGC,mBAAA;EAAA,SACD,EAAA;AAAA;;;;KAMC,kBAAA;EAAA,SACD,aAAA;EAAA,SACA,iBAAA;EAAA,SACA,gBAAA;EAAA,SACA,cAAA;EAAA,SACA,yBAAA;EAAA,SACA,yBAAA;EAAA,SACA,cAAA;EAAA,SACA,cAAA,EAAgB,wBAAA;EAAA,SAChB,WAAA,GAAc,gBAAA;EAAA,SACd,UAAA;EAAA,SACA,OAAA,EAAS,iBAAA;EAAA,SACT,kBAAA;EAAA,SACA,6BAAA,EAA+B,mBAAA;EAAA,SAC/B,4BAAA,EAA8B,mBAAA;EAAA,SAC9B,sBAAA,EAAwB,mBAAA;EAAA,SACxB,yBAAA;EAAA,SACA,gBAAA;EAAA,SACA,gBAAA;AAAA;AAAA,KAGC,gBAAA;EAER,IAAA;EACA,UAAA;EACA,WAAA;EACA,IAAA;EACA,IAAA;EACA,QAAA;EACA,QAAA;AAAA;EAGA,IAAA;AAAA;AAAA,KAIQ,iBAAA;EACV,MAAA;EACA,WAAA;AAAA;AAAA,KAGU,wBAAA;EACV,EAAA;AAAA;EAEM,IAAA;AAAA;EAEF,IAAA;EACA,QAAA;EACA,YAAA;EACA,gBAAA;EACA,iBAAA;EACA,cAAA;AAAA;EAGA,IAAA;EACA,QAAA;EACA,YAAA;EACA,SAAA;EACA,KAAA;EACA,WAAA;AAAA,KAEA,mBAAA;AAAA,KAEM,+BAAA;EACV,OAAA;IACE,MAAA;IACA,WAAA;EAAA;EAEF,cAAA,GAAiB,wBAAA;EACjB,aAAA;EACA,iBAAA;EACA,gBAAA;EACA,cAAA;EACA,yBAAA;EACA,yBAAA;EACA,cAAA;EACA,kBAAA;EACA,WAAA,GAAc,gBAAA;EACd,UAAA;EACA,6BAAA;IAAkC,EAAA;EAAA;EAClC,4BAAA;IAAiC,EAAA;EAAA;EACjC,sBAAA;IAA2B,EAAA;EAAA;EAC3B,yBAAA;EACA,gBAAA;EACA,gBAAA;AAAA"}

package/dist/lib/hexclave-app/projects/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../../../src/lib/hexclave-app/projects/index.ts"],"mappings":";;;;;;;;;;AAgBA;;KAAY,kBAAA;EACN,IAAA;EAA4B,KAAA;EAAe,IAAA;EAAc,MAAA;EAAgB,UAAA;EAAoB,cAAA;EAAwB,YAAA;AAAA;EACrH,IAAA;AAAA;EACA,IAAA;AAAA;AAAA,KAEM,iBAAA;EAAiB;;;EAI3B,MAAA,EAAQ,kBAAA;AAAA;AAAA,KAIE,OAAA;EAAA,SACD,EAAA;EAAA,SACA,WAAA;EAAA,SACA,MAAA,EAAQ,aAAA;AAAA;AAAA,KAGP,YAAA;EAAA,SACD,EAAA;EAAA,SACA,WAAA;EAAA,SACA,WAAA;EAAA,SACA,SAAA,EAAW,IAAA;EAAA,SACX,gBAAA;EAAA,SACA,wBAAA;EAAA,SACA,WAAA;EAAA,SACA,gBAAA,EAAkB,uBAAA;EAAA,SAClB,OAAA;EAAA,SACA,WAAA;EAAA,SACA,eAAA;EAAA,SACA,mBAAA;EAAA,SAEA,MAAA,EAAQ,kBAAA;EAEjB,MAAA,CAAO,IAAA,EAAM,YAAA,EAAc,MAAA,EAAQ,yBAAA,GAA4B,OAAA;EAC/D,MAAA,CAAO,IAAA,EAAM,YAAA,GAAe,OAAA;EAE5B,SAAA,CAAU,IAAA,EAAM,YAAA,GAAe,OAAA,CAAQ,cAAA;EAAR;;;;;;;EAU/B,YAAA,CACE,IAAA,EAAM,YAAA,EACN,MAAA,EAAQ,iCAAA,GACP,OAAA;EA6BK;;;;;;;;;;EAjBR,UAAA,CACE,IAAA,EAAM,YAAA,EACN,MAAA,EAAQ,iCAAA,EACR,OAAA,EAAS,iBAAA,GACR,OAAA;EA8C6E;;;;;;;;;;EAlChF,kBAAA,CACE,IAAA,EAAM,YAAA,EACN,MAAA,EAAQ,iCAAA,GACP,OAAA;EA9DM;;;;;;;;EAwET,qBAAA,CAAsB,IAAA,EAAM,YAAA,GAAe,OAAA,CAAQ,kBAAA;EAjExB;;;;EAuE3B,wBAAA,CAAyB,IAAA,EAAM,YAAA,GAAe,OAAA;EAjErC;;;;;;;EA0ET,uBAAA,CAAwB,IAAA,EAAM,YAAA,EAAc,KAAA,4BAAiC,IAAA,aAAiB,OAAA;EAvE9F;;;;EA6EA,iBAAA,CAAkB,IAAA,EAAM,YAAA,EAAc,KAAA,6BAAkC,OAAA,CAAQ,MAAA;EA3EhE;;;;EAiFhB,qBAAA,CAAsB,IAAA,EAAM,YAAA,EAAc,KAAA,4BAAiC,MAAA,EAAQ,MAAA,oBAA0B,OAAA;EAE7G,uBAAA,CAAwB,IAAA,EAAM,YAAA,GAAe,OAAA,CAAQ,mBAAA;AAAA,IACnD,OAAA;AAAA,KAEQ,iBAAA;EAAA,SACD,GAAA,EAAK,aAAA;AAAA,IACZ,YAAA;AAAA,KAEQ,yBAAA;EACV,WAAA;EACA,WAAA;EACA,gBAAA;EACA,gBAAA,GAAmB,uBAAA;EAlER;;;EAsEX,2BAAA;EACA,OAAA;EACA,WAAA;EACA,eAAA;EACA,mBAAA;EACA,MAAA,GAAS,+BAAA;AAAA;AAAA,iBAEK,+BAAA,CAAgC,OAAA,EAAS,yBAAA,GAA4B,YAAA;AAAA,KA8DzE,yBAAA,GAA4B,IAAA,CAAK,yBAAA;EAC3C,WAAA;EACA,MAAA;EACA,wBAAA;AAAA;AAAA,iBAEc,+BAAA,CAAgC,OAAA,EAAS,yBAAA,GAA4B,qBAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../../src/lib/hexclave-app/projects/index.ts"],"mappings":";;;;;;;;;;AAgBA;;KAAY,kBAAA;EACN,IAAA;EAA4B,KAAA;EAAe,IAAA;EAAc,MAAA;EAAgB,UAAA;EAAoB,cAAA;EAAwB,YAAA;AAAA;EACrH,IAAA;AAAA;EACA,IAAA;AAAA;AAAA,KAEM,iBAAA;EAAiB;;;EAI3B,MAAA,EAAQ,kBAAA;AAAA;AAAA,KAIE,OAAA;EAAA,SACD,EAAA;EAAA,SACA,WAAA;EAAA,SACA,MAAA,EAAQ,aAAA;AAAA;AAAA,KAGP,YAAA;EAAA,SACD,EAAA;EAAA,SACA,WAAA;EAAA,SACA,WAAA;EAAA,SACA,SAAA,EAAW,IAAA;EAAA,SACX,gBAAA;EAAA,SACA,wBAAA;EAAA,SACA,WAAA;EAAA,SACA,gBAAA,EAAkB,uBAAA;EAAA,SAClB,OAAA;EAAA,SACA,WAAA;EAAA,SACA,eAAA;EAAA,SACA,mBAAA;EAAA,SAEA,MAAA,EAAQ,kBAAA;EAEjB,MAAA,CAAO,IAAA,EAAM,YAAA,EAAc,MAAA,EAAQ,yBAAA,GAA4B,OAAA;EAC/D,MAAA,CAAO,IAAA,EAAM,YAAA,GAAe,OAAA;EAE5B,SAAA,CAAU,IAAA,EAAM,YAAA,GAAe,OAAA,CAAQ,cAAA;EAAR;;;;;;;EAU/B,YAAA,CACE,IAAA,EAAM,YAAA,EACN,MAAA,EAAQ,iCAAA,GACP,OAAA;EA6BK;;;;;;;;;;EAjBR,UAAA,CACE,IAAA,EAAM,YAAA,EACN,MAAA,EAAQ,iCAAA,EACR,OAAA,EAAS,iBAAA,GACR,OAAA;EA8C6E;;;;;;;;;;EAlChF,kBAAA,CACE,IAAA,EAAM,YAAA,EACN,MAAA,EAAQ,iCAAA,GACP,OAAA;EA9DM;;;;;;;;EAwET,qBAAA,CAAsB,IAAA,EAAM,YAAA,GAAe,OAAA,CAAQ,kBAAA;EAjExB;;;;EAuE3B,wBAAA,CAAyB,IAAA,EAAM,YAAA,GAAe,OAAA;EAjErC;;;;;;;EA0ET,uBAAA,CAAwB,IAAA,EAAM,YAAA,EAAc,KAAA,4BAAiC,IAAA,aAAiB,OAAA;EAvE9F;;;;EA6EA,iBAAA,CAAkB,IAAA,EAAM,YAAA,EAAc,KAAA,6BAAkC,OAAA,CAAQ,MAAA;EA3EhE;;;;EAiFhB,qBAAA,CAAsB,IAAA,EAAM,YAAA,EAAc,KAAA,4BAAiC,MAAA,EAAQ,MAAA,oBAA0B,OAAA;EAE7G,uBAAA,CAAwB,IAAA,EAAM,YAAA,GAAe,OAAA,CAAQ,mBAAA;AAAA,IACnD,OAAA;AAAA,KAEQ,iBAAA;EAAA,SACD,GAAA,EAAK,aAAA;AAAA,IACZ,YAAA;AAAA,KAEQ,yBAAA;EACV,WAAA;EACA,WAAA;EACA,gBAAA;EACA,gBAAA,GAAmB,uBAAA;EAlER;;;EAsEX,2BAAA;EACA,OAAA;EACA,WAAA;EACA,eAAA;EACA,mBAAA;EACA,MAAA,GAAS,+BAAA;AAAA;AAAA,iBAEK,+BAAA,CAAgC,OAAA,EAAS,yBAAA,GAA4B,YAAA;AAAA,KAgEzE,yBAAA,GAA4B,IAAA,CAAK,yBAAA;EAC3C,WAAA;EACA,MAAA;EACA,wBAAA;AAAA;AAAA,iBAEc,+BAAA,CAAgC,OAAA,EAAS,yBAAA,GAA4B,qBAAA"}

package/dist/lib/hexclave-app/projects/index.js

@@ -16,7 +16,7 @@ function adminProjectUpdateOptionsToCrud(options) {
 				domain: d.domain,
 				handler_path: d.handlerPath
 			})),
-			oauth_providers: options.config?.oauthProviders?.map((p) => ({
+			oauth_providers: options.config?.oauthProviders?.filter((p) => p.type !== "custom_oidc").map((p) => ({
 				id: p.id,
 				type: p.type,
 				...p.type === "standard" && {

package/dist/lib/hexclave-app/projects/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../../src/lib/hexclave-app/projects/index.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { ProductionModeError } from \"@hexclave/shared/dist/helpers/production-mode\";\nimport { AdminUserProjectsCrud, ProjectsCrud } from \"@hexclave/shared/dist/interface/crud/projects\";\nimport { ProjectOnboardingStatus } from \"@hexclave/shared/dist/schema-fields\";\n\nimport { CompleteConfig, EnvironmentConfigNormalizedOverride, EnvironmentConfigOverrideOverride } from \"@hexclave/shared/dist/config/schema\";\nimport { StackAdminApp } from \"../apps/interfaces/admin-app\";\nimport { AdminProjectConfig, AdminProjectConfigUpdateOptions, ProjectConfig } from \"../project-configs\";\n\n/**\n * SDK type for pushed config source (camelCase for SDK).\n * Represents where the branch config was pushed from.\n */\nexport type PushedConfigSource =\n  | { type: \"pushed-from-github\", owner: string, repo: string, branch: string, commitHash: string, configFilePath: string, workflowPath?: string }\n  | { type: \"pushed-from-unknown\" }\n  | { type: \"unlinked\" };\n\nexport type PushConfigOptions = {\n  /**\n   * The source of this config push.\n   */\n  source: PushedConfigSource,\n};\n\n\nexport type Project = {\n  readonly id: string,\n  readonly displayName: string,\n  readonly config: ProjectConfig,\n};\n\nexport type AdminProject = {\n  readonly id: string,\n  readonly displayName: string,\n  readonly description: string | null,\n  readonly createdAt: Date,\n  readonly isProductionMode: boolean,\n  readonly isDevelopmentEnvironment: boolean,\n  readonly ownerTeamId: string | null,\n  readonly onboardingStatus: ProjectOnboardingStatus,\n  readonly logoUrl: string | null | undefined,\n  readonly logoFullUrl: string | null | undefined,\n  readonly logoDarkModeUrl: string | null | undefined,\n  readonly logoFullDarkModeUrl: string | null | undefined,\n\n  readonly config: AdminProjectConfig,\n\n  update(this: AdminProject, update: AdminProjectUpdateOptions): Promise<void>,\n  delete(this: AdminProject): Promise<void>,\n\n  getConfig(this: AdminProject): Promise<CompleteConfig>,\n\n  /**\n   * Updates the environment's config by merging the provided config into the existing config.\n   *\n   * Changes made with `updateConfig` always take precedence over those made with `pushConfig`, even if the `pushConfig`\n   * config was pushed after the changes were made with `updateConfig`. This is best for environment-specific\n   * configuration like secrets, API keys, and other values that you wouldn't push into a source repository.\n   */\n  // We have some strict types here in order to prevent accidental overwriting of a top-level property of a config object\n  updateConfig(\n    this: AdminProject,\n    config: EnvironmentConfigOverrideOverride,\n  ): Promise<void>,\n\n  /**\n   * Pushes a config, replacing any previous config pushed with `pushConfig`.\n   *\n   * **Note:** This function does **not** replace any changes made with `updateConfig`. Changes made with\n   * `updateConfig` always take precedence over those made with `pushConfig`, even if the `pushConfig`\n   * config was pushed after the changes were made with `updateConfig`.\n   *\n   * This is useful for programmatically deploying configuration. More often than not, you'll want to use\n   * `updateConfig` instead.\n   */\n  pushConfig(\n    this: AdminProject,\n    config: EnvironmentConfigOverrideOverride,\n    options: PushConfigOptions,\n  ): Promise<void>,\n\n  /**\n   * Updates the pushed config by merging the provided config into the existing pushed config.\n   *\n   * **Warning:** This is almost always **not** the function you want to call. Changes made with\n   * `updatePushedConfig` will be replaced entirely the next time `pushConfig` is called. Consider using\n   * `pushConfig` to set the full pushed config, or `updateConfig` for environment-specific values that\n   * should persist across pushes.\n   *\n   * This function is useful for making temporary modifications to the pushed config before the next push.\n   */\n  updatePushedConfig(\n    this: AdminProject,\n    config: EnvironmentConfigOverrideOverride\n  ): Promise<void>,\n\n  /**\n   * Gets the source metadata for the pushed config, indicating where it was pushed from.\n   *\n   * The source can be:\n   * - `pushed-from-github`: Config was pushed from a GitHub repository\n   * - `pushed-from-unknown`: Config was pushed via CLI but source details unknown\n   * - `unlinked`: Config can be edited directly on the dashboard\n   */\n  getPushedConfigSource(this: AdminProject): Promise<PushedConfigSource>,\n\n  /**\n   * Unlinks the pushed config source, setting it to \"unlinked\".\n   * This allows the config to be edited directly on the dashboard without external push restrictions.\n   */\n  unlinkPushedConfigSource(this: AdminProject): Promise<void>,\n\n  /**\n   * Resets (removes) specific keys from the config override at the specified level.\n   * Uses the same nested key logic as the override algorithm: resetting key \"a.b\" also resets \"a.b.c\".\n   *\n   * This is useful when updating the pushed config (branch level) and wanting to remove the same keys\n   * from the environment config override so that the branch config values take precedence.\n   */\n  resetConfigOverrideKeys(this: AdminProject, level: \"branch\" | \"environment\", keys: string[]): Promise<void>,\n\n  /**\n   * Gets the raw config override at the specified level (before merging/defaults).\n   * Useful for inspecting exactly what's been set at each level.\n   */\n  getConfigOverride(this: AdminProject, level: \"branch\" | \"environment\"): Promise<Record<string, unknown>>,\n\n  /**\n   * Replaces the entire config override at the specified level.\n   * For branch level, preserves the existing source metadata.\n   */\n  replaceConfigOverride(this: AdminProject, level: \"branch\" | \"environment\", config: Record<string, unknown>): Promise<void>,\n\n  getProductionModeErrors(this: AdminProject): Promise<ProductionModeError[]>,\n} & Project;\n\nexport type AdminOwnedProject = {\n  readonly app: StackAdminApp<false>,\n} & AdminProject;\n\nexport type AdminProjectUpdateOptions = {\n  displayName?: string,\n  description?: string,\n  isProductionMode?: boolean,\n  onboardingStatus?: ProjectOnboardingStatus,\n  /**\n   * Updates `project.requirePublishableClientKey` in the project-level config override.\n   */\n  requirePublishableClientKey?: boolean,\n  logoUrl?: string | null,\n  logoFullUrl?: string | null,\n  logoDarkModeUrl?: string | null,\n  logoFullDarkModeUrl?: string | null,\n  config?: AdminProjectConfigUpdateOptions,\n};\nexport function adminProjectUpdateOptionsToCrud(options: AdminProjectUpdateOptions): ProjectsCrud[\"Admin\"][\"Update\"] {\n  return {\n    display_name: options.displayName,\n    description: options.description,\n    is_production_mode: options.isProductionMode,\n    onboarding_status: options.onboardingStatus,\n    logo_url: options.logoUrl,\n    logo_full_url: options.logoFullUrl,\n    logo_dark_mode_url: options.logoDarkModeUrl,\n    logo_full_dark_mode_url: options.logoFullDarkModeUrl,\n    /**\n     * NOTE: Do not update this config anymore. It's been superseded by the new config in schema.ts.\n     * @deprecated\n     */\n    config: {\n      domains: options.config?.domains?.map((d) => ({\n        domain: d.domain,\n        handler_path: d.handlerPath\n      })),\n      oauth_providers: options.config?.oauthProviders?.map((p) => ({\n        id: p.id as any,\n        type: p.type,\n        ...(p.type === 'standard' && {\n          client_id: p.clientId,\n          client_secret: p.clientSecret,\n          facebook_config_id: p.facebookConfigId,\n          microsoft_tenant_id: p.microsoftTenantId,\n          apple_bundle_ids: p.appleBundleIds,\n        }),\n      })),\n      email_config: options.config?.emailConfig && (\n        options.config.emailConfig.type === 'shared' ? {\n          type: 'shared',\n        } : {\n          type: 'standard',\n          host: options.config.emailConfig.host,\n          port: options.config.emailConfig.port,\n          username: options.config.emailConfig.username,\n          password: options.config.emailConfig.password,\n          sender_name: options.config.emailConfig.senderName,\n          sender_email: options.config.emailConfig.senderEmail,\n        }\n      ),\n      email_theme: options.config?.emailTheme,\n      sign_up_enabled: options.config?.signUpEnabled,\n      credential_enabled: options.config?.credentialEnabled,\n      magic_link_enabled: options.config?.magicLinkEnabled,\n      passkey_enabled: options.config?.passkeyEnabled,\n      allow_localhost: options.config?.allowLocalhost,\n      create_team_on_sign_up: options.config?.createTeamOnSignUp,\n      client_team_creation_enabled: options.config?.clientTeamCreationEnabled,\n      client_user_deletion_enabled: options.config?.clientUserDeletionEnabled,\n      team_creator_default_permissions: options.config?.teamCreatorDefaultPermissions,\n      team_member_default_permissions: options.config?.teamMemberDefaultPermissions,\n      user_default_permissions: options.config?.userDefaultPermissions,\n      oauth_account_merge_strategy: options.config?.oauthAccountMergeStrategy,\n      allow_user_api_keys: options.config?.allowUserApiKeys,\n      allow_team_api_keys: options.config?.allowTeamApiKeys,\n    },\n  };\n}\n\nexport type AdminProjectCreateOptions = Omit<AdminProjectUpdateOptions, 'displayName'> & {\n  displayName: string,\n  teamId: string,\n  isDevelopmentEnvironment?: boolean,\n};\nexport function adminProjectCreateOptionsToCrud(options: AdminProjectCreateOptions): AdminUserProjectsCrud[\"Server\"][\"Create\"] {\n  return {\n    ...adminProjectUpdateOptionsToCrud(options),\n    display_name: options.displayName,\n    is_development_environment: options.isDevelopmentEnvironment,\n    owner_team_id: options.teamId,\n  };\n}\n"],"mappings":";;;AA+JA,SAAgB,gCAAgC,SAAqE;AACnH,QAAO;EACL,cAAc,QAAQ;EACtB,aAAa,QAAQ;EACrB,oBAAoB,QAAQ;EAC5B,mBAAmB,QAAQ;EAC3B,UAAU,QAAQ;EAClB,eAAe,QAAQ;EACvB,oBAAoB,QAAQ;EAC5B,yBAAyB,QAAQ;EAKjC,QAAQ;GACN,SAAS,QAAQ,QAAQ,SAAS,KAAK,OAAO;IAC5C,QAAQ,EAAE;IACV,cAAc,EAAE;IACjB,EAAE;GACH,iBAAiB,QAAQ,QAAQ,gBAAgB,KAAK,OAAO;IAC3D,IAAI,EAAE;IACN,MAAM,EAAE;IACR,GAAI,EAAE,SAAS,cAAc;KAC3B,WAAW,EAAE;KACb,eAAe,EAAE;KACjB,oBAAoB,EAAE;KACtB,qBAAqB,EAAE;KACvB,kBAAkB,EAAE;KACrB;IACF,EAAE;GACH,cAAc,QAAQ,QAAQ,gBAC5B,QAAQ,OAAO,YAAY,SAAS,WAAW,EAC7C,MAAM,UACP,GAAG;IACF,MAAM;IACN,MAAM,QAAQ,OAAO,YAAY;IACjC,MAAM,QAAQ,OAAO,YAAY;IACjC,UAAU,QAAQ,OAAO,YAAY;IACrC,UAAU,QAAQ,OAAO,YAAY;IACrC,aAAa,QAAQ,OAAO,YAAY;IACxC,cAAc,QAAQ,OAAO,YAAY;IAC1C;GAEH,aAAa,QAAQ,QAAQ;GAC7B,iBAAiB,QAAQ,QAAQ;GACjC,oBAAoB,QAAQ,QAAQ;GACpC,oBAAoB,QAAQ,QAAQ;GACpC,iBAAiB,QAAQ,QAAQ;GACjC,iBAAiB,QAAQ,QAAQ;GACjC,wBAAwB,QAAQ,QAAQ;GACxC,8BAA8B,QAAQ,QAAQ;GAC9C,8BAA8B,QAAQ,QAAQ;GAC9C,kCAAkC,QAAQ,QAAQ;GAClD,iCAAiC,QAAQ,QAAQ;GACjD,0BAA0B,QAAQ,QAAQ;GAC1C,8BAA8B,QAAQ,QAAQ;GAC9C,qBAAqB,QAAQ,QAAQ;GACrC,qBAAqB,QAAQ,QAAQ;GACtC;EACF;;AAQH,SAAgB,gCAAgC,SAA+E;AAC7H,QAAO;EACL,GAAG,gCAAgC,QAAQ;EAC3C,cAAc,QAAQ;EACtB,4BAA4B,QAAQ;EACpC,eAAe,QAAQ;EACxB"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../../src/lib/hexclave-app/projects/index.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { ProductionModeError } from \"@hexclave/shared/dist/helpers/production-mode\";\nimport { AdminUserProjectsCrud, ProjectsCrud } from \"@hexclave/shared/dist/interface/crud/projects\";\nimport { ProjectOnboardingStatus } from \"@hexclave/shared/dist/schema-fields\";\n\nimport { CompleteConfig, EnvironmentConfigNormalizedOverride, EnvironmentConfigOverrideOverride } from \"@hexclave/shared/dist/config/schema\";\nimport { StackAdminApp } from \"../apps/interfaces/admin-app\";\nimport { AdminProjectConfig, AdminProjectConfigUpdateOptions, ProjectConfig } from \"../project-configs\";\n\n/**\n * SDK type for pushed config source (camelCase for SDK).\n * Represents where the branch config was pushed from.\n */\nexport type PushedConfigSource =\n  | { type: \"pushed-from-github\", owner: string, repo: string, branch: string, commitHash: string, configFilePath: string, workflowPath?: string }\n  | { type: \"pushed-from-unknown\" }\n  | { type: \"unlinked\" };\n\nexport type PushConfigOptions = {\n  /**\n   * The source of this config push.\n   */\n  source: PushedConfigSource,\n};\n\n\nexport type Project = {\n  readonly id: string,\n  readonly displayName: string,\n  readonly config: ProjectConfig,\n};\n\nexport type AdminProject = {\n  readonly id: string,\n  readonly displayName: string,\n  readonly description: string | null,\n  readonly createdAt: Date,\n  readonly isProductionMode: boolean,\n  readonly isDevelopmentEnvironment: boolean,\n  readonly ownerTeamId: string | null,\n  readonly onboardingStatus: ProjectOnboardingStatus,\n  readonly logoUrl: string | null | undefined,\n  readonly logoFullUrl: string | null | undefined,\n  readonly logoDarkModeUrl: string | null | undefined,\n  readonly logoFullDarkModeUrl: string | null | undefined,\n\n  readonly config: AdminProjectConfig,\n\n  update(this: AdminProject, update: AdminProjectUpdateOptions): Promise<void>,\n  delete(this: AdminProject): Promise<void>,\n\n  getConfig(this: AdminProject): Promise<CompleteConfig>,\n\n  /**\n   * Updates the environment's config by merging the provided config into the existing config.\n   *\n   * Changes made with `updateConfig` always take precedence over those made with `pushConfig`, even if the `pushConfig`\n   * config was pushed after the changes were made with `updateConfig`. This is best for environment-specific\n   * configuration like secrets, API keys, and other values that you wouldn't push into a source repository.\n   */\n  // We have some strict types here in order to prevent accidental overwriting of a top-level property of a config object\n  updateConfig(\n    this: AdminProject,\n    config: EnvironmentConfigOverrideOverride,\n  ): Promise<void>,\n\n  /**\n   * Pushes a config, replacing any previous config pushed with `pushConfig`.\n   *\n   * **Note:** This function does **not** replace any changes made with `updateConfig`. Changes made with\n   * `updateConfig` always take precedence over those made with `pushConfig`, even if the `pushConfig`\n   * config was pushed after the changes were made with `updateConfig`.\n   *\n   * This is useful for programmatically deploying configuration. More often than not, you'll want to use\n   * `updateConfig` instead.\n   */\n  pushConfig(\n    this: AdminProject,\n    config: EnvironmentConfigOverrideOverride,\n    options: PushConfigOptions,\n  ): Promise<void>,\n\n  /**\n   * Updates the pushed config by merging the provided config into the existing pushed config.\n   *\n   * **Warning:** This is almost always **not** the function you want to call. Changes made with\n   * `updatePushedConfig` will be replaced entirely the next time `pushConfig` is called. Consider using\n   * `pushConfig` to set the full pushed config, or `updateConfig` for environment-specific values that\n   * should persist across pushes.\n   *\n   * This function is useful for making temporary modifications to the pushed config before the next push.\n   */\n  updatePushedConfig(\n    this: AdminProject,\n    config: EnvironmentConfigOverrideOverride\n  ): Promise<void>,\n\n  /**\n   * Gets the source metadata for the pushed config, indicating where it was pushed from.\n   *\n   * The source can be:\n   * - `pushed-from-github`: Config was pushed from a GitHub repository\n   * - `pushed-from-unknown`: Config was pushed via CLI but source details unknown\n   * - `unlinked`: Config can be edited directly on the dashboard\n   */\n  getPushedConfigSource(this: AdminProject): Promise<PushedConfigSource>,\n\n  /**\n   * Unlinks the pushed config source, setting it to \"unlinked\".\n   * This allows the config to be edited directly on the dashboard without external push restrictions.\n   */\n  unlinkPushedConfigSource(this: AdminProject): Promise<void>,\n\n  /**\n   * Resets (removes) specific keys from the config override at the specified level.\n   * Uses the same nested key logic as the override algorithm: resetting key \"a.b\" also resets \"a.b.c\".\n   *\n   * This is useful when updating the pushed config (branch level) and wanting to remove the same keys\n   * from the environment config override so that the branch config values take precedence.\n   */\n  resetConfigOverrideKeys(this: AdminProject, level: \"branch\" | \"environment\", keys: string[]): Promise<void>,\n\n  /**\n   * Gets the raw config override at the specified level (before merging/defaults).\n   * Useful for inspecting exactly what's been set at each level.\n   */\n  getConfigOverride(this: AdminProject, level: \"branch\" | \"environment\"): Promise<Record<string, unknown>>,\n\n  /**\n   * Replaces the entire config override at the specified level.\n   * For branch level, preserves the existing source metadata.\n   */\n  replaceConfigOverride(this: AdminProject, level: \"branch\" | \"environment\", config: Record<string, unknown>): Promise<void>,\n\n  getProductionModeErrors(this: AdminProject): Promise<ProductionModeError[]>,\n} & Project;\n\nexport type AdminOwnedProject = {\n  readonly app: StackAdminApp<false>,\n} & AdminProject;\n\nexport type AdminProjectUpdateOptions = {\n  displayName?: string,\n  description?: string,\n  isProductionMode?: boolean,\n  onboardingStatus?: ProjectOnboardingStatus,\n  /**\n   * Updates `project.requirePublishableClientKey` in the project-level config override.\n   */\n  requirePublishableClientKey?: boolean,\n  logoUrl?: string | null,\n  logoFullUrl?: string | null,\n  logoDarkModeUrl?: string | null,\n  logoFullDarkModeUrl?: string | null,\n  config?: AdminProjectConfigUpdateOptions,\n};\nexport function adminProjectUpdateOptionsToCrud(options: AdminProjectUpdateOptions): ProjectsCrud[\"Admin\"][\"Update\"] {\n  return {\n    display_name: options.displayName,\n    description: options.description,\n    is_production_mode: options.isProductionMode,\n    onboarding_status: options.onboardingStatus,\n    logo_url: options.logoUrl,\n    logo_full_url: options.logoFullUrl,\n    logo_dark_mode_url: options.logoDarkModeUrl,\n    logo_full_dark_mode_url: options.logoFullDarkModeUrl,\n    /**\n     * NOTE: Do not update this config anymore. It's been superseded by the new config in schema.ts.\n     * @deprecated\n     */\n    config: {\n      domains: options.config?.domains?.map((d) => ({\n        domain: d.domain,\n        handler_path: d.handlerPath\n      })),\n      oauth_providers: options.config?.oauthProviders\n        ?.filter((p): p is Exclude<typeof p, { type: 'custom_oidc' }> => p.type !== 'custom_oidc')\n        .map((p) => ({\n          id: p.id as any,\n          type: p.type,\n          ...(p.type === 'standard' && {\n            client_id: p.clientId,\n            client_secret: p.clientSecret,\n            facebook_config_id: p.facebookConfigId,\n            microsoft_tenant_id: p.microsoftTenantId,\n            apple_bundle_ids: p.appleBundleIds,\n          }),\n        })),\n      email_config: options.config?.emailConfig && (\n        options.config.emailConfig.type === 'shared' ? {\n          type: 'shared',\n        } : {\n          type: 'standard',\n          host: options.config.emailConfig.host,\n          port: options.config.emailConfig.port,\n          username: options.config.emailConfig.username,\n          password: options.config.emailConfig.password,\n          sender_name: options.config.emailConfig.senderName,\n          sender_email: options.config.emailConfig.senderEmail,\n        }\n      ),\n      email_theme: options.config?.emailTheme,\n      sign_up_enabled: options.config?.signUpEnabled,\n      credential_enabled: options.config?.credentialEnabled,\n      magic_link_enabled: options.config?.magicLinkEnabled,\n      passkey_enabled: options.config?.passkeyEnabled,\n      allow_localhost: options.config?.allowLocalhost,\n      create_team_on_sign_up: options.config?.createTeamOnSignUp,\n      client_team_creation_enabled: options.config?.clientTeamCreationEnabled,\n      client_user_deletion_enabled: options.config?.clientUserDeletionEnabled,\n      team_creator_default_permissions: options.config?.teamCreatorDefaultPermissions,\n      team_member_default_permissions: options.config?.teamMemberDefaultPermissions,\n      user_default_permissions: options.config?.userDefaultPermissions,\n      oauth_account_merge_strategy: options.config?.oauthAccountMergeStrategy,\n      allow_user_api_keys: options.config?.allowUserApiKeys,\n      allow_team_api_keys: options.config?.allowTeamApiKeys,\n    },\n  };\n}\n\nexport type AdminProjectCreateOptions = Omit<AdminProjectUpdateOptions, 'displayName'> & {\n  displayName: string,\n  teamId: string,\n  isDevelopmentEnvironment?: boolean,\n};\nexport function adminProjectCreateOptionsToCrud(options: AdminProjectCreateOptions): AdminUserProjectsCrud[\"Server\"][\"Create\"] {\n  return {\n    ...adminProjectUpdateOptionsToCrud(options),\n    display_name: options.displayName,\n    is_development_environment: options.isDevelopmentEnvironment,\n    owner_team_id: options.teamId,\n  };\n}\n"],"mappings":";;;AA+JA,SAAgB,gCAAgC,SAAqE;AACnH,QAAO;EACL,cAAc,QAAQ;EACtB,aAAa,QAAQ;EACrB,oBAAoB,QAAQ;EAC5B,mBAAmB,QAAQ;EAC3B,UAAU,QAAQ;EAClB,eAAe,QAAQ;EACvB,oBAAoB,QAAQ;EAC5B,yBAAyB,QAAQ;EAKjC,QAAQ;GACN,SAAS,QAAQ,QAAQ,SAAS,KAAK,OAAO;IAC5C,QAAQ,EAAE;IACV,cAAc,EAAE;IACjB,EAAE;GACH,iBAAiB,QAAQ,QAAQ,gBAC7B,QAAQ,MAAuD,EAAE,SAAS,cAAc,CACzF,KAAK,OAAO;IACX,IAAI,EAAE;IACN,MAAM,EAAE;IACR,GAAI,EAAE,SAAS,cAAc;KAC3B,WAAW,EAAE;KACb,eAAe,EAAE;KACjB,oBAAoB,EAAE;KACtB,qBAAqB,EAAE;KACvB,kBAAkB,EAAE;KACrB;IACF,EAAE;GACL,cAAc,QAAQ,QAAQ,gBAC5B,QAAQ,OAAO,YAAY,SAAS,WAAW,EAC7C,MAAM,UACP,GAAG;IACF,MAAM;IACN,MAAM,QAAQ,OAAO,YAAY;IACjC,MAAM,QAAQ,OAAO,YAAY;IACjC,UAAU,QAAQ,OAAO,YAAY;IACrC,UAAU,QAAQ,OAAO,YAAY;IACrC,aAAa,QAAQ,OAAO,YAAY;IACxC,cAAc,QAAQ,OAAO,YAAY;IAC1C;GAEH,aAAa,QAAQ,QAAQ;GAC7B,iBAAiB,QAAQ,QAAQ;GACjC,oBAAoB,QAAQ,QAAQ;GACpC,oBAAoB,QAAQ,QAAQ;GACpC,iBAAiB,QAAQ,QAAQ;GACjC,iBAAiB,QAAQ,QAAQ;GACjC,wBAAwB,QAAQ,QAAQ;GACxC,8BAA8B,QAAQ,QAAQ;GAC9C,8BAA8B,QAAQ,QAAQ;GAC9C,kCAAkC,QAAQ,QAAQ;GAClD,iCAAiC,QAAQ,QAAQ;GACjD,0BAA0B,QAAQ,QAAQ;GAC1C,8BAA8B,QAAQ,QAAQ;GAC9C,qBAAqB,QAAQ,QAAQ;GACrC,qBAAqB,QAAQ,QAAQ;GACtC;EACF;;AAQH,SAAgB,gCAAgC,SAA+E;AAC7H,QAAO;EACL,GAAG,gCAAgC,QAAQ;EAC3C,cAAc,QAAQ;EACtB,4BAA4B,QAAQ;EACpC,eAAe,QAAQ;EACxB"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template (FOR package.json FILES, PLEASE EDIT package-template.json)",
   "name": "@hexclave/js",
-  "version": "1.0.19",
+  "version": "1.0.20",
   "repository": "https://github.com/hexclave/hexclave",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -66,7 +66,7 @@
     "rrweb": "^1.1.3",
     "tsx": "^4.21.0",
     "yup": "^1.7.1",
-    "@hexclave/shared": "1.0.19"
+    "@hexclave/shared": "1.0.20"
   },
   "devDependencies": {
     "@quetzallabs/i18n": "^0.1.19",

package/src/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.ts

@@ -273,6 +273,8 @@ describe("StackClientApp cross-domain auth", () => {
         protocol: "https:",
         hostname: "demo.stack-auth.com",
       },
+      addEventListener: () => {},
+      removeEventListener: () => {},
     } as any;
 
     const clientApp = new StackClientApp({
@@ -460,6 +462,40 @@ describe("StackClientApp cross-domain auth", () => {
     }
   });
 
+  it("throws when public app.urls reads would return hosted component URLs", () => {
+    const clientApp = new StackClientApp({
+      baseUrl: "http://localhost:12345",
+      projectId: "00000000-0000-4000-8000-000000000003",
+      publishableClientKey: "stack-pk-test",
+      tokenStore: "memory",
+      redirectMethod: "window",
+      urls: {
+        default: { type: "hosted" },
+      },
+      noAutomaticPrefetch: true,
+    });
+
+    expect(() => clientApp.urls.signIn).toThrowError(/app\.urls\.signIn cannot be used when this app is configured to use hosted components.*Use app\.redirectToSignIn\(\) instead/s);
+    expect(() => clientApp.urls.signOut).toThrowError(/app\.urls\.signOut cannot be used when this app is configured to use hosted components.*Use app\.redirectToSignOut\(\) instead/s);
+    expect(clientApp.urls.afterSignIn).toBe("/");
+  });
+
+  it("keeps public app.urls reads available for non-hosted targets", () => {
+    const clientApp = new StackClientApp({
+      baseUrl: "http://localhost:12345",
+      projectId: "00000000-0000-4000-8000-000000000003",
+      publishableClientKey: "stack-pk-test",
+      tokenStore: "memory",
+      redirectMethod: "window",
+      urls: {
+        handler: "/custom-handler",
+      },
+      noAutomaticPrefetch: true,
+    });
+
+    expect(clientApp.urls.signIn).toBe("/custom-handler/sign-in");
+  });
+
   it("keeps default hosted signOut() on the source domain when afterSignOut is not configured", async () => {
     const clientApp = new StackClientApp({
       baseUrl: "http://localhost:12345",

package/src/lib/hexclave-app/apps/implementations/client-app-impl.ts

@@ -84,6 +84,38 @@ const nestedCrossDomainAuthQueryParams = {
   afterCallbackRedirectUrl: "after_callback_redirect_url",
 } as const;
 
+function getRedirectHelperInstruction(handlerName: string): string {
+  if (handlerName === "handler") {
+    return "Use a page-specific redirect helper such as app.redirectToSignIn() instead.";
+  }
+  const redirectMethodName = `redirectTo${handlerName.slice(0, 1).toUpperCase()}${handlerName.slice(1)}`;
+  return `Use app.${redirectMethodName}() instead.`;
+}
+
+function createUrlsForPublicAccess(options: {
+  urls: ResolvedHandlerUrls,
+  projectId: string,
+}): Readonly<ResolvedHandlerUrls> {
+  const hostedUrlNames = new Set(
+    Object.entries(options.urls)
+      .filter(([, url]) => isHostedHandlerUrlForProject({ url, projectId: options.projectId }))
+      .map(([handlerName]) => handlerName),
+  );
+
+  return new Proxy(options.urls, {
+    get(target, property, receiver) {
+      if (typeof property === "string" && hostedUrlNames.has(property)) {
+        throw new Error(
+          `app.urls.${property} cannot be used when this app is configured to use hosted components. ` +
+          "`app.urls` is static and does not include the runtime redirect-back, cross-domain auth, or sign-out state required by hosted components. " +
+          getRedirectHelperInstruction(property),
+        );
+      }
+      return Reflect.get(target, property, receiver);
+    },
+  });
+}
+
 const oauthCallbackResponseQueryParams = ["code", "state", "error", "error_description", "errorCode", "message", "details"] as const;
 
 const allClientApps = new Map<string, [checkString: string | undefined, app: StackClientApp<any, any>]>();
@@ -1630,7 +1662,7 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
           teamId: crud.id,
           email: options.email,
           session,
-          callbackUrl: options.callbackUrl ?? constructRedirectUrl(app.urls.teamInvitation, "callbackUrl"),
+          callbackUrl: options.callbackUrl ?? constructRedirectUrl(app._getUrls().teamInvitation, "callbackUrl"),
         });
         await app._teamInvitationsCache.refresh([session, crud.id]);
       },
@@ -1682,7 +1714,7 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
       async sendVerificationEmail(options?: { callbackUrl?: string }) {
         await app._interface.sendCurrentUserContactChannelVerificationEmail(
           crud.id,
-          options?.callbackUrl || constructRedirectUrl(app.urls.emailVerification, "callbackUrl"),
+          options?.callbackUrl || constructRedirectUrl(app._getUrls().emailVerification, "callbackUrl"),
           session
         );
       },
@@ -1959,7 +1991,7 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
           {
             provider,
             redirectUrl: app._getOAuthCallbackRedirectUri(),
-            errorRedirectUrl: app.urls.error,
+            errorRedirectUrl: app._getUrls().error,
             providerScope: mergeScopeStrings(scopeString, (app._oauthScopesOnSignIn[provider as ProviderType] ?? []).join(" ")),
           },
           session,
@@ -2046,7 +2078,7 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
         }
         return await app._interface.sendVerificationEmail(
           crud.primary_email,
-          options?.callbackUrl ?? constructRedirectUrl(app.urls.emailVerification, "callbackUrl"),
+          options?.callbackUrl ?? constructRedirectUrl(app._getUrls().emailVerification, "callbackUrl"),
           session
         );
       },
@@ -2437,6 +2469,13 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
   }
 
   get urls(): Readonly<ResolvedHandlerUrls> {
+    return createUrlsForPublicAccess({
+      urls: this._getUrls(),
+      projectId: this.projectId,
+    });
+  }
+
+  protected _getUrls(): Readonly<ResolvedHandlerUrls> {
     return getUrls(this._urlOptions, { projectId: this.projectId });
   }
 

package/src/lib/hexclave-app/apps/implementations/server-app-impl.ts

@@ -356,7 +356,7 @@ export class _HexclaveServerAppImplIncomplete<HasTokenStore extends boolean, Pro
       isPrimary: crud.is_primary,
       usedForAuth: crud.used_for_auth,
       async sendVerificationEmail(options?: { callbackUrl?: string }) {
-        await app._interface.sendServerContactChannelVerificationEmail(userId, crud.id, options?.callbackUrl ?? constructRedirectUrl(app.urls.emailVerification, "callbackUrl"));
+        await app._interface.sendServerContactChannelVerificationEmail(userId, crud.id, options?.callbackUrl ?? constructRedirectUrl(app._getUrls().emailVerification, "callbackUrl"));
       },
       async update(data: ServerContactChannelUpdateOptions) {
         await app._interface.updateServerContactChannel(userId, crud.id, serverContactChannelUpdateOptionsToCrud(data));
@@ -922,7 +922,7 @@ export class _HexclaveServerAppImplIncomplete<HasTokenStore extends boolean, Pro
         await app._interface.sendServerTeamInvitation({
           teamId: crud.id,
           email: options.email,
-          callbackUrl: options.callbackUrl ?? constructRedirectUrl(app.urls.teamInvitation, "callbackUrl"),
+          callbackUrl: options.callbackUrl ?? constructRedirectUrl(app._getUrls().teamInvitation, "callbackUrl"),
         });
         await app._serverTeamInvitationsCache.refresh([crud.id]);
       },

package/src/lib/hexclave-app/apps/interfaces/client-app.ts

@@ -68,8 +68,9 @@ export type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId ex
     readonly version: string,
 
     /**
-     * @deprecated `app.urls` is static and does not include runtime redirect-back parameters.
-     * For navigation, prefer `redirectToXyz()` methods (for example `redirectToSignIn()`).
+     * @deprecated Do not use `app.urls` for navigation. It is static and does not include runtime redirect-back,
+     * cross-domain auth, or sign-out state. Use the matching `redirectToXyz()` method instead, for example
+     * `redirectToSignIn()`, `redirectToSignUp()`, `redirectToSignOut()`, or `redirectToAccountSettings()`.
      */
     readonly urls: Readonly<ResolvedHandlerUrls>,
 

package/src/lib/hexclave-app/project-configs/index.ts

@@ -76,6 +76,14 @@ export type AdminOAuthProviderConfig = {
       microsoftTenantId?: string,
       appleBundleIds?: string[],
     }
+    | {
+      type: 'custom_oidc',
+      clientId: string,
+      clientSecret: string,
+      issuerUrl: string,
+      scope?: string,
+      displayName?: string,
+    }
   ) & OAuthProviderConfig;
 
 export type AdminProjectConfigUpdateOptions = {

package/src/lib/hexclave-app/projects/index.ts

@@ -176,17 +176,19 @@ export function adminProjectUpdateOptionsToCrud(options: AdminProjectUpdateOptio
         domain: d.domain,
         handler_path: d.handlerPath
       })),
-      oauth_providers: options.config?.oauthProviders?.map((p) => ({
-        id: p.id as any,
-        type: p.type,
-        ...(p.type === 'standard' && {
-          client_id: p.clientId,
-          client_secret: p.clientSecret,
-          facebook_config_id: p.facebookConfigId,
-          microsoft_tenant_id: p.microsoftTenantId,
-          apple_bundle_ids: p.appleBundleIds,
-        }),
-      })),
+      oauth_providers: options.config?.oauthProviders
+        ?.filter((p): p is Exclude<typeof p, { type: 'custom_oidc' }> => p.type !== 'custom_oidc')
+        .map((p) => ({
+          id: p.id as any,
+          type: p.type,
+          ...(p.type === 'standard' && {
+            client_id: p.clientId,
+            client_secret: p.clientSecret,
+            facebook_config_id: p.facebookConfigId,
+            microsoft_tenant_id: p.microsoftTenantId,
+            apple_bundle_ids: p.appleBundleIds,
+          }),
+        })),
       email_config: options.config?.emailConfig && (
         options.config.emailConfig.type === 'shared' ? {
           type: 'shared',