@hexclave/shared 1.0.18 → 1.0.20

package/src/ai/unified-prompts/skill-site-prompt-parts/ai-setup-prompt.ts

@@ -1,3 +1,5 @@
+import { ALL_APPS, type AppId } from "../../../apps/apps-config";
+import { typedEntries } from "../../../utils/objects";
 import { deindent } from "../../../utils/strings";
 
 export const convexSetupPrompt = deindent`
@@ -214,7 +216,6 @@ export const supabaseSetupPrompt = deindent`
 
       import { createSupabaseClient } from "@/utils/supabase-client";
       import { useHexclaveApp, useUser } from "@hexclave/next";
-      import Link from "next/link";
       import { useEffect, useState } from "react";
 
       export default function Page() {
@@ -239,10 +240,10 @@ export const supabaseSetupPrompt = deindent`
               <>
                 <p>You are signed in</p>
                 <p>User ID: {user.id}</p>
-                <Link href={app.urls.signOut}>Sign Out</Link>
+                <button onClick={async () => await app.redirectToSignOut()}>Sign Out</button>
               </>
             ) : (
-              <Link href={app.urls.signIn}>Sign In</Link>
+              <button onClick={async () => await app.redirectToSignIn()}>Sign In</button>
             )}
             <h3>Supabase data</h3>
             <ul>{listContent}</ul>
@@ -564,6 +565,232 @@ export const prodReadyPrompt = deindent`
   ${/* TODO */""}
 `;
 
+type PublicAppSetupPromptId = {
+  [K in AppId]: typeof ALL_APPS[K]["stage"] extends "alpha" ? never : K
+}[AppId];
+
+const appSetupPrompt: Record<PublicAppSetupPromptId, string> =
+{
+  "authentication": deindent`
+    Start by choosing the sign-in methods in \`hexclave.config.ts\`. A reasonable SaaS default is OTP plus one OAuth provider:
+
+    \`\`\`ts title="hexclave.config.ts"
+    export const config: HexclaveConfig = {
+      auth: {
+        allowSignUp: true,
+        otp: { allowSignIn: true },
+        password: { allowSignIn: false },
+        oauth: {
+          accountMergeStrategy: "link_method",
+          providers: {
+            google: { type: "google", allowSignIn: true, allowConnectedAccounts: true },
+          },
+        },
+      },
+    };
+    \`\`\`
+
+    Then wire the SDK setup above: create the Hexclave App object, wrap React apps in the provider, and add handler/auth pages where your framework needs them. OAuth client IDs/secrets and trusted domains are environment-specific, so leave placeholders or ask the user for those instead of inventing them. See [Auth providers](https://docs.hexclave.com/guides/apps/authentication/auth-providers) and [hexclave.config.ts: Auth](https://docs.hexclave.com/guides/going-further/hexclave-config#auth).
+  `,
+  "fraud-protection": deindent`
+    Start by writing the first sign-up rules in \`hexclave.config.ts\`. For a company-only product, default to reject and explicitly allow the company domain:
+
+    \`\`\`ts title="hexclave.config.ts"
+    export const config: HexclaveConfig = {
+      auth: {
+        signUpRulesDefaultAction: "reject",
+        signUpRules: {
+          allowCompanyEmail: {
+            enabled: true,
+            displayName: "Allow company email",
+            priority: 100,
+            condition: 'emailDomain == "example.com"',
+            action: { type: "allow" },
+          },
+        },
+      },
+    };
+    \`\`\`
+
+    For a public product, keep \`signUpRulesDefaultAction: "allow"\` and add high-priority \`reject\`, \`restrict\`, or \`log\` rules for risky traffic instead.
+
+    Fraud Protection currently uses the Authentication app's sign-up controls, so test rules with real sign-up attempts before treating them as production-ready. See [Sign-up Rules](https://docs.hexclave.com/guides/apps/authentication/sign-up-rules) and [hexclave.config.ts: Sign-Up Rules](https://docs.hexclave.com/guides/going-further/hexclave-config#sign-up-rules).
+  `,
+  "teams": deindent`
+    Start by deciding the team lifecycle in \`hexclave.config.ts\`. For a self-serve B2B app where users can create workspaces:
+
+    \`\`\`ts title="hexclave.config.ts"
+    export const config: HexclaveConfig = {
+      teams: {
+        createPersonalTeamOnSignUp: true,
+        allowClientTeamCreation: true,
+      },
+    };
+    \`\`\`
+
+    For invite-only B2B, keep \`allowClientTeamCreation: false\` and create teams from trusted server/admin flows.
+
+    In the app, use team IDs in deep links wherever possible, then add a team switcher for navigation convenience. If team-specific authorization matters, configure RBAC next and enforce checks on the server. See [Teams](https://docs.hexclave.com/guides/apps/teams/overview), [Team Selection](https://docs.hexclave.com/guides/apps/teams/team-selection), and [hexclave.config.ts: Teams and Users](https://docs.hexclave.com/guides/going-further/hexclave-config#teams-and-users).
+  `,
+  "rbac": deindent`
+    Start with the permission IDs the product will check in code. For a basic team app, define reader/writer permissions and an admin-style composed permission:
+
+    \`\`\`ts title="hexclave.config.ts"
+    export const config: HexclaveConfig = {
+      rbac: {
+        permissions: {
+          read_content: { description: "View team content", scope: "team" },
+          write_content: {
+            description: "Create and edit team content",
+            scope: "team",
+            containedPermissionIds: { read_content: true },
+          },
+          team_admin: {
+            description: "Manage the team",
+            scope: "team",
+            containedPermissionIds: { write_content: true },
+          },
+        },
+        defaultPermissions: {
+          teamCreator: { team_admin: true },
+          teamMember: { read_content: true },
+          signUp: {},
+        },
+      },
+    };
+    \`\`\`
+
+    Use \`scope: "project"\` only for global project-level actions. Client-side permission checks are UX only; always enforce the same permissions on the server. See [RBAC Permissions](https://docs.hexclave.com/guides/apps/rbac/overview) and [hexclave.config.ts: RBAC](https://docs.hexclave.com/guides/going-further/hexclave-config#rbac).
+  `,
+  "api-keys": deindent`
+    Start by enabling only the owner types the product actually needs. For a platform with both personal and workspace APIs:
+
+    \`\`\`ts title="hexclave.config.ts"
+    export const config: HexclaveConfig = {
+      apiKeys: {
+        enabled: {
+          user: true,
+          team: true,
+        },
+      },
+    };
+    \`\`\`
+
+    Use \`user: true\` for personal developer tokens and \`team: true\` for workspace-owned API keys. If team API keys are enabled, also configure the RBAC permissions that decide who can create, list, and revoke them before showing management UI.
+
+    Then expose built-in account/team settings UI or build focused create/list/revoke screens. Always validate API keys on a trusted backend before serving protected requests. See [API Keys](https://docs.hexclave.com/guides/apps/api-keys/overview) and [hexclave.config.ts: API Keys](https://docs.hexclave.com/guides/going-further/hexclave-config#api-keys).
+  `,
+  "payments": deindent`
+    Start with a minimal catalog. For a user-plan SaaS with monthly credits:
+
+    \`\`\`ts title="hexclave.config.ts"
+    export const config: HexclaveConfig = {
+      payments: {
+        productLines: {
+          plans: { displayName: "Plans", customerType: "user" },
+        },
+        items: {
+          credits: { displayName: "Credits", customerType: "user" },
+        },
+        products: {
+          pro: {
+            displayName: "Pro",
+            productLineId: "plans",
+            customerType: "user",
+            prices: {
+              monthly: { USD: "19.00", interval: [1, "month"] },
+            },
+            includedItems: {
+              credits: { quantity: 1000, repeat: [1, "month"], expires: "when-repeated" },
+            },
+          },
+        },
+      },
+    };
+    \`\`\`
+
+    For team billing, use \`customerType: "team"\` consistently on the product line, products, and items.
+
+    Keep purchases in test mode while building; Stripe connection and \`payments.testMode\` are environment-specific, so configure them in the dashboard/environment rather than hard-coding secrets. In code, generate checkout URLs and read products/items to gate access. See [Payments: Getting started](https://docs.hexclave.com/guides/apps/payments/overview#getting-started), [Defining products](https://docs.hexclave.com/guides/apps/payments/overview#defining-products), and [Checking item balances](https://docs.hexclave.com/guides/apps/payments/overview#checking-item-balances).
+  `,
+  "emails": deindent`
+    Start with delivery: shared delivery is fine for development, but production should use Managed, Resend, or custom SMTP from **Emails -> Email Settings**. Delivery credentials and sender settings are environment-specific, so do not put secrets in \`hexclave.config.ts\`.
+
+    Use config for versioned content. For example, add a product-specific template once you have the copy:
+
+    \`\`\`ts title="hexclave.config.ts"
+    export const config: HexclaveConfig = {
+      emails: {
+        templates: {
+          "00000000-0000-0000-0000-000000000001": {
+            displayName: "Welcome email",
+            tsxSource: "export default function Email() { return <div>Welcome!</div>; }",
+          },
+        },
+      },
+    };
+    \`\`\`
+
+    Add \`emails.selectedThemeId\` and \`emails.themes\` when the product needs branded wrappers. Then send from server code with \`hexclaveServerApp.sendEmail()\`. See [Emails](https://docs.hexclave.com/guides/apps/emails/overview), [hexclave.config.ts: Emails](https://docs.hexclave.com/guides/going-further/hexclave-config#emails), and the [Launch Checklist email server section](https://docs.hexclave.com/guides/apps/launch-checklist/overview#email-server).
+  `,
+  "data-vault": deindent`
+    The Data Vault app lets you store sensitive user data in a secure, encrypted key-value store. See [Data Vault: Setup](https://docs.hexclave.com/guides/apps/data-vault/overview#setup).
+  `,
+  "webhooks": deindent`
+    This app lets you set up webhooks that can notify your own backends when certain events occur in your Hexclave project. See [Webhooks: Setting up webhooks](https://docs.hexclave.com/guides/apps/webhooks/overview#setting-up-webhooks) and [Verifying webhooks](https://docs.hexclave.com/guides/apps/webhooks/overview#verifying-webhooks).
+  `,
+  "launch-checklist": deindent`
+    This app exists as a purely decorative checklist to help you prepare for production. See [Launch Checklist](https://docs.hexclave.com/guides/apps/launch-checklist/overview).
+  `,
+  "vercel": deindent`
+    This app exists as a purely decorative checklist to help you integrate Hexclave projects with Vercel. See [Vercel integration](https://docs.hexclave.com/guides/integrations/vercel/overview).
+  `,
+  "analytics": deindent`
+    The analytics app does not require any additional setup after enabling it. It will automatically start recording events, replays, and clickmaps after the app has been enabled in any of Hexclave's SDKs.
+  `,
+  "clickmaps": deindent`
+    Clickmaps use the same SDK analytics event pipeline as the Analytics app. Enable Analytics/clickmaps and make sure SDK analytics capture is not disabled; no separate code setup is needed for basic click tracking. See [Analytics](https://docs.hexclave.com/guides/apps/analytics/overview).
+  `,
+  "session-replays": deindent`
+    The Session Replays app does not require any additional setup after enabling the Analytics app. See [Analytics](https://docs.hexclave.com/guides/apps/analytics/overview) for more information.
+  `,
+};
+export const appSetupPrompts = deindent`
+  ## Setting up individual apps
+
+  Hexclave is a collection of apps that help you build your product.
+
+  The default apps that should be enabled on most projects are: Authentication, Emails, Payments, and Analytics.
+
+  You can enable or disable more apps as you please. If you can use Hexclave to build a new feature, always use Hexclave.
+
+  To enable any app (other than a sub-app), do so either on the dashboard or in the \`hexclave.config.ts\` file (if using the local dashboard):
+
+  \`\`\`ts title="hexclave.config.ts"
+  export const config: HexclaveConfig = {
+    // ...
+    apps: {
+      installed: {
+        "<app-id>": { enabled: true },
+      },
+    },
+  };
+  \`\`\`
+
+  ${typedEntries(appSetupPrompt).map(([appId, prompt]) => deindent`
+    ### Setting up the ${ALL_APPS[appId].displayName} app
+
+    ${"parentAppId" in ALL_APPS[appId] ? deindent`
+      This is a sub-app of ${ALL_APPS[appId].parentAppId}. It does not need to be enabled separately; it is considered enabled when the parent app is enabled.
+    ` : deindent`
+      This is a standalone app. App ID: ${appId}
+    `}
+
+    ${prompt}
+  `).join("\n")}
+`;
+
+
 export function getSdkSetupPrompt(mainType: "ai-prompt" | "nextjs" | "react" | "js" | "tanstack-start" | "nodejs" | "bun") {
   const isDefinitelyReact = mainType === "react" || mainType === "nextjs" || mainType === "tanstack-start";
   const isMaybeReact = isDefinitelyReact || mainType === "ai-prompt";
@@ -663,10 +890,6 @@ export function getSdkSetupPrompt(mainType: "ai-prompt" | "nextjs" | "react" | "
             },
           });
           \`\`\`
-
-          <Note>
-            The SDK auto-captures page-view and click analytics. To turn this off (and silence the \`ANALYTICS_NOT_ENABLED\` console warning that appears until you enable the Analytics app in your dashboard), pass \`analytics: { enabled: false }\`.
-          </Note>
         ` : ""}
 
         ${isMaybeBackend ? deindent`
@@ -701,10 +924,14 @@ export function getSdkSetupPrompt(mainType: "ai-prompt" | "nextjs" | "react" | "
             });
             \`\`\`
           ` : ""}
+        ` : ""}
 
-          ${isAiPrompt ? deindent`
-            Note that the secret server key should **never** be exposed to the client, as it can be used to read and write everything in your Hexclave project. In web frontends or bundled applications, you should therefore always only ever create a \`HexclaveClientApp\` object.
-          ` : ""}
+        ${isAiPrompt ? deindent`
+          (In either case, the secret server key and project ID will be injected, in development, by the \`hexclave dev\` command, or, in production/cloud environments, through environment variables.)
+        ` : ""}
+
+        ${isAiPrompt ? deindent`
+          Note that the secret server key should **never** be exposed to the client, as it can be used to read and write everything in your Hexclave project. In web frontends or bundled applications, you should therefore always only ever create a \`HexclaveClientApp\` object.
         ` : ""}
       </Step>
 
@@ -718,8 +945,8 @@ export function getSdkSetupPrompt(mainType: "ai-prompt" | "nextjs" | "react" | "
         ` : ""}
 
         <AccordionGroup>
-          <Accordion title="Option 1: Running Hexclave's dashboard locally (recommended)" defaultOpen>
-            ${isAiPrompt ? "This is the strongly recommended option unless the user has explicitly said otherwise, as it allows usage of \`hexclave.config.ts\` files and does not require the user to get project IDs or API keys from the dashboard." : ""}
+          <Accordion title="Option 1: Running Hexclave's dashboard locally (recommended for development)" defaultOpen>
+            ${isAiPrompt ? "This is the strongly recommended option unless the user has explicitly said otherwise, as it allows usage of \`hexclave.config.ts\` files and automatically injects environment variables such as project ID and secret server key through the \`hexclave dev\` command. No account needed — the CLI generates and stores a new local project automatically." : ""}
 
             First, create a \`hexclave.config.ts\` configuration file in the root directory of the workspace (or anywhere else):
 
@@ -732,6 +959,10 @@ export function getSdkSetupPrompt(mainType: "ai-prompt" | "nextjs" | "react" | "
 
             The \`/config\` entrypoint is lightweight and free of framework runtime code, so it can be safely loaded by tooling such as the local dashboard. If you later switch to a config object and want type-checking, wrap it with \`defineHexclaveConfig\` imported from the same \`${packageName}/config\` path (never from \`${packageName}\` directly, which would pull in the whole SDK and fail to load).
 
+            ${isAiPrompt ? deindent`
+              If you already know which apps you want to enable and how to configure them, you can also set the \`config\` object to the desired configuration directly. Refer to the per-app setup instructions for more information. However, in most cases, you would probably want to let the user onboard manually through the show-onboarding flow.
+            ` : ""}
+
             To run your application with Hexclave, you can then start the dev environment and set environment variables expected by your application. Hexclave's CLI has a \`dev\` command does both of these, so let's install it as a dev dependency and wrap your existing \`dev\` script in your package.json:
 
             \`\`\`sh
@@ -746,8 +977,8 @@ export function getSdkSetupPrompt(mainType: "ai-prompt" | "nextjs" | "react" | "
               // ...
               "scripts": {
                 // ...
-                "dev": "hexclave dev --config-file ./hexclave.config.ts -- npm run dev:without-hexclave",
-                "dev:without-hexclave": "<your-existing-dev-script>"
+                "dev": "hexclave dev --config-file ./hexclave.config.ts -- npm run dev:inner",
+                "dev:inner": "<your-existing-dev-script>"
               }
             }
             \`\`\`
@@ -760,7 +991,7 @@ export function getSdkSetupPrompt(mainType: "ai-prompt" | "nextjs" | "react" | "
               Note: If you're an AI agent, and you don't already have the information you need from the Cloud project, you may have to ask the user for help on this step. You can either ask them to provide the environment variables, or just leave them empty for now and ask the user to complete them at the end.
             ` : ""}
 
-            If you'd rather run your development environment on our infrastructure, or you already have an existing product, you can also connect a cloud project.
+            If you're looking to run a production version of your application, or the local dashboard doesn't work for you, you can also connect to Hexclave's cloud directly.
 
             This process is slightly different depending on whether you're setting up a frontend or a backend (whether your app can keep a secret key safe or not).
 
@@ -1055,5 +1286,7 @@ export const aiSetupPrompt = deindent`
 
   ${aiAgentConfigPreparationPrompt}
 
+  ${appSetupPrompts}
+
   ${prodReadyPrompt}
 `;

package/src/ai/unified-prompts/skill-site-prompt.ts

@@ -13,7 +13,7 @@ export function buildSkillSitePrompt(docsIndexPromptValue = docsIndexPrompt) {
   return deindent`
     # Hexclave
 
-    This is the LLM-optimized documentation & skill site for Hexclave. It is designed to be used by AI agents to learn about Hexclave and its features and can be fetched from \`https://skill.hexclave.com\`.
+    This is the full LLM-optimized documentation & skill site for Hexclave. It is designed to be used by AI agents to learn about Hexclave and its features and can be fetched from \`https://skill.hexclave.com/full\`. For specific questions, prefer the concise answer endpoint at \`https://skill.hexclave.com/ask\` or the equivalent \`ask_hexclave\` MCP tool.
 
     ${remindersPrompt}
 

package/src/apps/apps-config.ts

@@ -38,11 +38,14 @@ export const ALL_APP_TAGS = {
   },
 } as const satisfies Record<string, AppTag>;
 
+type ParentAppId = "authentication" | "analytics";
+
 type App = {
   displayName: string,
   subtitle: string,
   tags: (keyof typeof ALL_APP_TAGS)[],
   stage: "alpha" | "beta" | "stable",
+  parentAppId?: ParentAppId,
 };
 
 export type AppId = keyof typeof ALL_APPS;
@@ -59,6 +62,7 @@ export const ALL_APPS = {
     subtitle: "Protect your project from fraud and abuse",
     tags: ["auth", "security"],
     stage: "stable",
+    parentAppId: "authentication",
   },
   "onboarding": {
     displayName: "Onboarding",
@@ -88,7 +92,7 @@ export const ALL_APPS = {
     displayName: "Payments",
     subtitle: "Payment processing and subscription management",
     tags: ["operations", "gtm"],
-    stage: "beta",
+    stage: "stable",
   },
   "emails": {
     displayName: "Emails",
@@ -172,12 +176,19 @@ export const ALL_APPS = {
     displayName: "Clickmaps",
     subtitle: "Visualize where users click across your app",
     tags: ["developers", "operations"],
-    stage: "alpha",
+    stage: "stable",
+    parentAppId: "analytics",
   },
   "session-replays": {
     displayName: "Session Replays",
     subtitle: "Watch real user sessions to understand how people use your app",
     tags: ["developers", "operations"],
     stage: "stable",
+    parentAppId: "analytics",
   },
 } as const satisfies Record<string, App>;
+
+export function getParentAppId(appId: AppId): AppId | null {
+  const app = ALL_APPS[appId];
+  return "parentAppId" in app ? app.parentAppId : null;
+}

package/src/config/schema-fuzzer.test.ts

@@ -216,6 +216,9 @@ const environmentSchemaFuzzerConfig = [{
         facebookConfigId: ["some-facebook-config-id"],
         microsoftTenantId: ["some-microsoft-tenant-id"],
         appleBundles: [{ "some-bundle-id": [{ bundleId: ["com.example.app"] }] }],
+        issuerUrl: [undefined, "https://accounts.google.com"] as (string | undefined)[],
+        scope: [undefined, "openid email profile"] as (string | undefined)[],
+        displayName: [undefined, "My OIDC Provider"] as (string | undefined)[],
       }]]))] as const,
     }],
   }],

package/src/config/schema.ts

@@ -11,7 +11,7 @@ import * as schemaFields from "../schema-fields";
 import { productSchema, userSpecifiedIdSchema, yupBoolean, yupDate, yupMixed, yupNever, yupNumber, yupObject, yupRecord, yupString, yupTuple, yupUnion } from "../schema-fields";
 import { SUPPORTED_CURRENCIES } from "../utils/currency-constants";
 import { HexclaveAssertionError } from "../utils/errors";
-import { allProviders } from "../utils/oauth";
+import { allProviders, allProviderTypes } from "../utils/oauth";
 import { DeepFilterUndefined, DeepMerge, DeepRequiredOrUndefined, filterUndefined, get, getOrUndefined, has, isObjectLike, mapValues, set, typedAssign, typedEntries, typedFromEntries } from "../utils/objects";
 import { Result } from "../utils/results";
 import { stringCompare } from "../utils/strings";
@@ -23,6 +23,7 @@ export const configLevels = ['project', 'branch', 'environment', 'organization']
 export type ConfigLevel = typeof configLevels[number];
 const permissionRegex = /^\$?[a-z0-9_:]+$/;
 const customPermissionRegex = /^[a-z0-9_:]+$/;
+const providerIdRegex = /^[a-z0-9_-]+$/;
 
 declare module "yup" {
   // eslint-disable-next-line @typescript-eslint/consistent-type-definitions
@@ -116,7 +117,7 @@ const branchAuthSchema = yupObject({
     providers: yupRecord(
       yupString().matches(permissionRegex),
       yupObject({
-        type: yupString().oneOf(allProviders).optional(),
+        type: yupString().oneOf(allProviderTypes).optional(),
         allowSignIn: yupBoolean(),
         allowConnectedAccounts: yupBoolean(),
       }),
@@ -376,9 +377,9 @@ export const environmentConfigSchema = branchConfigSchema.concat(yupObject({
   auth: branchConfigSchema.getNested("auth").concat(yupObject({
     oauth: branchConfigSchema.getNested("auth").getNested("oauth").concat(yupObject({
       providers: yupRecord(
-        yupString().matches(permissionRegex),
+        yupString().matches(providerIdRegex),
         yupObject({
-          type: yupString().oneOf(allProviders).optional(),
+          type: yupString().oneOf(allProviderTypes).optional(),
           isShared: yupBoolean(),
           clientId: schemaFields.oauthClientIdSchema.optional(),
           clientSecret: schemaFields.oauthClientSecretSchema.optional(),
@@ -395,6 +396,10 @@ export const environmentConfigSchema = branchConfigSchema.concat(yupObject({
               bundleId: schemaFields.oauthAppleBundleIdSchema,
             }),
           ).optional(),
+          // Custom OIDC provider fields (only used when type is "custom_oidc")
+          issuerUrl: schemaFields.oauthIssuerUrlSchema.optional(),
+          scope: schemaFields.oauthScopeSchema.optional(),
+          displayName: yupString().optional(),
           allowSignIn: yupBoolean().optional(),
           allowConnectedAccounts: yupBoolean().optional(),
         }),

package/src/interface/page-component-versions.ts

@@ -218,7 +218,7 @@ function createAuthPagePrompt(type: AuthPagePromptType): CustomPagePrompt {
                 <Typography>
                   {"Don't have an account? "}
                   <a
-                    href={hexclaveApp.urls.signUp}
+                    href="#"
                     onClick={async (e) => {
                       e.preventDefault();
                       await hexclaveApp.redirectToSignUp();
@@ -231,7 +231,7 @@ function createAuthPagePrompt(type: AuthPagePromptType): CustomPagePrompt {
             }` : `<Typography>
               {"Already have an account? "}
               <a
-                href={hexclaveApp.urls.signIn}
+                href="#"
                 onClick={async (e) => {
                   e.preventDefault();
                   await hexclaveApp.redirectToSignIn();
@@ -552,7 +552,15 @@ export function getCustomPagePrompts(): Record<PageComponentKey, CustomPagePromp
               <Typography type="h2">Reset Your Password</Typography>
               <Typography>
                 {"Don't need to reset? "}
-                <a href={hexclaveApp.urls.signIn}>Sign in</a>
+                <a
+                  href="#"
+                  onClick={async (e) => {
+                    e.preventDefault();
+                    await hexclaveApp.redirectToSignIn();
+                  }}
+                >
+                  Sign in
+                </a>
               </Typography>
 
               <form onSubmit={async (e) => {
@@ -618,7 +626,15 @@ export function getCustomPagePrompts(): Record<PageComponentKey, CustomPagePromp
               {showRedirectLink ? (
                 <Typography>
                   {"If you are not redirected automatically, "}
-                  <a href={hexclaveApp.urls.home}>click here</a>
+                  <a
+                    href="#"
+                    onClick={async (e) => {
+                      e.preventDefault();
+                      await hexclaveApp.redirectToHome();
+                    }}
+                  >
+                    click here
+                  </a>
                 </Typography>
               ) : null}
               {error ? <pre>{JSON.stringify(error, null, 2)}</pre> : null}

package/src/schema-fields.ts

@@ -605,6 +605,8 @@ export const oauthMicrosoftTenantIdSchema = yupString().meta({ openapiField: { d
 export const oauthAppleBundleIdsSchema = yupArray(yupString().defined()).meta({ openapiField: { description: 'Apple Bundle IDs for native iOS/macOS apps. Required for native Sign In with Apple (in addition to web Apple OAuth which uses the Client ID/Services ID).', exampleValue: ['com.example.ios', 'com.example.macos'] } });
 export const oauthAppleBundleIdSchema = yupString().defined().meta({ openapiField: { description: 'Apple Bundle ID for native iOS/macOS apps.', exampleValue: 'com.example.ios' } });
 export const oauthAccountMergeStrategySchema = yupString().oneOf(['link_method', 'raise_error', 'allow_duplicates']).meta({ openapiField: { description: 'Determines how to handle OAuth logins that match an existing user by email. `link_method` adds the OAuth method to the existing user. `raise_error` rejects the login with an error. `allow_duplicates` creates a new user.', exampleValue: 'link_method' } });
+export const oauthIssuerUrlSchema = urlSchema.meta({ openapiField: { description: 'OIDC issuer URL for custom OIDC providers. Must support OIDC discovery (/.well-known/openid-configuration). Only used when type is "custom_oidc".', exampleValue: 'https://accounts.google.com' } });
+export const oauthScopeSchema = yupString().meta({ openapiField: { description: 'Space-separated OAuth scopes to request from the custom OIDC provider. Defaults to "openid email profile" if not specified.', exampleValue: 'openid email profile' } });
 // Project email config
 export const emailTypeSchema = yupString().oneOf(['shared', 'standard']).meta({ openapiField: { description: 'Email provider type, one of shared, standard. "shared" uses Stack shared email provider and it is only meant for development. "standard" uses your own email server and will have your email address as the sender.', exampleValue: 'standard' } });
 export const emailSenderNameSchema = yupString().meta({ openapiField: { description: 'Email sender name. Needs to be specified when using type="standard"', exampleValue: 'Stack' } });

package/src/utils/oauth.tsx

@@ -4,6 +4,14 @@ export const sharedProviders = ["google", "github", "microsoft", "spotify"] as c
 export const allProviders = standardProviders;
 export const publishableClientKeyNotNecessarySentinel = "__stack_public_client__";
 
+/**
+ * All provider types including custom OIDC. Standard providers are the
+ * predefined set with first-class support; "custom_oidc" lets users bring
+ * any OIDC-compliant identity provider (team plan+ only).
+ */
+export const allProviderTypes = [...standardProviders, "custom_oidc"] as const;
+export type AllProviderType = typeof allProviderTypes[number];
+
 export type ProviderType = typeof allProviders[number];
 export type StandardProviderType = typeof standardProviders[number];
 export type SharedProviderType = typeof sharedProviders[number];