{"record":{"id":"87c66980372cff36","repo":"paperclipai/paperclip","slug":"authenticated-public-exposure-requires-auth-public","errorCode":null,"errorMessage":"authenticated public exposure requires auth.publicBaseUrl","messagePattern":"authenticated public exposure requires auth\\.publicBaseUrl","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/src/index.ts","lineNumber":657,"sourceCode":"  // A claimed warm-pool stack may restart while its provider environment still\n  // names the pool host. Restore the signed, durable identity before Better\n  // Auth, routes, or child-runtime configuration capture any public URL.\n  const restoredCloudRuntimeIdentity = await initializeCloudRuntimeIdentity(db as any);\n  if (restoredCloudRuntimeIdentity) config = loadConfig();\n\n  if (config.deploymentMode === \"local_trusted\" && !isLoopbackHost(config.host)) {\n    throw new Error(\n      `local_trusted mode requires loopback host binding (received: ${config.host}). ` +\n        \"Use authenticated mode for non-loopback deployments.\",\n    );\n  }\n  \n  if (config.deploymentMode === \"local_trusted\" && config.deploymentExposure !== \"private\") {\n    throw new Error(\"local_trusted mode only supports private exposure\");\n  }\n  \n  if (config.deploymentMode === \"authenticated\") {\n    if (config.authBaseUrlMode === \"explicit\" && !config.authPublicBaseUrl) {\n      throw new Error(\"auth.baseUrlMode=explicit requires auth.publicBaseUrl\");\n    }\n    if (config.deploymentExposure === \"public\") {\n      if (config.authBaseUrlMode !== \"explicit\") {\n        throw new Error(\"authenticated public exposure requires auth.baseUrlMode=explicit\");\n      }\n      if (!config.authPublicBaseUrl) {\n        throw new Error(\"authenticated public exposure requires auth.publicBaseUrl\");\n      }\n    }\n  }\n\n  const requestedListenPort = config.port;\n  const listenPort = await detectPort({\n    port: requestedListenPort,\n    hostname: config.host,\n  });\n  if (config.authBaseUrlMode === \"explicit\" && config.authPublicBaseUrl) {","sourceCodeStart":639,"sourceCodeEnd":675,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/index.ts#L639-L675","documentation":"Config consistency check in startServer (authenticated mode branch): deploymentExposure is 'public' and baseUrlMode is 'explicit', but auth.publicBaseUrl is still unset. The public deployment has no URL to anchor auth redirects, so startup aborts until PAPERCLIP_PUBLIC_URL / publicBaseUrl is configured.","triggerScenarios":"Thrown at server/src/index.ts:538 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set auth.publicBaseUrl to the public URL of the instance.","Change exposure or auth mode if a public base URL is not available."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}