{"record":{"id":"87c66980372cff36","repo":"paperclipai/paperclip","slug":"authenticated-public-exposure-requires-auth-public","errorCode":null,"errorMessage":"authenticated public exposure requires auth.publicBaseUrl","messagePattern":"authenticated public exposure requires auth\\.publicBaseUrl","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/src/index.ts","lineNumber":666,"sourceCode":"  // A claimed warm-pool stack may restart while its provider environment still\n  // names the pool host. Restore the signed, durable identity before Better\n  // Auth, routes, or child-runtime configuration capture any public URL.\n  const restoredCloudRuntimeIdentity = await initializeCloudRuntimeIdentity(db as any);\n  if (restoredCloudRuntimeIdentity) config = loadConfig();\n\n  if (config.deploymentMode === \"local_trusted\" && !isLoopbackHost(config.host)) {\n    throw new Error(\n      `local_trusted mode requires loopback host binding (received: ${config.host}). ` +\n        \"Use authenticated mode for non-loopback deployments.\",\n    );\n  }\n  \n  if (config.deploymentMode === \"local_trusted\" && config.deploymentExposure !== \"private\") {\n    throw new Error(\"local_trusted mode only supports private exposure\");\n  }\n  \n  if (config.deploymentMode === \"authenticated\") {\n    if (config.authBaseUrlMode === \"explicit\" && !config.authPublicBaseUrl) {\n      throw new Error(\"auth.baseUrlMode=explicit requires auth.publicBaseUrl\");\n    }\n    if (config.deploymentExposure === \"public\") {\n      if (config.authBaseUrlMode !== \"explicit\") {\n        throw new Error(\"authenticated public exposure requires auth.baseUrlMode=explicit\");\n      }\n      if (!config.authPublicBaseUrl) {\n        throw new Error(\"authenticated public exposure requires auth.publicBaseUrl\");\n      }\n    }\n  }\n\n  const requestedListenPort = config.port;\n  const listenPort = await detectPort({\n    port: requestedListenPort,\n    hostname: config.host,\n  });\n  if (config.authBaseUrlMode === \"explicit\" && config.authPublicBaseUrl) {","sourceCodeStart":648,"sourceCodeEnd":684,"githubUrl":"https://github.com/paperclipai/paperclip/blob/3f1d897a7c018d76563a21c6e39c3c9b03933622/server/src/index.ts#L648-L684","documentation":"Config consistency check in startServer (authenticated mode branch): deploymentExposure is 'public' and baseUrlMode is 'explicit', but auth.publicBaseUrl is still unset. The public deployment has no URL to anchor auth redirects, so startup aborts until PAPERCLIP_PUBLIC_URL / publicBaseUrl is configured.","triggerScenarios":"Thrown at server/src/index.ts:538 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set auth.publicBaseUrl to the public URL of the instance.","Change exposure or auth mode if a public base URL is not available."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3f1d897a7c018d76563a21c6e39c3c9b03933622","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}