@stackframe/tanstack-start 2.8.93 → 2.8.95

package/dist/lib/stack-app/apps/implementations/common.js

@@ -17,7 +17,7 @@ let _________env_js = require("../../../env.js");
 let ______url_targets_js = require("../../url-targets.js");
 
 //#region src/lib/stack-app/apps/implementations/common.ts
-const clientVersion = "js @stackframe/tanstack-start@2.8.93";
+const clientVersion = "js @stackframe/tanstack-start@2.8.95";
 if (clientVersion.startsWith("STACK_COMPILE_TIME")) throw new _stackframe_stack_shared_dist_utils_errors.StackAssertionError("Client version was not replaced. Something went wrong during build!");
 const replaceStackPortPrefix = (input) => {
 	if (!input) return input;

package/dist/lib/stack-app/url-targets.d.ts

@@ -1,7 +1,6 @@
 import { DefaultHandlerUrlTarget, HandlerUrlOptions, ResolvedHandlerUrls } from "./common.js";
 
 //#region src/lib/stack-app/url-targets.d.ts
-declare const getHostedHandlerDomainSuffix: () => string;
 declare const getHostedHandlerUrl: (options: {
   projectId: string;
   pagePath: string;
@@ -36,5 +35,5 @@ declare const isHostedHandlerUrlForProject: (options: {
   projectId: string;
 }) => boolean;
 //#endregion
-export { buildCliAuthConfirmUrl, getHostedHandlerDomainSuffix, getHostedHandlerUrl, getPagePrompt, isHostedHandlerUrlForProject, isLocalHandlerUrlTarget, resolveHandlerUrls, resolveUnknownHandlerPathFallbackUrl };
+export { buildCliAuthConfirmUrl, getHostedHandlerUrl, getPagePrompt, isHostedHandlerUrlForProject, isLocalHandlerUrlTarget, resolveHandlerUrls, resolveUnknownHandlerPathFallbackUrl };
 //# sourceMappingURL=url-targets.d.ts.map

package/dist/lib/stack-app/url-targets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url-targets.d.ts","names":[],"sources":["../../../src/lib/stack-app/url-targets.ts"],"mappings":";;;cAkGa,4BAAA;AAAA,cA4CA,mBAAA,GAAuB,OAAA;EAAW,SAAA;EAAmB,QAAA;AAAA;AAAA,cAiBrD,uBAAA,GAA2B,OAAA;EACtC,SAAA;EACA,WAAA;EACA,aAAA;AAAA;AAAA,cA8CW,kBAAA,GAAsB,OAAA;EAAW,IAAA,EAAM,iBAAA;EAA+B,SAAA;AAAA,MAAsB,mBAAA;AAAA,cAsI5F,sBAAA,GAA0B,OAAA;EACrC,iBAAA,UAxLW;EA0LX,MAAA;EACA,SAAA;AAAA;AAAA,cAOW,oCAAA,GAAwC,OAAA;EACnD,aAAA,EAAe,uBAAA;EACf,SAAA;EACA,WAAA;AAAA;AAAA,iBAoBc,aAAA,CAAc,QAAA,UAAkB,cAAA;EAA4B,KAAA;EAAe,UAAA;EAAoB,aAAA;EAA8B,aAAA;AAAA;AAAA,cAuBhI,4BAAA,GAAgC,OAAA;EAAW,GAAA;EAAa,SAAA;AAAA"}
+{"version":3,"file":"url-targets.d.ts","names":[],"sources":["../../../src/lib/stack-app/url-targets.ts"],"mappings":";;;cA2Ga,mBAAA,GAAuB,OAAA;EAAW,SAAA;EAAmB,QAAA;AAAA;AAAA,cAmBrD,uBAAA,GAA2B,OAAA;EACtC,SAAA;EACA,WAAA;EACA,aAAA;AAAA;AAAA,cA4DW,kBAAA,GAAsB,OAAA;EAAW,IAAA,EAAM,iBAAA;EAA+B,SAAA;AAAA,MAAsB,mBAAA;AAAA,cA4I5F,sBAAA,GAA0B,OAAA;EACrC,iBAAA,UA3MA;EA6MA,MAAA;EACA,SAAA;AAAA;AAAA,cAOW,oCAAA,GAAwC,OAAA;EACnD,aAAA,EAAe,uBAAA;EACf,SAAA;EACA,WAAA;AAAA;AAAA,iBAoBc,aAAA,CAAc,QAAA,UAAkB,cAAA;EAA4B,KAAA;EAAe,UAAA;EAAoB,aAAA;EAA8B,aAAA;AAAA;AAAA,cAuBhI,4BAAA,GAAgC,OAAA;EAAW,GAAA;EAAa,SAAA;AAAA"}

package/dist/lib/stack-app/url-targets.js

@@ -2,20 +2,13 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_chunk = require('../../chunk-BE-pF4vm.js');
 let _stackframe_stack_shared_dist_utils_errors = require("@stackframe/stack-shared/dist/utils/errors");
 let _stackframe_stack_shared_dist_interface_handler_urls = require("@stackframe/stack-shared/dist/interface/handler-urls");
+let _stackframe_stack_shared_dist_utils_redirect_urls = require("@stackframe/stack-shared/dist/utils/redirect-urls");
 let ___env_js = require("../env.js");
 
 //#region src/lib/stack-app/url-targets.ts
-const defaultHostedHandlerDomainSuffix = ".built-with-stack-auth.com";
-const hostedHandlerProjectIdPlaceholder = "{projectId}";
-const hostedHandlerPathPlaceholder = "{hostedPath}";
 const localUrlPlaceholderOrigin = "http://example.com";
 const schemePrefixRegex = /^[a-zA-Z][a-zA-Z\d+\-.]*:/;
 const customPagePrompts = (0, _stackframe_stack_shared_dist_interface_handler_urls.getCustomPagePrompts)();
-const replaceStackPortPrefix = (input) => {
-	if (!input) return input;
-	const prefix = ___env_js.envVars.NEXT_PUBLIC_STACK_PORT_PREFIX;
-	return prefix ? input.replace(/\$\{NEXT_PUBLIC_STACK_PORT_PREFIX:-81\}/g, prefix) : input;
-};
 const joinHandlerComponentPath = (basePath, pagePath) => {
 	const normalizedBasePath = basePath.endsWith("/") && basePath.length > 1 ? basePath.slice(0, -1) : basePath;
 	if (pagePath.length === 0) return normalizedBasePath;
@@ -45,25 +38,6 @@ const getHostedPagePathForHandlerName = (handlerName) => {
 		case "onboarding": return "onboarding";
 	}
 };
-const getHostedHandlerDomainSuffix = () => {
-	const domainSuffix = replaceStackPortPrefix(___env_js.envVars.NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX ?? defaultHostedHandlerDomainSuffix);
-	if (!domainSuffix.startsWith(".")) throw new _stackframe_stack_shared_dist_utils_errors.StackAssertionError("The hosted handler domain suffix must start with a dot.", {
-		domainSuffix,
-		hint: "Set NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX to a value like '.built-with-stack-auth.com'."
-	});
-	return domainSuffix;
-};
-const getHostedHandlerUrlTemplate = () => {
-	const configuredTemplate = replaceStackPortPrefix(___env_js.envVars.NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE);
-	if (configuredTemplate != null) {
-		if (!configuredTemplate.includes(hostedHandlerProjectIdPlaceholder) || !configuredTemplate.includes(hostedHandlerPathPlaceholder)) throw new _stackframe_stack_shared_dist_utils_errors.StackAssertionError("The hosted handler URL template must contain {projectId} and {hostedPath}.", {
-			hostedHandlerUrlTemplate: configuredTemplate,
-			hint: "Set NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE to a value like 'https://{projectId}.built-with-stack-auth.com/{hostedPath}'."
-		});
-		return configuredTemplate;
-	}
-	return `https://${hostedHandlerProjectIdPlaceholder}${getHostedHandlerDomainSuffix()}/${hostedHandlerPathPlaceholder}`;
-};
 const resolveCustomTargetUrl = (options) => {
 	const handlerName = options.handlerName;
 	if (handlerName in customPagePrompts) {
@@ -75,8 +49,13 @@ const resolveCustomTargetUrl = (options) => {
 const getHostedHandlerUrl = (options) => {
 	const normalizedPagePath = options.pagePath.replace(/^\/+/, "");
 	const hostedPath = normalizedPagePath.length > 0 ? `handler/${normalizedPagePath}` : "handler";
-	const templateFilled = getHostedHandlerUrlTemplate().replaceAll(hostedHandlerProjectIdPlaceholder, options.projectId).replaceAll(hostedHandlerPathPlaceholder, hostedPath);
-	return new URL(templateFilled).toString();
+	return (0, _stackframe_stack_shared_dist_utils_redirect_urls.getHostedHandlerUrlFromConfig)({
+		projectId: options.projectId,
+		hostedPath,
+		hostedHandlerDomainSuffix: ___env_js.envVars.NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX,
+		hostedHandlerUrlTemplate: ___env_js.envVars.NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE,
+		stackPortPrefix: ___env_js.envVars.NEXT_PUBLIC_STACK_PORT_PREFIX
+	});
 };
 const isRelativeUrlString = (url) => {
 	if (url.startsWith("//")) return false;
@@ -102,9 +81,18 @@ const resolveUrlTarget = (options) => {
 		});
 	}
 };
+const assertOAuthCallbackTargetIsRelative = (target) => {
+	const url = typeof target === "string" ? target : target.type === "custom" ? target.url : null;
+	if (url != null && !isRelativeUrlString(url)) throw new _stackframe_stack_shared_dist_utils_errors.StackAssertionError("OAuth callback URLs must be relative.", {
+		oauthCallbackUrl: url,
+		hint: "Use a relative URL like '/handler/oauth-callback', or use { type: 'hosted' } to let Stack use the current page for hosted callbacks."
+	});
+};
 const resolveHandlerUrls = (options) => {
 	const configuredUrls = options.urls;
 	const defaultTarget = configuredUrls?.default ?? { type: "handler-component" };
+	const oauthCallbackTarget = configuredUrls?.oauthCallback ?? (typeof defaultTarget !== "string" && defaultTarget.type === "hosted" ? defaultTarget : { type: "handler-component" });
+	assertOAuthCallbackTargetIsRelative(oauthCallbackTarget);
 	let handlerComponentBasePath = "/handler";
 	if (typeof configuredUrls?.handler === "string") handlerComponentBasePath = configuredUrls.handler;
 	else if (configuredUrls?.handler != null && configuredUrls.handler.type === "custom") handlerComponentBasePath = resolveCustomTargetUrl({
@@ -181,7 +169,7 @@ const resolveHandlerUrls = (options) => {
 		}),
 		home,
 		oauthCallback: resolveUrlTarget({
-			target: configuredUrls?.oauthCallback ?? defaultTarget,
+			target: oauthCallbackTarget,
 			fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, "oauth-callback"),
 			handlerName: "oauthCallback",
 			projectId: options.projectId
@@ -279,7 +267,6 @@ const isHostedHandlerUrlForProject = (options) => {
 
 //#endregion
 exports.buildCliAuthConfirmUrl = buildCliAuthConfirmUrl;
-exports.getHostedHandlerDomainSuffix = getHostedHandlerDomainSuffix;
 exports.getHostedHandlerUrl = getHostedHandlerUrl;
 exports.getPagePrompt = getPagePrompt;
 exports.isHostedHandlerUrlForProject = isHostedHandlerUrlForProject;

package/dist/lib/stack-app/url-targets.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-targets.js","names":["envVars","StackAssertionError"],"sources":["../../../src/lib/stack-app/url-targets.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { getCustomPagePrompts, type CustomPagePrompt } from \"@stackframe/stack-shared/dist/interface/handler-urls\";\nimport { StackAssertionError } from \"@stackframe/stack-shared/dist/utils/errors\";\nimport { envVars } from \"../env\";\nimport { DefaultHandlerUrlTarget, HandlerPageUrls, HandlerUrlOptions, HandlerUrlTarget, HandlerUrls, ResolvedHandlerUrls } from \"./common\";\n\nconst defaultHostedHandlerDomainSuffix = \".built-with-stack-auth.com\";\nconst hostedHandlerProjectIdPlaceholder = \"{projectId}\";\nconst hostedHandlerPathPlaceholder = \"{hostedPath}\";\nconst localUrlPlaceholderOrigin = \"http://example.com\";\nconst schemePrefixRegex = /^[a-zA-Z][a-zA-Z\\d+\\-.]*:/;\n\nconst customPagePrompts: Record<keyof Omit<HandlerPageUrls, \"handler\">, CustomPagePrompt> = getCustomPagePrompts();\n\nconst replaceStackPortPrefix = <T extends string | undefined>(input: T): T => {\n  if (!input) return input;\n  const prefix = envVars.NEXT_PUBLIC_STACK_PORT_PREFIX;\n  return prefix ? input.replace(/\\$\\{NEXT_PUBLIC_STACK_PORT_PREFIX:-81\\}/g, prefix) as T : input;\n};\n\nconst joinHandlerComponentPath = (basePath: string, pagePath: string): string => {\n  const normalizedBasePath = basePath.endsWith(\"/\") && basePath.length > 1\n    ? basePath.slice(0, -1)\n    : basePath;\n  if (pagePath.length === 0) {\n    return normalizedBasePath;\n  }\n  if (normalizedBasePath === \"/\") {\n    return `/${pagePath}`;\n  }\n  return `${normalizedBasePath}/${pagePath}`;\n};\n\nconst getHostedPagePathForHandlerName = (handlerName: keyof HandlerUrls): string => {\n  switch (handlerName) {\n    case \"handler\": {\n      return \"\";\n    }\n    case \"home\": {\n      return \"\";\n    }\n    case \"afterSignIn\": {\n      return \"\";\n    }\n    case \"afterSignUp\": {\n      return \"\";\n    }\n    case \"afterSignOut\": {\n      return \"\";\n    }\n    case \"signIn\": {\n      return \"sign-in\";\n    }\n    case \"signUp\": {\n      return \"sign-up\";\n    }\n    case \"signOut\": {\n      return \"sign-out\";\n    }\n    case \"emailVerification\": {\n      return \"email-verification\";\n    }\n    case \"passwordReset\": {\n      return \"password-reset\";\n    }\n    case \"forgotPassword\": {\n      return \"forgot-password\";\n    }\n    case \"oauthCallback\": {\n      return \"oauth-callback\";\n    }\n    case \"magicLinkCallback\": {\n      return \"magic-link-callback\";\n    }\n    case \"accountSettings\": {\n      return \"account-settings\";\n    }\n    case \"teamInvitation\": {\n      return \"team-invitation\";\n    }\n    case \"cliAuthConfirm\": {\n      return \"cli-auth-confirm\";\n    }\n    case \"mfa\": {\n      return \"mfa\";\n    }\n    case \"error\": {\n      return \"error\";\n    }\n    case \"onboarding\": {\n      return \"onboarding\";\n    }\n  }\n};\n\nexport const getHostedHandlerDomainSuffix = (): string => {\n  const configuredValue = envVars.NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX\n    ?? defaultHostedHandlerDomainSuffix;\n  const domainSuffix = replaceStackPortPrefix(configuredValue);\n  if (!domainSuffix.startsWith(\".\")) {\n    throw new StackAssertionError(\"The hosted handler domain suffix must start with a dot.\", {\n      domainSuffix,\n      hint: \"Set NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX to a value like '.built-with-stack-auth.com'.\",\n    });\n  }\n  return domainSuffix;\n};\n\nconst getHostedHandlerUrlTemplate = (): string => {\n  const configuredTemplate = replaceStackPortPrefix(envVars.NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE);\n  if (configuredTemplate != null) {\n    if (!configuredTemplate.includes(hostedHandlerProjectIdPlaceholder) || !configuredTemplate.includes(hostedHandlerPathPlaceholder)) {\n      throw new StackAssertionError(\"The hosted handler URL template must contain {projectId} and {hostedPath}.\", {\n        hostedHandlerUrlTemplate: configuredTemplate,\n        hint: \"Set NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE to a value like 'https://{projectId}.built-with-stack-auth.com/{hostedPath}'.\",\n      });\n    }\n    return configuredTemplate;\n  }\n  return `https://${hostedHandlerProjectIdPlaceholder}${getHostedHandlerDomainSuffix()}/${hostedHandlerPathPlaceholder}`;\n};\n\nconst resolveCustomTargetUrl = (options: {\n  target: { type: \"custom\", url: string, version: number },\n  handlerName: keyof HandlerUrls,\n}): string => {\n  const handlerName = options.handlerName;\n  if (handlerName in customPagePrompts) {\n    const customPagePrompt = customPagePrompts[handlerName as keyof typeof customPagePrompts];\n    if (options.target.version === 0 || options.target.version in customPagePrompt.versions) {\n      return options.target.url;\n    }\n\n    throw new Error(`Unsupported custom page version ${options.target.version} for ${options.handlerName} page at ${options.target.url}. The latest supported version of this page is ${Math.max(0, ...Object.keys(customPagePrompt.versions).map(Number))}. Please upgrade your Stack Auth SDK to a version that supports this version.`);\n  } else {\n    throw new Error(`URL target ${options.handlerName} cannot be a custom page. Please specify the URL as a string instead.`);\n  }\n};\n\nexport const getHostedHandlerUrl = (options: { projectId: string, pagePath: string }): string => {\n  const normalizedPagePath = options.pagePath.replace(/^\\/+/, \"\");\n  const hostedPath = normalizedPagePath.length > 0 ? `handler/${normalizedPagePath}` : \"handler\";\n  const template = getHostedHandlerUrlTemplate();\n  const templateFilled = template\n    .replaceAll(hostedHandlerProjectIdPlaceholder, options.projectId)\n    .replaceAll(hostedHandlerPathPlaceholder, hostedPath);\n  return new URL(templateFilled).toString();\n};\n\nconst isRelativeUrlString = (url: string): boolean => {\n  if (url.startsWith(\"//\")) {\n    return false;\n  }\n  return !schemePrefixRegex.test(url);\n};\n\nexport const isLocalHandlerUrlTarget = (options: {\n  targetUrl: string,\n  handlerPath: string,\n  currentOrigin?: string,\n}): boolean => {\n  const urlObject = new URL(options.targetUrl, localUrlPlaceholderOrigin);\n  const isHandlerPathTarget = urlObject.pathname === options.handlerPath\n    || urlObject.pathname.startsWith(`${options.handlerPath}/`);\n  if (!isHandlerPathTarget) {\n    return false;\n  }\n\n  // On server we only have path information, so treat matching handler paths as local.\n  if (options.currentOrigin == null) {\n    return true;\n  }\n\n  return isRelativeUrlString(options.targetUrl) || urlObject.origin === options.currentOrigin;\n};\n\nconst resolveUrlTarget = (options: {\n  target: HandlerUrlTarget,\n  fallbackPath: string,\n  handlerName: keyof HandlerUrls,\n  projectId: string,\n}): string => {\n  if (typeof options.target === \"string\") {\n    return options.target;\n  }\n\n  switch (options.target.type) {\n    case \"handler-component\": {\n      return options.fallbackPath;\n    }\n    case \"hosted\": {\n      return getHostedHandlerUrl({\n        projectId: options.projectId,\n        pagePath: getHostedPagePathForHandlerName(options.handlerName),\n      });\n    }\n    case \"custom\": {\n      return resolveCustomTargetUrl({\n        target: options.target,\n        handlerName: options.handlerName,\n      });\n    }\n  }\n};\n\nexport const resolveHandlerUrls = (options: { urls: HandlerUrlOptions | undefined, projectId: string }): ResolvedHandlerUrls => {\n  const configuredUrls = options.urls;\n  const defaultTarget: HandlerUrlTarget = configuredUrls?.default ?? { type: \"handler-component\" };\n  let handlerComponentBasePath = \"/handler\";\n  if (typeof configuredUrls?.handler === \"string\") {\n    handlerComponentBasePath = configuredUrls.handler;\n  } else if (configuredUrls?.handler != null && configuredUrls.handler.type === \"custom\") {\n    handlerComponentBasePath = resolveCustomTargetUrl({\n      target: configuredUrls.handler,\n      handlerName: \"handler\",\n    });\n  }\n\n  const home = resolveUrlTarget({\n    target: configuredUrls?.home ?? defaultTarget,\n    fallbackPath: \"/\",\n    handlerName: \"home\",\n    projectId: options.projectId,\n  });\n  const afterSignIn = resolveUrlTarget({\n    target: configuredUrls?.afterSignIn ?? defaultTarget,\n    fallbackPath: home,\n    handlerName: \"afterSignIn\",\n    projectId: options.projectId,\n  });\n\n  return {\n    handler: resolveUrlTarget({\n      target: configuredUrls?.handler ?? defaultTarget,\n      fallbackPath: handlerComponentBasePath,\n      handlerName: \"handler\",\n      projectId: options.projectId,\n    }),\n    signIn: resolveUrlTarget({\n      target: configuredUrls?.signIn ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"sign-in\"),\n      handlerName: \"signIn\",\n      projectId: options.projectId,\n    }),\n    signUp: resolveUrlTarget({\n      target: configuredUrls?.signUp ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"sign-up\"),\n      handlerName: \"signUp\",\n      projectId: options.projectId,\n    }),\n    afterSignIn,\n    afterSignUp: resolveUrlTarget({\n      target: configuredUrls?.afterSignUp ?? defaultTarget,\n      fallbackPath: afterSignIn,\n      handlerName: \"afterSignUp\",\n      projectId: options.projectId,\n    }),\n    signOut: resolveUrlTarget({\n      target: configuredUrls?.signOut ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"sign-out\"),\n      handlerName: \"signOut\",\n      projectId: options.projectId,\n    }),\n    afterSignOut: resolveUrlTarget({\n      target: configuredUrls?.afterSignOut ?? defaultTarget,\n      fallbackPath: home,\n      handlerName: \"afterSignOut\",\n      projectId: options.projectId,\n    }),\n    emailVerification: resolveUrlTarget({\n      target: configuredUrls?.emailVerification ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"email-verification\"),\n      handlerName: \"emailVerification\",\n      projectId: options.projectId,\n    }),\n    passwordReset: resolveUrlTarget({\n      target: configuredUrls?.passwordReset ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"password-reset\"),\n      handlerName: \"passwordReset\",\n      projectId: options.projectId,\n    }),\n    forgotPassword: resolveUrlTarget({\n      target: configuredUrls?.forgotPassword ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"forgot-password\"),\n      handlerName: \"forgotPassword\",\n      projectId: options.projectId,\n    }),\n    home,\n    oauthCallback: resolveUrlTarget({\n      target: configuredUrls?.oauthCallback ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"oauth-callback\"),\n      handlerName: \"oauthCallback\",\n      projectId: options.projectId,\n    }),\n    magicLinkCallback: resolveUrlTarget({\n      target: configuredUrls?.magicLinkCallback ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"magic-link-callback\"),\n      handlerName: \"magicLinkCallback\",\n      projectId: options.projectId,\n    }),\n    accountSettings: resolveUrlTarget({\n      target: configuredUrls?.accountSettings ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"account-settings\"),\n      handlerName: \"accountSettings\",\n      projectId: options.projectId,\n    }),\n    teamInvitation: resolveUrlTarget({\n      target: configuredUrls?.teamInvitation ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"team-invitation\"),\n      handlerName: \"teamInvitation\",\n      projectId: options.projectId,\n    }),\n    cliAuthConfirm: resolveUrlTarget({\n      target: configuredUrls?.cliAuthConfirm ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"cli-auth-confirm\"),\n      handlerName: \"cliAuthConfirm\",\n      projectId: options.projectId,\n    }),\n    mfa: resolveUrlTarget({\n      target: configuredUrls?.mfa ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"mfa\"),\n      handlerName: \"mfa\",\n      projectId: options.projectId,\n    }),\n    error: resolveUrlTarget({\n      target: configuredUrls?.error ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"error\"),\n      handlerName: \"error\",\n      projectId: options.projectId,\n    }),\n    onboarding: resolveUrlTarget({\n      target: configuredUrls?.onboarding ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"onboarding\"),\n      handlerName: \"onboarding\",\n      projectId: options.projectId,\n    }),\n  };\n};\n\nexport const buildCliAuthConfirmUrl = (options: {\n  cliAuthConfirmUrl: string,\n  /** Used as the base URL only when cliAuthConfirmUrl is relative. */\n  appUrl: string,\n  loginCode: string,\n}): string => {\n  const url = new URL(options.cliAuthConfirmUrl, options.appUrl);\n  url.searchParams.set(\"login_code\", options.loginCode);\n  return url.toString();\n};\n\nexport const resolveUnknownHandlerPathFallbackUrl = (options: {\n  defaultTarget: DefaultHandlerUrlTarget | undefined,\n  projectId: string,\n  unknownPath: string,\n}): string | null => {\n  const defaultTarget = options.defaultTarget ?? { type: \"handler-component\" } satisfies HandlerUrlTarget;\n  if (typeof defaultTarget === \"string\") {\n    return defaultTarget;\n  }\n\n  switch (defaultTarget.type) {\n    case \"handler-component\": {\n      return null;\n    }\n    case \"hosted\": {\n      return getHostedHandlerUrl({\n        projectId: options.projectId,\n        pagePath: options.unknownPath,\n      });\n    }\n  }\n};\n\nexport function getPagePrompt(pageName: string, currentVersion?: number): { title: string; fullPrompt: string; upgradePrompt: string | null; latestVersion: number } | null {\n  if (!(pageName in customPagePrompts)) return null;\n  const prompt = customPagePrompts[pageName as keyof typeof customPagePrompts];\n  const versionKeys = Object.keys(prompt.versions).map(Number);\n  const latestVersion = versionKeys.length > 0 ? Math.max(...versionKeys) : 0;\n\n  let upgradePrompt: string | null = null;\n  if (currentVersion != null) {\n    const relevantVersions = versionKeys\n      .filter(v => v > currentVersion)\n      .sort((a, b) => a - b);\n    const prompts = relevantVersions\n      .map(v => prompt.versions[v].upgradePrompt)\n      .filter(p => p.length > 0);\n    upgradePrompt = prompts.length > 0 ? prompts.join(\"\\n\\n\") : null;\n  } else {\n    const upgradeEntry = latestVersion > 0 ? prompt.versions[latestVersion] : undefined;\n    upgradePrompt = upgradeEntry?.upgradePrompt ?? null;\n  }\n\n  return { title: prompt.title, fullPrompt: prompt.fullPrompt, upgradePrompt, latestVersion };\n}\n\nexport const isHostedHandlerUrlForProject = (options: { url: string, projectId: string }): boolean => {\n  let parsedUrl: URL;\n  try {\n    parsedUrl = new URL(options.url);\n  } catch {\n    return false;\n  }\n\n  const hostedBaseUrl = new URL(getHostedHandlerUrl({ projectId: options.projectId, pagePath: \"\" }));\n  return parsedUrl.origin === hostedBaseUrl.origin\n    && (parsedUrl.pathname === hostedBaseUrl.pathname || parsedUrl.pathname.startsWith(`${hostedBaseUrl.pathname}/`));\n};\n"],"mappings":";;;;;;;AASA,MAAM,mCAAmC;AACzC,MAAM,oCAAoC;AAC1C,MAAM,+BAA+B;AACrC,MAAM,4BAA4B;AAClC,MAAM,oBAAoB;AAE1B,MAAM,oGAA4G;AAElH,MAAM,0BAAwD,UAAgB;AAC5E,KAAI,CAAC,MAAO,QAAO;CACnB,MAAM,SAASA,kBAAQ;AACvB,QAAO,SAAS,MAAM,QAAQ,4CAA4C,OAAO,GAAQ;;AAG3F,MAAM,4BAA4B,UAAkB,aAA6B;CAC/E,MAAM,qBAAqB,SAAS,SAAS,IAAI,IAAI,SAAS,SAAS,IACnE,SAAS,MAAM,GAAG,GAAG,GACrB;AACJ,KAAI,SAAS,WAAW,EACtB,QAAO;AAET,KAAI,uBAAuB,IACzB,QAAO,IAAI;AAEb,QAAO,GAAG,mBAAmB,GAAG;;AAGlC,MAAM,mCAAmC,gBAA2C;AAClF,SAAQ,aAAR;EACE,KAAK,UACH,QAAO;EAET,KAAK,OACH,QAAO;EAET,KAAK,cACH,QAAO;EAET,KAAK,cACH,QAAO;EAET,KAAK,eACH,QAAO;EAET,KAAK,SACH,QAAO;EAET,KAAK,SACH,QAAO;EAET,KAAK,UACH,QAAO;EAET,KAAK,oBACH,QAAO;EAET,KAAK,gBACH,QAAO;EAET,KAAK,iBACH,QAAO;EAET,KAAK,gBACH,QAAO;EAET,KAAK,oBACH,QAAO;EAET,KAAK,kBACH,QAAO;EAET,KAAK,iBACH,QAAO;EAET,KAAK,iBACH,QAAO;EAET,KAAK,MACH,QAAO;EAET,KAAK,QACH,QAAO;EAET,KAAK,aACH,QAAO;;;AAKb,MAAa,qCAA6C;CAGxD,MAAM,eAAe,uBAFGA,kBAAQ,kDAC3B,iCACuD;AAC5D,KAAI,CAAC,aAAa,WAAW,IAAI,CAC/B,OAAM,IAAIC,+DAAoB,2DAA2D;EACvF;EACA,MAAM;EACP,CAAC;AAEJ,QAAO;;AAGT,MAAM,oCAA4C;CAChD,MAAM,qBAAqB,uBAAuBD,kBAAQ,8CAA8C;AACxG,KAAI,sBAAsB,MAAM;AAC9B,MAAI,CAAC,mBAAmB,SAAS,kCAAkC,IAAI,CAAC,mBAAmB,SAAS,6BAA6B,CAC/H,OAAM,IAAIC,+DAAoB,8EAA8E;GAC1G,0BAA0B;GAC1B,MAAM;GACP,CAAC;AAEJ,SAAO;;AAET,QAAO,WAAW,oCAAoC,8BAA8B,CAAC,GAAG;;AAG1F,MAAM,0BAA0B,YAGlB;CACZ,MAAM,cAAc,QAAQ;AAC5B,KAAI,eAAe,mBAAmB;EACpC,MAAM,mBAAmB,kBAAkB;AAC3C,MAAI,QAAQ,OAAO,YAAY,KAAK,QAAQ,OAAO,WAAW,iBAAiB,SAC7E,QAAO,QAAQ,OAAO;AAGxB,QAAM,IAAI,MAAM,mCAAmC,QAAQ,OAAO,QAAQ,OAAO,QAAQ,YAAY,WAAW,QAAQ,OAAO,IAAI,iDAAiD,KAAK,IAAI,GAAG,GAAG,OAAO,KAAK,iBAAiB,SAAS,CAAC,IAAI,OAAO,CAAC,CAAC,+EAA+E;OAEtU,OAAM,IAAI,MAAM,cAAc,QAAQ,YAAY,uEAAuE;;AAI7H,MAAa,uBAAuB,YAA6D;CAC/F,MAAM,qBAAqB,QAAQ,SAAS,QAAQ,QAAQ,GAAG;CAC/D,MAAM,aAAa,mBAAmB,SAAS,IAAI,WAAW,uBAAuB;CAErF,MAAM,iBADW,6BAA6B,CAE3C,WAAW,mCAAmC,QAAQ,UAAU,CAChE,WAAW,8BAA8B,WAAW;AACvD,QAAO,IAAI,IAAI,eAAe,CAAC,UAAU;;AAG3C,MAAM,uBAAuB,QAAyB;AACpD,KAAI,IAAI,WAAW,KAAK,CACtB,QAAO;AAET,QAAO,CAAC,kBAAkB,KAAK,IAAI;;AAGrC,MAAa,2BAA2B,YAIzB;CACb,MAAM,YAAY,IAAI,IAAI,QAAQ,WAAW,0BAA0B;AAGvE,KAAI,EAFwB,UAAU,aAAa,QAAQ,eACtD,UAAU,SAAS,WAAW,GAAG,QAAQ,YAAY,GAAG,EAE3D,QAAO;AAIT,KAAI,QAAQ,iBAAiB,KAC3B,QAAO;AAGT,QAAO,oBAAoB,QAAQ,UAAU,IAAI,UAAU,WAAW,QAAQ;;AAGhF,MAAM,oBAAoB,YAKZ;AACZ,KAAI,OAAO,QAAQ,WAAW,SAC5B,QAAO,QAAQ;AAGjB,SAAQ,QAAQ,OAAO,MAAvB;EACE,KAAK,oBACH,QAAO,QAAQ;EAEjB,KAAK,SACH,QAAO,oBAAoB;GACzB,WAAW,QAAQ;GACnB,UAAU,gCAAgC,QAAQ,YAAY;GAC/D,CAAC;EAEJ,KAAK,SACH,QAAO,uBAAuB;GAC5B,QAAQ,QAAQ;GAChB,aAAa,QAAQ;GACtB,CAAC;;;AAKR,MAAa,sBAAsB,YAA6F;CAC9H,MAAM,iBAAiB,QAAQ;CAC/B,MAAM,gBAAkC,gBAAgB,WAAW,EAAE,MAAM,qBAAqB;CAChG,IAAI,2BAA2B;AAC/B,KAAI,OAAO,gBAAgB,YAAY,SACrC,4BAA2B,eAAe;UACjC,gBAAgB,WAAW,QAAQ,eAAe,QAAQ,SAAS,SAC5E,4BAA2B,uBAAuB;EAChD,QAAQ,eAAe;EACvB,aAAa;EACd,CAAC;CAGJ,MAAM,OAAO,iBAAiB;EAC5B,QAAQ,gBAAgB,QAAQ;EAChC,cAAc;EACd,aAAa;EACb,WAAW,QAAQ;EACpB,CAAC;CACF,MAAM,cAAc,iBAAiB;EACnC,QAAQ,gBAAgB,eAAe;EACvC,cAAc;EACd,aAAa;EACb,WAAW,QAAQ;EACpB,CAAC;AAEF,QAAO;EACL,SAAS,iBAAiB;GACxB,QAAQ,gBAAgB,WAAW;GACnC,cAAc;GACd,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,QAAQ,iBAAiB;GACvB,QAAQ,gBAAgB,UAAU;GAClC,cAAc,yBAAyB,0BAA0B,UAAU;GAC3E,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,QAAQ,iBAAiB;GACvB,QAAQ,gBAAgB,UAAU;GAClC,cAAc,yBAAyB,0BAA0B,UAAU;GAC3E,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF;EACA,aAAa,iBAAiB;GAC5B,QAAQ,gBAAgB,eAAe;GACvC,cAAc;GACd,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,SAAS,iBAAiB;GACxB,QAAQ,gBAAgB,WAAW;GACnC,cAAc,yBAAyB,0BAA0B,WAAW;GAC5E,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,cAAc,iBAAiB;GAC7B,QAAQ,gBAAgB,gBAAgB;GACxC,cAAc;GACd,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,mBAAmB,iBAAiB;GAClC,QAAQ,gBAAgB,qBAAqB;GAC7C,cAAc,yBAAyB,0BAA0B,qBAAqB;GACtF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,eAAe,iBAAiB;GAC9B,QAAQ,gBAAgB,iBAAiB;GACzC,cAAc,yBAAyB,0BAA0B,iBAAiB;GAClF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,gBAAgB,iBAAiB;GAC/B,QAAQ,gBAAgB,kBAAkB;GAC1C,cAAc,yBAAyB,0BAA0B,kBAAkB;GACnF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF;EACA,eAAe,iBAAiB;GAC9B,QAAQ,gBAAgB,iBAAiB;GACzC,cAAc,yBAAyB,0BAA0B,iBAAiB;GAClF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,mBAAmB,iBAAiB;GAClC,QAAQ,gBAAgB,qBAAqB;GAC7C,cAAc,yBAAyB,0BAA0B,sBAAsB;GACvF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,iBAAiB,iBAAiB;GAChC,QAAQ,gBAAgB,mBAAmB;GAC3C,cAAc,yBAAyB,0BAA0B,mBAAmB;GACpF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,gBAAgB,iBAAiB;GAC/B,QAAQ,gBAAgB,kBAAkB;GAC1C,cAAc,yBAAyB,0BAA0B,kBAAkB;GACnF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,gBAAgB,iBAAiB;GAC/B,QAAQ,gBAAgB,kBAAkB;GAC1C,cAAc,yBAAyB,0BAA0B,mBAAmB;GACpF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,KAAK,iBAAiB;GACpB,QAAQ,gBAAgB,OAAO;GAC/B,cAAc,yBAAyB,0BAA0B,MAAM;GACvE,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,OAAO,iBAAiB;GACtB,QAAQ,gBAAgB,SAAS;GACjC,cAAc,yBAAyB,0BAA0B,QAAQ;GACzE,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,YAAY,iBAAiB;GAC3B,QAAQ,gBAAgB,cAAc;GACtC,cAAc,yBAAyB,0BAA0B,aAAa;GAC9E,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACH;;AAGH,MAAa,0BAA0B,YAKzB;CACZ,MAAM,MAAM,IAAI,IAAI,QAAQ,mBAAmB,QAAQ,OAAO;AAC9D,KAAI,aAAa,IAAI,cAAc,QAAQ,UAAU;AACrD,QAAO,IAAI,UAAU;;AAGvB,MAAa,wCAAwC,YAIhC;CACnB,MAAM,gBAAgB,QAAQ,iBAAiB,EAAE,MAAM,qBAAqB;AAC5E,KAAI,OAAO,kBAAkB,SAC3B,QAAO;AAGT,SAAQ,cAAc,MAAtB;EACE,KAAK,oBACH,QAAO;EAET,KAAK,SACH,QAAO,oBAAoB;GACzB,WAAW,QAAQ;GACnB,UAAU,QAAQ;GACnB,CAAC;;;AAKR,SAAgB,cAAc,UAAkB,gBAA4H;AAC1K,KAAI,EAAE,YAAY,mBAAoB,QAAO;CAC7C,MAAM,SAAS,kBAAkB;CACjC,MAAM,cAAc,OAAO,KAAK,OAAO,SAAS,CAAC,IAAI,OAAO;CAC5D,MAAM,gBAAgB,YAAY,SAAS,IAAI,KAAK,IAAI,GAAG,YAAY,GAAG;CAE1E,IAAI,gBAA+B;AACnC,KAAI,kBAAkB,MAAM;EAI1B,MAAM,UAHmB,YACtB,QAAO,MAAK,IAAI,eAAe,CAC/B,MAAM,GAAG,MAAM,IAAI,EAAE,CAErB,KAAI,MAAK,OAAO,SAAS,GAAG,cAAc,CAC1C,QAAO,MAAK,EAAE,SAAS,EAAE;AAC5B,kBAAgB,QAAQ,SAAS,IAAI,QAAQ,KAAK,OAAO,GAAG;OAG5D,kBADqB,gBAAgB,IAAI,OAAO,SAAS,iBAAiB,SAC5C,iBAAiB;AAGjD,QAAO;EAAE,OAAO,OAAO;EAAO,YAAY,OAAO;EAAY;EAAe;EAAe;;AAG7F,MAAa,gCAAgC,YAAyD;CACpG,IAAI;AACJ,KAAI;AACF,cAAY,IAAI,IAAI,QAAQ,IAAI;SAC1B;AACN,SAAO;;CAGT,MAAM,gBAAgB,IAAI,IAAI,oBAAoB;EAAE,WAAW,QAAQ;EAAW,UAAU;EAAI,CAAC,CAAC;AAClG,QAAO,UAAU,WAAW,cAAc,WACpC,UAAU,aAAa,cAAc,YAAY,UAAU,SAAS,WAAW,GAAG,cAAc,SAAS,GAAG"}
+{"version":3,"file":"url-targets.js","names":["envVars","StackAssertionError"],"sources":["../../../src/lib/stack-app/url-targets.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { getCustomPagePrompts, type CustomPagePrompt } from \"@stackframe/stack-shared/dist/interface/handler-urls\";\nimport { StackAssertionError } from \"@stackframe/stack-shared/dist/utils/errors\";\nimport { getHostedHandlerUrlFromConfig } from \"@stackframe/stack-shared/dist/utils/redirect-urls\";\nimport { envVars } from \"../env\";\nimport { DefaultHandlerUrlTarget, HandlerPageUrls, HandlerUrlOptions, HandlerUrlTarget, HandlerUrls, ResolvedHandlerUrls } from \"./common\";\n\nconst localUrlPlaceholderOrigin = \"http://example.com\";\nconst schemePrefixRegex = /^[a-zA-Z][a-zA-Z\\d+\\-.]*:/;\n\nconst customPagePrompts: Record<keyof Omit<HandlerPageUrls, \"handler\">, CustomPagePrompt> = getCustomPagePrompts();\n\nconst joinHandlerComponentPath = (basePath: string, pagePath: string): string => {\n  const normalizedBasePath = basePath.endsWith(\"/\") && basePath.length > 1\n    ? basePath.slice(0, -1)\n    : basePath;\n  if (pagePath.length === 0) {\n    return normalizedBasePath;\n  }\n  if (normalizedBasePath === \"/\") {\n    return `/${pagePath}`;\n  }\n  return `${normalizedBasePath}/${pagePath}`;\n};\n\nconst getHostedPagePathForHandlerName = (handlerName: keyof HandlerUrls): string => {\n  switch (handlerName) {\n    case \"handler\": {\n      return \"\";\n    }\n    case \"home\": {\n      return \"\";\n    }\n    case \"afterSignIn\": {\n      return \"\";\n    }\n    case \"afterSignUp\": {\n      return \"\";\n    }\n    case \"afterSignOut\": {\n      return \"\";\n    }\n    case \"signIn\": {\n      return \"sign-in\";\n    }\n    case \"signUp\": {\n      return \"sign-up\";\n    }\n    case \"signOut\": {\n      return \"sign-out\";\n    }\n    case \"emailVerification\": {\n      return \"email-verification\";\n    }\n    case \"passwordReset\": {\n      return \"password-reset\";\n    }\n    case \"forgotPassword\": {\n      return \"forgot-password\";\n    }\n    case \"oauthCallback\": {\n      return \"oauth-callback\";\n    }\n    case \"magicLinkCallback\": {\n      return \"magic-link-callback\";\n    }\n    case \"accountSettings\": {\n      return \"account-settings\";\n    }\n    case \"teamInvitation\": {\n      return \"team-invitation\";\n    }\n    case \"cliAuthConfirm\": {\n      return \"cli-auth-confirm\";\n    }\n    case \"mfa\": {\n      return \"mfa\";\n    }\n    case \"error\": {\n      return \"error\";\n    }\n    case \"onboarding\": {\n      return \"onboarding\";\n    }\n  }\n};\n\nconst resolveCustomTargetUrl = (options: {\n  target: { type: \"custom\", url: string, version: number },\n  handlerName: keyof HandlerUrls,\n}): string => {\n  const handlerName = options.handlerName;\n  if (handlerName in customPagePrompts) {\n    const customPagePrompt = customPagePrompts[handlerName as keyof typeof customPagePrompts];\n    if (options.target.version === 0 || options.target.version in customPagePrompt.versions) {\n      return options.target.url;\n    }\n\n    throw new Error(`Unsupported custom page version ${options.target.version} for ${options.handlerName} page at ${options.target.url}. The latest supported version of this page is ${Math.max(0, ...Object.keys(customPagePrompt.versions).map(Number))}. Please upgrade your Stack Auth SDK to a version that supports this version.`);\n  } else {\n    throw new Error(`URL target ${options.handlerName} cannot be a custom page. Please specify the URL as a string instead.`);\n  }\n};\n\nexport const getHostedHandlerUrl = (options: { projectId: string, pagePath: string }): string => {\n  const normalizedPagePath = options.pagePath.replace(/^\\/+/, \"\");\n  const hostedPath = normalizedPagePath.length > 0 ? `handler/${normalizedPagePath}` : \"handler\";\n  return getHostedHandlerUrlFromConfig({\n    projectId: options.projectId,\n    hostedPath,\n    hostedHandlerDomainSuffix: envVars.NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX,\n    hostedHandlerUrlTemplate: envVars.NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE,\n    stackPortPrefix: envVars.NEXT_PUBLIC_STACK_PORT_PREFIX,\n  });\n};\n\nconst isRelativeUrlString = (url: string): boolean => {\n  if (url.startsWith(\"//\")) {\n    return false;\n  }\n  return !schemePrefixRegex.test(url);\n};\n\nexport const isLocalHandlerUrlTarget = (options: {\n  targetUrl: string,\n  handlerPath: string,\n  currentOrigin?: string,\n}): boolean => {\n  const urlObject = new URL(options.targetUrl, localUrlPlaceholderOrigin);\n  const isHandlerPathTarget = urlObject.pathname === options.handlerPath\n    || urlObject.pathname.startsWith(`${options.handlerPath}/`);\n  if (!isHandlerPathTarget) {\n    return false;\n  }\n\n  // On server we only have path information, so treat matching handler paths as local.\n  if (options.currentOrigin == null) {\n    return true;\n  }\n\n  return isRelativeUrlString(options.targetUrl) || urlObject.origin === options.currentOrigin;\n};\n\nconst resolveUrlTarget = (options: {\n  target: HandlerUrlTarget,\n  fallbackPath: string,\n  handlerName: keyof HandlerUrls,\n  projectId: string,\n}): string => {\n  if (typeof options.target === \"string\") {\n    return options.target;\n  }\n\n  switch (options.target.type) {\n    case \"handler-component\": {\n      return options.fallbackPath;\n    }\n    case \"hosted\": {\n      return getHostedHandlerUrl({\n        projectId: options.projectId,\n        pagePath: getHostedPagePathForHandlerName(options.handlerName),\n      });\n    }\n    case \"custom\": {\n      return resolveCustomTargetUrl({\n        target: options.target,\n        handlerName: options.handlerName,\n      });\n    }\n  }\n};\n\nconst assertOAuthCallbackTargetIsRelative = (target: HandlerUrlTarget): void => {\n  const url = typeof target === \"string\"\n    ? target\n    : target.type === \"custom\"\n      ? target.url\n      : null;\n  if (url != null && !isRelativeUrlString(url)) {\n    throw new StackAssertionError(\"OAuth callback URLs must be relative.\", {\n      oauthCallbackUrl: url,\n      hint: \"Use a relative URL like '/handler/oauth-callback', or use { type: 'hosted' } to let Stack use the current page for hosted callbacks.\",\n    });\n  }\n};\n\nexport const resolveHandlerUrls = (options: { urls: HandlerUrlOptions | undefined, projectId: string }): ResolvedHandlerUrls => {\n  const configuredUrls = options.urls;\n  const defaultTarget: HandlerUrlTarget = configuredUrls?.default ?? { type: \"handler-component\" };\n  const oauthCallbackTarget: HandlerUrlTarget = configuredUrls?.oauthCallback ?? (\n    typeof defaultTarget !== \"string\" && defaultTarget.type === \"hosted\"\n      ? defaultTarget\n      : { type: \"handler-component\" }\n  );\n  assertOAuthCallbackTargetIsRelative(oauthCallbackTarget);\n  let handlerComponentBasePath = \"/handler\";\n  if (typeof configuredUrls?.handler === \"string\") {\n    handlerComponentBasePath = configuredUrls.handler;\n  } else if (configuredUrls?.handler != null && configuredUrls.handler.type === \"custom\") {\n    handlerComponentBasePath = resolveCustomTargetUrl({\n      target: configuredUrls.handler,\n      handlerName: \"handler\",\n    });\n  }\n\n  const home = resolveUrlTarget({\n    target: configuredUrls?.home ?? defaultTarget,\n    fallbackPath: \"/\",\n    handlerName: \"home\",\n    projectId: options.projectId,\n  });\n  const afterSignIn = resolveUrlTarget({\n    target: configuredUrls?.afterSignIn ?? defaultTarget,\n    fallbackPath: home,\n    handlerName: \"afterSignIn\",\n    projectId: options.projectId,\n  });\n\n  return {\n    handler: resolveUrlTarget({\n      target: configuredUrls?.handler ?? defaultTarget,\n      fallbackPath: handlerComponentBasePath,\n      handlerName: \"handler\",\n      projectId: options.projectId,\n    }),\n    signIn: resolveUrlTarget({\n      target: configuredUrls?.signIn ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"sign-in\"),\n      handlerName: \"signIn\",\n      projectId: options.projectId,\n    }),\n    signUp: resolveUrlTarget({\n      target: configuredUrls?.signUp ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"sign-up\"),\n      handlerName: \"signUp\",\n      projectId: options.projectId,\n    }),\n    afterSignIn,\n    afterSignUp: resolveUrlTarget({\n      target: configuredUrls?.afterSignUp ?? defaultTarget,\n      fallbackPath: afterSignIn,\n      handlerName: \"afterSignUp\",\n      projectId: options.projectId,\n    }),\n    signOut: resolveUrlTarget({\n      target: configuredUrls?.signOut ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"sign-out\"),\n      handlerName: \"signOut\",\n      projectId: options.projectId,\n    }),\n    afterSignOut: resolveUrlTarget({\n      target: configuredUrls?.afterSignOut ?? defaultTarget,\n      fallbackPath: home,\n      handlerName: \"afterSignOut\",\n      projectId: options.projectId,\n    }),\n    emailVerification: resolveUrlTarget({\n      target: configuredUrls?.emailVerification ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"email-verification\"),\n      handlerName: \"emailVerification\",\n      projectId: options.projectId,\n    }),\n    passwordReset: resolveUrlTarget({\n      target: configuredUrls?.passwordReset ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"password-reset\"),\n      handlerName: \"passwordReset\",\n      projectId: options.projectId,\n    }),\n    forgotPassword: resolveUrlTarget({\n      target: configuredUrls?.forgotPassword ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"forgot-password\"),\n      handlerName: \"forgotPassword\",\n      projectId: options.projectId,\n    }),\n    home,\n    oauthCallback: resolveUrlTarget({\n      target: oauthCallbackTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"oauth-callback\"),\n      handlerName: \"oauthCallback\",\n      projectId: options.projectId,\n    }),\n    magicLinkCallback: resolveUrlTarget({\n      target: configuredUrls?.magicLinkCallback ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"magic-link-callback\"),\n      handlerName: \"magicLinkCallback\",\n      projectId: options.projectId,\n    }),\n    accountSettings: resolveUrlTarget({\n      target: configuredUrls?.accountSettings ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"account-settings\"),\n      handlerName: \"accountSettings\",\n      projectId: options.projectId,\n    }),\n    teamInvitation: resolveUrlTarget({\n      target: configuredUrls?.teamInvitation ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"team-invitation\"),\n      handlerName: \"teamInvitation\",\n      projectId: options.projectId,\n    }),\n    cliAuthConfirm: resolveUrlTarget({\n      target: configuredUrls?.cliAuthConfirm ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"cli-auth-confirm\"),\n      handlerName: \"cliAuthConfirm\",\n      projectId: options.projectId,\n    }),\n    mfa: resolveUrlTarget({\n      target: configuredUrls?.mfa ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"mfa\"),\n      handlerName: \"mfa\",\n      projectId: options.projectId,\n    }),\n    error: resolveUrlTarget({\n      target: configuredUrls?.error ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"error\"),\n      handlerName: \"error\",\n      projectId: options.projectId,\n    }),\n    onboarding: resolveUrlTarget({\n      target: configuredUrls?.onboarding ?? defaultTarget,\n      fallbackPath: joinHandlerComponentPath(handlerComponentBasePath, \"onboarding\"),\n      handlerName: \"onboarding\",\n      projectId: options.projectId,\n    }),\n  };\n};\n\nexport const buildCliAuthConfirmUrl = (options: {\n  cliAuthConfirmUrl: string,\n  /** Used as the base URL only when cliAuthConfirmUrl is relative. */\n  appUrl: string,\n  loginCode: string,\n}): string => {\n  const url = new URL(options.cliAuthConfirmUrl, options.appUrl);\n  url.searchParams.set(\"login_code\", options.loginCode);\n  return url.toString();\n};\n\nexport const resolveUnknownHandlerPathFallbackUrl = (options: {\n  defaultTarget: DefaultHandlerUrlTarget | undefined,\n  projectId: string,\n  unknownPath: string,\n}): string | null => {\n  const defaultTarget = options.defaultTarget ?? { type: \"handler-component\" } satisfies HandlerUrlTarget;\n  if (typeof defaultTarget === \"string\") {\n    return defaultTarget;\n  }\n\n  switch (defaultTarget.type) {\n    case \"handler-component\": {\n      return null;\n    }\n    case \"hosted\": {\n      return getHostedHandlerUrl({\n        projectId: options.projectId,\n        pagePath: options.unknownPath,\n      });\n    }\n  }\n};\n\nexport function getPagePrompt(pageName: string, currentVersion?: number): { title: string; fullPrompt: string; upgradePrompt: string | null; latestVersion: number } | null {\n  if (!(pageName in customPagePrompts)) return null;\n  const prompt = customPagePrompts[pageName as keyof typeof customPagePrompts];\n  const versionKeys = Object.keys(prompt.versions).map(Number);\n  const latestVersion = versionKeys.length > 0 ? Math.max(...versionKeys) : 0;\n\n  let upgradePrompt: string | null = null;\n  if (currentVersion != null) {\n    const relevantVersions = versionKeys\n      .filter(v => v > currentVersion)\n      .sort((a, b) => a - b);\n    const prompts = relevantVersions\n      .map(v => prompt.versions[v].upgradePrompt)\n      .filter(p => p.length > 0);\n    upgradePrompt = prompts.length > 0 ? prompts.join(\"\\n\\n\") : null;\n  } else {\n    const upgradeEntry = latestVersion > 0 ? prompt.versions[latestVersion] : undefined;\n    upgradePrompt = upgradeEntry?.upgradePrompt ?? null;\n  }\n\n  return { title: prompt.title, fullPrompt: prompt.fullPrompt, upgradePrompt, latestVersion };\n}\n\nexport const isHostedHandlerUrlForProject = (options: { url: string, projectId: string }): boolean => {\n  let parsedUrl: URL;\n  try {\n    parsedUrl = new URL(options.url);\n  } catch {\n    return false;\n  }\n\n  const hostedBaseUrl = new URL(getHostedHandlerUrl({ projectId: options.projectId, pagePath: \"\" }));\n  return parsedUrl.origin === hostedBaseUrl.origin\n    && (parsedUrl.pathname === hostedBaseUrl.pathname || parsedUrl.pathname.startsWith(`${hostedBaseUrl.pathname}/`));\n};\n"],"mappings":";;;;;;;;AAUA,MAAM,4BAA4B;AAClC,MAAM,oBAAoB;AAE1B,MAAM,oGAA4G;AAElH,MAAM,4BAA4B,UAAkB,aAA6B;CAC/E,MAAM,qBAAqB,SAAS,SAAS,IAAI,IAAI,SAAS,SAAS,IACnE,SAAS,MAAM,GAAG,GAAG,GACrB;AACJ,KAAI,SAAS,WAAW,EACtB,QAAO;AAET,KAAI,uBAAuB,IACzB,QAAO,IAAI;AAEb,QAAO,GAAG,mBAAmB,GAAG;;AAGlC,MAAM,mCAAmC,gBAA2C;AAClF,SAAQ,aAAR;EACE,KAAK,UACH,QAAO;EAET,KAAK,OACH,QAAO;EAET,KAAK,cACH,QAAO;EAET,KAAK,cACH,QAAO;EAET,KAAK,eACH,QAAO;EAET,KAAK,SACH,QAAO;EAET,KAAK,SACH,QAAO;EAET,KAAK,UACH,QAAO;EAET,KAAK,oBACH,QAAO;EAET,KAAK,gBACH,QAAO;EAET,KAAK,iBACH,QAAO;EAET,KAAK,gBACH,QAAO;EAET,KAAK,oBACH,QAAO;EAET,KAAK,kBACH,QAAO;EAET,KAAK,iBACH,QAAO;EAET,KAAK,iBACH,QAAO;EAET,KAAK,MACH,QAAO;EAET,KAAK,QACH,QAAO;EAET,KAAK,aACH,QAAO;;;AAKb,MAAM,0BAA0B,YAGlB;CACZ,MAAM,cAAc,QAAQ;AAC5B,KAAI,eAAe,mBAAmB;EACpC,MAAM,mBAAmB,kBAAkB;AAC3C,MAAI,QAAQ,OAAO,YAAY,KAAK,QAAQ,OAAO,WAAW,iBAAiB,SAC7E,QAAO,QAAQ,OAAO;AAGxB,QAAM,IAAI,MAAM,mCAAmC,QAAQ,OAAO,QAAQ,OAAO,QAAQ,YAAY,WAAW,QAAQ,OAAO,IAAI,iDAAiD,KAAK,IAAI,GAAG,GAAG,OAAO,KAAK,iBAAiB,SAAS,CAAC,IAAI,OAAO,CAAC,CAAC,+EAA+E;OAEtU,OAAM,IAAI,MAAM,cAAc,QAAQ,YAAY,uEAAuE;;AAI7H,MAAa,uBAAuB,YAA6D;CAC/F,MAAM,qBAAqB,QAAQ,SAAS,QAAQ,QAAQ,GAAG;CAC/D,MAAM,aAAa,mBAAmB,SAAS,IAAI,WAAW,uBAAuB;AACrF,6FAAqC;EACnC,WAAW,QAAQ;EACnB;EACA,2BAA2BA,kBAAQ;EACnC,0BAA0BA,kBAAQ;EAClC,iBAAiBA,kBAAQ;EAC1B,CAAC;;AAGJ,MAAM,uBAAuB,QAAyB;AACpD,KAAI,IAAI,WAAW,KAAK,CACtB,QAAO;AAET,QAAO,CAAC,kBAAkB,KAAK,IAAI;;AAGrC,MAAa,2BAA2B,YAIzB;CACb,MAAM,YAAY,IAAI,IAAI,QAAQ,WAAW,0BAA0B;AAGvE,KAAI,EAFwB,UAAU,aAAa,QAAQ,eACtD,UAAU,SAAS,WAAW,GAAG,QAAQ,YAAY,GAAG,EAE3D,QAAO;AAIT,KAAI,QAAQ,iBAAiB,KAC3B,QAAO;AAGT,QAAO,oBAAoB,QAAQ,UAAU,IAAI,UAAU,WAAW,QAAQ;;AAGhF,MAAM,oBAAoB,YAKZ;AACZ,KAAI,OAAO,QAAQ,WAAW,SAC5B,QAAO,QAAQ;AAGjB,SAAQ,QAAQ,OAAO,MAAvB;EACE,KAAK,oBACH,QAAO,QAAQ;EAEjB,KAAK,SACH,QAAO,oBAAoB;GACzB,WAAW,QAAQ;GACnB,UAAU,gCAAgC,QAAQ,YAAY;GAC/D,CAAC;EAEJ,KAAK,SACH,QAAO,uBAAuB;GAC5B,QAAQ,QAAQ;GAChB,aAAa,QAAQ;GACtB,CAAC;;;AAKR,MAAM,uCAAuC,WAAmC;CAC9E,MAAM,MAAM,OAAO,WAAW,WAC1B,SACA,OAAO,SAAS,WACd,OAAO,MACP;AACN,KAAI,OAAO,QAAQ,CAAC,oBAAoB,IAAI,CAC1C,OAAM,IAAIC,+DAAoB,yCAAyC;EACrE,kBAAkB;EAClB,MAAM;EACP,CAAC;;AAIN,MAAa,sBAAsB,YAA6F;CAC9H,MAAM,iBAAiB,QAAQ;CAC/B,MAAM,gBAAkC,gBAAgB,WAAW,EAAE,MAAM,qBAAqB;CAChG,MAAM,sBAAwC,gBAAgB,kBAC5D,OAAO,kBAAkB,YAAY,cAAc,SAAS,WACxD,gBACA,EAAE,MAAM,qBAAqB;AAEnC,qCAAoC,oBAAoB;CACxD,IAAI,2BAA2B;AAC/B,KAAI,OAAO,gBAAgB,YAAY,SACrC,4BAA2B,eAAe;UACjC,gBAAgB,WAAW,QAAQ,eAAe,QAAQ,SAAS,SAC5E,4BAA2B,uBAAuB;EAChD,QAAQ,eAAe;EACvB,aAAa;EACd,CAAC;CAGJ,MAAM,OAAO,iBAAiB;EAC5B,QAAQ,gBAAgB,QAAQ;EAChC,cAAc;EACd,aAAa;EACb,WAAW,QAAQ;EACpB,CAAC;CACF,MAAM,cAAc,iBAAiB;EACnC,QAAQ,gBAAgB,eAAe;EACvC,cAAc;EACd,aAAa;EACb,WAAW,QAAQ;EACpB,CAAC;AAEF,QAAO;EACL,SAAS,iBAAiB;GACxB,QAAQ,gBAAgB,WAAW;GACnC,cAAc;GACd,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,QAAQ,iBAAiB;GACvB,QAAQ,gBAAgB,UAAU;GAClC,cAAc,yBAAyB,0BAA0B,UAAU;GAC3E,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,QAAQ,iBAAiB;GACvB,QAAQ,gBAAgB,UAAU;GAClC,cAAc,yBAAyB,0BAA0B,UAAU;GAC3E,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF;EACA,aAAa,iBAAiB;GAC5B,QAAQ,gBAAgB,eAAe;GACvC,cAAc;GACd,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,SAAS,iBAAiB;GACxB,QAAQ,gBAAgB,WAAW;GACnC,cAAc,yBAAyB,0BAA0B,WAAW;GAC5E,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,cAAc,iBAAiB;GAC7B,QAAQ,gBAAgB,gBAAgB;GACxC,cAAc;GACd,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,mBAAmB,iBAAiB;GAClC,QAAQ,gBAAgB,qBAAqB;GAC7C,cAAc,yBAAyB,0BAA0B,qBAAqB;GACtF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,eAAe,iBAAiB;GAC9B,QAAQ,gBAAgB,iBAAiB;GACzC,cAAc,yBAAyB,0BAA0B,iBAAiB;GAClF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,gBAAgB,iBAAiB;GAC/B,QAAQ,gBAAgB,kBAAkB;GAC1C,cAAc,yBAAyB,0BAA0B,kBAAkB;GACnF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF;EACA,eAAe,iBAAiB;GAC9B,QAAQ;GACR,cAAc,yBAAyB,0BAA0B,iBAAiB;GAClF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,mBAAmB,iBAAiB;GAClC,QAAQ,gBAAgB,qBAAqB;GAC7C,cAAc,yBAAyB,0BAA0B,sBAAsB;GACvF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,iBAAiB,iBAAiB;GAChC,QAAQ,gBAAgB,mBAAmB;GAC3C,cAAc,yBAAyB,0BAA0B,mBAAmB;GACpF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,gBAAgB,iBAAiB;GAC/B,QAAQ,gBAAgB,kBAAkB;GAC1C,cAAc,yBAAyB,0BAA0B,kBAAkB;GACnF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,gBAAgB,iBAAiB;GAC/B,QAAQ,gBAAgB,kBAAkB;GAC1C,cAAc,yBAAyB,0BAA0B,mBAAmB;GACpF,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,KAAK,iBAAiB;GACpB,QAAQ,gBAAgB,OAAO;GAC/B,cAAc,yBAAyB,0BAA0B,MAAM;GACvE,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,OAAO,iBAAiB;GACtB,QAAQ,gBAAgB,SAAS;GACjC,cAAc,yBAAyB,0BAA0B,QAAQ;GACzE,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACF,YAAY,iBAAiB;GAC3B,QAAQ,gBAAgB,cAAc;GACtC,cAAc,yBAAyB,0BAA0B,aAAa;GAC9E,aAAa;GACb,WAAW,QAAQ;GACpB,CAAC;EACH;;AAGH,MAAa,0BAA0B,YAKzB;CACZ,MAAM,MAAM,IAAI,IAAI,QAAQ,mBAAmB,QAAQ,OAAO;AAC9D,KAAI,aAAa,IAAI,cAAc,QAAQ,UAAU;AACrD,QAAO,IAAI,UAAU;;AAGvB,MAAa,wCAAwC,YAIhC;CACnB,MAAM,gBAAgB,QAAQ,iBAAiB,EAAE,MAAM,qBAAqB;AAC5E,KAAI,OAAO,kBAAkB,SAC3B,QAAO;AAGT,SAAQ,cAAc,MAAtB;EACE,KAAK,oBACH,QAAO;EAET,KAAK,SACH,QAAO,oBAAoB;GACzB,WAAW,QAAQ;GACnB,UAAU,QAAQ;GACnB,CAAC;;;AAKR,SAAgB,cAAc,UAAkB,gBAA4H;AAC1K,KAAI,EAAE,YAAY,mBAAoB,QAAO;CAC7C,MAAM,SAAS,kBAAkB;CACjC,MAAM,cAAc,OAAO,KAAK,OAAO,SAAS,CAAC,IAAI,OAAO;CAC5D,MAAM,gBAAgB,YAAY,SAAS,IAAI,KAAK,IAAI,GAAG,YAAY,GAAG;CAE1E,IAAI,gBAA+B;AACnC,KAAI,kBAAkB,MAAM;EAI1B,MAAM,UAHmB,YACtB,QAAO,MAAK,IAAI,eAAe,CAC/B,MAAM,GAAG,MAAM,IAAI,EAAE,CAErB,KAAI,MAAK,OAAO,SAAS,GAAG,cAAc,CAC1C,QAAO,MAAK,EAAE,SAAS,EAAE;AAC5B,kBAAgB,QAAQ,SAAS,IAAI,QAAQ,KAAK,OAAO,GAAG;OAG5D,kBADqB,gBAAgB,IAAI,OAAO,SAAS,iBAAiB,SAC5C,iBAAiB;AAGjD,QAAO;EAAE,OAAO,OAAO;EAAO,YAAY,OAAO;EAAY;EAAe;EAAe;;AAG7F,MAAa,gCAAgC,YAAyD;CACpG,IAAI;AACJ,KAAI;AACF,cAAY,IAAI,IAAI,QAAQ,IAAI;SAC1B;AACN,SAAO;;CAGT,MAAM,gBAAgB,IAAI,IAAI,oBAAoB;EAAE,WAAW,QAAQ;EAAW,UAAU;EAAI,CAAC,CAAC;AAClG,QAAO,UAAU,WAAW,cAAc,WACpC,UAAU,aAAa,cAAc,YAAY,UAAU,SAAS,WAAW,GAAG,cAAc,SAAS,GAAG"}

package/dist/lib/stack-app/url-targets.test.js

@@ -89,6 +89,38 @@ let __url_targets_js = require("./url-targets.js");
 		(0, vitest.expect)(urls.signIn).toBe("https://project-id.example-stack-hosted.test/handler/sign-in");
 		(0, vitest.expect)(urls.cliAuthConfirm).toBe("https://project-id.example-stack-hosted.test/handler/cli-auth-confirm");
 	});
+	(0, vitest.it)("rejects absolute OAuth callback string targets", () => {
+		(0, vitest.expect)(() => (0, __url_targets_js.resolveHandlerUrls)({
+			projectId: "project-id",
+			urls: { oauthCallback: "https://app.example.test/oauth-callback" }
+		})).toThrowErrorMatchingInlineSnapshot(`
+      [StackAssertionError: OAuth callback URLs must be relative.
+
+      This is likely an error in Stack. Please make sure you are running the newest version and report it.]
+    `);
+	});
+	(0, vitest.it)("rejects absolute OAuth callback custom targets", () => {
+		(0, vitest.expect)(() => (0, __url_targets_js.resolveHandlerUrls)({
+			projectId: "project-id",
+			urls: { oauthCallback: {
+				type: "custom",
+				url: "https://app.example.test/oauth-callback",
+				version: 0
+			} }
+		})).toThrowErrorMatchingInlineSnapshot(`
+      [StackAssertionError: OAuth callback URLs must be relative.
+
+      This is likely an error in Stack. Please make sure you are running the newest version and report it.]
+    `);
+	});
+	(0, vitest.it)("does not inherit an absolute default target for the OAuth callback", () => {
+		const urls = (0, __url_targets_js.resolveHandlerUrls)({
+			projectId: "project-id",
+			urls: { default: "https://app.example.test/handler" }
+		});
+		(0, vitest.expect)(urls.signIn).toBe("https://app.example.test/handler");
+		(0, vitest.expect)(urls.oauthCallback).toBe("/handler/oauth-callback");
+	});
 	(0, vitest.it)("supports custom CLI auth confirmation targets", () => {
 		const cliAuthConfirmPrompt = (0, __url_targets_js.getPagePrompt)("cliAuthConfirm");
 		if (cliAuthConfirmPrompt == null) throw new Error("Expected cliAuthConfirm prompt metadata to exist");
@@ -117,14 +149,14 @@ let __url_targets_js = require("./url-targets.js");
 		})).toBe("https://project-id.example-stack-hosted.test/handler/custom-page");
 	});
 	(0, vitest.it)("uses the full hosted handler URL template when configured", () => {
-		vitest.vi.stubEnv("NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE", "http://localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}09/{projectId}/{hostedPath}");
+		vitest.vi.stubEnv("NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE", "http://{projectId}.localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}09/{hostedPath}");
 		vitest.vi.stubEnv("NEXT_PUBLIC_STACK_PORT_PREFIX", "93");
 		const urls = (0, __url_targets_js.resolveHandlerUrls)({
 			projectId: "project-id",
 			urls: { default: { type: "hosted" } }
 		});
-		(0, vitest.expect)(urls.signIn).toBe("http://localhost:9309/project-id/handler/sign-in");
-		(0, vitest.expect)(urls.accountSettings).toBe("http://localhost:9309/project-id/handler/account-settings");
+		(0, vitest.expect)(urls.signIn).toBe("http://project-id.localhost:9309/handler/sign-in");
+		(0, vitest.expect)(urls.accountSettings).toBe("http://project-id.localhost:9309/handler/account-settings");
 	});
 	(0, vitest.it)("validates the hosted handler URL template placeholders", () => {
 		vitest.vi.stubEnv("NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE", "http://localhost:9309/{projectId}/handler");
@@ -133,6 +165,17 @@ let __url_targets_js = require("./url-targets.js");
 			urls: { default: { type: "hosted" } }
 		})).toThrowError(/\{projectId\} and \{hostedPath\}/);
 	});
+	(0, vitest.it)("rejects hosted handler URL templates that put the project ID in the path", () => {
+		vitest.vi.stubEnv("NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE", "http://localhost:9309/{projectId}/{hostedPath}");
+		(0, vitest.expect)(() => (0, __url_targets_js.resolveHandlerUrls)({
+			projectId: "project-id",
+			urls: { default: { type: "hosted" } }
+		})).toThrowErrorMatchingInlineSnapshot(`
+      [StackAssertionError: The hosted handler URL template must put {projectId} in the hostname.
+
+      This is likely an error in Stack. Please make sure you are running the newest version and report it.]
+    `);
+	});
 });
 (0, vitest.describe)("isLocalHandlerUrlTarget", () => {
 	(0, vitest.it)("treats relative handler URLs as local targets", () => {

package/dist/lib/stack-app/url-targets.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-targets.test.js","names":[],"sources":["../../../src/lib/stack-app/url-targets.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { buildCliAuthConfirmUrl, getPagePrompt, isLocalHandlerUrlTarget, resolveHandlerUrls, resolveUnknownHandlerPathFallbackUrl } from \"./url-targets\";\n\ndescribe(\"handler URL targets\", () => {\n  afterEach(() => {\n    vi.unstubAllEnvs();\n  });\n\n  it(\"treats handler-component targets the same as omitted values\", () => {\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        handler: \"/custom-handler\",\n        signIn: { type: \"handler-component\" },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"/custom-handler/sign-in\");\n  });\n\n  it(\"treats custom v0 page targets like legacy string targets\", () => {\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        handler: \"/custom-handler\",\n        signIn: { type: \"handler-component\" },\n        signUp: { type: \"custom\", url: \"/sign-up-explicit\", version: 0 },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"/custom-handler/sign-in\");\n    expect(urls.signUp).toBe(\"/sign-up-explicit\");\n  });\n\n  it(\"throws on v0 custom target for handler page\", () => {\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        handler: { type: \"custom\", url: \"/custom-handler\", version: 0 },\n      },\n    })).toThrowError(/cannot be a custom page/);\n  });\n\n  it(\"supports the latest documented custom target version\", () => {\n    const signInPrompt = getPagePrompt(\"signIn\");\n    if (signInPrompt == null) {\n      throw new Error(\"Expected signIn prompt metadata to exist\");\n    }\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        signIn: { type: \"custom\", url: \"/custom-sign-in\", version: signInPrompt.latestVersion },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"/custom-sign-in\");\n  });\n\n  it(\"throws on custom target versions newer than the latest supported version\", () => {\n    const signInPrompt = getPagePrompt(\"signIn\");\n    if (signInPrompt == null) {\n      throw new Error(\"Expected signIn prompt metadata to exist\");\n    }\n\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        signIn: { type: \"custom\", url: \"/custom-sign-in\", version: signInPrompt.latestVersion + 1 },\n      },\n    })).toThrowError(/Unsupported custom page version/);\n  });\n\n  it(\"throws on non-zero custom version for handler page\", () => {\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        handler: { type: \"custom\", url: \"/custom-handler\", version: 1 },\n      },\n    })).toThrowError(/cannot be a custom page/);\n  });\n\n  it(\"uses hosted defaults for unspecified URLs\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX\", \".example-stack-hosted.test\");\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        signUp: \"/sign-up\",\n        default: { type: \"hosted\" },\n      },\n    });\n\n    expect(urls.signUp).toBe(\"/sign-up\");\n    expect(urls.signIn).toBe(\"https://project-id.example-stack-hosted.test/handler/sign-in\");\n    expect(urls.cliAuthConfirm).toBe(\"https://project-id.example-stack-hosted.test/handler/cli-auth-confirm\");\n  });\n\n  it(\"supports custom CLI auth confirmation targets\", () => {\n    const cliAuthConfirmPrompt = getPagePrompt(\"cliAuthConfirm\");\n    if (cliAuthConfirmPrompt == null) {\n      throw new Error(\"Expected cliAuthConfirm prompt metadata to exist\");\n    }\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        cliAuthConfirm: { type: \"custom\", url: \"/cli/authorize\", version: cliAuthConfirmPrompt.latestVersion },\n      },\n    });\n\n    expect(urls.cliAuthConfirm).toBe(\"/cli/authorize\");\n  });\n\n  it(\"builds CLI auth login URLs from the resolved confirmation target\", () => {\n    expect(buildCliAuthConfirmUrl({\n      cliAuthConfirmUrl: \"/cli/authorize\",\n      appUrl: \"https://app.example.test/base\",\n      loginCode: \"login-code\",\n    })).toBe(\"https://app.example.test/cli/authorize?login_code=login-code\");\n  });\n\n  it(\"uses default target for unknown /handler/* pages\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX\", \".example-stack-hosted.test\");\n\n    const url = resolveUnknownHandlerPathFallbackUrl({\n      defaultTarget: { type: \"hosted\" },\n      projectId: \"project-id\",\n      unknownPath: \"custom-page\",\n    });\n\n    expect(url).toBe(\"https://project-id.example-stack-hosted.test/handler/custom-page\");\n  });\n\n  it(\"uses the full hosted handler URL template when configured\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE\", \"http://localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}09/{projectId}/{hostedPath}\");\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_PORT_PREFIX\", \"93\");\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"http://localhost:9309/project-id/handler/sign-in\");\n    expect(urls.accountSettings).toBe(\"http://localhost:9309/project-id/handler/account-settings\");\n  });\n\n  it(\"validates the hosted handler URL template placeholders\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE\", \"http://localhost:9309/{projectId}/handler\");\n\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n    })).toThrowError(/\\{projectId\\} and \\{hostedPath\\}/);\n  });\n});\n\ndescribe(\"isLocalHandlerUrlTarget\", () => {\n  it(\"treats relative handler URLs as local targets\", () => {\n    expect(isLocalHandlerUrlTarget({\n      targetUrl: \"/handler/sign-in\",\n      handlerPath: \"/handler\",\n      currentOrigin: \"http://p91.localhost:9101\",\n    })).toBe(true);\n  });\n\n  it(\"treats same-origin absolute handler URLs as local targets\", () => {\n    expect(isLocalHandlerUrlTarget({\n      targetUrl: \"http://p91.localhost:9101/handler/sign-in\",\n      handlerPath: \"/handler\",\n      currentOrigin: \"http://p91.localhost:9101\",\n    })).toBe(true);\n  });\n\n  it(\"treats cross-origin absolute handler URLs as non-local targets\", () => {\n    expect(isLocalHandlerUrlTarget({\n      targetUrl: \"https://project-id.built-with-stack-auth.com/handler/sign-in\",\n      handlerPath: \"/handler\",\n      currentOrigin: \"http://p91.localhost:9101\",\n    })).toBe(false);\n  });\n\n  it(\"treats non-handler paths as non-local targets\", () => {\n    expect(isLocalHandlerUrlTarget({\n      targetUrl: \"/projects\",\n      handlerPath: \"/handler\",\n      currentOrigin: \"http://p91.localhost:9101\",\n    })).toBe(false);\n  });\n});\n"],"mappings":";;;;;qBAOS,6BAA6B;AACpC,6BAAgB;AACd,YAAG,eAAe;GAClB;AAEF,gBAAG,qEAAqE;AAStE,8DARgC;GAC9B,WAAW;GACX,MAAM;IACJ,SAAS;IACT,QAAQ,EAAE,MAAM,qBAAqB;IACtC;GACF,CAAC,CAEU,OAAO,CAAC,KAAK,0BAA0B;GACnD;AAEF,gBAAG,kEAAkE;EACnE,MAAM,gDAA0B;GAC9B,WAAW;GACX,MAAM;IACJ,SAAS;IACT,QAAQ,EAAE,MAAM,qBAAqB;IACrC,QAAQ;KAAE,MAAM;KAAU,KAAK;KAAqB,SAAS;KAAG;IACjE;GACF,CAAC;AAEF,qBAAO,KAAK,OAAO,CAAC,KAAK,0BAA0B;AACnD,qBAAO,KAAK,OAAO,CAAC,KAAK,oBAAoB;GAC7C;AAEF,gBAAG,qDAAqD;AACtD,oEAAgC;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS;IAAE,MAAM;IAAU,KAAK;IAAmB,SAAS;IAAG,EAChE;GACF,CAAC,CAAC,CAAC,aAAa,0BAA0B;GAC3C;AAEF,gBAAG,8DAA8D;EAC/D,MAAM,mDAA6B,SAAS;AAC5C,MAAI,gBAAgB,KAClB,OAAM,IAAI,MAAM,2CAA2C;AAU7D,8DAPgC;GAC9B,WAAW;GACX,MAAM,EACJ,QAAQ;IAAE,MAAM;IAAU,KAAK;IAAmB,SAAS,aAAa;IAAe,EACxF;GACF,CAAC,CAEU,OAAO,CAAC,KAAK,kBAAkB;GAC3C;AAEF,gBAAG,kFAAkF;EACnF,MAAM,mDAA6B,SAAS;AAC5C,MAAI,gBAAgB,KAClB,OAAM,IAAI,MAAM,2CAA2C;AAG7D,oEAAgC;GAC9B,WAAW;GACX,MAAM,EACJ,QAAQ;IAAE,MAAM;IAAU,KAAK;IAAmB,SAAS,aAAa,gBAAgB;IAAG,EAC5F;GACF,CAAC,CAAC,CAAC,aAAa,kCAAkC;GACnD;AAEF,gBAAG,4DAA4D;AAC7D,oEAAgC;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS;IAAE,MAAM;IAAU,KAAK;IAAmB,SAAS;IAAG,EAChE;GACF,CAAC,CAAC,CAAC,aAAa,0BAA0B;GAC3C;AAEF,gBAAG,mDAAmD;AACpD,YAAG,QAAQ,kDAAkD,6BAA6B;EAE1F,MAAM,gDAA0B;GAC9B,WAAW;GACX,MAAM;IACJ,QAAQ;IACR,SAAS,EAAE,MAAM,UAAU;IAC5B;GACF,CAAC;AAEF,qBAAO,KAAK,OAAO,CAAC,KAAK,WAAW;AACpC,qBAAO,KAAK,OAAO,CAAC,KAAK,+DAA+D;AACxF,qBAAO,KAAK,eAAe,CAAC,KAAK,wEAAwE;GACzG;AAEF,gBAAG,uDAAuD;EACxD,MAAM,2DAAqC,iBAAiB;AAC5D,MAAI,wBAAwB,KAC1B,OAAM,IAAI,MAAM,mDAAmD;AAUrE,8DAPgC;GAC9B,WAAW;GACX,MAAM,EACJ,gBAAgB;IAAE,MAAM;IAAU,KAAK;IAAkB,SAAS,qBAAqB;IAAe,EACvG;GACF,CAAC,CAEU,eAAe,CAAC,KAAK,iBAAiB;GAClD;AAEF,gBAAG,0EAA0E;AAC3E,kEAA8B;GAC5B,mBAAmB;GACnB,QAAQ;GACR,WAAW;GACZ,CAAC,CAAC,CAAC,KAAK,+DAA+D;GACxE;AAEF,gBAAG,0DAA0D;AAC3D,YAAG,QAAQ,kDAAkD,6BAA6B;AAQ1F,gFANiD;GAC/C,eAAe,EAAE,MAAM,UAAU;GACjC,WAAW;GACX,aAAa;GACd,CAAC,CAES,CAAC,KAAK,mEAAmE;GACpF;AAEF,gBAAG,mEAAmE;AACpE,YAAG,QAAQ,iDAAiD,mFAAmF;AAC/I,YAAG,QAAQ,iCAAiC,KAAK;EAEjD,MAAM,gDAA0B;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS,EAAE,MAAM,UAAU,EAC5B;GACF,CAAC;AAEF,qBAAO,KAAK,OAAO,CAAC,KAAK,mDAAmD;AAC5E,qBAAO,KAAK,gBAAgB,CAAC,KAAK,4DAA4D;GAC9F;AAEF,gBAAG,gEAAgE;AACjE,YAAG,QAAQ,iDAAiD,4CAA4C;AAExG,oEAAgC;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS,EAAE,MAAM,UAAU,EAC5B;GACF,CAAC,CAAC,CAAC,aAAa,mCAAmC;GACpD;EACF;qBAEO,iCAAiC;AACxC,gBAAG,uDAAuD;AACxD,mEAA+B;GAC7B,WAAW;GACX,aAAa;GACb,eAAe;GAChB,CAAC,CAAC,CAAC,KAAK,KAAK;GACd;AAEF,gBAAG,mEAAmE;AACpE,mEAA+B;GAC7B,WAAW;GACX,aAAa;GACb,eAAe;GAChB,CAAC,CAAC,CAAC,KAAK,KAAK;GACd;AAEF,gBAAG,wEAAwE;AACzE,mEAA+B;GAC7B,WAAW;GACX,aAAa;GACb,eAAe;GAChB,CAAC,CAAC,CAAC,KAAK,MAAM;GACf;AAEF,gBAAG,uDAAuD;AACxD,mEAA+B;GAC7B,WAAW;GACX,aAAa;GACb,eAAe;GAChB,CAAC,CAAC,CAAC,KAAK,MAAM;GACf;EACF"}
+{"version":3,"file":"url-targets.test.js","names":[],"sources":["../../../src/lib/stack-app/url-targets.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { buildCliAuthConfirmUrl, getPagePrompt, isLocalHandlerUrlTarget, resolveHandlerUrls, resolveUnknownHandlerPathFallbackUrl } from \"./url-targets\";\n\ndescribe(\"handler URL targets\", () => {\n  afterEach(() => {\n    vi.unstubAllEnvs();\n  });\n\n  it(\"treats handler-component targets the same as omitted values\", () => {\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        handler: \"/custom-handler\",\n        signIn: { type: \"handler-component\" },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"/custom-handler/sign-in\");\n  });\n\n  it(\"treats custom v0 page targets like legacy string targets\", () => {\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        handler: \"/custom-handler\",\n        signIn: { type: \"handler-component\" },\n        signUp: { type: \"custom\", url: \"/sign-up-explicit\", version: 0 },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"/custom-handler/sign-in\");\n    expect(urls.signUp).toBe(\"/sign-up-explicit\");\n  });\n\n  it(\"throws on v0 custom target for handler page\", () => {\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        handler: { type: \"custom\", url: \"/custom-handler\", version: 0 },\n      },\n    })).toThrowError(/cannot be a custom page/);\n  });\n\n  it(\"supports the latest documented custom target version\", () => {\n    const signInPrompt = getPagePrompt(\"signIn\");\n    if (signInPrompt == null) {\n      throw new Error(\"Expected signIn prompt metadata to exist\");\n    }\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        signIn: { type: \"custom\", url: \"/custom-sign-in\", version: signInPrompt.latestVersion },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"/custom-sign-in\");\n  });\n\n  it(\"throws on custom target versions newer than the latest supported version\", () => {\n    const signInPrompt = getPagePrompt(\"signIn\");\n    if (signInPrompt == null) {\n      throw new Error(\"Expected signIn prompt metadata to exist\");\n    }\n\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        signIn: { type: \"custom\", url: \"/custom-sign-in\", version: signInPrompt.latestVersion + 1 },\n      },\n    })).toThrowError(/Unsupported custom page version/);\n  });\n\n  it(\"throws on non-zero custom version for handler page\", () => {\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        handler: { type: \"custom\", url: \"/custom-handler\", version: 1 },\n      },\n    })).toThrowError(/cannot be a custom page/);\n  });\n\n  it(\"uses hosted defaults for unspecified URLs\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX\", \".example-stack-hosted.test\");\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        signUp: \"/sign-up\",\n        default: { type: \"hosted\" },\n      },\n    });\n\n    expect(urls.signUp).toBe(\"/sign-up\");\n    expect(urls.signIn).toBe(\"https://project-id.example-stack-hosted.test/handler/sign-in\");\n    expect(urls.cliAuthConfirm).toBe(\"https://project-id.example-stack-hosted.test/handler/cli-auth-confirm\");\n  });\n\n  it(\"rejects absolute OAuth callback string targets\", () => {\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        oauthCallback: \"https://app.example.test/oauth-callback\",\n      },\n    })).toThrowErrorMatchingInlineSnapshot(`\n      [StackAssertionError: OAuth callback URLs must be relative.\n\n      This is likely an error in Stack. Please make sure you are running the newest version and report it.]\n    `);\n  });\n\n  it(\"rejects absolute OAuth callback custom targets\", () => {\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        oauthCallback: { type: \"custom\", url: \"https://app.example.test/oauth-callback\", version: 0 },\n      },\n    })).toThrowErrorMatchingInlineSnapshot(`\n      [StackAssertionError: OAuth callback URLs must be relative.\n\n      This is likely an error in Stack. Please make sure you are running the newest version and report it.]\n    `);\n  });\n\n  it(\"does not inherit an absolute default target for the OAuth callback\", () => {\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        default: \"https://app.example.test/handler\",\n      },\n    });\n\n    expect(urls.signIn).toBe(\"https://app.example.test/handler\");\n    expect(urls.oauthCallback).toBe(\"/handler/oauth-callback\");\n  });\n\n  it(\"supports custom CLI auth confirmation targets\", () => {\n    const cliAuthConfirmPrompt = getPagePrompt(\"cliAuthConfirm\");\n    if (cliAuthConfirmPrompt == null) {\n      throw new Error(\"Expected cliAuthConfirm prompt metadata to exist\");\n    }\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        cliAuthConfirm: { type: \"custom\", url: \"/cli/authorize\", version: cliAuthConfirmPrompt.latestVersion },\n      },\n    });\n\n    expect(urls.cliAuthConfirm).toBe(\"/cli/authorize\");\n  });\n\n  it(\"builds CLI auth login URLs from the resolved confirmation target\", () => {\n    expect(buildCliAuthConfirmUrl({\n      cliAuthConfirmUrl: \"/cli/authorize\",\n      appUrl: \"https://app.example.test/base\",\n      loginCode: \"login-code\",\n    })).toBe(\"https://app.example.test/cli/authorize?login_code=login-code\");\n  });\n\n  it(\"uses default target for unknown /handler/* pages\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX\", \".example-stack-hosted.test\");\n\n    const url = resolveUnknownHandlerPathFallbackUrl({\n      defaultTarget: { type: \"hosted\" },\n      projectId: \"project-id\",\n      unknownPath: \"custom-page\",\n    });\n\n    expect(url).toBe(\"https://project-id.example-stack-hosted.test/handler/custom-page\");\n  });\n\n  it(\"uses the full hosted handler URL template when configured\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE\", \"http://{projectId}.localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}09/{hostedPath}\");\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_PORT_PREFIX\", \"93\");\n\n    const urls = resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n    });\n\n    expect(urls.signIn).toBe(\"http://project-id.localhost:9309/handler/sign-in\");\n    expect(urls.accountSettings).toBe(\"http://project-id.localhost:9309/handler/account-settings\");\n  });\n\n  it(\"validates the hosted handler URL template placeholders\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE\", \"http://localhost:9309/{projectId}/handler\");\n\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n    })).toThrowError(/\\{projectId\\} and \\{hostedPath\\}/);\n  });\n\n  it(\"rejects hosted handler URL templates that put the project ID in the path\", () => {\n    vi.stubEnv(\"NEXT_PUBLIC_STACK_HOSTED_HANDLER_URL_TEMPLATE\", \"http://localhost:9309/{projectId}/{hostedPath}\");\n\n    expect(() => resolveHandlerUrls({\n      projectId: \"project-id\",\n      urls: {\n        default: { type: \"hosted\" },\n      },\n    })).toThrowErrorMatchingInlineSnapshot(`\n      [StackAssertionError: The hosted handler URL template must put {projectId} in the hostname.\n\n      This is likely an error in Stack. Please make sure you are running the newest version and report it.]\n    `);\n  });\n});\n\ndescribe(\"isLocalHandlerUrlTarget\", () => {\n  it(\"treats relative handler URLs as local targets\", () => {\n    expect(isLocalHandlerUrlTarget({\n      targetUrl: \"/handler/sign-in\",\n      handlerPath: \"/handler\",\n      currentOrigin: \"http://p91.localhost:9101\",\n    })).toBe(true);\n  });\n\n  it(\"treats same-origin absolute handler URLs as local targets\", () => {\n    expect(isLocalHandlerUrlTarget({\n      targetUrl: \"http://p91.localhost:9101/handler/sign-in\",\n      handlerPath: \"/handler\",\n      currentOrigin: \"http://p91.localhost:9101\",\n    })).toBe(true);\n  });\n\n  it(\"treats cross-origin absolute handler URLs as non-local targets\", () => {\n    expect(isLocalHandlerUrlTarget({\n      targetUrl: \"https://project-id.built-with-stack-auth.com/handler/sign-in\",\n      handlerPath: \"/handler\",\n      currentOrigin: \"http://p91.localhost:9101\",\n    })).toBe(false);\n  });\n\n  it(\"treats non-handler paths as non-local targets\", () => {\n    expect(isLocalHandlerUrlTarget({\n      targetUrl: \"/projects\",\n      handlerPath: \"/handler\",\n      currentOrigin: \"http://p91.localhost:9101\",\n    })).toBe(false);\n  });\n});\n"],"mappings":";;;;;qBAOS,6BAA6B;AACpC,6BAAgB;AACd,YAAG,eAAe;GAClB;AAEF,gBAAG,qEAAqE;AAStE,8DARgC;GAC9B,WAAW;GACX,MAAM;IACJ,SAAS;IACT,QAAQ,EAAE,MAAM,qBAAqB;IACtC;GACF,CAAC,CAEU,OAAO,CAAC,KAAK,0BAA0B;GACnD;AAEF,gBAAG,kEAAkE;EACnE,MAAM,gDAA0B;GAC9B,WAAW;GACX,MAAM;IACJ,SAAS;IACT,QAAQ,EAAE,MAAM,qBAAqB;IACrC,QAAQ;KAAE,MAAM;KAAU,KAAK;KAAqB,SAAS;KAAG;IACjE;GACF,CAAC;AAEF,qBAAO,KAAK,OAAO,CAAC,KAAK,0BAA0B;AACnD,qBAAO,KAAK,OAAO,CAAC,KAAK,oBAAoB;GAC7C;AAEF,gBAAG,qDAAqD;AACtD,oEAAgC;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS;IAAE,MAAM;IAAU,KAAK;IAAmB,SAAS;IAAG,EAChE;GACF,CAAC,CAAC,CAAC,aAAa,0BAA0B;GAC3C;AAEF,gBAAG,8DAA8D;EAC/D,MAAM,mDAA6B,SAAS;AAC5C,MAAI,gBAAgB,KAClB,OAAM,IAAI,MAAM,2CAA2C;AAU7D,8DAPgC;GAC9B,WAAW;GACX,MAAM,EACJ,QAAQ;IAAE,MAAM;IAAU,KAAK;IAAmB,SAAS,aAAa;IAAe,EACxF;GACF,CAAC,CAEU,OAAO,CAAC,KAAK,kBAAkB;GAC3C;AAEF,gBAAG,kFAAkF;EACnF,MAAM,mDAA6B,SAAS;AAC5C,MAAI,gBAAgB,KAClB,OAAM,IAAI,MAAM,2CAA2C;AAG7D,oEAAgC;GAC9B,WAAW;GACX,MAAM,EACJ,QAAQ;IAAE,MAAM;IAAU,KAAK;IAAmB,SAAS,aAAa,gBAAgB;IAAG,EAC5F;GACF,CAAC,CAAC,CAAC,aAAa,kCAAkC;GACnD;AAEF,gBAAG,4DAA4D;AAC7D,oEAAgC;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS;IAAE,MAAM;IAAU,KAAK;IAAmB,SAAS;IAAG,EAChE;GACF,CAAC,CAAC,CAAC,aAAa,0BAA0B;GAC3C;AAEF,gBAAG,mDAAmD;AACpD,YAAG,QAAQ,kDAAkD,6BAA6B;EAE1F,MAAM,gDAA0B;GAC9B,WAAW;GACX,MAAM;IACJ,QAAQ;IACR,SAAS,EAAE,MAAM,UAAU;IAC5B;GACF,CAAC;AAEF,qBAAO,KAAK,OAAO,CAAC,KAAK,WAAW;AACpC,qBAAO,KAAK,OAAO,CAAC,KAAK,+DAA+D;AACxF,qBAAO,KAAK,eAAe,CAAC,KAAK,wEAAwE;GACzG;AAEF,gBAAG,wDAAwD;AACzD,oEAAgC;GAC9B,WAAW;GACX,MAAM,EACJ,eAAe,2CAChB;GACF,CAAC,CAAC,CAAC,mCAAmC;;;;MAIrC;GACF;AAEF,gBAAG,wDAAwD;AACzD,oEAAgC;GAC9B,WAAW;GACX,MAAM,EACJ,eAAe;IAAE,MAAM;IAAU,KAAK;IAA2C,SAAS;IAAG,EAC9F;GACF,CAAC,CAAC,CAAC,mCAAmC;;;;MAIrC;GACF;AAEF,gBAAG,4EAA4E;EAC7E,MAAM,gDAA0B;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS,oCACV;GACF,CAAC;AAEF,qBAAO,KAAK,OAAO,CAAC,KAAK,mCAAmC;AAC5D,qBAAO,KAAK,cAAc,CAAC,KAAK,0BAA0B;GAC1D;AAEF,gBAAG,uDAAuD;EACxD,MAAM,2DAAqC,iBAAiB;AAC5D,MAAI,wBAAwB,KAC1B,OAAM,IAAI,MAAM,mDAAmD;AAUrE,8DAPgC;GAC9B,WAAW;GACX,MAAM,EACJ,gBAAgB;IAAE,MAAM;IAAU,KAAK;IAAkB,SAAS,qBAAqB;IAAe,EACvG;GACF,CAAC,CAEU,eAAe,CAAC,KAAK,iBAAiB;GAClD;AAEF,gBAAG,0EAA0E;AAC3E,kEAA8B;GAC5B,mBAAmB;GACnB,QAAQ;GACR,WAAW;GACZ,CAAC,CAAC,CAAC,KAAK,+DAA+D;GACxE;AAEF,gBAAG,0DAA0D;AAC3D,YAAG,QAAQ,kDAAkD,6BAA6B;AAQ1F,gFANiD;GAC/C,eAAe,EAAE,MAAM,UAAU;GACjC,WAAW;GACX,aAAa;GACd,CAAC,CAES,CAAC,KAAK,mEAAmE;GACpF;AAEF,gBAAG,mEAAmE;AACpE,YAAG,QAAQ,iDAAiD,mFAAmF;AAC/I,YAAG,QAAQ,iCAAiC,KAAK;EAEjD,MAAM,gDAA0B;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS,EAAE,MAAM,UAAU,EAC5B;GACF,CAAC;AAEF,qBAAO,KAAK,OAAO,CAAC,KAAK,mDAAmD;AAC5E,qBAAO,KAAK,gBAAgB,CAAC,KAAK,4DAA4D;GAC9F;AAEF,gBAAG,gEAAgE;AACjE,YAAG,QAAQ,iDAAiD,4CAA4C;AAExG,oEAAgC;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS,EAAE,MAAM,UAAU,EAC5B;GACF,CAAC,CAAC,CAAC,aAAa,mCAAmC;GACpD;AAEF,gBAAG,kFAAkF;AACnF,YAAG,QAAQ,iDAAiD,iDAAiD;AAE7G,oEAAgC;GAC9B,WAAW;GACX,MAAM,EACJ,SAAS,EAAE,MAAM,UAAU,EAC5B;GACF,CAAC,CAAC,CAAC,mCAAmC;;;;MAIrC;GACF;EACF;qBAEO,iCAAiC;AACxC,gBAAG,uDAAuD;AACxD,mEAA+B;GAC7B,WAAW;GACX,aAAa;GACb,eAAe;GAChB,CAAC,CAAC,CAAC,KAAK,KAAK;GACd;AAEF,gBAAG,mEAAmE;AACpE,mEAA+B;GAC7B,WAAW;GACX,aAAa;GACb,eAAe;GAChB,CAAC,CAAC,CAAC,KAAK,KAAK;GACd;AAEF,gBAAG,wEAAwE;AACzE,mEAA+B;GAC7B,WAAW;GACX,aAAa;GACb,eAAe;GAChB,CAAC,CAAC,CAAC,KAAK,MAAM;GACf;AAEF,gBAAG,uDAAuD;AACxD,mEAA+B;GAC7B,WAAW;GACX,aAAa;GACb,eAAe;GAChB,CAAC,CAAC,CAAC,KAAK,MAAM;GACf;EACF"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY, INSTEAD EDIT THE CORRESPONDING FILE IN packages/template (FOR package.json FILES, PLEASE EDIT package-template.json)",
   "name": "@stackframe/tanstack-start",
-  "version": "2.8.93",
+  "version": "2.8.95",
   "repository": "https://github.com/hexclave/stack-auth",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -76,8 +76,8 @@
     "rrweb": "^1.1.3",
     "tsx": "^4.21.0",
     "yup": "^1.7.1",
-    "@stackframe/stack-shared": "2.8.93",
-    "@stackframe/stack-ui": "2.8.93"
+    "@stackframe/stack-shared": "2.8.95",
+    "@stackframe/stack-ui": "2.8.95"
   },
   "peerDependencies": {
     "@types/react": ">=18.3.0",