handzon-core 0.12.0 → 0.12.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "handzon-core",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Core framework for Handzon — layouts, components, content + AI libs, and server runtime (handlers, DB, auth, migration runner) consumed by Handzon scaffolds.",
   "publishConfig": {
     "access": "public"

package/src/server/auth/config.ts

@@ -56,6 +56,12 @@ function resolveAuthUrl(): string | undefined {
   return undefined;
 }
 
+function resolveAuthPrefix(): string {
+  const base = import.meta.env.BASE_URL;
+  const normalizedBase = base === "/" ? "" : base.replace(/\/$/, "");
+  return `${normalizedBase}/api/auth`;
+}
+
 export function createAuthConfig({ db }: AuthConfigOptions) {
   // Auth.js v5 reads `AUTH_URL` from process.env on each request, so
   // we resolve once and write it back. Idempotent: if AUTH_URL was
@@ -73,6 +79,11 @@ export function createAuthConfig({ db }: AuthConfigOptions) {
     return defineConfig({ providers: [] });
   }
   return defineConfig({
+    // auth-astro defaults to /api/auth, but Astro apps mounted with
+    // `base` receive requests at /<base>/api/auth. Use the same base
+    // that powers app links and API calls so the catch-all auth route
+    // returns a Response instead of falling through with undefined.
+    prefix: resolveAuthPrefix(),
     adapter: DrizzleAdapter(db, {
       usersTable: users,
       accountsTable: accounts,