From dd48f4fddcca5d418adf5f4909b180d9e8fd7b5e Mon Sep 17 00:00:00 2001
From: Konstantin Wohlwend <n2d4xc@gmail.com>
Date: Tue, 5 Aug 2025 17:31:04 -0700
Subject: [PATCH 01/16] Wildcard domains

---
 .claude/settings.json                         |  30 ++
 CLAUDE-KNOWLEDGE.md                           | 125 +++++
 CLAUDE.md                                     |  27 +-
 .../oauth/callback/[provider_id]/route.tsx    |   3 +-
 .../register/verification-code-handler.tsx    |  30 +-
 .../sign-in/verification-code-handler.tsx     |  29 +-
 apps/backend/src/lib/redirect-urls.test.tsx   | 462 +++++++++++++++++
 apps/backend/src/lib/redirect-urls.tsx        |  99 +++-
 apps/backend/src/oauth/model.tsx              |  10 +-
 .../[projectId]/domains/page-client.tsx       |  20 +-
 .../auth/oauth/exact-domain-matching.test.ts  | 284 ++++++++++
 .../v1/auth/oauth/wildcard-domains.test.ts    | 313 +++++++++++
 .../v1/auth/passkey/wildcard-domains.test.ts  | 484 ++++++++++++++++++
 .../src/helpers/production-mode.ts            |   4 +-
 packages/stack-shared/src/utils/urls.tsx      | 142 +++++
 15 files changed, 1983 insertions(+), 79 deletions(-)
 create mode 100644 .claude/settings.json
 create mode 100644 CLAUDE-KNOWLEDGE.md
 create mode 100644 apps/backend/src/lib/redirect-urls.test.tsx
 create mode 100644 apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts
 create mode 100644 apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
 create mode 100644 apps/e2e/tests/backend/endpoints/api/v1/auth/passkey/wildcard-domains.test.ts

diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 0000000000..ee52ce43b2
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,30 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "permissions": {
+    "allow": [
+      "Bash(pnpm typecheck:*)",
+      "Bash(pnpm test:*)",
+      "Bash(pnpm lint:*)",
+      "Bash(find:*)",
+      "Bash(ls:*)",
+      "Bash(pnpm codegen)",
+      "Bash(pnpm vitest run:*)",
+      "Bash(pnpm eslint:*)"
+    ],
+    "deny": []
+  },
+  "includeCoAuthoredBy": false,
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "Edit|MultiEdit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "pnpm run lint --fix"
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/CLAUDE-KNOWLEDGE.md b/CLAUDE-KNOWLEDGE.md
new file mode 100644
index 0000000000..9857ba1196
--- /dev/null
+++ b/CLAUDE-KNOWLEDGE.md
@@ -0,0 +1,125 @@
+# CLAUDE-KNOWLEDGE.md
+
+This file documents key learnings from implementing wildcard domain support in Stack Auth, organized in Q&A format.
+
+## OAuth Flow and Validation
+
+### Q: Where does OAuth redirect URL validation happen in the flow?
+A: The validation happens in the callback endpoint (`/api/v1/auth/oauth/callback/[provider_id]/route.tsx`), not in the authorize endpoint. The authorize endpoint just stores the redirect URL and redirects to the OAuth provider. The actual validation occurs when the OAuth provider calls back, and the oauth2-server library validates the redirect URL.
+
+### Q: How do you test OAuth flows that should fail?
+A: Use `Auth.OAuth.getMaybeFailingAuthorizationCode()` instead of `Auth.OAuth.getAuthorizationCode()`. The latter expects success (status 303), while the former allows you to test failure cases. The failure happens at the callback stage with a 400 status and specific error message.
+
+### Q: What error is thrown for invalid redirect URLs in OAuth?
+A: The callback endpoint returns a 400 status with the message: "Invalid redirect URI. The URL you are trying to redirect to is not trusted. If it should be, add it to the list of trusted domains in the Stack Auth dashboard."
+
+## Wildcard Pattern Implementation
+
+### Q: How do you handle ** vs * precedence in regex patterns?
+A: Use a placeholder approach to prevent ** from being corrupted when replacing *:
+```typescript
+const doubleWildcardPlaceholder = '\x00DOUBLE_WILDCARD\x00';
+regexPattern = regexPattern.replace(/\*\*/g, doubleWildcardPlaceholder);
+regexPattern = regexPattern.replace(/\*/g, '[^.]*');
+regexPattern = regexPattern.replace(new RegExp(doubleWildcardPlaceholder, 'g'), '.*');
+```
+
+### Q: Why can't you use `new URL()` with wildcard domains?
+A: Wildcard characters (* and **) are not valid in URLs and will cause parsing errors. For wildcard domains, you need to manually parse the URL components instead of using the URL constructor.
+
+### Q: How do you validate URLs with wildcards?
+A: Extract the hostname pattern manually and use `matchHostnamePattern()`:
+```typescript
+const protocolEnd = domain.baseUrl.indexOf('://');
+const protocol = domain.baseUrl.substring(0, protocolEnd + 3);
+const afterProtocol = domain.baseUrl.substring(protocolEnd + 3);
+const pathStart = afterProtocol.indexOf('/');
+const hostnamePattern = pathStart === -1 ? afterProtocol : afterProtocol.substring(0, pathStart);
+```
+
+## Testing Best Practices
+
+### Q: How should you run multiple independent test commands?
+A: Use parallel execution by batching tool calls together:
+```typescript
+// Good - runs in parallel
+const [result1, result2] = await Promise.all([
+  niceBackendFetch("/endpoint1"),
+  niceBackendFetch("/endpoint2")
+]);
+
+// In E2E tests, the framework handles this automatically when you
+// batch multiple tool calls in a single response
+```
+
+### Q: What's the correct way to update project configuration in E2E tests?
+A: Use the `/api/v1/internal/config/override` endpoint with PATCH method and admin access token:
+```typescript
+await niceBackendFetch("/api/v1/internal/config/override", {
+  method: "PATCH",
+  accessType: "admin",
+  headers: {
+    'x-stack-admin-access-token': adminAccessToken,
+  },
+  body: {
+    config_override_string: JSON.stringify({
+      'domains.trustedDomains.name': { baseUrl: '...', handlerPath: '...' }
+    }),
+  },
+});
+```
+
+## Code Organization
+
+### Q: Where does domain validation logic belong?
+A: Core validation functions (`isValidHostnameWithWildcards`, `matchHostnamePattern`) belong in the shared utils package (`packages/stack-shared/src/utils/urls.tsx`) so they can be used by both frontend and backend.
+
+### Q: How do you simplify validation logic with wildcards?
+A: Replace wildcards with valid placeholders before validation:
+```typescript
+const normalizedDomain = domain.replace(/\*+/g, 'wildcard-placeholder');
+url = new URL(normalizedDomain); // Now this won't throw
+```
+
+## Debugging E2E Tests
+
+### Q: What does "ECONNREFUSED" mean in E2E tests?
+A: The backend server isn't running. Make sure to start the backend with `pnpm dev` before running E2E tests.
+
+### Q: How do you debug which stage of OAuth flow is failing?
+A: Check the error location:
+- Authorize endpoint (307 redirect) - Initial request succeeded
+- Callback endpoint (400 error) - Validation failed during callback
+- Token endpoint (400 error) - Validation failed during token exchange
+
+## Git and Development Workflow
+
+### Q: How should you format git commit messages in this project?
+A: Use a HEREDOC to ensure proper formatting:
+```bash
+git commit -m "$(cat <<'EOF'
+Commit message here.
+
+🤖 Generated with [Claude Code](https://claude.ai/code)
+
+Co-Authored-By: Claude <noreply@anthropic.com>
+EOF
+)"
+```
+
+### Q: What commands should you run before considering a task complete?
+A: Always run:
+1. `pnpm test run <relevant-test-files>` - Run tests
+2. `pnpm lint` - Check for linting errors
+3. `pnpm typecheck` - Check for TypeScript errors
+
+## Common Pitfalls
+
+### Q: Why might imports get removed after running lint --fix?
+A: ESLint may remove "unused" imports. Always verify your changes after auto-fixing, especially if you're using imports in a way ESLint doesn't recognize (like in test expectations).
+
+### Q: What's a common linting error in test files?
+A: Missing newline at end of file. ESLint requires files to end with a newline character.
+
+### Q: How do you handle TypeScript errors about missing exports?
+A: Double-check that you're only importing what's actually exported from a module. The error "Module declares 'X' locally, but it is not exported" means you're trying to import something that isn't exported.
\ No newline at end of file
diff --git a/CLAUDE.md b/CLAUDE.md
index 18b87fbb14..cac840b9a3 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -6,18 +6,22 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ### Essential Commands
 - **Install dependencies**: `pnpm install`
+- **Run tests**: `pnpm test run` (uses Vitest). You can filter with `pnpm test run <file-filters>`. The `run` is important to not trigger watch mode
+- **Lint code**: `pnpm lint`. `pnpm lint --fix` will fix some of the linting errors, prefer that over fixing them manually.
+- **Type check**: `pnpm typecheck`
+
+#### Extra commands
+These commands are usually already called by the user, but you can remind them to run it for you if they forgot to.
 - **Build packages**: `pnpm build:packages`
 - **Generate code**: `pnpm codegen`
 - **Start dependencies**: `pnpm restart-deps` (resets & restarts Docker containers for DB, Inbucket, etc. Usually already called by the user)
 - **Run development**: `pnpm dev` (starts all services on different ports. Usually already started by the user in the background)
 - **Run minimal dev**: `pnpm dev:basic` (only backend and dashboard for resource-limited systems)
-- **Run tests**: `pnpm test --no-watch` (uses Vitest). You can filter with `pnpm test --no-watch <file-filters>`
-- **Lint code**: `pnpm lint`
-- **Type check**: `pnpm typecheck`
 
 ### Testing
-- **Run all tests**: `pnpm test --no-watch`
-- **Run some tests**: `pnpm test --no-watch <file-filters>`
+You should ALWAYS add new E2E tests when you change the API or SDK interface. Generally, err on the side of creating too many tests; it is super important that our codebase is well-tested, due to the nature of the industry we're building in.
+- **Run all tests**: `pnpm test run`
+- **Run some tests**: `pnpm test run <file-filters>`
 
 ### Database Commands
 - **Generate migration**: `pnpm db:migration-gen`
@@ -62,15 +66,12 @@ The API follows a RESTful design with routes organized by resource type:
 - OAuth providers: `/api/latest/oauth-providers/*`
 
 ### Development Ports
-- 8100: Dev launchpad
-- 8101: Dashboard
-- 8102: Backend API
-- 8103: Demo app
-- 8104: Documentation
-- 8105: Inbucket (email testing)
-- 8106: Prisma Studio
+To see all development ports, refer to the index.html of `apps/dev-launchpad/public/index.html`.
 
 ## Important Notes
 - Environment variables are pre-configured in `.env.development` files
-- Code generation (`pnpm codegen`) must be run after schema changes
+- Always run typecheck, lint, and test to make sure your changes are working as expected. You can save time by only linting and testing the files you've changed (and/or related E2E tests).
 - The project uses a custom route handler system in the backend for consistent API responses
+- Sometimes, the typecheck will give errors along the line of "Cannot assign Buffer to Uint8Array" or similar, on changes that are completely unrelated to your own changes. If that happens, tell the user to run `pnpm clean && pnpm i && pnpm run codegen && pnpm build:packages`, and restart the dev server (you cannot run this yourself). After that's done, the typecheck should pass.
+- When writing tests, prefer .toMatchInlineSnapshot over other selectors, if possible. You can check (and modify) the snapshot-serializer.ts file to see how the snapshots are formatted and how non-deterministic values are handled.
+- Whenever you learn something new, or at the latest right before you call the `Stop` tool, write whatever you learned into the CLAUDE-KNOWLEDGE.md file, in the Q&A format in there. You will later be able to look up knowledge from there (based on the question you asked).
diff --git a/apps/backend/src/app/api/latest/auth/oauth/callback/[provider_id]/route.tsx b/apps/backend/src/app/api/latest/auth/oauth/callback/[provider_id]/route.tsx
index 62bafd0c4d..c675751b69 100644
--- a/apps/backend/src/app/api/latest/auth/oauth/callback/[provider_id]/route.tsx
+++ b/apps/backend/src/app/api/latest/auth/oauth/callback/[provider_id]/route.tsx
@@ -403,7 +403,8 @@ const handler = createSmartRouteHandler({
       } catch (error) {
         if (error instanceof InvalidClientError) {
           if (error.message.includes("redirect_uri") || error.message.includes("redirectUri")) {
-            throw new StatusError(400, "Invalid redirect URI. You might have set the wrong redirect URI in the OAuth provider settings. (Please copy the redirect URI from the Stack Auth dashboard and paste it into the OAuth provider's dashboard)");
+            console.log("User is trying to authorize OAuth with an invalid redirect URI", error, oauthRequest);
+            throw new StatusError(400, "Invalid redirect URI. The URL you are trying to redirect to is not trusted. If it should be, add it to the list of trusted domains in the Stack Auth dashboard.");
           }
         } else if (error instanceof InvalidScopeError) {
           // which scopes are being requested, and by whom?
diff --git a/apps/backend/src/app/api/latest/auth/passkey/register/verification-code-handler.tsx b/apps/backend/src/app/api/latest/auth/passkey/register/verification-code-handler.tsx
index a2de637c49..44ac869a17 100644
--- a/apps/backend/src/app/api/latest/auth/passkey/register/verification-code-handler.tsx
+++ b/apps/backend/src/app/api/latest/auth/passkey/register/verification-code-handler.tsx
@@ -1,3 +1,4 @@
+import { validateRedirectUrl } from "@/lib/redirect-urls";
 import { getPrismaClientForTenancy, retryTransaction } from "@/prisma-client";
 import { createVerificationCodeHandler } from "@/route-handlers/verification-code-handler";
 import { VerificationCodeType } from "@prisma/client";
@@ -50,35 +51,16 @@ export const registerVerificationCodeHandler = createVerificationCodeHandler({
     }
 
     // HACK: we validate origin and rpid outside of simpleauth, this should be replaced once we have a primary authentication domain
-
-    let expectedRPID = "";
-    let expectedOrigin = "";
     const clientDataJSON = decodeClientDataJSON(credential.response.clientDataJSON);
     const { origin } = clientDataJSON;
-    const localhostAllowed = tenancy.config.domains.allowLocalhost;
-    const parsedOrigin = new URL(origin);
-    const isLocalhost = parsedOrigin.hostname === "localhost";
-
-    if (!localhostAllowed && isLocalhost) {
-      throw new KnownErrors.PasskeyAuthenticationFailed("Passkey registration failed because localhost is not allowed");
-    }
 
-    if (localhostAllowed && isLocalhost) {
-      expectedRPID = parsedOrigin.hostname;
-      expectedOrigin = origin;
+    if (!validateRedirectUrl(origin, tenancy)) {
+      throw new KnownErrors.PasskeyRegistrationFailed("Passkey registration failed because the origin is not allowed");
     }
 
-    if (!isLocalhost) {
-      if (!Object.values(tenancy.config.domains.trustedDomains)
-        .filter(e => e.baseUrl)
-        .map(e => e.baseUrl)
-        .includes(parsedOrigin.origin)) {
-        throw new KnownErrors.PasskeyAuthenticationFailed("Passkey registration failed because the origin is not allowed");
-      } else {
-        expectedRPID = parsedOrigin.hostname;
-        expectedOrigin = origin;
-      }
-    }
+    const parsedOrigin = new URL(origin);
+    const expectedRPID = parsedOrigin.hostname;
+    const expectedOrigin = origin;
 
 
     let verification;
diff --git a/apps/backend/src/app/api/latest/auth/passkey/sign-in/verification-code-handler.tsx b/apps/backend/src/app/api/latest/auth/passkey/sign-in/verification-code-handler.tsx
index 690c0753a5..842bb3d4f7 100644
--- a/apps/backend/src/app/api/latest/auth/passkey/sign-in/verification-code-handler.tsx
+++ b/apps/backend/src/app/api/latest/auth/passkey/sign-in/verification-code-handler.tsx
@@ -1,3 +1,4 @@
+import { validateRedirectUrl } from "@/lib/redirect-urls";
 import { createAuthTokens } from "@/lib/tokens";
 import { getPrismaClientForTenancy } from "@/prisma-client";
 import { createVerificationCodeHandler } from "@/route-handlers/verification-code-handler";
@@ -63,34 +64,16 @@ export const passkeySignInVerificationCodeHandler = createVerificationCodeHandle
     }
 
     // HACK: we validate origin and rpid outside of simpleauth, this should be replaced once we have a primary authentication domain
-    let expectedRPID = "";
-    let expectedOrigin = "";
     const clientDataJSON = decodeClientDataJSON(authentication_response.response.clientDataJSON);
     const { origin } = clientDataJSON;
-    const localhostAllowed = tenancy.config.domains.allowLocalhost;
-    const parsedOrigin = new URL(origin);
-    const isLocalhost = parsedOrigin.hostname === "localhost";
-
-    if (!localhostAllowed && isLocalhost) {
-      throw new KnownErrors.PasskeyAuthenticationFailed("Passkey authentication failed because localhost is not allowed");
-    }
 
-    if (localhostAllowed && isLocalhost) {
-      expectedRPID = parsedOrigin.hostname;
-      expectedOrigin = origin;
+    if (!validateRedirectUrl(origin, tenancy)) {
+      throw new KnownErrors.PasskeyAuthenticationFailed("Passkey authentication failed because the origin is not allowed");
     }
 
-    if (!isLocalhost) {
-      if (!Object.values(tenancy.config.domains.trustedDomains)
-        .filter(e => e.baseUrl)
-        .map(e => e.baseUrl)
-        .includes(parsedOrigin.origin)) {
-        throw new KnownErrors.PasskeyAuthenticationFailed("Passkey authentication failed because the origin is not allowed");
-      } else {
-        expectedRPID = parsedOrigin.hostname;
-        expectedOrigin = origin;
-      }
-    }
+    const parsedOrigin = new URL(origin);
+    const expectedRPID = parsedOrigin.hostname;
+    const expectedOrigin = origin;
 
     let authVerify;
     authVerify = await verifyAuthenticationResponse({
diff --git a/apps/backend/src/lib/redirect-urls.test.tsx b/apps/backend/src/lib/redirect-urls.test.tsx
new file mode 100644
index 0000000000..efa71819eb
--- /dev/null
+++ b/apps/backend/src/lib/redirect-urls.test.tsx
@@ -0,0 +1,462 @@
+import { describe, it, expect } from 'vitest';
+import { validateRedirectUrl } from './redirect-urls';
+import { Tenancy } from './tenancies';
+
+describe('validateRedirectUrl', () => {
+  const createMockTenancy = (config: Partial<Tenancy['config']>): Tenancy => {
+    return {
+      config: {
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {},
+          ...config.domains,
+        },
+        ...config,
+      },
+    } as Tenancy;
+  };
+
+  describe('exact domain matching', () => {
+    it('should validate exact domain matches', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://example.com', handlerPath: '/handler' },
+          },
+        },
+      });
+
+      expect(validateRedirectUrl('https://example.com/handler', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://example.com/handler/callback', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://example.com/other', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://other.com/handler', tenancy)).toBe(false);
+    });
+
+    it('should validate protocol matching', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://example.com', handlerPath: '/handler' },
+          },
+        },
+      });
+
+      expect(validateRedirectUrl('https://example.com/handler', tenancy)).toBe(true);
+      expect(validateRedirectUrl('http://example.com/handler', tenancy)).toBe(false);
+    });
+  });
+
+  describe('wildcard domain matching', () => {
+    it('should validate single wildcard subdomain patterns', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://*.example.com', handlerPath: '/handler' },
+          },
+        },
+      });
+
+      expect(validateRedirectUrl('https://api.example.com/handler', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://www.example.com/handler', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://staging.example.com/handler', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://example.com/handler', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://api.v2.example.com/handler', tenancy)).toBe(false);
+    });
+
+    it('should validate double wildcard patterns', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://**.example.com', handlerPath: '/handler' },
+          },
+        },
+      });
+
+      expect(validateRedirectUrl('https://api.example.com/handler', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://api.v2.example.com/handler', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://a.b.c.example.com/handler', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://example.com/handler', tenancy)).toBe(false);
+    });
+
+    it('should validate wildcard patterns with prefixes', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://api-*.example.com', handlerPath: '/handler' },
+          },
+        },
+      });
+
+      expect(validateRedirectUrl('https://api-v1.example.com/handler', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://api-v2.example.com/handler', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://api-prod.example.com/handler', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://api.example.com/handler', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://v1-api.example.com/handler', tenancy)).toBe(false);
+    });
+
+    it('should validate multiple wildcard patterns', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://*.*.org', handlerPath: '/handler' },
+          },
+        },
+      });
+
+      expect(validateRedirectUrl('https://mail.example.org/handler', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://api.company.org/handler', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://example.org/handler', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://a.b.c.org/handler', tenancy)).toBe(false);
+    });
+  });
+
+  describe('localhost handling', () => {
+    it('should allow localhost when configured', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: true,
+          trustedDomains: {},
+        },
+      });
+
+      expect(validateRedirectUrl('http://localhost/callback', tenancy)).toBe(true);
+      expect(validateRedirectUrl('http://localhost:3000/callback', tenancy)).toBe(true);
+      expect(validateRedirectUrl('http://127.0.0.1/callback', tenancy)).toBe(true);
+      expect(validateRedirectUrl('http://sub.localhost/callback', tenancy)).toBe(true);
+    });
+
+    it('should reject localhost when not configured', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {},
+        },
+      });
+
+      expect(validateRedirectUrl('http://localhost/callback', tenancy)).toBe(false);
+      expect(validateRedirectUrl('http://127.0.0.1/callback', tenancy)).toBe(false);
+    });
+  });
+
+  describe('path validation', () => {
+    it('should validate handler path matching', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://example.com', handlerPath: '/auth/handler' },
+          },
+        },
+      });
+
+      expect(validateRedirectUrl('https://example.com/auth/handler', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://example.com/auth/handler/callback', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://example.com/auth', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://example.com/other/handler', tenancy)).toBe(false);
+    });
+
+    it('should work with wildcard domains and path validation', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://*.example.com', handlerPath: '/api/auth' },
+          },
+        },
+      });
+
+      expect(validateRedirectUrl('https://api.example.com/api/auth', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://app.example.com/api/auth/callback', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://api.example.com/api', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://api.example.com/other/auth', tenancy)).toBe(false);
+    });
+  });
+
+  describe('port number handling with wildcards', () => {
+    it('should handle exact domain without port (defaults to standard ports)', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://localhost', handlerPath: '/' },
+          },
+        },
+      });
+
+      // https://localhost should match https://localhost:443 (default HTTPS port)
+      expect(validateRedirectUrl('https://localhost/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://localhost:443/', tenancy)).toBe(true);
+
+      // Should NOT match other ports
+      expect(validateRedirectUrl('https://localhost:3000/', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://localhost:8080/', tenancy)).toBe(false);
+    });
+
+    it('should handle http domain without port (defaults to port 80)', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'http://localhost', handlerPath: '/' },
+          },
+        },
+      });
+
+      // http://localhost should match http://localhost:80 (default HTTP port)
+      expect(validateRedirectUrl('http://localhost/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('http://localhost:80/', tenancy)).toBe(true);
+
+      // Should NOT match other ports
+      expect(validateRedirectUrl('http://localhost:3000/', tenancy)).toBe(false);
+      expect(validateRedirectUrl('http://localhost:8080/', tenancy)).toBe(false);
+    });
+
+    it('should handle wildcard with port pattern to match any port', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://localhost:*', handlerPath: '/' },
+          },
+        },
+      });
+
+      // Should match localhost on any port
+      expect(validateRedirectUrl('https://localhost/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://localhost:443/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://localhost:3000/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://localhost:8080/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://localhost:12345/', tenancy)).toBe(true);
+
+      // Should NOT match different hostnames
+      expect(validateRedirectUrl('https://example.com:3000/', tenancy)).toBe(false);
+    });
+
+    it('should handle subdomain wildcard without affecting port matching', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://*.localhost', handlerPath: '/' },
+          },
+        },
+      });
+
+      // Should match subdomains on default port only
+      expect(validateRedirectUrl('https://api.localhost/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://api.localhost:443/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://app.localhost/', tenancy)).toBe(true);
+
+      // Should NOT match subdomains on other ports
+      expect(validateRedirectUrl('https://api.localhost:3000/', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://app.localhost:8080/', tenancy)).toBe(false);
+
+      // Should NOT match the base domain (no subdomain)
+      expect(validateRedirectUrl('https://localhost/', tenancy)).toBe(false);
+    });
+
+    it('should handle subdomain wildcard WITH port wildcard', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://*.localhost:*', handlerPath: '/' },
+          },
+        },
+      });
+
+      // Should match subdomains on any port
+      expect(validateRedirectUrl('https://api.localhost/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://api.localhost:3000/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://app.localhost:8080/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://staging.localhost:12345/', tenancy)).toBe(true);
+
+      // Should NOT match the base domain (no subdomain)
+      expect(validateRedirectUrl('https://localhost:3000/', tenancy)).toBe(false);
+    });
+
+    it('should handle TLD wildcard without affecting port', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://localhost.*', handlerPath: '/' },
+          },
+        },
+      });
+
+      // Should match different TLDs on default port
+      expect(validateRedirectUrl('https://localhost.de/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://localhost.com/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://localhost.org/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://localhost.de:443/', tenancy)).toBe(true);
+
+      // Should NOT match different TLDs on other ports
+      expect(validateRedirectUrl('https://localhost.de:3000/', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://localhost.com:8080/', tenancy)).toBe(false);
+
+      // Should NOT match without TLD
+      expect(validateRedirectUrl('https://localhost/', tenancy)).toBe(false);
+    });
+
+    it('should handle specific port in wildcard pattern', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://*.example.com:8080', handlerPath: '/' },
+          },
+        },
+      });
+
+      // Should match subdomains only on port 8080
+      expect(validateRedirectUrl('https://api.example.com:8080/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://app.example.com:8080/', tenancy)).toBe(true);
+
+      // Should NOT match on other ports
+      expect(validateRedirectUrl('https://api.example.com/', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://api.example.com:443/', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://api.example.com:3000/', tenancy)).toBe(false);
+    });
+
+    it('should handle double wildcard with port patterns', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://**.example.com:*', handlerPath: '/' },
+          },
+        },
+      });
+
+      // Should match any subdomain depth on any port
+      expect(validateRedirectUrl('https://api.example.com:3000/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://api.v2.example.com:8080/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://staging.api.v2.example.com:12345/', tenancy)).toBe(true);
+
+      // Should NOT match base domain
+      expect(validateRedirectUrl('https://example.com:3000/', tenancy)).toBe(false);
+    });
+
+    it('should handle single wildcard (*:*) pattern correctly', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'http://*:*', handlerPath: '/' },
+          },
+        },
+      });
+
+      // * matches single level (no dots), so should match simple hostnames on any port
+      expect(validateRedirectUrl('http://localhost:3000/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('http://localhost:8080/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('http://app:12345/', tenancy)).toBe(true);
+
+      // Should NOT match hostnames with dots (need ** for that)
+      expect(validateRedirectUrl('http://example.com:8080/', tenancy)).toBe(false);
+      expect(validateRedirectUrl('http://api.test.com:12345/', tenancy)).toBe(false);
+
+      // Should NOT match https (different protocol)
+      expect(validateRedirectUrl('https://localhost:3000/', tenancy)).toBe(false);
+    });
+
+    it('should handle double wildcard (**:*) pattern to match any hostname on any port', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'http://**:*', handlerPath: '/' },
+          },
+        },
+      });
+
+      // ** matches any characters including dots, so should match any hostname on any port
+      expect(validateRedirectUrl('http://localhost:3000/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('http://example.com:8080/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('http://api.test.com:12345/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('http://192.168.1.1:80/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('http://deeply.nested.subdomain.example.com:9999/', tenancy)).toBe(true);
+
+      // Should NOT match https (different protocol)
+      expect(validateRedirectUrl('https://localhost:3000/', tenancy)).toBe(false);
+    });
+
+    it('should correctly distinguish between port wildcard and subdomain wildcard', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://app-*.example.com', handlerPath: '/' },
+            '2': { baseUrl: 'https://api.example.com:*', handlerPath: '/' },
+          },
+        },
+      });
+
+      // First pattern should match app-* subdomains on default port
+      expect(validateRedirectUrl('https://app-v1.example.com/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://app-staging.example.com/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://app-v1.example.com:3000/', tenancy)).toBe(false);
+
+      // Second pattern should match api.example.com on any port
+      expect(validateRedirectUrl('https://api.example.com/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://api.example.com:3000/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://api.example.com:8080/', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://api-v1.example.com:3000/', tenancy)).toBe(false);
+    });
+  });
+
+  describe('edge cases', () => {
+    it('should handle invalid URLs', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://example.com', handlerPath: '/handler' },
+          },
+        },
+      });
+
+      expect(validateRedirectUrl('not-a-url', tenancy)).toBe(false);
+      expect(validateRedirectUrl('', tenancy)).toBe(false);
+      expect(validateRedirectUrl('javascript:alert(1)', tenancy)).toBe(false);
+    });
+
+    it('should handle missing baseUrl in domain config', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: undefined as any, handlerPath: '/handler' },
+          },
+        },
+      });
+
+      expect(validateRedirectUrl('https://example.com/handler', tenancy)).toBe(false);
+    });
+
+    it('should handle multiple trusted domains with wildcards', () => {
+      const tenancy = createMockTenancy({
+        domains: {
+          allowLocalhost: false,
+          trustedDomains: {
+            '1': { baseUrl: 'https://example.com', handlerPath: '/handler' },
+            '2': { baseUrl: 'https://*.staging.com', handlerPath: '/auth' },
+            '3': { baseUrl: 'https://**.production.com', handlerPath: '/callback' },
+          },
+        },
+      });
+
+      expect(validateRedirectUrl('https://example.com/handler', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://api.staging.com/auth', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://api.v2.production.com/callback', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://other.com/handler', tenancy)).toBe(false);
+    });
+  });
+});
diff --git a/apps/backend/src/lib/redirect-urls.tsx b/apps/backend/src/lib/redirect-urls.tsx
index 33acfa8135..23c6d0c164 100644
--- a/apps/backend/src/lib/redirect-urls.tsx
+++ b/apps/backend/src/lib/redirect-urls.tsx
@@ -1,5 +1,5 @@
 import { StackAssertionError, captureError } from "@stackframe/stack-shared/dist/utils/errors";
-import { createUrlIfValid, isLocalhost } from "@stackframe/stack-shared/dist/utils/urls";
+import { createUrlIfValid, isLocalhost, matchHostnamePattern } from "@stackframe/stack-shared/dist/utils/urls";
 import { Tenancy } from "./tenancies";
 
 export function validateRedirectUrl(
@@ -17,17 +17,94 @@ export function validateRedirectUrl(
     }
 
     const testUrl = url;
-    const baseUrl = createUrlIfValid(domain.baseUrl);
-    if (!baseUrl) {
-      captureError("invalid-redirect-domain", new StackAssertionError("Invalid redirect domain; maybe this should be fixed in the database", {
-        domain: domain.baseUrl,
-      }));
-      return false;
-    }
 
-    const sameOrigin = baseUrl.protocol === testUrl.protocol && baseUrl.hostname === testUrl.hostname;
-    const isSubPath = testUrl.pathname.startsWith(baseUrl.pathname);
+    // Check if the domain uses wildcards
+    const hasWildcard = domain.baseUrl.includes('*');
+
+    if (hasWildcard) {
+      // For wildcard domains, we need to parse the pattern manually
+      // Extract protocol, hostname pattern, and path
+      const protocolEnd = domain.baseUrl.indexOf('://');
+      if (protocolEnd === -1) {
+        captureError("invalid-redirect-domain", new StackAssertionError("Invalid domain format; missing protocol", {
+          domain: domain.baseUrl,
+        }));
+        return false;
+      }
+
+      const protocol = domain.baseUrl.substring(0, protocolEnd + 3);
+      const afterProtocol = domain.baseUrl.substring(protocolEnd + 3);
+      const pathStart = afterProtocol.indexOf('/');
+      const hostPattern = pathStart === -1 ? afterProtocol : afterProtocol.substring(0, pathStart);
+      const basePath = pathStart === -1 ? '/' : afterProtocol.substring(pathStart);
+
+      // Check protocol
+      if (testUrl.protocol + '//' !== protocol) {
+        return false;
+      }
+
+      // Check host (including port) with wildcard pattern
+      // We need to handle port matching correctly
+      const hasPortInPattern = hostPattern.includes(':');
+
+      if (hasPortInPattern) {
+        // Pattern includes port - match against full host (hostname:port)
+        // Need to normalize for default ports
+        let normalizedTestHost = testUrl.host;
+        if (testUrl.port === '' ||
+            (testUrl.protocol === 'https:' && testUrl.port === '443') ||
+            (testUrl.protocol === 'http:' && testUrl.port === '80')) {
+          // Add default port explicitly for matching when pattern has a port
+          const defaultPort = testUrl.protocol === 'https:' ? '443' : '80';
+          normalizedTestHost = testUrl.hostname + ':' + (testUrl.port || defaultPort);
+        }
+
+        if (!matchHostnamePattern(hostPattern, normalizedTestHost)) {
+          return false;
+        }
+      } else {
+        // Pattern doesn't include port - match hostname only and check port separately
+        if (!matchHostnamePattern(hostPattern, testUrl.hostname)) {
+          return false;
+        }
 
-    return sameOrigin && isSubPath;
+        // When no port is specified in pattern, only allow default ports
+        const isDefaultPort =
+          (testUrl.protocol === 'https:' && (testUrl.port === '' || testUrl.port === '443')) ||
+          (testUrl.protocol === 'http:' && (testUrl.port === '' || testUrl.port === '80'));
+
+        if (!isDefaultPort) {
+          return false;
+        }
+      }
+
+      // Check path
+      const handlerPath = domain.handlerPath || '/';
+      const fullBasePath = basePath === '/' ? handlerPath : basePath + handlerPath;
+      return testUrl.pathname.startsWith(fullBasePath);
+    } else {
+      // For non-wildcard domains, use the original logic
+      const baseUrl = createUrlIfValid(domain.baseUrl);
+      if (!baseUrl) {
+        captureError("invalid-redirect-domain", new StackAssertionError("Invalid redirect domain; maybe this should be fixed in the database", {
+          domain: domain.baseUrl,
+        }));
+        return false;
+      }
+
+      const protocolMatches = baseUrl.protocol === testUrl.protocol;
+      const hostnameMatches = baseUrl.hostname === testUrl.hostname;
+
+      // Check port matching for non-wildcard domains
+      const portMatches = baseUrl.port === testUrl.port ||
+        (baseUrl.port === '' && testUrl.protocol === 'https:' && testUrl.port === '443') ||
+        (baseUrl.port === '' && testUrl.protocol === 'http:' && testUrl.port === '80') ||
+        (testUrl.port === '' && baseUrl.protocol === 'https:' && baseUrl.port === '443') ||
+        (testUrl.port === '' && baseUrl.protocol === 'http:' && baseUrl.port === '80');
+
+      const pathMatches = testUrl.pathname.startsWith(domain.handlerPath || '/');
+
+      return protocolMatches && hostnameMatches && portMatches && pathMatches;
+    }
   });
 }
diff --git a/apps/backend/src/oauth/model.tsx b/apps/backend/src/oauth/model.tsx
index fd049393fc..eff9bd497b 100644
--- a/apps/backend/src/oauth/model.tsx
+++ b/apps/backend/src/oauth/model.tsx
@@ -52,9 +52,13 @@ export class OAuthModel implements AuthorizationCodeModel {
 
     let redirectUris: string[] = [];
     try {
-      redirectUris = Object.entries(tenancy.config.domains.trustedDomains).map(
-        ([_, domain]) => new URL(domain.handlerPath, domain.baseUrl).toString()
-      );
+      redirectUris = Object.entries(tenancy.config.domains.trustedDomains)
+        // note that this may include wildcard domains, which is fine because we correctly account for them in
+        // model.validateRedirectUri(...)
+        .filter(([_, domain]) => {
+          return domain.baseUrl;
+        })
+        .map(([_, domain]) => new URL(domain.handlerPath, domain.baseUrl).toString());
     } catch (e) {
       captureError("get-oauth-redirect-urls", {
         error: e,
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/domains/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/domains/page-client.tsx
index 7cd55b2e82..99fdee72b4 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/domains/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/domains/page-client.tsx
@@ -5,7 +5,7 @@ import { SettingCard, SettingSwitch } from "@/components/settings";
 import { AdminDomainConfig, AdminProject } from "@stackframe/stack";
 import { yupString } from "@stackframe/stack-shared/dist/schema-fields";
 import { StackAssertionError } from "@stackframe/stack-shared/dist/utils/errors";
-import { isValidHostname, isValidUrl } from "@stackframe/stack-shared/dist/utils/urls";
+import { isValidHostnameWithWildcards, isValidUrl } from "@stackframe/stack-shared/dist/utils/urls";
 import { Accordion, AccordionContent, AccordionItem, AccordionTrigger, ActionCell, ActionDialog, Alert, Button, Table, TableBody, TableCell, TableHead, TableHeader, TableRow, Typography } from "@stackframe/stack-ui";
 import React from "react";
 import * as yup from "yup";
@@ -35,7 +35,7 @@ function EditDialog(props: {
       .test({
         name: 'domain',
         message: (params) => `Invalid domain`,
-        test: (value) => value == null || isValidHostname(value)
+        test: (value) => value == null || isValidHostnameWithWildcards(value)
       })
       .test({
         name: 'unique-domain',
@@ -77,6 +77,11 @@ function EditDialog(props: {
       return false;
     }
 
+    // Don't allow adding www. to wildcard domains
+    if (domain.includes('*')) {
+      return false;
+    }
+
     const httpsUrl = 'https://' + domain;
     if (!isValidUrl(httpsUrl)) {
       return false;
@@ -153,7 +158,16 @@ function EditDialog(props: {
     render={(form) => (
       <>
         <Alert>
-          Please ensure you own or have control over this domain. Also note that each subdomain (e.g. blog.example.com, app.example.com) is treated as a distinct domain.
+          <div className="space-y-2">
+            <p>Please ensure you own or have control over this domain. Also note that each subdomain (e.g. blog.example.com, app.example.com) is treated as a distinct domain.</p>
+            <p><strong>Wildcard domains:</strong> You can use wildcards to match multiple domains:</p>
+            <ul className="list-disc list-inside ml-2 space-y-1">
+              <li><code>*.example.com</code> - matches any single subdomain (e.g., api.example.com, www.example.com)</li>
+              <li><code>**.example.com</code> - matches any subdomain level (e.g., api.v2.example.com)</li>
+              <li><code>api-*.example.com</code> - matches api-v1.example.com, api-prod.example.com, etc.</li>
+              <li><code>*.*.org</code> - matches mail.example.org, but not example.org</li>
+            </ul>
+          </div>
         </Alert>
         <InputField
           label="Domain"
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts
new file mode 100644
index 0000000000..dcc9027563
--- /dev/null
+++ b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts
@@ -0,0 +1,284 @@
+import { describe } from "vitest";
+import { it, localRedirectUrl } from "../../../../../../helpers";
+import { Auth, InternalApiKey, Project, niceBackendFetch } from "../../../../../backend-helpers";
+
+describe("OAuth with exact domain matching", () => {
+  it("should allow OAuth with exact matching domain", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        oauth_providers: [{ id: "spotify", type: "shared" }],
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Add exact domain that matches our redirect URL
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.exact': {
+            baseUrl: 'http://localhost:8107',
+            handlerPath: '/handler',
+          },
+          'domains.allowLocalhost': true,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // OAuth flow should succeed
+    const response = await Auth.OAuth.signIn();
+    expect(response.tokenResponse.status).toBe(200);
+    await Auth.expectToBeSignedIn();
+  });
+
+  it("should reject OAuth with non-matching exact domain", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        oauth_providers: [{ id: "spotify", type: "shared" }],
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Add exact domain that does NOT match
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.production': {
+            baseUrl: 'https://app.production.com',
+            handlerPath: '/auth/handler',
+          },
+          'domains.allowLocalhost': false, // Ensure we only check exact domains
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Try to complete the OAuth flow - it should fail at the callback stage
+    const { response } = await Auth.OAuth.getMaybeFailingAuthorizationCode();
+    expect(response.status).toBe(400);
+    expect(response.body).toBe("Invalid redirect URI. The URL you are trying to redirect to is not trusted. If it should be, add it to the list of trusted domains in the Stack Auth dashboard.");
+  });
+
+  it("should match exact subdomain but not other subdomains", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        oauth_providers: [{ id: "spotify", type: "shared" }],
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Add exact subdomain
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.subdomain': {
+            baseUrl: 'https://app.example.com',
+            handlerPath: '/handler',
+          },
+          'domains.allowLocalhost': false,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Try to complete the OAuth flow - it should fail at the callback stage
+    const { response } = await Auth.OAuth.getMaybeFailingAuthorizationCode();
+    expect(response.status).toBe(400);
+    expect(response.body).toBe("Invalid redirect URI. The URL you are trying to redirect to is not trusted. If it should be, add it to the list of trusted domains in the Stack Auth dashboard.");
+  });
+
+  it("should require exact port matching", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        oauth_providers: [{ id: "spotify", type: "shared" }],
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Add domain with specific port
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.withport': {
+            baseUrl: 'http://localhost:3000',
+            handlerPath: '/handler',
+          },
+          'domains.allowLocalhost': false,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Try to complete the OAuth flow - it should fail at the callback stage
+    const { response } = await Auth.OAuth.getMaybeFailingAuthorizationCode();
+    expect(response.status).toBe(400);
+    expect(response.body).toBe("Invalid redirect URI. The URL you are trying to redirect to is not trusted. If it should be, add it to the list of trusted domains in the Stack Auth dashboard.");
+  });
+
+  it("should require exact protocol matching", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        oauth_providers: [{ id: "spotify", type: "shared" }],
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Add HTTPS domain
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.https': {
+            baseUrl: 'https://localhost:8107',
+            handlerPath: '/handler',
+          },
+          'domains.allowLocalhost': false,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Try to complete the OAuth flow - it should fail at the callback stage
+    const { response } = await Auth.OAuth.getMaybeFailingAuthorizationCode();
+    expect(response.status).toBe(400);
+    expect(response.body).toBe("Invalid redirect URI. The URL you are trying to redirect to is not trusted. If it should be, add it to the list of trusted domains in the Stack Auth dashboard.");
+  });
+
+  it("should match path prefix correctly", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        oauth_providers: [{ id: "spotify", type: "shared" }],
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Add domain with specific handler path
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.withpath': {
+            baseUrl: 'http://localhost:8107',
+            handlerPath: '/auth/oauth/callback', // Different path than default /handler
+          },
+          'domains.allowLocalhost': false,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Try to complete the OAuth flow - it should fail at the callback stage
+    const { response } = await Auth.OAuth.getMaybeFailingAuthorizationCode();
+    expect(response.status).toBe(400);
+    expect(response.body).toBe("Invalid redirect URI. The URL you are trying to redirect to is not trusted. If it should be, add it to the list of trusted domains in the Stack Auth dashboard.");
+  });
+
+  it("should work with multiple exact domains where one matches", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        oauth_providers: [{ id: "spotify", type: "shared" }],
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Add multiple domains
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.prod': {
+            baseUrl: 'https://app.production.com',
+            handlerPath: '/handler',
+          },
+          'domains.trustedDomains.staging': {
+            baseUrl: 'https://app.staging.com',
+            handlerPath: '/handler',
+          },
+          'domains.trustedDomains.local': {
+            baseUrl: 'http://localhost:8107', // This one matches!
+            handlerPath: '/handler',
+          },
+          'domains.allowLocalhost': true,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // OAuth should succeed with the matching domain
+    const response = await Auth.OAuth.signIn();
+    expect(response.tokenResponse.status).toBe(200);
+  });
+
+  it("should fail when no exact domains match", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        oauth_providers: [{ id: "spotify", type: "shared" }],
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Add multiple domains, none match localhost:8107
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.prod': {
+            baseUrl: 'https://app.production.com',
+            handlerPath: '/handler',
+          },
+          'domains.trustedDomains.staging': {
+            baseUrl: 'https://app.staging.com',
+            handlerPath: '/handler',
+          },
+          'domains.trustedDomains.differentPort': {
+            baseUrl: 'http://localhost:3000', // Different port
+            handlerPath: '/handler',
+          },
+          'domains.allowLocalhost': false,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Try to complete the OAuth flow - it should fail at the callback stage
+    const { response } = await Auth.OAuth.getMaybeFailingAuthorizationCode();
+    expect(response.status).toBe(400);
+    expect(response.body).toBe("Invalid redirect URI. The URL you are trying to redirect to is not trusted. If it should be, add it to the list of trusted domains in the Stack Auth dashboard.");
+  });
+});
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
new file mode 100644
index 0000000000..a3bc418778
--- /dev/null
+++ b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
@@ -0,0 +1,313 @@
+import { describe } from "vitest";
+import { it, localRedirectUrl } from "../../../../../../helpers";
+import { Auth, InternalApiKey, Project, niceBackendFetch } from "../../../../../backend-helpers";
+
+describe("OAuth with wildcard domains", () => {
+  it("should work with exact domain configuration", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        oauth_providers: [{ id: "spotify", type: "shared" }],
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Add exact domain matching our test redirect URL
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.exact': {
+            baseUrl: 'http://localhost:8107',
+            handlerPath: '/handler',
+          },
+          'domains.allowLocalhost': true,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // OAuth flow should work
+    const response = await Auth.OAuth.signIn();
+    expect(response.tokenResponse.status).toBe(200);
+  });
+
+  it("should FAIL with exact domain that doesn't match", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        oauth_providers: [{ id: "spotify", type: "shared" }],
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Add exact domain that DOESN'T match our test redirect URL
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.exact': {
+            baseUrl: 'https://app.example.com',
+            handlerPath: '/handler',
+          },
+          'domains.allowLocalhost': false, // Disable localhost to ensure exact matching
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Try to complete the OAuth flow - it should fail at the callback stage
+    const { response } = await Auth.OAuth.getMaybeFailingAuthorizationCode();
+    expect(response.status).toBe(400);
+    expect(response.body).toBe("Invalid redirect URI. The URL you are trying to redirect to is not trusted. If it should be, add it to the list of trusted domains in the Stack Auth dashboard.");
+  });
+
+  it("should work with single wildcard domain", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        oauth_providers: [{ id: "spotify", type: "shared" }],
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Add wildcard domain
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.wildcard': {
+            baseUrl: 'http://*.localhost:8107',
+            handlerPath: '/handler',
+          },
+          'domains.allowLocalhost': true,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // OAuth flow should work with localhost
+    const response = await Auth.OAuth.signIn();
+    expect(response.tokenResponse.status).toBe(200);
+  });
+
+  it("should FAIL with single wildcard that doesn't match", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        oauth_providers: [{ id: "spotify", type: "shared" }],
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Add wildcard domain that doesn't match localhost pattern
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.wildcard': {
+            baseUrl: 'https://*.example.com',
+            handlerPath: '/handler',
+          },
+          'domains.allowLocalhost': false,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Try to complete the OAuth flow - it should fail at the callback stage
+    const { response } = await Auth.OAuth.getMaybeFailingAuthorizationCode();
+    expect(response.status).toBe(400);
+    expect(response.body).toBe("Invalid redirect URI. The URL you are trying to redirect to is not trusted. If it should be, add it to the list of trusted domains in the Stack Auth dashboard.");
+  });
+
+  it("should work with double wildcard domain", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        oauth_providers: [{ id: "spotify", type: "shared" }],
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Add double wildcard domain
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.double': {
+            baseUrl: 'http://**.localhost:8107',
+            handlerPath: '/handler',
+          },
+          'domains.allowLocalhost': true,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // OAuth flow should work
+    const response = await Auth.OAuth.signIn();
+    expect(response.tokenResponse.status).toBe(200);
+  });
+
+  it("should FAIL with double wildcard that doesn't match", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        oauth_providers: [{ id: "spotify", type: "shared" }],
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Add double wildcard for different TLD
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.double': {
+            baseUrl: 'https://**.example.org', // Different TLD - won't match localhost
+            handlerPath: '/handler',
+          },
+          'domains.allowLocalhost': false,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Try to complete the OAuth flow - it should fail at the callback stage
+    const { response } = await Auth.OAuth.getMaybeFailingAuthorizationCode();
+    expect(response.status).toBe(400);
+    expect(response.body).toBe("Invalid redirect URI. The URL you are trying to redirect to is not trusted. If it should be, add it to the list of trusted domains in the Stack Auth dashboard.");
+  });
+
+  it("should match prefix wildcard patterns correctly", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        oauth_providers: [{ id: "spotify", type: "shared" }],
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Add prefix wildcard that should match "localhost"
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.prefix': {
+            baseUrl: 'http://local*:8107', // Should match localhost
+            handlerPath: '/handler',
+          },
+          'domains.allowLocalhost': true,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // OAuth flow should work
+    const response = await Auth.OAuth.signIn();
+    expect(response.tokenResponse.status).toBe(200);
+  });
+
+  it("should FAIL with prefix wildcard that doesn't match", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        oauth_providers: [{ id: "spotify", type: "shared" }],
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Add prefix wildcard that won't match localhost
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.prefix': {
+            baseUrl: 'http://api-*:8107', // Won't match localhost
+            handlerPath: '/handler',
+          },
+          'domains.allowLocalhost': false,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Try to complete the OAuth flow - it should fail at the callback stage
+    const { response } = await Auth.OAuth.getMaybeFailingAuthorizationCode();
+    expect(response.status).toBe(400);
+    expect(response.body).toBe("Invalid redirect URI. The URL you are trying to redirect to is not trusted. If it should be, add it to the list of trusted domains in the Stack Auth dashboard.");
+  });
+
+  it("should properly validate multiple domains with wildcards", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        oauth_providers: [{ id: "spotify", type: "shared" }],
+      }
+    });
+
+    // Configure multiple domains, only one matches
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.prod': {
+            baseUrl: 'https://app.production.com',
+            handlerPath: '/handler',
+          },
+          'domains.trustedDomains.staging': {
+            baseUrl: 'https://*.staging.com',
+            handlerPath: '/handler',
+          },
+          'domains.trustedDomains.test': {
+            baseUrl: 'http://localhost:8107', // This one matches!
+            handlerPath: '/handler',
+          },
+          'domains.allowLocalhost': true,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Get the config to verify all domains are stored
+    const getResponse = await niceBackendFetch("/api/v1/internal/config", {
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      method: "GET",
+    });
+    expect(getResponse.status).toBe(200);
+
+    const config = JSON.parse(getResponse.body.config_string);
+    expect(Object.keys(config.domains.trustedDomains).length).toBe(3);
+  });
+});
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/auth/passkey/wildcard-domains.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/auth/passkey/wildcard-domains.test.ts
new file mode 100644
index 0000000000..75932f2c79
--- /dev/null
+++ b/apps/e2e/tests/backend/endpoints/api/v1/auth/passkey/wildcard-domains.test.ts
@@ -0,0 +1,484 @@
+import { describe } from "vitest";
+import { it } from "../../../../../../helpers";
+import { Auth, InternalApiKey, Project, niceBackendFetch } from "../../../../../backend-helpers";
+
+describe("Passkey with wildcard domains", () => {
+  it("should store wildcard domains in config correctly", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        passkey_enabled: true,
+      }
+    });
+
+    // Configure various wildcard domains
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.exact': {
+            baseUrl: 'https://app.example.com',
+            handlerPath: '/handler',
+          },
+          'domains.trustedDomains.single-wildcard': {
+            baseUrl: 'https://*.example.com',
+            handlerPath: '/handler',
+          },
+          'domains.trustedDomains.prefix-wildcard': {
+            baseUrl: 'https://api-*.example.com',
+            handlerPath: '/handler',
+          },
+          'domains.trustedDomains.double-wildcard': {
+            baseUrl: 'https://**.example.com',
+            handlerPath: '/handler',
+          },
+          'domains.trustedDomains.multi-level': {
+            baseUrl: 'https://*.*.test.com',
+            handlerPath: '/handler',
+          },
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Get the config to verify wildcards are stored
+    const getResponse = await niceBackendFetch("/api/v1/internal/config", {
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      method: "GET",
+    });
+    expect(getResponse.status).toBe(200);
+
+    const config = JSON.parse(getResponse.body.config_string);
+    expect(config.domains.trustedDomains).toMatchObject({
+      'exact': {
+        baseUrl: 'https://app.example.com',
+        handlerPath: '/handler',
+      },
+      'single-wildcard': {
+        baseUrl: 'https://*.example.com',
+        handlerPath: '/handler',
+      },
+      'prefix-wildcard': {
+        baseUrl: 'https://api-*.example.com',
+        handlerPath: '/handler',
+      },
+      'double-wildcard': {
+        baseUrl: 'https://**.example.com',
+        handlerPath: '/handler',
+      },
+      'multi-level': {
+        baseUrl: 'https://*.*.test.com',
+        handlerPath: '/handler',
+      },
+    });
+  });
+
+  it("should successfully register passkey with matching wildcard domain", async ({ expect }) => {
+    await Project.createAndSwitch({
+      config: {
+        passkey_enabled: true,
+        magic_link_enabled: true
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Sign up a user first
+    const res = await Auth.Password.signUpWithEmail();
+
+    // Configure wildcard domain that matches our test origin
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.wildcard': {
+            baseUrl: 'http://*:8103', // Will match http://localhost:8103 and any host on port 8103
+            handlerPath: '/',
+          },
+          'domains.allowLocalhost': false, // Disable default localhost to test wildcard
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Initiate passkey registration
+    const initiateResponse = await niceBackendFetch("/api/v1/auth/passkey/initiate-passkey-registration", {
+      method: "POST",
+      accessType: "client",
+      body: {},
+    });
+    expect(initiateResponse.status).toBe(200);
+    const { code } = initiateResponse.body;
+
+    // Register passkey with origin matching wildcard
+    const registerResponse = await niceBackendFetch("/api/v1/auth/passkey/register", {
+      method: "POST",
+      accessType: "client",
+      body: {
+        "credential": {
+          "id": "WILDCARD_TEST_ID",
+          "rawId": "WILDCARD_TEST_ID",
+          "response": {
+            "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViYSZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2NdAAAAAAAAAAAAAAAAAAAAAAAAAAAAFAQWGAfwysz2R5taOiCxqOkpP3AXpQECAyYgASFYIO7JJihe93CDhZOPFp9pVefZyBvy62JMjSs47id1q0vpIlggNMjLAQG7ESYqRZsBQbX07WWIImEzYFDsJgBOSYiQZL8",
+            "clientDataJSON": btoa(JSON.stringify({
+              type: "webauthn.create",
+              challenge: "TU9DSw",
+              origin: "http://localhost:8103", // Matches wildcard *:8103
+              crossOrigin: false
+            })),
+            "transports": ["hybrid", "internal"],
+            "publicKeyAlgorithm": -7,
+            "publicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7skmKF73cIOFk48Wn2lV59nIG_LrYkyNKzjuJ3WrS-k0yMsBAbsRJipFmwFBtfTtZYgiYTNgUOwmAE5JiJBkvw",
+            "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2NdAAAAAAAAAAAAAAAAAAAAAAAAAAAAFAQWGAfwysz2R5taOiCxqOkpP3AXpQECAyYgASFYIO7JJihe93CDhZOPFp9pVefZyBvy62JMjSs47id1q0vpIlggNMjLAQG7ESYqRZsBQbX07WWIImEzYFDsJgBOSYiQZL8"
+          },
+          "type": "public-key",
+          "clientExtensionResults": {
+            "credProps": {
+              "rk": true
+            }
+          },
+          "authenticatorAttachment": "platform"
+        },
+        "code": code,
+      },
+    });
+
+    if (registerResponse.status !== 200) {
+      console.log("Register failed with:", registerResponse.body);
+    }
+    expect(registerResponse.status).toBe(200);
+    expect(registerResponse.body).toHaveProperty("user_handle");
+  });
+
+  it("should successfully sign in with passkey using matching double wildcard domain", async ({ expect }) => {
+    await Project.createAndSwitch({
+      config: {
+        passkey_enabled: true,
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Sign up and register passkey with default localhost allowed
+    const res = await Auth.Password.signUpWithEmail();
+    const expectedUserId = res.userId;
+    await Auth.Passkey.register(); // This uses http://localhost:8103
+    await Auth.signOut();
+
+    // Configure double wildcard domain that matches localhost:8103
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.double': {
+            baseUrl: 'http://**host:8103', // Will match localhost:8103
+            handlerPath: '/',
+          },
+          'domains.allowLocalhost': false,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Initiate authentication
+    const initiateResponse = await niceBackendFetch("/api/v1/auth/passkey/initiate-passkey-authentication", {
+      method: "POST",
+      accessType: "client",
+      body: {},
+    });
+    expect(initiateResponse.status).toBe(200);
+    const { code } = initiateResponse.body;
+
+    // Sign in with passkey using deeply nested subdomain
+    const signinResponse = await niceBackendFetch("/api/v1/auth/passkey/sign-in", {
+      method: "POST",
+      accessType: "client",
+      body: {
+        "authentication_response": {
+          "id": "BBYYB_DKzPZHm1o6ILGo6Sk_cBc",
+          "rawId": "BBYYB_DKzPZHm1o6ILGo6Sk_cBc",
+          "response": {
+            "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA",
+            "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoiVFU5RFN3Iiwib3JpZ2luIjoiaHR0cDovL2xvY2FsaG9zdDo4MTAzIiwiY3Jvc3NPcmlnaW4iOmZhbHNlLCJvdGhlcl9rZXlzX2Nhbl9iZV9hZGRlZF9oZXJlIjoiZG8gbm90IGNvbXBhcmUgY2xpZW50RGF0YUpTT04gYWdhaW5zdCBhIHRlbXBsYXRlLiBTZWUgaHR0cHM6Ly9nb28uZ2wveWFiUGV4In0", // Matches **host:8103
+            "signature": "MEUCIQDPFYXxm-ALPZVuP4YdXBr1INrfObXR6hukxTttYNnegAIgEfy5MlnIi10VwmilOmuT1TuuDBLw9GDSv9DQuIRZXRE",
+            "userHandle": "YzE3YzJjNjMtMTkxZi00MWZmLTlkNjEtYzBjOGVlMmVlMGQ0"
+          },
+          "type": "public-key",
+          "clientExtensionResults": {},
+          "authenticatorAttachment": "platform"
+        },
+        "code": code,
+      },
+    });
+
+    expect(signinResponse.status).toBe(200);
+    expect(signinResponse.body.user_id).toBe(expectedUserId);
+  });
+
+  it("should FAIL passkey registration with non-matching exact domain", async ({ expect }) => {
+    await Project.createAndSwitch({
+      config: {
+        passkey_enabled: true,
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Sign up a user first
+    await Auth.Password.signUpWithEmail();
+
+    // Configure exact domain that doesn't match
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.exact': {
+            baseUrl: 'https://app.production.com',
+            handlerPath: '/handler',
+          },
+          'domains.allowLocalhost': false,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Initiate passkey registration
+    const initiateResponse = await niceBackendFetch("/api/v1/auth/passkey/initiate-passkey-registration", {
+      method: "POST",
+      accessType: "client",
+      body: {},
+    });
+    expect(initiateResponse.status).toBe(200);
+    const { code } = initiateResponse.body;
+
+    // Try to register passkey with non-matching origin
+    const registerResponse = await niceBackendFetch("/api/v1/auth/passkey/register", {
+      method: "POST",
+      accessType: "client",
+      body: {
+        "credential": {
+          "id": "FAIL_TEST_ID",
+          "rawId": "FAIL_TEST_ID",
+          "response": {
+            "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViYSZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2NdAAAAAAAAAAAAAAAAAAAAAAAAAAAAFAQWGAfwysz2R5taOiCxqOkpP3AXpQECAyYgASFYIO7JJihe93CDhZOPFp9pVefZyBvy62JMjSs47id1q0vpIlggNMjLAQG7ESYqRZsBQbX07WWIImEzYFDsJgBOSYiQZL8",
+            "clientDataJSON": btoa(JSON.stringify({
+              type: "webauthn.create",
+              challenge: "TU9DSw",
+              origin: "http://localhost:8103", // Doesn't match https://app.production.com
+              crossOrigin: false
+            })),
+            "transports": ["hybrid", "internal"],
+            "publicKeyAlgorithm": -7,
+            "publicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7skmKF73cIOFk48Wn2lV59nIG_LrYkyNKzjuJ3WrS-k0yMsBAbsRJipFmwFBtfTtZYgiYTNgUOwmAE5JiJBkvw",
+            "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2NdAAAAAAAAAAAAAAAAAAAAAAAAAAAAFAQWGAfwysz2R5taOiCxqOkpP3AXpQECAyYgASFYIO7JJihe93CDhZOPFp9pVefZyBvy62JMjSs47id1q0vpIlggNMjLAQG7ESYqRZsBQbX07WWIImEzYFDsJgBOSYiQZL8"
+          },
+          "type": "public-key",
+          "clientExtensionResults": {
+            "credProps": {
+              "rk": true
+            }
+          },
+          "authenticatorAttachment": "platform"
+        },
+        "code": code,
+      },
+    });
+
+    expect(registerResponse.status).toBe(400);
+    expect(registerResponse.body).toMatchObject({
+      code: "PASSKEY_REGISTRATION_FAILED",
+      error: expect.stringContaining("origin is not allowed")
+    });
+  });
+
+  it("should FAIL passkey sign-in with non-matching wildcard domain", async ({ expect }) => {
+    await Project.createAndSwitch({
+      config: {
+        passkey_enabled: true,
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Sign up and register passkey with default localhost allowed
+    const res = await Auth.Password.signUpWithEmail();
+    await Auth.Passkey.register();
+    await Auth.signOut();
+
+    // Configure wildcard that doesn't match localhost
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.wildcard': {
+            baseUrl: 'https://*.example.com',
+            handlerPath: '/handler',
+          },
+          'domains.allowLocalhost': false,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Initiate authentication
+    const initiateResponse = await niceBackendFetch("/api/v1/auth/passkey/initiate-passkey-authentication", {
+      method: "POST",
+      accessType: "client",
+      body: {},
+    });
+    expect(initiateResponse.status).toBe(200);
+    const { code } = initiateResponse.body;
+
+    // Try to sign in with non-matching origin
+    const signinResponse = await niceBackendFetch("/api/v1/auth/passkey/sign-in", {
+      method: "POST",
+      accessType: "client",
+      body: {
+        "authentication_response": {
+          "id": "BBYYB_DKzPZHm1o6ILGo6Sk_cBc",
+          "rawId": "BBYYB_DKzPZHm1o6ILGo6Sk_cBc",
+          "response": {
+            "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA",
+            "clientDataJSON": btoa(JSON.stringify({
+              type: "webauthn.get",
+              challenge: "TU9DSw",
+              origin: "http://localhost:8103", // Doesn't match *.example.com
+              crossOrigin: false
+            })),
+            "signature": "MEUCIQDPFYXxm-ALPZVuP4YdXBr1INrfObXR6hukxTttYNnegAIgEfy5MlnIi10VwmilOmuT1TuuDBLw9GDSv9DQuIRZXRE",
+            "userHandle": "YzE3YzJjNjMtMTkxZi00MWZmLTlkNjEtYzBjOGVlMmVlMGQ0"
+          },
+          "type": "public-key",
+          "clientExtensionResults": {},
+          "authenticatorAttachment": "platform"
+        },
+        "code": code,
+      },
+    });
+
+    expect(signinResponse.status).toBe(400);
+    expect(signinResponse.body).toMatchObject({
+      code: "PASSKEY_AUTHENTICATION_FAILED",
+      error: expect.stringContaining("origin is not allowed")
+    });
+  });
+
+  it("should work with prefix wildcard pattern for passkey", async ({ expect }) => {
+    await Project.createAndSwitch({
+      config: {
+        passkey_enabled: true,
+      }
+    });
+    await InternalApiKey.createAndSetProjectKeys();
+
+    // Sign up and register passkey with default localhost allowed
+    const res = await Auth.Password.signUpWithEmail();
+    await Auth.Passkey.register(); // This uses http://localhost:8103
+    await Auth.signOut();
+
+    // Configure wildcard that matches localhost
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.wildcard': {
+            baseUrl: 'http://*:8103', // Will match localhost:8103
+            handlerPath: '/',
+          },
+          'domains.allowLocalhost': false,
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Initiate authentication
+    const initiateResponse = await niceBackendFetch("/api/v1/auth/passkey/initiate-passkey-authentication", {
+      method: "POST",
+      accessType: "client",
+      body: {},
+    });
+    expect(initiateResponse.status).toBe(200);
+    const { code } = initiateResponse.body;
+
+    // Sign in with matching prefix pattern
+    const signinResponse = await niceBackendFetch("/api/v1/auth/passkey/sign-in", {
+      method: "POST",
+      accessType: "client",
+      body: {
+        "authentication_response": {
+          "id": "BBYYB_DKzPZHm1o6ILGo6Sk_cBc",
+          "rawId": "BBYYB_DKzPZHm1o6ILGo6Sk_cBc",
+          "response": {
+            "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA",
+            "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoiVFU5RFN3Iiwib3JpZ2luIjoiaHR0cDovL2xvY2FsaG9zdDo4MTAzIiwiY3Jvc3NPcmlnaW4iOmZhbHNlLCJvdGhlcl9rZXlzX2Nhbl9iZV9hZGRlZF9oZXJlIjoiZG8gbm90IGNvbXBhcmUgY2xpZW50RGF0YUpTT04gYWdhaW5zdCBhIHRlbXBsYXRlLiBTZWUgaHR0cHM6Ly9nb28uZ2wveWFiUGV4In0", // Matches *:8103
+            "signature": "MEUCIQDPFYXxm-ALPZVuP4YdXBr1INrfObXR6hukxTttYNnegAIgEfy5MlnIi10VwmilOmuT1TuuDBLw9GDSv9DQuIRZXRE",
+            "userHandle": "YzE3YzJjNjMtMTkxZi00MWZmLTlkNjEtYzBjOGVlMmVlMGQ0"
+          },
+          "type": "public-key",
+          "clientExtensionResults": {},
+          "authenticatorAttachment": "platform"
+        },
+        "code": code,
+      },
+    });
+
+    expect(signinResponse.status).toBe(200);
+    expect(signinResponse.body).toHaveProperty("user_id");
+  });
+
+  it("should handle complex wildcard patterns correctly", async ({ expect }) => {
+    const { adminAccessToken } = await Project.createAndSwitch({
+      config: {
+        passkey_enabled: true,
+      }
+    });
+
+    // Configure complex wildcard patterns
+    const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
+      method: "PATCH",
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      body: {
+        config_override_string: JSON.stringify({
+          'domains.trustedDomains.complex1': {
+            baseUrl: 'https://api-*.*.example.com',
+            handlerPath: '/handler',
+          },
+          'domains.trustedDomains.complex2': {
+            baseUrl: 'https://**.api.example.com',
+            handlerPath: '/handler',
+          },
+          'domains.trustedDomains.complex3': {
+            baseUrl: 'https://*-staging.example.com',
+            handlerPath: '/handler',
+          },
+        }),
+      },
+    });
+    expect(configResponse.status).toBe(200);
+
+    // Verify the complex patterns are stored correctly
+    const getResponse = await niceBackendFetch("/api/v1/internal/config", {
+      accessType: "admin",
+      headers: {
+        'x-stack-admin-access-token': adminAccessToken,
+      },
+      method: "GET",
+    });
+    expect(getResponse.status).toBe(200);
+
+    const config = JSON.parse(getResponse.body.config_string);
+    expect(config.domains.trustedDomains.complex1.baseUrl).toBe('https://api-*.*.example.com');
+    expect(config.domains.trustedDomains.complex2.baseUrl).toBe('https://**.api.example.com');
+    expect(config.domains.trustedDomains.complex3.baseUrl).toBe('https://*-staging.example.com');
+  });
+});
diff --git a/packages/stack-shared/src/helpers/production-mode.ts b/packages/stack-shared/src/helpers/production-mode.ts
index 35f8393fbd..1ab7c5ac04 100644
--- a/packages/stack-shared/src/helpers/production-mode.ts
+++ b/packages/stack-shared/src/helpers/production-mode.ts
@@ -21,7 +21,9 @@ export function getProductionModeErrors(project: ProjectsCrud["Admin"]["Read"]):
   for (const { domain } of project.config.domains) {
     let url;
     try {
-      url = new URL(domain);
+      // For wildcard domains, replace wildcards with a valid placeholder to validate the URL structure
+      const normalizedDomain = domain.replace(/\*+/g, 'wildcard-placeholder');
+      url = new URL(normalizedDomain);
     } catch (e) {
       captureError("production-mode-domain-not-valid", new StackAssertionError("Domain was somehow not a valid URL; we should've caught this when setting the domain in the first place", {
         domain,
diff --git a/packages/stack-shared/src/utils/urls.tsx b/packages/stack-shared/src/utils/urls.tsx
index b600d55254..64ae4c2e6d 100644
--- a/packages/stack-shared/src/utils/urls.tsx
+++ b/packages/stack-shared/src/utils/urls.tsx
@@ -36,6 +36,11 @@ import.meta.vitest?.test("isValidUrl", ({ expect }) => {
 });
 
 export function isValidHostname(hostname: string) {
+  // Basic validation
+  if (!hostname || hostname.startsWith('.') || hostname.endsWith('.') || hostname.includes('..')) {
+    return false;
+  }
+
   const url = createUrlIfValid(`https://${hostname}`);
   if (!url) return false;
   return url.hostname === hostname;
@@ -54,6 +59,143 @@ import.meta.vitest?.test("isValidHostname", ({ expect }) => {
   expect(isValidHostname("example com")).toBe(false);
 });
 
+export function isValidHostnameWithWildcards(hostname: string) {
+  // Empty hostnames are invalid
+  if (!hostname) return false;
+
+  // Check if it contains wildcards
+  const hasWildcard = hostname.includes('*');
+
+  if (!hasWildcard) {
+    // If no wildcards, validate as a normal hostname
+    return isValidHostname(hostname);
+  }
+
+  // Basic validation checks that apply even with wildcards
+  // - Hostname cannot start or end with a dot
+  if (hostname.startsWith('.') || hostname.endsWith('.')) {
+    return false;
+  }
+
+  // - No consecutive dots
+  if (hostname.includes('..')) {
+    return false;
+  }
+
+  // For wildcard validation, check that non-wildcard parts contain valid characters
+  // Replace wildcards with a valid placeholder to check the rest
+  const testHostname = hostname.replace(/\*+/g, 'wildcard');
+
+  // Check if the resulting string would be a valid hostname
+  if (!/^[a-zA-Z0-9.-]+$/.test(testHostname)) {
+    return false;
+  }
+
+  // Additional check: ensure the pattern makes sense
+  // Check each segment between wildcards
+  const segments = hostname.split(/\*+/);
+  for (let i = 0; i < segments.length; i++) {
+    const segment = segments[i];
+    if (segment === '') continue; // Empty segments are OK (consecutive wildcards)
+
+    // First segment can't start with dot
+    if (i === 0 && segment.startsWith('.')) {
+      return false;
+    }
+
+    // Last segment can't end with dot
+    if (i === segments.length - 1 && segment.endsWith('.')) {
+      return false;
+    }
+
+    // No segment should have consecutive dots
+    if (segment.includes('..')) {
+      return false;
+    }
+  }
+
+  return true;
+}
+import.meta.vitest?.test("isValidHostnameWithWildcards", ({ expect }) => {
+  // Test with valid regular hostnames
+  expect(isValidHostnameWithWildcards("example.com")).toBe(true);
+  expect(isValidHostnameWithWildcards("localhost")).toBe(true);
+  expect(isValidHostnameWithWildcards("sub.domain.example.com")).toBe(true);
+
+  // Test with valid wildcard hostnames
+  expect(isValidHostnameWithWildcards("*.example.com")).toBe(true);
+  expect(isValidHostnameWithWildcards("a-*.example.com")).toBe(true);
+  expect(isValidHostnameWithWildcards("*.*.org")).toBe(true);
+  expect(isValidHostnameWithWildcards("**.example.com")).toBe(true);
+  expect(isValidHostnameWithWildcards("sub.**.com")).toBe(true);
+  expect(isValidHostnameWithWildcards("*-api.*.com")).toBe(true);
+
+  // Test with invalid hostnames
+  expect(isValidHostnameWithWildcards("")).toBe(false);
+  expect(isValidHostnameWithWildcards("example.com/path")).toBe(false);
+  expect(isValidHostnameWithWildcards("https://example.com")).toBe(false);
+  expect(isValidHostnameWithWildcards("example com")).toBe(false);
+  expect(isValidHostnameWithWildcards(".example.com")).toBe(false);
+  expect(isValidHostnameWithWildcards("example.com.")).toBe(false);
+  expect(isValidHostnameWithWildcards("example..com")).toBe(false);
+  expect(isValidHostnameWithWildcards("*.example..com")).toBe(false);
+});
+
+export function matchHostnamePattern(pattern: string, hostname: string): boolean {
+  // If no wildcards, it's an exact match
+  if (!pattern.includes('*')) {
+    return pattern === hostname;
+  }
+
+  // Convert the pattern to a regex
+  // First, escape all regex special characters except *
+  let regexPattern = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&');
+
+  // Use a placeholder for ** to handle it separately from single *
+  const doubleWildcardPlaceholder = '\x00DOUBLE_WILDCARD\x00';
+  regexPattern = regexPattern.replace(/\*\*/g, doubleWildcardPlaceholder);
+
+  // Replace single * with a pattern that matches anything except dots
+  regexPattern = regexPattern.replace(/\*/g, '[^.]*');
+
+  // Replace the double wildcard placeholder with a pattern that matches anything including dots
+  regexPattern = regexPattern.replace(new RegExp(doubleWildcardPlaceholder, 'g'), '.*');
+
+  // Anchor the pattern to match the entire hostname
+  regexPattern = '^' + regexPattern + '$';
+
+  try {
+    const regex = new RegExp(regexPattern);
+    return regex.test(hostname);
+  } catch {
+    return false;
+  }
+}
+import.meta.vitest?.test("matchHostnamePattern", ({ expect }) => {
+  // Test exact matches
+  expect(matchHostnamePattern("example.com", "example.com")).toBe(true);
+  expect(matchHostnamePattern("example.com", "other.com")).toBe(false);
+
+  // Test single wildcard matches
+  expect(matchHostnamePattern("*.example.com", "api.example.com")).toBe(true);
+  expect(matchHostnamePattern("*.example.com", "www.example.com")).toBe(true);
+  expect(matchHostnamePattern("*.example.com", "example.com")).toBe(false);
+  expect(matchHostnamePattern("*.example.com", "api.v2.example.com")).toBe(false);
+
+  // Test double wildcard matches
+  expect(matchHostnamePattern("**.example.com", "api.example.com")).toBe(true);
+  expect(matchHostnamePattern("**.example.com", "api.v2.example.com")).toBe(true);
+  expect(matchHostnamePattern("**.example.com", "a.b.c.example.com")).toBe(true);
+  expect(matchHostnamePattern("**.example.com", "example.com")).toBe(false);
+
+  // Test complex patterns
+  expect(matchHostnamePattern("api-*.example.com", "api-v1.example.com")).toBe(true);
+  expect(matchHostnamePattern("api-*.example.com", "api-v2.example.com")).toBe(true);
+  expect(matchHostnamePattern("api-*.example.com", "api.example.com")).toBe(false);
+  expect(matchHostnamePattern("*.*.org", "mail.example.org")).toBe(true);
+  expect(matchHostnamePattern("*.*.org", "example.org")).toBe(false);
+});
+
 export function isLocalhost(urlOrString: string | URL) {
   const url = createUrlIfValid(urlOrString);
   if (!url) return false;

From 0ae980b75a51c53b3c0256b2d9cb1afe5780cece Mon Sep 17 00:00:00 2001
From: Konstantin Wohlwend <n2d4xc@gmail.com>
Date: Tue, 5 Aug 2025 17:40:23 -0700
Subject: [PATCH 02/16] fix

---
 apps/backend/src/lib/redirect-urls.tsx | 166 +++++++++++--------------
 1 file changed, 75 insertions(+), 91 deletions(-)

diff --git a/apps/backend/src/lib/redirect-urls.tsx b/apps/backend/src/lib/redirect-urls.tsx
index 23c6d0c164..8947b057f2 100644
--- a/apps/backend/src/lib/redirect-urls.tsx
+++ b/apps/backend/src/lib/redirect-urls.tsx
@@ -2,109 +2,93 @@ import { StackAssertionError, captureError } from "@stackframe/stack-shared/dist
 import { createUrlIfValid, isLocalhost, matchHostnamePattern } from "@stackframe/stack-shared/dist/utils/urls";
 import { Tenancy } from "./tenancies";
 
-export function validateRedirectUrl(
-  urlOrString: string | URL,
-  tenancy: Tenancy,
-): boolean {
-  const url = createUrlIfValid(urlOrString);
-  if (!url) return false;
-  if (tenancy.config.domains.allowLocalhost && isLocalhost(url)) {
-    return true;
-  }
-  return Object.values(tenancy.config.domains.trustedDomains).some((domain) => {
-    if (!domain.baseUrl) {
-      return false;
-    }
-
-    const testUrl = url;
-
-    // Check if the domain uses wildcards
-    const hasWildcard = domain.baseUrl.includes('*');
-
-    if (hasWildcard) {
-      // For wildcard domains, we need to parse the pattern manually
-      // Extract protocol, hostname pattern, and path
-      const protocolEnd = domain.baseUrl.indexOf('://');
-      if (protocolEnd === -1) {
-        captureError("invalid-redirect-domain", new StackAssertionError("Invalid domain format; missing protocol", {
-          domain: domain.baseUrl,
-        }));
-        return false;
-      }
-
-      const protocol = domain.baseUrl.substring(0, protocolEnd + 3);
-      const afterProtocol = domain.baseUrl.substring(protocolEnd + 3);
-      const pathStart = afterProtocol.indexOf('/');
-      const hostPattern = pathStart === -1 ? afterProtocol : afterProtocol.substring(0, pathStart);
-      const basePath = pathStart === -1 ? '/' : afterProtocol.substring(pathStart);
+/**
+ * Normalizes a URL to include explicit default ports for comparison
+ */
+function normalizePort(url: URL): string {
+  const defaultPorts: Record<string, string> = { 'https:': '443', 'http:': '80' };
+  const port = url.port || defaultPorts[url.protocol] || '';
+  return port ? `${url.hostname}:${port}` : url.hostname;
+}
 
-      // Check protocol
-      if (testUrl.protocol + '//' !== protocol) {
-        return false;
-      }
+/**
+ * Checks if a URL uses the default port for its protocol
+ */
+function isDefaultPort(url: URL): boolean {
+  return !url.port ||
+    (url.protocol === 'https:' && url.port === '443') ||
+    (url.protocol === 'http:' && url.port === '80');
+}
 
-      // Check host (including port) with wildcard pattern
-      // We need to handle port matching correctly
-      const hasPortInPattern = hostPattern.includes(':');
+/**
+ * Checks if two URLs have matching ports (considering default ports)
+ */
+function portsMatch(url1: URL, url2: URL): boolean {
+  return normalizePort(url1) === normalizePort(url2);
+}
 
-      if (hasPortInPattern) {
-        // Pattern includes port - match against full host (hostname:port)
-        // Need to normalize for default ports
-        let normalizedTestHost = testUrl.host;
-        if (testUrl.port === '' ||
-            (testUrl.protocol === 'https:' && testUrl.port === '443') ||
-            (testUrl.protocol === 'http:' && testUrl.port === '80')) {
-          // Add default port explicitly for matching when pattern has a port
-          const defaultPort = testUrl.protocol === 'https:' ? '443' : '80';
-          normalizedTestHost = testUrl.hostname + ':' + (testUrl.port || defaultPort);
-        }
+/**
+ * Validates a URL against a domain pattern (with or without wildcards)
+ */
+function matchesDomain(testUrl: URL, pattern: string, handlerPath: string): boolean {
+  const baseUrl = createUrlIfValid(pattern);
+
+  // If pattern is invalid as a URL, it might contain wildcards
+  if (!baseUrl || pattern.includes('*')) {
+    // Parse wildcard pattern manually
+    const match = pattern.match(/^([^:]+:\/\/)([^/]*)(.*)$/);
+    if (!match) {
+      captureError("invalid-redirect-domain", new StackAssertionError("Invalid domain pattern", { pattern }));
+      return false;
+    }
 
-        if (!matchHostnamePattern(hostPattern, normalizedTestHost)) {
-          return false;
-        }
-      } else {
-        // Pattern doesn't include port - match hostname only and check port separately
-        if (!matchHostnamePattern(hostPattern, testUrl.hostname)) {
-          return false;
-        }
+    const [, protocol, hostPattern, basePath] = match;
 
-        // When no port is specified in pattern, only allow default ports
-        const isDefaultPort =
-          (testUrl.protocol === 'https:' && (testUrl.port === '' || testUrl.port === '443')) ||
-          (testUrl.protocol === 'http:' && (testUrl.port === '' || testUrl.port === '80'));
+    // Check protocol
+    if (testUrl.protocol + '//' !== protocol) {
+      return false;
+    }
 
-        if (!isDefaultPort) {
-          return false;
-        }
+    // Check host with wildcard pattern
+    const hasPortInPattern = hostPattern.includes(':');
+    if (hasPortInPattern) {
+      // Pattern includes port - match against normalized host:port
+      if (!matchHostnamePattern(hostPattern, normalizePort(testUrl))) {
+        return false;
       }
-
-      // Check path
-      const handlerPath = domain.handlerPath || '/';
-      const fullBasePath = basePath === '/' ? handlerPath : basePath + handlerPath;
-      return testUrl.pathname.startsWith(fullBasePath);
     } else {
-      // For non-wildcard domains, use the original logic
-      const baseUrl = createUrlIfValid(domain.baseUrl);
-      if (!baseUrl) {
-        captureError("invalid-redirect-domain", new StackAssertionError("Invalid redirect domain; maybe this should be fixed in the database", {
-          domain: domain.baseUrl,
-        }));
+      // Pattern doesn't include port - match hostname only, require default port
+      if (!matchHostnamePattern(hostPattern, testUrl.hostname) || !isDefaultPort(testUrl)) {
         return false;
       }
+    }
 
-      const protocolMatches = baseUrl.protocol === testUrl.protocol;
-      const hostnameMatches = baseUrl.hostname === testUrl.hostname;
+    // Check path
+    const fullPath = basePath === '/' ? handlerPath : basePath + handlerPath;
+    return testUrl.pathname.startsWith(fullPath || '/');
+  }
 
-      // Check port matching for non-wildcard domains
-      const portMatches = baseUrl.port === testUrl.port ||
-        (baseUrl.port === '' && testUrl.protocol === 'https:' && testUrl.port === '443') ||
-        (baseUrl.port === '' && testUrl.protocol === 'http:' && testUrl.port === '80') ||
-        (testUrl.port === '' && baseUrl.protocol === 'https:' && baseUrl.port === '443') ||
-        (testUrl.port === '' && baseUrl.protocol === 'http:' && baseUrl.port === '80');
+  // For non-wildcard patterns, use URL comparison
+  return baseUrl.protocol === testUrl.protocol &&
+         baseUrl.hostname === testUrl.hostname &&
+         portsMatch(baseUrl, testUrl) &&
+         testUrl.pathname.startsWith(handlerPath || '/');
+}
 
-      const pathMatches = testUrl.pathname.startsWith(domain.handlerPath || '/');
+export function validateRedirectUrl(
+  urlOrString: string | URL,
+  tenancy: Tenancy,
+): boolean {
+  const url = createUrlIfValid(urlOrString);
+  if (!url) return false;
 
-      return protocolMatches && hostnameMatches && portMatches && pathMatches;
-    }
-  });
+  // Check localhost permission
+  if (tenancy.config.domains.allowLocalhost && isLocalhost(url)) {
+    return true;
+  }
+
+  // Check trusted domains
+  return Object.values(tenancy.config.domains.trustedDomains).some(domain =>
+    domain.baseUrl && matchesDomain(url, domain.baseUrl, domain.handlerPath || '/')
+  );
 }

From 8524a8af01f28719d4c8c54a2e0231951c167ea6 Mon Sep 17 00:00:00 2001
From: Konsti Wohlwend <n2d4xc@gmail.com>
Date: Wed, 13 Aug 2025 17:45:08 -0700
Subject: [PATCH 03/16] Update
 apps/backend/src/app/api/latest/auth/oauth/callback/[provider_id]/route.tsx

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
---
 .../app/api/latest/auth/oauth/callback/[provider_id]/route.tsx  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/backend/src/app/api/latest/auth/oauth/callback/[provider_id]/route.tsx b/apps/backend/src/app/api/latest/auth/oauth/callback/[provider_id]/route.tsx
index c675751b69..5d878e6fe5 100644
--- a/apps/backend/src/app/api/latest/auth/oauth/callback/[provider_id]/route.tsx
+++ b/apps/backend/src/app/api/latest/auth/oauth/callback/[provider_id]/route.tsx
@@ -403,7 +403,7 @@ const handler = createSmartRouteHandler({
       } catch (error) {
         if (error instanceof InvalidClientError) {
           if (error.message.includes("redirect_uri") || error.message.includes("redirectUri")) {
-            console.log("User is trying to authorize OAuth with an invalid redirect URI", error, oauthRequest);
+            console.log("User is trying to authorize OAuth with an invalid redirect URI", error, { redirectUri: oauthRequest.query?.redirect_uri, clientId: oauthRequest.query?.client_id });
             throw new StatusError(400, "Invalid redirect URI. The URL you are trying to redirect to is not trusted. If it should be, add it to the list of trusted domains in the Stack Auth dashboard.");
           }
         } else if (error instanceof InvalidScopeError) {

From 05f5e44338f17af415bf938507eb0b470aa567a8 Mon Sep 17 00:00:00 2001
From: Konstantin Wohlwend <n2d4xc@gmail.com>
Date: Wed, 13 Aug 2025 17:50:31 -0700
Subject: [PATCH 04/16] move CLAUDE-KNOWLEDGE

---
 CLAUDE-KNOWLEDGE.md => .claude/CLAUDE-KNOWLEDGE.md | 0
 CLAUDE.md                                          | 2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename CLAUDE-KNOWLEDGE.md => .claude/CLAUDE-KNOWLEDGE.md (100%)

diff --git a/CLAUDE-KNOWLEDGE.md b/.claude/CLAUDE-KNOWLEDGE.md
similarity index 100%
rename from CLAUDE-KNOWLEDGE.md
rename to .claude/CLAUDE-KNOWLEDGE.md
diff --git a/CLAUDE.md b/CLAUDE.md
index cac840b9a3..89e16f0ffc 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -74,4 +74,4 @@ To see all development ports, refer to the index.html of `apps/dev-launchpad/pub
 - The project uses a custom route handler system in the backend for consistent API responses
 - Sometimes, the typecheck will give errors along the line of "Cannot assign Buffer to Uint8Array" or similar, on changes that are completely unrelated to your own changes. If that happens, tell the user to run `pnpm clean && pnpm i && pnpm run codegen && pnpm build:packages`, and restart the dev server (you cannot run this yourself). After that's done, the typecheck should pass.
 - When writing tests, prefer .toMatchInlineSnapshot over other selectors, if possible. You can check (and modify) the snapshot-serializer.ts file to see how the snapshots are formatted and how non-deterministic values are handled.
-- Whenever you learn something new, or at the latest right before you call the `Stop` tool, write whatever you learned into the CLAUDE-KNOWLEDGE.md file, in the Q&A format in there. You will later be able to look up knowledge from there (based on the question you asked).
+- Whenever you learn something new, or at the latest right before you call the `Stop` tool, write whatever you learned into the ./claude/CLAUDE-KNOWLEDGE.md file, in the Q&A format in there. You will later be able to look up knowledge from there (based on the question you asked).

From ee9be7dec740b7d098722ecee9261910c2b13631 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <209825114+claude[bot]@users.noreply.github.com>
Date: Thu, 14 Aug 2025 00:53:20 +0000
Subject: [PATCH 05/16] refactor: use Map for defaultPorts to avoid prototype
 pollution

Replace Record<string, string> object with Map<string, string> for
defaultPorts to prevent potential prototype pollution vulnerabilities.

Co-authored-by: Konsti Wohlwend <N2D4@users.noreply.github.com>
---
 apps/backend/src/lib/redirect-urls.tsx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/backend/src/lib/redirect-urls.tsx b/apps/backend/src/lib/redirect-urls.tsx
index 8947b057f2..27a6696939 100644
--- a/apps/backend/src/lib/redirect-urls.tsx
+++ b/apps/backend/src/lib/redirect-urls.tsx
@@ -6,8 +6,8 @@ import { Tenancy } from "./tenancies";
  * Normalizes a URL to include explicit default ports for comparison
  */
 function normalizePort(url: URL): string {
-  const defaultPorts: Record<string, string> = { 'https:': '443', 'http:': '80' };
-  const port = url.port || defaultPorts[url.protocol] || '';
+  const defaultPorts = new Map<string, string>([['https:', '443'], ['http:', '80']]);
+  const port = url.port || defaultPorts.get(url.protocol) || '';
   return port ? `${url.hostname}:${port}` : url.hostname;
 }
 

From b9a0b09eff19130a3568c907a238d95b395522e3 Mon Sep 17 00:00:00 2001
From: Konsti Wohlwend <n2d4xc@gmail.com>
Date: Wed, 13 Aug 2025 18:03:47 -0700
Subject: [PATCH 06/16] Update
 apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts

---
 .../endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts    | 1 -
 1 file changed, 1 deletion(-)

diff --git a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts
index dcc9027563..05ff4e7a34 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts
@@ -24,7 +24,6 @@ describe("OAuth with exact domain matching", () => {
             baseUrl: 'http://localhost:8107',
             handlerPath: '/handler',
           },
-          'domains.allowLocalhost': true,
         }),
       },
     });

From 17b7e2b40007c41f085acc0cf987dfe98cc82ac7 Mon Sep 17 00:00:00 2001
From: Konsti Wohlwend <n2d4xc@gmail.com>
Date: Wed, 13 Aug 2025 18:05:38 -0700
Subject: [PATCH 07/16] Update
 apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts

---
 .../endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts    | 1 +
 1 file changed, 1 insertion(+)

diff --git a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts
index 05ff4e7a34..0acc1c99e1 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts
@@ -24,6 +24,7 @@ describe("OAuth with exact domain matching", () => {
             baseUrl: 'http://localhost:8107',
             handlerPath: '/handler',
           },
+          'domains.allowLocalhost': false,
         }),
       },
     });

From 3ed23dacb239bc8c083026c04799dfb2c116b0b0 Mon Sep 17 00:00:00 2001
From: Konsti Wohlwend <n2d4xc@gmail.com>
Date: Wed, 13 Aug 2025 18:06:03 -0700
Subject: [PATCH 08/16] Update
 apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts

---
 .../endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts
index 0acc1c99e1..160b8bc511 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts
@@ -230,7 +230,7 @@ describe("OAuth with exact domain matching", () => {
             baseUrl: 'http://localhost:8107', // This one matches!
             handlerPath: '/handler',
           },
-          'domains.allowLocalhost': true,
+          'domains.allowLocalhost': false,
         }),
       },
     });

From a56ae736039b772785aa55b962cc5a1b3c2b1ed7 Mon Sep 17 00:00:00 2001
From: Konsti Wohlwend <n2d4xc@gmail.com>
Date: Wed, 13 Aug 2025 18:07:04 -0700
Subject: [PATCH 09/16] Update
 apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts

---
 .../endpoints/api/v1/auth/oauth/wildcard-domains.test.ts        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
index a3bc418778..1cb080d0b5 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
@@ -89,7 +89,7 @@ describe("OAuth with wildcard domains", () => {
             baseUrl: 'http://*.localhost:8107',
             handlerPath: '/handler',
           },
-          'domains.allowLocalhost': true,
+          'domains.allowLocalhost': false,
         }),
       },
     });

From d22367f34632de8a8c0eaa474252c533ed34fe6e Mon Sep 17 00:00:00 2001
From: Konsti Wohlwend <n2d4xc@gmail.com>
Date: Wed, 13 Aug 2025 18:12:13 -0700
Subject: [PATCH 10/16] Update
 apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts

---
 .../endpoints/api/v1/auth/oauth/wildcard-domains.test.ts        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
index 1cb080d0b5..dbc89899dd 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
@@ -219,7 +219,7 @@ describe("OAuth with wildcard domains", () => {
             baseUrl: 'http://local*:8107', // Should match localhost
             handlerPath: '/handler',
           },
-          'domains.allowLocalhost': true,
+          'domains.allowLocalhost': false,
         }),
       },
     });

From 0e4bb559a061c6bb81a236880b37d3cbce8fc41b Mon Sep 17 00:00:00 2001
From: Konsti Wohlwend <n2d4xc@gmail.com>
Date: Wed, 13 Aug 2025 18:12:26 -0700
Subject: [PATCH 11/16] Update
 apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts

---
 .../endpoints/api/v1/auth/oauth/wildcard-domains.test.ts        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
index dbc89899dd..9a68b5fe0c 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
@@ -154,7 +154,7 @@ describe("OAuth with wildcard domains", () => {
             baseUrl: 'http://**.localhost:8107',
             handlerPath: '/handler',
           },
-          'domains.allowLocalhost': true,
+          'domains.allowLocalhost': false,
         }),
       },
     });

From 120dfc163fd271f7c134b90f8e659df69f7d76d0 Mon Sep 17 00:00:00 2001
From: Konsti Wohlwend <n2d4xc@gmail.com>
Date: Wed, 13 Aug 2025 18:12:51 -0700
Subject: [PATCH 12/16] Update
 apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
---
 .../endpoints/api/v1/auth/oauth/wildcard-domains.test.ts       | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
index 9a68b5fe0c..e1fe8cf983 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
@@ -269,7 +269,8 @@ describe("OAuth with wildcard domains", () => {
         oauth_providers: [{ id: "spotify", type: "shared" }],
       }
     });
-
+});
+    await InternalApiKey.createAndSetProjectKeys();
     // Configure multiple domains, only one matches
     const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
       method: "PATCH",

From da6d04e3a256fa29a3ef6210c9b96de15cc01751 Mon Sep 17 00:00:00 2001
From: Konsti Wohlwend <n2d4xc@gmail.com>
Date: Wed, 13 Aug 2025 18:13:07 -0700
Subject: [PATCH 13/16] Update
 apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts

---
 .../endpoints/api/v1/auth/oauth/wildcard-domains.test.ts        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
index e1fe8cf983..d7e28e8abd 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
@@ -292,7 +292,7 @@ describe("OAuth with wildcard domains", () => {
             baseUrl: 'http://localhost:8107', // This one matches!
             handlerPath: '/handler',
           },
-          'domains.allowLocalhost': true,
+          'domains.allowLocalhost': false,
         }),
       },
     });

From 3eb48f15507461bae9378a1d50fb8d72f9951686 Mon Sep 17 00:00:00 2001
From: Konstantin Wohlwend <n2d4xc@gmail.com>
Date: Wed, 13 Aug 2025 18:20:03 -0700
Subject: [PATCH 14/16] fix

---
 CLAUDE.md                                   |  3 +
 apps/backend/src/lib/redirect-urls.test.tsx | 62 +++++++++++++--------
 apps/backend/src/lib/redirect-urls.tsx      | 21 ++-----
 3 files changed, 47 insertions(+), 39 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 89e16f0ffc..743c189775 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -75,3 +75,6 @@ To see all development ports, refer to the index.html of `apps/dev-launchpad/pub
 - Sometimes, the typecheck will give errors along the line of "Cannot assign Buffer to Uint8Array" or similar, on changes that are completely unrelated to your own changes. If that happens, tell the user to run `pnpm clean && pnpm i && pnpm run codegen && pnpm build:packages`, and restart the dev server (you cannot run this yourself). After that's done, the typecheck should pass.
 - When writing tests, prefer .toMatchInlineSnapshot over other selectors, if possible. You can check (and modify) the snapshot-serializer.ts file to see how the snapshots are formatted and how non-deterministic values are handled.
 - Whenever you learn something new, or at the latest right before you call the `Stop` tool, write whatever you learned into the ./claude/CLAUDE-KNOWLEDGE.md file, in the Q&A format in there. You will later be able to look up knowledge from there (based on the question you asked).
+
+### Code-related
+- Use ES6 maps instead of records wherever you can.
diff --git a/apps/backend/src/lib/redirect-urls.test.tsx b/apps/backend/src/lib/redirect-urls.test.tsx
index efa71819eb..4e37b7cc06 100644
--- a/apps/backend/src/lib/redirect-urls.test.tsx
+++ b/apps/backend/src/lib/redirect-urls.test.tsx
@@ -1,4 +1,4 @@
-import { describe, it, expect } from 'vitest';
+import { describe, expect, it } from 'vitest';
 import { validateRedirectUrl } from './redirect-urls';
 import { Tenancy } from './tenancies';
 
@@ -29,8 +29,10 @@ describe('validateRedirectUrl', () => {
 
       expect(validateRedirectUrl('https://example.com/handler', tenancy)).toBe(true);
       expect(validateRedirectUrl('https://example.com/handler/callback', tenancy)).toBe(true);
-      expect(validateRedirectUrl('https://example.com/other', tenancy)).toBe(false);
-      expect(validateRedirectUrl('https://other.com/handler', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://example.com/other', tenancy)).toBe(true); // Any path on trusted domain is valid
+      expect(validateRedirectUrl('https://example.com/', tenancy)).toBe(true); // Root path is also valid
+      expect(validateRedirectUrl('https://other.com/handler', tenancy)).toBe(false); // Different domain is not trusted
+      expect(validateRedirectUrl('https://example.com.other.com/handler', tenancy)).toBe(false); // Similar different domain is also not trusted
     });
 
     it('should validate protocol matching', () => {
@@ -44,7 +46,8 @@ describe('validateRedirectUrl', () => {
       });
 
       expect(validateRedirectUrl('https://example.com/handler', tenancy)).toBe(true);
-      expect(validateRedirectUrl('http://example.com/handler', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://example.com/any/path', tenancy)).toBe(true); // Any path is valid
+      expect(validateRedirectUrl('http://example.com/handler', tenancy)).toBe(false); // Wrong protocol
     });
   });
 
@@ -60,10 +63,11 @@ describe('validateRedirectUrl', () => {
       });
 
       expect(validateRedirectUrl('https://api.example.com/handler', tenancy)).toBe(true);
-      expect(validateRedirectUrl('https://www.example.com/handler', tenancy)).toBe(true);
-      expect(validateRedirectUrl('https://staging.example.com/handler', tenancy)).toBe(true);
-      expect(validateRedirectUrl('https://example.com/handler', tenancy)).toBe(false);
-      expect(validateRedirectUrl('https://api.v2.example.com/handler', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://api.example.com/any/path', tenancy)).toBe(true); // Any path is valid
+      expect(validateRedirectUrl('https://www.example.com/', tenancy)).toBe(true); // Root path is valid
+      expect(validateRedirectUrl('https://staging.example.com/other', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://example.com/handler', tenancy)).toBe(false); // Not a subdomain
+      expect(validateRedirectUrl('https://api.v2.example.com/handler', tenancy)).toBe(false); // Too many subdomains for single *
     });
 
     it('should validate double wildcard patterns', () => {
@@ -77,9 +81,10 @@ describe('validateRedirectUrl', () => {
       });
 
       expect(validateRedirectUrl('https://api.example.com/handler', tenancy)).toBe(true);
-      expect(validateRedirectUrl('https://api.v2.example.com/handler', tenancy)).toBe(true);
-      expect(validateRedirectUrl('https://a.b.c.example.com/handler', tenancy)).toBe(true);
-      expect(validateRedirectUrl('https://example.com/handler', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://api.example.com/', tenancy)).toBe(true); // Root path is valid
+      expect(validateRedirectUrl('https://api.v2.example.com/other/path', tenancy)).toBe(true); // Any path is valid
+      expect(validateRedirectUrl('https://a.b.c.example.com/deep/nested/path', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://example.com/handler', tenancy)).toBe(false); // Not a subdomain
     });
 
     it('should validate wildcard patterns with prefixes', () => {
@@ -93,10 +98,10 @@ describe('validateRedirectUrl', () => {
       });
 
       expect(validateRedirectUrl('https://api-v1.example.com/handler', tenancy)).toBe(true);
-      expect(validateRedirectUrl('https://api-v2.example.com/handler', tenancy)).toBe(true);
-      expect(validateRedirectUrl('https://api-prod.example.com/handler', tenancy)).toBe(true);
-      expect(validateRedirectUrl('https://api.example.com/handler', tenancy)).toBe(false);
-      expect(validateRedirectUrl('https://v1-api.example.com/handler', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://api-v2.example.com/any/path', tenancy)).toBe(true); // Any path is valid
+      expect(validateRedirectUrl('https://api-prod.example.com/', tenancy)).toBe(true); // Root path is valid
+      expect(validateRedirectUrl('https://api.example.com/handler', tenancy)).toBe(false); // Missing prefix
+      expect(validateRedirectUrl('https://v1-api.example.com/handler', tenancy)).toBe(false); // Wrong prefix position
     });
 
     it('should validate multiple wildcard patterns', () => {
@@ -110,9 +115,10 @@ describe('validateRedirectUrl', () => {
       });
 
       expect(validateRedirectUrl('https://mail.example.org/handler', tenancy)).toBe(true);
-      expect(validateRedirectUrl('https://api.company.org/handler', tenancy)).toBe(true);
-      expect(validateRedirectUrl('https://example.org/handler', tenancy)).toBe(false);
-      expect(validateRedirectUrl('https://a.b.c.org/handler', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://mail.example.org/any/path', tenancy)).toBe(true); // Any path is valid
+      expect(validateRedirectUrl('https://api.company.org/', tenancy)).toBe(true); // Root path is valid
+      expect(validateRedirectUrl('https://example.org/handler', tenancy)).toBe(false); // Not enough subdomain levels
+      expect(validateRedirectUrl('https://a.b.c.org/handler', tenancy)).toBe(false); // Too many subdomain levels
     });
   });
 
@@ -145,7 +151,7 @@ describe('validateRedirectUrl', () => {
   });
 
   describe('path validation', () => {
-    it('should validate handler path matching', () => {
+    it('should allow any path on trusted domains (handlerPath is only a default)', () => {
       const tenancy = createMockTenancy({
         domains: {
           allowLocalhost: false,
@@ -155,13 +161,15 @@ describe('validateRedirectUrl', () => {
         },
       });
 
+      // All paths on the trusted domain should be valid
       expect(validateRedirectUrl('https://example.com/auth/handler', tenancy)).toBe(true);
       expect(validateRedirectUrl('https://example.com/auth/handler/callback', tenancy)).toBe(true);
-      expect(validateRedirectUrl('https://example.com/auth', tenancy)).toBe(false);
-      expect(validateRedirectUrl('https://example.com/other/handler', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://example.com/auth', tenancy)).toBe(true); // Any path is valid
+      expect(validateRedirectUrl('https://example.com/other/handler', tenancy)).toBe(true); // Any path is valid
+      expect(validateRedirectUrl('https://example.com/', tenancy)).toBe(true); // Root is valid
     });
 
-    it('should work with wildcard domains and path validation', () => {
+    it('should work with wildcard domains (any path is valid)', () => {
       const tenancy = createMockTenancy({
         domains: {
           allowLocalhost: false,
@@ -171,10 +179,12 @@ describe('validateRedirectUrl', () => {
         },
       });
 
+      // All paths on matched domains should be valid
       expect(validateRedirectUrl('https://api.example.com/api/auth', tenancy)).toBe(true);
       expect(validateRedirectUrl('https://app.example.com/api/auth/callback', tenancy)).toBe(true);
-      expect(validateRedirectUrl('https://api.example.com/api', tenancy)).toBe(false);
-      expect(validateRedirectUrl('https://api.example.com/other/auth', tenancy)).toBe(false);
+      expect(validateRedirectUrl('https://api.example.com/api', tenancy)).toBe(true); // Any path is valid
+      expect(validateRedirectUrl('https://api.example.com/other/auth', tenancy)).toBe(true); // Any path is valid
+      expect(validateRedirectUrl('https://api.example.com/', tenancy)).toBe(true); // Root is valid
     });
   });
 
@@ -453,9 +463,13 @@ describe('validateRedirectUrl', () => {
         },
       });
 
+      // Any path on trusted domains should be valid
       expect(validateRedirectUrl('https://example.com/handler', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://example.com/any/path', tenancy)).toBe(true);
       expect(validateRedirectUrl('https://api.staging.com/auth', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://api.staging.com/different/path', tenancy)).toBe(true);
       expect(validateRedirectUrl('https://api.v2.production.com/callback', tenancy)).toBe(true);
+      expect(validateRedirectUrl('https://api.v2.production.com/', tenancy)).toBe(true);
       expect(validateRedirectUrl('https://other.com/handler', tenancy)).toBe(false);
     });
   });
diff --git a/apps/backend/src/lib/redirect-urls.tsx b/apps/backend/src/lib/redirect-urls.tsx
index 27a6696939..a7d486c074 100644
--- a/apps/backend/src/lib/redirect-urls.tsx
+++ b/apps/backend/src/lib/redirect-urls.tsx
@@ -30,7 +30,7 @@ function portsMatch(url1: URL, url2: URL): boolean {
 /**
  * Validates a URL against a domain pattern (with or without wildcards)
  */
-function matchesDomain(testUrl: URL, pattern: string, handlerPath: string): boolean {
+function matchesDomain(testUrl: URL, pattern: string): boolean {
   const baseUrl = createUrlIfValid(pattern);
 
   // If pattern is invalid as a URL, it might contain wildcards
@@ -42,7 +42,7 @@ function matchesDomain(testUrl: URL, pattern: string, handlerPath: string): bool
       return false;
     }
 
-    const [, protocol, hostPattern, basePath] = match;
+    const [, protocol, hostPattern] = match;
 
     // Check protocol
     if (testUrl.protocol + '//' !== protocol) {
@@ -53,26 +53,17 @@ function matchesDomain(testUrl: URL, pattern: string, handlerPath: string): bool
     const hasPortInPattern = hostPattern.includes(':');
     if (hasPortInPattern) {
       // Pattern includes port - match against normalized host:port
-      if (!matchHostnamePattern(hostPattern, normalizePort(testUrl))) {
-        return false;
-      }
+      return matchHostnamePattern(hostPattern, normalizePort(testUrl));
     } else {
       // Pattern doesn't include port - match hostname only, require default port
-      if (!matchHostnamePattern(hostPattern, testUrl.hostname) || !isDefaultPort(testUrl)) {
-        return false;
-      }
+      return matchHostnamePattern(hostPattern, testUrl.hostname) && isDefaultPort(testUrl);
     }
-
-    // Check path
-    const fullPath = basePath === '/' ? handlerPath : basePath + handlerPath;
-    return testUrl.pathname.startsWith(fullPath || '/');
   }
 
   // For non-wildcard patterns, use URL comparison
   return baseUrl.protocol === testUrl.protocol &&
          baseUrl.hostname === testUrl.hostname &&
-         portsMatch(baseUrl, testUrl) &&
-         testUrl.pathname.startsWith(handlerPath || '/');
+         portsMatch(baseUrl, testUrl);
 }
 
 export function validateRedirectUrl(
@@ -89,6 +80,6 @@ export function validateRedirectUrl(
 
   // Check trusted domains
   return Object.values(tenancy.config.domains.trustedDomains).some(domain =>
-    domain.baseUrl && matchesDomain(url, domain.baseUrl, domain.handlerPath || '/')
+    domain.baseUrl && matchesDomain(url, domain.baseUrl)
   );
 }

From 414536c1c1b13ff696ec37b96298a02276d4720c Mon Sep 17 00:00:00 2001
From: "claude[bot]" <209825114+claude[bot]@users.noreply.github.com>
Date: Thu, 14 Aug 2025 01:26:00 +0000
Subject: [PATCH 15/16] Fix test issues: replace JSON utils, remove unused
 imports, fix config

- Replace JSON.parse/JSON.stringify with parseJson/stringifyJson utilities
- Remove unused localRedirectUrl imports from OAuth test files
- Remove debug console.log statement in passkey test
- Fix syntax error in OAuth wildcard test (missing closing brace)
- Set proper allowLocalhost configuration values
- Add proper imports for JSON utilities

Co-authored-by: Konsti Wohlwend <N2D4@users.noreply.github.com>
---
 .../auth/oauth/exact-domain-matching.test.ts  | 19 +++++++-------
 .../v1/auth/oauth/wildcard-domains.test.ts    | 26 +++++++++----------
 .../v1/auth/passkey/wildcard-domains.test.ts  | 22 +++++++---------
 3 files changed, 33 insertions(+), 34 deletions(-)

diff --git a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts
index 160b8bc511..810e9a2d5c 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/exact-domain-matching.test.ts
@@ -1,6 +1,7 @@
 import { describe } from "vitest";
-import { it, localRedirectUrl } from "../../../../../../helpers";
+import { it } from "../../../../../../helpers";
 import { Auth, InternalApiKey, Project, niceBackendFetch } from "../../../../../backend-helpers";
+import { stringifyJson } from "@stackframe/stack-shared/dist/utils/json";
 
 describe("OAuth with exact domain matching", () => {
   it("should allow OAuth with exact matching domain", async ({ expect }) => {
@@ -19,7 +20,7 @@ describe("OAuth with exact domain matching", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.exact': {
             baseUrl: 'http://localhost:8107',
             handlerPath: '/handler',
@@ -52,7 +53,7 @@ describe("OAuth with exact domain matching", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.production': {
             baseUrl: 'https://app.production.com',
             handlerPath: '/auth/handler',
@@ -85,7 +86,7 @@ describe("OAuth with exact domain matching", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.subdomain': {
             baseUrl: 'https://app.example.com',
             handlerPath: '/handler',
@@ -118,7 +119,7 @@ describe("OAuth with exact domain matching", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.withport': {
             baseUrl: 'http://localhost:3000',
             handlerPath: '/handler',
@@ -151,7 +152,7 @@ describe("OAuth with exact domain matching", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.https': {
             baseUrl: 'https://localhost:8107',
             handlerPath: '/handler',
@@ -184,7 +185,7 @@ describe("OAuth with exact domain matching", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.withpath': {
             baseUrl: 'http://localhost:8107',
             handlerPath: '/auth/oauth/callback', // Different path than default /handler
@@ -217,7 +218,7 @@ describe("OAuth with exact domain matching", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.prod': {
             baseUrl: 'https://app.production.com',
             handlerPath: '/handler',
@@ -257,7 +258,7 @@ describe("OAuth with exact domain matching", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.prod': {
             baseUrl: 'https://app.production.com',
             handlerPath: '/handler',
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
index d7e28e8abd..7ef22578cb 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/auth/oauth/wildcard-domains.test.ts
@@ -1,6 +1,7 @@
 import { describe } from "vitest";
-import { it, localRedirectUrl } from "../../../../../../helpers";
+import { it } from "../../../../../../helpers";
 import { Auth, InternalApiKey, Project, niceBackendFetch } from "../../../../../backend-helpers";
+import { parseJson, stringifyJson } from "@stackframe/stack-shared/dist/utils/json";
 
 describe("OAuth with wildcard domains", () => {
   it("should work with exact domain configuration", async ({ expect }) => {
@@ -19,12 +20,12 @@ describe("OAuth with wildcard domains", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.exact': {
             baseUrl: 'http://localhost:8107',
             handlerPath: '/handler',
           },
-          'domains.allowLocalhost': true,
+          'domains.allowLocalhost': false,
         }),
       },
     });
@@ -51,7 +52,7 @@ describe("OAuth with wildcard domains", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.exact': {
             baseUrl: 'https://app.example.com',
             handlerPath: '/handler',
@@ -84,7 +85,7 @@ describe("OAuth with wildcard domains", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.wildcard': {
             baseUrl: 'http://*.localhost:8107',
             handlerPath: '/handler',
@@ -116,7 +117,7 @@ describe("OAuth with wildcard domains", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.wildcard': {
             baseUrl: 'https://*.example.com',
             handlerPath: '/handler',
@@ -149,7 +150,7 @@ describe("OAuth with wildcard domains", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.double': {
             baseUrl: 'http://**.localhost:8107',
             handlerPath: '/handler',
@@ -181,7 +182,7 @@ describe("OAuth with wildcard domains", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.double': {
             baseUrl: 'https://**.example.org', // Different TLD - won't match localhost
             handlerPath: '/handler',
@@ -214,7 +215,7 @@ describe("OAuth with wildcard domains", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.prefix': {
             baseUrl: 'http://local*:8107', // Should match localhost
             handlerPath: '/handler',
@@ -246,7 +247,7 @@ describe("OAuth with wildcard domains", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.prefix': {
             baseUrl: 'http://api-*:8107', // Won't match localhost
             handlerPath: '/handler',
@@ -269,7 +270,6 @@ describe("OAuth with wildcard domains", () => {
         oauth_providers: [{ id: "spotify", type: "shared" }],
       }
     });
-});
     await InternalApiKey.createAndSetProjectKeys();
     // Configure multiple domains, only one matches
     const configResponse = await niceBackendFetch("/api/v1/internal/config/override", {
@@ -279,7 +279,7 @@ describe("OAuth with wildcard domains", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.prod': {
             baseUrl: 'https://app.production.com',
             handlerPath: '/handler',
@@ -308,7 +308,7 @@ describe("OAuth with wildcard domains", () => {
     });
     expect(getResponse.status).toBe(200);
 
-    const config = JSON.parse(getResponse.body.config_string);
+    const config = parseJson(getResponse.body.config_string);
     expect(Object.keys(config.domains.trustedDomains).length).toBe(3);
   });
 });
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/auth/passkey/wildcard-domains.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/auth/passkey/wildcard-domains.test.ts
index 75932f2c79..e26907ab6b 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/auth/passkey/wildcard-domains.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/auth/passkey/wildcard-domains.test.ts
@@ -1,6 +1,7 @@
 import { describe } from "vitest";
 import { it } from "../../../../../../helpers";
 import { Auth, InternalApiKey, Project, niceBackendFetch } from "../../../../../backend-helpers";
+import { parseJson, stringifyJson } from "@stackframe/stack-shared/dist/utils/json";
 
 describe("Passkey with wildcard domains", () => {
   it("should store wildcard domains in config correctly", async ({ expect }) => {
@@ -18,7 +19,7 @@ describe("Passkey with wildcard domains", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.exact': {
             baseUrl: 'https://app.example.com',
             handlerPath: '/handler',
@@ -54,7 +55,7 @@ describe("Passkey with wildcard domains", () => {
     });
     expect(getResponse.status).toBe(200);
 
-    const config = JSON.parse(getResponse.body.config_string);
+    const config = parseJson(getResponse.body.config_string);
     expect(config.domains.trustedDomains).toMatchObject({
       'exact': {
         baseUrl: 'https://app.example.com',
@@ -96,7 +97,7 @@ describe("Passkey with wildcard domains", () => {
       method: "PATCH",
       accessType: "admin",
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.wildcard': {
             baseUrl: 'http://*:8103', // Will match http://localhost:8103 and any host on port 8103
             handlerPath: '/',
@@ -149,9 +150,6 @@ describe("Passkey with wildcard domains", () => {
       },
     });
 
-    if (registerResponse.status !== 200) {
-      console.log("Register failed with:", registerResponse.body);
-    }
     expect(registerResponse.status).toBe(200);
     expect(registerResponse.body).toHaveProperty("user_handle");
   });
@@ -175,7 +173,7 @@ describe("Passkey with wildcard domains", () => {
       method: "PATCH",
       accessType: "admin",
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.double': {
             baseUrl: 'http://**host:8103', // Will match localhost:8103
             handlerPath: '/',
@@ -237,7 +235,7 @@ describe("Passkey with wildcard domains", () => {
       method: "PATCH",
       accessType: "admin",
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.exact': {
             baseUrl: 'https://app.production.com',
             handlerPath: '/handler',
@@ -315,7 +313,7 @@ describe("Passkey with wildcard domains", () => {
       method: "PATCH",
       accessType: "admin",
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.wildcard': {
             baseUrl: 'https://*.example.com',
             handlerPath: '/handler',
@@ -387,7 +385,7 @@ describe("Passkey with wildcard domains", () => {
       method: "PATCH",
       accessType: "admin",
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.wildcard': {
             baseUrl: 'http://*:8103', // Will match localhost:8103
             handlerPath: '/',
@@ -448,7 +446,7 @@ describe("Passkey with wildcard domains", () => {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        config_override_string: JSON.stringify({
+        config_override_string: stringifyJson({
           'domains.trustedDomains.complex1': {
             baseUrl: 'https://api-*.*.example.com',
             handlerPath: '/handler',
@@ -476,7 +474,7 @@ describe("Passkey with wildcard domains", () => {
     });
     expect(getResponse.status).toBe(200);
 
-    const config = JSON.parse(getResponse.body.config_string);
+    const config = parseJson(getResponse.body.config_string);
     expect(config.domains.trustedDomains.complex1.baseUrl).toBe('https://api-*.*.example.com');
     expect(config.domains.trustedDomains.complex2.baseUrl).toBe('https://**.api.example.com');
     expect(config.domains.trustedDomains.complex3.baseUrl).toBe('https://*-staging.example.com');

From 7631fabac81ae0b925251d00af52d78da14365ee Mon Sep 17 00:00:00 2001
From: Konstantin Wohlwend <n2d4xc@gmail.com>
Date: Sat, 16 Aug 2025 15:41:10 -0700
Subject: [PATCH 16/16] JS Execution Engine

---
 .claude/settings.json                         |  13 +-
 .vscode/settings.json                         |   2 +
 CLAUDE.md                                     |   3 +-
 apps/backend/.env                             |   5 +
 apps/backend/.env.development                 |   4 +
 apps/dev-launchpad/public/index.html          |  10 +
 .../tests/js-execution-engine/basic.test.ts   | 174 ++++++++
 .../js-execution-engine/checkpoint.test.ts    | 186 ++++++++
 .../complex-scripts.test.ts                   | 223 ++++++++++
 apps/js-execution-engine/.env                 |  12 +
 apps/js-execution-engine/.env.development     |   8 +
 apps/js-execution-engine/.env.production      |   0
 apps/js-execution-engine/.eslintrc.js         |   6 +
 apps/js-execution-engine/Dockerfile           | 137 ++++++
 apps/js-execution-engine/package.json         |  34 ++
 apps/js-execution-engine/src/index.ts         |  42 ++
 .../src/middleware/auth.ts                    |  19 +
 .../js-execution-engine/src/routes/execute.ts |  50 +++
 .../src/services/executor.ts                  | 173 ++++++++
 apps/js-execution-engine/src/services/s3.ts   |  53 +++
 .../src/services/vm-status.ts                 | 258 +++++++++++
 apps/js-execution-engine/tsconfig.json        |  20 +
 docker/server/.env                            |   4 +
 pnpm-lock.yaml                                | 399 ++++++++++++++----
 24 files changed, 1750 insertions(+), 85 deletions(-)
 create mode 100644 apps/e2e/tests/js-execution-engine/basic.test.ts
 create mode 100644 apps/e2e/tests/js-execution-engine/checkpoint.test.ts
 create mode 100644 apps/e2e/tests/js-execution-engine/complex-scripts.test.ts
 create mode 100644 apps/js-execution-engine/.env
 create mode 100644 apps/js-execution-engine/.env.development
 create mode 100644 apps/js-execution-engine/.env.production
 create mode 100644 apps/js-execution-engine/.eslintrc.js
 create mode 100644 apps/js-execution-engine/Dockerfile
 create mode 100644 apps/js-execution-engine/package.json
 create mode 100644 apps/js-execution-engine/src/index.ts
 create mode 100644 apps/js-execution-engine/src/middleware/auth.ts
 create mode 100644 apps/js-execution-engine/src/routes/execute.ts
 create mode 100644 apps/js-execution-engine/src/services/executor.ts
 create mode 100644 apps/js-execution-engine/src/services/s3.ts
 create mode 100644 apps/js-execution-engine/src/services/vm-status.ts
 create mode 100644 apps/js-execution-engine/tsconfig.json

diff --git a/.claude/settings.json b/.claude/settings.json
index ee52ce43b2..a750210831 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -4,6 +4,7 @@
     "allow": [
       "Bash(pnpm typecheck:*)",
       "Bash(pnpm test:*)",
+      "Bash(pnpm build:*)",
       "Bash(pnpm lint:*)",
       "Bash(find:*)",
       "Bash(ls:*)",
@@ -21,7 +22,17 @@
         "hooks": [
           {
             "type": "command",
-            "command": "pnpm run lint --fix"
+            "command": "jq -r '.tool_input.file_path' | { read file_path; if [[ \"$file_path\" =~ \\.(js|jsx|ts|tsx)$ ]]; then pnpm run lint --fix \"$file_path\" || true; fi }"
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "(pnpm run typecheck || exit 2) && (pnpm run lint || exit 2)"
           }
         ]
       }
diff --git a/.vscode/settings.json b/.vscode/settings.json
index 775973a21e..93a151ef69 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -74,6 +74,7 @@
     "psql",
     "qrcode",
     "quetzallabs",
+    "quickjs",
     "rehype",
     "reqs",
     "retryable",
@@ -100,6 +101,7 @@
     "upsert",
     "Upvotes",
     "upvoting",
+    "uuidv",
     "webapi",
     "webauthn",
     "Whitespaces",
diff --git a/CLAUDE.md b/CLAUDE.md
index 743c189775..6b65021073 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -72,9 +72,10 @@ To see all development ports, refer to the index.html of `apps/dev-launchpad/pub
 - Environment variables are pre-configured in `.env.development` files
 - Always run typecheck, lint, and test to make sure your changes are working as expected. You can save time by only linting and testing the files you've changed (and/or related E2E tests).
 - The project uses a custom route handler system in the backend for consistent API responses
-- Sometimes, the typecheck will give errors along the line of "Cannot assign Buffer to Uint8Array" or similar, on changes that are completely unrelated to your own changes. If that happens, tell the user to run `pnpm clean && pnpm i && pnpm run codegen && pnpm build:packages`, and restart the dev server (you cannot run this yourself). After that's done, the typecheck should pass.
 - When writing tests, prefer .toMatchInlineSnapshot over other selectors, if possible. You can check (and modify) the snapshot-serializer.ts file to see how the snapshots are formatted and how non-deterministic values are handled.
 - Whenever you learn something new, or at the latest right before you call the `Stop` tool, write whatever you learned into the ./claude/CLAUDE-KNOWLEDGE.md file, in the Q&A format in there. You will later be able to look up knowledge from there (based on the question you asked).
 
 ### Code-related
 - Use ES6 maps instead of records wherever you can.
+- ALWAYS use `pnpm`, never use `npm` or `yarn`.
+- Sometimes, the typecheck will give errors along the line of "Cannot assign Buffer to Uint8Array" or similar, on changes that are completely unrelated to your own changes. If that happens, tell the user to run `pnpm clean && pnpm i && pnpm run codegen && pnpm build:packages`, and restart the dev server (you cannot run this yourself). After that's done, the typecheck should pass.
diff --git a/apps/backend/.env b/apps/backend/.env
index c62e3063b5..90898c8081 100644
--- a/apps/backend/.env
+++ b/apps/backend/.env
@@ -32,6 +32,11 @@ STACK_SPOTIFY_CLIENT_SECRET=# client secret
 
 STACK_ALLOW_SHARED_OAUTH_ACCESS_TOKENS=# allow shared oauth provider to also use connected account access token, this should only be used for development and testing
 
+# JS Execution Engine, required for workflows
+STACK_JS_EXECUTION_ENGINE_URL=# url of the JS execution engine API
+STACK_JS_EXECUTION_ENGINE_SECRET=# secret of the JS execution engine
+
+
 # Email
 # For local development, you can spin up a local SMTP server like inbucket
 STACK_EMAIL_HOST=# for local inbucket: 127.0.0.1
diff --git a/apps/backend/.env.development b/apps/backend/.env.development
index 95d8b99692..3f51db539f 100644
--- a/apps/backend/.env.development
+++ b/apps/backend/.env.development
@@ -48,6 +48,10 @@ CRON_SECRET=mock_cron_secret
 STACK_FREESTYLE_API_KEY=mock_stack_freestyle_key
 STACK_OPENAI_API_KEY=mock_openai_api_key
 STACK_STRIPE_SECRET_KEY=sk_test_mockstripekey
+
+STACK_JS_EXECUTION_ENGINE_URL=http://localhost:8124
+STACK_JS_EXECUTION_ENGINE_SECRET=dev-secret-placeholder-123456
+
 STACK_STRIPE_WEBHOOK_SECRET=mock_stripe_webhook_secret
 
 # S3 Configuration for local development using s3mock
diff --git a/apps/dev-launchpad/public/index.html b/apps/dev-launchpad/public/index.html
index 62a58fb176..c324a0f5ec 100644
--- a/apps/dev-launchpad/public/index.html
+++ b/apps/dev-launchpad/public/index.html
@@ -288,6 +288,16 @@ <h2 style="margin-top: 64px;">Background services</h2>
             "React example",
           ],
         },
+        {
+          name: "JS Execution Engine",
+          port: 8124,
+          description: [
+            "Src: ./apps/js-execution-engine",
+            "Script execution service",
+          ],
+          importance: 1,
+          img: "https://www.svgrepo.com/show/373705/js-official.svg",
+        },
       ];
 
       const appsContainers = document.querySelectorAll(".apps-container");
diff --git a/apps/e2e/tests/js-execution-engine/basic.test.ts b/apps/e2e/tests/js-execution-engine/basic.test.ts
new file mode 100644
index 0000000000..8d45171ad9
--- /dev/null
+++ b/apps/e2e/tests/js-execution-engine/basic.test.ts
@@ -0,0 +1,174 @@
+import { beforeAll, describe, expect, it } from "vitest";
+
+const JS_EXECUTION_ENGINE_URL = "http://localhost:8124";
+const JS_EXECUTION_ENGINE_SECRET = "dev-secret-placeholder-123456";
+
+describe("JS Execution Engine - Basic functionality", () => {
+  beforeAll(async () => {
+    // Wait for service to be ready
+    const maxRetries = 30;
+    for (let i = 0; i < maxRetries; i++) {
+      try {
+        const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/health`, {
+          headers: {
+            Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+          },
+        });
+        if (response.ok) break;
+      } catch {
+        // Service not ready yet
+      }
+      await new Promise(resolve => setTimeout(resolve, 1000));
+    }
+  });
+
+  it("should reject requests without authentication", async () => {
+    const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        script: "return 1 + 1;",
+        engine: "quickjs",
+      }),
+    });
+
+    expect(response.status).toBe(401);
+    const body = await response.json();
+    expect(body).toMatchInlineSnapshot(`
+      {
+        "error": "Unauthorized",
+      }
+    `);
+  });
+
+  it("should reject requests with invalid authentication", async () => {
+    const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: "Bearer invalid-secret",
+      },
+      body: JSON.stringify({
+        script: "return 1 + 1;",
+        engine: "quickjs",
+      }),
+    });
+
+    expect(response.status).toBe(401);
+  });
+
+  it("should execute a simple QuickJS script", async () => {
+    const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+      },
+      body: JSON.stringify({
+        script: "return 1 + 1;",
+        engine: "quickjs",
+      }),
+    });
+
+    expect(response.status).toBe(200);
+    const body = await response.json();
+    expect(body.result).toBe(2);
+    expect(body.checkpoint_storage_id).toBeTypeOf("string");
+    expect(body.checkpoint_byte_length).toBeGreaterThan(0);
+  });
+
+  it("should execute a simple Node.js script", async () => {
+    const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+      },
+      body: JSON.stringify({
+        script: "return 2 + 2;",
+        engine: "nodejs",
+      }),
+    });
+
+    expect(response.status).toBe(200);
+    const body = await response.json();
+    expect(body.result).toBe(4);
+    expect(body.checkpoint_storage_id).toBeTypeOf("string");
+    expect(body.checkpoint_byte_length).toBeGreaterThan(0);
+  });
+
+  it("should execute a simple Hermes script", async () => {
+    const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+      },
+      body: JSON.stringify({
+        script: "return 3 + 3;",
+        engine: "hermes",
+      }),
+    });
+
+    expect(response.status).toBe(200);
+    const body = await response.json();
+    expect(body.result).toBe(6);
+    expect(body.checkpoint_storage_id).toBeTypeOf("string");
+    expect(body.checkpoint_byte_length).toBeGreaterThan(0);
+  });
+
+  it("should validate request body", async () => {
+    const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+      },
+      body: JSON.stringify({
+        script: "return 1 + 1;",
+        engine: "invalid-engine",
+      }),
+    });
+
+    expect(response.status).toBe(400);
+    const body = await response.json();
+    expect(body.error).toBe("Invalid request");
+    expect(body.details).toBeDefined();
+  });
+
+  it("should handle missing script field", async () => {
+    const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+      },
+      body: JSON.stringify({
+        engine: "quickjs",
+      }),
+    });
+
+    expect(response.status).toBe(400);
+    const body = await response.json();
+    expect(body.error).toBe("Invalid request");
+  });
+
+  it("should handle missing engine field", async () => {
+    const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+      },
+      body: JSON.stringify({
+        script: "return 1 + 1;",
+      }),
+    });
+
+    expect(response.status).toBe(400);
+    const body = await response.json();
+    expect(body.error).toBe("Invalid request");
+  });
+});
diff --git a/apps/e2e/tests/js-execution-engine/checkpoint.test.ts b/apps/e2e/tests/js-execution-engine/checkpoint.test.ts
new file mode 100644
index 0000000000..7c8eedeec9
--- /dev/null
+++ b/apps/e2e/tests/js-execution-engine/checkpoint.test.ts
@@ -0,0 +1,186 @@
+import { it, describe, expect, beforeAll } from "vitest";
+
+const JS_EXECUTION_ENGINE_URL = "http://localhost:8124";
+const JS_EXECUTION_ENGINE_SECRET = "dev-secret-placeholder-123456";
+
+describe("JS Execution Engine - Checkpoint functionality", () => {
+  beforeAll(async () => {
+    // Wait for service to be ready
+    const maxRetries = 30;
+    for (let i = 0; i < maxRetries; i++) {
+      try {
+        const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/health`, {
+          headers: {
+            Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+          },
+        });
+        if (response.ok) break;
+      } catch {
+        // Service not ready yet
+      }
+      await new Promise(resolve => setTimeout(resolve, 1000));
+    }
+  });
+
+  it("should create and restore from checkpoint", async () => {
+    // First execution - create initial state
+    const firstResponse = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+      },
+      body: JSON.stringify({
+        script: `
+          global.counter = (global.counter || 0) + 1;
+          return global.counter;
+        `,
+        engine: "nodejs",
+      }),
+    });
+
+    expect(firstResponse.status).toBe(200);
+    const firstBody = await firstResponse.json();
+    expect(firstBody.result).toBe(1);
+    expect(firstBody.checkpoint_storage_id).toBeTypeOf("string");
+    expect(firstBody.checkpoint_byte_length).toBeGreaterThan(0);
+
+    const checkpointId = firstBody.checkpoint_storage_id;
+
+    // Second execution - restore from checkpoint and increment
+    const secondResponse = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+      },
+      body: JSON.stringify({
+        script: `
+          global.counter = (global.counter || 0) + 1;
+          return global.counter;
+        `,
+        engine: "nodejs",
+        checkpoint_storage_id: checkpointId,
+      }),
+    });
+
+    expect(secondResponse.status).toBe(200);
+    const secondBody = await secondResponse.json();
+    expect(secondBody.result).toBe(2);
+    expect(secondBody.checkpoint_storage_id).toBeTypeOf("string");
+  });
+
+  it("should maintain state across checkpoint restores", async () => {
+    // Initialize with some data
+    const initResponse = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+      },
+      body: JSON.stringify({
+        script: `
+          global.data = {
+            users: ["alice", "bob"],
+            count: 2,
+          };
+          return global.data;
+        `,
+        engine: "nodejs",
+      }),
+    });
+
+    expect(initResponse.status).toBe(200);
+    const initBody = await initResponse.json();
+    expect(initBody.result).toMatchInlineSnapshot(`
+      {
+        "count": 2,
+        "users": [
+          "alice",
+          "bob",
+        ],
+      }
+    `);
+
+    const checkpointId = initBody.checkpoint_storage_id;
+
+    // Modify the data using checkpoint
+    const modifyResponse = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+      },
+      body: JSON.stringify({
+        script: `
+          global.data.users.push("charlie");
+          global.data.count++;
+          return global.data;
+        `,
+        engine: "nodejs",
+        checkpoint_storage_id: checkpointId,
+      }),
+    });
+
+    expect(modifyResponse.status).toBe(200);
+    const modifyBody = await modifyResponse.json();
+    expect(modifyBody.result).toMatchInlineSnapshot(`
+      {
+        "count": 3,
+        "users": [
+          "alice",
+          "bob",
+          "charlie",
+        ],
+      }
+    `);
+  });
+
+  it("should handle invalid checkpoint ID gracefully", async () => {
+    const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+      },
+      body: JSON.stringify({
+        script: "return 42;",
+        engine: "quickjs",
+        checkpoint_storage_id: "non-existent-checkpoint-id",
+      }),
+    });
+
+    // Should still execute, just without the checkpoint
+    expect(response.status).toBe(200);
+    const body = await response.json();
+    expect(body.result).toBe(42);
+  });
+
+  it("should create separate checkpoints for different engines", async () => {
+    const engines = ["quickjs", "nodejs", "hermes"] as const;
+    const checkpoints: Record<string, string> = {};
+
+    for (const engine of engines) {
+      const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+        },
+        body: JSON.stringify({
+          script: `return "${engine}";`,
+          engine,
+        }),
+      });
+
+      expect(response.status).toBe(200);
+      const body = await response.json();
+      expect(body.result).toBe(engine);
+      checkpoints[engine] = body.checkpoint_storage_id;
+    }
+
+    // Verify all checkpoint IDs are unique
+    const uniqueCheckpoints = new Set(Object.values(checkpoints));
+    expect(uniqueCheckpoints.size).toBe(engines.length);
+  });
+});
diff --git a/apps/e2e/tests/js-execution-engine/complex-scripts.test.ts b/apps/e2e/tests/js-execution-engine/complex-scripts.test.ts
new file mode 100644
index 0000000000..bf3790aaab
--- /dev/null
+++ b/apps/e2e/tests/js-execution-engine/complex-scripts.test.ts
@@ -0,0 +1,223 @@
+import { it, describe, expect, beforeAll } from "vitest";
+
+const JS_EXECUTION_ENGINE_URL = "http://localhost:8124";
+const JS_EXECUTION_ENGINE_SECRET = "dev-secret-placeholder-123456";
+
+describe("JS Execution Engine - Complex Scripts", () => {
+  beforeAll(async () => {
+    // Wait for service to be ready
+    const maxRetries = 30;
+    for (let i = 0; i < maxRetries; i++) {
+      try {
+        const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/health`, {
+          headers: {
+            Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+          },
+        });
+        if (response.ok) break;
+      } catch {
+        // Service not ready yet
+      }
+      await new Promise(resolve => setTimeout(resolve, 1000));
+    }
+  });
+
+  it("should execute the factorial example from the spec", async () => {
+    const script = `
+      // get the value of the factorials of the numbers from 1 to 10 combined
+      const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+
+      function factorial(n) {
+        if (n === 0) {
+          return 1;
+        }
+        return n * factorial(n - 1);
+      }
+
+      const b = a.map(factorial);
+
+      return b.reduce((a, b) => a + b);
+    `;
+
+    const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+      },
+      body: JSON.stringify({
+        script,
+        engine: "quickjs",
+      }),
+    });
+
+    expect(response.status).toBe(200);
+    const body = await response.json();
+    // 1! + 2! + 3! + 4! + 5! + 6! + 7! + 8! + 9! + 10!
+    // = 1 + 2 + 6 + 24 + 120 + 720 + 5040 + 40320 + 362880 + 3628800
+    // = 4037913
+    expect(body.result).toBe(4037913);
+  });
+
+  it("should execute array operations", async () => {
+    const script = `
+      const numbers = [1, 2, 3, 4, 5];
+      const doubled = numbers.map(n => n * 2);
+      const sum = doubled.reduce((acc, n) => acc + n, 0);
+      return sum;
+    `;
+
+    const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+      },
+      body: JSON.stringify({
+        script,
+        engine: "nodejs",
+      }),
+    });
+
+    expect(response.status).toBe(200);
+    const body = await response.json();
+    expect(body.result).toBe(30); // (1+2+3+4+5) * 2 = 30
+  });
+
+  it("should execute object operations", async () => {
+    const script = `
+      const obj = {
+        a: 1,
+        b: 2,
+        c: 3,
+      };
+      
+      const keys = Object.keys(obj);
+      const values = Object.values(obj);
+      const sum = values.reduce((acc, val) => acc + val, 0);
+      
+      return {
+        keyCount: keys.length,
+        sum: sum,
+      };
+    `;
+
+    const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+      },
+      body: JSON.stringify({
+        script,
+        engine: "quickjs",
+      }),
+    });
+
+    expect(response.status).toBe(200);
+    const body = await response.json();
+    expect(body.result).toMatchInlineSnapshot(`
+      {
+        "keyCount": 3,
+        "sum": 6,
+      }
+    `);
+  });
+
+  it("should handle string operations", async () => {
+    const script = `
+      const str = "hello world";
+      const reversed = str.split('').reverse().join('');
+      const uppercase = str.toUpperCase();
+      
+      return {
+        original: str,
+        reversed: reversed,
+        uppercase: uppercase,
+        length: str.length,
+      };
+    `;
+
+    const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+      },
+      body: JSON.stringify({
+        script,
+        engine: "hermes",
+      }),
+    });
+
+    expect(response.status).toBe(200);
+    const body = await response.json();
+    expect(body.result).toMatchInlineSnapshot(`
+      {
+        "length": 11,
+        "original": "hello world",
+        "reversed": "dlrow olleh",
+        "uppercase": "HELLO WORLD",
+      }
+    `);
+  });
+
+  it("should handle nested functions", async () => {
+    const script = `
+      function outer(x) {
+        function inner(y) {
+          return x + y;
+        }
+        return inner;
+      }
+      
+      const addFive = outer(5);
+      const result = addFive(3);
+      
+      return result;
+    `;
+
+    const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+      },
+      body: JSON.stringify({
+        script,
+        engine: "nodejs",
+      }),
+    });
+
+    expect(response.status).toBe(200);
+    const body = await response.json();
+    expect(body.result).toBe(8);
+  });
+
+  it("should handle recursive functions", async () => {
+    const script = `
+      function fibonacci(n) {
+        if (n <= 1) return n;
+        return fibonacci(n - 1) + fibonacci(n - 2);
+      }
+      
+      return fibonacci(10);
+    `;
+
+    const response = await fetch(`${JS_EXECUTION_ENGINE_URL}/execute`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${JS_EXECUTION_ENGINE_SECRET}`,
+      },
+      body: JSON.stringify({
+        script,
+        engine: "quickjs",
+      }),
+    });
+
+    expect(response.status).toBe(200);
+    const body = await response.json();
+    expect(body.result).toBe(55);
+  });
+});
diff --git a/apps/js-execution-engine/.env b/apps/js-execution-engine/.env
new file mode 100644
index 0000000000..48e1567458
--- /dev/null
+++ b/apps/js-execution-engine/.env
@@ -0,0 +1,12 @@
+# JS Execution Engine Configuration
+
+# Server Configuration
+PORT=# the port to run the server on
+JS_EXECUTION_ENGINE_SECRET=# the secret used for authentication
+
+# S3 Configuration (optional, can use local storage)
+S3_REGION=
+S3_CHECKPOINT_BUCKET=
+S3_ACCESS_KEY_ID=
+S3_SECRET_ACCESS_KEY=
+S3_ENDPOINT=
diff --git a/apps/js-execution-engine/.env.development b/apps/js-execution-engine/.env.development
new file mode 100644
index 0000000000..a5f705e7aa
--- /dev/null
+++ b/apps/js-execution-engine/.env.development
@@ -0,0 +1,8 @@
+PORT=8124
+JS_EXECUTION_ENGINE_SECRET=dev-secret-placeholder-123456
+
+S3_ENDPOINT=http://localhost:9000
+S3_REGION=us-east-1
+S3_ACCESS_KEY_ID=minioadmin
+S3_SECRET_ACCESS_KEY=minioadmin
+S3_CHECKPOINT_BUCKET=js-execution-checkpoints
diff --git a/apps/js-execution-engine/.env.production b/apps/js-execution-engine/.env.production
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/apps/js-execution-engine/.eslintrc.js b/apps/js-execution-engine/.eslintrc.js
new file mode 100644
index 0000000000..51b882f29c
--- /dev/null
+++ b/apps/js-execution-engine/.eslintrc.js
@@ -0,0 +1,6 @@
+module.exports = {
+  "extends": [
+    "../../configs/eslint/defaults.js",
+  ],
+  "ignorePatterns": ['/*', '!/src']
+};
diff --git a/apps/js-execution-engine/Dockerfile b/apps/js-execution-engine/Dockerfile
new file mode 100644
index 0000000000..2ffd56f442
--- /dev/null
+++ b/apps/js-execution-engine/Dockerfile
@@ -0,0 +1,137 @@
+# syntax=docker/dockerfile:1.6
+FROM ubuntu:24.04
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    RAM=1024 \
+    VCPUS=2
+
+# Basic first install just so we can download the VM image
+RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates
+
+# --- VM assets (build-time) ---
+WORKDIR /vm
+# Ubuntu 24.04 (Noble) cloud image (qcow2 + cloud-init ready)
+RUN curl -fsSL -O https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img
+
+# QEMU + cloud-init tooling + Node + SSH/network tools
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      qemu-system-x86 qemu-utils cloud-image-utils \
+      tini nodejs npm procps \
+      openssh-client netcat-openbsd socat jq \
+    && rm -rf /var/lib/apt/lists/*
+
+# Generate an SSH keypair inside the image at build time
+RUN ssh-keygen -t rsa -b 4096 -N "" -f /vm/id_rsa
+
+# Minimal cloud-init: install Podman inside the VM
+RUN printf '%s\n' \
+  '#cloud-config' \
+  'ssh_deletekeys: false' \
+  'users:' \
+  '  - name: root' \
+  '    ssh-authorized-keys:' \
+  "      - $(cat /vm/id_rsa.pub)" \
+  'package_update: true' \
+  'packages:' \
+  '  - podman' \
+  '  - crun' \
+  '  - fuse-overlayfs' \
+  '  - uidmap' \
+  '  - iptables' \
+  '  - iproute2' \
+  > /vm/user-data \
+  && printf '' > /vm/meta-data \
+  && cloud-localds /vm/seed.img /vm/user-data /vm/meta-data
+
+# --- runtime launcher & node server ---
+WORKDIR /app
+
+ENV QEMU_CMD="qemu-system-x86_64 \
+  -machine accel=tcg \
+  -m "${RAM}" -smp "${VCPUS}" \
+  -drive if=virtio,file=/vm/noble-server-cloudimg-amd64.img,format=qcow2 \
+  -drive if=virtio,file=/vm/seed.img,format=raw \
+  -netdev user,id=net0,hostfwd=tcp::${SSH_PORT}-:22 \
+  -device virtio-net-pci,netdev=net0 \
+  -serial file:/tmp/qemu-serial.log \
+  -display none \
+  -daemonize \
+  -pidfile /tmp/qemu.pid"
+
+# Pre-build the VM
+RUN $QEMU_CMD -qmp unix:/tmp/qmp-sock,server,nowait \
+    && tail -n +1 -f /tmp/qemu-serial.log & \
+    while ! grep -q 'Finished .* Cloud-init: Final Stage' /tmp/qemu-serial.log; do sleep 1; done \
+    && sleep 5 \
+    && printf '{"execute":"stop"}\n' | socat - UNIX-CONNECT:/tmp/qmp-sock | jq -e '.return != null' \
+    && printf '{"execute":"savevm","arguments":{"name":"post-init"}}\n' | socat - UNIX-CONNECT:/tmp/qmp-sock | jq -e '.return != null' \
+    && printf '{"execute":"quit"}\n' | socat - UNIX-CONNECT:/tmp/qmp-sock | jq -e '.return != null' \
+    && sleep 20
+
+# Install Node.js 20
+RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
+    apt-get install -y nodejs && \
+    rm -rf /var/lib/apt/lists/*
+
+
+# Copy package files and install dependencies
+COPY package.json ./
+COPY tsconfig.json ./
+RUN npm install --verbose
+
+# Copy source code
+COPY src ./src
+
+# Build the application
+RUN npm run build
+
+RUN cat > /usr/local/bin/start.sh <<'EOF' && chmod +x /usr/local/bin/start.sh
+#!/usr/bin/env bash
+set -euo pipefail
+: "${RAM:=1024}"
+: "${VCPUS:=2}"
+: "${SSH_PORT:=10022}"
+
+echo "[$(date '+%Y-%m-%d %H:%M:%S')] Starting Ubuntu VM with QEMU..."
+
+# Boot the VM with SSH port forwarding and serial console
+$QEMU_CMD -loadvm post-init
+
+# Check if QEMU started successfully
+if [ -f /tmp/qemu.pid ]; then
+    PID=$(cat /tmp/qemu.pid)
+    echo "[$(date '+%Y-%m-%d %H:%M:%S')] QEMU VM started with PID: $PID"
+    echo "[$(date '+%Y-%m-%d %H:%M:%S')] SSH will be available on port ${SSH_PORT} once VM boots"
+else
+    echo "[$(date '+%Y-%m-%d %H:%M:%S')] ERROR: Failed to start QEMU VM"
+    exit 1
+fi
+
+# Monitor VM boot progress in background
+(
+    echo "[$(date '+%Y-%m-%d %H:%M:%S')] Monitoring VM boot progress..."
+    for i in {1..120}; do
+        # Check if SSH port is open
+        if timeout 1 bash -c "echo > /dev/tcp/localhost/${SSH_PORT}" 2>/dev/null; then
+            echo "[$(date '+%Y-%m-%d %H:%M:%S')] VM SSH port is now open on port ${SSH_PORT}"
+            break
+        fi
+        
+        # Show serial console progress every 10 seconds
+        if [ $((i % 10)) -eq 0 ] && [ -f /tmp/qemu-serial.log ]; then
+            LINES=$(wc -l < /tmp/qemu-serial.log 2>/dev/null || echo 0)
+            echo "[$(date '+%Y-%m-%d %H:%M:%S')] VM boot progress: Serial log has $LINES lines"
+        fi
+        
+        sleep 1
+    done
+) &
+
+echo "[$(date '+%Y-%m-%d %H:%M:%S')] Starting Node.js application..."
+
+# Run Node server in foreground
+exec node /app/dist/index.js
+EOF
+
+ENTRYPOINT ["/usr/bin/tini","--"]
+CMD ["/usr/local/bin/start.sh"]
diff --git a/apps/js-execution-engine/package.json b/apps/js-execution-engine/package.json
new file mode 100644
index 0000000000..b6f145133e
--- /dev/null
+++ b/apps/js-execution-engine/package.json
@@ -0,0 +1,34 @@
+{
+  "name": "@stack/js-execution-engine",
+  "version": "1.0.0",
+  "private": true,
+  "scripts": {
+    "clean": "rm -rf node_modules && rm -rf dist",
+    "dev": "touch .env.development && touch .env.development.local && touch .env && touch .env.local && pnpm build && docker run --rm -it -p 8124:8124 -e NODE_ENV=development --env-file .env --env-file .env.local --env-file .env.development --env-file .env.development.local js-execution-engine",
+    "start": "touch .env.production && touch .env.production.local && touch .env && touch .env.local && pnpm build && docker run --rm -it -p 8124:8124 -e NODE_ENV=production --env-file .env --env-file .env.local --env-file .env.production --env-file .env.production.local js-execution-engine",
+    "dev:local": "tsx watch --env-file .env.development src/index.ts",
+    "build": "docker build -t js-execution-engine -f Dockerfile .",
+    "lint": "eslint",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@aws-sdk/client-s3": "^3.679.0",
+    "@aws-sdk/lib-storage": "^3.679.0",
+    "cors": "^2.8.5",
+    "dotenv": "^16.4.5",
+    "express": "^4.21.1",
+    "uuid": "^11.0.4",
+    "zod": "^3.24.1"
+  },
+  "devDependencies": {
+    "@types/cors": "^2.8.17",
+    "@types/express": "^5.0.0",
+    "@types/node": "^22.10.5",
+    "@types/uuid": "^10.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.20.0",
+    "@typescript-eslint/parser": "^8.20.0",
+    "eslint": "^8.57.1",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.2"
+  }
+}
diff --git a/apps/js-execution-engine/src/index.ts b/apps/js-execution-engine/src/index.ts
new file mode 100644
index 0000000000..82a01f9c32
--- /dev/null
+++ b/apps/js-execution-engine/src/index.ts
@@ -0,0 +1,42 @@
+import cors from 'cors';
+import express from 'express';
+import { authMiddleware } from './middleware/auth';
+import { executeRouter } from './routes/execute';
+import { checkVMStatus } from './services/vm-status';
+
+const app = express();
+const PORT = process.env.PORT || 8124;
+
+app.use(cors());
+app.use(express.json({ limit: '50mb' }));
+app.set('json spaces', 2);
+
+// Health endpoint (no auth required)
+app.get('/health', async (_req, res) => {
+  const vmStatus = await checkVMStatus();
+  res.json({
+    status: 'ok',
+    app: 'running',
+    vm: vmStatus,
+    environment: {
+      node_env: process.env.NODE_ENV,
+      port: PORT,
+      ssh_port: process.env.SSH_PORT || 10022,
+    }
+  });
+});
+
+// Serial console endpoint (no auth required for debugging)
+app.get('/serial-console', async (_req, res) => {
+  const { getVMSerialConsole } = await import('./services/vm-status.js');
+  const serialLog = await getVMSerialConsole();
+  res.type('text/plain').send(serialLog);
+});
+
+// Apply auth middleware for all other routes
+app.use(authMiddleware);
+app.use(executeRouter);
+
+app.listen(PORT, () => {
+  // Server started on port ${PORT}
+});
diff --git a/apps/js-execution-engine/src/middleware/auth.ts b/apps/js-execution-engine/src/middleware/auth.ts
new file mode 100644
index 0000000000..2223f10bc9
--- /dev/null
+++ b/apps/js-execution-engine/src/middleware/auth.ts
@@ -0,0 +1,19 @@
+import { Request, Response, NextFunction } from 'express';
+
+export function authMiddleware(req: Request, res: Response, next: NextFunction): void {
+  const authHeader = req.headers.authorization;
+  const expectedSecret = process.env.JS_EXECUTION_ENGINE_SECRET;
+
+  if (!expectedSecret) {
+    console.error('JS_EXECUTION_ENGINE_SECRET not configured');
+    res.status(500).json({ error: 'Server configuration error' });
+    return;
+  }
+
+  if (!authHeader || authHeader !== `Bearer ${expectedSecret}`) {
+    res.status(401).json({ error: 'Unauthorized' });
+    return;
+  }
+
+  next();
+}
\ No newline at end of file
diff --git a/apps/js-execution-engine/src/routes/execute.ts b/apps/js-execution-engine/src/routes/execute.ts
new file mode 100644
index 0000000000..1e912e412f
--- /dev/null
+++ b/apps/js-execution-engine/src/routes/execute.ts
@@ -0,0 +1,50 @@
+import { Router } from 'express';
+import { z } from 'zod';
+import { executeScript } from '../services/executor';
+import { downloadCheckpoint, uploadCheckpoint } from '../services/s3';
+
+const executeRequestSchema = z.object({
+  script: z.string(),
+  engine: z.enum(['quickjs', 'hermes', 'nodejs']),
+  checkpoint_storage_id: z.string().optional(),
+});
+
+export const executeRouter = Router();
+
+executeRouter.post('/execute', async (req, res): Promise<void> => {
+  try {
+    const body = executeRequestSchema.parse(req.body);
+
+    let checkpointData = null;
+    if (body.checkpoint_storage_id) {
+      checkpointData = await downloadCheckpoint(body.checkpoint_storage_id);
+    }
+
+    const { result, checkpoint } = await executeScript({
+      script: body.script,
+      engine: body.engine,
+      checkpoint: checkpointData,
+    });
+
+    let checkpointStorageId = body.checkpoint_storage_id;
+    let checkpointByteLength = 0;
+
+    if (checkpoint) {
+      checkpointStorageId = await uploadCheckpoint(checkpoint);
+      checkpointByteLength = checkpoint.length;
+    }
+
+    res.json({
+      result,
+      checkpoint_byte_length: checkpointByteLength,
+      checkpoint_storage_id: checkpointStorageId,
+    });
+  } catch (error) {
+    console.error('Execution error:', error);
+    if (error instanceof z.ZodError) {
+      res.status(400).json({ error: 'Invalid request', details: error.errors });
+      return;
+    }
+    res.status(500).json({ error: 'Execution failed' });
+  }
+});
diff --git a/apps/js-execution-engine/src/services/executor.ts b/apps/js-execution-engine/src/services/executor.ts
new file mode 100644
index 0000000000..0bb6d9eb3d
--- /dev/null
+++ b/apps/js-execution-engine/src/services/executor.ts
@@ -0,0 +1,173 @@
+import { exec } from 'child_process';
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { promisify } from 'util';
+import { v4 as uuidv4 } from 'uuid';
+
+const execAsync = promisify(exec);
+
+type ExecuteOptions = {
+  script: string,
+  engine: 'quickjs' | 'hermes' | 'nodejs',
+  checkpoint?: Buffer | null,
+}
+
+type ExecuteResult = {
+  result: unknown,
+  checkpoint: Buffer | null,
+  logs?: string,
+}
+
+// SSH connection details for the QEMU VM
+const VM_SSH_PORT = '10022';
+const VM_SSH_USER = 'root';
+const VM_SSH_HOST = 'localhost';
+
+export async function executeScript(options: ExecuteOptions): Promise<ExecuteResult> {
+  const { script, engine, checkpoint } = options;
+  const executionId = uuidv4();
+  const tempDir = `/tmp/js-exec-${executionId}`;
+
+  try {
+    await fs.mkdir(tempDir, { recursive: true });
+
+    // For now, simulate checkpoint functionality
+    // In production with proper CRIU support, this would restore container state
+    let previousState = {};
+    if (checkpoint) {
+      try {
+        const checkpointData = JSON.parse(checkpoint.toString());
+        previousState = checkpointData.state || {};
+      } catch {
+        // Invalid checkpoint, ignore
+      }
+    }
+
+    // Create a wrapper script that handles state and returns JSON
+    const wrapperScript = `
+      const previousState = ${JSON.stringify(previousState)};
+      const global = { ...previousState };
+      
+      let userResult;
+      try {
+        userResult = (function() {
+          ${script}
+        })();
+      } catch (error) {
+        userResult = { error: error.message, stack: error.stack };
+      }
+      
+      const output = {
+        result: userResult,
+        state: global
+      };
+      
+      console.log(JSON.stringify(output));
+    `;
+
+    const scriptPath = path.join(tempDir, 'script.js');
+    await fs.writeFile(scriptPath, wrapperScript);
+
+    // Check VM status first
+    const { checkVMStatus } = await import('./vm-status.js');
+    const vmStatus = await checkVMStatus();
+
+    if (!vmStatus.qemu_running) {
+      throw new Error('QEMU VM is not running');
+    }
+
+    // Log current VM status
+    console.log(`VM Status: QEMU PID=${vmStatus.qemu_pid}, Uptime=${vmStatus.qemu_uptime_seconds}s`);
+
+    let stdout: string;
+    let logs = '';
+
+    // Map engine to container command
+    let containerCmd: string;
+    switch (engine) {
+      case 'nodejs': {
+        containerCmd = 'node';
+        break;
+      }
+      case 'quickjs': {
+        containerCmd = 'qjs';
+        break;
+      }
+      case 'hermes': {
+        containerCmd = 'hermes';
+        break;
+      }
+      default: {
+        containerCmd = 'node';
+      }
+    }
+
+    // Try to execute via SSH in the VM
+    if (vmStatus.ready && vmStatus.qemu_uptime_seconds && vmStatus.qemu_uptime_seconds > 60) {
+      try {
+        // First, try to check if SSH is accessible
+        const checkSSH = `timeout 2 nc -z ${VM_SSH_HOST} ${VM_SSH_PORT}`;
+        const sshCheck = await execAsync(checkSSH).catch(() => null);
+
+        if (sshCheck) {
+          // SSH is accessible, try to execute in VM
+          const sshCommand = `ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=5 -p ${VM_SSH_PORT} ${VM_SSH_USER}@${VM_SSH_HOST} "echo '${wrapperScript.replace(/'/g, "'\\''").replace(/\n/g, ' ')}' | ${containerCmd}"`;
+
+          const result = await execAsync(sshCommand, { timeout: 30000 });
+          stdout = result.stdout;
+          logs = `Executed in VM via SSH on port ${VM_SSH_PORT}`;
+        } else {
+          throw new Error('SSH port not accessible');
+        }
+      } catch (sshError) {
+        // SSH failed, fall back to local execution
+        console.warn('VM SSH execution failed, using local fallback:', sshError);
+        logs = `SSH failed (${sshError}), using local execution`;
+
+        // Execute locally with the appropriate interpreter
+        const localCommand = `${containerCmd === 'qjs' ? 'node' : containerCmd} ${scriptPath}`;
+        const result = await execAsync(localCommand, { timeout: 30000 });
+        stdout = result.stdout;
+      }
+    } else {
+      // VM not ready, execute locally
+      logs = 'VM not ready, using local execution';
+      const localCommand = `node ${scriptPath}`;
+      const result = await execAsync(localCommand, { timeout: 30000 });
+      stdout = result.stdout;
+    }
+
+    let output;
+    try {
+      output = JSON.parse(stdout.trim());
+    } catch {
+      // If parsing fails, return the raw output
+      output = { result: stdout.trim(), state: {} };
+    }
+
+    // Create a simulated checkpoint with the current state
+    const checkpointData = {
+      engine,
+      state: output.state || {},
+      timestamp: new Date().toISOString(),
+    };
+
+    const newCheckpoint = Buffer.from(JSON.stringify(checkpointData));
+
+    return {
+      result: output.result,
+      checkpoint: newCheckpoint,
+      logs,
+    };
+  } catch (error) {
+    console.error('Execution error:', error);
+    // Return a more detailed error for debugging
+    throw new Error(`Execution failed: ${error instanceof Error ? error.message : String(error)}`);
+  } finally {
+    try {
+      await fs.rm(tempDir, { recursive: true, force: true });
+    } catch {
+      // Ignore cleanup errors
+    }
+  }
+}
diff --git a/apps/js-execution-engine/src/services/s3.ts b/apps/js-execution-engine/src/services/s3.ts
new file mode 100644
index 0000000000..9165a2e115
--- /dev/null
+++ b/apps/js-execution-engine/src/services/s3.ts
@@ -0,0 +1,53 @@
+import { GetObjectCommand, PutObjectCommand, S3Client } from '@aws-sdk/client-s3';
+import { v4 as uuidv4 } from 'uuid';
+
+function throwErr(message: string): never {
+  throw new Error(message);
+}
+
+const s3Client = new S3Client({
+  region: process.env.S3_REGION || throwErr("S3_REGION is not set"),
+  endpoint: process.env.S3_ENDPOINT || throwErr("S3_ENDPOINT is not set"),
+  credentials: {
+    accessKeyId: process.env.S3_ACCESS_KEY_ID || throwErr("S3_ACCESS_KEY_ID is not set"),
+    secretAccessKey: process.env.S3_SECRET_ACCESS_KEY || throwErr("S3_SECRET_ACCESS_KEY is not set"),
+  },
+  forcePathStyle: true,
+});
+
+const BUCKET_NAME = process.env.S3_CHECKPOINT_BUCKET ?? throwErr("S3_CHECKPOINT_BUCKET is not set");
+
+export async function uploadCheckpoint(checkpoint: Buffer): Promise<string> {
+  const key = `checkpoint-${uuidv4()}`;
+
+  await s3Client.send(new PutObjectCommand({
+    Bucket: BUCKET_NAME,
+    Key: key,
+    Body: checkpoint,
+    ContentType: 'application/octet-stream',
+  }));
+
+  return key;
+}
+
+export async function downloadCheckpoint(storageId: string): Promise<Buffer | null> {
+  try {
+    const response = await s3Client.send(new GetObjectCommand({
+      Bucket: BUCKET_NAME,
+      Key: storageId,
+    }));
+
+    if (!response.Body) {
+      return null;
+    }
+
+    const chunks: Uint8Array[] = [];
+    for await (const chunk of response.Body as AsyncIterable<Uint8Array>) {
+      chunks.push(chunk);
+    }
+    return Buffer.concat(chunks);
+  } catch (error) {
+    console.error('Failed to download checkpoint:', error);
+    return null;
+  }
+}
diff --git a/apps/js-execution-engine/src/services/vm-status.ts b/apps/js-execution-engine/src/services/vm-status.ts
new file mode 100644
index 0000000000..144d294470
--- /dev/null
+++ b/apps/js-execution-engine/src/services/vm-status.ts
@@ -0,0 +1,258 @@
+import { exec } from 'child_process';
+import * as fs from 'fs/promises';
+import { promisify } from 'util';
+
+const execAsync = promisify(exec);
+
+type VMStatus = {
+  qemu_running: boolean,
+  qemu_pid?: number,
+  qemu_uptime_seconds?: number,
+  vm_network_info?: {
+    ip?: string,
+    mac?: string,
+  },
+  ssh_status?: {
+    port_open: boolean,
+    port: number,
+    authentication_working?: boolean,
+    error?: string,
+    username?: string,
+  },
+  podman_status?: {
+    installed: boolean,
+    version?: string,
+    containers?: {
+      running: number,
+      total: number,
+      list?: string[],
+    },
+  },
+  cloud_init_status?: {
+    completed: boolean,
+    uptime?: string,
+  },
+  serial_console?: {
+    lines_available: number,
+    last_lines?: string[],
+  },
+  ready: boolean,
+  diagnostics?: string[],
+}
+
+export async function checkVMStatus(): Promise<VMStatus> {
+  const status: VMStatus = {
+    qemu_running: false,
+    ready: false,
+    diagnostics: [],
+  };
+
+  const sshPort = 10022;
+  const sshUser = 'root';
+
+  try {
+    // Check if QEMU process is running
+    const { stdout: psOutput } = await execAsync('ps aux | grep qemu-system-x86_64 | grep -v grep').catch(() => ({ stdout: '' }));
+
+    if (psOutput.trim()) {
+      status.qemu_running = true;
+
+      // Extract PID from ps output
+      const pidMatch = psOutput.match(/^\S+\s+(\d+)/);
+      if (pidMatch) {
+        status.qemu_pid = parseInt(pidMatch[1], 10);
+
+        // Get process uptime
+        try {
+          const { stdout: uptimeData } = await execAsync(`ps -o etimes= -p ${status.qemu_pid}`);
+          status.qemu_uptime_seconds = parseInt(uptimeData.trim(), 10);
+          status.diagnostics?.push(`QEMU running for ${status.qemu_uptime_seconds} seconds`);
+        } catch {
+          status.diagnostics?.push('Could not determine QEMU uptime');
+        }
+      }
+
+      // Parse QEMU command line to get network info
+      const netMatch = psOutput.match(/-netdev\s+user,id=(\w+)/);
+      if (netMatch) {
+        status.vm_network_info = {
+          mac: '52:54:00:12:34:56', // Default QEMU MAC
+        };
+        status.diagnostics?.push('VM network configured');
+      }
+
+      // Check SSH connectivity
+      status.ssh_status = {
+        port_open: false,
+        port: sshPort,
+        username: sshUser,
+      };
+
+      // Check if SSH port is open
+      try {
+        const { stdout: ncOutput } = await execAsync(`timeout 1 nc -z localhost ${sshPort} && echo "open" || echo "closed"`);
+        if (ncOutput.trim() === 'open') {
+          status.ssh_status.port_open = true;
+          status.diagnostics?.push(`SSH port ${sshPort} is open`);
+
+          // Try to authenticate via SSH
+          try {
+            // Try a simple SSH command - note: this requires SSH key setup
+            const { stdout: sshTest } = await execAsync(
+              `timeout 2 ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=2 -p ${sshPort} ${sshUser}@localhost "echo 'SSH_OK' && uname -a" 2>/dev/null`
+            ).catch(err => {
+              // Check if it's a permission denied (authentication) issue
+              if (err.message.includes('Permission denied')) {
+                return { stdout: 'AUTH_FAILED' };
+              }
+              return { stdout: '' };
+            });
+
+            if (sshTest.includes('SSH_OK')) {
+              status.ssh_status.authentication_working = true;
+              status.diagnostics?.push('SSH authentication successful');
+
+              // Get more VM info since SSH works
+              try {
+                // Check cloud-init status
+                const { stdout: cloudInitStatus } = await execAsync(
+                  `ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=2 -p ${sshPort} ${sshUser}@localhost "cloud-init status --wait 2>/dev/null || echo 'not-ready'" 2>/dev/null`
+                ).catch(() => ({ stdout: 'error' }));
+
+                if (cloudInitStatus.includes('done')) {
+                  status.cloud_init_status = { completed: true };
+                  status.diagnostics?.push('Cloud-init completed');
+                } else {
+                  status.cloud_init_status = { completed: false };
+                  status.diagnostics?.push('Cloud-init still running');
+                }
+
+                // Check Podman installation
+                const { stdout: podmanVersion } = await execAsync(
+                  `ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=2 -p ${sshPort} ${sshUser}@localhost "podman --version 2>/dev/null || echo 'not-installed'" 2>/dev/null`
+                ).catch(() => ({ stdout: 'not-installed' }));
+
+                if (!podmanVersion.includes('not-installed')) {
+                  status.podman_status = {
+                    installed: true,
+                    version: podmanVersion.trim(),
+                  };
+
+                  // Get container info
+                  const { stdout: containerList } = await execAsync(
+                    `ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=2 -p ${sshPort} ${sshUser}@localhost "podman ps -a --format '{{.Names}}:{{.Status}}' 2>/dev/null" 2>/dev/null`
+                  ).catch(() => ({ stdout: '' }));
+
+                  const containers = containerList.trim().split('\n').filter(line => line);
+                  const runningContainers = containers.filter(c => c.includes(':Up')).length;
+
+                  status.podman_status.containers = {
+                    running: runningContainers,
+                    total: containers.length,
+                    list: containers.slice(0, 5), // Show first 5 containers
+                  };
+
+                  status.diagnostics?.push(`Podman ${status.podman_status.version} with ${runningContainers}/${containers.length} containers`);
+                } else {
+                  status.podman_status = { installed: false };
+                  status.diagnostics?.push('Podman not installed yet');
+                }
+
+                // Get VM uptime
+                const { stdout: vmUptime } = await execAsync(
+                  `ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=2 -p ${sshPort} ${sshUser}@localhost "uptime" 2>/dev/null`
+                ).catch(() => ({ stdout: '' }));
+
+                if (vmUptime) {
+                  status.cloud_init_status.uptime = vmUptime.trim();
+                }
+
+                status.ready = true;
+              } catch (err) {
+                status.diagnostics?.push(`SSH works but some commands failed: ${err}`);
+              }
+            } else if (sshTest === 'AUTH_FAILED') {
+              status.ssh_status.authentication_working = false;
+              status.ssh_status.error = 'Authentication failed - SSH keys may not be set up';
+              status.diagnostics?.push('SSH port open but authentication failed');
+            } else {
+              status.ssh_status.authentication_working = false;
+              status.ssh_status.error = 'Connection failed';
+              status.diagnostics?.push('SSH connection failed');
+            }
+          } catch (sshErr) {
+            status.ssh_status.authentication_working = false;
+            status.ssh_status.error = String(sshErr);
+            status.diagnostics?.push(`SSH test failed: ${sshErr}`);
+          }
+        } else {
+          status.diagnostics?.push(`SSH port ${sshPort} is not open`);
+        }
+      } catch (err) {
+        status.diagnostics?.push(`Cannot check SSH port: ${err}`);
+      }
+    } else {
+      status.diagnostics?.push('QEMU process not found');
+    }
+
+    // Check for QEMU serial output
+    try {
+      const serialLog = await fs.readFile('/tmp/qemu-serial.log', 'utf-8').catch(() => null);
+      if (serialLog) {
+        const lines = serialLog.split('\n');
+        const lastLines = lines.slice(-10).filter(line => line.trim());
+
+        status.serial_console = {
+          lines_available: lines.length,
+          last_lines: lastLines,
+        };
+
+        // Check for key boot milestones in serial log
+        if (serialLog.includes('cloud-init') && serialLog.includes('finished')) {
+          if (!status.cloud_init_status) {
+            status.cloud_init_status = { completed: true };
+          }
+          status.diagnostics?.push('Cloud-init finished (from serial log)');
+        }
+
+        if (serialLog.includes('Ubuntu')) {
+          status.diagnostics?.push('Ubuntu detected in serial log');
+        }
+      }
+    } catch {
+      // Serial log not available
+    }
+
+  } catch (error) {
+    console.error('Error checking VM status:', error);
+    status.diagnostics?.push(`Error: ${error}`);
+  }
+
+  return status;
+}
+
+export async function getVMSerialConsole(): Promise<string> {
+  try {
+    const serialLog = await fs.readFile('/tmp/qemu-serial.log', 'utf-8').catch(() => '');
+    return serialLog;
+  } catch {
+    return 'Serial console not available';
+  }
+}
+
+export async function executeInVM(command: string): Promise<{ stdout: string, stderr: string }> {
+  const sshPort = 10022;
+  const sshUser = 'root';
+
+  try {
+    const { stdout, stderr } = await execAsync(
+      `ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=5 -p ${sshPort} ${sshUser}@localhost "${command}" 2>&1`
+    );
+    return { stdout, stderr: stderr || '' };
+  } catch (error) {
+    return {
+      stdout: '',
+      stderr: `VM command execution failed: ${error}`,
+    };
+  }
+}
diff --git a/apps/js-execution-engine/tsconfig.json b/apps/js-execution-engine/tsconfig.json
new file mode 100644
index 0000000000..6b266a7718
--- /dev/null
+++ b/apps/js-execution-engine/tsconfig.json
@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "rootDir": "./src",
+    "outDir": "./dist",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "target": "ES2022",
+    "lib": ["ES2022"],
+    "types": ["node"],
+    "resolveJsonModule": true,
+    "allowSyntheticDefaultImports": true,
+    "esModuleInterop": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "noEmit": false
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}
\ No newline at end of file
diff --git a/docker/server/.env b/docker/server/.env
index c581d74203..d0942410c8 100644
--- a/docker/server/.env
+++ b/docker/server/.env
@@ -38,3 +38,7 @@ STACK_S3_REGION=
 STACK_S3_ACCESS_KEY_ID=
 STACK_S3_SECRET_ACCESS_KEY=
 STACK_S3_BUCKET=
+
+# Required for workflows
+STACK_JS_EXECUTION_ENGINE_URL=
+STACK_JS_EXECUTION_ENGINE_SECRET=
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b75bd06d65..882384561e 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -517,6 +517,61 @@ importers:
         specifier: ^5.6.3
         version: 5.6.3
 
+  apps/js-execution-engine:
+    dependencies:
+      '@aws-sdk/client-s3':
+        specifier: ^3.679.0
+        version: 3.864.0
+      '@aws-sdk/lib-storage':
+        specifier: ^3.679.0
+        version: 3.864.0(@aws-sdk/client-s3@3.864.0)
+      '@stackframe/stack-shared':
+        specifier: workspace:*
+        version: link:../../packages/stack-shared
+      cors:
+        specifier: ^2.8.5
+        version: 2.8.5
+      dotenv:
+        specifier: ^16.4.5
+        version: 16.4.7
+      express:
+        specifier: ^4.21.1
+        version: 4.21.2
+      uuid:
+        specifier: ^11.0.4
+        version: 11.1.0
+      zod:
+        specifier: ^3.24.1
+        version: 3.25.76
+    devDependencies:
+      '@types/cors':
+        specifier: ^2.8.17
+        version: 2.8.19
+      '@types/express':
+        specifier: ^5.0.0
+        version: 5.0.0
+      '@types/node':
+        specifier: ^22.10.5
+        version: 22.15.18
+      '@types/uuid':
+        specifier: ^10.0.0
+        version: 10.0.0
+      '@typescript-eslint/eslint-plugin':
+        specifier: ^8.20.0
+        version: 8.25.0(@typescript-eslint/parser@8.25.0(eslint@8.57.1)(typescript@5.8.3))(eslint@8.57.1)(typescript@5.8.3)
+      '@typescript-eslint/parser':
+        specifier: ^8.20.0
+        version: 8.25.0(eslint@8.57.1)(typescript@5.8.3)
+      eslint:
+        specifier: ^8.57.1
+        version: 8.57.1
+      tsx:
+        specifier: ^4.19.2
+        version: 4.19.3
+      typescript:
+        specifier: ^5.7.2
+        version: 5.8.3
+
   apps/mock-oauth-server:
     dependencies:
       '@types/express':
@@ -1968,6 +2023,12 @@ packages:
     resolution: {integrity: sha512-nNcjPN4SYg8drLwqK0vgVeSvxeGQiD0FxOaT38mV2H8cu0C5NzpvA+14Xy+W6vT84dxgmJYKk71Cr5QL2Oz+rA==}
     engines: {node: '>=18.0.0'}
 
+  '@aws-sdk/lib-storage@3.864.0':
+    resolution: {integrity: sha512-Me/HlMXXPv3tStPQufdwnYGholY14JmmzCdOjhnG7gnaClBEnroZKcHuQhrgMm+KyfbzCQ2+9YHsULOfFrg7Mw==}
+    engines: {node: '>=18.0.0'}
+    peerDependencies:
+      '@aws-sdk/client-s3': ^3.864.0
+
   '@aws-sdk/middleware-bucket-endpoint@3.862.0':
     resolution: {integrity: sha512-Wcsc7VPLjImQw+CP1/YkwyofMs9Ab6dVq96iS8p0zv0C6YTaMjvillkau4zFfrrrTshdzFWKptIFhKK8Zsei1g==}
     engines: {node: '>=18.0.0'}
@@ -3851,10 +3912,18 @@ packages:
     resolution: {integrity: sha512-XXrH9Uarn0stsyldqDYq8r++mROmWRI1xKMXa640Bb//SY1+ECYX6VzT6Lcx5frD0V30XieqJ0oX9I2Xj5aoMA==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
 
+  '@eslint/eslintrc@2.1.4':
+    resolution: {integrity: sha512-269Z39MS6wVJtsoUl10L60WdkhJVdPG24Q4eZTH3nnF6lpvSShEK3wQjDX9JRWAUPvPh7COouPpU9IrqaZFvtQ==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+
   '@eslint/eslintrc@3.3.0':
     resolution: {integrity: sha512-yaVPAiNAalnCZedKLdR21GOGILMLKPyqSLWaAjQFvYA2i/ciDi8ArYVr69Anohb6cH2Ukhqti4aFnYyPm8wdwQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
+  '@eslint/js@8.57.1':
+    resolution: {integrity: sha512-d9zaMRSTIKDLhctzH12MtXvJKSSUhaHcjV+2Z+GK+EEY7XKpP5yR4x+N3TAcHTcu963nIr+TMcCb4DBCYX1z6Q==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+
   '@eslint/js@9.21.0':
     resolution: {integrity: sha512-BqStZ3HX8Yz6LvsF5ByXYrtigrV5AXADWLAGc7PH/1SxOb7/FIYYMszZZWiUou/GB9P2lXWk2SV4d+Z8h0nknw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -4050,6 +4119,11 @@ packages:
     engines: {node: '>=10.10.0'}
     deprecated: Use @eslint/config-array instead
 
+  '@humanwhocodes/config-array@0.13.0':
+    resolution: {integrity: sha512-DZLEEqFWQFiyK6h5YIeynKx7JlvCYWL0cImfSRXZ9l4Sg2efkFGTuFf6vzXjK1cq6IYkU+Eg/JizXw+TD2vRNw==}
+    engines: {node: '>=10.10.0'}
+    deprecated: Use @eslint/config-array instead
+
   '@humanwhocodes/module-importer@1.0.1':
     resolution: {integrity: sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==}
     engines: {node: '>=12.22'}
@@ -7331,6 +7405,9 @@ packages:
   '@types/cookies@0.9.0':
     resolution: {integrity: sha512-40Zk8qR147RABiQ7NQnBzWzDcjKzNrntB5BAmeGCb2p/MIyOE+4BVvc17wumsUqUw00bJYqoXFHYygQnEFh4/Q==}
 
+  '@types/cors@2.8.19':
+    resolution: {integrity: sha512-mFNylyeyqN93lfe/9CSxOGREz8cpzAhH+E93xJ4xWQf62V8sQ/24reV2nyzUWM6H6Xji+GGHpkbLe7pVoUEskg==}
+
   '@types/d3-array@3.2.1':
     resolution: {integrity: sha512-Y2Jn2idRrLzUfAKV2LyRImR+y4oa2AntrgID95SHJxuMUrkNXmanDSed71sRNZysveJVt1hLLemQZIady0FpEg==}
 
@@ -7640,6 +7717,9 @@ packages:
   '@types/unist@3.0.3':
     resolution: {integrity: sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==}
 
+  '@types/uuid@10.0.0':
+    resolution: {integrity: sha512-7gqG38EyHgyP1S+7+xomFtL+ZNHcKv6DwNaCZmJmo1vgMugyF3TCnXVg4t1uk89mLNwnLtnY3TpOpCOyp1/xHQ==}
+
   '@types/uuid@9.0.8':
     resolution: {integrity: sha512-jg+97EGIcY9AGHJJRaaPVgetKDsrTgbRjQ5Msgjh/DQKEFl0DtyRr/VCOyD1T2R1MNeWPK/u7JoGhlDZnKBAfA==}
 
@@ -8446,6 +8526,9 @@ packages:
   buffer-from@1.1.2:
     resolution: {integrity: sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==}
 
+  buffer@5.6.0:
+    resolution: {integrity: sha512-/gDYp/UtU0eA1ys8bOs9J6a+E/KWIY+DZ+Q2WESNUA0jFRsJOc0SNUO6xJ5SGA1xueg3NL65W6s+NY5l9cunuw==}
+
   buffer@5.7.1:
     resolution: {integrity: sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==}
 
@@ -9896,6 +9979,12 @@ packages:
     deprecated: This version is no longer supported. Please see https://eslint.org/version-support for other options.
     hasBin: true
 
+  eslint@8.57.1:
+    resolution: {integrity: sha512-ypowyDxpVSYpkXr9WPv2PAZCtNip1Mv5KTW0SCurXv/9iOpcrH9PaqUElksqEB6pChqHGDRCFTyrZlGhnLNGiA==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+    deprecated: This version is no longer supported. Please see https://eslint.org/version-support for other options.
+    hasBin: true
+
   eslint@9.21.0:
     resolution: {integrity: sha512-KjeihdFqTPhOMXTt7StsDxriV4n66ueuF/jfPNC3j/lduHwr/ijDwJMsF+wyMJethgiKi5wniIE243vi07d3pg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -14112,6 +14201,9 @@ packages:
   std-env@3.7.0:
     resolution: {integrity: sha512-JPbdCEQLj1w5GilpiHAx3qJvFndqybBysA3qUOnznweH4QbNYUsW/ea8QzSrnh0vNsezMMw5bcVool8lM0gwzg==}
 
+  stream-browserify@3.0.0:
+    resolution: {integrity: sha512-H73RAHsVBapbim0tU2JwwOiXUj+fikfiaoYAKHF3VJfA0pe2BCzkhAHBlLG6REzE+2WNZcxOXjK7lkso+9euLA==}
+
   stream-buffers@2.2.0:
     resolution: {integrity: sha512-uyQK/mx5QjHun80FLJTfaWE7JtwfRMKBLkMne6udYOmvH0CawotVa7TfgYHzAnpphn4+TweIx1QKMnRIbipmUg==}
     engines: {node: '>= 0.10.0'}
@@ -15982,6 +16074,17 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
+  '@aws-sdk/lib-storage@3.864.0(@aws-sdk/client-s3@3.864.0)':
+    dependencies:
+      '@aws-sdk/client-s3': 3.864.0
+      '@smithy/abort-controller': 4.0.5
+      '@smithy/middleware-endpoint': 4.1.18
+      '@smithy/smithy-client': 4.4.10
+      buffer: 5.6.0
+      events: 3.3.0
+      stream-browserify: 3.0.0
+      tslib: 2.8.1
+
   '@aws-sdk/middleware-bucket-endpoint@3.862.0':
     dependencies:
       '@aws-sdk/types': 3.862.0
@@ -17036,7 +17139,7 @@ snapshots:
       '@babel/parser': 7.26.9
       '@babel/template': 7.25.0
       '@babel/types': 7.26.0
-      debug: 4.4.0
+      debug: 4.4.1
       globals: 11.12.0
     transitivePeerDependencies:
       - supports-color
@@ -17048,7 +17151,7 @@ snapshots:
       '@babel/parser': 7.26.9
       '@babel/template': 7.26.9
       '@babel/types': 7.26.9
-      debug: 4.4.0
+      debug: 4.4.1
       globals: 11.12.0
     transitivePeerDependencies:
       - supports-color
@@ -17060,7 +17163,7 @@ snapshots:
       '@babel/parser': 7.26.9
       '@babel/template': 7.26.9
       '@babel/types': 7.26.9
-      debug: 4.4.0
+      debug: 4.4.1
       globals: 11.12.0
     transitivePeerDependencies:
       - supports-color
@@ -17909,6 +18012,11 @@ snapshots:
       eslint: 8.30.0
       eslint-visitor-keys: 3.4.3
 
+  '@eslint-community/eslint-utils@4.4.1(eslint@8.57.1)':
+    dependencies:
+      eslint: 8.57.1
+      eslint-visitor-keys: 3.4.3
+
   '@eslint-community/eslint-utils@4.4.1(eslint@9.21.0(jiti@2.4.2))':
     dependencies:
       eslint: 9.21.0(jiti@2.4.2)
@@ -17919,7 +18027,7 @@ snapshots:
   '@eslint/config-array@0.19.2':
     dependencies:
       '@eslint/object-schema': 2.1.6
-      debug: 4.4.0
+      debug: 4.4.1
       minimatch: 3.1.2
     transitivePeerDependencies:
       - supports-color
@@ -17942,10 +18050,24 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@eslint/eslintrc@2.1.4':
+    dependencies:
+      ajv: 6.12.6
+      debug: 4.4.1
+      espree: 9.6.1
+      globals: 13.24.0
+      ignore: 5.3.2
+      import-fresh: 3.3.1
+      js-yaml: 4.1.0
+      minimatch: 3.1.2
+      strip-json-comments: 3.1.1
+    transitivePeerDependencies:
+      - supports-color
+
   '@eslint/eslintrc@3.3.0':
     dependencies:
       ajv: 6.12.6
-      debug: 4.4.0
+      debug: 4.4.1
       espree: 10.3.0
       globals: 14.0.0
       ignore: 5.3.2
@@ -17956,6 +18078,8 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@eslint/js@8.57.1': {}
+
   '@eslint/js@9.21.0': {}
 
   '@eslint/object-schema@2.1.6': {}
@@ -18412,6 +18536,14 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@humanwhocodes/config-array@0.13.0':
+    dependencies:
+      '@humanwhocodes/object-schema': 2.0.3
+      debug: 4.4.1
+      minimatch: 3.1.2
+    transitivePeerDependencies:
+      - supports-color
+
   '@humanwhocodes/module-importer@1.0.1': {}
 
   '@humanwhocodes/object-schema@2.0.3': {}
@@ -18427,7 +18559,7 @@ snapshots:
       '@antfu/install-pkg': 1.1.0
       '@antfu/utils': 8.1.1
       '@iconify/types': 2.0.0
-      debug: 4.4.0
+      debug: 4.4.1
       globals: 15.15.0
       kolorist: 1.8.0
       local-pkg: 1.1.1
@@ -18724,7 +18856,7 @@ snapshots:
 
   '@koa/router@12.0.1':
     dependencies:
-      debug: 4.4.0
+      debug: 4.4.1
       http-errors: 2.0.0
       koa-compose: 4.1.0
       methods: 1.1.2
@@ -22503,6 +22635,10 @@ snapshots:
       '@types/keygrip': 1.0.6
       '@types/node': 22.15.18
 
+  '@types/cors@2.8.19':
+    dependencies:
+      '@types/node': 22.15.18
+
   '@types/d3-array@3.2.1': {}
 
   '@types/d3-axis@3.0.6':
@@ -22874,6 +23010,8 @@ snapshots:
 
   '@types/unist@3.0.3': {}
 
+  '@types/uuid@10.0.0': {}
+
   '@types/uuid@9.0.8': {}
 
   '@types/ws@8.18.1':
@@ -22910,22 +23048,36 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/eslint-plugin@6.21.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint@8.30.0)(typescript@5.8.3)':
+  '@typescript-eslint/eslint-plugin@8.25.0(@typescript-eslint/parser@8.25.0(eslint@8.30.0)(typescript@5.8.3))(eslint@8.30.0)(typescript@5.8.3)':
     dependencies:
       '@eslint-community/regexpp': 4.12.1
-      '@typescript-eslint/parser': 6.21.0(eslint@8.30.0)(typescript@5.8.3)
-      '@typescript-eslint/scope-manager': 6.21.0
-      '@typescript-eslint/type-utils': 6.21.0(eslint@8.30.0)(typescript@5.8.3)
-      '@typescript-eslint/utils': 6.21.0(eslint@8.30.0)(typescript@5.8.3)
-      '@typescript-eslint/visitor-keys': 6.21.0
-      debug: 4.3.7
+      '@typescript-eslint/parser': 8.25.0(eslint@8.30.0)(typescript@5.8.3)
+      '@typescript-eslint/scope-manager': 8.25.0
+      '@typescript-eslint/type-utils': 8.25.0(eslint@8.30.0)(typescript@5.8.3)
+      '@typescript-eslint/utils': 8.25.0(eslint@8.30.0)(typescript@5.8.3)
+      '@typescript-eslint/visitor-keys': 8.25.0
       eslint: 8.30.0
       graphemer: 1.4.0
       ignore: 5.3.2
       natural-compare: 1.4.0
-      semver: 7.6.3
-      ts-api-utils: 1.4.0(typescript@5.8.3)
-    optionalDependencies:
+      ts-api-utils: 2.0.1(typescript@5.8.3)
+      typescript: 5.8.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/eslint-plugin@8.25.0(@typescript-eslint/parser@8.25.0(eslint@8.57.1)(typescript@5.8.3))(eslint@8.57.1)(typescript@5.8.3)':
+    dependencies:
+      '@eslint-community/regexpp': 4.12.1
+      '@typescript-eslint/parser': 8.25.0(eslint@8.57.1)(typescript@5.8.3)
+      '@typescript-eslint/scope-manager': 8.25.0
+      '@typescript-eslint/type-utils': 8.25.0(eslint@8.57.1)(typescript@5.8.3)
+      '@typescript-eslint/utils': 8.25.0(eslint@8.57.1)(typescript@5.8.3)
+      '@typescript-eslint/visitor-keys': 8.25.0
+      eslint: 8.57.1
+      graphemer: 1.4.0
+      ignore: 5.3.2
+      natural-compare: 1.4.0
+      ts-api-utils: 2.0.1(typescript@5.8.3)
       typescript: 5.8.3
     transitivePeerDependencies:
       - supports-color
@@ -22953,22 +23105,33 @@ snapshots:
       '@typescript-eslint/types': 6.21.0
       '@typescript-eslint/typescript-estree': 6.21.0(typescript@5.3.3)
       '@typescript-eslint/visitor-keys': 6.21.0
-      debug: 4.3.7
+      debug: 4.4.1
       eslint: 8.30.0
     optionalDependencies:
       typescript: 5.3.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3)':
+  '@typescript-eslint/parser@8.25.0(eslint@8.30.0)(typescript@5.8.3)':
     dependencies:
-      '@typescript-eslint/scope-manager': 6.21.0
-      '@typescript-eslint/types': 6.21.0
-      '@typescript-eslint/typescript-estree': 6.21.0(typescript@5.8.3)
-      '@typescript-eslint/visitor-keys': 6.21.0
-      debug: 4.3.7
+      '@typescript-eslint/scope-manager': 8.25.0
+      '@typescript-eslint/types': 8.25.0
+      '@typescript-eslint/typescript-estree': 8.25.0(typescript@5.8.3)
+      '@typescript-eslint/visitor-keys': 8.25.0
+      debug: 4.4.1
       eslint: 8.30.0
-    optionalDependencies:
+      typescript: 5.8.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/parser@8.25.0(eslint@8.57.1)(typescript@5.8.3)':
+    dependencies:
+      '@typescript-eslint/scope-manager': 8.25.0
+      '@typescript-eslint/types': 8.25.0
+      '@typescript-eslint/typescript-estree': 8.25.0(typescript@5.8.3)
+      '@typescript-eslint/visitor-keys': 8.25.0
+      debug: 4.4.1
+      eslint: 8.57.1
       typescript: 5.8.3
     transitivePeerDependencies:
       - supports-color
@@ -22979,7 +23142,7 @@ snapshots:
       '@typescript-eslint/types': 8.25.0
       '@typescript-eslint/typescript-estree': 8.25.0(typescript@5.3.3)
       '@typescript-eslint/visitor-keys': 8.25.0
-      debug: 4.4.0
+      debug: 4.4.1
       eslint: 9.21.0(jiti@2.4.2)
       typescript: 5.3.3
     transitivePeerDependencies:
@@ -23007,14 +23170,24 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/type-utils@6.21.0(eslint@8.30.0)(typescript@5.8.3)':
+  '@typescript-eslint/type-utils@8.25.0(eslint@8.30.0)(typescript@5.8.3)':
     dependencies:
-      '@typescript-eslint/typescript-estree': 6.21.0(typescript@5.8.3)
-      '@typescript-eslint/utils': 6.21.0(eslint@8.30.0)(typescript@5.8.3)
-      debug: 4.4.0
+      '@typescript-eslint/typescript-estree': 8.25.0(typescript@5.8.3)
+      '@typescript-eslint/utils': 8.25.0(eslint@8.30.0)(typescript@5.8.3)
+      debug: 4.4.1
       eslint: 8.30.0
-      ts-api-utils: 1.4.0(typescript@5.8.3)
-    optionalDependencies:
+      ts-api-utils: 2.0.1(typescript@5.8.3)
+      typescript: 5.8.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/type-utils@8.25.0(eslint@8.57.1)(typescript@5.8.3)':
+    dependencies:
+      '@typescript-eslint/typescript-estree': 8.25.0(typescript@5.8.3)
+      '@typescript-eslint/utils': 8.25.0(eslint@8.57.1)(typescript@5.8.3)
+      debug: 4.4.1
+      eslint: 8.57.1
+      ts-api-utils: 2.0.1(typescript@5.8.3)
       typescript: 5.8.3
     transitivePeerDependencies:
       - supports-color
@@ -23023,7 +23196,7 @@ snapshots:
     dependencies:
       '@typescript-eslint/typescript-estree': 8.25.0(typescript@5.3.3)
       '@typescript-eslint/utils': 8.25.0(eslint@9.21.0(jiti@2.4.2))(typescript@5.3.3)
-      debug: 4.4.0
+      debug: 4.4.1
       eslint: 9.21.0(jiti@2.4.2)
       ts-api-utils: 2.0.1(typescript@5.3.3)
       typescript: 5.3.3
@@ -23038,43 +23211,42 @@ snapshots:
     dependencies:
       '@typescript-eslint/types': 6.21.0
       '@typescript-eslint/visitor-keys': 6.21.0
-      debug: 4.4.0
+      debug: 4.4.1
       globby: 11.1.0
       is-glob: 4.0.3
       minimatch: 9.0.3
-      semver: 7.6.3
+      semver: 7.7.2
       ts-api-utils: 1.4.0(typescript@5.3.3)
     optionalDependencies:
       typescript: 5.3.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/typescript-estree@6.21.0(typescript@5.8.3)':
+  '@typescript-eslint/typescript-estree@8.25.0(typescript@5.3.3)':
     dependencies:
-      '@typescript-eslint/types': 6.21.0
-      '@typescript-eslint/visitor-keys': 6.21.0
-      debug: 4.4.0
-      globby: 11.1.0
+      '@typescript-eslint/types': 8.25.0
+      '@typescript-eslint/visitor-keys': 8.25.0
+      debug: 4.4.1
+      fast-glob: 3.3.3
       is-glob: 4.0.3
-      minimatch: 9.0.3
-      semver: 7.6.3
-      ts-api-utils: 1.4.0(typescript@5.8.3)
-    optionalDependencies:
-      typescript: 5.8.3
+      minimatch: 9.0.5
+      semver: 7.7.2
+      ts-api-utils: 2.0.1(typescript@5.3.3)
+      typescript: 5.3.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/typescript-estree@8.25.0(typescript@5.3.3)':
+  '@typescript-eslint/typescript-estree@8.25.0(typescript@5.8.3)':
     dependencies:
       '@typescript-eslint/types': 8.25.0
       '@typescript-eslint/visitor-keys': 8.25.0
-      debug: 4.4.0
+      debug: 4.4.1
       fast-glob: 3.3.3
       is-glob: 4.0.3
       minimatch: 9.0.5
-      semver: 7.6.3
-      ts-api-utils: 2.0.1(typescript@5.3.3)
-      typescript: 5.3.3
+      semver: 7.7.2
+      ts-api-utils: 2.0.1(typescript@5.8.3)
+      typescript: 5.8.3
     transitivePeerDependencies:
       - supports-color
 
@@ -23092,19 +23264,27 @@ snapshots:
       - supports-color
       - typescript
 
-  '@typescript-eslint/utils@6.21.0(eslint@8.30.0)(typescript@5.8.3)':
+  '@typescript-eslint/utils@8.25.0(eslint@8.30.0)(typescript@5.8.3)':
     dependencies:
       '@eslint-community/eslint-utils': 4.4.1(eslint@8.30.0)
-      '@types/json-schema': 7.0.15
-      '@types/semver': 7.5.8
-      '@typescript-eslint/scope-manager': 6.21.0
-      '@typescript-eslint/types': 6.21.0
-      '@typescript-eslint/typescript-estree': 6.21.0(typescript@5.8.3)
+      '@typescript-eslint/scope-manager': 8.25.0
+      '@typescript-eslint/types': 8.25.0
+      '@typescript-eslint/typescript-estree': 8.25.0(typescript@5.8.3)
       eslint: 8.30.0
-      semver: 7.6.3
+      typescript: 5.8.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/utils@8.25.0(eslint@8.57.1)(typescript@5.8.3)':
+    dependencies:
+      '@eslint-community/eslint-utils': 4.4.1(eslint@8.57.1)
+      '@typescript-eslint/scope-manager': 8.25.0
+      '@typescript-eslint/types': 8.25.0
+      '@typescript-eslint/typescript-estree': 8.25.0(typescript@5.8.3)
+      eslint: 8.57.1
+      typescript: 5.8.3
     transitivePeerDependencies:
       - supports-color
-      - typescript
 
   '@typescript-eslint/utils@8.25.0(eslint@9.21.0(jiti@2.4.2))(typescript@5.3.3)':
     dependencies:
@@ -23374,7 +23554,7 @@ snapshots:
 
   agent-base@6.0.2:
     dependencies:
-      debug: 4.4.0
+      debug: 4.4.1
     transitivePeerDependencies:
       - supports-color
 
@@ -24018,6 +24198,11 @@ snapshots:
 
   buffer-from@1.1.2: {}
 
+  buffer@5.6.0:
+    dependencies:
+      base64-js: 1.5.1
+      ieee754: 1.2.1
+
   buffer@5.7.1:
     dependencies:
       base64-js: 1.5.1
@@ -25520,12 +25705,12 @@ snapshots:
     dependencies:
       '@next/eslint-plugin-next': 15.3.2
       '@rushstack/eslint-patch': 1.10.4
-      '@typescript-eslint/eslint-plugin': 6.21.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint@8.30.0)(typescript@5.8.3)
-      '@typescript-eslint/parser': 6.21.0(eslint@8.30.0)(typescript@5.8.3)
+      '@typescript-eslint/eslint-plugin': 8.25.0(@typescript-eslint/parser@8.25.0(eslint@8.30.0)(typescript@5.8.3))(eslint@8.30.0)(typescript@5.8.3)
+      '@typescript-eslint/parser': 8.25.0(eslint@8.30.0)(typescript@5.8.3)
       eslint: 8.30.0
       eslint-import-resolver-node: 0.3.9
-      eslint-import-resolver-typescript: 3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0)(eslint@8.30.0)
-      eslint-plugin-import: 2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint@8.30.0)
+      eslint-import-resolver-typescript: 3.6.3(@typescript-eslint/parser@8.25.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0)(eslint@8.30.0)
+      eslint-plugin-import: 2.31.0(@typescript-eslint/parser@8.25.0(eslint@8.30.0)(typescript@5.8.3))(eslint@8.30.0)
       eslint-plugin-jsx-a11y: 6.10.2(eslint@8.30.0)
       eslint-plugin-react: 7.37.2(eslint@8.30.0)
       eslint-plugin-react-hooks: 5.1.0(eslint@8.30.0)
@@ -25546,13 +25731,13 @@ snapshots:
 
   eslint-import-resolver-typescript@3.6.1(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0)(eslint@8.30.0):
     dependencies:
-      debug: 4.4.0
+      debug: 4.4.1
       enhanced-resolve: 5.17.0
       eslint: 8.30.0
       eslint-module-utils: 2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.1(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0)(eslint@8.30.0))(eslint@8.30.0)
       eslint-plugin-import: 2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint@8.30.0)
       fast-glob: 3.3.2
-      get-tsconfig: 4.7.5
+      get-tsconfig: 4.8.1
       is-core-module: 2.15.1
       is-glob: 4.0.3
     transitivePeerDependencies:
@@ -25580,19 +25765,19 @@ snapshots:
       - eslint-import-resolver-webpack
       - supports-color
 
-  eslint-import-resolver-typescript@3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0)(eslint@8.30.0):
+  eslint-import-resolver-typescript@3.6.3(@typescript-eslint/parser@8.25.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0)(eslint@8.30.0):
     dependencies:
       '@nolyfill/is-core-module': 1.0.39
-      debug: 4.4.0
+      debug: 4.4.1
       enhanced-resolve: 5.17.1
       eslint: 8.30.0
-      eslint-module-utils: 2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0)(eslint@8.30.0))(eslint@8.30.0)
+      eslint-module-utils: 2.12.0(@typescript-eslint/parser@8.25.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3(@typescript-eslint/parser@8.25.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0)(eslint@8.30.0))(eslint@8.30.0)
       fast-glob: 3.3.3
       get-tsconfig: 4.8.1
       is-bun-module: 1.2.1
       is-glob: 4.0.3
     optionalDependencies:
-      eslint-plugin-import: 2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint@8.30.0)
+      eslint-plugin-import: 2.31.0(@typescript-eslint/parser@8.25.0(eslint@8.30.0)(typescript@5.8.3))(eslint@8.30.0)
     transitivePeerDependencies:
       - '@typescript-eslint/parser'
       - eslint-import-resolver-node
@@ -25631,22 +25816,22 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-module-utils@2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0)(eslint@8.30.0))(eslint@8.30.0):
+  eslint-module-utils@2.12.0(@typescript-eslint/parser@8.25.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3(@typescript-eslint/parser@8.25.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0)(eslint@8.30.0))(eslint@8.30.0):
     dependencies:
       debug: 3.2.7
     optionalDependencies:
-      '@typescript-eslint/parser': 6.21.0(eslint@8.30.0)(typescript@5.8.3)
+      '@typescript-eslint/parser': 8.25.0(eslint@8.30.0)(typescript@5.8.3)
       eslint: 8.30.0
       eslint-import-resolver-node: 0.3.9
-      eslint-import-resolver-typescript: 3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0)(eslint@8.30.0)
+      eslint-import-resolver-typescript: 3.6.3(@typescript-eslint/parser@8.25.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0)(eslint@8.30.0)
     transitivePeerDependencies:
       - supports-color
 
-  eslint-module-utils@2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint@8.30.0):
+  eslint-module-utils@2.12.0(@typescript-eslint/parser@8.25.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint@8.30.0):
     dependencies:
       debug: 3.2.7
     optionalDependencies:
-      '@typescript-eslint/parser': 6.21.0(eslint@8.30.0)(typescript@5.8.3)
+      '@typescript-eslint/parser': 8.25.0(eslint@8.30.0)(typescript@5.8.3)
       eslint: 8.30.0
       eslint-import-resolver-node: 0.3.9
     transitivePeerDependencies:
@@ -25745,7 +25930,7 @@ snapshots:
       - eslint-import-resolver-webpack
       - supports-color
 
-  eslint-plugin-import@2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint@8.30.0):
+  eslint-plugin-import@2.31.0(@typescript-eslint/parser@8.25.0(eslint@8.30.0)(typescript@5.8.3))(eslint@8.30.0):
     dependencies:
       '@rtsao/scc': 1.1.0
       array-includes: 3.1.8
@@ -25756,7 +25941,7 @@ snapshots:
       doctrine: 2.1.0
       eslint: 8.30.0
       eslint-import-resolver-node: 0.3.9
-      eslint-module-utils: 2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint@8.30.0)
+      eslint-module-utils: 2.12.0(@typescript-eslint/parser@8.25.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint@8.30.0)
       hasown: 2.0.2
       is-core-module: 2.15.1
       is-glob: 4.0.3
@@ -25768,7 +25953,7 @@ snapshots:
       string.prototype.trimend: 1.0.8
       tsconfig-paths: 3.15.0
     optionalDependencies:
-      '@typescript-eslint/parser': 6.21.0(eslint@8.30.0)(typescript@5.8.3)
+      '@typescript-eslint/parser': 8.25.0(eslint@8.30.0)(typescript@5.8.3)
     transitivePeerDependencies:
       - eslint-import-resolver-typescript
       - eslint-import-resolver-webpack
@@ -25945,6 +26130,49 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  eslint@8.57.1:
+    dependencies:
+      '@eslint-community/eslint-utils': 4.4.1(eslint@8.57.1)
+      '@eslint-community/regexpp': 4.12.1
+      '@eslint/eslintrc': 2.1.4
+      '@eslint/js': 8.57.1
+      '@humanwhocodes/config-array': 0.13.0
+      '@humanwhocodes/module-importer': 1.0.1
+      '@nodelib/fs.walk': 1.2.8
+      '@ungap/structured-clone': 1.3.0
+      ajv: 6.12.6
+      chalk: 4.1.2
+      cross-spawn: 7.0.6
+      debug: 4.4.1
+      doctrine: 3.0.0
+      escape-string-regexp: 4.0.0
+      eslint-scope: 7.2.2
+      eslint-visitor-keys: 3.4.3
+      espree: 9.6.1
+      esquery: 1.6.0
+      esutils: 2.0.3
+      fast-deep-equal: 3.1.3
+      file-entry-cache: 6.0.1
+      find-up: 5.0.0
+      glob-parent: 6.0.2
+      globals: 13.24.0
+      graphemer: 1.4.0
+      ignore: 5.3.2
+      imurmurhash: 0.1.4
+      is-glob: 4.0.3
+      is-path-inside: 3.0.3
+      js-yaml: 4.1.0
+      json-stable-stringify-without-jsonify: 1.0.1
+      levn: 0.4.1
+      lodash.merge: 4.6.2
+      minimatch: 3.1.2
+      natural-compare: 1.4.0
+      optionator: 0.9.4
+      strip-ansi: 6.0.1
+      text-table: 0.2.0
+    transitivePeerDependencies:
+      - supports-color
+
   eslint@9.21.0(jiti@2.4.2):
     dependencies:
       '@eslint-community/eslint-utils': 4.4.1(eslint@9.21.0(jiti@2.4.2))
@@ -27275,7 +27503,7 @@ snapshots:
   https-proxy-agent@5.0.1:
     dependencies:
       agent-base: 6.0.2
-      debug: 4.4.0
+      debug: 4.4.1
     transitivePeerDependencies:
       - supports-color
 
@@ -27944,7 +28172,7 @@ snapshots:
       content-disposition: 0.5.4
       content-type: 1.0.5
       cookies: 0.9.1
-      debug: 4.4.0
+      debug: 4.4.1
       delegates: 1.0.0
       depd: 2.0.0
       destroy: 1.2.0
@@ -31536,6 +31764,11 @@ snapshots:
 
   std-env@3.7.0: {}
 
+  stream-browserify@3.0.0:
+    dependencies:
+      inherits: 2.0.4
+      readable-stream: 3.6.2
+
   stream-buffers@2.2.0: {}
 
   stream-composer@1.0.2:
@@ -32112,14 +32345,14 @@ snapshots:
     dependencies:
       typescript: 5.3.3
 
-  ts-api-utils@1.4.0(typescript@5.8.3):
-    dependencies:
-      typescript: 5.8.3
-
   ts-api-utils@2.0.1(typescript@5.3.3):
     dependencies:
       typescript: 5.3.3
 
+  ts-api-utils@2.0.1(typescript@5.8.3):
+    dependencies:
+      typescript: 5.8.3
+
   ts-dedent@2.2.0: {}
 
   ts-interface-checker@0.1.13: {}