@aurostack/stacks 0.2.2 → 0.2.3

package/README.md

@@ -2,6 +2,10 @@
 
 House project templates, and the generator that stamps them out.
 
+**Documentation: [aurostack-org.github.io/stacks](https://aurostack-org.github.io/stacks/)**:
+every template, feature and environment variable, how to set up and connect a
+generated project, and architecture diagrams. Sources in [`docs/`](docs/).
+
 ```
 stack list                              # what's available
 stack info nest-api                     # its features and defaults

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@aurostack/stacks",
-	"version": "0.2.2",
+	"version": "0.2.3",
 	"description": "Scaffold new projects from house templates: a NestJS API, React app or Turborepo monorepo, and Node or Python workers. Subtractive templates plus a zero-dependency generator.",
 	"license": "MIT",
 	"author": "Aurostack (https://github.com/aurostack-org)",

package/templates/nest-api/files/.env.example

@@ -8,10 +8,11 @@ APP_HOST='0.0.0.0'
 PORT='5000'
 SERVER_HOST='http://localhost:5000'
 FRONTEND_HOST='http://localhost:3000'
-# Extra origins beyond FRONTEND_HOST, comma separated: trusted by auth in every
-# environment, allowed by CORS in development only. A full origin
-# (`http://localhost:3001`) is used as written; a bare hostname (`example.com`)
-# expands to https://example.com and its auth., app. and admin. subdomains.
+# Extra origins beyond FRONTEND_HOST, comma separated, trusted by auth and
+# allowed by CORS: every react-monorepo app goes here or in FRONTEND_HOST. A full
+# origin (`http://localhost:3001`) is used as written; a bare hostname
+# (`example.com`) expands to https://example.com and its auth., app. and admin.
+# subdomains.
 MISC_CORS_ORIGINS=''
 
 DATABASE_URL='postgresql://root:postgres@localhost:5432/main'

package/templates/nest-api/files/src/common/constants/options.ts

@@ -14,11 +14,11 @@ const frontendHost = E.FRONTEND_HOST!;
 const env = E.APP_ENV!;
 const IS_DEV = env === 'development';
 
-// Extra origins are a development convenience only — production is pinned to
-// the configured frontend host.
-const CORS_ORIGINS = !IS_DEV
-	? [frontendHost]
-	: [frontendHost, ...OriginBuilder.build(E.MISC_CORS_ORIGINS)];
+// The same origins better-auth trusts, in every environment: an origin trusted
+// for sign-in but refused by CORS can't reach the API at all (every
+// react-monorepo app beyond FRONTEND_HOST). MISC_CORS_ORIGINS is empty unless
+// you list something.
+const CORS_ORIGINS = [frontendHost, ...OriginBuilder.build(E.MISC_CORS_ORIGINS)];
 
 // @feature:start openapi
 const createDocumentBuilder = () => {