@c15t/backend 1.2.0-canary.9 → 1.2.1

package/dist/schema/consent-purpose/table.d.ts

@@ -37,8 +37,8 @@ export declare function getPurposeTable(options: C15TOptions, purposeFields?: Re
         name: import("zod").ZodString;
         description: import("zod").ZodString;
         isEssential: import("zod").ZodDefault<import("zod").ZodBoolean>;
-        dataCategory: import("zod").ZodOptional<import("zod").ZodString>;
-        legalBasis: import("zod").ZodOptional<import("zod").ZodString>;
+        dataCategory: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+        legalBasis: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
         isActive: import("zod").ZodDefault<import("zod").ZodBoolean>;
         createdAt: import("zod").ZodDefault<import("zod").ZodDate>;
         updatedAt: import("zod").ZodDefault<import("zod").ZodDate>;
@@ -51,8 +51,8 @@ export declare function getPurposeTable(options: C15TOptions, purposeFields?: Re
         updatedAt: Date;
         isEssential: boolean;
         isActive: boolean;
-        dataCategory?: string | undefined;
-        legalBasis?: string | undefined;
+        dataCategory?: string | null | undefined;
+        legalBasis?: string | null | undefined;
     }, {
         code: string;
         name: string;
@@ -61,8 +61,8 @@ export declare function getPurposeTable(options: C15TOptions, purposeFields?: Re
         createdAt?: Date | undefined;
         updatedAt?: Date | undefined;
         isEssential?: boolean | undefined;
-        dataCategory?: string | undefined;
-        legalBasis?: string | undefined;
+        dataCategory?: string | null | undefined;
+        legalBasis?: string | null | undefined;
         isActive?: boolean | undefined;
     }>;
     /**

package/dist/schema/create-registry.d.ts

@@ -106,8 +106,8 @@ export declare const createRegistry: (ctx: RegistryContext) => {
         updatedAt: Date;
         isEssential: boolean;
         isActive: boolean;
-        dataCategory?: string | undefined;
-        legalBasis?: string | undefined;
+        dataCategory?: string | null | undefined;
+        legalBasis?: string | null | undefined;
     }>;
     findConsentPurposeByCode: (code: string) => Promise<{
         code: string;
@@ -118,8 +118,8 @@ export declare const createRegistry: (ctx: RegistryContext) => {
         updatedAt: Date;
         isEssential: boolean;
         isActive: boolean;
-        dataCategory?: string | undefined;
-        legalBasis?: string | undefined;
+        dataCategory?: string | null | undefined;
+        legalBasis?: string | null | undefined;
     } | null>;
     createDomain: (domain: Omit<import("./domain").Domain, "id" | "createdAt" | "updatedAt"> & Partial<import("./domain").Domain>, context?: import("../pkgs/types").GenericEndpointContext) => Promise<{
         name: string;

package/dist/schema/create-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-registry.d.ts","sourceRoot":"","sources":["../../src/schema/create-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAWpD,eAAO,MAAM,cAAc,GAAI,KAAK,eAAe;;;;;;;;;;;iBAUmtE,CAAC;yBAA8B,CAAC;iBAAsB,CAAC;eAAoB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAAuuH,CAAC;eAAqB,CAAC;uBAA6B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAD7mM,CAAC"}
+{"version":3,"file":"create-registry.d.ts","sourceRoot":"","sources":["../../src/schema/create-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAWpD,eAAO,MAAM,cAAc,GAAI,KAAK,eAAe;;;;;;;;;;;iBAUmtE,CAAC;yBAA8B,CAAC;iBAAsB,CAAC;eAAoB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAA+jI,CAAC;eAAqB,CAAC;uBAA6B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CADr8M,CAAC"}

package/dist/schema/definition.d.ts

@@ -106,8 +106,8 @@ export declare const getConsentTables: (options: C15TOptions) => {
             name: import("zod").ZodString;
             description: import("zod").ZodString;
             isEssential: import("zod").ZodDefault<import("zod").ZodBoolean>;
-            dataCategory: import("zod").ZodOptional<import("zod").ZodString>;
-            legalBasis: import("zod").ZodOptional<import("zod").ZodString>;
+            dataCategory: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+            legalBasis: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
             isActive: import("zod").ZodDefault<import("zod").ZodBoolean>;
             createdAt: import("zod").ZodDefault<import("zod").ZodDate>;
             updatedAt: import("zod").ZodDefault<import("zod").ZodDate>;
@@ -120,8 +120,8 @@ export declare const getConsentTables: (options: C15TOptions) => {
             updatedAt: Date;
             isEssential: boolean;
             isActive: boolean;
-            dataCategory?: string | undefined;
-            legalBasis?: string | undefined;
+            dataCategory?: string | null | undefined;
+            legalBasis?: string | null | undefined;
         }, {
             code: string;
             name: string;
@@ -130,8 +130,8 @@ export declare const getConsentTables: (options: C15TOptions) => {
             createdAt?: Date | undefined;
             updatedAt?: Date | undefined;
             isEssential?: boolean | undefined;
-            dataCategory?: string | undefined;
-            legalBasis?: string | undefined;
+            dataCategory?: string | null | undefined;
+            legalBasis?: string | null | undefined;
             isActive?: boolean | undefined;
         }>;
         fields: {

package/dist/schema/index.cjs

@@ -534,8 +534,8 @@ const purposeSchema = external_zod_namespaceObject.z.object({
     name: external_zod_namespaceObject.z.string(),
     description: external_zod_namespaceObject.z.string(),
     isEssential: external_zod_namespaceObject.z.boolean().default(false),
-    dataCategory: external_zod_namespaceObject.z.string().optional(),
-    legalBasis: external_zod_namespaceObject.z.string().optional(),
+    dataCategory: external_zod_namespaceObject.z.string().nullish(),
+    legalBasis: external_zod_namespaceObject.z.string().nullish(),
     isActive: external_zod_namespaceObject.z.boolean().default(true),
     createdAt: external_zod_namespaceObject.z.date().default(()=>new Date()),
     updatedAt: external_zod_namespaceObject.z.date().default(()=>new Date())
@@ -1139,10 +1139,19 @@ function consentRegistry({ adapter, ...ctx }) {
 }
 async function generatePolicyPlaceholder(name, date) {
     const content = `[PLACEHOLDER] This is an automatically generated version of the ${name} policy.\n\nThis placeholder content should be replaced with actual policy terms before being presented to users.\n\nGenerated on: ${date.toISOString()}`;
-    const encoder = new TextEncoder();
-    const data = encoder.encode(content);
-    const hashBuffer = await crypto.subtle.digest('SHA-256', data);
-    const contentHash = Array.from(new Uint8Array(hashBuffer)).map((b)=>b.toString(16).padStart(2, '0')).join('');
+    let contentHash;
+    try {
+        const encoder = new TextEncoder();
+        const data = encoder.encode(content);
+        const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+        contentHash = Array.from(new Uint8Array(hashBuffer)).map((b)=>b.toString(16).padStart(2, '0')).join('');
+    } catch (error) {
+        throw new error_class_DoubleTieError('Failed to generate policy content hash', {
+            code: error_codes_ERROR_CODES.INTERNAL_SERVER_ERROR,
+            status: 500,
+            cause: error instanceof Error ? error : new Error(String(error))
+        });
+    }
     return {
         content,
         contentHash
@@ -1204,42 +1213,51 @@ function policyRegistry({ adapter, ...ctx }) {
         },
         findOrCreatePolicy: async (type)=>await adapter.transaction({
                 callback: async (txAdapter)=>{
-                    const now = new Date();
-                    const txRegistry = policyRegistry({
-                        adapter: txAdapter,
-                        ...ctx
-                    });
-                    const rawLatestPolicy = await txAdapter.findOne({
-                        model: 'consentPolicy',
-                        where: [
-                            {
-                                field: 'isActive',
-                                value: true
-                            },
-                            {
-                                field: 'type',
-                                value: type
+                    try {
+                        const now = new Date();
+                        const txRegistry = policyRegistry({
+                            adapter: txAdapter,
+                            ...ctx
+                        });
+                        const rawLatestPolicy = await txAdapter.findOne({
+                            model: 'consentPolicy',
+                            where: [
+                                {
+                                    field: 'isActive',
+                                    value: true
+                                },
+                                {
+                                    field: 'type',
+                                    value: type
+                                }
+                            ],
+                            sortBy: {
+                                field: 'effectiveDate',
+                                direction: 'desc'
                             }
-                        ],
-                        sortBy: {
-                            field: 'effectiveDate',
-                            direction: 'desc'
-                        }
-                    });
-                    const latestPolicy = rawLatestPolicy ? validateEntityOutput('consentPolicy', rawLatestPolicy, ctx.options) : null;
-                    if (latestPolicy) return latestPolicy;
-                    const { content: defaultContent, contentHash } = await generatePolicyPlaceholder(type, now);
-                    return txRegistry.createConsentPolicy({
-                        version: '1.0.0',
-                        type,
-                        name: type,
-                        effectiveDate: now,
-                        content: defaultContent,
-                        contentHash,
-                        isActive: true,
-                        updatedAt: now,
-                        expirationDate: null
-                    });
+                        });
+                        const latestPolicy = rawLatestPolicy ? validateEntityOutput('consentPolicy', rawLatestPolicy, ctx.options) : null;
+                        if (latestPolicy) return latestPolicy;
+                        const { content: defaultContent, contentHash } = await generatePolicyPlaceholder(type, now);
+                        return txRegistry.createConsentPolicy({
+                            version: '1.0.0',
+                            type,
+                            name: type,
+                            effectiveDate: now,
+                            content: defaultContent,
+                            contentHash,
+                            isActive: true,
+                            updatedAt: now,
+                            expirationDate: null
+                        });
+                    } catch (error) {
+                        ctx.logger.error('Error in findOrCreatePolicy transaction:', error);
+                        throw new error_class_DoubleTieError('Failed to find or create policy', {
+                            code: error_codes_ERROR_CODES.INTERNAL_SERVER_ERROR,
+                            status: 500,
+                            cause: error instanceof Error ? error : new Error(String(error))
+                        });
+                    }
                 }
             })
     };

package/dist/schema/index.js

@@ -474,8 +474,8 @@ const purposeSchema = __WEBPACK_EXTERNAL_MODULE_zod__.z.object({
     name: __WEBPACK_EXTERNAL_MODULE_zod__.z.string(),
     description: __WEBPACK_EXTERNAL_MODULE_zod__.z.string(),
     isEssential: __WEBPACK_EXTERNAL_MODULE_zod__.z.boolean().default(false),
-    dataCategory: __WEBPACK_EXTERNAL_MODULE_zod__.z.string().optional(),
-    legalBasis: __WEBPACK_EXTERNAL_MODULE_zod__.z.string().optional(),
+    dataCategory: __WEBPACK_EXTERNAL_MODULE_zod__.z.string().nullish(),
+    legalBasis: __WEBPACK_EXTERNAL_MODULE_zod__.z.string().nullish(),
     isActive: __WEBPACK_EXTERNAL_MODULE_zod__.z.boolean().default(true),
     createdAt: __WEBPACK_EXTERNAL_MODULE_zod__.z.date().default(()=>new Date()),
     updatedAt: __WEBPACK_EXTERNAL_MODULE_zod__.z.date().default(()=>new Date())
@@ -1079,10 +1079,19 @@ function consentRegistry({ adapter, ...ctx }) {
 }
 async function generatePolicyPlaceholder(name, date) {
     const content = `[PLACEHOLDER] This is an automatically generated version of the ${name} policy.\n\nThis placeholder content should be replaced with actual policy terms before being presented to users.\n\nGenerated on: ${date.toISOString()}`;
-    const encoder = new TextEncoder();
-    const data = encoder.encode(content);
-    const hashBuffer = await crypto.subtle.digest('SHA-256', data);
-    const contentHash = Array.from(new Uint8Array(hashBuffer)).map((b)=>b.toString(16).padStart(2, '0')).join('');
+    let contentHash;
+    try {
+        const encoder = new TextEncoder();
+        const data = encoder.encode(content);
+        const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+        contentHash = Array.from(new Uint8Array(hashBuffer)).map((b)=>b.toString(16).padStart(2, '0')).join('');
+    } catch (error) {
+        throw new error_class_DoubleTieError('Failed to generate policy content hash', {
+            code: error_codes_ERROR_CODES.INTERNAL_SERVER_ERROR,
+            status: 500,
+            cause: error instanceof Error ? error : new Error(String(error))
+        });
+    }
     return {
         content,
         contentHash
@@ -1144,42 +1153,51 @@ function policyRegistry({ adapter, ...ctx }) {
         },
         findOrCreatePolicy: async (type)=>await adapter.transaction({
                 callback: async (txAdapter)=>{
-                    const now = new Date();
-                    const txRegistry = policyRegistry({
-                        adapter: txAdapter,
-                        ...ctx
-                    });
-                    const rawLatestPolicy = await txAdapter.findOne({
-                        model: 'consentPolicy',
-                        where: [
-                            {
-                                field: 'isActive',
-                                value: true
-                            },
-                            {
-                                field: 'type',
-                                value: type
+                    try {
+                        const now = new Date();
+                        const txRegistry = policyRegistry({
+                            adapter: txAdapter,
+                            ...ctx
+                        });
+                        const rawLatestPolicy = await txAdapter.findOne({
+                            model: 'consentPolicy',
+                            where: [
+                                {
+                                    field: 'isActive',
+                                    value: true
+                                },
+                                {
+                                    field: 'type',
+                                    value: type
+                                }
+                            ],
+                            sortBy: {
+                                field: 'effectiveDate',
+                                direction: 'desc'
                             }
-                        ],
-                        sortBy: {
-                            field: 'effectiveDate',
-                            direction: 'desc'
-                        }
-                    });
-                    const latestPolicy = rawLatestPolicy ? validateEntityOutput('consentPolicy', rawLatestPolicy, ctx.options) : null;
-                    if (latestPolicy) return latestPolicy;
-                    const { content: defaultContent, contentHash } = await generatePolicyPlaceholder(type, now);
-                    return txRegistry.createConsentPolicy({
-                        version: '1.0.0',
-                        type,
-                        name: type,
-                        effectiveDate: now,
-                        content: defaultContent,
-                        contentHash,
-                        isActive: true,
-                        updatedAt: now,
-                        expirationDate: null
-                    });
+                        });
+                        const latestPolicy = rawLatestPolicy ? validateEntityOutput('consentPolicy', rawLatestPolicy, ctx.options) : null;
+                        if (latestPolicy) return latestPolicy;
+                        const { content: defaultContent, contentHash } = await generatePolicyPlaceholder(type, now);
+                        return txRegistry.createConsentPolicy({
+                            version: '1.0.0',
+                            type,
+                            name: type,
+                            effectiveDate: now,
+                            content: defaultContent,
+                            contentHash,
+                            isActive: true,
+                            updatedAt: now,
+                            expirationDate: null
+                        });
+                    } catch (error) {
+                        ctx.logger.error('Error in findOrCreatePolicy transaction:', error);
+                        throw new error_class_DoubleTieError('Failed to find or create policy', {
+                            code: error_codes_ERROR_CODES.INTERNAL_SERVER_ERROR,
+                            status: 500,
+                            cause: error instanceof Error ? error : new Error(String(error))
+                        });
+                    }
                 }
             })
     };

package/dist/schema/schemas.d.ts

@@ -120,8 +120,8 @@ export declare const schemas: {
         name: z.ZodString;
         description: z.ZodString;
         isEssential: z.ZodDefault<z.ZodBoolean>;
-        dataCategory: z.ZodOptional<z.ZodString>;
-        legalBasis: z.ZodOptional<z.ZodString>;
+        dataCategory: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        legalBasis: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         isActive: z.ZodDefault<z.ZodBoolean>;
         createdAt: z.ZodDefault<z.ZodDate>;
         updatedAt: z.ZodDefault<z.ZodDate>;
@@ -134,8 +134,8 @@ export declare const schemas: {
         updatedAt: Date;
         isEssential: boolean;
         isActive: boolean;
-        dataCategory?: string | undefined;
-        legalBasis?: string | undefined;
+        dataCategory?: string | null | undefined;
+        legalBasis?: string | null | undefined;
     }, {
         code: string;
         name: string;
@@ -144,8 +144,8 @@ export declare const schemas: {
         createdAt?: Date | undefined;
         updatedAt?: Date | undefined;
         isEssential?: boolean | undefined;
-        dataCategory?: string | undefined;
-        legalBasis?: string | undefined;
+        dataCategory?: string | null | undefined;
+        legalBasis?: string | null | undefined;
         isActive?: boolean | undefined;
     }>;
     readonly consentRecord: z.ZodObject<{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c15t/backend",
-  "version": "1.2.0-canary.9",
+  "version": "1.2.1",
   "license": "GPL-3.0-only",
   "type": "module",
   "exports": {
@@ -19,6 +19,11 @@
       "import": "./dist/schema/index.js",
       "require": "./dist/schema/index.cjs"
     },
+    "./contracts": {
+      "types": "./dist/contracts/index.d.ts",
+      "import": "./dist/contracts.js",
+      "require": "./dist/contracts.cjs"
+    },
     "./pkgs/data-model/fields": {
       "types": "./dist/pkgs/data-model/fields/index.d.ts",
       "import": "./dist/pkgs/data-model/fields/index.js",
@@ -117,7 +122,7 @@
     "build": "rslib build",
     "check-types": "tsc --noEmit",
     "dev": "rslib build --watch",
-    "fmt": "pnpm biome format --write . && biome check --formatter-enabled=false --linter-enabled=false --organize-imports-enabled=true --write",
+    "fmt": "pnpm biome format --write . && pnpm biome check --formatter-enabled=false --linter-enabled=false --organize-imports-enabled=true --write",
     "knip": "knip",
     "lint": "pnpm biome lint ./src",
     "start": "node dist/server.cjs",

package/rslib.config.ts

@@ -62,6 +62,7 @@ export default defineConfig({
 		entry: {
 			core: ['./src/core.ts'],
 			router: ['./src/router.ts'],
+			contracts: ['./src/contracts/index.ts'],
 			'schema/index': ['./src/schema/index.ts'],
 			'pkgs/data-model/fields/index': ['./src/pkgs/data-model/fields/index.ts'],
 			'pkgs/data-model/index': ['./src/pkgs/data-model/index.ts'],

package/src/__tests__/server.test.ts

@@ -0,0 +1,96 @@
+import { describe, expect, it } from 'vitest';
+import { type C15TOptions, c15tInstance } from '../core';
+
+const mockOptions: C15TOptions = {
+	appName: 'Consent.io Dashboard',
+	basePath: '/api/c15t',
+	trustedOrigins: [
+		'localhost',
+		'vercel.app',
+		'consent.io',
+		'https://test.consent.io',
+	],
+	cors: true,
+	advanced: {
+		cors: {
+			allowHeaders: ['content-type', 'x-request-id'],
+		},
+	},
+	logger: {
+		level: 'debug',
+	},
+};
+
+const createTestRequest = (
+	path = '/api/c15t/status',
+	method = 'GET',
+	headers?: Record<string, string>
+) => {
+	return new Request(`http://localhost${path}`, {
+		method,
+		headers: {
+			'content-type': 'application/json',
+			...(headers || {}),
+		},
+	});
+};
+
+describe('C15T /status endpoint', () => {
+	it('GET /api/c15t/status returns 200 and status payload', async () => {
+		const c15t = c15tInstance(mockOptions);
+		const request = createTestRequest();
+		const response = await c15t.handler(request);
+		expect(response.status).toBe(200);
+		const data = await response.json();
+		expect(data).toHaveProperty('status');
+	});
+
+	it('responds correctly to requests from allowed origins', async () => {
+		const c15t = c15tInstance(mockOptions);
+		const request = createTestRequest(undefined, undefined, {
+			origin: 'https://test.consent.io',
+		});
+		const response = await c15t.handler(request);
+		expect(response.status).toBe(200);
+		expect(response.headers.get('access-control-allow-origin')).toBe(
+			'https://test.consent.io'
+		);
+	});
+
+	it('rejects requests from disallowed origins', async () => {
+		const c15t = c15tInstance(mockOptions);
+		const request = createTestRequest(undefined, undefined, {
+			origin: 'https://malicious-site.com',
+		});
+		const response = await c15t.handler(request);
+		expect(response.headers.get('access-control-allow-origin')).toBeNull();
+	});
+
+	it('handles preflight requests correctly', async () => {
+		const c15t = c15tInstance(mockOptions);
+		const request = createTestRequest(undefined, 'OPTIONS', {
+			origin: 'https://test.consent.io',
+			'access-control-request-method': 'GET',
+		});
+		const response = await c15t.handler(request);
+		expect(response.status).toBe(204);
+		expect(response.headers.get('access-control-allow-origin')).toBe(
+			'https://test.consent.io'
+		);
+		expect(response.headers.get('access-control-allow-headers')).toContain(
+			'Content-Type, Authorization, x-request-id'
+		);
+	});
+});
+
+describe('C15T /docs endpoint', () => {
+	it('GET /api/c15t/docs returns 200 and HTML', async () => {
+		const c15t = c15tInstance(mockOptions);
+		const request = createTestRequest('/api/c15t/docs');
+		const response = await c15t.handler(request);
+		expect(response.status).toBe(200);
+		const text = await response.text();
+		expect(text).toContain('<!doctype html>');
+		expect(response.headers.get('content-type')).toContain('text/html');
+	});
+});

package/src/contracts/index.ts

@@ -12,6 +12,8 @@ const config = {
 	meta: metaContracts,
 };
 
+export { config as contracts };
+
 export const os = implement(config);
 
 export type ContractsOutputs = InferContractRouterOutputs<typeof config>;

package/src/core.ts

@@ -296,16 +296,31 @@ export const c15tInstance = <PluginTypes extends C15TPlugin[] = C15TPlugin[]>(
 
 		// Use oRPC handler to handle the request with our enhanced context
 		const handlerContext = orpcContext as Record<string, unknown>;
+
+		orpcContext.logger.debug?.('Handling prefix', {
+			prefix: (options.basePath as `/${string}`) || '/',
+		});
+
 		const { matched, response } = await rpcHandler.handle(request, {
-			prefix: (options.baseURL as `/${string}`) || '/',
+			prefix: (options.basePath as `/${string}`) || '/',
 			context: handlerContext,
 		});
 
 		// Return the response if handler matched
 		if (matched && response) {
+			orpcContext.logger.debug('Handler matched', {
+				request,
+				matched,
+				response,
+			});
 			return response;
 		}
 
+		orpcContext.logger.debug('No handler matched', {
+			request,
+			matched,
+			response,
+		});
 		// If no handler matched, return 404
 		return new Response('Not Found', { status: 404 });
 	};
@@ -340,6 +355,19 @@ export const c15tInstance = <PluginTypes extends C15TPlugin[] = C15TPlugin[]>(
 			}
 			const ctx = ctxResult.value;
 
+			// After options/baseURL/basePath is set/used
+			const basePath = options.basePath || options.baseURL || '/';
+			createLogger(options.logger)?.debug?.('[c15t] Using basePath/baseURL', {
+				basePath,
+			});
+
+			// Add this debug log:
+			createLogger(options.logger)?.debug?.('[c15t] Routing request', {
+				method: request.method,
+				url: request.url,
+				prefix: basePath,
+			});
+
 			// Handle API request
 			return await handleApiRequest(request, ctx);
 		} catch (error) {

package/src/middleware/cors/cors.test.ts

@@ -1,4 +1,3 @@
-import {} from 'msw';
 import { setupServer } from 'msw/node';
 import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest';
 import { c15tInstance } from '../../core';

package/src/middleware/openapi/config.ts

@@ -4,12 +4,15 @@ import packageJson from '../../../package.json';
 /**
  * Default OpenAPI configuration
  */
-export const createOpenAPIConfig = (options: C15TOptions) => ({
-	enabled: true,
-	specPath: '/spec.json',
-	docsPath: '/docs',
-	...(options.openapi || {}),
-});
+export const createOpenAPIConfig = (options: C15TOptions) => {
+	const basePath = options.basePath || '';
+	return {
+		enabled: true,
+		specPath: `${basePath}/spec.json`,
+		docsPath: `${basePath}/docs`,
+		...(options.openapi || {}),
+	};
+};
 
 /**
  * Default OpenAPI options
@@ -20,6 +23,6 @@ export const createDefaultOpenAPIOptions = (options: C15TOptions) => ({
 		version: packageJson.version,
 		description: 'API for consent management',
 	},
-	servers: [{ url: '/' }],
+	servers: [{ url: options.basePath || '/' }],
 	security: [{ bearerAuth: [] }],
 });