@nextsparkjs/core 0.1.0-beta.69 → 0.1.0-beta.70

package/dist/lib/api/entity/generic-handler.js

@@ -204,11 +204,11 @@ async function handleGenericList(request) {
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "list")) {
       const response2 = createApiError("List operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const authResult = await authenticateRequest(request);
     let userId = null;
@@ -227,7 +227,7 @@ async function handleGenericList(request) {
       }
       if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:read`)) {
         const response2 = createApiError("Insufficient permissions", 403);
-        return addCorsHeaders(response2);
+        return addCorsHeaders(response2, request);
       }
       userId = authResult.user.id;
       const teamValidation = await validateTeamContextWithBypass(request, authResult, userId);
@@ -479,11 +479,11 @@ async function handleGenericList(request) {
       );
     }
     const response = createApiResponse(dataWithTaxonomies, paginationMeta);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic list handler:", error);
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
 async function handleGenericCreate(request) {
@@ -492,11 +492,11 @@ async function handleGenericCreate(request) {
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "create")) {
       const response2 = createApiError("Create operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const authResult = await authenticateRequest(request);
     if (!authResult.success) {
@@ -510,14 +510,14 @@ async function handleGenericCreate(request) {
     }
     if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:write`)) {
       const response2 = createApiError("Insufficient permissions", 403);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     let body;
     try {
       body = await request.json();
     } catch {
       const response2 = createApiError("Invalid JSON body", 400);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const { metas, ...entityData } = body;
     const rawUserId = entityData.userId;
@@ -531,7 +531,7 @@ async function handleGenericCreate(request) {
         errors: validation.error.issues
       });
       const response2 = createApiError("Validation error", 400, validation.error.issues, "VALIDATION_ERROR");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const validatedData = validation.data;
     const idStrategy = ((_a = entityConfig.idStrategy) == null ? void 0 : _a.type) || "uuid";
@@ -548,7 +548,7 @@ async function handleGenericCreate(request) {
     const teamId = teamValidation.teamId;
     if (!teamId) {
       const response2 = createApiError("Team context required for create operations. Include x-team-id header.", 400, void 0, "TEAM_CONTEXT_REQUIRED");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (idStrategy === "serial") {
       insertFields = ['"userId"', '"teamId"'];
@@ -681,11 +681,11 @@ async function handleGenericCreate(request) {
       console.error(`[generic-handler] Error in afterEntityCreate hook for ${entityConfig.slug}:`, hookError);
     }
     const response = createApiResponse(responseData, { created: true }, 201);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic create handler:", error);
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
 async function handleGenericRead(request, { params }) {
@@ -695,11 +695,11 @@ async function handleGenericRead(request, { params }) {
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "read")) {
       const response2 = createApiError("Read operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const authResult = await authenticateRequest(request);
     let userId = null;
@@ -718,7 +718,7 @@ async function handleGenericRead(request, { params }) {
       }
       if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:read`)) {
         const response2 = createApiError("Insufficient permissions", 403);
-        return addCorsHeaders(response2);
+        return addCorsHeaders(response2, request);
       }
       userId = authResult.user.id;
       const teamValidation = await validateTeamContextWithBypass(request, authResult, userId);
@@ -763,7 +763,7 @@ async function handleGenericRead(request, { params }) {
     const items = await queryWithRLS(query, queryParams, userId);
     if (!items[0]) {
       const response2 = createApiError("Item not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const item = items[0];
     const metaParams = parseMetaParams(request);
@@ -799,11 +799,11 @@ async function handleGenericRead(request, { params }) {
       itemWithTaxonomies = itemsWithTaxonomies[0] || itemWithChild;
     }
     const response = createApiResponse(itemWithTaxonomies);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic read handler:", error);
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
 async function handleGenericUpdate(request, { params }) {
@@ -813,11 +813,11 @@ async function handleGenericUpdate(request, { params }) {
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "update")) {
       const response2 = createApiError("Update operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const authResult = await authenticateRequest(request);
     if (!authResult.success) {
@@ -831,7 +831,7 @@ async function handleGenericUpdate(request, { params }) {
     }
     if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:write`)) {
       const response2 = createApiError("Insufficient permissions", 403);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const teamValidation = await validateTeamContextWithBypass(request, authResult, authResult.user.id);
     if (!teamValidation.valid) {
@@ -840,14 +840,14 @@ async function handleGenericUpdate(request, { params }) {
     const teamId = teamValidation.teamId;
     if (!teamId) {
       const response2 = createApiError("Team context required for update operations. Include x-team-id header.", 400, void 0, "TEAM_CONTEXT_REQUIRED");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     let body;
     try {
       body = await request.json();
     } catch {
       const response2 = createApiError("Invalid JSON body", 400);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const { metas, ...entityData } = body;
     const entityConfig = resolution.entityConfig;
@@ -860,7 +860,7 @@ async function handleGenericUpdate(request, { params }) {
         errors: validation.error.issues
       });
       const response2 = createApiError("Validation error", 400, validation.error.issues, "VALIDATION_ERROR");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const validatedData = validation.data;
     const updates = [];
@@ -928,7 +928,7 @@ async function handleGenericUpdate(request, { params }) {
     const metadataWasProvided = metas && typeof metas === "object" && Object.keys(metas).length > 0;
     if (updates.length === 0 && !metadataWasProvided) {
       const response2 = createApiError("No fields to update", 400);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (updates.length > 0) {
       updates.push(`"updatedAt" = CURRENT_TIMESTAMP`);
@@ -954,7 +954,7 @@ async function handleGenericUpdate(request, { params }) {
       const result = await mutateWithRLS(updateQuery, values, authResult.user.id);
       if (!result.rows || result.rows.length === 0) {
         const response2 = createApiError("Item not found", 404);
-        return addCorsHeaders(response2);
+        return addCorsHeaders(response2, request);
       }
       updatedItem = result.rows[0];
     } else {
@@ -967,7 +967,7 @@ async function handleGenericUpdate(request, { params }) {
       const result = await queryWithRLS(selectQuery, selectValues, authResult.user.id);
       if (!result || result.length === 0) {
         const response2 = createApiError("Item not found", 404);
-        return addCorsHeaders(response2);
+        return addCorsHeaders(response2, request);
       }
       updatedItem = result[0];
     }
@@ -1003,11 +1003,11 @@ async function handleGenericUpdate(request, { params }) {
       console.error(`[generic-handler] Error in afterEntityUpdate hook for ${entityConfig.slug}:`, hookError);
     }
     const response = createApiResponse(responseData);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic update handler:", error);
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
 async function handleGenericDelete(request, { params }) {
@@ -1017,11 +1017,11 @@ async function handleGenericDelete(request, { params }) {
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "delete")) {
       const response2 = createApiError("Delete operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const authResult = await authenticateRequest(request);
     if (!authResult.success) {
@@ -1035,7 +1035,7 @@ async function handleGenericDelete(request, { params }) {
     }
     if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:write`)) {
       const response2 = createApiError("Insufficient permissions", 403);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const teamValidation = await validateTeamContextWithBypass(request, authResult, authResult.user.id);
     if (!teamValidation.valid) {
@@ -1044,7 +1044,7 @@ async function handleGenericDelete(request, { params }) {
     const teamId = teamValidation.teamId;
     if (!teamId) {
       const response2 = createApiError("Team context required for delete operations. Include x-team-id header.", 400, void 0, "TEAM_CONTEXT_REQUIRED");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const entityConfig = resolution.entityConfig;
     const tableName = getTableName(entityConfig);
@@ -1067,7 +1067,7 @@ async function handleGenericDelete(request, { params }) {
     const result = await mutateWithRLS(deleteQuery, deleteParams, authResult.user.id);
     if (!result.rows || result.rows.length === 0) {
       const response2 = createApiError("Item not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     try {
       await afterEntityDelete(entityConfig.slug, id, authResult.user.id);
@@ -1075,15 +1075,15 @@ async function handleGenericDelete(request, { params }) {
       console.error(`[generic-handler] Error in afterEntityDelete hook for ${entityConfig.slug}:`, hookError);
     }
     const response = createApiResponse({ success: true, id });
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic delete handler:", error);
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
-async function handleGenericOptions() {
-  return handleCorsPreflightRequest();
+async function handleGenericOptions(request) {
+  return handleCorsPreflightRequest(request);
 }
 async function handleDistinctJsonbField(entityConfig, fieldName, url, userId) {
   var _a;

package/dist/lib/api/helpers.js

@@ -7,6 +7,7 @@ import { auth } from "../auth.js";
 import { MetaService } from "../services/meta.service.js";
 import { ScopeService } from "../services/scope.service.js";
 import { getChildEntities } from "../entities/queries.js";
+import { getCorsOrigins, normalizeOrigin } from "../utils/cors.js";
 async function validateAndAuthenticateRequest(request) {
   var _a;
   const cookieHeader = request.headers.get("cookie");
@@ -265,19 +266,23 @@ async function addCorsHeaders(response, request) {
   if (request) {
     const origin = request.headers.get("origin");
     if (origin) {
+      const normalizedOrigin = normalizeOrigin(origin);
       if (env === "development" && corsConfig.allowAllOrigins.development) {
-        allowedOrigin = origin;
+        allowedOrigin = normalizedOrigin;
       } else {
-        const allowedOrigins = corsConfig.allowedOrigins[env] || [];
-        if (allowedOrigins.includes(origin)) {
-          allowedOrigin = origin;
+        const allowedOrigins = getCorsOrigins(config, env);
+        if (allowedOrigins.includes(normalizedOrigin)) {
+          allowedOrigin = normalizedOrigin;
         }
       }
     }
+  } else if (env === "development" && corsConfig.allowAllOrigins.development) {
+    const allowedOrigins = getCorsOrigins(config, env);
+    allowedOrigin = allowedOrigins[0] || "http://localhost:3000";
   }
   response.headers.set("Access-Control-Allow-Origin", allowedOrigin);
   response.headers.set("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS");
-  response.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-API-Key");
+  response.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-API-Key, x-team-id, x-builder-source");
   response.headers.set("Access-Control-Allow-Credentials", "true");
   response.headers.set("Access-Control-Max-Age", "86400");
   return response;
@@ -286,6 +291,33 @@ async function handleCorsPreflightRequest(request) {
   const response = new NextResponse(null, { status: 200 });
   return await addCorsHeaders(response, request);
 }
+async function wrapAuthHandlerWithCors(handler, request) {
+  const response = await handler();
+  const newResponse = new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: new Headers(response.headers)
+  });
+  const env = process.env.NODE_ENV || "development";
+  const config = await getApplicationConfig();
+  const corsConfig = config.api.cors;
+  const origin = request.headers.get("origin");
+  if (origin) {
+    const normalizedOrigin = normalizeOrigin(origin);
+    let allowedOrigin = "null";
+    if (env === "development" && corsConfig.allowAllOrigins.development) {
+      allowedOrigin = normalizedOrigin;
+    } else {
+      const allowedOrigins = getCorsOrigins(config, env);
+      if (allowedOrigins.includes(normalizedOrigin)) {
+        allowedOrigin = normalizedOrigin;
+      }
+    }
+    newResponse.headers.set("Access-Control-Allow-Origin", allowedOrigin);
+    newResponse.headers.set("Access-Control-Allow-Credentials", "true");
+  }
+  return newResponse;
+}
 function parseMetaParams(request) {
   const url = new URL(request.url);
   const metasParam = url.searchParams.get("metas");
@@ -522,5 +554,6 @@ export {
   sanitizeSearchQuery,
   validateAndAuthenticateApiRequest,
   validateAndAuthenticateRequest,
-  withApiLogging
+  withApiLogging,
+  wrapAuthHandlerWithCors
 };

package/dist/lib/auth.js

@@ -3,10 +3,11 @@ import { Pool } from "pg";
 import { nextCookies } from "better-auth/next-js";
 import { parseSSLConfig } from "./db.js";
 import { EmailFactory, emailTemplates } from "./email/index.js";
-import { I18N_CONFIG, USER_ROLES_CONFIG, TEAMS_CONFIG } from "./config/index.js";
+import { I18N_CONFIG, USER_ROLES_CONFIG, TEAMS_CONFIG, APP_CONFIG_MERGED } from "./config/index.js";
 import { getUserFlags } from "./services/user-flags.service.js";
 import { TeamService } from "./services/team.service.js";
 import { shouldSkipTeamCreation } from "./auth-context.js";
+import { getCorsOrigins } from "./utils/cors.js";
 const isProd = process.env.NODE_ENV === "production";
 const baseUrl = process.env.BETTER_AUTH_URL || process.env.NEXT_PUBLIC_APP_URL || "http://localhost:5173";
 const emailService = EmailFactory.create();
@@ -137,20 +138,8 @@ const auth = betterAuth({
     }
   },
   baseURL: baseUrl,
-  trustedOrigins: [
-    baseUrl,
-    process.env.NEXT_PUBLIC_APP_URL,
-    // Additional public URL
-    "http://localhost:5173",
-    "http://localhost:3000",
-    // Ionic app
-    "http://localhost:3008",
-    // Ionic app (puerto actual)
-    "http://127.0.0.1:3000",
-    // Alternative localhost
-    "http://127.0.0.1:3008"
-    // Alternative localhost actual
-  ].filter((origin) => Boolean(origin)),
+  // Use unified CORS configuration from app.config.ts + theme extensions + env vars
+  trustedOrigins: getCorsOrigins(APP_CONFIG_MERGED),
   plugins: [
     nextCookies()
     // MUST be the last plugin for Next.js cookie handling

package/dist/lib/index.js

@@ -1,4 +1,4 @@
-import { cn } from "./utils.js";
+import { cn } from "./utils/index.js";
 export * from "./formatters.js";
 export * from "./countries-timezones.js";
 export * from "./i18n-utils.js";

package/dist/lib/plugins/env-loader.js

@@ -38,7 +38,11 @@ class PluginEnvLoader {
         if (existsSync(envPath)) {
           const result = config({ path: envPath, override: false });
           if (result.error) {
-            console.error(`[Plugin Env Loader] Error loading ${entry}/.env:`, result.error);
+            if (process.env.NODE_ENV === "development") {
+              console.error(`[Plugin Env Loader] Error loading ${entry}/.env:`, result.error);
+            } else {
+              console.error(`[Plugin Env Loader] Error loading ${entry}/.env`);
+            }
             pluginEnv = { ...process.env };
           } else if (result.parsed) {
             pluginEnv = { ...process.env, ...result.parsed };
@@ -58,7 +62,11 @@ class PluginEnvLoader {
       }
       this.loaded = true;
     } catch (error) {
-      console.error("[Plugin Env Loader] Failed to load plugin environments:", error);
+      if (process.env.NODE_ENV === "development") {
+        console.error("[Plugin Env Loader] Failed to load plugin environments:", error);
+      } else {
+        console.error("[Plugin Env Loader] Failed to load plugin environments");
+      }
       this.loaded = true;
     }
   }
@@ -74,7 +82,7 @@ class PluginEnvLoader {
       if (process.env.NODE_ENV === "development") {
         console.warn(`[Plugin Env Loader] No .env found for plugin: ${pluginName}`);
       }
-      return {};
+      return { ...process.env };
     }
     return pluginEnv;
   }

package/dist/lib/selectors/domains/block-editor.selectors.js

@@ -148,7 +148,28 @@ const BLOCK_EDITOR_SELECTORS = {
       content: "builder-config-entity-content",
       field: "builder-config-entity-field-{name}"
     },
-    // SEO & Meta section (collapsible)
+    // SEO section (collapsible) - standalone
+    seoSection: {
+      container: "builder-config-seo-section",
+      trigger: "builder-config-seo-trigger",
+      content: "builder-config-seo-content",
+      metaTitle: "builder-config-seo-title",
+      metaDescription: "builder-config-seo-description",
+      metaKeywords: "builder-config-seo-keywords",
+      ogImage: "builder-config-seo-og-image"
+    },
+    // Custom Fields section (collapsible) - standalone
+    customFieldsSection: {
+      container: "builder-config-custom-section",
+      trigger: "builder-config-custom-trigger",
+      content: "builder-config-custom-content",
+      addButton: "builder-config-custom-add",
+      fieldKey: "builder-config-custom-key-{index}",
+      fieldValue: "builder-config-custom-value-{index}",
+      fieldRemove: "builder-config-custom-remove-{index}"
+    },
+    // SEO & Meta section (collapsible) - DEPRECATED: use seoSection + customFieldsSection
+    /** @deprecated Use seoSection and customFieldsSection instead */
     seoMetaSection: {
       container: "builder-config-seo-section",
       trigger: "builder-config-seo-trigger",

package/dist/lib/utils/cors.js

@@ -0,0 +1,64 @@
+const DEV_LIKE_ENVIRONMENTS = ["development", "staging", "qa"];
+function isDebugEnabled() {
+  return process.env.NEXTSPARK_DEBUG_CORS === "true";
+}
+function normalizeOrigin(origin) {
+  if (!origin || typeof origin !== "string") {
+    return "";
+  }
+  try {
+    const url = new URL(origin);
+    return url.origin;
+  } catch {
+    return origin.toLowerCase().replace(/\/+$/, "");
+  }
+}
+function normalizeCorsEnvironment(env) {
+  const normalized = env.toLowerCase();
+  if (DEV_LIKE_ENVIRONMENTS.includes(normalized)) {
+    return "development";
+  }
+  if (normalized === "production") {
+    return "production";
+  }
+  if (isDebugEnabled()) {
+    console.log(`[cors] Unknown environment "${env}", defaulting to development`);
+  }
+  return "development";
+}
+function getCorsOrigins(config, env = process.env.NODE_ENV || "development") {
+  var _a;
+  const key = normalizeCorsEnvironment(env);
+  if (isDebugEnabled()) {
+    console.log(`[cors] Environment: ${env} -> normalized: ${key}`);
+  }
+  const coreOrigins = [...config.api.cors.allowedOrigins[key] || []];
+  const themeOrigins = [...((_a = config.api.cors.additionalOrigins) == null ? void 0 : _a[key]) || []];
+  const envVar = process.env.CORS_ADDITIONAL_ORIGINS || "";
+  const envOrigins = envVar.split(",").map((o) => o.trim()).filter(Boolean);
+  const appUrl = process.env.NEXT_PUBLIC_APP_URL;
+  const authUrl = process.env.BETTER_AUTH_URL;
+  const baseOrigins = [];
+  if (appUrl) baseOrigins.push(appUrl);
+  if (authUrl && authUrl !== appUrl) baseOrigins.push(authUrl);
+  const allOrigins = [...baseOrigins, ...coreOrigins, ...themeOrigins, ...envOrigins];
+  const origins = [...new Set(allOrigins.map(normalizeOrigin))];
+  if (isDebugEnabled()) {
+    console.log(`[cors] Merged origins (${origins.length}):`, origins);
+    console.log(`[cors]   - Base origins: ${baseOrigins.length}`);
+    console.log(`[cors]   - Core origins: ${coreOrigins.length}`);
+    console.log(`[cors]   - Theme origins: ${themeOrigins.length}`);
+    console.log(`[cors]   - Env origins: ${envOrigins.length}`);
+    for (const origin of origins) {
+      if (!origin.startsWith("http://") && !origin.startsWith("https://")) {
+        console.warn(`[cors] Invalid origin format: "${origin}" (must start with http:// or https://)`);
+      }
+    }
+  }
+  return origins;
+}
+export {
+  getCorsOrigins,
+  normalizeCorsEnvironment,
+  normalizeOrigin
+};

package/dist/lib/utils/index.js

@@ -0,0 +1,9 @@
+import { cn } from "../utils.js";
+import { getCorsOrigins, normalizeCorsEnvironment, normalizeOrigin } from "./cors.js";
+export * from "./config-merge.js";
+export {
+  cn,
+  getCorsOrigins,
+  normalizeCorsEnvironment,
+  normalizeOrigin
+};

package/dist/messages/en/admin.json

@@ -270,6 +270,7 @@
     "config": {
       "entityFields": "Entity Fields",
       "entityFieldsDescription": "Configure page-level properties",
+      "seo": "SEO",
       "seoMeta": "SEO & Meta",
       "seoMetaDescription": "Search engine optimization settings"
     },

package/dist/messages/es/admin.json

@@ -270,6 +270,7 @@
     "config": {
       "entityFields": "Campos de Entidad",
       "entityFieldsDescription": "Configura propiedades a nivel de página",
+      "seo": "SEO",
       "seoMeta": "SEO y Meta",
       "seoMetaDescription": "Configuración para motores de búsqueda"
     },

package/dist/templates/app/api/auth/[...all]/route.ts

@@ -4,9 +4,15 @@ import { NextRequest, NextResponse } from "next/server";
 import { TEAMS_CONFIG } from "@nextsparkjs/core/lib/config";
 import { isPublicSignupRestricted } from "@nextsparkjs/core/lib/teams/helpers";
 import { TeamService } from "@nextsparkjs/core/lib/services";
+import { wrapAuthHandlerWithCors, handleCorsPreflightRequest, addCorsHeaders } from "@nextsparkjs/core/lib/api/helpers";
 
 const handlers = toNextJsHandler(auth);
 
+// Handle CORS preflight requests for cross-origin auth (mobile apps, etc.)
+export async function OPTIONS(req: NextRequest) {
+  return handleCorsPreflightRequest(req);
+}
+
 // Intercept email verification requests to redirect to UI page
 // eslint-disable-next-line @typescript-eslint/no-unused-vars
 export async function GET(req: NextRequest, context: { params: Promise<{ all: string[] }> }) {
@@ -31,8 +37,8 @@ export async function GET(req: NextRequest, context: { params: Promise<{ all: st
     }
   }
 
-  // For all other requests (including UI verification calls), use the default Better Auth handler
-  return handlers.GET(req);
+  // Wrap with CORS headers for cross-origin requests (mobile apps, etc.)
+  return wrapAuthHandlerWithCors(() => handlers.GET(req), req);
 }
 
 // Intercept signup requests to validate single-tenant mode
@@ -53,7 +59,8 @@ export async function POST(req: NextRequest) {
 
       if (teamExists) {
         // Block public signup - users must be invited
-        return NextResponse.json(
+        // Add CORS headers so mobile apps can read the error message
+        const errorResponse = NextResponse.json(
           {
             error: 'Registration is closed',
             message: 'This application requires an invitation to register. Please contact an administrator.',
@@ -61,10 +68,11 @@ export async function POST(req: NextRequest) {
           },
           { status: 403 }
         );
+        return await addCorsHeaders(errorResponse, req);
       }
     }
   }
 
-  // Continue with normal Better Auth handling
-  return handlers.POST(req);
+  // Wrap with CORS headers for cross-origin requests (mobile apps, etc.)
+  return wrapAuthHandlerWithCors(() => handlers.POST(req), req);
 }

package/dist/templates/contents/themes/starter/config/app.config.ts

@@ -80,16 +80,17 @@ export const APP_CONFIG_OVERRIDES = {
   // =============================================================================
   api: {
     cors: {
-      allowedOrigins: {
+      // Theme-specific CORS origins (extends core defaults, does not replace)
+      // Core already includes: localhost:3000, localhost:5173, and their 127.0.0.1 variants
+      additionalOrigins: {
         development: [
-          'http://localhost:3000',
-          'http://localhost:5173',
-          'http://127.0.0.1:3000',
-          'http://127.0.0.1:5173',
+          // Add your development origins here
+          // 'http://localhost:4200', // Angular dev server
+          // 'http://localhost:8081', // Expo mobile web
         ],
         production: [
-          // Add production domains:
-          // 'https://your-domain.com',
+          // Add your production origins here
+          // 'https://mobile.yourapp.com',
         ],
       },
     },

package/dist/templates/pnpm-workspace.yaml

@@ -0,0 +1,5 @@
+# pnpm workspace configuration
+# Enables plugins and themes to have their own package.json with dependencies
+packages:
+  - 'contents/themes/*'
+  - 'contents/plugins/*'