feat(mcp): scaffold uses real EINHERJAR_SERVER_CORS_ORIGINS; document web.New vs server.New (v1.2.0)

internal/tools/scaffold.go

@@ -131,13 +131,14 @@ func Run() error {
 
 	db := postgres.New(logger, cfg.PG)
 
-	// CORS: allow-all in local dev; explicit origins elsewhere. mw.CORS panics on
-	// "*", so never pass a wildcard through APP_CORS_ORIGINS outside local.
+	// CORS: allow-all in local dev; explicit origins elsewhere. Origins come from the
+	// framework's own EINHERJAR_SERVER_CORS_ORIGINS (cfg.Server.CORSOrigins). mw.CORS
+	// panics on "*", so never set that var to a wildcard outside local.
 	var corsMW func(http.Handler) http.Handler
 	if strings.EqualFold(cfg.AppEnv, "local") {
 		corsMW = mw.CORSAllowAll()
 	} else {
-		corsMW = mw.CORS(cfg.CORSOrigins)
+		corsMW = mw.CORS(cfg.Server.CORSOrigins)
 	}
 
 	srv := server.New(logger, cfg.Server,
@@ -202,14 +203,13 @@ import (
 // the nested framework configs, populating their EINHERJAR_* tags from the
 // environment next to the app-owned APP_* fields.
 type Config struct {
-	AppEnv      string   ` + "`" + `env:"APP_ENV"          envDefault:"local"` + "`" + `
-	CORSOrigins []string ` + "`" + `env:"APP_CORS_ORIGINS" envSeparator:","` + "`" + `
+	AppEnv string ` + "`" + `env:"APP_ENV" envDefault:"local"` + "`" + `
 
 	// Framework component configs — composed verbatim; their EINHERJAR_* tags
 	// load through this same env.Parse call.
 	Launcher launcher.Config // EINHERJAR_COMPONENT_STOP_TIMEOUT
 	Log      logz.Config     // EINHERJAR_LOG_*
-	Server   server.Config   // EINHERJAR_SERVER_*
+	Server   server.Config   // EINHERJAR_SERVER_* (incl. EINHERJAR_SERVER_CORS_ORIGINS)
 	Health   health.Config   // EINHERJAR_HEALTH_CHECK_TIMEOUT
 	PG       postgres.Config // EINHERJAR_PG_*
 }
@@ -237,9 +237,7 @@ func renderEnvExample(idx *index.Index, app string) string {
 
 	b.WriteString("# ── App (APP_*) ────────────────────────────────────────────────────────────\n")
 	b.WriteString("APP_ENV=local\n")
-	b.WriteString("# APP_CORS_ORIGINS — explicit origins for non-local envs (comma-separated).\n")
-	b.WriteString("# Local uses mw.CORSAllowAll() and ignores this; \"*\" is rejected by mw.CORS — never use it.\n")
-	b.WriteString("APP_CORS_ORIGINS=\n\n")
+	b.WriteString("# CORS: local uses mw.CORSAllowAll(); non-local reads EINHERJAR_SERVER_CORS_ORIGINS below.\n\n")
 
 	writeEnvSection(&b, "Einherjar: launcher", envspec.FindStruct(idx, "core", "launcher", "Config"), app)
 	writeEnvSection(&b, "Einherjar: logging", envspec.FindStruct(idx, "core", "logz", "Config"), app)