@copilotkit/runtime 1.51.2-next.1 → 1.51.3-next.0

package/package.json

@@ -9,7 +9,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.51.2-next.1",
+  "version": "1.51.3-next.0",
   "sideEffects": false,
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -61,7 +61,7 @@
     "graphql": "^16.8.1",
     "graphql-scalars": "^1.23.0",
     "graphql-yoga": "^5.3.1",
-    "hono": "^4.10.3",
+    "hono": "^4.11.4",
     "openai": "^4.85.1",
     "partial-json": "^0.1.7",
     "pino": "^9.2.0",
@@ -70,9 +70,9 @@
     "rxjs": "7.8.1",
     "type-graphql": "2.0.0-rc.1",
     "zod": "^3.23.3",
-    "@copilotkit/shared": "1.51.2-next.1",
-    "@copilotkitnext/agent": "1.51.2-next.1",
-    "@copilotkitnext/runtime": "1.51.2-next.1"
+    "@copilotkit/shared": "1.51.3-next.0",
+    "@copilotkitnext/agent": "1.51.3-next.0",
+    "@copilotkitnext/runtime": "1.51.3-next.0"
   },
   "peerDependencies": {
     "@anthropic-ai/sdk": "^0.57.0",
@@ -85,9 +85,9 @@
     "groq-sdk": ">=0.3.0 <1.0.0",
     "langchain": ">=0.3.3",
     "openai": "^4.85.1",
-    "@copilotkit/shared": "1.51.2-next.1",
-    "@copilotkitnext/agent": "1.51.2-next.1",
-    "@copilotkitnext/runtime": "1.51.2-next.1"
+    "@copilotkit/shared": "1.51.3-next.0",
+    "@copilotkitnext/agent": "1.51.3-next.0",
+    "@copilotkitnext/runtime": "1.51.3-next.0"
   },
   "peerDependenciesMeta": {
     "@anthropic-ai/sdk": {

package/src/lib/integrations/nextjs/app-router.ts

@@ -28,10 +28,12 @@ export function copilotRuntimeNextJSAppRouterEndpoint(options: CreateCopilotRunt
     options.runtime.handleServiceAdapter(serviceAdapter);
   }
 
+  // Note: cors option requires @copilotkitnext/runtime with credentials support
   const copilotRoute = createCopilotEndpointSingleRoute({
     runtime: options.runtime.instance,
     basePath: options.baseUrl ?? options.endpoint,
-  });
+    ...(options.cors && { cors: options.cors }),
+  } as any);
 
   const handleRequest = handle(copilotRoute as any);
   return { handleRequest };

package/src/lib/integrations/node-http/index.ts

@@ -38,10 +38,12 @@ export function copilotRuntimeNodeHttpEndpoint(options: CreateCopilotRuntimeServ
     options.runtime.handleServiceAdapter(serviceAdapter);
   }
 
+  // Note: cors option requires @copilotkitnext/runtime with credentials support
   const honoApp = createCopilotEndpointSingleRoute({
     runtime: options.runtime.instance,
     basePath: options.baseUrl ?? options.endpoint,
-  });
+    ...(options.cors && { cors: options.cors }),
+  } as any);
 
   const handle = async function handler(req: IncomingWithBody, res: ServerResponse) {
     const url = getFullUrl(req);

package/src/lib/integrations/shared.ts

@@ -12,6 +12,21 @@ import { StateResolver } from "../../graphql/resolvers/state.resolver";
 import * as packageJson from "../../../package.json";
 import { CopilotKitError, CopilotKitErrorCode } from "@copilotkit/shared";
 
+/**
+ * CORS configuration for CopilotKit endpoints.
+ */
+export interface CopilotEndpointCorsConfig {
+  /**
+   * Allowed origin(s). Can be a string, array of strings, or a function that returns the origin.
+   */
+  origin: string | string[] | ((origin: string, c: any) => string | undefined | null);
+  /**
+   * Whether to include credentials (cookies, authorization headers) in CORS requests.
+   * When true, origin cannot be "*" - must be an explicit origin.
+   */
+  credentials?: boolean;
+}
+
 const logger = createLogger();
 
 export const addCustomHeaderPlugin = {
@@ -41,6 +56,11 @@ export interface CreateCopilotRuntimeServerOptions {
   cloud?: CopilotCloudOptions;
   properties?: CopilotRequestContextProperties;
   logLevel?: LogLevel;
+  /**
+   * Optional CORS configuration. When not provided, defaults to allowing all origins without credentials.
+   * To support HTTP-only cookies, provide cors config with credentials: true and explicit origin.
+   */
+  cors?: CopilotEndpointCorsConfig;
 }
 
 export async function createContext(