@decocms/runtime 1.0.0-alpha.14 → 1.0.0-alpha.17

package/config-schema.json

@@ -0,0 +1,553 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$ref": "#/definitions/WranglerConfig",
+  "definitions": {
+    "WranglerConfig": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "main": {
+          "type": "string"
+        },
+        "scope": {
+          "type": "string"
+        },
+        "main_module": {
+          "type": "string"
+        },
+        "routes": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/Route"
+          }
+        },
+        "compatibility_date": {
+          "type": "string"
+        },
+        "compatibility_flags": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "vars": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+        "kv_namespaces": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/KVNamespace"
+          }
+        },
+        "triggers": {
+          "$ref": "#/definitions/Triggers"
+        },
+        "ai": {
+          "type": "object",
+          "properties": {
+            "binding": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "binding"
+          ],
+          "additionalProperties": false
+        },
+        "browser": {
+          "type": "object",
+          "properties": {
+            "binding": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "binding"
+          ],
+          "additionalProperties": false
+        },
+        "durable_objects": {
+          "type": "object",
+          "properties": {
+            "bindings": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string"
+                  },
+                  "class_name": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "name",
+                  "class_name"
+                ],
+                "additionalProperties": false
+              }
+            }
+          },
+          "additionalProperties": false
+        },
+        "hyperdrive": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "binding": {
+                "type": "string"
+              },
+              "id": {
+                "type": "string"
+              },
+              "localConnectionString": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "binding",
+              "id",
+              "localConnectionString"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "d1_databases": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "database_name": {
+                "type": "string"
+              },
+              "database_id": {
+                "type": "string"
+              },
+              "binding": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "database_name",
+              "binding"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "queues": {
+          "type": "object",
+          "properties": {
+            "consumers": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "queue": {
+                    "type": "string"
+                  },
+                  "max_batch_timeout": {
+                    "type": "number"
+                  }
+                },
+                "required": [
+                  "queue",
+                  "max_batch_timeout"
+                ],
+                "additionalProperties": false
+              }
+            },
+            "producers": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "queue": {
+                    "type": "string"
+                  },
+                  "binding": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "queue",
+                  "binding"
+                ],
+                "additionalProperties": false
+              }
+            }
+          },
+          "additionalProperties": false
+        },
+        "workflows": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string"
+              },
+              "binding": {
+                "type": "string"
+              },
+              "class_name": {
+                "type": "string"
+              },
+              "script_name": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "name",
+              "binding"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "migrations": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/Migration"
+          }
+        },
+        "assets": {
+          "type": "object",
+          "properties": {
+            "directory": {
+              "type": "string"
+            },
+            "binding": {
+              "type": "string"
+            },
+            "jwt": {
+              "type": "string"
+            },
+            "not_found_handling": {
+              "type": "string",
+              "enum": [
+                "none",
+                "404-page",
+                "single-page-application"
+              ]
+            },
+            "run_worker_first": {
+              "type": "boolean"
+            }
+          },
+          "additionalProperties": false
+        },
+        "keep_assets": {
+          "type": "boolean"
+        },
+        "deco": {
+          "type": "object",
+          "properties": {
+            "enable_workflows": {
+              "type": "boolean"
+            },
+            "workspace": {
+              "type": "string"
+            },
+            "local": {
+              "type": "boolean"
+            },
+            "integration": {
+              "type": "object",
+              "properties": {
+                "friendlyName": {
+                  "type": "string"
+                },
+                "icon": {
+                  "type": "string"
+                },
+                "description": {
+                  "type": "string"
+                }
+              },
+              "additionalProperties": false
+            },
+            "bindings": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/Binding"
+              }
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "additionalProperties": false
+    },
+    "Route": {
+      "type": "object",
+      "properties": {
+        "pattern": {
+          "type": "string"
+        },
+        "custom_domain": {
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "pattern"
+      ],
+      "additionalProperties": false
+    },
+    "KVNamespace": {
+      "type": "object",
+      "properties": {
+        "binding": {
+          "type": "string"
+        },
+        "id": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "binding",
+        "id"
+      ],
+      "additionalProperties": false
+    },
+    "Triggers": {
+      "type": "object",
+      "properties": {
+        "crons": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      },
+      "required": [
+        "crons"
+      ],
+      "additionalProperties": false
+    },
+    "Migration": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/NewClassMigration"
+        },
+        {
+          "$ref": "#/definitions/DeletedClassMigration"
+        },
+        {
+          "$ref": "#/definitions/RenamedClassMigration"
+        }
+      ]
+    },
+    "NewClassMigration": {
+      "type": "object",
+      "properties": {
+        "tag": {
+          "type": "string"
+        },
+        "new_classes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "new_sqlite_classes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      },
+      "additionalProperties": false,
+      "required": [
+        "tag"
+      ]
+    },
+    "DeletedClassMigration": {
+      "type": "object",
+      "properties": {
+        "tag": {
+          "type": "string"
+        },
+        "deleted_classes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      },
+      "required": [
+        "deleted_classes",
+        "tag"
+      ],
+      "additionalProperties": false
+    },
+    "RenamedClassMigration": {
+      "type": "object",
+      "properties": {
+        "tag": {
+          "type": "string"
+        },
+        "renamed_classes": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "from": {
+                "type": "string"
+              },
+              "to": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "from",
+              "to"
+            ],
+            "additionalProperties": false
+          }
+        }
+      },
+      "required": [
+        "renamed_classes",
+        "tag"
+      ],
+      "additionalProperties": false
+    },
+    "Binding": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/MCPBinding"
+        },
+        {
+          "$ref": "#/definitions/ContractBinding"
+        }
+      ]
+    },
+    "MCPBinding": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/MCPConnectionBinding"
+        },
+        {
+          "$ref": "#/definitions/MCPAppBinding"
+        }
+      ]
+    },
+    "MCPConnectionBinding": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "type": {
+          "type": "string",
+          "const": "mcp"
+        },
+        "connection_id": {
+          "type": "string",
+          "description": "If not provided, will return a function that takes the integration id and return the binding implementation.."
+        }
+      },
+      "required": [
+        "connection_id",
+        "name",
+        "type"
+      ],
+      "additionalProperties": false
+    },
+    "MCPAppBinding": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "type": {
+          "type": "string",
+          "const": "mcp"
+        },
+        "app_name": {
+          "type": "string",
+          "description": "The name of the integration to bind."
+        }
+      },
+      "required": [
+        "app_name",
+        "name",
+        "type"
+      ],
+      "additionalProperties": false
+    },
+    "ContractBinding": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "type": {
+          "type": "string",
+          "const": "contract"
+        },
+        "contract": {
+          "$ref": "#/definitions/Contract",
+          "description": "The clauses of this contract"
+        }
+      },
+      "required": [
+        "contract",
+        "name",
+        "type"
+      ],
+      "additionalProperties": false
+    },
+    "Contract": {
+      "type": "object",
+      "properties": {
+        "body": {
+          "type": "string"
+        },
+        "clauses": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ContractClause"
+          }
+        }
+      },
+      "required": [
+        "body",
+        "clauses"
+      ],
+      "additionalProperties": false
+    },
+    "ContractClause": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "price": {
+          "type": [
+            "string",
+            "number"
+          ]
+        },
+        "description": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "id",
+        "price"
+      ],
+      "additionalProperties": false
+    }
+  },
+  "allowTrailingCommas": true
+}

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@decocms/runtime",
-  "version": "1.0.0-alpha.14",
+  "version": "1.0.0-alpha.17",
   "type": "module",
   "dependencies": {
     "@cloudflare/workers-types": "^4.20250617.0",
     "@deco/mcp": "npm:@jsr/deco__mcp@0.5.5",
-    "@decocms/bindings": "1.0.1-alpha.11",
+    "@decocms/bindings": "1.0.1-alpha.12",
     "@modelcontextprotocol/sdk": "1.20.2",
     "@ai-sdk/provider": "^2.0.0",
     "hono": "^4.10.7",

package/src/cors.ts

@@ -0,0 +1,140 @@
+export type CORSOrigin =
+  | string
+  | string[]
+  | ((origin: string, req: Request) => string | null | undefined);
+
+export interface CORSOptions {
+  /**
+   * The value of "Access-Control-Allow-Origin" CORS header.
+   * Can be a string, array of strings, or a function that returns the allowed origin.
+   * @default '*'
+   */
+  origin?: CORSOrigin;
+  /**
+   * The value of "Access-Control-Allow-Methods" CORS header.
+   * @default ['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH']
+   */
+  allowMethods?: string[];
+  /**
+   * The value of "Access-Control-Allow-Headers" CORS header.
+   * @default []
+   */
+  allowHeaders?: string[];
+  /**
+   * The value of "Access-Control-Max-Age" CORS header (in seconds).
+   */
+  maxAge?: number;
+  /**
+   * The value of "Access-Control-Allow-Credentials" CORS header.
+   */
+  credentials?: boolean;
+  /**
+   * The value of "Access-Control-Expose-Headers" CORS header.
+   * @default []
+   */
+  exposeHeaders?: string[];
+}
+
+const DEFAULT_ALLOW_METHODS = ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH"];
+
+const resolveOrigin = (
+  origin: CORSOrigin | undefined,
+  requestOrigin: string | null,
+  req: Request,
+): string | null => {
+  if (!requestOrigin) return null;
+
+  if (origin === undefined || origin === "*") {
+    return "*";
+  }
+
+  if (typeof origin === "string") {
+    return origin === requestOrigin ? origin : null;
+  }
+
+  if (Array.isArray(origin)) {
+    return origin.includes(requestOrigin) ? requestOrigin : null;
+  }
+
+  if (typeof origin === "function") {
+    return origin(requestOrigin, req) ?? null;
+  }
+
+  return null;
+};
+
+const setCORSHeaders = (
+  headers: Headers,
+  req: Request,
+  options: CORSOptions,
+): void => {
+  const requestOrigin = req.headers.get("Origin");
+  const allowedOrigin = resolveOrigin(options.origin, requestOrigin, req);
+
+  if (allowedOrigin) {
+    headers.set("Access-Control-Allow-Origin", allowedOrigin);
+  }
+
+  if (options.credentials) {
+    headers.set("Access-Control-Allow-Credentials", "true");
+  }
+
+  if (options.exposeHeaders?.length) {
+    headers.set(
+      "Access-Control-Expose-Headers",
+      options.exposeHeaders.join(", "),
+    );
+  }
+};
+
+export const handlePreflight = (
+  req: Request,
+  options: CORSOptions,
+): Response => {
+  const headers = new Headers();
+  const requestOrigin = req.headers.get("Origin");
+  const allowedOrigin = resolveOrigin(options.origin, requestOrigin, req);
+
+  if (allowedOrigin) {
+    headers.set("Access-Control-Allow-Origin", allowedOrigin);
+  }
+
+  if (options.credentials) {
+    headers.set("Access-Control-Allow-Credentials", "true");
+  }
+
+  const allowMethods = options.allowMethods ?? DEFAULT_ALLOW_METHODS;
+  headers.set("Access-Control-Allow-Methods", allowMethods.join(", "));
+
+  const requestHeaders = req.headers.get("Access-Control-Request-Headers");
+  if (options.allowHeaders?.length) {
+    headers.set(
+      "Access-Control-Allow-Headers",
+      options.allowHeaders.join(", "),
+    );
+  } else if (requestHeaders) {
+    // Mirror the requested headers if no explicit allowHeaders configured
+    headers.set("Access-Control-Allow-Headers", requestHeaders);
+  }
+
+  if (options.maxAge !== undefined) {
+    headers.set("Access-Control-Max-Age", options.maxAge.toString());
+  }
+
+  return new Response(null, { status: 204, headers });
+};
+
+export const withCORS = (
+  response: Response,
+  req: Request,
+  options: CORSOptions,
+): Response => {
+  const newHeaders = new Headers(response.headers);
+  setCORSHeaders(newHeaders, req, options);
+
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: newHeaders,
+  });
+};

package/src/index.ts

@@ -10,12 +10,14 @@ import {
   MCPServer,
 } from "./tools.ts";
 import type { Binding, ContractBinding, MCPBinding } from "./wrangler.ts";
+import { type CORSOptions, handlePreflight, withCORS } from "./cors.ts";
 export { proxyConnectionForId } from "./bindings.ts";
 export {
   createMCPFetchStub,
   type CreateStubAPIOptions,
   type ToolBinder,
 } from "./mcp.ts";
+export { type CORSOptions, type CORSOrigin } from "./cors.ts";
 
 export interface DefaultEnv<TSchema extends z.ZodTypeAny = any> {
   MESH_REQUEST_CONTEXT: RequestContext<TSchema>;
@@ -56,6 +58,11 @@ export interface UserDefaultExport<
     env: TEnv,
     ctx: ExecutionContext,
   ) => Promise<Response> | Response;
+  /**
+   * CORS configuration options.
+   * Set to `false` to disable CORS handling entirely.
+   */
+  cors?: CORSOptions | false;
 }
 
 // 1. Map binding type to its interface
@@ -155,11 +162,13 @@ export const withBindings = <TEnv>({
   server,
   tokenOrContext,
   url,
+  bindings: inlineBindings,
 }: {
   env: TEnv;
   server: MCPServer<TEnv, any>;
   tokenOrContext?: string | RequestContext;
   url?: string;
+  bindings?: Binding[];
 }): TEnv => {
   const env = _env as DefaultEnv<any>;
 
@@ -209,7 +218,7 @@ export const withBindings = <TEnv>({
   }
 
   env.MESH_REQUEST_CONTEXT = context;
-  const bindings = MCPBindings.parse(env.MESH_BINDINGS);
+  const bindings = inlineBindings ?? MCPBindings.parse(env.MESH_BINDINGS);
 
   for (const binding of bindings) {
     env[binding.name] = creatorByType[binding.type](binding as any, env);
@@ -228,6 +237,8 @@ export const withRuntime = <TEnv, TSchema extends z.ZodTypeAny = never>(
   userFns: UserDefaultExport<TEnv, TSchema>,
 ): ExportedHandler<TEnv & DefaultEnv<TSchema>> => {
   const server = createMCPServer<TEnv, TSchema>(userFns);
+  const corsOptions = userFns.cors;
+
   const fetcher = async (
     req: Request,
     env: TEnv & DefaultEnv<TSchema>,
@@ -265,22 +276,39 @@ export const withRuntime = <TEnv, TSchema extends z.ZodTypeAny = never>(
       new Response("Not found", { status: 404 })
     );
   };
+
   return {
     fetch: async (
       req: Request,
       env: TEnv & DefaultEnv<TSchema>,
       ctx: ExecutionContext,
     ) => {
+      // Handle CORS preflight (OPTIONS) requests
+      if (corsOptions !== false && req.method === "OPTIONS") {
+        const options = corsOptions ?? {};
+        return handlePreflight(req, options);
+      }
+
       const bindings = withBindings({
         env,
         server,
+        bindings: userFns.bindings,
         tokenOrContext: req.headers.get("x-mesh-token") ?? undefined,
         url: req.url,
       });
-      return await State.run(
+
+      const response = await State.run(
         { req, env: bindings, ctx },
         async () => await fetcher(req, bindings, ctx),
       );
+
+      // Add CORS headers to response
+      if (corsOptions !== false) {
+        const options = corsOptions ?? {};
+        return withCORS(response, req, options);
+      }
+
+      return response;
     },
   };
 };

package/src/tools.ts

@@ -6,6 +6,7 @@ import { z } from "zod";
 import { zodToJsonSchema } from "zod-to-json-schema";
 import type { DefaultEnv } from "./index.ts";
 import { State } from "./state.ts";
+import { Binding } from "./wrangler.ts";
 
 export const createRuntimeContext = (prev?: AppContext) => {
   const store = State.getStore();
@@ -153,6 +154,7 @@ export interface CreateMCPServerOptions<
     state?: TSchema;
     scopes?: string[];
   };
+  bindings?: Binding[];
   tools?:
     | Array<
         (