@mandujs/core 0.54.24 → 0.54.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mandujs/core",
-  "version": "0.54.24",
+  "version": "0.54.25",
   "description": "Mandu Framework Core - Spec, Generator, Guard, Runtime",
   "type": "module",
   "main": "./src/index.ts",

package/src/filling/filling.ts

@@ -606,6 +606,20 @@ export class ManduFilling<TLoaderData = unknown> {
       if (this.config.handlers.has("GET") && !allowed.includes("HEAD")) {
         allowed.push("HEAD");
       }
+      // RFC 7231 §4.3.7: auto-respond to a plain OPTIONS request (no explicit
+      // OPTIONS handler) with 204 + an `Allow` header. CORS preflights — which
+      // carry `Access-Control-Request-Method` — are left to the normal flow so
+      // CORS middleware can attach its Access-Control-* headers.
+      if (
+        method === "OPTIONS" &&
+        !normalizedRequest.headers.get("access-control-request-method")
+      ) {
+        const optionsAllowed = allowed.includes("OPTIONS") ? allowed : [...allowed, "OPTIONS"];
+        return new Response(null, {
+          status: 204,
+          headers: { Allow: optionsAllowed.join(", ") },
+        });
+      }
       // RFC 7231 §6.5.5: a 405 response MUST include an `Allow` header listing
       // every supported method (not just the body field). ctx.json() cannot
       // attach headers, so build the response directly here.

package/src/filling/head-method.test.ts

@@ -104,4 +104,51 @@ describe("Filling HEAD handling (#319)", () => {
     // HEAD is implied by GET.
     expect(methods).toContain("HEAD");
   });
+
+  // RFC 7231 §4.3.7: a plain OPTIONS request (no explicit OPTIONS handler)
+  // should return 204 with an Allow header, not 405.
+  it("auto-responds to a plain OPTIONS request with 204 + Allow", async () => {
+    const filling = ManduFillingFactory.filling()
+      .get((ctx) => ctx.json({ ok: true }))
+      .post((ctx) => ctx.json({ ok: true }));
+
+    const res = await filling.handle(
+      new Request("http://localhost/api/pledges", { method: "OPTIONS" }),
+    );
+
+    expect(res.status).toBe(204);
+    const methods = (res.headers.get("Allow") ?? "").split(", ");
+    expect(methods).toContain("GET");
+    expect(methods).toContain("POST");
+    expect(methods).toContain("HEAD");
+    expect(methods).toContain("OPTIONS");
+  });
+
+  it("defers CORS preflight OPTIONS (Access-Control-Request-Method) instead of auto-answering", async () => {
+    const filling = ManduFillingFactory.filling().get((ctx) => ctx.json({ ok: true }));
+
+    const res = await filling.handle(
+      new Request("http://localhost/api/pledges", {
+        method: "OPTIONS",
+        headers: { "Access-Control-Request-Method": "GET", Origin: "https://x" },
+      }),
+    );
+
+    // No CORS middleware registered → falls through to 405 (not the 204
+    // auto-OPTIONS path), leaving preflight handling to CORS middleware.
+    expect(res.status).toBe(405);
+  });
+
+  it("an explicit OPTIONS handler still takes precedence", async () => {
+    const filling = ManduFillingFactory.filling()
+      .get((ctx) => ctx.json({ ok: true }))
+      .options((ctx) => ctx.json({ custom: true }));
+
+    const res = await filling.handle(
+      new Request("http://localhost/api/pledges", { method: "OPTIONS" }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ custom: true });
+  });
 });

package/src/runtime/handlers.ts

@@ -76,6 +76,16 @@ function createMethodDispatcher(module: RouteModule, routeId: string) {
       if (typeof module.GET === "function" && !allow.includes("HEAD")) {
         allow.push("HEAD");
       }
+      // RFC 7231 §4.3.7: auto-respond to a plain OPTIONS request (no explicit
+      // OPTIONS export) with 204 + an `Allow` header. CORS preflights (which
+      // carry `Access-Control-Request-Method`) are left to the normal flow.
+      if (method === "OPTIONS" && !req.headers.get("access-control-request-method")) {
+        const optionsAllow = allow.includes("OPTIONS") ? allow : [...allow, "OPTIONS"];
+        return new Response(null, {
+          status: 204,
+          headers: { Allow: optionsAllow.join(", ") },
+        });
+      }
       return Response.json(
         {
           error: `Method ${method} not allowed for route ${routeId}`,