@portel/photon 1.34.1 → 1.35.0

package/dist/auto-ui/streamable-http-transport.js

@@ -23,7 +23,7 @@ import { join, dirname, extname, resolve, normalize } from 'path';
 import { homedir } from 'os';
 import { PHOTON_VERSION } from '../version.js';
 import { formatToolError } from '../shared/error-handler.js';
-import { SimpleRateLimiter } from '../shared/security.js';
+import { SimpleRateLimiter, getCorsOrigin } from '../shared/security.js';
 // Default rate limit: 600 requests/min per source IP. Beam app UI opens several
 // MCP sessions and can legitimately burst while navigating between photons.
 // Override via
@@ -114,7 +114,7 @@ function paginateMCPList(items, cursor, pageSize = MCP_LIST_PAGE_SIZE) {
 function invalidCursorResponse(id, error) {
     return {
         jsonrpc: '2.0',
-        id: id,
+        ...(typeof id === 'string' || typeof id === 'number' ? { id } : {}),
         error: { code: -32602, message: error.message },
     };
 }
@@ -4383,7 +4383,9 @@ export async function handleStreamableHTTP(req, res, options) {
         return false;
     }
     // CORS headers
-    res.setHeader('Access-Control-Allow-Origin', '*');
+    const corsOrigin = getCorsOrigin(req);
+    if (corsOrigin)
+        res.setHeader('Access-Control-Allow-Origin', corsOrigin);
     res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
     res.setHeader('Access-Control-Allow-Headers', [
         'Content-Type',