@tatara/http 0.1.2 → 0.1.4

package/dist/index.d.mts

@@ -64,8 +64,11 @@ type Defaults<E extends HttpEnv> = Partial<Omit<E["Variables"], "requestId" | "l
 export declare function requestContext<E extends HttpEnv>(logger: CoreLogger, defaults?: Defaults<E>): MiddlewareHandler<E, string, {}, Response>;
 interface CreateAppOptions<E extends HttpEnv> {
   logger: CoreLogger;
-  /** origins are exact (`https://app.example.com`) or one-label patterns (`https://*.example.com`) */
-  cors: {
+  /**
+   * Deprecated: call Hono's `cors()` in the app instead (with `corsOrigin` for the origin check),
+   * so its headers and origins are the app's. Kept so existing apps keep working.
+   */
+  cors?: {
     origins: string[];
     exposeHeaders?: string[];
     allowHeaders?: string[];
@@ -78,7 +81,7 @@ interface CreateAppOptions<E extends HttpEnv> {
 }
 /** Matches exact origins and `*.`-patterns, where `*` is exactly one DNS label (tenant subdomains). */
 export declare function corsOrigin(origins: string[]): (origin: string) => string | null;
-/** A plain OpenAPIHono app with request context, secure headers, CORS, body limit, /health and /ready. */
+/** A plain OpenAPIHono app with request context, secure headers, body limit, /health and /ready. CORS is the app's: Hono's `cors()`. */
 export declare function createApp<E extends HttpEnv>(options: CreateAppOptions<E>): OpenAPIHono<E>;
 interface RouteDefinition<A extends string = string, E extends HttpEnv = HttpEnv> {
   /** which HTTP app serves these routes */

package/dist/index.mjs

@@ -145,12 +145,12 @@ function corsOrigin(origins) {
 	});
 	return (origin) => exact.has(origin) || patterns.some((p) => p.test(origin)) ? origin : null;
 }
-/** A plain OpenAPIHono app with request context, secure headers, CORS, body limit, /health and /ready. */
+/** A plain OpenAPIHono app with request context, secure headers, body limit, /health and /ready. CORS is the app's: Hono's `cors()`. */
 function createApp(options) {
 	const app = new OpenAPIHono({ defaultHook: validationHook });
 	app.use(requestContext(options.logger, options.defaults));
 	app.use(secureHeaders());
-	app.use(cors({
+	if (options.cors) app.use(cors({
 		origin: corsOrigin(options.cors.origins),
 		credentials: true,
 		allowHeaders: options.cors.allowHeaders ?? [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tatara/http",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "tatara HTTP: Hono app setup, errors, envelope, OpenAPI docs and route mounting",
   "type": "module",
   "license": "MIT",
@@ -31,7 +31,7 @@
     "@hono/zod-openapi": "^1.6.3",
     "@hono/node-server": "^2.1.5",
     "@scalar/hono-api-reference": "^0.12.12",
-    "@tatara/core": "^0.1.2",
+    "@tatara/core": "^0.1.3",
     "pino": "^10.4.0",
     "zod": "^4.6.7"
   },

package/src/app.ts

@@ -43,8 +43,11 @@ export function requestContext<E extends HttpEnv>(logger: CoreLogger, defaults:
 
 export interface CreateAppOptions<E extends HttpEnv> {
 	logger: CoreLogger;
-	/** origins are exact (`https://app.example.com`) or one-label patterns (`https://*.example.com`) */
-	cors: { origins: string[]; exposeHeaders?: string[]; allowHeaders?: string[] };
+	/**
+	 * Deprecated: call Hono's `cors()` in the app instead (with `corsOrigin` for the origin check),
+	 * so its headers and origins are the app's. Kept so existing apps keep working.
+	 */
+	cors?: { origins: string[]; exposeHeaders?: string[]; allowHeaders?: string[] };
 	bodyLimitBytes: number;
 	/** a limit on how long a handler may take, with longer ones for slow paths */
 	timeouts?: TimeoutOptions;
@@ -66,24 +69,25 @@ export function corsOrigin(origins: string[]): (origin: string) => string | null
 	return (origin) => (exact.has(origin) || patterns.some((p) => p.test(origin)) ? origin : null);
 }
 
-/** A plain OpenAPIHono app with request context, secure headers, CORS, body limit, /health and /ready. */
+/** A plain OpenAPIHono app with request context, secure headers, body limit, /health and /ready. CORS is the app's: Hono's `cors()`. */
 export function createApp<E extends HttpEnv>(options: CreateAppOptions<E>): OpenAPIHono<E> {
 	const app = new OpenAPIHono<E>({ defaultHook: validationHook });
 	app.use(requestContext<E>(options.logger, options.defaults) as MiddlewareHandler<E>);
 	app.use(secureHeaders());
-	app.use(
-		cors({
-			origin: corsOrigin(options.cors.origins),
-			credentials: true,
-			allowHeaders: options.cors.allowHeaders ?? [
-				"Content-Type",
-				"Authorization",
-				"X-Request-Id",
-				"Accept-Language",
-			],
-			exposeHeaders: options.cors.exposeHeaders ?? ["X-Request-Id"],
-		}),
-	);
+	if (options.cors)
+		app.use(
+			cors({
+				origin: corsOrigin(options.cors.origins),
+				credentials: true,
+				allowHeaders: options.cors.allowHeaders ?? [
+					"Content-Type",
+					"Authorization",
+					"X-Request-Id",
+					"Accept-Language",
+				],
+				exposeHeaders: options.cors.exposeHeaders ?? ["X-Request-Id"],
+			}),
+		);
 	app.use(bodyLimit({ maxSize: options.bodyLimitBytes }));
 	if (options.timeouts) app.use(requestTimeout(options.timeouts));
 	app.get("/health", (c) => c.json({ status: "ok" }));