bxo 0.0.5-dev.47 → 0.0.5-dev.49

package/index.ts

@@ -9,15 +9,14 @@ type StatusResponseSchema = Record<number, ResponseSchema>;
 type ResponseConfig = ResponseSchema | StatusResponseSchema;
 
 // Type utility to extract response type from response config
-type InferResponseType<T> = T extends ResponseSchema 
+type InferResponseType<T> = T extends ResponseSchema
   ? InferZodType<T>
-  : T extends StatusResponseSchema 
-    ? { [K in keyof T]: InferZodType<T[K]> }[keyof T]
-    : never;
+  : T extends StatusResponseSchema
+  ? { [K in keyof T]: InferZodType<T[K]> }[keyof T]
+  : never;
 
-// Cookie interface
-interface Cookie {
-  name: string;
+// Cookie options interface for setting cookies
+interface CookieOptions {
   value: string;
   domain?: string;
   path?: string;
@@ -64,34 +63,47 @@ export type Context<TConfig extends RouteConfig = {}> = {
   path: string;
   request: Request;
   set: {
-    status?: number;
-    headers?: Record<string, string>;
-    cookies?: Cookie[];
+    status: number;
+    headers: Record<string, string>;
+    cookies: (name: string, options: CookieOptions) => void;
     redirect?: { location: string; status?: number };
   };
   status: <T extends number>(
-    code: TConfig['response'] extends StatusResponseSchema 
+    code: TConfig['response'] extends StatusResponseSchema
       ? StatusCodes<TConfig['response']> | number
       : T,
-    data?: TConfig['response'] extends StatusResponseSchema 
-      ? T extends keyof TConfig['response'] 
-        ? InferZodType<TConfig['response'][T]>
-        : any
-      : TConfig['response'] extends ResponseSchema 
-        ? InferZodType<TConfig['response']>
-        : any
-  ) => TConfig['response'] extends StatusResponseSchema 
-    ? T extends keyof TConfig['response'] 
+    data?: TConfig['response'] extends StatusResponseSchema
+      ? T extends keyof TConfig['response']
       ? InferZodType<TConfig['response'][T]>
       : any
-    : TConfig['response'] extends ResponseSchema 
+      : TConfig['response'] extends ResponseSchema
       ? InferZodType<TConfig['response']>
-      : any;
+      : any
+  ) => TConfig['response'] extends StatusResponseSchema
+    ? T extends keyof TConfig['response']
+    ? InferZodType<TConfig['response'][T]>
+    : any
+    : TConfig['response'] extends ResponseSchema
+    ? InferZodType<TConfig['response']>
+    : any;
   redirect: (location: string, status?: number) => Response;
   clearRedirect: () => void;
   [key: string]: any;
 };
 
+// Internal cookie storage interface
+interface InternalCookie {
+  name: string;
+  value: string;
+  domain?: string;
+  path?: string;
+  expires?: Date;
+  maxAge?: number;
+  secure?: boolean;
+  httpOnly?: boolean;
+  sameSite?: 'Strict' | 'Lax' | 'None';
+}
+
 // Handler function type with proper response typing
 type Handler<TConfig extends RouteConfig = {}, EC = {}> = (ctx: Context<TConfig> & EC) => Promise<InferResponseType<TConfig['response']> | any> | InferResponseType<TConfig['response']> | any;
 
@@ -346,10 +358,10 @@ export default class BXO {
 
       // Check for double wildcard (**) in the route
       const hasDoubleWildcard = routeSegments.some(segment => segment === '**');
-      
+
       // Handle double wildcard at the end (catch-all with slashes)
       const hasDoubleWildcardAtEnd = routeSegments.length > 0 && routeSegments[routeSegments.length - 1] === '**';
-      
+
       // Handle single wildcard at the end (catch-all)
       const hasWildcardAtEnd = routeSegments.length > 0 && routeSegments[routeSegments.length - 1] === '*';
 
@@ -392,31 +404,31 @@ export default class BXO {
         if (routeSegment === '**') {
           // Find the next non-wildcard segment to match against
           let nextNonWildcardIndex = i + 1;
-          while (nextNonWildcardIndex < routeSegments.length && 
-                 (routeSegments[nextNonWildcardIndex] === '*' || routeSegments[nextNonWildcardIndex] === '**')) {
+          while (nextNonWildcardIndex < routeSegments.length &&
+            (routeSegments[nextNonWildcardIndex] === '*' || routeSegments[nextNonWildcardIndex] === '**')) {
             nextNonWildcardIndex++;
           }
-          
+
           if (nextNonWildcardIndex >= routeSegments.length) {
             // Double wildcard is at the end or followed by other wildcards
             const remainingPath = pathSegments.slice(i).join('/');
             params['**'] = remainingPath;
             break;
           }
-          
+
           // Find the next matching segment in the path
           const nextRouteSegment = routeSegments[nextNonWildcardIndex];
           if (!nextRouteSegment) {
             isMatch = false;
             break;
           }
-          
+
           let foundMatch = false;
           let matchedPath = '';
-          
+
           for (let j = i; j < pathSegments.length; j++) {
             const currentPathSegment = pathSegments[j];
-            
+
             // Check if this path segment matches the next route segment
             if (nextRouteSegment.startsWith(':')) {
               // Param segment - always matches
@@ -441,12 +453,12 @@ export default class BXO {
               break;
             }
           }
-          
+
           if (!foundMatch) {
             isMatch = false;
             break;
           }
-          
+
           continue;
         }
 
@@ -488,10 +500,10 @@ export default class BXO {
 
       // Check for double wildcard (**) in the route
       const hasDoubleWildcard = routeSegments.some(segment => segment === '**');
-      
+
       // Handle double wildcard at the end (catch-all with slashes)
       const hasDoubleWildcardAtEnd = routeSegments.length > 0 && routeSegments[routeSegments.length - 1] === '**';
-      
+
       // Handle single wildcard at the end (catch-all)
       const hasWildcardAtEnd = routeSegments.length > 0 && routeSegments[routeSegments.length - 1] === '*';
 
@@ -534,31 +546,31 @@ export default class BXO {
         if (routeSegment === '**') {
           // Find the next non-wildcard segment to match against
           let nextNonWildcardIndex = i + 1;
-          while (nextNonWildcardIndex < routeSegments.length && 
-                 (routeSegments[nextNonWildcardIndex] === '*' || routeSegments[nextNonWildcardIndex] === '**')) {
+          while (nextNonWildcardIndex < routeSegments.length &&
+            (routeSegments[nextNonWildcardIndex] === '*' || routeSegments[nextNonWildcardIndex] === '**')) {
             nextNonWildcardIndex++;
           }
-          
+
           if (nextNonWildcardIndex >= routeSegments.length) {
             // Double wildcard is at the end or followed by other wildcards
             const remainingPath = pathSegments.slice(i).join('/');
             params['**'] = remainingPath;
             break;
           }
-          
+
           // Find the next matching segment in the path
           const nextRouteSegment = routeSegments[nextNonWildcardIndex];
           if (!nextRouteSegment) {
             isMatch = false;
             break;
           }
-          
+
           let foundMatch = false;
           let matchedPath = '';
-          
+
           for (let j = i; j < pathSegments.length; j++) {
             const currentPathSegment = pathSegments[j];
-            
+
             // Check if this path segment matches the next route segment
             if (nextRouteSegment.startsWith(':')) {
               // Param segment - always matches
@@ -583,12 +595,12 @@ export default class BXO {
               break;
             }
           }
-          
+
           if (!foundMatch) {
             isMatch = false;
             break;
           }
-          
+
           continue;
         }
 
@@ -638,9 +650,9 @@ export default class BXO {
   // Parse cookies from Cookie header
   private parseCookies(cookieHeader: string | null): Record<string, string> {
     const cookies: Record<string, string> = {};
-    
+
     if (!cookieHeader) return cookies;
-    
+
     const cookiePairs = cookieHeader.split(';');
     for (const pair of cookiePairs) {
       const [name, value] = pair.trim().split('=');
@@ -648,7 +660,7 @@ export default class BXO {
         cookies[decodeURIComponent(name)] = decodeURIComponent(value);
       }
     }
-    
+
     return cookies;
   }
 
@@ -661,19 +673,19 @@ export default class BXO {
   // Validate response against response config (supports both simple and status-based schemas)
   private validateResponse(responseConfig: ResponseConfig | undefined, data: any, status: number = 200): any {
     if (!responseConfig || !this.enableValidation) return data;
-    
+
     // If it's a simple schema (not status-based)
     if ('parse' in responseConfig && typeof responseConfig.parse === 'function') {
       return responseConfig.parse(data);
     }
-    
+
     // If it's a status-based schema
     if (typeof responseConfig === 'object' && !('parse' in responseConfig)) {
       const statusSchema = responseConfig[status];
       if (statusSchema) {
         return statusSchema.parse(data);
       }
-      
+
       // If no specific status schema found, try to find a fallback
       // Common fallback statuses: 200, 201, 400, 500
       const fallbackStatuses = [200, 201, 400, 500];
@@ -682,11 +694,11 @@ export default class BXO {
           return responseConfig[fallbackStatus]?.parse(data);
         }
       }
-      
+
       // If no schema found for the status, return data as-is
       return data;
     }
-    
+
     return data;
   }
 
@@ -732,7 +744,17 @@ export default class BXO {
         cookies: {},
         path: pathname,
         request,
-        set: {},
+        set: {
+          status: 200,
+          headers: {},
+          cookies: (name: string, options?: CookieOptions) => {
+            // This is a placeholder for setting cookies.
+            // In a real Bun.serve context, you'd use Bun.serve's cookie handling.
+            // For now, we'll just log it or throw an error if not Bun.serve.
+            console.warn(`Setting cookie '${name}' via ctx.set.cookies is not directly supported by Bun.serve. Use Bun.serve's cookie handling.`);
+          },
+          redirect: undefined
+        },
         status: ((code: number, data?: any) => {
           ctx.set.status = code;
           return data;
@@ -758,7 +780,7 @@ export default class BXO {
             }
           }
           if (typeof ctx.set.status === 'number' && ctx.set.status >= 300 && ctx.set.status < 400) {
-            delete ctx.set.status;
+            ctx.set.status = 200;
           }
         }) as any
       };
@@ -837,6 +859,9 @@ export default class BXO {
       }
     }
 
+    // Create internal cookie storage
+    const internalCookies: InternalCookie[] = [];
+
     // Create context with validation
     let ctx: Context;
     try {
@@ -846,7 +871,7 @@ export default class BXO {
       const validatedBody = this.enableValidation && route.config?.body ? this.validateData(route.config.body, body) : body;
       const validatedHeaders = this.enableValidation && route.config?.headers ? this.validateData(route.config.headers, headers) : headers;
       const validatedCookies = this.enableValidation && route.config?.cookies ? this.validateData(route.config.cookies, cookies) : cookies;
-      
+
       ctx = {
         params: validatedParams,
         query: validatedQuery,
@@ -855,44 +880,66 @@ export default class BXO {
         cookies: validatedCookies,
         path: pathname,
         request,
-        set: {},
+        set: {
+          status: 200,
+          headers: {},
+          cookies: (name: string, options: CookieOptions) => {
+            internalCookies.push({
+              name,
+              value: options.value,
+              domain: options.domain,
+              path: options.path,
+              expires: options.expires,
+              maxAge: options.maxAge,
+              secure: options.secure,
+              httpOnly: options.httpOnly,
+              sameSite: options.sameSite
+            });
+          }
+        },
         status: ((code: number, data?: any) => {
           ctx.set.status = code;
           return data;
         }) as any,
-                 redirect: ((location: string, status: number = 302) => {
-           // Record redirect intent only; avoid mutating generic status/headers so it can be canceled later
-           ctx.set.redirect = { location, status };
-
-           // Prepare headers for immediate Response return without persisting to ctx.set.headers
-           const responseHeaders: Record<string, string> = {
-             Location: location,
-             ...(ctx.set.headers || {})
-           };
-
-           // Handle cookies if any are set on context
-           if (ctx.set.cookies && ctx.set.cookies.length > 0) {
-             const cookieHeaders = ctx.set.cookies.map(cookie => {
-               let cookieString = `${encodeURIComponent(cookie.name)}=${encodeURIComponent(cookie.value)}`;
-               if (cookie.domain) cookieString += `; Domain=${cookie.domain}`;
-               if (cookie.path) cookieString += `; Path=${cookie.path}`;
-               if (cookie.expires) cookieString += `; Expires=${cookie.expires.toUTCString()}`;
-               if (cookie.maxAge) cookieString += `; Max-Age=${cookie.maxAge}`;
-               if (cookie.secure) cookieString += `; Secure`;
-               if (cookie.httpOnly) cookieString += `; HttpOnly`;
-               if (cookie.sameSite) cookieString += `; SameSite=${cookie.sameSite}`;
-               return cookieString;
-             });
-             cookieHeaders.forEach((cookieHeader, index) => {
-               responseHeaders[index === 0 ? 'Set-Cookie' : `Set-Cookie-${index}`] = cookieHeader;
-             });
-           }
-
-           return new Response(null, {
-             status,
-             headers: responseHeaders
-           });
-         }) as any,
+        redirect: ((location: string, status: number = 302) => {
+          // Record redirect intent only; avoid mutating generic status/headers so it can be canceled later
+          ctx.set.redirect = { location, status };
+
+          // Prepare headers for immediate Response return without persisting to ctx.set.headers
+          const responseHeaders = new Headers();
+          responseHeaders.set('Location', location);
+
+          // Add any additional headers from ctx.set.headers
+          if (ctx.set.headers) {
+            Object.entries(ctx.set.headers).forEach(([key, value]) => {
+              responseHeaders.set(key, value);
+            });
+          }
+
+          // Handle cookies if any are set on context
+          if (internalCookies.length > 0) {
+            const cookieHeaders = internalCookies.map(cookie => {
+              let cookieString = `${encodeURIComponent(cookie.name)}=${encodeURIComponent(cookie.value)}`;
+              if (cookie.domain) cookieString += `; Domain=${cookie.domain}`;
+              if (cookie.path) cookieString += `; Path=${cookie.path}`;
+              if (cookie.expires) cookieString += `; Expires=${cookie.expires.toUTCString()}`;
+              if (cookie.maxAge) cookieString += `; Max-Age=${cookie.maxAge}`;
+              if (cookie.secure) cookieString += `; Secure`;
+              if (cookie.httpOnly) cookieString += `; HttpOnly`;
+              if (cookie.sameSite) cookieString += `; SameSite=${cookie.sameSite}`;
+              return cookieString;
+            });
+            // Set multiple Set-Cookie headers properly
+            cookieHeaders.forEach(cookieHeader => {
+              responseHeaders.append('Set-Cookie', cookieHeader);
+            });
+          }
+
+          return new Response(null, {
+            status,
+            headers: responseHeaders
+          });
+        }) as any,
         clearRedirect: (() => {
           // Clear explicit redirect intent
           delete ctx.set.redirect;
@@ -906,13 +953,13 @@ export default class BXO {
           }
           // Reset status if it is a redirect
           if (typeof ctx.set.status === 'number' && ctx.set.status >= 300 && ctx.set.status < 400) {
-            delete ctx.set.status;
+            ctx.set.status = 200;
           }
         }) as any
       };
     } catch (validationError) {
       // Validation failed - return error response
-      
+
       // Extract detailed validation errors from Zod
       let validationDetails = undefined;
       if (validationError instanceof Error) {
@@ -922,13 +969,13 @@ export default class BXO {
           validationDetails = validationError.issues;
         }
       }
-      
+
       // Create a clean error message
-      const errorMessage = validationDetails && validationDetails.length > 0 
+      const errorMessage = validationDetails && validationDetails.length > 0
         ? `Validation failed for ${validationDetails.length} field(s)`
         : 'Validation failed';
-      
-      return new Response(JSON.stringify({ 
+
+      return new Response(JSON.stringify({
         error: errorMessage,
         details: validationDetails
       }), {
@@ -981,7 +1028,7 @@ export default class BXO {
 
       // If the handler did not return a response, but a redirect was configured via ctx.set,
       // automatically create a redirect Response so users can call ctx.redirect(...) or set headers without returning.
-      const hasImplicitRedirectIntent = !!ctx.set.redirect 
+      const hasImplicitRedirectIntent = !!ctx.set.redirect
         || (typeof ctx.set.status === 'number' && ctx.set.status >= 300 && ctx.set.status < 400);
       if ((response === undefined || response === null) && hasImplicitRedirectIntent) {
         const locationFromHeaders = ctx.set.headers && Object.entries(ctx.set.headers).find(([k]) => k.toLowerCase() === 'location')?.[1];
@@ -996,8 +1043,8 @@ export default class BXO {
           const status = ctx.set.redirect?.status ?? ctx.set.status ?? 302;
 
           // Handle cookies if any are set
-          if (ctx.set.cookies && ctx.set.cookies.length > 0) {
-            const cookieHeaders = ctx.set.cookies.map(cookie => {
+          if (internalCookies.length > 0) {
+            const cookieHeaders = internalCookies.map(cookie => {
               let cookieString = `${encodeURIComponent(cookie.name)}=${encodeURIComponent(cookie.value)}`;
               if (cookie.domain) cookieString += `; Domain=${cookie.domain}`;
               if (cookie.path) cookieString += `; Path=${cookie.path}`;
@@ -1008,9 +1055,20 @@ export default class BXO {
               if (cookie.sameSite) cookieString += `; SameSite=${cookie.sameSite}`;
               return cookieString;
             });
-            cookieHeaders.forEach((cookieHeader, index) => {
-              responseHeaders[index === 0 ? 'Set-Cookie' : `Set-Cookie-${index}`] = cookieHeader;
+            // Convert responseHeaders to Headers object for proper multiple Set-Cookie handling
+            const headers = new Headers();
+            Object.entries(responseHeaders).forEach(([key, value]) => {
+              headers.set(key, value);
+            });
+            cookieHeaders.forEach(cookieHeader => {
+              headers.append('Set-Cookie', cookieHeader);
+            });
+            // Convert back to plain object for Response constructor
+            const finalHeaders: Record<string, string> = {};
+            headers.forEach((value, key) => {
+              finalHeaders[key] = value;
             });
+            responseHeaders = finalHeaders;
           }
 
           return new Response(null, {
@@ -1027,7 +1085,7 @@ export default class BXO {
           response = this.validateResponse(route.config.response, response, status);
         } catch (validationError) {
           // Response validation failed
-          
+
           // Extract detailed validation errors from Zod
           let validationDetails = undefined;
           if (validationError instanceof Error) {
@@ -1037,13 +1095,13 @@ export default class BXO {
               validationDetails = validationError.issues;
             }
           }
-          
+
           // Create a clean error message
-          const errorMessage = validationDetails && validationDetails.length > 0 
+          const errorMessage = validationDetails && validationDetails.length > 0
             ? `Response validation failed for ${validationDetails.length} field(s)`
             : 'Response validation failed';
-          
-          return new Response(JSON.stringify({ 
+
+          return new Response(JSON.stringify({
             error: errorMessage,
             details: validationDetails
           }), {
@@ -1055,6 +1113,43 @@ export default class BXO {
 
       // Convert response to Response object
       if (response instanceof Response) {
+        // If there are headers set via ctx.set.headers, merge them with the Response headers
+        if (ctx.set.headers && Object.keys(ctx.set.headers).length > 0) {
+          const newHeaders = new Headers(response.headers);
+
+          // Add headers from ctx.set.headers
+          Object.entries(ctx.set.headers).forEach(([key, value]) => {
+            newHeaders.set(key, value);
+          });
+
+          // Handle cookies if any are set
+          if (internalCookies.length > 0) {
+            const cookieHeaders = internalCookies.map(cookie => {
+              let cookieString = `${encodeURIComponent(cookie.name)}=${encodeURIComponent(cookie.value)}`;
+              if (cookie.domain) cookieString += `; Domain=${cookie.domain}`;
+              if (cookie.path) cookieString += `; Path=${cookie.path}`;
+              if (cookie.expires) cookieString += `; Expires=${cookie.expires.toUTCString()}`;
+              if (cookie.maxAge) cookieString += `; Max-Age=${cookie.maxAge}`;
+              if (cookie.secure) cookieString += `; Secure`;
+              if (cookie.httpOnly) cookieString += `; HttpOnly`;
+              if (cookie.sameSite) cookieString += `; SameSite=${cookie.sameSite}`;
+              return cookieString;
+            });
+
+            // Add Set-Cookie headers
+            cookieHeaders.forEach(cookieHeader => {
+              newHeaders.append('Set-Cookie', cookieHeader);
+            });
+          }
+
+          // Create new Response with merged headers
+          return new Response(response.body, {
+            status: ctx.set.status || response.status,
+            statusText: response.statusText,
+            headers: newHeaders
+          });
+        }
+
         return response;
       }
 
@@ -1089,12 +1184,13 @@ export default class BXO {
 
       // Prepare headers with cookies
       let responseHeaders = ctx.set.headers ? { ...ctx.set.headers } : {};
-      
+
       // Handle cookies if any are set
-      if (ctx.set.cookies && ctx.set.cookies.length > 0) {
-        const cookieHeaders = ctx.set.cookies.map(cookie => {
+      console.log('Checking cookies:', internalCookies.length, internalCookies);
+      if (internalCookies.length > 0) {
+        const cookieHeaders = internalCookies.map(cookie => {
           let cookieString = `${encodeURIComponent(cookie.name)}=${encodeURIComponent(cookie.value)}`;
-          
+
           if (cookie.domain) cookieString += `; Domain=${cookie.domain}`;
           if (cookie.path) cookieString += `; Path=${cookie.path}`;
           if (cookie.expires) cookieString += `; Expires=${cookie.expires.toUTCString()}`;
@@ -1102,16 +1198,36 @@ export default class BXO {
           if (cookie.secure) cookieString += `; Secure`;
           if (cookie.httpOnly) cookieString += `; HttpOnly`;
           if (cookie.sameSite) cookieString += `; SameSite=${cookie.sameSite}`;
-          
+
           return cookieString;
         });
-        
+
         // Add Set-Cookie headers
-        cookieHeaders.forEach((cookieHeader, index) => {
-          responseHeaders[index === 0 ? 'Set-Cookie' : `Set-Cookie-${index}`] = cookieHeader;
+        // Use Headers object directly for Response constructor to handle multiple Set-Cookie headers properly
+        const headers = new Headers();
+        Object.entries(responseHeaders).forEach(([key, value]) => {
+          headers.set(key, value);
+        });
+        cookieHeaders.forEach(cookieHeader => {
+          headers.append('Set-Cookie', cookieHeader);
+        });
+
+        const responseInit: ResponseInit = {
+          status: ctx.set.status || 200,
+          headers: headers
+        };
+
+        if (typeof response === 'string') {
+          return new Response(response, responseInit);
+        }
+
+        return new Response(JSON.stringify(response), {
+          status: responseInit.status,
+          headers: headers
         });
       }
 
+      // If no cookies, use the original responseHeaders
       const responseInit: ResponseInit = {
         status: ctx.set.status || 200,
         headers: responseHeaders
@@ -1262,7 +1378,7 @@ export default class BXO {
         } catch (stopError) {
           console.error('❌ Error calling server.stop():', stopError);
         }
-        
+
         // Clear the server reference
         this.server = undefined;
       }
@@ -1430,15 +1546,13 @@ const redirect = (location: string, status: number = 302) => {
 export { z, error, file, redirect };
 
 // Export types for external use
-export type { RouteConfig, RouteDetail, Handler, WebSocketHandler, WSRoute, Cookie, BXOOptions, Plugin };
+export type { RouteConfig, RouteDetail, Handler, WebSocketHandler, WSRoute, CookieOptions, BXOOptions, Plugin };
 
-// Helper function to create a cookie
-export const createCookie = (
-  name: string,
+// Helper function to create cookie options
+export const createCookieOptions = (
   value: string,
-  options: Omit<Cookie, 'name' | 'value'> = {}
-): Cookie => ({
-  name,
+  options: Omit<CookieOptions, 'value'> = {}
+): CookieOptions => ({
   value,
   ...options
 });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bxo",
   "module": "index.ts",
-  "version": "0.0.5-dev.47",
+  "version": "0.0.5-dev.49",
   "description": "A simple and lightweight web framework for Bun",
   "type": "module",
   "exports": {

package/plugins/cors.ts

@@ -85,29 +85,23 @@ export function cors(options: CORSOptions = {}): Plugin {
         });
       }
     },
-    onResponse: async (ctx, response) => {
+    onResponse: async (ctx) => {
       // Handle CORS headers for actual requests
       const requestOrigin = getRequestOrigin(ctx.request);
       const allowedOrigin = validateOrigin(requestOrigin, origin);
 
-      // Clone the response to modify headers
-      const newResponse = new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: new Headers(response.headers)
-      });
-
-      // Set CORS headers
-      newResponse.headers.set('Access-Control-Allow-Origin', allowedOrigin || '*');
-      newResponse.headers.set('Access-Control-Allow-Methods', methods.join(', '));
-      newResponse.headers.set('Access-Control-Allow-Headers', allowedHeaders.join(', '));
-      newResponse.headers.set('Access-Control-Max-Age', maxAge.toString());
+      // Set CORS headers for all responses
+      ctx.set.headers = {
+        ...ctx.set.headers,
+        'Access-Control-Allow-Origin': allowedOrigin || '*',
+        'Access-Control-Allow-Methods': methods.join(', '),
+        'Access-Control-Allow-Headers': allowedHeaders.join(', '),
+        'Access-Control-Max-Age': maxAge.toString()
+      };
 
       if (credentials) {
-        newResponse.headers.set('Access-Control-Allow-Credentials', 'true');
+        ctx.set.headers['Access-Control-Allow-Credentials'] = 'true';
       }
-
-      return newResponse;
     }
   };
 }

package/example.ts

@@ -1,20 +0,0 @@
-import BXO from ".";
-import { cors } from "./plugins";
-
-const app = new BXO();
-
-app.use(cors());
-
-app.get('/', (ctx) => {
-    return { message: 'Hello, world!' };
-});
-
-app.get("/api/actions/nodula.auth.login", (ctx) => {
-    return { message: 'Hello, world!' };
-});
-
-app.post("/api/actions/nodula.auth.login", (ctx) => {
-    return { message: 'Hello, world!' };
-});
-
-app.listen(3000);