http-transport: restore explicit credentialed origin reflection

[denny-il]

Summary

• allow an explicit, serializable credentialed origin-reflection policy
• preserve the safe credential-less cors: true default
• apply explicit allowCredentials values at runtime
• cover the behavior and public type with regression tests

Why

PR #270 intentionally stopped cors: true from reflecting arbitrary origins with credentials. Neem planners cannot use the callback alternative because functions are not structured-cloneable, leaving no way to opt into the former behavior through planner data.

This adds the explicit serializable alternative:

cors: {
  origin: true,
  allowCredentials: 'true',
}

This addresses the old-behavior use case from #276 without changing the safe default. Functional planner options remain a separate worker-boundary concern.

Validation

• vp test run packages/http-transport/tests/cors.spec.ts --reporter=agent
• vp exec oxlint packages/http-transport/src packages/http-transport/tests --format=agent

Summary by CodeRabbit

• Bug Fixes

  • Corrected CORS handling so explicitly configured credentials are preserved when origins are reflected.
  • Credentialed reflected-origin requests now return the appropriate Access-Control-Allow-Credentials header.

• Improvements

  • CORS configuration now supports combining reflected origins with explicit credential settings.
  • Updated configuration guidance and validation to reflect the expanded supported options.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a1c5c869-0611-47cb-83d8-3ac265d1a648

📥 Commits

Reviewing files that changed from the base of the PR and between b81ccc4 and c1be26e.

📒 Files selected for processing (3)

• packages/http-transport/src/server.ts
• packages/http-transport/src/types.ts
• packages/http-transport/tests/cors.spec.ts

---

📝 Walkthrough

Walkthrough

CORS configuration now permits credentials with reflected origins. Runtime handling preserves explicit credential settings for object and function configurations, and tests cover response headers and TypeScript configuration validity.

Changes

CORS credential reflection

Layer / File(s)	Summary
Unified CORS parameter contract packages/http-transport/src/types.ts	HttpTransportCorsCustomParams now allows allowCredentials with both origin: true and string-array origins.
Credential preservation and validation packages/http-transport/src/server.ts, packages/http-transport/tests/cors.spec.ts	Object- and function-based CORS configurations preserve explicit credentials, with runtime header and type-surface tests for reflected origins.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• neematajs/neemata#270: Modifies related HTTP transport CORS credential, reflected-origin, and type behavior.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: restoring explicit credentialed origin reflection in http-transport CORS handling.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev/cors-credentials-policy

---

_{Comment @coderabbitai help to get the list of available commands.}