cors.nx

cors.nx -- build CORS response headers. Fetch / XHR from a browser to a cross-origin server triggers CORS (Cross-Origin Resource Sharing). Browser sends a preflight OPTIONS request with Origin + Access-Control-Request-Method + Access-Control-Request-Headers. Server answers with Access- Control-Allow-* headers indicating what's permitted. Spec: Fetch Living Standard §Cors (supersedes the W3C CORS rec). Typical minimal response for a permissive public API: Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Max-Age: 86400 For credentialed requests (cookies / auth), Allow-Origin MUST echo the specific origin (not '*') and Allow-Credentials MUST be true. We expose both modes. Invariants: CO1 Stream builder; caller supplies an output buffer + offset. CO2 Headers include trailing CRLF; caller concatenates them after the HTTP status line.