Expose WWW-Authenticate and X-Request-ID in CORS headers (v0.6.2)

Browsers cannot read non-safelisted response headers from cross-origin
responses unless they appear in Access-Control-Expose-Headers.  Always
expose WWW-Authenticate (needed for OAuth discovery from 401 responses)
and X-Request-ID (for client-side debugging) when CORS is enabled.
Also allow Authorization in request headers for Bearer token support.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: rustyconover

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@query-farm/vgi-rpc",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "license": "Apache-2.0",
   "homepage": "https://vgi-rpc-typescript.query.farm",
   "repository": {

src/http/handler.ts

@@ -85,7 +85,8 @@ export function createHttpHandler(
     if (corsOrigins) {
       headers.set("Access-Control-Allow-Origin", corsOrigins);
       headers.set("Access-Control-Allow-Methods", "POST, OPTIONS");
-      headers.set("Access-Control-Allow-Headers", "Content-Type");
+      headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization");
+      headers.set("Access-Control-Expose-Headers", "WWW-Authenticate, X-Request-ID");
     }
   }
 

test/http/handler.test.ts

@@ -316,6 +316,7 @@ describe("HTTP Handler", () => {
 
     expect(res.status).toBe(200);
     expect(res.headers.get("Access-Control-Allow-Origin")).toBe("*");
+    expect(res.headers.get("Access-Control-Expose-Headers")).toBe("WWW-Authenticate, X-Request-ID");
   });
 
   test("CORS preflight", async () => {
@@ -329,6 +330,8 @@ describe("HTTP Handler", () => {
     expect(res.status).toBe(204);
     expect(res.headers.get("Access-Control-Allow-Origin")).toBe("*");
     expect(res.headers.get("Access-Control-Allow-Methods")).toBe("POST, OPTIONS");
+    expect(res.headers.get("Access-Control-Allow-Headers")).toBe("Content-Type, Authorization");
+    expect(res.headers.get("Access-Control-Expose-Headers")).toBe("WWW-Authenticate, X-Request-ID");
   });
 
   // -- Producer stream --