dream: CORS middleware + preflight handling + 12 tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/dream/cors.sx

@@ -0,0 +1,51 @@
+;; lib/dream/cors.sx — Dream-on-SX CORS middleware.
+;; Decorates responses with Access-Control-Allow-* headers and short-circuits
+;; preflight OPTIONS requests with a 204. Depends on types.sx.
+
+(define dream-cors-defaults {:methods "GET, POST, PUT, PATCH, DELETE, OPTIONS" :headers "Content-Type" :max-age 86400 :credentials false :origin "*"})
+
+(define
+  dr/cors-origin-headers
+  (fn
+    (opts resp)
+    (let
+      ((r1 (dream-add-header resp "access-control-allow-origin" (get opts :origin))))
+      (if
+        (get opts :credentials)
+        (dream-add-header r1 "access-control-allow-credentials" "true")
+        r1))))
+
+(define
+  dr/cors-preflight
+  (fn
+    (opts)
+    (dr/cors-origin-headers
+      opts
+      (dream-add-header
+        (dream-add-header
+          (dream-add-header
+            (dream-empty 204)
+            "access-control-allow-methods"
+            (get opts :methods))
+          "access-control-allow-headers"
+          (get opts :headers))
+        "access-control-max-age"
+        (str (get opts :max-age))))))
+
+(define
+  dream-cors-with
+  (fn
+    (opts)
+    (fn
+      (next)
+      (fn
+        (req)
+        (if
+          (= (dream-method req) "OPTIONS")
+          (dr/cors-preflight opts)
+          (dr/cors-origin-headers opts (next req)))))))
+
+(define dream-cors (dream-cors-with dream-cors-defaults))
+(define
+  dream-cors-origin
+  (fn (origin) (dream-cors-with (assoc dream-cors-defaults :origin origin))))