Module cors 

CORS (Cross-Origin Resource Sharing).

A drop-in front door is frequently deployed in front of an app whose browser frontend lives on a different origin (a separate static host, a preview deployment, localhost:5173 during development). Browsers block those cross-origin fetch/XHR calls unless the server answers with the right Access-Control-* headers, so EdgeGuard grows a small, explicit CORS policy.

Two responsibilities, both driven by CorsPolicy (held in the hot-swappable [Runtime], None when cors.enabled = false):

1. Preflight — answer a browser’s OPTIONS preflight (Origin + Access-Control-Request-Method) directly with 204 + the allow headers. This happens before authentication in the request pipeline, because a preflight carries no credentials; gating it behind auth would make every cross-origin call fail.
2. Decoration — add Access-Control-Allow-Origin (and friends) to the actual response so the browser exposes it to the calling page.

Security note: a wildcard origin ("*") cannot be combined with allow_credentials = true — the Fetch spec forbids it and browsers ignore the combination — so CorsPolicy::build rejects it at startup/reload rather than emitting a policy that silently doesn’t work.

Structs

CorsPolicy

A compiled CORS policy. Built once from CorsCfg; the string header values are precomputed so the request path only does cheap lookups and inserts.