From a703d51bceb218c3b33c16a8d64417b3dff63701 Mon Sep 17 00:00:00 2001
From: Rosie Val <everestmcarthur@gmail.com>
Date: Mon, 10 Aug 2026 18:07:57 -0400
Subject: [PATCH] Add _headers to apply CORS to static assets

---
 scripts/generate-site.mjs | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/scripts/generate-site.mjs b/scripts/generate-site.mjs
index b4bf974..ad5f2ac 100644
--- a/scripts/generate-site.mjs
+++ b/scripts/generate-site.mjs
@@ -58,4 +58,15 @@ for (const p of plugins) {
     await copyFile("./site/index.html", `./dist/${p.id}/index.html`);
 }
 
+// Static install files (manifest.json / index.js) are served directly by the Workers Assets layer,
+// bypassing the Worker code, so CORS headers must be attached here.
+const headers = `/*
+  Access-Control-Allow-Origin: *
+  Access-Control-Allow-Methods: GET, HEAD, PUT, DELETE, OPTIONS, PATCH
+  Access-Control-Allow-Headers: authorization, content-type
+  Access-Control-Max-Age: 86400
+  Vary: Origin
+`;
+await writeFile("./dist/_headers", headers);
+
 console.log(`Generated site data for ${plugins.length} plugin(s).`);