From 6a9a7040f8a720b249979fc311c486f86168a520 Mon Sep 17 00:00:00 2001
From: Rosie Val <everestmcarthur@gmail.com>
Date: Sun, 9 Aug 2026 21:14:20 -0400
Subject: [PATCH 1/2] Fix CORS for worker serving rp.jarviscli.dev

---
 api/src/index.ts | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/api/src/index.ts b/api/src/index.ts
index cdb85d9..6c70fa6 100644
--- a/api/src/index.ts
+++ b/api/src/index.ts
@@ -103,10 +103,20 @@ const CACHE_TTL_SECONDS = 60; // Workers KV's enforced minimum
 
 const CORS_HEADERS = {
     "access-control-allow-origin": "*",
-    "access-control-allow-methods": "GET,PUT,DELETE,OPTIONS",
+    "access-control-allow-methods": "GET,HEAD,PUT,DELETE,OPTIONS,PATCH",
     "access-control-allow-headers": "authorization,content-type",
+    "access-control-max-age": "86400",
+    "vary": "Origin",
 };
 
+function withCors(response: Response): Response {
+    const headers = new Headers(response.headers);
+    for (const [k, v] of Object.entries(CORS_HEADERS)) {
+        headers.set(k, v);
+    }
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+}
+
 function json(data: unknown, status = 200): Response {
     return new Response(JSON.stringify(data), {
         status,
@@ -174,7 +184,7 @@ export default {
 async function handle(request: Request, env: Env): Promise<Response> {
     const url = new URL(request.url);
 
-    if (request.method === "OPTIONS" && url.pathname.startsWith("/api/")) {
+    if (request.method === "OPTIONS") {
         return new Response(null, { headers: CORS_HEADERS });
     }
 
@@ -219,11 +229,11 @@ async function handle(request: Request, env: Env): Promise<Response> {
             return new Response(row.main_js, { headers: { "content-type": "application/javascript", ...CORS_HEADERS } });
         }
 
-        return env.ASSETS.fetch(request);
+        return withCors(await env.ASSETS.fetch(request));
     }
 
     if (!url.pathname.startsWith("/api/")) {
-        return env.ASSETS.fetch(request);
+        return withCors(await env.ASSETS.fetch(request));
     }
 
     // GET /api/overlay - public read, used by the admin plugin/site to show current values before

From a703d51bceb218c3b33c16a8d64417b3dff63701 Mon Sep 17 00:00:00 2001
From: Rosie Val <everestmcarthur@gmail.com>
Date: Mon, 10 Aug 2026 18:07:57 -0400
Subject: [PATCH 2/2] Add _headers to apply CORS to static assets

---
 scripts/generate-site.mjs | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/scripts/generate-site.mjs b/scripts/generate-site.mjs
index b4bf974..ad5f2ac 100644
--- a/scripts/generate-site.mjs
+++ b/scripts/generate-site.mjs
@@ -58,4 +58,15 @@ for (const p of plugins) {
     await copyFile("./site/index.html", `./dist/${p.id}/index.html`);
 }
 
+// Static install files (manifest.json / index.js) are served directly by the Workers Assets layer,
+// bypassing the Worker code, so CORS headers must be attached here.
+const headers = `/*
+  Access-Control-Allow-Origin: *
+  Access-Control-Allow-Methods: GET, HEAD, PUT, DELETE, OPTIONS, PATCH
+  Access-Control-Allow-Headers: authorization, content-type
+  Access-Control-Max-Age: 86400
+  Vary: Origin
+`;
+await writeFile("./dist/_headers", headers);
+
 console.log(`Generated site data for ${plugins.length} plugin(s).`);