@standardagents/builder 0.18.2 → 0.18.3

package/dist/plugin.js

@@ -7333,15 +7333,22 @@ function addCorsHeaders(response) {
     return response;
   }
 
-  // Preserve Set-Cookie exactly. Rebuilding a Response from response.headers can
-  // drop cookie headers in Worker runtimes because Set-Cookie is special.
-  if (response.headers.has("Set-Cookie")) {
+  // Skip if already has CORS headers
+  if (response.headers.has("Access-Control-Allow-Origin")) {
     return response;
   }
 
-  // Skip if already has CORS headers
-  if (response.headers.has("Access-Control-Allow-Origin")) {
+  // Prefer mutating the original Response headers. Rebuilding a Response from
+  // response.headers can drop special headers such as Set-Cookie in Worker
+  // runtimes, even when the header is not visible through Headers.has().
+  try {
+    for (const [key, value] of Object.entries(CORS_HEADERS)) {
+      response.headers.set(key, value);
+    }
     return response;
+  } catch {
+    // Some Responses, especially fetched upstream responses, have immutable
+    // headers. Fall back to wrapping those responses.
   }
 
   // Create new headers with CORS added