blume 1.7.0 → 1.7.2

package/dist/types/core/config-input.d.ts

@@ -588,6 +588,8 @@ export interface AskSuggestion {
 /** Backends that can route an Ask AI request. */
 type AskProviderGateway = "gateway" | "openrouter" | "llmgateway";
 type AskProvider = AskProviderGateway | "inkeep" | "openai-compatible";
+/** How much the model reasons before answering (`ai.ask.reasoning`). */
+type AskReasoning = "none" | "minimal" | "low" | "medium" | "high" | "xhigh";
 /** How much retrieved documentation each Ask AI question carries. */
 export interface AskRetrievalConfig {
     /**
@@ -620,6 +622,18 @@ export interface AskConfig {
      * overrides the built-in preset.
      */
     baseUrl?: string;
+    /**
+     * Origins allowed to call the generated endpoint from another site — a
+     * marketing page that embeds an ask box, for example — or `"*"` to allow
+     * every origin. The route answers preflight requests and names a listed
+     * origin on every response, errors included; every other origin stays
+     * subject to the browser's same-origin rule. Callers must send the body as
+     * JSON with a `content-type: application/json` header, or Astro's cross-site
+     * request check rejects the `POST` before the route runs. Only the generated
+     * route reads this; an external `endpoint` handles its own CORS and can't be
+     * combined with it.
+     */
+    cors?: string[];
     /** Turn Ask AI on. Defaults to `false`. */
     enabled?: boolean;
     /**
@@ -628,6 +642,13 @@ export interface AskConfig {
      * limiting, and streaming. Accepts an absolute URL or root-relative path.
      */
     endpoint?: string;
+    /**
+     * Static request headers sent to the provider on every call — a
+     * caller-identifying header for a shared backend, for example. Values are
+     * written into the generated route as literals, so keep secrets in
+     * `apiKeyEnv` rather than here.
+     */
+    headers?: Record<string, string>;
     /**
      * Extra system-prompt text appended to the built-in instructions — use it
      * for identity, language, or tone. The built-in grounding behavior (answer
@@ -638,6 +659,18 @@ export interface AskConfig {
     model?: string;
     /** Which backend routes the request. Defaults to `gateway`. */
     provider?: AskProvider;
+    /**
+     * How much the model reasons before answering, from `"none"` to `"xhigh"`.
+     * Sent as the backend's own reasoning-effort control: the AI SDK's
+     * `reasoning` option on the gateway, `reasoning.effort` on OpenRouter, and
+     * `reasoning_effort` on OpenAI-compatible endpoints. The model has to
+     * support the level — OpenAI rejects one a model doesn't offer — and the
+     * endpoint has to accept the parameter; Inkeep has no reasoning control,
+     * so the field is rejected there. Omitted keeps the model's default.
+     * `"none"` is the fastest and cheapest for grounded docs Q&A, where the
+     * retrieved excerpts carry the answer.
+     */
+    reasoning?: AskReasoning;
     /**
      * How much documentation each question carries into the model's prompt.
      * Lower values cut time-to-first-token — which dominates on a self-hosted

package/dist/types/core/schema.d.ts

@@ -327,6 +327,11 @@ export type SidebarItemConfig = string | {
     root?: string;
 };
 export declare const searchProviders: readonly ["orama", "pagefind", "flexsearch", "algolia", "orama-cloud", "typesense", "mixedbread", "none"];
+/**
+ * The `ai.ask.reasoning` levels: the AI SDK's top-level `reasoning` values
+ * minus `provider-default`, which is what omitting the field means.
+ */
+export declare const askReasoningLevels: readonly ["none", "minimal", "low", "medium", "high", "xhigh"];
 /** Ask AI backends. `gateway` (default) routes through the Vercel AI Gateway. */
 export declare const askAiProviders: readonly ["gateway", "openrouter", "llmgateway", "inkeep", "openai-compatible"];
 declare const aiConfigSchema: z.ZodObject<{
@@ -334,8 +339,10 @@ declare const aiConfigSchema: z.ZodObject<{
     ask: z.ZodOptional<z.ZodObject<{
         apiKeyEnv: z.ZodOptional<z.ZodString>;
         baseUrl: z.ZodOptional<z.ZodURL>;
+        cors: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodPipe<z.ZodURL, z.ZodTransform<string, string>>]>>>;
         enabled: z.ZodDefault<z.ZodBoolean>;
         endpoint: z.ZodOptional<z.ZodString>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         instructions: z.ZodOptional<z.ZodString>;
         model: z.ZodDefault<z.ZodString>;
         provider: z.ZodDefault<z.ZodEnum<{
@@ -345,6 +352,14 @@ declare const aiConfigSchema: z.ZodObject<{
             inkeep: "inkeep";
             "openai-compatible": "openai-compatible";
         }>>;
+        reasoning: z.ZodOptional<z.ZodEnum<{
+            none: "none";
+            minimal: "minimal";
+            low: "low";
+            medium: "medium";
+            high: "high";
+            xhigh: "xhigh";
+        }>>;
         retrieval: z.ZodOptional<z.ZodObject<{
             contextBudget: z.ZodOptional<z.ZodNumber>;
             excerptChars: z.ZodOptional<z.ZodNumber>;
@@ -390,6 +405,7 @@ declare const aiConfigSchema: z.ZodObject<{
     webmcp: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strict>;
 export type AskAiProvider = (typeof askAiProviders)[number];
+export type AskReasoning = (typeof askReasoningLevels)[number];
 export type AskAiConfig = NonNullable<z.infer<typeof aiConfigSchema>["ask"]>;
 export { openInChatProviders } from "./open-in-chat.ts";
 export type { OpenInChatProvider } from "./open-in-chat.ts";
@@ -504,9 +520,9 @@ declare const contentSignalsSchema: z.ZodPipe<z.ZodUnion<readonly [z.ZodBoolean,
 declare const dateFormatConfigSchema: z.ZodObject<{
     calendar: z.ZodOptional<z.ZodString>;
     dateStyle: z.ZodOptional<z.ZodEnum<{
+        medium: "medium";
         full: "full";
         long: "long";
-        medium: "medium";
         short: "short";
     }>>;
     day: z.ZodOptional<z.ZodEnum<{
@@ -575,8 +591,10 @@ export declare const blumeConfigSchema: z.ZodObject<{
         ask: z.ZodOptional<z.ZodObject<{
             apiKeyEnv: z.ZodOptional<z.ZodString>;
             baseUrl: z.ZodOptional<z.ZodURL>;
+            cors: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodPipe<z.ZodURL, z.ZodTransform<string, string>>]>>>;
             enabled: z.ZodDefault<z.ZodBoolean>;
             endpoint: z.ZodOptional<z.ZodString>;
+            headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
             instructions: z.ZodOptional<z.ZodString>;
             model: z.ZodDefault<z.ZodString>;
             provider: z.ZodDefault<z.ZodEnum<{
@@ -586,6 +604,14 @@ export declare const blumeConfigSchema: z.ZodObject<{
                 inkeep: "inkeep";
                 "openai-compatible": "openai-compatible";
             }>>;
+            reasoning: z.ZodOptional<z.ZodEnum<{
+                none: "none";
+                minimal: "minimal";
+                low: "low";
+                medium: "medium";
+                high: "high";
+                xhigh: "xhigh";
+            }>>;
             retrieval: z.ZodOptional<z.ZodObject<{
                 contextBudget: z.ZodOptional<z.ZodNumber>;
                 excerptChars: z.ZodOptional<z.ZodNumber>;
@@ -771,9 +797,9 @@ export declare const blumeConfigSchema: z.ZodObject<{
     dateFormat: z.ZodDefault<z.ZodObject<{
         calendar: z.ZodOptional<z.ZodString>;
         dateStyle: z.ZodOptional<z.ZodEnum<{
+            medium: "medium";
             full: "full";
             long: "long";
-            medium: "medium";
             short: "short";
         }>>;
         day: z.ZodOptional<z.ZodEnum<{
@@ -1059,6 +1085,7 @@ export declare const blumeConfigSchema: z.ZodObject<{
             label: z.ZodString;
         }, z.core.$strict>>>;
         provider: z.ZodDefault<z.ZodEnum<{
+            none: "none";
             algolia: "algolia";
             mixedbread: "mixedbread";
             orama: "orama";
@@ -1066,7 +1093,6 @@ export declare const blumeConfigSchema: z.ZodObject<{
             flexsearch: "flexsearch";
             "orama-cloud": "orama-cloud";
             typesense: "typesense";
-            none: "none";
         }>>;
         typesense: z.ZodOptional<z.ZodObject<{
             collection: z.ZodString;

package/docs/08-faq.mdx

@@ -160,3 +160,24 @@ Patch oxfmt so it preserves the line break that sits directly against a `:::` fe
 :::warning[Version-pinned]
 The patch targets a specific oxfmt build — its diff references a file whose name is hashed per release (`dist/markdown-*.js`). When you bump oxfmt, regenerate the patch (e.g. `bun patch oxfmt`) or check whether the upstream fix has landed and the patch is no longer needed.
 :::
+
+## Why does Knip report my `blume.config.ts` dependencies as unused?
+
+[Knip](https://knip.dev) only follows imports from files it knows are entry points, and it learns those from its built-in plugins. There is no Blume plugin yet, and Knip's Astro plugin doesn't switch on either: it looks for `astro` in your own `package.json`, but a Blume project depends on `blume`, and the generated `.blume/` Astro project is gitignored, so Knip never sees it. Nothing references `blume.config.ts`, so any package it imports gets reported as unused.
+
+Register the files Blume loads from your project root as entries. In `knip.json`:
+
+```json knip.json
+{
+  "entry": [
+    "blume.config.{ts,mjs,js}",
+    "components.{ts,tsx}",
+    "islands/**/*.{ts,tsx}",
+    "pages/**/*"
+  ]
+}
+```
+
+In a monorepo, put the same `entry` list under the docs workspace in `workspaces` instead. Drop any line for a convention you don't use — `components.ts` for [component overrides](/docs/configuration/customization#component-overrides), `islands/` for [interactive islands](/docs/configuration/customization#interactive-islands), and `pages/` for [custom pages](/docs/configuration/customization#custom-pages) (adjust the last one if you've changed `content.pages`).
+
+Knip can only follow real imports. A package that's only named inside a string — say, an [Astro integration](/docs/configuration/customization#astro-integrations) that calls `injectScript("page", "import('some-package')")` — still needs an `ignoreDependencies` entry.

package/docs/configuration/ask-ai.mdx

@@ -109,6 +109,37 @@ Blume sends the same `POST` body as its built-in route:
 
 Return a successful response whose body is a plain UTF-8 text stream. If the endpoint is on another origin, allow the docs origin with CORS: accept `OPTIONS` and `POST`, permit the `content-type` request header, and return the CORS headers on both the preflight and streamed response. With `endpoint` set, Blume generates the chat UI but no server route, grounding snapshot, provider dependency, or provider-secret warning; your backend owns retrieval, authentication, rate limiting, model access, and citations.
 
+## Cross-origin callers
+
+The generated endpoint answers the in-page assistant on its own origin. To call it from another site as well — a marketing page with an ask box, say — list that site's origin in `cors`:
+
+```ts blume.config.ts lineNumbers
+ai: {
+  ask: {
+    enabled: true,
+    cors: ["https://www.example.com"],
+  },
+}
+```
+
+The route then answers the browser's `OPTIONS` preflight and names a listed origin on every response — the streamed answer and the error statuses alike, so the caller can tell a rejected body from a provider failure. Origins that aren't listed get no header and stay subject to the browser's same-origin rule. Each entry is reduced to its origin, so `https://www.example.com/docs/` and `https://www.example.com` mean the same thing. To let any page call the route, list `"*"` instead of origins.
+
+The caller sends the same `POST` body the [external endpoint](#external-endpoint) contract describes and reads back the same text stream. Send it as JSON with a `content-type: application/json` header:
+
+```ts
+const response = await fetch("https://docs.example.com/api/ask", {
+  body: JSON.stringify({
+    messages: [{ role: "user", content: "How do I deploy?" }],
+  }),
+  headers: { "content-type": "application/json" },
+  method: "POST",
+});
+```
+
+The content type matters: Astro's cross-site request check rejects a cross-origin `POST` that has no content type, or a form-like one such as `text/plain`, with a 403 before the route runs, and that response carries no CORS headers, so the browser reports it as a network error rather than a status. The preflight allows whatever request headers the caller asks for, so a fetch wrapper that adds its own headers needs no extra configuration.
+
+`cors` only affects the generated route; with an external `endpoint`, CORS is that backend's job, and setting both is a config error. The endpoint stays unauthenticated either way, so the [rate limiting](#rate-limiting) advice applies to cross-origin traffic too.
+
 ## Server output required
 
 Blume's built-in Ask AI backend is a server route (`POST /api/ask`), so it can't run on a static build. Switch to server output and pick an adapter:
@@ -166,12 +197,44 @@ ai: {
 
 Set `apiKeyEnv` (and, for the named providers, `baseUrl`) on any backend to point at a different env var or proxy.
 
+To send static request headers with every call — a caller-identifying header for a shared backend, say, so its own observability or rate limiting can tell your docs apart from other traffic — set `headers`. It works on every backend, including the gateway:
+
+```ts blume.config.ts lineNumbers
+ai: {
+  ask: {
+    enabled: true,
+    provider: "openai-compatible",
+    baseUrl: "https://llm.internal.example.com/v1",
+    apiKeyEnv: "INTERNAL_LLM_API_KEY",
+    headers: { "X-Caller-Id": "docs" },
+  },
+}
+```
+
+The values are written into the generated route as-is, so keep secrets in `apiKeyEnv` rather than in `headers`. The API key's `Authorization` header is applied first, so a custom header can't displace it.
+
 :::note
 **Inkeep** answers from the content you've indexed in the Inkeep dashboard — it runs its own retrieval — so Blume leaves it ungrounded. Every other backend is [grounded](#grounding) in this site's pages.
 :::
 
 Keys are read through Astro's [`getSecret()`](https://docs.astro.build/en/guides/environment-variables/#retrieving-secrets-programmatically), so each adapter supplies them its own way: environment variables on Node, Vercel, and Netlify, and the Worker's [bindings](https://docs.astro.build/en/guides/integrations-guide/cloudflare/#environment-variables-and-secrets) on Cloudflare. Enabling Ask AI also turns on React for the in-page island — see [Customization](/docs/configuration/customization#interactive-islands).
 
+## Reasoning
+
+Reasoning models think before they answer, and how much they do so by default varies by model. For grounded docs Q&A the retrieved excerpts carry the answer, so most of that thinking is latency the reader waits through. `reasoning` sets how much the model reasons: `"none"`, `"minimal"`, `"low"`, `"medium"`, `"high"`, or `"xhigh"`:
+
+```ts blume.config.ts lineNumbers
+ai: {
+  ask: {
+    enabled: true,
+    model: "openai/gpt-5.5",
+    reasoning: "none",
+  },
+}
+```
+
+The value is sent as the backend's own reasoning-effort control. Through the gateway it travels as the [AI SDK's `reasoning` option](https://ai-sdk.dev/docs/ai-sdk-core/reasoning), which the gateway maps to the model's setting — OpenAI's `reasoning_effort`, for example. On OpenRouter it is sent as `reasoning.effort`, and on LLMGateway or a custom `openai-compatible` endpoint as `reasoning_effort` in the request, so the endpoint has to accept that parameter. The model has to support the level you pick: OpenAI rejects a level a model doesn't offer (`"none"` and `"xhigh"` exist only on some), so check the model's documentation before setting one. Inkeep runs its own QA pipeline and has no reasoning control, so setting `reasoning` with that backend is a config error. Leave it unset to keep the model's default. Like [retrieval size](#retrieval-size), it trades thoroughness for time-to-first-token, and answers stay grounded either way.
+
 ## Rate limiting
 
 The `POST /api/ask` endpoint is **unauthenticated** — it has to be, so the in-page assistant can call it. Blume validates each request — rejecting malformed bodies, capping it to 1–40 messages, and accepting only `user`/`assistant` roles so a caller can't inject their own system prompt and repurpose the route as a general LLM proxy — to bound how much a single call can spend against your model, but it can't stop someone from calling the endpoint repeatedly. If cost abuse is a concern, put the route behind a rate limiter — your host's (e.g. Vercel's) edge rate limiting, a middleware, or your model provider's per-key spend limits.

package/docs/content/sources.mdx

@@ -163,7 +163,7 @@ A read token for a private dataset comes from the `SANITY_TOKEN` environment var
 
 ## Notion
 
-The built-in `notion` source turns a Notion database into a collection: each row becomes a page, its properties become frontmatter, and its block tree becomes MDX. Callouts, toggles, columns, and code blocks map to the matching Blume components. `@notionhq/client` (v5 or later) is an optional peer dependency; Blume reads the database through its first data source.
+The built-in `notion` source turns a Notion database into a collection: each row becomes a page, its properties become frontmatter, and its block tree becomes MDX. Callouts, toggles, columns, and code blocks map to the matching Blume components. Video blocks become a `<YouTube>` embed when they hold a YouTube link and a `<video>` player otherwise, with the block's caption as a `<Frame>` caption either way; a link to a video page rather than a media file (a Vimeo or Loom URL, say) is reported as a warning instead of embedded. `@notionhq/client` (v5 or later) is an optional peer dependency; Blume reads the database through its first data source.
 
 ```ts blume.config.ts
 import { defineConfig } from "blume";
@@ -185,7 +185,7 @@ export default defineConfig({
 });
 ```
 
-The integration token comes from the `NOTION_TOKEN` environment variable (share the database with your integration). By default every page is imported; set `publishedValue` to make the `Status` property a publish gate — any other value then maps to `draft: true`, which production builds drop. **Notion image URLs are signed and expire**, so the adapter downloads them at build time into the site's assets and rewrites the references — a CMS image never rots a static build. API calls are paced through a small request pool (3 at a time, matching Notion's per-integration rate limit) so databases with hundreds of pages import without tripping `429` responses; set `concurrency` on the source to tune it.
+The integration token comes from the `NOTION_TOKEN` environment variable (share the database with your integration). By default every page is imported; set `publishedValue` to make the `Status` property a publish gate — any other value then maps to `draft: true`, which production builds drop. **Notion image and video URLs are signed and expire**, so the adapter downloads them at build time into the site's assets and rewrites the references — a CMS asset never rots a static build. API calls are paced through a small request pool (3 at a time, matching Notion's per-integration rate limit) so databases with hundreds of pages import without tripping `429` responses; set `concurrency` on the source to tune it.
 
 ## Preview and sync
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blume",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "description": "Documentation that's fast, AI-ready, and zero-config.",
   "keywords": [
     "astro",

package/src/ai/ask.ts

@@ -7,16 +7,31 @@ import type { AskAiConfig } from "../core/schema.ts";
  * AI SDK's OpenAI-compatible provider.
  */
 export type AskBackend =
-  | { kind: "gateway"; model: string }
-  | { apiKeyEnv: string; kind: "openrouter"; model: string }
+  | { headers?: AskHeaders; kind: "gateway"; model: string }
+  | {
+      apiKeyEnv: string;
+      headers?: AskHeaders;
+      kind: "openrouter";
+      model: string;
+    }
   | {
       apiKeyEnv: string;
       baseUrl: string;
+      headers?: AskHeaders;
       kind: "openai-compatible";
       model: string;
       name: string;
     };
 
+/**
+ * Static request headers (`ai.ask.headers`) every backend forwards to its
+ * provider factory. Every provider Blume generates against accepts the same
+ * `headers` option, so the map travels unchanged; the OpenAI-compatible
+ * provider applies them after the `Authorization` header it derives from the
+ * API key, so a custom header can't displace auth.
+ */
+export type AskHeaders = Record<string, string>;
+
 interface AskPreset {
   apiKeyEnv: string;
   baseUrl?: string;
@@ -69,17 +84,28 @@ const ASK_PRESETS: AskPresetRegistry = {
 
 const DEFAULT_MODEL = "openai/gpt-5.5";
 
+/**
+ * The `headers` field every backend variant shares. An empty map is dropped so
+ * the generated route only carries a `headers` option when there is something
+ * to send.
+ */
+const askHeadersField = (ask?: AskAiConfig): { headers?: AskHeaders } =>
+  ask?.headers && Object.keys(ask.headers).length > 0
+    ? { headers: ask.headers }
+    : {};
+
 /** Resolve the `ai.ask` config into the backend the endpoint is built against. */
 export const resolveAskBackend = (ask?: AskAiConfig): AskBackend => {
   const provider = ask?.provider ?? "gateway";
   const model = ask?.model ?? DEFAULT_MODEL;
+  const headers = askHeadersField(ask);
   if (provider === "gateway") {
-    return { kind: "gateway", model };
+    return { ...headers, kind: "gateway", model };
   }
   const preset = ASK_PRESETS[provider];
   const apiKeyEnv = ask?.apiKeyEnv ?? preset?.apiKeyEnv ?? "API_KEY";
   if (provider === "openrouter") {
-    return { apiKeyEnv, kind: "openrouter", model };
+    return { apiKeyEnv, ...headers, kind: "openrouter", model };
   }
   // `llmgateway`, `inkeep`, and the generic `openai-compatible` provider all
   // stream through the AI SDK's OpenAI-compatible provider. The schema requires
@@ -87,6 +113,7 @@ export const resolveAskBackend = (ask?: AskAiConfig): AskBackend => {
   return {
     apiKeyEnv,
     baseUrl: ask?.baseUrl ?? preset?.baseUrl ?? "",
+    ...headers,
     kind: OPENAI_COMPATIBLE,
     model,
     name: preset?.name ?? OPENAI_COMPATIBLE,

package/src/ai/cors.ts

@@ -0,0 +1,87 @@
+/**
+ * CORS for the generated Ask AI route (`ai.ask.cors`).
+ *
+ * A browser only lets a page on another origin read a response that names
+ * that origin, and a JSON `POST` preflights first. `preflightResponse` answers
+ * the `OPTIONS`; `withCors` wraps the `POST` handler so every response it
+ * returns — the stream, a 400, a 500 — carries the headers. Wrapping once,
+ * rather than stamping each `return`, keeps the next return site added to the
+ * handler from shipping an opaque failure for that one status.
+ *
+ * `allowed` is the `ai.ask.cors` list: origins already reduced to their
+ * `scheme://host[:port]` form by the config schema, or the single entry `"*"`
+ * to admit every origin.
+ */
+
+/** The `ai.ask.cors` entry that admits every origin. */
+export const ANY_ORIGIN = "*";
+
+/** The headers a response carries for a cross-origin caller. */
+export interface CorsHeaders {
+  "access-control-allow-origin"?: string;
+  vary?: string;
+}
+
+/** The response headers that name the caller's origin when `allowed` lists it. */
+export const corsHeaders = (
+  request: Request,
+  allowed: readonly string[]
+): CorsHeaders => {
+  if (allowed.includes(ANY_ORIGIN)) {
+    // A wildcard answer is the same for every caller, so nothing to vary on.
+    return { "access-control-allow-origin": ANY_ORIGIN };
+  }
+  // `Vary` rides on both branches: the answer depends on `Origin` whether or
+  // not it was listed, so a shared cache never hands one origin's response
+  // (or the header-less one) to another.
+  const origin = request.headers.get("origin");
+  return origin && allowed.includes(origin)
+    ? { "access-control-allow-origin": origin, vary: "origin" }
+    : { vary: "origin" };
+};
+
+/** Answer the browser's `OPTIONS` preflight for the route. */
+export const preflightResponse = (
+  request: Request,
+  allowed: readonly string[]
+): Response =>
+  new Response(null, {
+    headers: {
+      ...corsHeaders(request, allowed),
+      // Reflect whatever the caller's fetch wrapper asks to send, falling back
+      // to the JSON POST's own `content-type`; a listed origin shouldn't need
+      // an eject to add a header of its own.
+      "access-control-allow-headers":
+        request.headers.get("access-control-request-headers") ?? "content-type",
+      "access-control-allow-methods": "POST",
+      "access-control-max-age": "86400",
+    },
+    status: 204,
+  });
+
+/** The slice of Astro's `APIContext` the wrapped handler reads. */
+interface RequestContext {
+  request: Request;
+}
+
+/** Stamp the CORS headers on every response `handler` returns. */
+export const withCors =
+  (
+    allowed: readonly string[],
+    handler: (context: RequestContext) => Promise<Response> | Response
+  ): ((context: RequestContext) => Promise<Response>) =>
+  async (context) => {
+    const response = await handler(context);
+    for (const [key, value] of Object.entries(
+      corsHeaders(context.request, allowed)
+    )) {
+      // `Vary` accumulates (the handler may already vary on something), the
+      // rest replace.
+      if (key === "vary") {
+        response.headers.append(key, value);
+      } else {
+        response.headers.set(key, value);
+      }
+    }
+    return response;
+  };

package/src/astro/generate.ts

@@ -1826,7 +1826,9 @@ const writeAskFiles = async (
   await write(
     join(srcDir, "pages", "api", "ask.ts"),
     askEndpointTemplate(resolveAskBackend(ask), grounded, {
+      cors: ask.cors,
       instructions: ask.instructions,
+      reasoning: ask.reasoning,
       retrieval: ask.retrieval,
     })
   );
@@ -2339,6 +2341,7 @@ export const generateRuntime = async (
       changelogIndexTemplate({
         exportEpub,
         exportPdf,
+        mathEnabled: usesMath,
         needsReact,
         staged: hasStaged,
       })