blume 1.7.1 → 1.7.3

package/src/ai/ai-catalog.ts

@@ -0,0 +1,241 @@
+import { normalizeBasePath, withBasePath } from "../core/base-path.ts";
+import type { ResolvedConfig } from "../core/schema.ts";
+import { absoluteUrl } from "../core/site-url.ts";
+import { resolveReferences } from "../openapi/references.ts";
+import { API_CATALOG_PATH, hasApiCatalog } from "./api-catalog.ts";
+import { OPENAPI_PATH } from "./api/paths.ts";
+import { asciiSlugify } from "./mcp/discovery.ts";
+import { AGENT_SKILLS_DIR } from "./skills.ts";
+import type { SkillArtifact } from "./skills.ts";
+
+/**
+ * The AI Catalog (Agent-Card/ai-catalog data model, `specVersion` 1.0) at
+ * `/.well-known/ai-catalog.json`, which is also the Agentic Resource
+ * Discovery (ARD) manifest: one entry per agent-facing resource the site
+ * publishes, each an `urn:air:<host>:<namespace>:<name>` identifier, a
+ * display name, the artifact's media type, a URL, and the
+ * `representativeQueries` registries embed for semantic search. Like the
+ * RFC 9727 catalog next to it, everything is derived from `blume.config.ts`
+ * and the build's published skills — nothing is hand-written.
+ *
+ * ARD v0.91 moved its manifest to `/.well-known/ard.json` and calls
+ * `ai-catalog.json` the predecessor path that consumers only *may* consult,
+ * while the ai-catalog spec and today's agent-readiness scanners key on
+ * `ai-catalog.json`. The ARD manifest is just an `entries` array (other
+ * members are ignored), so the one document is written to both paths.
+ *
+ * Served as plain `application/json`: the `.json` extension gets it from
+ * every static host with no header rule, and the scanners that gate on the
+ * file ask for exactly that type. The registered `application/ai-catalog+json`
+ * is what the `Link`/`<link>` advertisements declare the document to be.
+ */
+
+export const AI_CATALOG_PATH = "/.well-known/ai-catalog.json";
+export const ARD_MANIFEST_PATH = "/.well-known/ard.json";
+export const AI_CATALOG_TYPE = "application/ai-catalog+json";
+const SPEC_VERSION = "1.0";
+
+/** One catalog entry, restricted to the terms Blume emits. */
+interface CatalogEntry {
+  identifier: string;
+  displayName: string;
+  type: string;
+  url: string;
+  description?: string;
+  capabilities?: string[];
+  representativeQueries: string[];
+}
+
+/** An entry before its identifier and queries are resolved against the host. */
+interface EntrySeed {
+  /** `<namespace>:<name>` — the identifier's tail and the `queries` key. */
+  key: string;
+  displayName: string;
+  type: string;
+  url: string;
+  description?: string;
+  capabilities?: string[];
+  /** Generated queries, replaced wholesale by a configured `queries[key]`. */
+  queries: string[];
+}
+
+const REFERENCE_KIND_LABEL = {
+  asyncapi: "AsyncAPI",
+  graphql: "GraphQL",
+  openapi: "OpenAPI",
+} as const;
+
+/** The `urn:air` publisher: the configured site's hostname. */
+const publisherHost = (site: string): string => new URL(site).hostname;
+
+/**
+ * Whether the site publishes a catalog: the feature is on, a `deployment.site`
+ * anchors the identifiers, and at least one entry exists. Every entry source
+ * is a config flag, so the answer needs no build output — the same gate the
+ * header rules, the `Link` header, and the head links read.
+ */
+export const hasAiCatalog = (config: ResolvedConfig): boolean =>
+  config.ai.catalog.enabled &&
+  Boolean(config.deployment.site) &&
+  (config.ai.mcp.enabled ||
+    config.ai.api ||
+    config.ai.llmsTxt.enabled ||
+    Boolean(config.ai.skills) ||
+    resolveReferences(config).length > 0);
+
+/**
+ * The `.well-known` documents agent registries fetch cross-origin (browser
+ * agents, hosted registries reading through a page). Each needs
+ * `Access-Control-Allow-Origin: *` on the static surface; the MCP endpoint
+ * itself already sets it at runtime.
+ */
+export const crossOriginDiscoveryPaths = (config: ResolvedConfig): string[] => {
+  const paths: string[] = [];
+  if (hasAiCatalog(config)) {
+    paths.push(AI_CATALOG_PATH, ARD_MANIFEST_PATH);
+  }
+  if (hasApiCatalog(config)) {
+    paths.push(API_CATALOG_PATH);
+  }
+  if (config.ai.mcp.enabled) {
+    paths.push("/.well-known/mcp.json", "/.well-known/mcp/server-card.json");
+  }
+  return paths;
+};
+
+const entrySeeds = (
+  config: ResolvedConfig,
+  skills: readonly SkillArtifact[],
+  abs: (path: string) => string
+): EntrySeed[] => {
+  const { title } = config;
+  const seeds: EntrySeed[] = [];
+
+  if (config.ai.mcp.enabled) {
+    const name = config.ai.mcp.name ?? title;
+    seeds.push({
+      capabilities: ["search_docs", "get_page", "list_pages", "get_navigation"],
+      description:
+        config.ai.mcp.instructions ??
+        `Model Context Protocol server over the ${title} documentation: full-text search, page Markdown, the page index, and the navigation tree.`,
+      displayName: name,
+      key: `mcp:${asciiSlugify(name) || "docs"}`,
+      queries: [
+        `search the ${title} documentation`,
+        `get a ${title} docs page as Markdown`,
+        `list every page in the ${title} docs`,
+      ],
+      type: "application/mcp-server-card+json",
+      url: abs("/.well-known/mcp/server-card.json"),
+    });
+  }
+
+  for (const skill of skills) {
+    seeds.push({
+      description: skill.description,
+      displayName: skill.name,
+      key: `skill:${skill.name}`,
+      queries: [
+        `load the ${skill.name} agent skill`,
+        `how do I use ${skill.name}`,
+      ],
+      type:
+        skill.type === "archive"
+          ? "application/agent-skills+gzip"
+          : "application/agent-skills+md",
+      url: abs(`${AGENT_SKILLS_DIR}/${skill.path}`),
+    });
+  }
+
+  if (config.ai.api) {
+    seeds.push({
+      description: `REST API over the ${title} documentation: the page index, each page as JSON or Markdown, and the navigation tree, described by this OpenAPI document.`,
+      displayName: `${title} docs API`,
+      key: "api:docs",
+      queries: [
+        `fetch a ${title} docs page as JSON`,
+        `list the pages in the ${title} docs`,
+        `get the ${title} docs navigation tree`,
+      ],
+      type: "application/vnd.oai.openapi+json",
+      url: abs(OPENAPI_PATH),
+    });
+  }
+
+  for (const reference of resolveReferences(config)) {
+    // Blume-rendered pages mount under `basePath`; Scalar pages stay at the
+    // raw route (see `referenceRoutes`). The rendered reference is the
+    // resource this publisher owns — the spec itself is catalogued by URL in
+    // the RFC 9727 linkset.
+    const docRoute =
+      reference.renderer === "blume"
+        ? withBasePath(reference.basePath, reference.route)
+        : reference.route;
+    seeds.push({
+      description: `${reference.label}: rendered ${REFERENCE_KIND_LABEL[reference.kind]} reference in the ${title} documentation.`,
+      displayName: reference.label,
+      key: `reference:${reference.slug}`,
+      queries: [
+        `what operations does the ${reference.label} API expose`,
+        `how do I call the ${reference.label} API`,
+      ],
+      type: "text/html",
+      url: abs(docRoute),
+    });
+  }
+
+  if (config.ai.llmsTxt.enabled) {
+    seeds.push({
+      description: `llms.txt index of the ${title} documentation: every page with a one-line summary, plus the agent-facing resources on this site.`,
+      displayName: `${title} llms.txt`,
+      key: "docs:llms-txt",
+      queries: [`what is ${title}`, `overview of the ${title} documentation`],
+      type: "text/plain",
+      url: abs("/llms.txt"),
+    });
+  }
+
+  return seeds;
+};
+
+/** The catalog document, or null when the site publishes none. */
+export const buildAiCatalog = (
+  config: ResolvedConfig,
+  skills: readonly SkillArtifact[]
+): string | null => {
+  const site = config.deployment.site ?? null;
+  if (!(site && hasAiCatalog(config))) {
+    return null;
+  }
+  const deployBase = normalizeBasePath(config.deployment.base);
+  const abs = (path: string): string =>
+    absoluteUrl(site, withBasePath(deployBase, path));
+  const host = publisherHost(site);
+  const entries = entrySeeds(config, skills, abs).map((seed): CatalogEntry => {
+    const entry: CatalogEntry = {
+      displayName: seed.displayName,
+      identifier: `urn:air:${host}:${seed.key}`,
+      representativeQueries:
+        config.ai.catalog.queries[seed.key] ?? seed.queries,
+      type: seed.type,
+      url: seed.url,
+    };
+    if (seed.description) {
+      entry.description = seed.description;
+    }
+    if (seed.capabilities) {
+      entry.capabilities = seed.capabilities;
+    }
+    return entry;
+  });
+  const catalog = {
+    entries,
+    host: {
+      displayName: config.title,
+      documentationUrl: abs("/"),
+      identifier: `did:web:${host}`,
+    },
+    specVersion: SPEC_VERSION,
+  };
+  return `${JSON.stringify(catalog, null, 2)}\n`;
+};

package/src/ai/cors.ts

@@ -0,0 +1,87 @@
+/**
+ * CORS for the generated Ask AI route (`ai.ask.cors`).
+ *
+ * A browser only lets a page on another origin read a response that names
+ * that origin, and a JSON `POST` preflights first. `preflightResponse` answers
+ * the `OPTIONS`; `withCors` wraps the `POST` handler so every response it
+ * returns — the stream, a 400, a 500 — carries the headers. Wrapping once,
+ * rather than stamping each `return`, keeps the next return site added to the
+ * handler from shipping an opaque failure for that one status.
+ *
+ * `allowed` is the `ai.ask.cors` list: origins already reduced to their
+ * `scheme://host[:port]` form by the config schema, or the single entry `"*"`
+ * to admit every origin.
+ */
+
+/** The `ai.ask.cors` entry that admits every origin. */
+export const ANY_ORIGIN = "*";
+
+/** The headers a response carries for a cross-origin caller. */
+export interface CorsHeaders {
+  "access-control-allow-origin"?: string;
+  vary?: string;
+}
+
+/** The response headers that name the caller's origin when `allowed` lists it. */
+export const corsHeaders = (
+  request: Request,
+  allowed: readonly string[]
+): CorsHeaders => {
+  if (allowed.includes(ANY_ORIGIN)) {
+    // A wildcard answer is the same for every caller, so nothing to vary on.
+    return { "access-control-allow-origin": ANY_ORIGIN };
+  }
+  // `Vary` rides on both branches: the answer depends on `Origin` whether or
+  // not it was listed, so a shared cache never hands one origin's response
+  // (or the header-less one) to another.
+  const origin = request.headers.get("origin");
+  return origin && allowed.includes(origin)
+    ? { "access-control-allow-origin": origin, vary: "origin" }
+    : { vary: "origin" };
+};
+
+/** Answer the browser's `OPTIONS` preflight for the route. */
+export const preflightResponse = (
+  request: Request,
+  allowed: readonly string[]
+): Response =>
+  new Response(null, {
+    headers: {
+      ...corsHeaders(request, allowed),
+      // Reflect whatever the caller's fetch wrapper asks to send, falling back
+      // to the JSON POST's own `content-type`; a listed origin shouldn't need
+      // an eject to add a header of its own.
+      "access-control-allow-headers":
+        request.headers.get("access-control-request-headers") ?? "content-type",
+      "access-control-allow-methods": "POST",
+      "access-control-max-age": "86400",
+    },
+    status: 204,
+  });
+
+/** The slice of Astro's `APIContext` the wrapped handler reads. */
+interface RequestContext {
+  request: Request;
+}
+
+/** Stamp the CORS headers on every response `handler` returns. */
+export const withCors =
+  (
+    allowed: readonly string[],
+    handler: (context: RequestContext) => Promise<Response> | Response
+  ): ((context: RequestContext) => Promise<Response>) =>
+  async (context) => {
+    const response = await handler(context);
+    for (const [key, value] of Object.entries(
+      corsHeaders(context.request, allowed)
+    )) {
+      // `Vary` accumulates (the handler may already vary on something), the
+      // rest replace.
+      if (key === "vary") {
+        response.headers.append(key, value);
+      } else {
+        response.headers.set(key, value);
+      }
+    }
+    return response;
+  };

package/src/ai/link-headers.ts

@@ -1,5 +1,10 @@
 import { normalizeBasePath } from "../core/base-path.ts";
 import type { ResolvedConfig } from "../core/schema.ts";
+import {
+  AI_CATALOG_PATH,
+  AI_CATALOG_TYPE,
+  hasAiCatalog,
+} from "./ai-catalog.ts";
 import { API_CATALOG_PATH, hasApiCatalog } from "./api-catalog.ts";
 import { OPENAPI_PATH } from "./api/paths.ts";
 
@@ -37,6 +42,13 @@ export const buildHomeLinkHeader = (
       `<${deployBase}${API_CATALOG_PATH}>; rel="api-catalog"; type="application/linkset+json"`
     );
   }
+  // The ai-catalog spec's own relation for its well-known document, the
+  // header form of the `<link rel="ai-catalog">` every page carries.
+  if (hasAiCatalog(config)) {
+    links.push(
+      `<${deployBase}${AI_CATALOG_PATH}>; rel="ai-catalog"; type="${AI_CATALOG_TYPE}"`
+    );
+  }
   // RFC 8631: `service-desc` is the relation for a machine-readable
   // description of the service — the JSON docs API's OpenAPI document.
   if (config.ai.api) {

package/src/ai/llms.ts

@@ -6,6 +6,7 @@ import { absoluteUrl } from "../core/site-url.ts";
 import { readExpandedEntryText } from "../core/sources/read.ts";
 import type { NavNode, Navigation, PageRecord } from "../core/types.ts";
 import { buildRssFeeds } from "../deploy/rss.ts";
+import { AI_CATALOG_PATH, hasAiCatalog } from "./ai-catalog.ts";
 import { API_CATALOG_PATH, hasApiCatalog } from "./api-catalog.ts";
 import { API_PAGES_PATH, OPENAPI_PATH } from "./api/paths.ts";
 import { downlevelComponents } from "./component-markdown.ts";
@@ -75,6 +76,11 @@ const agentResourceLines = (project: BlumeProject): string[] => {
       `- [API catalog](${url(API_CATALOG_PATH)}): RFC 9727 linkset of the APIs documented here.`
     );
   }
+  if (hasAiCatalog(config)) {
+    lines.push(
+      `- [AI catalog](${url(AI_CATALOG_PATH)}): ARD manifest of the agent-facing resources on this site (MCP server, skills, APIs).`
+    );
+  }
   if (config.seo.agentReadability) {
     lines.push(
       `- [agent-readability.json](${url("/agent-readability.json")}): Manifest of every agent-facing artifact on this site.`

package/src/ai/mcp/discovery.ts

@@ -56,7 +56,7 @@ const truncate = (text: string): string =>
 const NON_ASCII_SLUG = /[^a-z0-9]+/gu;
 const COMBINING_MARKS = /\p{M}+/gu;
 
-const asciiSlugify = (text: string): string =>
+export const asciiSlugify = (text: string): string =>
   trimChar(
     text
       .normalize("NFKD")

package/src/astro/generate.ts

@@ -24,6 +24,7 @@ import {
 } from "pathe";
 import { glob } from "tinyglobby";
 
+import { hasAiCatalog } from "../ai/ai-catalog.ts";
 import { OPENAPI_PATH } from "../ai/api/paths.ts";
 import { buildApiSpec } from "../ai/api/spec.ts";
 import { buildAskData } from "../ai/ask-data.ts";
@@ -1357,6 +1358,7 @@ export const buildRuntimeData = (project: BlumeProject): string => {
       description: config.description,
       discovery: {
         agentReadability: config.seo.agentReadability,
+        aiCatalog: hasAiCatalog(config),
         api: config.ai.api,
         llmsTxt: config.ai.llmsTxt.enabled,
         // Mirrors `buildSitemapFiles`: no site, no sitemap.
@@ -1826,7 +1828,9 @@ const writeAskFiles = async (
   await write(
     join(srcDir, "pages", "api", "ask.ts"),
     askEndpointTemplate(resolveAskBackend(ask), grounded, {
+      cors: ask.cors,
       instructions: ask.instructions,
+      reasoning: ask.reasoning,
       retrieval: ask.retrieval,
     })
   );

package/src/astro/templates.ts

@@ -9,7 +9,7 @@ import type { AskBackend } from "../ai/ask.ts";
 import { buildHomeLinkHeader } from "../ai/link-headers.ts";
 import { normalizeBasePath } from "../core/base-path.ts";
 import { TOC_HIDDEN_KEY } from "../core/heading-markers.ts";
-import type { ResolvedConfig } from "../core/schema.ts";
+import type { AskReasoning, ResolvedConfig } from "../core/schema.ts";
 import { BLUME_IGNORE_DIRS } from "../core/sources/watch.ts";
 import { trimChar } from "../core/trim.ts";
 import type { ProjectContext } from "../core/types.ts";
@@ -1040,12 +1040,58 @@ const ASK_FALLBACK_PROMPT =
 
 /** The `ai.ask` values the generated endpoint has to carry with it. */
 export interface AskEndpointOptions {
+  /** `ai.ask.cors` — origins allowed to call the route from another site. */
+  cors?: string[];
   /** `ai.ask.instructions` — extra system-prompt text. */
   instructions?: string;
+  /**
+   * `ai.ask.reasoning` — how much the model reasons before answering, sent
+   * as the backend's own reasoning-effort control.
+   */
+  reasoning?: AskReasoning;
   /** `ai.ask.retrieval` — how much documentation each question carries. */
   retrieval?: AskRetrievalOptions;
 }
 
+/** The pieces `askEndpointTemplate` splices in for `ai.ask.cors`. */
+interface AskCorsTemplate {
+  /** The route's closing token: `});` when the POST is wrapped, `};` otherwise. */
+  close: string;
+  /** The runtime import, when anything is listed. */
+  imports: string[];
+  /** The opening of `export const POST: APIRoute = `. */
+  open: string;
+  /** The allow list and the `OPTIONS` handler, spliced after the provider setup. */
+  setup: string;
+}
+
+/**
+ * `ai.ask.cors`: a browser only lets another origin read the stream when the
+ * response names that origin, and a JSON POST preflights first, so the route
+ * answers `OPTIONS` and wraps the `POST` in `withCors`, which stamps a listed
+ * origin on every response — errors included, so a cross-origin caller can
+ * tell a 400 from a 500 — without each `return` having to remember to.
+ * Unlisted origins get no allow header and stay subject to the same-origin
+ * rule. Left out entirely when nothing is listed, so the default route is
+ * unchanged.
+ */
+const askCorsTemplate = (cors: readonly string[] = []): AskCorsTemplate =>
+  cors.length > 0
+    ? {
+        close: "});",
+        imports: [
+          'import { preflightResponse, withCors } from "blume/ai/cors.ts";',
+        ],
+        open: "withCors(ALLOWED_ORIGINS, async ({ request }) => {",
+        setup: `
+const ALLOWED_ORIGINS = ${JSON.stringify(cors)};
+
+export const OPTIONS: APIRoute = ({ request }) =>
+  preflightResponse(request, ALLOWED_ORIGINS);
+`,
+      }
+    : { close: "};", imports: [], open: "async ({ request }) => {", setup: "" };
+
 /**
  * Generate the Ask AI server endpoint (`.blume/src/pages/api/ask.ts`).
  *
@@ -1053,15 +1099,24 @@ export interface AskEndpointOptions {
  * built-in prompt on every path: the grounded prompt via `createAskContext`,
  * and the plain fallback here. `options.retrieval` (the `ai.ask.retrieval`
  * config) is forwarded to `createAskContext` on the grounded path, where it
- * sizes retrieval. Both travel in one options object so a new call site can't
- * silently drop one of them.
+ * sizes retrieval. `options.reasoning` (the `ai.ask.reasoning` config)
+ * reaches the model call on both paths. `options.cors` (the `ai.ask.cors`
+ * config) adds a preflight handler and wraps the `POST` so every response
+ * names a listed origin. All four travel in one options object so a new call
+ * site can't silently drop one of them.
  */
 export const askEndpointTemplate = (
   backend: AskBackend,
   grounded: boolean,
   options?: AskEndpointOptions
 ): string => {
-  const instructions = options?.instructions;
+  const { instructions, reasoning, retrieval } = options ?? {};
+  // `ai.ask.reasoning`. The gateway and OpenAI-compatible providers take it
+  // from `streamText`'s top-level `reasoning` (the gateway maps it to the
+  // model's own control, the OpenAI-compatible provider sends it as
+  // `reasoning_effort`). OpenRouter's provider ignores that call option and
+  // only reads its own model setting, so there the level rides on the model
+  // as `reasoning.effort`. Omitted keeps the provider default on every path.
   const fallbackPrompt = instructions
     ? `${ASK_FALLBACK_PROMPT}\n\n${instructions}`
     : ASK_FALLBACK_PROMPT;
@@ -1097,7 +1152,10 @@ export const askEndpointTemplate = (
     setup = `\nconst openrouter = createOpenRouter({
   apiKey: getSecret(${JSON.stringify(backend.apiKeyEnv)}),${headersField}
 });\n`;
-    modelExpr = `openrouter(${JSON.stringify(backend.model)})`;
+    const settings = reasoning
+      ? `, { reasoning: { effort: ${JSON.stringify(reasoning)} } }`
+      : "";
+    modelExpr = `openrouter(${JSON.stringify(backend.model)}${settings})`;
   } else if (backend.kind === "openai-compatible") {
     imports.push(
       'import { createOpenAICompatible } from "@ai-sdk/openai-compatible";'
@@ -1120,13 +1178,15 @@ export const askEndpointTemplate = (
     if (instructions) {
       groundFields.push(`instructions: ${JSON.stringify(instructions)}`);
     }
-    if (options?.retrieval) {
-      groundFields.push(`retrieval: ${JSON.stringify(options.retrieval)}`);
+    if (retrieval) {
+      groundFields.push(`retrieval: ${JSON.stringify(retrieval)}`);
     }
     const groundOptions =
       groundFields.length > 0 ? `, { ${groundFields.join(", ")} }` : "";
     setup += `\nconst ground = createAskContext(askData${groundOptions});\n`;
   }
+  const cors = askCorsTemplate(options?.cors);
+  imports.push(...cors.imports);
   // Validate the client-supplied body and cap its size. The endpoint is
   // unauthenticated, so bounding message count/length limits how much a caller
   // can spend against the model per request, and restricting roles to
@@ -1183,24 +1243,29 @@ export const askEndpointTemplate = (
   const onError = `      onError({ error }) {
         console.error("Ask AI provider error:", error);
       },`;
+  // The `streamText` argument list, built once so the grounded and plain
+  // paths can't drift: they differ only in where the instructions come from.
+  const streamFields = [
+    `model: ${modelExpr}`,
+    grounded
+      ? "instructions"
+      : `instructions:\n        ${JSON.stringify(fallbackPrompt)}`,
+    "messages",
+  ];
+  if (reasoning && backend.kind !== "openrouter") {
+    streamFields.push(`reasoning: ${JSON.stringify(reasoning)}`);
+  }
+  const call = `    const result = streamText({
+      ${streamFields.join(",\n      ")},
+${onError}
+    });`;
   const stream = grounded
     ? `    const instructions =
       (await ground(messages, body.page)) ??
       ${JSON.stringify(fallbackPrompt)};
-    const result = streamText({
-      model: ${modelExpr},
-      instructions,
-      messages,
-${onError}
-    });`
-    : `    const result = streamText({
-      model: ${modelExpr},
-      instructions:
-        ${JSON.stringify(fallbackPrompt)},
-      messages,
-${onError}
-    });`;
-  const handler = `export const POST: APIRoute = async ({ request }) => {
+${call}`
+    : call;
+  const handler = `export const POST: APIRoute = ${cors.open}
 ${validate}
 ${keyCheck}
   try {
@@ -1209,12 +1274,12 @@ ${stream}
   } catch {
     return new Response("Failed to generate a response.", { status: 500 });
   }
-};`;
+${cors.close}`;
   return `// Generated by Blume. Do not edit.
 ${imports.join("\n")}
 
 export const prerender = false;
-${setup}
+${setup}${cors.setup}
 ${handler}
 `;
 };

package/src/cli/commands/build.ts

@@ -5,6 +5,7 @@ import { build } from "astro";
 import { defineCommand } from "citty";
 import { join } from "pathe";
 
+import { crossOriginDiscoveryPaths } from "../../ai/ai-catalog.ts";
 import {
   API_CATALOG_PATH,
   API_CATALOG_TYPE,
@@ -128,7 +129,8 @@ const emitVercelNegotiation = async (
     {
       json: existsSync(join(staticDir, "404.json")),
       markdown: existsSync(join(staticDir, "404.md")),
-    }
+    },
+    crossOriginDiscoveryPaths(config)
   );
   if (injected === null) {
     logger.warn(