From c36a50e2f0f243f573f2da71effedaea677313d4 Mon Sep 17 00:00:00 2001
From: Nate Moore <natemoo-re@users.noreply.github.com>
Date: Sat, 4 Apr 2026 22:16:27 -0400
Subject: [PATCH] fix(examples): add corp header (#33)

* fix(corp): add corp header

* fix(preview): add wrangler to package
---
 astro.config.mjs                               | 5 +++--
 package.json                                   | 3 ++-
 pnpm-lock.yaml                                 | 3 +++
 public/_headers                                | 3 ++-
 router/src/index.ts                            | 3 ++-
 src/components/WebContainer/WebContainer.astro | 2 +-
 6 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/astro.config.mjs b/astro.config.mjs
index 49c2672..a4d9502 100644
--- a/astro.config.mjs
+++ b/astro.config.mjs
@@ -14,8 +14,9 @@ export default defineConfig({
 	outDir: "./dist/docs/",
 	server: {
 		headers: {
-			'Cross-Origin-Embedder-Policy': 'credentialless',
-			'Cross-Origin-Opener-Policy': 'same-origin'
+			'Cross-Origin-Embedder-Policy': 'require-corp',
+			'Cross-Origin-Opener-Policy': 'same-origin',
+			'Cross-Origin-Resource-Policy': 'cross-origin'
 		}
 	},
 	integrations: [
diff --git a/package.json b/package.json
index d0e1506..be80e0a 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,8 @@
     "starlight-sidebar-topics": "^0.6.2"
   },
   "devDependencies": {
-    "tinyexec": "^1.0.2"
+    "tinyexec": "^1.0.2",
+    "wrangler": "^4.14.4"
   },
   "pnpm": {
     "onlyBuiltDependencies": [
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 147fce5..ce5be6c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -54,6 +54,9 @@ importers:
       tinyexec:
         specifier: ^1.0.2
         version: 1.0.2
+      wrangler:
+        specifier: ^4.14.4
+        version: 4.80.0(@cloudflare/workers-types@4.20260405.1)
 
   router:
     devDependencies:
diff --git a/public/_headers b/public/_headers
index 2a351fb..458cae3 100644
--- a/public/_headers
+++ b/public/_headers
@@ -1,3 +1,4 @@
 /*
-  Cross-Origin-Embedder-Policy: credentialless
+  Cross-Origin-Embedder-Policy: require-corp
   Cross-Origin-Opener-Policy: same-origin
+  Cross-Origin-Resource-Policy: cross-origin
diff --git a/router/src/index.ts b/router/src/index.ts
index 74e783d..3a47d6d 100644
--- a/router/src/index.ts
+++ b/router/src/index.ts
@@ -7,8 +7,9 @@ export default {
 		if (url.pathname.startsWith("/docs")) {
 			const response = await fetch(new URL(url.pathname, "https://docs.bomb.sh/"));
 			const headers = new Headers(response.headers);
-			headers.set("Cross-Origin-Embedder-Policy", "credentialless");
+			headers.set("Cross-Origin-Embedder-Policy", "require-corp");
 			headers.set("Cross-Origin-Opener-Policy", "same-origin");
+			headers.set("Cross-Origin-Resource-Policy", "cross-origin");
 			return new Response(response.body, {
 				status: response.status,
 				statusText: response.statusText,
diff --git a/src/components/WebContainer/WebContainer.astro b/src/components/WebContainer/WebContainer.astro
index a775af1..dca9ff8 100644
--- a/src/components/WebContainer/WebContainer.astro
+++ b/src/components/WebContainer/WebContainer.astro
@@ -20,7 +20,7 @@ const { name } = Astro.props;
   let bootError: string | null = null;
 
   try {
-    host = await WebContainer.boot({ coep: 'credentialless', workdirName: 'demo' });
+    host = await WebContainer.boot({ coep: 'require-corp', workdirName: 'demo' });
     const base = (import.meta.env.BASE_URL || '/').replace(/\/?$/, '');
     const snapshotUrl = `${base}/snapshot`;
     const snapshotResponse = await fetch(snapshotUrl);
-- 
2.51.2