From 7d5426d95a10623d6d786c880608efe960fea0b4 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 5 Jul 2026 14:26:03 +0000
Subject: [PATCH] =?UTF-8?q?feat(kbdb):=20CORS=20=E6=94=BE=E8=A1=8C?=
 =?UTF-8?q?=E7=80=8F=E8=A6=BD=E5=99=A8=20GET=20=E8=AE=80=E5=8F=96(leo=20?=
 =?UTF-8?q?=E5=90=8C=E6=84=8F,mindset=20=C2=A76)=E2=80=94=E2=80=94mira=20?=
 =?UTF-8?q?=E5=A4=A7=E7=9C=BE=E5=8C=96=E8=AA=9E=E7=BE=A9=E6=90=9C=E5=B0=8B?=
 =?UTF-8?q?=E5=89=8D=E5=8F=B0=E5=8F=AF=E7=9B=B4=E8=AE=80=20KBDB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- hono/cors: origin:'*' 只 GET+OPTIONS(讀),不開跨源寫入
- 過渡:worker 現裸開無 auth;正路走 cypher-proxy(mira §1.7)
---
 kbdb/src/index.ts | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/kbdb/src/index.ts b/kbdb/src/index.ts
index f2095ed..7e48bbf 100644
--- a/kbdb/src/index.ts
+++ b/kbdb/src/index.ts
@@ -4,6 +4,7 @@
 // Base = D1 only (free, no credit card): entries / templates / records + LIKE search + recipe-stats.
 // Optional modules (NOT in this base): embed (Vectorize+AI binding, semantic search), triplet (separate repo).
 import { Hono } from 'hono';
+import { cors } from 'hono/cors';
 import type { Bindings } from './types';
 import { entryRoutes } from './routes/entries';
 import { templateRoutes } from './routes/templates';
@@ -13,6 +14,13 @@ import { embedRoutes } from './routes/embed';
 
 const app = new Hono<{ Bindings: Bindings }>();
 
+// CORS（leo 2026-07-05 明示同意；arcrun mindset §6「暴露資料要人類明示同意」）：
+// 讓瀏覽器（mira 前台 mira.uncle6.me 等）能「讀」KBDB 做大眾化語義搜尋。
+// 只放行 GET 跨源讀取（+ OPTIONS preflight）；不開 POST/寫入跨源——寫入本就裸開，
+// 但不讓任意瀏覽器 origin 直接寫進 KBDB。origin:'*' 涵蓋 leo 之後 DNS 指向的任何網域。
+// 正路是走 cypher-proxy（有 auth，mira §1.7）；此為過渡（worker 現本就裸開無 auth）。
+app.use('*', cors({ origin: '*', allowMethods: ['GET', 'OPTIONS'], allowHeaders: ['Content-Type'] }));
+
 app.get('/', (c) => c.json({ service: 'arcrun-kbdb', tier: 'base', status: 'ok' }));
 app.get('/health', (c) => c.json({ ok: true }));