From 5fad27c38bdd6566009c36dcf9dbadbb3c106ae6 Mon Sep 17 00:00:00 2001
From: Gorka <gorka@aquigorka.com>
Date: Wed, 29 Jul 2026 18:49:30 -0300
Subject: [PATCH] fix(cors): allow X-Client-Name/X-Client-Version so browser
 RPC preflight passes (release 0.9.17)

stellar-sdk sends X-Client-Name/X-Client-Version on RPC calls; production CORS
omitted them, so the browser blocked /api/v1/rpc preflight and getAccount failed
as 'Account not found'. Add them to Access-Control-Allow-Headers.
---
 deno.json                   | 2 +-
 src/http/middleware/cors.ts | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/deno.json b/deno.json
index f4adb30..18db98c 100644
--- a/deno.json
+++ b/deno.json
@@ -1,6 +1,6 @@
 {
   "name": "@moonlight-protocol/provider-platform",
-  "version": "0.9.16",
+  "version": "0.9.17",
   "license": "MIT",
   "exports": "./src/main.ts",
   "tasks": {
diff --git a/src/http/middleware/cors.ts b/src/http/middleware/cors.ts
index 543b16e..6a54c3d 100644
--- a/src/http/middleware/cors.ts
+++ b/src/http/middleware/cors.ts
@@ -27,7 +27,7 @@ function setCorsHeaders(ctx: Context, origin: string) {
     "Access-Control-Allow-Headers",
     MODE === "development"
       ? "*"
-      : "Content-Type, Authorization, Traceparent, Tracestate",
+      : "Content-Type, Authorization, Traceparent, Tracestate, X-Client-Name, X-Client-Version",
   );
   ctx.response.headers.set("Access-Control-Max-Age", "86400");
 }