@lovable.dev/mcp-js 0.5.1 → 0.6.0

package/dist/{chunk-DDF63QWG.js → chunk-K2T4WTKX.js}

@@ -1,25 +1,24 @@
 import {
   JSON_HEADERS,
+  corsPreflightResponse,
   getOAuthRuntime,
   headResponse,
   methodNotAllowed,
   oauthConfigurationErrorResponse,
-  resolveProtectedResource
-} from "./chunk-XEDRJFAR.js";
+  resolveProtectedResource,
+  withCors
+} from "./chunk-ZKKLOL2C.js";
 
 // src/protocols/oauth-metadata.ts
-var CORS_ORIGIN = { "Access-Control-Allow-Origin": "*" };
-function withCors(response) {
-  response.headers.set("Access-Control-Allow-Origin", "*");
-  return response;
-}
 function notFound() {
-  return new Response(JSON.stringify({ error: "not found" }), {
-    status: 404,
-    // `no-store` so a 404 (OAuth unconfigured) isn't heuristically cached and
-    // then served past a later deploy that enables OAuth and starts returning 200.
-    headers: { ...JSON_HEADERS, ...CORS_ORIGIN, "Cache-Control": "no-store" }
-  });
+  return withCors(
+    new Response(JSON.stringify({ error: "not found" }), {
+      status: 404,
+      // `no-store` so a 404 (OAuth unconfigured) isn't heuristically cached and
+      // then served past a later deploy that enables OAuth and starts returning 200.
+      headers: { ...JSON_HEADERS, "Cache-Control": "no-store" }
+    })
+  );
 }
 async function buildProtectedResourceMetadata(mcp, auth, request, options, discovery) {
   const issuer = await discovery.resolveIssuer();
@@ -44,17 +43,12 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
   return async (request) => {
     if (runtime.kind !== "configured" || runtime.auth.protectedResourceMetadataUrl !== void 0)
       return notFound();
-    if (request.method === "OPTIONS") {
-      return new Response(null, {
-        status: 204,
-        headers: { ...CORS_ORIGIN, "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS" }
-      });
-    }
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("GET, HEAD, OPTIONS");
     if (request.method !== "GET" && request.method !== "HEAD")
       return withCors(methodNotAllowed("GET, HEAD, OPTIONS"));
     const headers = {
       ...JSON_HEADERS,
-      ...CORS_ORIGIN,
       "Cache-Control": "public, max-age=300",
       Vary: "Host"
     };
@@ -66,7 +60,7 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
         runtime.options,
         runtime.discovery
       );
-      const response = Response.json(metadata, { headers });
+      const response = withCors(Response.json(metadata, { headers }));
       return request.method === "HEAD" ? headResponse(response) : response;
     } catch {
       const response = withCors(oauthConfigurationErrorResponse());

package/dist/{chunk-GLG5RZGE.js → chunk-NJ5WBRYI.js}

@@ -2,8 +2,10 @@ import {
   ToolContext
 } from "./chunk-MA5H6PSF.js";
 import {
-  createRequestAuthorizer
-} from "./chunk-XEDRJFAR.js";
+  corsPreflightResponse,
+  createRequestAuthorizer,
+  withCors
+} from "./chunk-ZKKLOL2C.js";
 
 // src/protocols/mcp/protocol.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -25,7 +27,7 @@ function adaptToolToSdkCallback(tool, auth) {
 }
 function createMcpProtocolHandler(mcp, options = {}) {
   const authorizer = createRequestAuthorizer(mcp, options);
-  return async (request) => {
+  const handle = async (request) => {
     const authResult = await authorizer.authorize(request);
     if (!authResult.ok)
       return authResult.response;
@@ -59,6 +61,11 @@ function createMcpProtocolHandler(mcp, options = {}) {
       );
     }
   };
+  return async (request) => {
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("GET, POST, DELETE, OPTIONS");
+    return withCors(await handle(request));
+  };
 }
 
 export {

package/dist/{chunk-VD6CS7Y6.js → chunk-SYI32IRK.js}

@@ -4,10 +4,12 @@ import {
 import {
   JSON_HEADERS,
   assertRestResourceBinding,
+  corsPreflightResponse,
   createRequestAuthorizer,
   headResponse,
-  methodNotAllowed
-} from "./chunk-XEDRJFAR.js";
+  methodNotAllowed,
+  withCors
+} from "./chunk-ZKKLOL2C.js";
 
 // src/protocols/rest/list-tools.ts
 import { objectFromShape } from "@modelcontextprotocol/sdk/server/zod-compat.js";
@@ -24,12 +26,12 @@ function shapeToJsonSchema(shape) {
 function createListToolsHandler(mcp, options = {}) {
   assertRestResourceBinding(mcp, options);
   const authorizer = createRequestAuthorizer(mcp, options);
-  return async (request) => {
+  const handle = async (request) => {
     const authResult = await authorizer.authorize(request);
     if (!authResult.ok)
       return authResult.response;
     if (request.method !== "GET" && request.method !== "HEAD")
-      return methodNotAllowed("GET, HEAD");
+      return methodNotAllowed("GET, HEAD, OPTIONS");
     const body = {
       server: { name: mcp.name, version: mcp.version, title: mcp.title },
       tools: mcp.tools.map((tool) => ({
@@ -44,6 +46,11 @@ function createListToolsHandler(mcp, options = {}) {
     const response = Response.json(body);
     return request.method === "HEAD" ? headResponse(response) : response;
   };
+  return async (request) => {
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("GET, HEAD, OPTIONS");
+    return withCors(await handle(request));
+  };
 }
 
 // src/protocols/rest/invoke-tool.ts
@@ -63,12 +70,12 @@ function isEmptyArgs(value) {
 function createInvokeToolHandler(mcp, options = {}) {
   assertRestResourceBinding(mcp, options);
   const authorizer = createRequestAuthorizer(mcp, options);
-  return async (request, toolName) => {
+  const handle = async (request, toolName) => {
     const authResult = await authorizer.authorize(request);
     if (!authResult.ok)
       return authResult.response;
     if (request.method !== "POST")
-      return methodNotAllowed("POST");
+      return methodNotAllowed("POST, OPTIONS");
     const tool = mcp.tools.find((t) => t.name === toolName);
     if (!tool) {
       return new Response(JSON.stringify({ error: `unknown tool: ${safeReflectName(toolName)}` }), {
@@ -136,6 +143,11 @@ function createInvokeToolHandler(mcp, options = {}) {
       isError: result.isError
     });
   };
+  return async (request, toolName) => {
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("POST, OPTIONS");
+    return withCors(await handle(request, toolName));
+  };
 }
 
 export {

package/dist/{chunk-XEDRJFAR.js → chunk-ZKKLOL2C.js}

@@ -359,6 +359,26 @@ function createRequestAuthorizer(mcp, options = {}) {
   };
 }
 
+// src/core/cors.ts
+var EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
+var ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
+function withCors(response) {
+  response.headers.set("Access-Control-Allow-Origin", "*");
+  response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
+  return response;
+}
+function corsPreflightResponse(allowMethods) {
+  return new Response(null, {
+    status: 204,
+    headers: {
+      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Methods": allowMethods,
+      "Access-Control-Allow-Headers": ALLOW_HEADERS,
+      "Access-Control-Max-Age": "86400"
+    }
+  });
+}
+
 export {
   JSON_HEADERS,
   headResponse,
@@ -367,5 +387,7 @@ export {
   oauthConfigurationErrorResponse,
   getOAuthRuntime,
   assertRestResourceBinding,
-  createRequestAuthorizer
+  createRequestAuthorizer,
+  withCors,
+  corsPreflightResponse
 };

package/dist/protocols/mcp/index.cjs

@@ -446,6 +446,26 @@ var ToolContext = class {
   }
 };
 
+// src/core/cors.ts
+var EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
+var ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
+function withCors(response) {
+  response.headers.set("Access-Control-Allow-Origin", "*");
+  response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
+  return response;
+}
+function corsPreflightResponse(allowMethods) {
+  return new Response(null, {
+    status: 204,
+    headers: {
+      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Methods": allowMethods,
+      "Access-Control-Allow-Headers": ALLOW_HEADERS,
+      "Access-Control-Max-Age": "86400"
+    }
+  });
+}
+
 // src/protocols/mcp/protocol.ts
 function adaptToolToSdkCallback(tool, auth) {
   return async (first) => {
@@ -464,7 +484,7 @@ function adaptToolToSdkCallback(tool, auth) {
 }
 function createMcpProtocolHandler(mcp, options = {}) {
   const authorizer = createRequestAuthorizer(mcp, options);
-  return async (request) => {
+  const handle = async (request) => {
     const authResult = await authorizer.authorize(request);
     if (!authResult.ok)
       return authResult.response;
@@ -498,6 +518,11 @@ function createMcpProtocolHandler(mcp, options = {}) {
       );
     }
   };
+  return async (request) => {
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("GET, POST, DELETE, OPTIONS");
+    return withCors(await handle(request));
+  };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/protocols/mcp/index.js

@@ -1,8 +1,8 @@
 import {
   createMcpProtocolHandler
-} from "../../chunk-GLG5RZGE.js";
+} from "../../chunk-NJ5WBRYI.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-XEDRJFAR.js";
+import "../../chunk-ZKKLOL2C.js";
 import "../../chunk-QA3FWDUV.js";
 import "../../chunk-6DXGZZA4.js";
 export {

package/dist/protocols/oauth-metadata.cjs

@@ -317,20 +317,37 @@ function getOAuthRuntime(mcp, options = {}) {
   };
 }
 
-// src/protocols/oauth-metadata.ts
-var CORS_ORIGIN = { "Access-Control-Allow-Origin": "*" };
+// src/core/cors.ts
+var EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
+var ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
 function withCors(response) {
   response.headers.set("Access-Control-Allow-Origin", "*");
+  response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
   return response;
 }
-function notFound() {
-  return new Response(JSON.stringify({ error: "not found" }), {
-    status: 404,
-    // `no-store` so a 404 (OAuth unconfigured) isn't heuristically cached and
-    // then served past a later deploy that enables OAuth and starts returning 200.
-    headers: { ...JSON_HEADERS, ...CORS_ORIGIN, "Cache-Control": "no-store" }
+function corsPreflightResponse(allowMethods) {
+  return new Response(null, {
+    status: 204,
+    headers: {
+      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Methods": allowMethods,
+      "Access-Control-Allow-Headers": ALLOW_HEADERS,
+      "Access-Control-Max-Age": "86400"
+    }
   });
 }
+
+// src/protocols/oauth-metadata.ts
+function notFound() {
+  return withCors(
+    new Response(JSON.stringify({ error: "not found" }), {
+      status: 404,
+      // `no-store` so a 404 (OAuth unconfigured) isn't heuristically cached and
+      // then served past a later deploy that enables OAuth and starts returning 200.
+      headers: { ...JSON_HEADERS, "Cache-Control": "no-store" }
+    })
+  );
+}
 async function buildProtectedResourceMetadata(mcp, auth, request, options, discovery) {
   const issuer = await discovery.resolveIssuer();
   const body = {
@@ -354,17 +371,12 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
   return async (request) => {
     if (runtime.kind !== "configured" || runtime.auth.protectedResourceMetadataUrl !== void 0)
       return notFound();
-    if (request.method === "OPTIONS") {
-      return new Response(null, {
-        status: 204,
-        headers: { ...CORS_ORIGIN, "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS" }
-      });
-    }
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("GET, HEAD, OPTIONS");
     if (request.method !== "GET" && request.method !== "HEAD")
       return withCors(methodNotAllowed("GET, HEAD, OPTIONS"));
     const headers = {
       ...JSON_HEADERS,
-      ...CORS_ORIGIN,
       "Cache-Control": "public, max-age=300",
       Vary: "Host"
     };
@@ -376,7 +388,7 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
         runtime.options,
         runtime.discovery
       );
-      const response = Response.json(metadata, { headers });
+      const response = withCors(Response.json(metadata, { headers }));
       return request.method === "HEAD" ? headResponse(response) : response;
     } catch {
       const response = withCors(oauthConfigurationErrorResponse());

package/dist/protocols/oauth-metadata.js

@@ -1,7 +1,7 @@
 import {
   createOAuthProtectedResourceMetadataHandler
-} from "../chunk-DDF63QWG.js";
-import "../chunk-XEDRJFAR.js";
+} from "../chunk-K2T4WTKX.js";
+import "../chunk-ZKKLOL2C.js";
 import "../chunk-QA3FWDUV.js";
 import "../chunk-6DXGZZA4.js";
 export {

package/dist/protocols/rest/index.cjs

@@ -421,6 +421,26 @@ function createRequestAuthorizer(mcp, options = {}) {
   };
 }
 
+// src/core/cors.ts
+var EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
+var ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
+function withCors(response) {
+  response.headers.set("Access-Control-Allow-Origin", "*");
+  response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
+  return response;
+}
+function corsPreflightResponse(allowMethods) {
+  return new Response(null, {
+    status: 204,
+    headers: {
+      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Methods": allowMethods,
+      "Access-Control-Allow-Headers": ALLOW_HEADERS,
+      "Access-Control-Max-Age": "86400"
+    }
+  });
+}
+
 // src/protocols/rest/list-tools.ts
 function shapeToJsonSchema(shape) {
   if (!shape)
@@ -434,12 +454,12 @@ function shapeToJsonSchema(shape) {
 function createListToolsHandler(mcp, options = {}) {
   assertRestResourceBinding(mcp, options);
   const authorizer = createRequestAuthorizer(mcp, options);
-  return async (request) => {
+  const handle = async (request) => {
     const authResult = await authorizer.authorize(request);
     if (!authResult.ok)
       return authResult.response;
     if (request.method !== "GET" && request.method !== "HEAD")
-      return methodNotAllowed("GET, HEAD");
+      return methodNotAllowed("GET, HEAD, OPTIONS");
     const body = {
       server: { name: mcp.name, version: mcp.version, title: mcp.title },
       tools: mcp.tools.map((tool) => ({
@@ -454,6 +474,11 @@ function createListToolsHandler(mcp, options = {}) {
     const response = Response.json(body);
     return request.method === "HEAD" ? headResponse(response) : response;
   };
+  return async (request) => {
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("GET, HEAD, OPTIONS");
+    return withCors(await handle(request));
+  };
 }
 
 // src/protocols/rest/invoke-tool.ts
@@ -518,12 +543,12 @@ function isEmptyArgs(value) {
 function createInvokeToolHandler(mcp, options = {}) {
   assertRestResourceBinding(mcp, options);
   const authorizer = createRequestAuthorizer(mcp, options);
-  return async (request, toolName) => {
+  const handle = async (request, toolName) => {
     const authResult = await authorizer.authorize(request);
     if (!authResult.ok)
       return authResult.response;
     if (request.method !== "POST")
-      return methodNotAllowed("POST");
+      return methodNotAllowed("POST, OPTIONS");
     const tool = mcp.tools.find((t) => t.name === toolName);
     if (!tool) {
       return new Response(JSON.stringify({ error: `unknown tool: ${safeReflectName(toolName)}` }), {
@@ -591,6 +616,11 @@ function createInvokeToolHandler(mcp, options = {}) {
       isError: result.isError
     });
   };
+  return async (request, toolName) => {
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("POST, OPTIONS");
+    return withCors(await handle(request, toolName));
+  };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/protocols/rest/index.js

@@ -1,9 +1,9 @@
 import {
   createInvokeToolHandler,
   createListToolsHandler
-} from "../../chunk-VD6CS7Y6.js";
+} from "../../chunk-SYI32IRK.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-XEDRJFAR.js";
+import "../../chunk-ZKKLOL2C.js";
 import "../../chunk-QA3FWDUV.js";
 import "../../chunk-6DXGZZA4.js";
 export {

package/dist/stacks/tanstack/index.cjs

@@ -466,6 +466,26 @@ var ToolContext = class {
   }
 };
 
+// src/core/cors.ts
+var EXPOSE_HEADERS = "WWW-Authenticate, Mcp-Session-Id, Mcp-Protocol-Version";
+var ALLOW_HEADERS = "Authorization, Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID";
+function withCors(response) {
+  response.headers.set("Access-Control-Allow-Origin", "*");
+  response.headers.set("Access-Control-Expose-Headers", EXPOSE_HEADERS);
+  return response;
+}
+function corsPreflightResponse(allowMethods) {
+  return new Response(null, {
+    status: 204,
+    headers: {
+      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Methods": allowMethods,
+      "Access-Control-Allow-Headers": ALLOW_HEADERS,
+      "Access-Control-Max-Age": "86400"
+    }
+  });
+}
+
 // src/protocols/mcp/protocol.ts
 function adaptToolToSdkCallback(tool, auth) {
   return async (first) => {
@@ -484,7 +504,7 @@ function adaptToolToSdkCallback(tool, auth) {
 }
 function createMcpProtocolHandler(mcp, options = {}) {
   const authorizer = createRequestAuthorizer(mcp, options);
-  return async (request) => {
+  const handle = async (request) => {
     const authResult = await authorizer.authorize(request);
     if (!authResult.ok)
       return authResult.response;
@@ -518,21 +538,23 @@ function createMcpProtocolHandler(mcp, options = {}) {
       );
     }
   };
+  return async (request) => {
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("GET, POST, DELETE, OPTIONS");
+    return withCors(await handle(request));
+  };
 }
 
 // src/protocols/oauth-metadata.ts
-var CORS_ORIGIN = { "Access-Control-Allow-Origin": "*" };
-function withCors(response) {
-  response.headers.set("Access-Control-Allow-Origin", "*");
-  return response;
-}
 function notFound() {
-  return new Response(JSON.stringify({ error: "not found" }), {
-    status: 404,
-    // `no-store` so a 404 (OAuth unconfigured) isn't heuristically cached and
-    // then served past a later deploy that enables OAuth and starts returning 200.
-    headers: { ...JSON_HEADERS, ...CORS_ORIGIN, "Cache-Control": "no-store" }
-  });
+  return withCors(
+    new Response(JSON.stringify({ error: "not found" }), {
+      status: 404,
+      // `no-store` so a 404 (OAuth unconfigured) isn't heuristically cached and
+      // then served past a later deploy that enables OAuth and starts returning 200.
+      headers: { ...JSON_HEADERS, "Cache-Control": "no-store" }
+    })
+  );
 }
 async function buildProtectedResourceMetadata(mcp, auth, request, options, discovery) {
   const issuer = await discovery.resolveIssuer();
@@ -557,17 +579,12 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
   return async (request) => {
     if (runtime.kind !== "configured" || runtime.auth.protectedResourceMetadataUrl !== void 0)
       return notFound();
-    if (request.method === "OPTIONS") {
-      return new Response(null, {
-        status: 204,
-        headers: { ...CORS_ORIGIN, "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS" }
-      });
-    }
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("GET, HEAD, OPTIONS");
     if (request.method !== "GET" && request.method !== "HEAD")
       return withCors(methodNotAllowed("GET, HEAD, OPTIONS"));
     const headers = {
       ...JSON_HEADERS,
-      ...CORS_ORIGIN,
       "Cache-Control": "public, max-age=300",
       Vary: "Host"
     };
@@ -579,7 +596,7 @@ function createOAuthProtectedResourceMetadataHandler(mcp, options = {}) {
         runtime.options,
         runtime.discovery
       );
-      const response = Response.json(metadata, { headers });
+      const response = withCors(Response.json(metadata, { headers }));
       return request.method === "HEAD" ? headResponse(response) : response;
     } catch {
       const response = withCors(oauthConfigurationErrorResponse());
@@ -603,12 +620,12 @@ function shapeToJsonSchema(shape) {
 function createListToolsHandler(mcp, options = {}) {
   assertRestResourceBinding(mcp, options);
   const authorizer = createRequestAuthorizer(mcp, options);
-  return async (request) => {
+  const handle = async (request) => {
     const authResult = await authorizer.authorize(request);
     if (!authResult.ok)
       return authResult.response;
     if (request.method !== "GET" && request.method !== "HEAD")
-      return methodNotAllowed("GET, HEAD");
+      return methodNotAllowed("GET, HEAD, OPTIONS");
     const body = {
       server: { name: mcp.name, version: mcp.version, title: mcp.title },
       tools: mcp.tools.map((tool) => ({
@@ -623,6 +640,11 @@ function createListToolsHandler(mcp, options = {}) {
     const response = Response.json(body);
     return request.method === "HEAD" ? headResponse(response) : response;
   };
+  return async (request) => {
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("GET, HEAD, OPTIONS");
+    return withCors(await handle(request));
+  };
 }
 
 // src/protocols/rest/invoke-tool.ts
@@ -642,12 +664,12 @@ function isEmptyArgs(value) {
 function createInvokeToolHandler(mcp, options = {}) {
   assertRestResourceBinding(mcp, options);
   const authorizer = createRequestAuthorizer(mcp, options);
-  return async (request, toolName) => {
+  const handle = async (request, toolName) => {
     const authResult = await authorizer.authorize(request);
     if (!authResult.ok)
       return authResult.response;
     if (request.method !== "POST")
-      return methodNotAllowed("POST");
+      return methodNotAllowed("POST, OPTIONS");
     const tool = mcp.tools.find((t) => t.name === toolName);
     if (!tool) {
       return new Response(JSON.stringify({ error: `unknown tool: ${safeReflectName(toolName)}` }), {
@@ -715,6 +737,11 @@ function createInvokeToolHandler(mcp, options = {}) {
       isError: result.isError
     });
   };
+  return async (request, toolName) => {
+    if (request.method === "OPTIONS")
+      return corsPreflightResponse("POST, OPTIONS");
+    return withCors(await handle(request, toolName));
+  };
 }
 
 // src/stacks/tanstack/handlers.ts

package/dist/stacks/tanstack/index.js

@@ -1,15 +1,15 @@
 import {
   createMcpProtocolHandler
-} from "../../chunk-GLG5RZGE.js";
+} from "../../chunk-NJ5WBRYI.js";
 import {
   createOAuthProtectedResourceMetadataHandler
-} from "../../chunk-DDF63QWG.js";
+} from "../../chunk-K2T4WTKX.js";
 import {
   createInvokeToolHandler,
   createListToolsHandler
-} from "../../chunk-VD6CS7Y6.js";
+} from "../../chunk-SYI32IRK.js";
 import "../../chunk-MA5H6PSF.js";
-import "../../chunk-XEDRJFAR.js";
+import "../../chunk-ZKKLOL2C.js";
 import "../../chunk-QA3FWDUV.js";
 import "../../chunk-6DXGZZA4.js";
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/mcp-js",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Author MCP servers for Lovable apps. Declare tools with defineTool, register them in defineMcp, and the framework adapter (TanStack today, Supabase Edge Functions next) emits the route(s) at build time.",
   "type": "module",
   "repository": {