@exposify/next 0.0.2 → 0.0.3

package/README.md

@@ -6,7 +6,7 @@ your own app.
 
 ```sh
 npm install @exposify/next
-npx exposify-next setup   # pick the endpoints, get the route file to create
+npx @exposify/next setup   # pick the endpoints, get the route file to create
 ```
 
 Or by hand, in two files:
@@ -32,7 +32,7 @@ export { handler as GET, handler as POST, handler as DELETE };
 build` starts, and keeps it current in dev as route files change. It holds
 the route table, your Server Actions, your docs (`README.md`, `docs/**/*.md`) for `search_docs`,
 and `exposify.descriptions.json`'s texts, so nothing is read from disk at
-runtime. Commit it or ignore it; `npx exposify-next generate` writes it too.
+runtime. Commit it or ignore it; `npx @exposify/next generate` writes it too.
 
 ## Which routes become tools
 
@@ -79,6 +79,22 @@ it. The MCP client's address and host are forwarded as
 - **Vercel Deployment Protection** blocks those requests on protected
   previews: set `VERCEL_AUTOMATION_BYPASS_SECRET` (Vercel's "Protection
   Bypass for Automation") and it's sent as `x-vercel-protection-bypass`.
+  Without it, a tool call fails with an error that says so. An MCP client
+  outside Vercel reaches a protected preview with
+  `?x-vercel-protection-bypass=<secret>` on the MCP URL.
+- **The agent's address:** some hosts (Vercel) replace `x-forwarded-for` on
+  these requests with their own. Where a route rate-limits or logs by IP,
+  use `agentIp()`: the agent's address on a tool call (signed with
+  `EXPOSIFY_KEY`, so it can't be forged), the usual `x-forwarded-for`
+  otherwise.
+
+  ```ts
+  import { agentIp } from "@exposify/next";
+
+  export async function POST(req: Request) {
+    const ip = await agentIp(req);
+  }
+  ```
 - `basePath` and `trailingSlash` from `next.config` are applied.
 - `rateLimit` / `rateWindowMs`: MCP requests per client address per window
   (default 60 per 60 s), in memory and per instance.
@@ -286,8 +302,8 @@ errors; the thrown message stays in your server log.
 
 ## CLI
 
-`npx exposify-next setup | inspect | describe | generate`. The first three
-are the same as `exposify-express`'s; the scan reads your route files
+`npx @exposify/next setup | inspect | describe | generate`. The first three
+are the same as `@exposify/express`'s; the scan reads your route files
 instead of booting the app.
 
 Server Actions get their own rows:

package/dist/config.cjs

@@ -1930,9 +1930,9 @@ function renderManifest(d, opts) {
     return `    { name: ${j(p.name)}, path: ${j(p.path)}, params: ${j(p.params)}, file: ${j(p.file)}${extra} },`;
   });
   const lines = [
-    "// Generated by exposify-next from your route files. Don't edit: withExposify()",
+    "// Generated by @exposify/next from your route files. Don't edit: withExposify()",
     "// in next.config regenerates it on `next dev` and `next build`, or run",
-    "// `npx exposify-next generate`.",
+    "// `npx @exposify/next generate`.",
     "/* eslint-disable */",
     ...ts ? ['import type { ExposifyManifest } from "@exposify/next";', ""] : ["", '/** @type {import("@exposify/next").ExposifyManifest} */'],
     `export const exposify${ts ? ": ExposifyManifest" : ""} = {`,
@@ -1969,11 +1969,11 @@ function generate(root, opts = {}, warn = (m) => console.warn(`[exposify] ${m}`)
     authStacks: (0, import_core2.authStacksOf)((0, import_core2.dependencyNames)(pkg)).map((s) => s.pkg)
   });
   for (const a of discovery.actions.filter((x) => x.proposed?.status === "stale")) {
-    warn(`the input accepted for the ${a.action.name} server action (${a.file}) is out of date, since the action changed: it's not used until \`exposify-next describe\` reviews it again`);
+    warn(`the input accepted for the ${a.action.name} server action (${a.file}) is out of date, since the action changed: it's not used until \`@exposify/next describe\` reviews it again`);
   }
   if (discovery.actions.length > 0 && !discovery.mcpPath) {
     warn(
-      discovery.mcpRoute ? `found ${discovery.actions.length} Server Action(s), but the MCP route (${discovery.mcpRoute.file}) isn't a catch-all route, which they're served under: move it to app/mcp/[[...transport]]/route.ts` : `found ${discovery.actions.length} Server Action(s), but no MCP route to serve them under: create app/mcp/[[...transport]]/route.ts (npx exposify-next setup)`
+      discovery.mcpRoute ? `found ${discovery.actions.length} Server Action(s), but the MCP route (${discovery.mcpRoute.file}) isn't a catch-all route, which they're served under: move it to app/mcp/[[...transport]]/route.ts` : `found ${discovery.actions.length} Server Action(s), but no MCP route to serve them under: create app/mcp/[[...transport]]/route.ts (npx @exposify/next setup)`
     );
   }
   const file = (0, import_node_path6.join)(root, outFile);

package/dist/config.js

@@ -1863,9 +1863,9 @@ function renderManifest(d, opts) {
     return `    { name: ${j(p.name)}, path: ${j(p.path)}, params: ${j(p.params)}, file: ${j(p.file)}${extra} },`;
   });
   const lines = [
-    "// Generated by exposify-next from your route files. Don't edit: withExposify()",
+    "// Generated by @exposify/next from your route files. Don't edit: withExposify()",
     "// in next.config regenerates it on `next dev` and `next build`, or run",
-    "// `npx exposify-next generate`.",
+    "// `npx @exposify/next generate`.",
     "/* eslint-disable */",
     ...ts ? ['import type { ExposifyManifest } from "@exposify/next";', ""] : ["", '/** @type {import("@exposify/next").ExposifyManifest} */'],
     `export const exposify${ts ? ": ExposifyManifest" : ""} = {`,
@@ -1902,11 +1902,11 @@ function generate(root, opts = {}, warn = (m) => console.warn(`[exposify] ${m}`)
     authStacks: authStacksOf(dependencyNames(pkg)).map((s) => s.pkg)
   });
   for (const a of discovery.actions.filter((x) => x.proposed?.status === "stale")) {
-    warn(`the input accepted for the ${a.action.name} server action (${a.file}) is out of date, since the action changed: it's not used until \`exposify-next describe\` reviews it again`);
+    warn(`the input accepted for the ${a.action.name} server action (${a.file}) is out of date, since the action changed: it's not used until \`@exposify/next describe\` reviews it again`);
   }
   if (discovery.actions.length > 0 && !discovery.mcpPath) {
     warn(
-      discovery.mcpRoute ? `found ${discovery.actions.length} Server Action(s), but the MCP route (${discovery.mcpRoute.file}) isn't a catch-all route, which they're served under: move it to app/mcp/[[...transport]]/route.ts` : `found ${discovery.actions.length} Server Action(s), but no MCP route to serve them under: create app/mcp/[[...transport]]/route.ts (npx exposify-next setup)`
+      discovery.mcpRoute ? `found ${discovery.actions.length} Server Action(s), but the MCP route (${discovery.mcpRoute.file}) isn't a catch-all route, which they're served under: move it to app/mcp/[[...transport]]/route.ts` : `found ${discovery.actions.length} Server Action(s), but no MCP route to serve them under: create app/mcp/[[...transport]]/route.ts (npx @exposify/next setup)`
     );
   }
   const file = join6(root, outFile);

package/dist/exposify-next.js

@@ -1961,9 +1961,9 @@ function renderManifest(d, opts) {
     return `    { name: ${j(p.name)}, path: ${j(p.path)}, params: ${j(p.params)}, file: ${j(p.file)}${extra} },`;
   });
   const lines = [
-    "// Generated by exposify-next from your route files. Don't edit: withExposify()",
+    "// Generated by @exposify/next from your route files. Don't edit: withExposify()",
     "// in next.config regenerates it on `next dev` and `next build`, or run",
-    "// `npx exposify-next generate`.",
+    "// `npx @exposify/next generate`.",
     "/* eslint-disable */",
     ...ts ? ['import type { ExposifyManifest } from "@exposify/next";', ""] : ["", '/** @type {import("@exposify/next").ExposifyManifest} */'],
     `export const exposify${ts ? ": ExposifyManifest" : ""} = {`,
@@ -2000,11 +2000,11 @@ function generate(root, opts = {}, warn = (m) => console.warn(`[exposify] ${m}`)
     authStacks: authStacksOf(dependencyNames(pkg)).map((s) => s.pkg)
   });
   for (const a of discovery.actions.filter((x) => x.proposed?.status === "stale")) {
-    warn(`the input accepted for the ${a.action.name} server action (${a.file}) is out of date, since the action changed: it's not used until \`exposify-next describe\` reviews it again`);
+    warn(`the input accepted for the ${a.action.name} server action (${a.file}) is out of date, since the action changed: it's not used until \`@exposify/next describe\` reviews it again`);
   }
   if (discovery.actions.length > 0 && !discovery.mcpPath) {
     warn(
-      discovery.mcpRoute ? `found ${discovery.actions.length} Server Action(s), but the MCP route (${discovery.mcpRoute.file}) isn't a catch-all route, which they're served under: move it to app/mcp/[[...transport]]/route.ts` : `found ${discovery.actions.length} Server Action(s), but no MCP route to serve them under: create app/mcp/[[...transport]]/route.ts (npx exposify-next setup)`
+      discovery.mcpRoute ? `found ${discovery.actions.length} Server Action(s), but the MCP route (${discovery.mcpRoute.file}) isn't a catch-all route, which they're served under: move it to app/mcp/[[...transport]]/route.ts` : `found ${discovery.actions.length} Server Action(s), but no MCP route to serve them under: create app/mcp/[[...transport]]/route.ts (npx @exposify/next setup)`
     );
   }
   const file = join6(root, outFile);
@@ -2387,7 +2387,7 @@ function findNextRoot(start) {
   }
 }
 var nextAdapter = {
-  bin: "exposify-next",
+  bin: "npx @exposify/next",
   entryExample: "apps/web",
   entryHelp: "The Next.js project directory",
   locate(cwd, entryFlag) {
@@ -2591,7 +2591,7 @@ function applyReplace(site, config, entries, usesZod, relFile) {
 }
 
 // bin/exposify-next.ts
-var GENERATE_USAGE = `Usage: exposify-next generate [options]
+var GENERATE_USAGE = `Usage: @exposify/next generate [options]
 
 Writes exposify.generated.ts (the route table and docs the MCP route uses).
 withExposify() in next.config runs this on \`next dev\` and \`next build\`.
@@ -2638,7 +2638,7 @@ ${GENERATE_USAGE}`);
   console.log(
     `${result.changed ? "Wrote" : "Unchanged:"} ${relative4(cwd, result.file) || result.file}: ${app} App Router route file${app === 1 ? "" : "s"}, ${routes.length - app} Pages Router API file${routes.length - app === 1 ? "" : "s"}.`
   );
-  if (!result.discovery.mcpRoute) console.log("No MCP route yet: run `npx exposify-next setup`.");
+  if (!result.discovery.mcpRoute) console.log("No MCP route yet: run `npx @exposify/next setup`.");
   return 0;
 }
 var argv = process.argv.slice(2);

package/dist/index.cjs

@@ -20,7 +20,9 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  AGENT_IP_HEADER: () => AGENT_IP_HEADER,
   DISPATCH_HEADER: () => DISPATCH_HEADER,
+  agentIp: () => agentIp,
   aiReady: () => aiReady,
   completeMcpLogin: () => import_core2.completeMcpLogin,
   createHostedAuthResolver: () => import_core2.createHostedAuthResolver,
@@ -637,6 +639,49 @@ async function readPageResponse(res, url) {
 // src/routes.ts
 var HTTP_METHODS = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
 
+// src/agent-ip.ts
+var AGENT_IP_HEADER = "x-exposify-agent-ip";
+var MAX_AGE_S = 300;
+function env2() {
+  return globalThis.process?.env ?? {};
+}
+var keyCache = /* @__PURE__ */ new Map();
+function hmacKey(secret) {
+  let key = keyCache.get(secret);
+  if (!key) {
+    key = (async () => {
+      const material = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(`exposify agent-ip v1
+${secret}`));
+      return crypto.subtle.importKey("raw", material, { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+    })();
+    keyCache.set(secret, key);
+  }
+  return key;
+}
+var hex2 = (buf) => [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, "0")).join("");
+async function signAgentIp(ip, secret = env2().EXPOSIFY_KEY, now = Date.now()) {
+  if (!ip || !secret || /[;\s]/.test(ip) || ip.length > 64) return null;
+  const t = Math.floor(now / 1e3);
+  const sig = await crypto.subtle.sign("HMAC", await hmacKey(secret), new TextEncoder().encode(`${ip};${t}`));
+  return `${ip};${t};${hex2(sig)}`;
+}
+function forwardedIp(headers) {
+  return headers.get("x-forwarded-for")?.split(",")[0]?.trim() || headers.get("x-real-ip")?.trim() || void 0;
+}
+async function agentIp(request, options = {}) {
+  const signed = request.headers.get(AGENT_IP_HEADER);
+  const secret = options.key ?? env2().EXPOSIFY_KEY;
+  if (signed && secret) {
+    const [ip, t, sig] = signed.split(";");
+    const age = Math.floor((options.now ?? Date.now()) / 1e3) - Number(t);
+    if (ip && sig && /^[0-9a-f]{64}$/.test(sig) && Number.isInteger(Number(t)) && age >= -60 && age <= MAX_AGE_S) {
+      const bytes = new Uint8Array(sig.match(/../g).map((b) => parseInt(b, 16)));
+      if (await crypto.subtle.verify("HMAC", await hmacKey(secret), bytes, new TextEncoder().encode(`${ip};${t}`))) return ip;
+    }
+  }
+  return forwardedIp(request.headers);
+}
+
 // src/index.ts
 var import_core2 = require("@exposify/core");
 var DISPATCH_HEADER = "x-exposify-dispatch";
@@ -645,7 +690,7 @@ var LOG_PREFIX = "[agentready]";
 var ACTION_NOTE = "It returns the action's result, or { ok: true, redirectedTo } when the action redirects; a redirect to a sign-in page means the call wasn't authorised.";
 var LEFT_BLANK = "A field you leave out is as if left blank on the form.";
 var PAGE_NOTE = "Returns the page's main content as text, with links, and the data it was rendered with when the page passes any to its components. An error naming a sign-in page means signing in first.";
-function env2() {
+function env3() {
   return globalThis.process?.env ?? {};
 }
 function errorMessage(err) {
@@ -708,7 +753,7 @@ function derivedInput(action) {
     const fields = action.proposed.map((p) => ({ name: p.name, type: p.type, ...p.required ? { required: true } : {}, ...p.enum ? { enum: p.enum } : {}, ...p.description ? { description: p.description } : {} }));
     return { input: Object.fromEntries(fields.map((f) => [f.name, fieldSchema(f)])) };
   }
-  if (reason) return { reason: action.fields.some((f) => f.type === "file") ? reason : `${reason}; \`exposify-next describe\` can propose it for you to review` };
+  if (reason) return { reason: action.fields.some((f) => f.type === "file") ? reason : `${reason}; \`@exposify/next describe\` can propose it for you to review` };
   return { input: Object.fromEntries(action.fields.map((f) => [f.name, fieldSchema(f)])) };
 }
 var sentence = (s) => /[.!?]$/.test(s.trim()) ? s.trim() : `${s.trim()}.`;
@@ -959,7 +1004,7 @@ function aiReady(manifest, options = {}) {
         (0, import_core.formatWarning)(
           LOG_PREFIX,
           `MCP is up at ${endpoint} but exposes no route tools`,
-          "check that exposify.generated.ts is current (withExposify() in next.config, or `npx exposify-next generate`)"
+          "check that exposify.generated.ts is current (withExposify() in next.config, or `npx @exposify/next generate`)"
         )
       );
       return;
@@ -973,7 +1018,7 @@ function aiReady(manifest, options = {}) {
     if (pages.forms > 0) details.push(`${pages.forms} page${pages.forms === 1 ? "" : "s"} left out as just a form (list in aiReady({ pages }) to include)`);
     if (exposedActions > 0) details.push(`${exposedActions} server action${exposedActions === 1 ? "" : "s"} exposed, each checking auth itself`);
     if (hiddenActions > 0) details.push(`${hiddenActions} server action${hiddenActions === 1 ? "" : "s"} hidden (opt in with aiReady({ actions }))`);
-    const e = env2();
+    const e = env3();
     if (e.VERCEL && e.VERCEL_ENV !== "production" && !e.VERCEL_AUTOMATION_BYPASS_SECRET) {
       details.push("on a protected Vercel preview, tool calls need VERCEL_AUTOMATION_BYPASS_SECRET");
     }
@@ -983,7 +1028,7 @@ function aiReady(manifest, options = {}) {
   const selfFetch = async (request, mcpReq, route) => {
     const target = new URL(request.url);
     const incoming = new URL(mcpReq.url);
-    const origin = options.baseUrl ?? env2().EXPOSIFY_BASE_URL ?? incoming.origin;
+    const origin = options.baseUrl ?? env3().EXPOSIFY_BASE_URL ?? incoming.origin;
     let path = `${manifest.basePath ?? ""}${target.pathname}`;
     if (manifest.trailingSlash && !path.endsWith("/")) path += "/";
     const headers = new Headers(request.headers);
@@ -994,8 +1039,11 @@ function aiReady(manifest, options = {}) {
     }
     headers.set("x-forwarded-proto", mcpReq.headers.get("x-forwarded-proto") ?? incoming.protocol.slice(0, -1));
     headers.set("x-forwarded-host", mcpReq.headers.get("x-forwarded-host") ?? mcpReq.headers.get("host") ?? incoming.host);
-    const bypass = env2().VERCEL_AUTOMATION_BYPASS_SECRET;
+    const bypass = env3().VERCEL_AUTOMATION_BYPASS_SECRET;
     if (bypass) headers.set("x-vercel-protection-bypass", bypass);
+    const signedIp = await signAgentIp(clientIp(mcpReq.headers));
+    if (signedIp) headers.set(AGENT_IP_HEADER, signedIp);
+    else headers.delete(AGENT_IP_HEADER);
     const body = request.body ? await request.text() : void 0;
     const actionKey = actionUrl?.exec(target.pathname)?.[1];
     if (actionKey !== void 0) {
@@ -1043,13 +1091,13 @@ function aiReady(manifest, options = {}) {
     fields: spec.fields,
     signedOutPaths: cfg.signedOutPaths ?? [],
     attempt: async (values, ctx) => {
-      const target = options.baseUrl ?? env2().EXPOSIFY_BASE_URL ?? new URL(req.url).origin;
+      const target = options.baseUrl ?? env3().EXPOSIFY_BASE_URL ?? new URL(req.url).origin;
       const pub = new URL(ctx.origin);
       const headers = new Headers({ origin: pub.origin, "x-forwarded-proto": pub.protocol.slice(0, -1), "x-forwarded-host": pub.host });
       if (ctx.ip) headers.set("x-forwarded-for", ctx.ip);
       const ua = req.headers.get("user-agent");
       if (ua) headers.set("user-agent", ua);
-      const bypass = env2().VERCEL_AUTOMATION_BYPASS_SECRET;
+      const bypass = env3().VERCEL_AUTOMATION_BYPASS_SECRET;
       if (bypass) headers.set("x-vercel-protection-bypass", bypass);
       const pathOf = (p) => {
         let path = `${manifest.basePath ?? ""}${p}`;
@@ -1168,7 +1216,9 @@ function aiReady(manifest, options = {}) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AGENT_IP_HEADER,
   DISPATCH_HEADER,
+  agentIp,
   aiReady,
   completeMcpLogin,
   createHostedAuthResolver,

package/dist/index.d.cts

@@ -122,6 +122,22 @@ interface ExposifyManifest {
     descriptions?: Record<string, string>;
 }
 
+/** Header carrying `<ip>;<unix seconds>;<signature>` on a tool call. */
+declare const AGENT_IP_HEADER = "x-exposify-agent-ip";
+/**
+ * The address of whoever made this request: on a tool call, the AI agent's
+ * (verified with EXPOSIFY_KEY, so it can't be forged); otherwise the
+ * platform's `x-forwarded-for`, as you'd read it anyway. Use it where a
+ * route rate-limits or logs by IP: on Vercel, a tool call's own
+ * `x-forwarded-for` is the function's address, not the agent's.
+ */
+declare function agentIp(request: {
+    headers: Headers;
+}, options?: {
+    key?: string;
+    now?: number;
+}): Promise<string | undefined>;
+
 /** Set on every tool call; the MCP route refuses requests carrying it, so a tool can never call the MCP endpoint. */
 declare const DISPATCH_HEADER = "x-exposify-dispatch";
 type InputShape = NonNullable<Extract<RouteMarker, {
@@ -198,4 +214,4 @@ interface NextPageOptions {
 type NextMcpHandler = (req: Request) => Promise<Response>;
 declare function aiReady(manifest: ExposifyManifest, options?: NextAiReadyOptions): NextMcpHandler;
 
-export { type AppRouteEntry, DISPATCH_HEADER, type ExposifyManifest, type ManifestAction, type ManifestLogin, type ManifestPage, type ManifestRoute, type NextActionOptions, type NextAiReadyOptions, type NextMcpHandler, type NextPageOptions, type PagesRouteEntry, aiReady };
+export { AGENT_IP_HEADER, type AppRouteEntry, DISPATCH_HEADER, type ExposifyManifest, type ManifestAction, type ManifestLogin, type ManifestPage, type ManifestRoute, type NextActionOptions, type NextAiReadyOptions, type NextMcpHandler, type NextPageOptions, type PagesRouteEntry, agentIp, aiReady };

package/dist/index.d.ts

@@ -122,6 +122,22 @@ interface ExposifyManifest {
     descriptions?: Record<string, string>;
 }
 
+/** Header carrying `<ip>;<unix seconds>;<signature>` on a tool call. */
+declare const AGENT_IP_HEADER = "x-exposify-agent-ip";
+/**
+ * The address of whoever made this request: on a tool call, the AI agent's
+ * (verified with EXPOSIFY_KEY, so it can't be forged); otherwise the
+ * platform's `x-forwarded-for`, as you'd read it anyway. Use it where a
+ * route rate-limits or logs by IP: on Vercel, a tool call's own
+ * `x-forwarded-for` is the function's address, not the agent's.
+ */
+declare function agentIp(request: {
+    headers: Headers;
+}, options?: {
+    key?: string;
+    now?: number;
+}): Promise<string | undefined>;
+
 /** Set on every tool call; the MCP route refuses requests carrying it, so a tool can never call the MCP endpoint. */
 declare const DISPATCH_HEADER = "x-exposify-dispatch";
 type InputShape = NonNullable<Extract<RouteMarker, {
@@ -198,4 +214,4 @@ interface NextPageOptions {
 type NextMcpHandler = (req: Request) => Promise<Response>;
 declare function aiReady(manifest: ExposifyManifest, options?: NextAiReadyOptions): NextMcpHandler;
 
-export { type AppRouteEntry, DISPATCH_HEADER, type ExposifyManifest, type ManifestAction, type ManifestLogin, type ManifestPage, type ManifestRoute, type NextActionOptions, type NextAiReadyOptions, type NextMcpHandler, type NextPageOptions, type PagesRouteEntry, aiReady };
+export { AGENT_IP_HEADER, type AppRouteEntry, DISPATCH_HEADER, type ExposifyManifest, type ManifestAction, type ManifestLogin, type ManifestPage, type ManifestRoute, type NextActionOptions, type NextAiReadyOptions, type NextMcpHandler, type NextPageOptions, type PagesRouteEntry, agentIp, aiReady };

package/dist/index.js

@@ -638,6 +638,49 @@ async function readPageResponse(res, url) {
   return Response.json(body);
 }
 
+// src/agent-ip.ts
+var AGENT_IP_HEADER = "x-exposify-agent-ip";
+var MAX_AGE_S = 300;
+function env2() {
+  return globalThis.process?.env ?? {};
+}
+var keyCache = /* @__PURE__ */ new Map();
+function hmacKey(secret) {
+  let key = keyCache.get(secret);
+  if (!key) {
+    key = (async () => {
+      const material = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(`exposify agent-ip v1
+${secret}`));
+      return crypto.subtle.importKey("raw", material, { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+    })();
+    keyCache.set(secret, key);
+  }
+  return key;
+}
+var hex2 = (buf) => [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, "0")).join("");
+async function signAgentIp(ip, secret = env2().EXPOSIFY_KEY, now = Date.now()) {
+  if (!ip || !secret || /[;\s]/.test(ip) || ip.length > 64) return null;
+  const t = Math.floor(now / 1e3);
+  const sig = await crypto.subtle.sign("HMAC", await hmacKey(secret), new TextEncoder().encode(`${ip};${t}`));
+  return `${ip};${t};${hex2(sig)}`;
+}
+function forwardedIp(headers) {
+  return headers.get("x-forwarded-for")?.split(",")[0]?.trim() || headers.get("x-real-ip")?.trim() || void 0;
+}
+async function agentIp(request, options = {}) {
+  const signed = request.headers.get(AGENT_IP_HEADER);
+  const secret = options.key ?? env2().EXPOSIFY_KEY;
+  if (signed && secret) {
+    const [ip, t, sig] = signed.split(";");
+    const age = Math.floor((options.now ?? Date.now()) / 1e3) - Number(t);
+    if (ip && sig && /^[0-9a-f]{64}$/.test(sig) && Number.isInteger(Number(t)) && age >= -60 && age <= MAX_AGE_S) {
+      const bytes = new Uint8Array(sig.match(/../g).map((b) => parseInt(b, 16)));
+      if (await crypto.subtle.verify("HMAC", await hmacKey(secret), bytes, new TextEncoder().encode(`${ip};${t}`))) return ip;
+    }
+  }
+  return forwardedIp(request.headers);
+}
+
 // src/index.ts
 import {
   exposed,
@@ -653,7 +696,7 @@ var LOG_PREFIX = "[agentready]";
 var ACTION_NOTE = "It returns the action's result, or { ok: true, redirectedTo } when the action redirects; a redirect to a sign-in page means the call wasn't authorised.";
 var LEFT_BLANK = "A field you leave out is as if left blank on the form.";
 var PAGE_NOTE = "Returns the page's main content as text, with links, and the data it was rendered with when the page passes any to its components. An error naming a sign-in page means signing in first.";
-function env2() {
+function env3() {
   return globalThis.process?.env ?? {};
 }
 function errorMessage(err) {
@@ -716,7 +759,7 @@ function derivedInput(action) {
     const fields = action.proposed.map((p) => ({ name: p.name, type: p.type, ...p.required ? { required: true } : {}, ...p.enum ? { enum: p.enum } : {}, ...p.description ? { description: p.description } : {} }));
     return { input: Object.fromEntries(fields.map((f) => [f.name, fieldSchema(f)])) };
   }
-  if (reason) return { reason: action.fields.some((f) => f.type === "file") ? reason : `${reason}; \`exposify-next describe\` can propose it for you to review` };
+  if (reason) return { reason: action.fields.some((f) => f.type === "file") ? reason : `${reason}; \`@exposify/next describe\` can propose it for you to review` };
   return { input: Object.fromEntries(action.fields.map((f) => [f.name, fieldSchema(f)])) };
 }
 var sentence = (s) => /[.!?]$/.test(s.trim()) ? s.trim() : `${s.trim()}.`;
@@ -967,7 +1010,7 @@ function aiReady(manifest, options = {}) {
         formatWarning(
           LOG_PREFIX,
           `MCP is up at ${endpoint} but exposes no route tools`,
-          "check that exposify.generated.ts is current (withExposify() in next.config, or `npx exposify-next generate`)"
+          "check that exposify.generated.ts is current (withExposify() in next.config, or `npx @exposify/next generate`)"
         )
       );
       return;
@@ -981,7 +1024,7 @@ function aiReady(manifest, options = {}) {
     if (pages.forms > 0) details.push(`${pages.forms} page${pages.forms === 1 ? "" : "s"} left out as just a form (list in aiReady({ pages }) to include)`);
     if (exposedActions > 0) details.push(`${exposedActions} server action${exposedActions === 1 ? "" : "s"} exposed, each checking auth itself`);
     if (hiddenActions > 0) details.push(`${hiddenActions} server action${hiddenActions === 1 ? "" : "s"} hidden (opt in with aiReady({ actions }))`);
-    const e = env2();
+    const e = env3();
     if (e.VERCEL && e.VERCEL_ENV !== "production" && !e.VERCEL_AUTOMATION_BYPASS_SECRET) {
       details.push("on a protected Vercel preview, tool calls need VERCEL_AUTOMATION_BYPASS_SECRET");
     }
@@ -991,7 +1034,7 @@ function aiReady(manifest, options = {}) {
   const selfFetch = async (request, mcpReq, route) => {
     const target = new URL(request.url);
     const incoming = new URL(mcpReq.url);
-    const origin = options.baseUrl ?? env2().EXPOSIFY_BASE_URL ?? incoming.origin;
+    const origin = options.baseUrl ?? env3().EXPOSIFY_BASE_URL ?? incoming.origin;
     let path = `${manifest.basePath ?? ""}${target.pathname}`;
     if (manifest.trailingSlash && !path.endsWith("/")) path += "/";
     const headers = new Headers(request.headers);
@@ -1002,8 +1045,11 @@ function aiReady(manifest, options = {}) {
     }
     headers.set("x-forwarded-proto", mcpReq.headers.get("x-forwarded-proto") ?? incoming.protocol.slice(0, -1));
     headers.set("x-forwarded-host", mcpReq.headers.get("x-forwarded-host") ?? mcpReq.headers.get("host") ?? incoming.host);
-    const bypass = env2().VERCEL_AUTOMATION_BYPASS_SECRET;
+    const bypass = env3().VERCEL_AUTOMATION_BYPASS_SECRET;
     if (bypass) headers.set("x-vercel-protection-bypass", bypass);
+    const signedIp = await signAgentIp(clientIp(mcpReq.headers));
+    if (signedIp) headers.set(AGENT_IP_HEADER, signedIp);
+    else headers.delete(AGENT_IP_HEADER);
     const body = request.body ? await request.text() : void 0;
     const actionKey = actionUrl?.exec(target.pathname)?.[1];
     if (actionKey !== void 0) {
@@ -1051,13 +1097,13 @@ function aiReady(manifest, options = {}) {
     fields: spec.fields,
     signedOutPaths: cfg.signedOutPaths ?? [],
     attempt: async (values, ctx) => {
-      const target = options.baseUrl ?? env2().EXPOSIFY_BASE_URL ?? new URL(req.url).origin;
+      const target = options.baseUrl ?? env3().EXPOSIFY_BASE_URL ?? new URL(req.url).origin;
       const pub = new URL(ctx.origin);
       const headers = new Headers({ origin: pub.origin, "x-forwarded-proto": pub.protocol.slice(0, -1), "x-forwarded-host": pub.host });
       if (ctx.ip) headers.set("x-forwarded-for", ctx.ip);
       const ua = req.headers.get("user-agent");
       if (ua) headers.set("user-agent", ua);
-      const bypass = env2().VERCEL_AUTOMATION_BYPASS_SECRET;
+      const bypass = env3().VERCEL_AUTOMATION_BYPASS_SECRET;
       if (bypass) headers.set("x-vercel-protection-bypass", bypass);
       const pathOf = (p) => {
         let path = `${manifest.basePath ?? ""}${p}`;
@@ -1175,7 +1221,9 @@ function aiReady(manifest, options = {}) {
   };
 }
 export {
+  AGENT_IP_HEADER,
   DISPATCH_HEADER,
+  agentIp,
   aiReady,
   completeMcpLogin,
   createHostedAuthResolver,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/next",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -33,7 +33,7 @@
   "dependencies": {
     "@babel/parser": "^8.0.0",
     "@exposify/cli": "0.0.2",
-    "@exposify/core": "0.3.14",
+    "@exposify/core": "0.3.15",
     "tinyglobby": "^0.2.10",
     "zod": "^3.24.0"
   },