tapimo 0.14.0 → 0.15.1

package/src/apps/management/routes/verified-token-requests.test.ts

@@ -247,10 +247,18 @@ describe('POST /v1/orgs/:orgId/verified-token-requests', () => {
     expect(body.error?.code).toBe('request_pending_exists')
   })
 
-  test('caps pending requests per organization', async () => {
+  test('caps pending requests per requester after an organization is deleted', async () => {
     const context = createApp()
     const requests = context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['verified-token-requests']
     const { org, owner } = await setup(context)
+    const nextResponse = await context.client.v1.orgs.$post(
+      { json: { name: 'Next' } },
+      as(owner.cookie),
+    )
+    expect(nextResponse.status).toBe(200)
+    if (nextResponse.status !== 200)
+      throw new Error(`Failed to create organization: ${nextResponse.status}`)
+    const next = await nextResponse.json()
 
     for (let index = 0; index < 10; index++) {
       const created = await requests.$post(
@@ -267,10 +275,16 @@ describe('POST /v1/orgs/:orgId/verified-token-requests', () => {
       expect(created.status).toBe(200)
     }
 
+    const deleted = await context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].$delete(
+      { param: { orgId: org.id } },
+      as(owner.cookie),
+    )
+    expect(deleted.status).toBe(200)
+
     const overflow = await requests.$post(
       {
         json: { ...token, address: `0x20c${'f'.padStart(37, '0')}` as `0x${string}`, symbol: 'tOVER' }, // prettier-ignore
-        param: { orgId: org.id },
+        param: { orgId: next.id },
       },
       as(owner.cookie),
     )

package/src/apps/management/routes/verified-token-requests.ts

@@ -239,9 +239,6 @@ const paramValidation = {
   message: 'Check the path parameters and try again.',
 } as const
 
-/** Maximum open (pending) requests per organization. */
-const maxPending = 10
-
 /** Mounts organization verified-token request operations. */
 export function verifiedTokenRequests() {
   return new Hono<Environment>()
@@ -265,7 +262,7 @@ export function verifiedTokenRequests() {
             },
             409: {
               codes: ['request_limit_reached', 'request_pending_exists', 'verified_symbol_exists', 'verified_token_exists'], // prettier-ignore
-              description: 'The token is already verified or requested, or the organization is at its pending-request limit.', // prettier-ignore
+              description: 'The token is already verified or requested, or the requester is at the pending-request limit.', // prettier-ignore
             },
           },
           success: { description: 'Created request.', schema: schema.VerifiedTokenRequest },
@@ -297,12 +294,6 @@ export function verifiedTokenRequests() {
               message: 'A verified token already uses this symbol',
               status: 409,
             })
-          if ((await VerifiedTokenRequests.countPending(db, orgId)) >= maxPending)
-            return Response.error(c, {
-              code: 'request_limit_reached',
-              message: `Organizations may have at most ${maxPending} pending requests`,
-              status: 409,
-            })
           const record = await VerifiedTokenRequests.create(db, {
             address: body.address,
             chainId: body.chainId,
@@ -330,6 +321,12 @@ export function verifiedTokenRequests() {
             200,
           )
         } catch (cause) {
+          if (cause instanceof VerifiedTokenRequests.PendingLimitError)
+            return Response.error(c, {
+              code: 'request_limit_reached',
+              message: `Requesters may have at most ${VerifiedTokenRequests.maxPendingPerRequester} pending requests`,
+              status: 409,
+            })
           return Response.upstream(c, cause)
         }
       },

package/src/apps/management/routes/webhooks.test.ts

@@ -3,6 +3,7 @@ import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 import * as App from '../../../App.js'
 import * as Memberships from '../../../db/tables/memberships.js'
 import * as Cursor from '../../../internal/Cursor.js'
+import type * as Log from '../../../internal/Log.js'
 import * as core_Webhooks from '../../../internal/Webhooks.js'
 import * as TestApp from '../../../../test/App.js'
 import { management } from '../App.js'
@@ -11,7 +12,7 @@ import * as Webhooks from './webhooks.js'
 
 const origin = 'http://localhost'
 const webhook = {
-  applicationEventTypes: ['funding:deposit.updated', 'funding:transfer.updated'],
+  applicationEventTypes: ['routes:deposit.updated', 'routes:transfer.updated'],
   supportedChainIds: [4217, 42431],
 } satisfies App.Webhook
 
@@ -25,15 +26,22 @@ function json(method: 'PATCH' | 'POST', cookie: string, body: unknown) {
 
 function createApp(options: createApp.Options = {}) {
   return App.create({
-    auth: { session: { wallet: { origin } } },
+    auth: {
+      session: { secret: 'test-better-auth-secret-at-least-32-characters', wallet: { origin } },
+    },
     db: options.db ?? TestApp.database(),
     kv: { store: TestApp.kvStore() },
+    ...(options.logger === undefined ? {} : { logger: options.logger }),
   }).route('/', management({ webhook: options.webhook ?? webhook }))
 }
 
 declare namespace createApp {
   type Options = {
+    /** Database source override. */
     db?: App.create.Options['db'] | undefined
+    /** Request logger override. */
+    logger?: App.create.Options['logger'] | undefined
+    /** Webhook capability override. */
     webhook?: App.Webhook | false | undefined
   }
 }
@@ -59,21 +67,22 @@ describe('webhooks', () => {
     const retry = spec.paths['/v1/orgs/{orgId}/webhooks/{id}/deliveries/{deliveryId}/retry'].post
 
     expect({
-      components: [
-        'CreateOrganizationWebhookBetterstackResponse',
-        'CreateOrganizationWebhookRequest',
-        'CreateOrganizationWebhookResponse',
-        'CreateOrganizationWebhookSlackResponse',
-        'CreateOrganizationWebhookUrlResponse',
-        'DeleteOrganizationWebhookResponse',
-        'OrganizationWebhook',
-        'OrganizationWebhookDelivery',
-        'OrganizationWebhookDeliveryList',
-        'OrganizationWebhookDeliverySummary',
-        'OrganizationWebhookList',
-        'RetryOrganizationWebhookDeliveryResponse',
-        'UpdateOrganizationWebhookRequest',
-      ].filter((name) => spec.components.schemas[name]),
+      components: Object.keys(spec.components.schemas)
+        .filter(
+          (name) =>
+            name.startsWith('CreateOrganizationWebhook') ||
+            [
+              'DeleteOrganizationWebhookResponse',
+              'OrganizationWebhook',
+              'OrganizationWebhookDelivery',
+              'OrganizationWebhookDeliveryList',
+              'OrganizationWebhookDeliverySummary',
+              'OrganizationWebhookList',
+              'RetryOrganizationWebhookDeliveryResponse',
+              'UpdateOrganizationWebhookRequest',
+            ].includes(name),
+        )
+        .sort(),
       create: {
         errors: {
           400: collection.post.responses[400].content['application/json'].schema,
@@ -146,9 +155,15 @@ describe('webhooks', () => {
       {
         "components": [
           "CreateOrganizationWebhookBetterstackResponse",
+          "CreateOrganizationWebhookBlockRequest",
+          "CreateOrganizationWebhookLogRequest",
           "CreateOrganizationWebhookRequest",
           "CreateOrganizationWebhookResponse",
+          "CreateOrganizationWebhookRoutesDepositRequest",
+          "CreateOrganizationWebhookRoutesTransferRequest",
           "CreateOrganizationWebhookSlackResponse",
+          "CreateOrganizationWebhookTransactionRequest",
+          "CreateOrganizationWebhookTransferRequest",
           "CreateOrganizationWebhookUrlResponse",
           "DeleteOrganizationWebhookResponse",
           "OrganizationWebhook",
@@ -284,7 +299,7 @@ describe('webhooks', () => {
     `)
   })
 
-  test('creates funding transfer subscriptions without reading the RPC head', async () => {
+  test('creates route transfer subscriptions without reading the RPC head', async () => {
     const db = TestApp.database()
     const app = createApp({ db })
     const cookie = await session(app)
@@ -293,9 +308,9 @@ describe('webhooks', () => {
       `/v1/orgs/${org.id}/webhooks`,
       json('POST', cookie, {
         chainId: 4217,
-        destination: { type: 'url', url: 'https://example.com/funding' },
+        destination: { type: 'url', url: 'https://example.com/routes' },
         environment: 'production',
-        eventType: 'funding:transfer.updated',
+        eventType: 'routes:transfer.updated',
         filters: { status: 'completed' },
       }),
     )
@@ -317,7 +332,7 @@ describe('webhooks', () => {
     expect(await core_Webhooks.getCursor(db, created.id)).toBeNull()
   })
 
-  test('preserves a production funding environment on testnet', async () => {
+  test('preserves a production route environment on testnet', async () => {
     const db = TestApp.database()
     const app = createApp({ db })
     const cookie = await session(app)
@@ -326,9 +341,9 @@ describe('webhooks', () => {
       `/v1/orgs/${org.id}/webhooks`,
       json('POST', cookie, {
         chainId: 42431,
-        destination: { type: 'url', url: 'https://example.com/funding-testnet' },
+        destination: { type: 'url', url: 'https://example.com/routes-testnet' },
         environment: 'production',
-        eventType: 'funding:deposit.updated',
+        eventType: 'routes:deposit.updated',
       }),
     )
     const created = await TestApp.json(response, Webhooks.schema.createWebhook.Response)
@@ -343,7 +358,7 @@ describe('webhooks', () => {
     expect(stored?.environment).toBe('production')
   })
 
-  test('requires an explicit environment for funding deposit subscriptions', async () => {
+  test('requires an explicit environment for route deposit subscriptions', async () => {
     const app = createApp()
     const cookie = await session(app)
     const org = await organization(app, cookie)
@@ -351,8 +366,8 @@ describe('webhooks', () => {
       `/v1/orgs/${org.id}/webhooks`,
       json('POST', cookie, {
         chainId: 4217,
-        destination: { type: 'url', url: 'https://example.com/funding' },
-        eventType: 'funding:deposit.updated',
+        destination: { type: 'url', url: 'https://example.com/routes' },
+        eventType: 'routes:deposit.updated',
       }),
     )
 
@@ -658,7 +673,9 @@ describe('webhooks', () => {
   })
 
   test('uses the shared per-owner limit', async () => {
+    const entries: Log.Entry[] = []
     const app = createApp({
+      logger: (entry) => void entries.push(entry),
       webhook: { maxPerOwner: 1, supportedChainIds: webhook.supportedChainIds },
     })
     const cookie = await session(app)
@@ -675,6 +692,12 @@ describe('webhooks', () => {
     const response = await app.request(collection, json('POST', cookie, body))
     expect(response.status).toBe(403)
     expect(await response.json()).toMatchObject({ error: { code: 'limit_exceeded' } })
+    expect(entries.at(-1)).toMatchObject({
+      errorCode: 'limit_exceeded',
+      method: 'POST',
+      route: '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/webhooks',
+      status: 403,
+    })
   })
 
   test('lists every webhook when the creation limit is lowered', async () => {

package/src/apps/management/routes/webhooks.ts

@@ -44,28 +44,83 @@ export namespace schema {
     const Environment = z
       .enum(['production', 'sandbox'])
       .check(
-        z.describe('API-key environment whose private funding resources are delivered.'),
+        z.describe('API-key environment whose private route resources are delivered.'),
         z.meta({ examples: ['production'] }),
       )
 
+    const BlockBody = OpenApi.component(
+      z
+        .object({
+          ...DataWebhooks.schema.createWebhook.BlockBody.shape,
+          chainId: DataWebhooks.schema.Subscription.shape.chainId,
+          environment: z.optional(Environment),
+        })
+        .check(z.meta({ title: 'Block subscription' })),
+      'CreateOrganizationWebhookBlockRequest',
+    )
+    const RoutesDepositBody = OpenApi.component(
+      z
+        .object({
+          ...DataWebhooks.schema.createWebhook.RoutesDepositBody.shape,
+          chainId: DataWebhooks.schema.Subscription.shape.chainId,
+          environment: Environment,
+        })
+        .check(z.meta({ title: 'Route deposit subscription' })),
+      'CreateOrganizationWebhookRoutesDepositRequest',
+    )
+    const RoutesTransferBody = OpenApi.component(
+      z
+        .object({
+          ...DataWebhooks.schema.createWebhook.RoutesTransferBody.shape,
+          chainId: DataWebhooks.schema.Subscription.shape.chainId,
+          environment: Environment,
+        })
+        .check(z.meta({ title: 'Route transfer subscription' })),
+      'CreateOrganizationWebhookRoutesTransferRequest',
+    )
+    const LogBody = OpenApi.component(
+      z
+        .object({
+          ...DataWebhooks.schema.createWebhook.LogBody.shape,
+          chainId: DataWebhooks.schema.Subscription.shape.chainId,
+          environment: z.optional(Environment),
+        })
+        .check(z.meta({ title: 'Log subscription' })),
+      'CreateOrganizationWebhookLogRequest',
+    )
+    const TransactionBody = OpenApi.component(
+      z
+        .object({
+          ...DataWebhooks.schema.createWebhook.TransactionBody.shape,
+          chainId: DataWebhooks.schema.Subscription.shape.chainId,
+          environment: z.optional(Environment),
+        })
+        .check(z.meta({ title: 'Included-transaction subscription' })),
+      'CreateOrganizationWebhookTransactionRequest',
+    )
+    const TransferBody = OpenApi.component(
+      z
+        .object({
+          ...DataWebhooks.schema.createWebhook.TransferBody.shape,
+          chainId: DataWebhooks.schema.Subscription.shape.chainId,
+          environment: z.optional(Environment),
+        })
+        .check(z.meta({ title: 'Transfer subscription' })),
+      'CreateOrganizationWebhookTransferRequest',
+    )
+
     /** Organization webhook creation requires an explicit network. */
     export const Body = OpenApi.component(
       z
-        .intersection(
-          DataWebhooks.schema.createWebhook.Body,
-          z.object({
-            chainId: DataWebhooks.schema.Subscription.shape.chainId,
-            environment: z.optional(Environment),
-          }),
-        )
-        .check(
-          z.refine(
-            (body) =>
-              !DataWebhooks.isFundingEventType(body.eventType) || body.environment !== undefined,
-            { error: '`environment` is required for funding subscriptions.' },
-          ),
-          z.describe('Details for creating an organization webhook subscription.'),
-        ),
+        .discriminatedUnion('eventType', [
+          TransferBody,
+          TransactionBody,
+          LogBody,
+          BlockBody,
+          RoutesDepositBody,
+          RoutesTransferBody,
+        ])
+        .check(z.describe('Details for creating an organization webhook subscription.')),
       'CreateOrganizationWebhookRequest',
     )
 
@@ -319,7 +374,8 @@ export function webhooks(options: webhooks.Options = {}) {
             },
             403: {
               codes: ['forbidden', 'limit_exceeded'],
-              description: 'Admin access is required and the organization must be under its limit.',
+              description:
+                'Admin access is required; API-key organizations share their creator subscription limit.',
             },
             404: {
               codes: ['organization_not_found', 'webhooks_not_enabled'],
@@ -344,7 +400,7 @@ export function webhooks(options: webhooks.Options = {}) {
 
         const body = c.req.valid('json')
         if (
-          DataWebhooks.isFundingEventType(body.eventType) &&
+          DataWebhooks.isRoutesEventType(body.eventType) &&
           !options.webhook.applicationEventTypes?.includes(body.eventType)
         )
           return Response.error(c, {
@@ -362,9 +418,9 @@ export function webhooks(options: webhooks.Options = {}) {
           const db = Db.get(c.get('db'))
           const maxPerOwner = options.webhook.maxPerOwner ?? defaultMaxPerOwner
           const owner_ = owner(Auth.org(c).id)
-          if ((await Webhooks.countSubscriptions(db, owner_)) >= maxPerOwner)
+          if ((await Webhooks.countSubscriptionsForLimit(db, { owner: owner_ })) >= maxPerOwner)
             throw new Webhooks.LimitExceededError(maxPerOwner)
-          const startBlockNumber = DataWebhooks.isFundingEventType(body.eventType)
+          const startBlockNumber = DataWebhooks.isRoutesEventType(body.eventType)
             ? undefined
             : Number(await c.get('getClient')(chainId).getBlockNumber())
           const subscription = await Webhooks.createSubscription(
@@ -373,7 +429,7 @@ export function webhooks(options: webhooks.Options = {}) {
               chainId,
               ...(body.context === undefined ? {} : { context: body.context }),
               destination: body.destination,
-              ...(DataWebhooks.isFundingEventType(body.eventType) && body.environment !== undefined
+              ...(DataWebhooks.isRoutesEventType(body.eventType) && body.environment !== undefined
                 ? { environment: body.environment }
                 : {}),
               eventType: body.eventType,
@@ -753,7 +809,7 @@ function publicSubscription(subscription: Webhooks.Subscription) {
     ...(subscription.context === undefined ? {} : { context: subscription.context }),
     createdAt: subscription.createdAt,
     destination,
-    ...(DataWebhooks.isFundingEventType(subscription.eventType) &&
+    ...(DataWebhooks.isRoutesEventType(subscription.eventType) &&
     subscription.environment !== undefined
       ? { environment: subscription.environment }
       : {}),

package/src/apps/mcp.test.ts

@@ -1,6 +1,6 @@
 import { Cli as incur_Cli, z } from 'incur'
-import { App } from 'tapimo'
 import { data } from 'tapimo/apps'
+import { App, Store } from 'tapimo/server'
 
 import * as TestApp from '../../test/App.js'
 import * as Runtime from '../../test/runtime.js'
@@ -42,32 +42,36 @@ function docsStub() {
 type Host = { fetch: (request: Request) => Response | Promise<Response> }
 
 async function request(host: Host, body: unknown, headers: Record<string, string> = {}) {
-  const response = await host.fetch(
-    new Request(new URL('/mcp', origin), {
-      body: JSON.stringify(body),
-      headers: {
-        accept: 'application/json, text/event-stream',
-        'content-type': 'application/json',
-        ...headers,
-      },
-      method: 'POST',
-    }),
-  )
+  const request = new Request(new URL('/mcp', origin), {
+    body: JSON.stringify(body),
+    headers: {
+      accept: 'application/json, text/event-stream',
+      'content-type': 'application/json',
+      ...headers,
+    },
+    method: 'POST',
+  })
+  if (request.headers.has('cf-connecting-ip')) Object.assign(request, { cf: {} })
+  const response = await host.fetch(request)
   expect(response.status).toBe(200)
   return (await response.json()) as { result: any }
 }
 
-function initialize(host: Host) {
-  return request(host, {
-    id: 1,
-    jsonrpc: '2.0',
-    method: 'initialize',
-    params: {
-      capabilities: {},
-      clientInfo: { name: 'test-client', version: '1.0.0' },
-      protocolVersion: '2025-03-26',
+function initialize(host: Host, headers: Record<string, string> = {}) {
+  return request(
+    host,
+    {
+      id: 1,
+      jsonrpc: '2.0',
+      method: 'initialize',
+      params: {
+        capabilities: {},
+        clientInfo: { name: 'test-client', version: '1.0.0' },
+        protocolVersion: '2025-03-26',
+      },
     },
-  })
+    headers,
+  )
 }
 
 async function toolsList(host: Host) {
@@ -109,8 +113,8 @@ async function toolsSearch(host: Host) {
 }
 
 /** Loads the complete schema and metadata for one catalog tool. */
-async function toolDetails(host: Host, name: string) {
-  return resultJson(await toolsCall(host, 'get_tool_details', { name })) as {
+async function toolDetails(host: Host, name: string, headers: Record<string, string> = {}) {
+  return resultJson(await toolsCall(host, 'get_tool_details', { name }, headers)) as {
     annotations?: { readOnlyHint?: boolean }
     inputSchema: { properties?: Record<string, { description?: string }> }
     name: string
@@ -124,7 +128,7 @@ async function generatedToolCall(
   args: Record<string, unknown>,
   headers: Record<string, string> = {},
 ) {
-  const details = await toolDetails(host, name)
+  const details = await toolDetails(host, name, headers)
   return toolsCall(
     host,
     details.annotations?.readOnlyHint === true ? 'call_read_tool' : 'call_write_tool',
@@ -151,7 +155,7 @@ test('identifies as Tempo MCP', async () => {
   })
 })
 
-test('scopes tools to the data and inbound funding domains', async () => {
+test('scopes tools to the data and Routes domains', async () => {
   const { app, host } = createHost({ docs: docsStub() })
 
   // The domain filter must drop paths that actually exist in the spec.
@@ -172,8 +176,8 @@ test('scopes tools to the data and inbound funding domains', async () => {
   const tools = (await toolsSearch(host)).map((tool) => tool.name)
 
   expect(tools).toContain('v1_tokens_get')
-  expect(tools).toContain('v1_funding_quotes')
-  expect(tools).toContain('v1_funding_transfers_post')
+  expect(tools).toContain('v1_routes_quotes')
+  expect(tools).toContain('v1_routes_transfers_post')
   expect(tools).toContain('docs_search')
   // RPC is part of the data domain tag group.
   expect(tools.some((name) => name.startsWith('rpc'))).toBe(true)
@@ -184,7 +188,7 @@ test('scopes tools to the data and inbound funding domains', async () => {
   expect(tools.some((name) => name.startsWith('v1_me'))).toBe(false)
 })
 
-test('keeps the data tools functional when funding is omitted', async () => {
+test('keeps the data tools functional when routes is omitted', async () => {
   const app = App.create({ auth: false, db: TestApp.database() }).route('/', data())
   const { host } = createHost({ app })
 
@@ -192,7 +196,7 @@ test('keeps the data tools functional when funding is omitted', async () => {
   const tools = (await toolsSearch(host)).map((tool) => tool.name)
 
   expect(tools).toContain('v1_tokens_get')
-  expect(tools.some((name) => name.startsWith('v1_funding_'))).toBe(false)
+  expect(tools.some((name) => name.startsWith('v1_routes_'))).toBe(false)
 })
 
 test('keeps tool input schemas compact', async () => {
@@ -246,6 +250,85 @@ test('forwards the caller Authorization header to authenticated tools', async ()
   expect(resultJson(allowed)).toMatchObject({ data: [] })
 })
 
+test('preserves Cloudflare client identity across concurrent generated tools', async () => {
+  const store = Store.memory()
+  const db = TestApp.database()
+  await TestApp.verifiedSeed(db, Runtime.get().chainId)
+  const app = App.create({
+    auth: { rateLimit: { store } },
+    cache: { edge: false },
+    db,
+  }).route('/', data())
+  app.route('/', mcp({ docs: false, fetch: (request) => app.fetch(request) }))
+  const headers_a = { 'cf-connecting-ip': '203.0.113.7' }
+  const headers_b = { 'cf-connecting-ip': '198.51.100.9' }
+  await initialize(app, headers_a)
+
+  const [result_a, result_b] = await Promise.all([
+    generatedToolCall(app, 'v1_tokens_get', { verified: true }, headers_a),
+    generatedToolCall(app, 'v1_tokens_get', { verified: true }, headers_b),
+  ])
+
+  expect(result_a.isError, JSON.stringify(result_a.content)).toBeFalsy()
+  expect(result_b.isError, JSON.stringify(result_b.content)).toBeFalsy()
+  const keys = (await store.list({ prefix: 'ratelimit:' })).keys.map((key) => key.name)
+  expect(keys.some((key) => key.endsWith('public:203.0.113.7'))).toBe(true)
+  expect(keys.some((key) => key.endsWith('public:198.51.100.9'))).toBe(true)
+  expect(keys.some((key) => key.endsWith('public:anonymous'))).toBe(false)
+})
+
+test('allows an IP-restricted API key through generated tools', async () => {
+  const db = TestApp.database()
+  await TestApp.verifiedSeed(db, Runtime.get().chainId)
+  const key = {
+    ...TestApp.key,
+    allowedIps: ['203.0.113.0/24'],
+  }
+  const app = App.create({
+    auth: {},
+    cache: { edge: false },
+    db,
+    kv: { store: TestApp.kvStore({ keys: [key] }) },
+  }).route('/', data())
+  app.route('/', mcp({ docs: false, fetch: (request) => app.fetch(request) }))
+  const headers = {
+    authorization: `Bearer ${key.token}`,
+    'cf-connecting-ip': '203.0.113.7',
+  }
+  await initialize(app, headers)
+
+  const result = await generatedToolCall(app, 'v1_tokens_get', { verified: true }, headers)
+
+  expect(result.isError, JSON.stringify(result.content)).toBeFalsy()
+})
+
+test('preserves a configured trusted client identity through generated tools', async () => {
+  const db = TestApp.database()
+  await TestApp.verifiedSeed(db, Runtime.get().chainId)
+  const key = {
+    ...TestApp.key,
+    allowedIps: ['198.51.100.0/24'],
+  }
+  const app = App.create({
+    auth: { public: { clientIp: (request) => request.headers.get('x-real-ip') ?? undefined } },
+    cache: { edge: false },
+    db,
+    kv: { store: TestApp.kvStore({ keys: [key] }) },
+  }).route('/', data())
+  app.route('/', mcp({ docs: false, fetch: (request) => app.fetch(request) }))
+  const headers = {
+    authorization: `Bearer ${key.token}`,
+    'cf-connecting-ip': '203.0.113.7',
+    'tempo-mcp-client-ip': '192.0.2.1',
+    'x-real-ip': '198.51.100.9',
+  }
+  await initialize(app, headers)
+
+  const result = await generatedToolCall(app, 'v1_tokens_get', { verified: true }, headers)
+
+  expect(result.isError, JSON.stringify(result.content)).toBeFalsy()
+})
+
 test('proxies docs tool calls to the remote MCP source', async () => {
   const { host } = createHost({ docs: docsStub() })
   await initialize(host)