@frontmcp/auth 1.11.1 → 1.11.3

package/browser/jwks/jwks.service.mjs

@@ -9,14 +9,7 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 });
 
 // libs/auth/src/jwks/jwks.service.ts
-import {
-  bytesToHex,
-  createKeyPersistence,
-  isProduction,
-  isRedirectResponse,
-  randomBytes,
-  rsaVerify
-} from "@frontmcp/utils";
+import { bytesToHex, isProduction, isRedirectResponse, randomBytes, rsaVerify } from "@frontmcp/utils";
 import { resolveAndCheckHostname } from "../cimd/cimd.validator.mjs";
 import { noopAuthLogger } from "../common/auth-logger.interface.mjs";
 import { loadJose } from "./jose.loader.mjs";
@@ -88,16 +81,12 @@ var JwksService = class {
   warnedProviders = /* @__PURE__ */ new Set();
   // Orchestrator signing material
   orchestratorKey;
+  // The keys this server's own tokens verify with (see setPublicJwks)
+  publicJwks = { keys: [] };
   // Provider JWKS cache (providerId -> jwks + fetchedAt)
   providerJwks = /* @__PURE__ */ new Map();
   // The last key refetch an unknown `kid` started, per provider (see refetchForUnknownKid)
   unknownKidRefetches = /* @__PURE__ */ new Map();
-  // Track if key has been initialized (for async loading)
-  keyInitialized = false;
-  // Promise guard to prevent concurrent key generation
-  keyInitPromise;
-  // KeyPersistence instance for unified key storage
-  keyPersistence;
   constructor(opts) {
     this.logger = opts?.logger ?? noopAuthLogger;
     this.opts = {
@@ -110,27 +99,15 @@ var JwksService = class {
     };
   }
   // ===========================================================================
-  // Key Persistence Helpers
-  // ===========================================================================
-  /**
-   * Get or create the KeyPersistence instance.
-   * Returns null if persistence is disabled (production).
-   */
-  async getKeyPersistence() {
-    if (isProduction()) return null;
-    if (!this.keyPersistence) {
-      this.keyPersistence = await createKeyPersistence({
-        baseDir: ".frontmcp/keys"
-      });
-    }
-    return this.keyPersistence;
-  }
-  // ===========================================================================
   // Public JWKS (what /.well-known/jwks.json serves)
   // ===========================================================================
-  /** Gateway's public JWKS (publish at /.well-known/jwks.json when orchestrated). */
+  /** The public keys this server's tokens verify with, served at `/.well-known/jwks.json`; empty for HMAC tokens. */
   async getPublicJwks() {
-    return this.getOrchestratorJwks();
+    return { keys: [...this.publicJwks.keys] };
+  }
+  /** Set the public keys {@link getPublicJwks} serves (`LocalTokenKeys.publicJwks`). */
+  setPublicJwks(jwks) {
+    this.publicJwks = { keys: [...jwks.keys] };
   }
   // ===========================================================================
   // Scope-aware verification API
@@ -393,14 +370,20 @@ var JwksService = class {
   // ===========================================================================
   // Orchestrator keys (generation/rotation)
   // ===========================================================================
-  /** Return the orchestrator public JWKS (generates/rotates as needed). */
+  /**
+   * Return the orchestrator public JWKS (generates/rotates as needed, in memory).
+   * @deprecated FrontMCP never signs with this key; `getPublicJwks()` serves the keys its tokens verify with.
+   */
   async getOrchestratorJwks() {
-    await this.ensureOrchestratorKey();
+    this.ensureOrchestratorKey();
     return this.orchestratorKey.publicJwk;
   }
-  /** Return private signing key + kid for issuing orchestrator tokens. */
+  /**
+   * Return private signing key + kid for issuing orchestrator tokens.
+   * @deprecated FrontMCP never signs with this key; configure `signKey` to sign tokens with your own key.
+   */
   async getOrchestratorSigningKey() {
-    await this.ensureOrchestratorKey();
+    this.ensureOrchestratorKey();
     return { kid: this.orchestratorKey.kid, key: this.orchestratorKey.privateKey, alg: this.opts.orchestratorAlg };
   }
   // ===========================================================================
@@ -469,74 +452,10 @@ var JwksService = class {
       clearTimeout(timer);
     }
   }
-  async ensureOrchestratorKey() {
-    const now = Date.now();
+  ensureOrchestratorKey() {
     const maxAge = this.opts.rotateDays * 24 * 60 * 60 * 1e3;
-    if (this.orchestratorKey && now - this.orchestratorKey.createdAt <= maxAge) {
-      return;
-    }
-    if (this.keyInitPromise) {
-      await this.keyInitPromise;
-      return;
-    }
-    this.keyInitPromise = this.initializeOrchestratorKey(now, maxAge);
-    try {
-      await this.keyInitPromise;
-    } finally {
-      this.keyInitPromise = void 0;
-    }
-  }
-  async initializeOrchestratorKey(now, maxAge) {
-    const persistence = await this.getKeyPersistence();
-    if (persistence && !this.keyInitialized) {
-      this.keyInitialized = true;
-      const loaded = await persistence.getAsymmetric("jwks-orchestrator");
-      if (loaded && now - loaded.createdAt <= maxAge) {
-        if (loaded.alg !== this.opts.orchestratorAlg) {
-          this.logger.warn(
-            "[JwksService] Persisted key algorithm (%s) doesn't match config (%s), generating new key",
-            loaded.alg,
-            this.opts.orchestratorAlg
-          );
-        } else {
-          try {
-            const { createPrivateKey } = __require("node:crypto");
-            const privateKey = createPrivateKey({
-              key: loaded.privateKey,
-              format: "jwk"
-            });
-            this.orchestratorKey = {
-              kid: loaded.kid,
-              privateKey,
-              publicJwk: loaded.publicJwk,
-              createdAt: loaded.createdAt
-            };
-            return;
-          } catch (error) {
-            this.logger.warn(
-              "[JwksService] Failed to load persisted key: %s, generating new key",
-              error.message
-            );
-          }
-        }
-      }
-    }
-    this.orchestratorKey = this.generateKey(this.opts.orchestratorAlg);
-    this.keyInitialized = true;
-    if (persistence) {
-      try {
-        await persistence.set({
-          type: "asymmetric",
-          kid: this.orchestratorKey.kid,
-          alg: this.opts.orchestratorAlg,
-          privateKey: this.orchestratorKey.privateKey.export({ format: "jwk" }),
-          publicJwk: this.orchestratorKey.publicJwk,
-          createdAt: this.orchestratorKey.createdAt,
-          version: 1
-        });
-      } catch (error) {
-        this.logger.warn("[JwksService] Failed to persist dev key: %s", error.message);
-      }
+    if (!this.orchestratorKey || Date.now() - this.orchestratorKey.createdAt > maxAge) {
+      this.orchestratorKey = this.generateKey(this.opts.orchestratorAlg);
     }
   }
   generateKey(alg) {

package/browser/jwks/local-token-keys.mjs

@@ -0,0 +1,155 @@
+// libs/auth/src/jwks/local-token-keys.ts
+import { base64urlDecode, sha256Base64url } from "@frontmcp/utils";
+import { SigningKeyInvalidError } from "../errors/auth-internal.errors.mjs";
+import { loadJose } from "./jose.loader.mjs";
+var HMAC_MIN_BYTES = { HS256: 32, HS384: 48, HS512: 64 };
+var ALGS_BY_KTY = {
+  RSA: ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512"],
+  EC: ["ES256", "ES384", "ES512"],
+  OKP: ["EdDSA", "Ed25519"]
+};
+var EC_ALG_BY_CURVE = { "P-256": "ES256", "P-384": "ES384", "P-521": "ES512" };
+var PUBLIC_MEMBERS = {
+  RSA: ["e", "kty", "n"],
+  EC: ["crv", "kty", "x", "y"],
+  OKP: ["crv", "kty", "x"]
+};
+var MIN_RSA_MODULUS_BYTES = 256;
+function isAsymmetricKty(kty) {
+  return kty === "RSA" || kty === "EC" || kty === "OKP";
+}
+var LocalTokenKeys = class _LocalTokenKeys {
+  constructor(alg, kid, publicJwks, algorithms, hmacKey, privateJwk) {
+    this.alg = alg;
+    this.kid = kid;
+    this.publicJwks = publicJwks;
+    this.algorithms = algorithms;
+    this.hmacKey = hmacKey;
+    this.privateJwk = privateJwk;
+  }
+  alg;
+  kid;
+  publicJwks;
+  algorithms;
+  hmacKey;
+  privateJwk;
+  importedKey;
+  /** The published keys as one JWK set, built once: the set imports each key on its first use and keeps it. */
+  publicKeySet;
+  /** Throws {@link SigningKeyInvalidError} when a configured key can't sign or be published. */
+  static fromConfig(config, fallbackSecret, optionPath) {
+    const { signKey, jwks } = config;
+    if (signKey !== void 0 && !(signKey instanceof Uint8Array) && signKey.kty !== "oct") {
+      return _LocalTokenKeys.asymmetric(signKey, jwks?.keys ?? [], optionPath);
+    }
+    if (jwks?.keys?.length) {
+      const hmacSource = signKey ? `${optionPath}.signKey` : "JWT_SECRET";
+      throw new SigningKeyInvalidError(
+        `${optionPath}.jwks is set, but tokens are signed with an HMAC key (${hmacSource}), which is never published. Set an RSA, EC or Ed25519 private key as ${optionPath}.signKey.`
+      );
+    }
+    const hmac = _LocalTokenKeys.hmacKeyOf(signKey, fallbackSecret, `${optionPath}.signKey`);
+    return new _LocalTokenKeys(hmac.alg, hmac.kid, { keys: [] }, [hmac.alg], hmac.key, void 0);
+  }
+  protectedHeader() {
+    return this.kid ? { alg: this.alg, typ: "JWT", kid: this.kid } : { alg: this.alg, typ: "JWT" };
+  }
+  /** The key `SignJWT.sign` takes; a private JWK is imported once. */
+  signingKey() {
+    if (this.hmacKey) return Promise.resolve(this.hmacKey);
+    this.importedKey ??= loadJose().then(({ importJWK }) => importJWK(this.privateJwk, this.alg)).catch((error) => {
+      this.importedKey = void 0;
+      const reason = error instanceof Error ? error.message : String(error);
+      throw new SigningKeyInvalidError(`The configured signKey can't be imported: ${reason}`);
+    });
+    return this.importedKey;
+  }
+  /** Verify a token's signature, pinned to the algorithms these keys sign with. */
+  async verify(token, options) {
+    const { createLocalJWKSet, jwtVerify } = await loadJose();
+    const verifyOptions = { ...options, algorithms: this.algorithms };
+    if (this.hmacKey) return jwtVerify(token, this.hmacKey, verifyOptions);
+    this.publicKeySet ??= createLocalJWKSet(this.publicJwks);
+    return jwtVerify(token, this.publicKeySet, verifyOptions);
+  }
+  static asymmetric(signKey, jwksKeys, optionPath) {
+    const signing = _LocalTokenKeys.publicKeyOf(signKey, `${optionPath}.signKey`, "private");
+    const published = [signing];
+    jwksKeys.forEach((key, index) => {
+      const publicKey = _LocalTokenKeys.publicKeyOf(key, `${optionPath}.jwks.keys[${index}]`, "public");
+      if (!published.some((existing) => existing.kid === publicKey.kid)) published.push(publicKey);
+    });
+    const algorithms = [...new Set(published.map((key) => key.alg))];
+    return new _LocalTokenKeys(signing.alg, signing.kid, { keys: published }, algorithms, void 0, signKey);
+  }
+  static hmacKeyOf(signKey, fallbackSecret, path) {
+    if (signKey === void 0) return { alg: "HS256", key: fallbackSecret };
+    if (signKey instanceof Uint8Array) return { alg: "HS256", key: _LocalTokenKeys.longEnough(signKey, "HS256", path) };
+    const alg = signKey.alg ?? "HS256";
+    if (!(alg in HMAC_MIN_BYTES)) {
+      throw new SigningKeyInvalidError(`${path} is an oct key with alg "${alg}"; use HS256, HS384 or HS512.`);
+    }
+    if (typeof signKey.k !== "string" || signKey.k.length === 0) {
+      throw new SigningKeyInvalidError(`${path} is an oct key without "k".`);
+    }
+    return { alg, kid: signKey.kid, key: _LocalTokenKeys.longEnough(base64urlDecode(signKey.k), alg, path) };
+  }
+  static longEnough(key, alg, path) {
+    const minBytes = HMAC_MIN_BYTES[alg];
+    if (key.length < minBytes) {
+      throw new SigningKeyInvalidError(
+        `${path} is ${key.length} bytes; ${alg} requires at least ${minBytes} (RFC 7518 \xA73.2).`
+      );
+    }
+    return key;
+  }
+  /** The public half of `key` with its `kid` (else its RFC 7638 thumbprint), `alg` and `use`. */
+  static publicKeyOf(key, path, expected) {
+    if (!isAsymmetricKty(key.kty)) {
+      throw new SigningKeyInvalidError(`${path} has kty "${String(key.kty)}"; use an RSA, EC or OKP key.`);
+    }
+    const isPrivate = typeof key.d === "string";
+    if (expected === "private" && !isPrivate) {
+      throw new SigningKeyInvalidError(`${path} is a public key (it has no "d"); it must be the private key.`);
+    }
+    if (expected === "public" && isPrivate) {
+      throw new SigningKeyInvalidError(
+        `${path} holds a private key; the jwks are published, so list public keys only.`
+      );
+    }
+    if (key.use !== void 0 && key.use !== "sig") {
+      throw new SigningKeyInvalidError(`${path} has use "${key.use}"; a signing key needs use "sig" or none.`);
+    }
+    const alg = key.alg ?? _LocalTokenKeys.defaultAlg(key);
+    if (!ALGS_BY_KTY[key.kty].includes(alg)) {
+      throw new SigningKeyInvalidError(`${path} has alg "${alg}", which ${key.kty} keys can't sign with.`);
+    }
+    if (key.kty === "EC" && EC_ALG_BY_CURVE[key.crv ?? ""] !== alg) {
+      throw new SigningKeyInvalidError(
+        `${path} has curve "${String(key.crv)}" and alg "${alg}"; use P-256/ES256, P-384/ES384 or P-521/ES512.`
+      );
+    }
+    if (key.kty === "OKP" && key.crv !== "Ed25519") {
+      throw new SigningKeyInvalidError(`${path} is an OKP key on "${String(key.crv)}"; only Ed25519 signs.`);
+    }
+    const members = PUBLIC_MEMBERS[key.kty];
+    const missing = members.filter((member) => typeof key[member] !== "string");
+    if (missing.length > 0) {
+      throw new SigningKeyInvalidError(`${path} is missing ${missing.map((member) => `"${member}"`).join(", ")}.`);
+    }
+    if (key.kty === "RSA" && base64urlDecode(key.n).length < MIN_RSA_MODULUS_BYTES) {
+      throw new SigningKeyInvalidError(`${path} is an RSA key shorter than 2048 bits.`);
+    }
+    const publicMembers = Object.fromEntries(members.map((member) => [member, key[member]]));
+    const kid = key.kid ?? sha256Base64url(JSON.stringify(publicMembers));
+    return { ...publicMembers, kid, alg, use: "sig" };
+  }
+  static defaultAlg(key) {
+    if (key.kty === "RSA") return "RS256";
+    if (key.kty === "OKP") return "EdDSA";
+    return EC_ALG_BY_CURVE[key.crv ?? ""] ?? "ES256";
+  }
+};
+export {
+  LocalTokenKeys
+};

package/browser/options/public.schema.mjs

@@ -24,13 +24,16 @@ var publicAuthOptionsSchema = z.object({
    */
   publicAccess: publicAccessConfigSchema.optional(),
   /**
-   * JWKS for token verification
-   * @default auto-generated
+   * Public keys published at `/.well-known/jwks.json` beside the `signKey`'s, and accepted on verification
+   * (e.g. a retired key's, while its tokens expire). Needs an RSA, EC or Ed25519 `signKey`.
+   * @default the `signKey`'s public key only
    */
   jwks: jsonWebKeySetSchema.optional(),
   /**
-   * Private key for signing anonymous tokens
-   * @default auto-generated
+   * Private key to sign tokens with, in place of `JWT_SECRET` (HS256).
+   * An RSA, EC or Ed25519 private JWK signs with its `alg` (default by key type) and is published at
+   * `/.well-known/jwks.json`; a `Uint8Array` or `oct` JWK is an HMAC key and is never published.
+   * @default HS256 with `JWT_SECRET`
    */
   signKey: jwkSchema.or(z.instanceof(Uint8Array)).optional()
 });

package/browser/options/shared.schemas.mjs

@@ -30,13 +30,16 @@ var publicAccessConfigSchema = z.object({
 });
 var localSigningConfigSchema = z.object({
   /**
-   * Private key for signing tokens
-   * @default auto-generated
+   * Private key to sign tokens with, in place of `JWT_SECRET` (HS256).
+   * An RSA, EC or Ed25519 private JWK signs with its `alg` (default by key type) and is published at
+   * `/.well-known/jwks.json`; a `Uint8Array` or `oct` JWK is an HMAC key and is never published.
+   * @default HS256 with `JWT_SECRET`
    */
   signKey: jwkSchema.or(z.instanceof(Uint8Array)).optional(),
   /**
-   * JWKS for token verification
-   * @default auto-generated
+   * Public keys published at `/.well-known/jwks.json` beside the `signKey`'s, and accepted on verification
+   * (e.g. a retired key's, while its tokens expire). Needs an RSA, EC or Ed25519 `signKey`.
+   * @default the `signKey`'s public key only
    */
   jwks: jsonWebKeySetSchema.optional(),
   /**
@@ -80,7 +83,11 @@ var providerConfigSchema = z.object({
    */
   verifyIssuer: z.boolean().optional(),
   /**
-   * Enable Dynamic Client Registration (DCR)
+   * Remote mode: without a `clientId`, register this server with the provider by
+   * dynamic client registration (RFC 7591) at startup, and sign in with that client.
+   * With a persistent `tokenStorage` the client is kept there (its secret encrypted
+   * with `JWT_SECRET`) and reused across restarts and instances. Startup fails when
+   * the registration fails. Ignored when `clientId` is set, and in transparent mode.
    * @default false
    */
   dcrEnabled: z.boolean().default(false),
@@ -88,7 +95,10 @@ var providerConfigSchema = z.object({
   authEndpoint: z.string().url().optional(),
   /** Token endpoint override */
   tokenEndpoint: z.string().url().optional(),
-  /** Registration endpoint override (for DCR) */
+  /**
+   * Registration endpoint for `dcrEnabled`.
+   * @default the `registration_endpoint` of the provider's RFC 8414 or OpenID metadata
+   */
   registrationEndpoint: z.string().url().optional(),
   /** User info endpoint override */
   userInfoEndpoint: z.string().url().optional()
@@ -130,7 +140,11 @@ var remoteProviderConfigSchema = z.object({
    */
   scopes: z.array(z.string()).optional(),
   /**
-   * Enable Dynamic Client Registration (DCR)
+   * Remote mode: without a `clientId`, register this server with the provider by
+   * dynamic client registration (RFC 7591) at startup, and sign in with that client.
+   * With a persistent `tokenStorage` the client is kept there (its secret encrypted
+   * with `JWT_SECRET`) and reused across restarts and instances. Startup fails when
+   * the registration fails. Ignored when `clientId` is set, and in transparent mode.
    * @default false
    */
   dcrEnabled: z.boolean().default(false),
@@ -143,7 +157,8 @@ var remoteProviderConfigSchema = z.object({
    */
   tokenEndpoint: z.string().url().optional(),
   /**
-   * Registration endpoint override (for DCR)
+   * Registration endpoint for `dcrEnabled`.
+   * @default the `registration_endpoint` of the provider's RFC 8414 or OpenID metadata
    */
   registrationEndpoint: z.string().url().optional(),
   /**
@@ -212,11 +227,11 @@ var localDcrClientSchema = z.object({
    * Token-endpoint auth method. Defaults to `'none'` (public PKCE client).
    */
   tokenEndpointAuthMethod: z.enum(["none", "client_secret_basic", "client_secret_post"]).default("none"),
-  /** Allowed grant types. Defaults to `['authorization_code']`. */
-  grantTypes: z.array(z.enum(["authorization_code", "refresh_token"])).default(["authorization_code"]),
+  /** Allowed grant types; without `refresh_token`, the client gets no refresh token. Defaults to both. */
+  grantTypes: z.array(z.enum(["authorization_code", "refresh_token"])).default(["authorization_code", "refresh_token"]),
   /** Allowed response types. Defaults to `['code']`. */
   responseTypes: z.array(z.enum(["code"])).default(["code"]),
-  /** Optional space-delimited default scope string. */
+  /** Space-delimited scopes this client may be granted; a request for others is narrowed to these. */
   scope: z.string().optional()
 });
 var localDcrConfigSchema = z.object({
@@ -469,12 +484,22 @@ var incrementalAuthConfigSchema = z.object({
    */
   skippedAppBehavior: skippedAppBehaviorSchema.default("anonymous"),
   /**
-   * Allow users to skip app authorization during initial auth flow
+   * Allow users to skip app authorization during initial auth flow. With
+   * `false`, a sign-in through the provider picker must link the provider of
+   * every app with its own `auth`: the picker shows them checked and required,
+   * and the callbacks refuse a sign-in that leaves one out or declines it.
    * @default true
    */
   allowSkip: z.boolean().default(true),
   /**
-   * Show all apps in a single authorization page (vs step-by-step)
+   * Show every provider on one picker page (`true`), or one per page (`false`):
+   * the sign-in then walks the picker's providers in order, and each step
+   * links or skips one of them (with Back to change an answer). Each step is
+   * checked server-side: a CSRF token, and `allowSkip` and
+   * `federatedAuth.requiredProviders` refuse skipping a required provider.
+   * The last step carries the sign-in fields, and finishes the sign-in as the
+   * one-page picker does. A custom `@AuthUi({ slot: 'federated' })` page gets
+   * the step in `extras.step` (see `FederatedStep`).
    * @default true
    */
   showAllAppsAtOnce: z.boolean().default(true)

package/browser/session/federated-auth.session.mjs

@@ -88,6 +88,7 @@ var InMemoryFederatedAuthSessionStore = class {
       completedProviders: /* @__PURE__ */ new Map(),
       skippedProviders: [],
       signinBinding: params.signinBinding,
+      authorizedAppIds: params.authorizedAppIds,
       createdAt: now,
       expiresAt: now + this.sessionTtlMs
     };
@@ -121,6 +122,7 @@ function createFederatedAuthSession(params, ttlMs = 15 * 60 * 1e3) {
     completedProviders: /* @__PURE__ */ new Map(),
     skippedProviders: [],
     signinBinding: params.signinBinding,
+    authorizedAppIds: params.authorizedAppIds,
     createdAt: now,
     expiresAt: now + ttlMs
   };

package/browser/session/incremental-auth-ticket.mjs

@@ -1,13 +1,29 @@
 // libs/auth/src/session/incremental-auth-ticket.ts
 import { randomUUID, signData, verifyData } from "@frontmcp/utils";
+import { openPendingLogin, sealPendingLogin } from "./pending-login.mjs";
 var DEFAULT_INCREMENTAL_TICKET_TTL_MS = 3e5;
+function profileKey(secret) {
+  return new TextEncoder().encode(secret);
+}
+function profileBinding(jti) {
+  return `incremental-ticket:${jti}`;
+}
 function signIncrementalAuthTicket(input, secret) {
+  const jti = randomUUID();
+  const hasProfile = input.email !== void 0 || input.name !== void 0;
   const payload = {
     sub: input.sub,
     appId: input.appId,
     ...input.toolId !== void 0 ? { toolId: input.toolId } : {},
     ...input.priorAppIds !== void 0 ? { priorAppIds: input.priorAppIds } : {},
-    jti: randomUUID(),
+    ...hasProfile ? {
+      profile: sealPendingLogin(profileKey(secret), profileBinding(jti), {
+        sub: input.sub,
+        email: input.email,
+        name: input.name
+      })
+    } : {},
+    jti,
     exp: Date.now() + (input.ttlMs ?? DEFAULT_INCREMENTAL_TICKET_TTL_MS)
   };
   const signedJson = signData(payload, { secret });
@@ -27,6 +43,7 @@ function verifyIncrementalAuthTicket(token, secret, now = Date.now()) {
   if (typeof payload.jti !== "string" || payload.jti.length === 0) return null;
   if (!Number.isFinite(payload.exp)) return null;
   if (payload.toolId !== void 0 && typeof payload.toolId !== "string") return null;
+  if (payload.profile !== void 0 && typeof payload.profile !== "string") return null;
   if (payload.priorAppIds !== void 0 && (!Array.isArray(payload.priorAppIds) || payload.priorAppIds.some((id) => typeof id !== "string"))) {
     return null;
   }
@@ -35,8 +52,14 @@ function verifyIncrementalAuthTicket(token, secret, now = Date.now()) {
   }
   return payload;
 }
+function openIncrementalAuthTicketProfile(payload, secret) {
+  if (!payload.profile) return void 0;
+  const login = openPendingLogin(profileKey(secret), profileBinding(payload.jti), payload.profile);
+  return login?.sub === payload.sub ? { sub: login.sub, email: login.email, name: login.name } : void 0;
+}
 export {
   DEFAULT_INCREMENTAL_TICKET_TTL_MS,
+  openIncrementalAuthTicketProfile,
   signIncrementalAuthTicket,
   verifyIncrementalAuthTicket
 };

package/browser/session/index.mjs

@@ -55,6 +55,7 @@ import {
 import {
   signIncrementalAuthTicket,
   verifyIncrementalAuthTicket,
+  openIncrementalAuthTicketProfile,
   DEFAULT_INCREMENTAL_TICKET_TTL_MS
 } from "./incremental-auth-ticket.mjs";
 import { CREDENTIALS_ACCESSOR } from "./credentials-accessor.mjs";
@@ -100,6 +101,7 @@ import {
   decryptSessionJson,
   safeDecrypt,
   resetCachedKey,
+  isSessionSecretConfigured,
   TinyTtlCache
 } from "./utils/index.mjs";
 import {
@@ -219,6 +221,7 @@ export {
   isPersistentTokenStorage,
   isRedisTokenStorage,
   isSessionComplete,
+  isSessionSecretConfigured,
   isSignedSession,
   isSoonExpiring,
   isSoonExpiringProvider,
@@ -226,6 +229,7 @@ export {
   legacySseTransportStateSchema,
   mtlsCredentialSchema,
   oauthCredentialSchema,
+  openIncrementalAuthTicketProfile,
   openPendingLogin,
   pendingIncrementalAuthSchema,
   pkceChallengeSchema,

package/browser/session/redis-session.store.mjs

@@ -1,11 +1,11 @@
 // libs/auth/src/session/redis-session.store.ts
 import { randomUUID, RedisStorageAdapter } from "@frontmcp/utils";
+import { SessionIdEmptyError } from "../errors/auth-internal.errors.mjs";
+import { signSession, verifyOrParseSession } from "./session-crypto.mjs";
+import { SessionRateLimiter } from "./session-rate-limiter.mjs";
 import {
   storedSessionSchema
 } from "./transport-session.types.mjs";
-import { signSession, verifyOrParseSession } from "./session-crypto.mjs";
-import { SessionRateLimiter } from "./session-rate-limiter.mjs";
-import { SessionIdEmptyError } from "../errors/auth-internal.errors.mjs";
 var RedisSessionStore = class {
   storage;
   keyPrefix;

package/browser/session/session-crypto.mjs

@@ -1,11 +1,11 @@
 // libs/auth/src/session/session-crypto.ts
 import {
+  getEnv,
+  isProduction,
+  isSignedData,
   signData,
   verifyData,
-  isSignedData,
-  verifyOrParseData,
-  getEnv,
-  isProduction
+  verifyOrParseData
 } from "@frontmcp/utils";
 import { SessionSecretRequiredError } from "../errors/auth-internal.errors.mjs";
 function getSigningSecret(config) {

package/browser/session/storage/storage-authorization-vault.mjs

@@ -1,6 +1,8 @@
 // libs/auth/src/session/storage/storage-authorization-vault.ts
 import { randomUUID, TypedStorage } from "@frontmcp/utils";
-import { authorizationVaultEntrySchema } from "../authorization-vault.mjs";
+import {
+  authorizationVaultEntrySchema
+} from "../authorization-vault.mjs";
 var StorageAuthorizationVault = class {
   storage;
   namespace;

package/browser/session/token.vault.mjs

@@ -1,5 +1,5 @@
 // libs/auth/src/session/token.vault.ts
-import { encryptAesGcm, decryptAesGcm, randomBytes, base64urlEncode, base64urlDecode } from "@frontmcp/utils";
+import { base64urlDecode, base64urlEncode, decryptAesGcm, encryptAesGcm, randomBytes } from "@frontmcp/utils";
 var TokenVault = class {
   /** Active key used for new encryptions */
   active;

package/browser/session/utils/index.mjs

@@ -7,7 +7,14 @@ import {
   anonymousCallerClaims,
   extractBearerToken
 } from "./auth-token.utils.mjs";
-import { getKey, encryptJson, decryptSessionJson, safeDecrypt, resetCachedKey } from "./session-crypto.utils.mjs";
+import {
+  getKey,
+  encryptJson,
+  decryptSessionJson,
+  safeDecrypt,
+  resetCachedKey,
+  isSessionSecretConfigured
+} from "./session-crypto.utils.mjs";
 export {
   TinyTtlCache,
   anonymousCallerClaims,
@@ -18,6 +25,7 @@ export {
   getKey,
   getTokenSignatureFingerprint,
   isJwt,
+  isSessionSecretConfigured,
   resetCachedKey,
   safeDecrypt
 };

package/browser/session/utils/session-crypto.utils.mjs

@@ -17,6 +17,9 @@ function getKey() {
   cachedKey = sha256(new TextEncoder().encode(base));
   return cachedKey;
 }
+function isSessionSecretConfigured() {
+  return !!getEnv("MCP_SESSION_SECRET");
+}
 function encryptJson(obj) {
   const key = getKey();
   const encrypted = encryptValue(obj, key);
@@ -44,6 +47,7 @@ export {
   decryptSessionJson,
   encryptJson,
   getKey,
+  isSessionSecretConfigured,
   resetCachedKey,
   safeDecrypt
 };

package/browser/ui/index.mjs

@@ -16,6 +16,7 @@ import {
   buildConsentPage,
   buildIncrementalAuthPage,
   buildFederatedLoginPage,
+  buildFederatedStepPage,
   buildToolConsentPage,
   buildLoginPage,
   buildConnectPage,
@@ -35,6 +36,7 @@ export {
   buildConsentPage,
   buildErrorPage,
   buildFederatedLoginPage,
+  buildFederatedStepPage,
   buildIncrementalAuthPage,
   buildLoginPage,
   buildToolConsentPage,