@frontmcp/auth 1.7.1 → 1.7.2

package/index.js

@@ -262,15 +262,16 @@ __export(index_exports, {
   CredentialProviderAlreadyRegisteredError: () => CredentialProviderAlreadyRegisteredError,
   CredentialStorageError: () => CredentialStorageError,
   CredentialsAccessorImpl: () => CredentialsAccessorImpl,
+  DEFAULT_INCREMENTAL_TICKET_TTL_MS: () => DEFAULT_INCREMENTAL_TICKET_TTL_MS,
   DEFAULT_RESUME_TTL_MS: () => DEFAULT_RESUME_TTL_MS,
   DEFAULT_THEME: () => DEFAULT_THEME,
   DcrClientRegistry: () => DcrClientRegistry,
   EagerCredentialLoader: () => EagerCredentialLoader,
   ElicitationSecretRequiredError: () => ElicitationSecretRequiredError,
   EncryptedRedisVault: () => EncryptedRedisVault,
-  EncryptedStorageError: () => import_utils22.EncryptedStorageError,
+  EncryptedStorageError: () => import_utils23.EncryptedStorageError,
   EncryptedStorageSecureStoreBackend: () => EncryptedStorageSecureStoreBackend,
-  EncryptedTypedStorage: () => import_utils22.EncryptedTypedStorage,
+  EncryptedTypedStorage: () => import_utils23.EncryptedTypedStorage,
   EncryptionContextNotSetError: () => EncryptionContextNotSetError,
   EncryptionKeyNotConfiguredError: () => EncryptionKeyNotConfiguredError,
   FetchCredentialMiddleware: () => FetchCredentialMiddleware,
@@ -316,7 +317,7 @@ __export(index_exports, {
   TokenVault: () => TokenVault,
   TransparentAuthorization: () => TransparentAuthorization,
   TransportIdGenerator: () => TransportIdGenerator,
-  TypedStorage: () => import_utils21.TypedStorage,
+  TypedStorage: () => import_utils22.TypedStorage,
   VaultEncryption: () => VaultEncryption,
   VaultLoadError: () => VaultLoadError,
   VaultNotFoundError: () => VaultNotFoundError,
@@ -398,9 +399,9 @@ __export(index_exports, {
   credentialTypeSchema: () => credentialTypeSchema,
   customCredentialSchema: () => customCredentialSchema,
   decodeJwtPayloadSafe: () => decodeJwtPayloadSafe,
-  decryptAesGcm: () => import_utils32.decryptAesGcm,
+  decryptAesGcm: () => import_utils33.decryptAesGcm,
   decryptSessionJson: () => decryptSessionJson,
-  decryptValue: () => import_utils32.decryptValue,
+  decryptValue: () => import_utils33.decryptValue,
   defaultSessionRateLimiter: () => defaultSessionRateLimiter,
   deriveAuthorizationId: () => deriveAuthorizationId,
   deriveExpectedAudience: () => deriveExpectedAudience,
@@ -408,9 +409,9 @@ __export(index_exports, {
   deriveTypedUser: () => deriveTypedUser,
   detectAuthProviders: () => detectAuthProviders,
   detectedAuthProviderSchema: () => detectedAuthProviderSchema,
-  encryptAesGcm: () => import_utils32.encryptAesGcm,
+  encryptAesGcm: () => import_utils33.encryptAesGcm,
   encryptJson: () => encryptJson,
-  encryptValue: () => import_utils32.encryptValue,
+  encryptValue: () => import_utils33.encryptValue,
   encryptedBlobSchema: () => encryptedBlobSchema,
   encryptedDataSchema: () => encryptedDataSchema,
   encryptedVaultEntrySchema: () => encryptedVaultEntrySchema,
@@ -436,7 +437,7 @@ __export(index_exports, {
   getTokenSignatureFingerprint: () => getTokenSignatureFingerprint,
   hasOnlyLocalhostRedirectUris: () => hasOnlyLocalhostRedirectUris,
   headerApplier: () => headerApplier,
-  hkdfSha256: () => import_utils32.hkdfSha256,
+  hkdfSha256: () => import_utils33.hkdfSha256,
   incrementalAuthConfigSchema: () => incrementalAuthConfigSchema,
   isCimdClientId: () => isCimdClientId,
   isFrontMcpCredentials: () => isFrontMcpCredentials,
@@ -450,7 +451,7 @@ __export(index_exports, {
   isRedisTokenStorage: () => isRedisTokenStorage,
   isRemoteMode: () => isRemoteMode,
   isSessionComplete: () => isSessionComplete,
-  isSignedSession: () => import_utils14.isSignedData,
+  isSignedSession: () => import_utils15.isSignedData,
   isSoonExpiring: () => isSoonExpiring,
   isSoonExpiringProvider: () => isSoonExpiringProvider,
   isSqliteTokenStorage: () => isSqliteTokenStorage,
@@ -505,6 +506,7 @@ __export(index_exports, {
   sessionIdPayloadSchema: () => sessionIdPayloadSchema,
   sessionJwtPayloadSchema: () => sessionJwtPayloadSchema,
   signCredentialResumeToken: () => signCredentialResumeToken,
+  signIncrementalAuthTicket: () => signIncrementalAuthTicket,
   signSession: () => signSession,
   skippedAppBehaviorSchema: () => skippedAppBehaviorSchema,
   sseTransportStateSchema: () => sseTransportStateSchema,
@@ -533,6 +535,7 @@ __export(index_exports, {
   vaultConsentRecordSchema: () => vaultConsentRecordSchema,
   vaultFederatedRecordSchema: () => vaultFederatedRecordSchema,
   verifyCredentialResumeToken: () => verifyCredentialResumeToken,
+  verifyIncrementalAuthTicket: () => verifyIncrementalAuthTicket,
   verifyOrParseSession: () => verifyOrParseSession,
   verifyPkce: () => verifyPkce,
   verifySession: () => verifySession,
@@ -1641,8 +1644,6 @@ function buildIncrementalAuthPage(params) {
 
       <form method="GET" action="${escapeHtml3(callbackPath)}" class="flex gap-3 pt-4 border-t border-gray-100">
         <input type="hidden" name="pending_auth_id" value="${escapeHtml3(sessionHint)}">
-        <input type="hidden" name="app_id" value="${escapeHtml3(app.appId)}">
-        <input type="hidden" name="incremental" value="true">
         <button type="button" onclick="window.close()"
           class="flex-1 px-4 py-2.5 text-gray-600 hover:text-gray-900 hover:bg-gray-100 font-medium rounded-lg transition-colors">
           Cancel
@@ -2126,6 +2127,7 @@ function buildPendingRecord(params) {
     createdAt: now,
     expiresAt: now + PENDING_AUTH_TTL_MS,
     isIncremental: params.isIncremental,
+    incrementalSub: params.incrementalSub,
     targetAppId: params.targetAppId,
     targetToolId: params.targetToolId,
     existingSessionId: params.existingSessionId,
@@ -3260,6 +3262,44 @@ function buildCredentialResumeUrl(basePath, token) {
   return `${trimmed}/oauth/connect?token=${encodeURIComponent(token)}`;
 }
 
+// libs/auth/src/session/incremental-auth-ticket.ts
+var import_utils10 = require("@frontmcp/utils");
+var DEFAULT_INCREMENTAL_TICKET_TTL_MS = 3e5;
+function signIncrementalAuthTicket(input, secret) {
+  const payload = {
+    sub: input.sub,
+    appId: input.appId,
+    ...input.toolId !== void 0 ? { toolId: input.toolId } : {},
+    ...input.priorAppIds !== void 0 ? { priorAppIds: input.priorAppIds } : {},
+    jti: (0, import_utils10.randomUUID)(),
+    exp: Date.now() + (input.ttlMs ?? DEFAULT_INCREMENTAL_TICKET_TTL_MS)
+  };
+  const signedJson = (0, import_utils10.signData)(payload, { secret });
+  return Buffer.from(signedJson, "utf8").toString("base64url");
+}
+function verifyIncrementalAuthTicket(token, secret, now = Date.now()) {
+  let signedJson;
+  try {
+    signedJson = Buffer.from(token, "base64url").toString("utf8");
+  } catch {
+    return null;
+  }
+  const payload = (0, import_utils10.verifyData)(signedJson, { secret });
+  if (!payload) return null;
+  if (typeof payload.sub !== "string" || payload.sub.length === 0) return null;
+  if (typeof payload.appId !== "string" || payload.appId.length === 0) return null;
+  if (typeof payload.jti !== "string" || payload.jti.length === 0) return null;
+  if (!Number.isFinite(payload.exp)) return null;
+  if (payload.toolId !== void 0 && typeof payload.toolId !== "string") return null;
+  if (payload.priorAppIds !== void 0 && (!Array.isArray(payload.priorAppIds) || payload.priorAppIds.some((id) => typeof id !== "string"))) {
+    return null;
+  }
+  if (now >= payload.exp) {
+    return null;
+  }
+  return payload;
+}
+
 // libs/auth/src/session/credentials-accessor.ts
 var CREDENTIALS_ACCESSOR = /* @__PURE__ */ Symbol.for("frontmcp:CREDENTIALS_ACCESSOR");
 
@@ -3424,7 +3464,7 @@ function errMsg2(err) {
 var SECURE_STORE_ACCESSOR = /* @__PURE__ */ Symbol.for("frontmcp:SECURE_STORE_ACCESSOR");
 
 // libs/auth/src/session/secure-store-accessor.impl.ts
-var import_utils10 = require("@frontmcp/utils");
+var import_utils11 = require("@frontmcp/utils");
 var GLOBAL_NAMESPACE = "global";
 var SecureStoreAccessorImpl = class {
   backend;
@@ -3453,12 +3493,12 @@ var SecureStoreAccessorImpl = class {
         return GLOBAL_NAMESPACE;
       case "session": {
         const sid = this.resolveSessionId();
-        return sid ? `s:${(0, import_utils10.sha256Hex)(sid).slice(0, 32)}` : void 0;
+        return sid ? `s:${(0, import_utils11.sha256Hex)(sid).slice(0, 32)}` : void 0;
       }
       case "user":
       default: {
         const sub = this.resolveSub();
-        return sub ? `u:${(0, import_utils10.sha256Hex)(sub).slice(0, 32)}` : void 0;
+        return sub ? `u:${(0, import_utils11.sha256Hex)(sub).slice(0, 32)}` : void 0;
       }
     }
   }
@@ -3499,7 +3539,7 @@ function errMsg3(err) {
 }
 
 // libs/auth/src/session/secure-store.factory.ts
-var import_utils11 = require("@frontmcp/utils");
+var import_utils12 = require("@frontmcp/utils");
 function isCustomBackendConfig(config) {
   return typeof config === "object" && config !== null && "backend" in config && !!config.backend;
 }
@@ -3548,7 +3588,7 @@ async function createSecureStore(options) {
   if (storage) {
     adapter = storage;
   } else if (kind === "memory") {
-    adapter = new import_utils11.MemoryStorageAdapter();
+    adapter = new import_utils12.MemoryStorageAdapter();
     await adapter.connect();
   } else {
     adapter = await createTokenStorageAdapter(toTokenStorageConfig(config));
@@ -3562,7 +3602,7 @@ async function createSecureStore(options) {
 }
 
 // libs/auth/src/session/token.vault.ts
-var import_utils12 = require("@frontmcp/utils");
+var import_utils13 = require("@frontmcp/utils");
 var TokenVault = class {
   /** Active key used for new encryptions */
   active;
@@ -3591,14 +3631,14 @@ var TokenVault = class {
     this.keys.set(k.kid, k.key);
   }
   async encrypt(plaintext, opts) {
-    const iv = (0, import_utils12.randomBytes)(12);
-    const { ciphertext, tag } = await (0, import_utils12.encryptAesGcm)(this.active.key, new TextEncoder().encode(plaintext), iv);
+    const iv = (0, import_utils13.randomBytes)(12);
+    const { ciphertext, tag } = await (0, import_utils13.encryptAesGcm)(this.active.key, new TextEncoder().encode(plaintext), iv);
     return {
       alg: "A256GCM",
       kid: this.active.kid,
-      iv: (0, import_utils12.base64urlEncode)(iv),
-      tag: (0, import_utils12.base64urlEncode)(tag),
-      data: (0, import_utils12.base64urlEncode)(ciphertext),
+      iv: (0, import_utils13.base64urlEncode)(iv),
+      tag: (0, import_utils13.base64urlEncode)(tag),
+      data: (0, import_utils13.base64urlEncode)(ciphertext),
       exp: opts?.exp,
       meta: opts?.meta
     };
@@ -3612,16 +3652,16 @@ var TokenVault = class {
     }
     const key = this.keys.get(blob.kid);
     if (!key) throw new Error(`vault_unknown_kid:${blob.kid}`);
-    const iv = (0, import_utils12.base64urlDecode)(blob.iv);
-    const tag = (0, import_utils12.base64urlDecode)(blob.tag);
-    const data = (0, import_utils12.base64urlDecode)(blob.data);
-    const plaintext = await (0, import_utils12.decryptAesGcm)(key, data, iv, tag);
+    const iv = (0, import_utils13.base64urlDecode)(blob.iv);
+    const tag = (0, import_utils13.base64urlDecode)(blob.tag);
+    const data = (0, import_utils13.base64urlDecode)(blob.data);
+    const plaintext = await (0, import_utils13.decryptAesGcm)(key, data, iv, tag);
     return new TextDecoder().decode(plaintext);
   }
 };
 
 // libs/auth/src/session/index.ts
-var import_utils32 = require("@frontmcp/utils");
+var import_utils33 = require("@frontmcp/utils");
 
 // libs/auth/src/session/transport-session.types.ts
 var import_lazy_zod4 = require("@frontmcp/lazy-zod");
@@ -3717,10 +3757,10 @@ var redisConfigSchema = import_lazy_zod4.z.object({
 });
 
 // libs/auth/src/session/session-crypto.ts
-var import_utils14 = require("@frontmcp/utils");
+var import_utils15 = require("@frontmcp/utils");
 
 // libs/auth/src/errors/auth-internal.error.ts
-var import_utils13 = require("@frontmcp/utils");
+var import_utils14 = require("@frontmcp/utils");
 var AuthInternalError = class extends Error {
   /**
    * Unique error ID for tracking in logs.
@@ -3742,7 +3782,7 @@ var AuthInternalError = class extends Error {
     super(message);
     this.name = this.constructor.name;
     this.code = code;
-    this.errorId = `err_${(0, import_utils13.bytesToHex)((0, import_utils13.randomBytes)(8))}`;
+    this.errorId = `err_${(0, import_utils14.bytesToHex)((0, import_utils14.randomBytes)(8))}`;
     Error.captureStackTrace(this, this.constructor);
   }
   /**
@@ -3865,9 +3905,9 @@ var AuthFlowError = class extends AuthInternalError {
 
 // libs/auth/src/session/session-crypto.ts
 function getSigningSecret(config) {
-  const secret = config?.secret || (0, import_utils14.getEnv)("MCP_SESSION_SECRET");
+  const secret = config?.secret || (0, import_utils15.getEnv)("MCP_SESSION_SECRET");
   if (!secret) {
-    if ((0, import_utils14.isProduction)()) {
+    if ((0, import_utils15.isProduction)()) {
       throw new SessionSecretRequiredError("session signing");
     }
     console.warn("[SessionCrypto] MCP_SESSION_SECRET not set. Using insecure default for development only.");
@@ -3879,13 +3919,13 @@ function resolveConfig(config) {
   return { secret: getSigningSecret(config) };
 }
 function signSession(session, config) {
-  return (0, import_utils14.signData)(session, resolveConfig(config));
+  return (0, import_utils15.signData)(session, resolveConfig(config));
 }
 function verifySession(signedData, config) {
-  return (0, import_utils14.verifyData)(signedData, resolveConfig(config));
+  return (0, import_utils15.verifyData)(signedData, resolveConfig(config));
 }
 function verifyOrParseSession(data, config) {
-  return (0, import_utils14.verifyOrParseData)(data, resolveConfig(config));
+  return (0, import_utils15.verifyOrParseData)(data, resolveConfig(config));
 }
 
 // libs/auth/src/session/session-rate-limiter.ts
@@ -4012,7 +4052,7 @@ var SessionRateLimiter = class {
 var defaultSessionRateLimiter = new SessionRateLimiter();
 
 // libs/auth/src/session/session.transport.ts
-var import_utils15 = require("@frontmcp/utils");
+var import_utils16 = require("@frontmcp/utils");
 var TransportIdGenerator = class {
   /**
    * Create a transport session ID.
@@ -4021,7 +4061,7 @@ var TransportIdGenerator = class {
    * @returns A transport session ID (UUID without dashes)
    */
   static createId() {
-    return (0, import_utils15.randomUUID)().replace(/-/g, "");
+    return (0, import_utils16.randomUUID)().replace(/-/g, "");
   }
 };
 
@@ -4070,7 +4110,7 @@ var TinyTtlCache = class {
 };
 
 // libs/auth/src/session/utils/auth-token.utils.ts
-var import_utils16 = require("@frontmcp/utils");
+var import_utils17 = require("@frontmcp/utils");
 function isJwt(token) {
   if (!token) return false;
   return token.split(".").length === 3;
@@ -4080,7 +4120,7 @@ function getTokenSignatureFingerprint(token) {
     const sig = token.split(".")[2];
     if (sig) return sig;
   }
-  return (0, import_utils16.sha256Base64url)(token);
+  return (0, import_utils17.sha256Base64url)(token);
 }
 function extractClaimValue(claims, key, validator) {
   const value = claims[key];
@@ -4112,26 +4152,26 @@ function extractBearerToken(header) {
 }
 
 // libs/auth/src/session/utils/session-crypto.utils.ts
-var import_utils17 = require("@frontmcp/utils");
+var import_utils18 = require("@frontmcp/utils");
 var cachedKey = null;
 function getKey() {
   if (cachedKey) return cachedKey;
-  const secret = (0, import_utils17.getEnv)("MCP_SESSION_SECRET");
+  const secret = (0, import_utils18.getEnv)("MCP_SESSION_SECRET");
   if (!secret) {
-    if ((0, import_utils17.isProduction)()) {
+    if ((0, import_utils18.isProduction)()) {
       throw new SessionSecretRequiredError("session ID encryption");
     }
     console.warn(
       "[SessionIdUtils] Using machine ID as session encryption secret - NOT SECURE FOR PRODUCTION. Set MCP_SESSION_SECRET environment variable for secure session encryption."
     );
   }
-  const base = secret || (0, import_utils17.getMachineId)();
-  cachedKey = (0, import_utils17.sha256)(new TextEncoder().encode(base));
+  const base = secret || (0, import_utils18.getMachineId)();
+  cachedKey = (0, import_utils18.sha256)(new TextEncoder().encode(base));
   return cachedKey;
 }
 function encryptJson(obj) {
   const key = getKey();
-  const encrypted = (0, import_utils17.encryptValue)(obj, key);
+  const encrypted = (0, import_utils18.encryptValue)(obj, key);
   return `${encrypted.iv}.${encrypted.tag}.${encrypted.data}`;
 }
 function decryptSessionJson(sessionId) {
@@ -4140,7 +4180,7 @@ function decryptSessionJson(sessionId) {
   const [ivB64, tagB64, ctB64] = parts;
   if (!ivB64 || !tagB64 || !ctB64) return null;
   const key = getKey();
-  return (0, import_utils17.decryptValue)({ alg: "A256GCM", iv: ivB64, tag: tagB64, data: ctB64 }, key);
+  return (0, import_utils18.decryptValue)({ alg: "A256GCM", iv: ivB64, tag: tagB64, data: ctB64 }, key);
 }
 function safeDecrypt(sessionId) {
   try {
@@ -4154,11 +4194,11 @@ function resetCachedKey() {
 }
 
 // libs/auth/src/session/storage/index.ts
-var import_utils21 = require("@frontmcp/utils");
 var import_utils22 = require("@frontmcp/utils");
+var import_utils23 = require("@frontmcp/utils");
 
 // libs/auth/src/session/storage/storage-token-store.ts
-var import_utils18 = require("@frontmcp/utils");
+var import_utils19 = require("@frontmcp/utils");
 var StorageTokenStore = class {
   storage;
   namespace;
@@ -4170,13 +4210,13 @@ var StorageTokenStore = class {
     this.defaultTtlSeconds = options.defaultTtlSeconds;
     this.storageIsNamespaced = "namespace" in storage && typeof storage.namespace === "function";
     const namespacedStorage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
-    this.storage = new import_utils18.TypedStorage(namespacedStorage);
+    this.storage = new import_utils19.TypedStorage(namespacedStorage);
   }
   /**
    * Allocate a new unique ID for a token record.
    */
   allocId() {
-    return (0, import_utils18.randomUUID)();
+    return (0, import_utils19.randomUUID)();
   }
   /**
    * Store an encrypted token blob.
@@ -4239,7 +4279,7 @@ var StorageTokenStore = class {
 };
 
 // libs/auth/src/session/storage/storage-authorization-vault.ts
-var import_utils19 = require("@frontmcp/utils");
+var import_utils20 = require("@frontmcp/utils");
 var StorageAuthorizationVault = class {
   storage;
   namespace;
@@ -4248,7 +4288,7 @@ var StorageAuthorizationVault = class {
     this.namespace = options.namespace ?? "vault";
     this.pendingAuthTtlMs = options.pendingAuthTtlMs ?? 10 * 60 * 1e3;
     const namespacedStorage = this.isNamespacedStorage(storage) ? storage.namespace(this.namespace) : storage;
-    this.storage = new import_utils19.TypedStorage(namespacedStorage, {
+    this.storage = new import_utils20.TypedStorage(namespacedStorage, {
       schema: options.validateOnRead ? authorizationVaultEntrySchema : void 0,
       throwOnInvalid: false
     });
@@ -4259,7 +4299,7 @@ var StorageAuthorizationVault = class {
   async create(params) {
     const now = Date.now();
     const entry = {
-      id: (0, import_utils19.randomUUID)(),
+      id: (0, import_utils20.randomUUID)(),
       userSub: params.userSub,
       userEmail: params.userEmail,
       userName: params.userName,
@@ -4333,7 +4373,7 @@ var StorageAuthorizationVault = class {
     }
     const now = Date.now();
     const pendingAuth = {
-      id: (0, import_utils19.randomUUID)(),
+      id: (0, import_utils20.randomUUID)(),
       appId: params.appId,
       toolId: params.toolId,
       authUrl: params.authUrl,
@@ -4537,11 +4577,11 @@ var StorageAuthorizationVault = class {
 };
 
 // libs/auth/src/session/storage/in-memory-authorization-vault.ts
-var import_utils20 = require("@frontmcp/utils");
+var import_utils21 = require("@frontmcp/utils");
 var InMemoryAuthorizationVault = class extends StorageAuthorizationVault {
   memoryAdapter;
   constructor(options = {}) {
-    const memoryAdapter = new import_utils20.MemoryStorageAdapter();
+    const memoryAdapter = new import_utils21.MemoryStorageAdapter();
     super(memoryAdapter, {
       namespace: options.namespace ?? "vault",
       pendingAuthTtlMs: options.pendingAuthTtlMs
@@ -4562,7 +4602,7 @@ var InMemoryAuthorizationVault = class extends StorageAuthorizationVault {
 };
 
 // libs/auth/src/session/redis-session.store.ts
-var import_utils23 = require("@frontmcp/utils");
+var import_utils24 = require("@frontmcp/utils");
 var RedisSessionStore = class {
   storage;
   keyPrefix;
@@ -4584,14 +4624,14 @@ var RedisSessionStore = class {
       });
     }
     if ("redis" in config && config.redis) {
-      this.storage = new import_utils23.RedisStorageAdapter({
+      this.storage = new import_utils24.RedisStorageAdapter({
         client: config.redis,
         keyPrefix: this.keyPrefix
       });
       this.externalInstance = true;
     } else {
       const redisConfig = config;
-      this.storage = new import_utils23.RedisStorageAdapter({
+      this.storage = new import_utils24.RedisStorageAdapter({
         config: {
           host: redisConfig.host,
           port: redisConfig.port ?? 6379,
@@ -4773,7 +4813,7 @@ var RedisSessionStore = class {
    * Allocate a new session ID
    */
   allocId() {
-    return (0, import_utils23.randomUUID)();
+    return (0, import_utils24.randomUUID)();
   }
   /**
    * Disconnect from Redis (only if we created the connection)
@@ -4809,7 +4849,7 @@ var RedisSessionStore = class {
 };
 
 // libs/auth/src/session/vercel-kv-session.store.ts
-var import_utils24 = require("@frontmcp/utils");
+var import_utils25 = require("@frontmcp/utils");
 var VercelKvSessionStore = class {
   storage;
   keyPrefix;
@@ -4829,7 +4869,7 @@ var VercelKvSessionStore = class {
         maxRequests: this.security.rateLimiting?.maxRequests
       });
     }
-    this.storage = new import_utils24.VercelKvStorageAdapter({
+    this.storage = new import_utils25.VercelKvStorageAdapter({
       url: config.url,
       token: config.token,
       keyPrefix: this.keyPrefix
@@ -5003,7 +5043,7 @@ var VercelKvSessionStore = class {
    * Allocate a new session ID
    */
   allocId() {
-    return (0, import_utils24.randomUUID)();
+    return (0, import_utils25.randomUUID)();
   }
   /**
    * Disconnect from Vercel KV
@@ -5032,7 +5072,7 @@ var VercelKvSessionStore = class {
 };
 
 // libs/auth/src/session/orchestrated-token.store.ts
-var import_utils25 = require("@frontmcp/utils");
+var import_utils26 = require("@frontmcp/utils");
 var InMemoryOrchestratedTokenStore = class {
   /** Token storage: Map<compositeKey, ProviderTokenRecord> */
   tokens = /* @__PURE__ */ new Map();
@@ -5074,7 +5114,7 @@ var InMemoryOrchestratedTokenStore = class {
     }
     const info = new TextEncoder().encode(`orchestrated-token:${compositeKey}`);
     const salt = new TextEncoder().encode("frontmcp-token-store");
-    const derivedKey = (0, import_utils25.hkdfSha256)(this.encryptionKey, salt, info, 32);
+    const derivedKey = (0, import_utils26.hkdfSha256)(this.encryptionKey, salt, info, 32);
     this.derivedKeys.set(compositeKey, derivedKey);
     return derivedKey;
   }
@@ -5084,8 +5124,8 @@ var InMemoryOrchestratedTokenStore = class {
   async encryptRecord(compositeKey, record) {
     const key = await this.deriveKeyForRecord(compositeKey);
     const plaintext = JSON.stringify(record);
-    const iv = (0, import_utils25.randomBytes)(12);
-    const { ciphertext, tag } = (0, import_utils25.encryptAesGcm)(key, new TextEncoder().encode(plaintext), iv);
+    const iv = (0, import_utils26.randomBytes)(12);
+    const { ciphertext, tag } = (0, import_utils26.encryptAesGcm)(key, new TextEncoder().encode(plaintext), iv);
     return JSON.stringify({
       iv: Buffer.from(iv).toString("base64url"),
       tag: Buffer.from(tag).toString("base64url"),
@@ -5101,7 +5141,7 @@ var InMemoryOrchestratedTokenStore = class {
     const ivBytes = Buffer.from(iv, "base64url");
     const tagBytes = Buffer.from(tag, "base64url");
     const ciphertextBytes = Buffer.from(data, "base64url");
-    const plaintext = (0, import_utils25.decryptAesGcm)(key, ciphertextBytes, ivBytes, tagBytes);
+    const plaintext = (0, import_utils26.decryptAesGcm)(key, ciphertextBytes, ivBytes, tagBytes);
     return JSON.parse(new TextDecoder().decode(plaintext));
   }
   /**
@@ -5303,7 +5343,7 @@ var InMemoryOrchestratedTokenStore = class {
 };
 
 // libs/auth/src/session/orchestrated-token.crypto.ts
-var import_utils26 = require("@frontmcp/utils");
+var import_utils27 = require("@frontmcp/utils");
 var HKDF_SALT = new TextEncoder().encode("frontmcp-token-store");
 function deriveKeyForRecord(masterKey, compositeKey, cache) {
   const cached = cache.get(compositeKey);
@@ -5311,14 +5351,14 @@ function deriveKeyForRecord(masterKey, compositeKey, cache) {
     return cached;
   }
   const info = new TextEncoder().encode(`orchestrated-token:${compositeKey}`);
-  const derived = (0, import_utils26.hkdfSha256)(masterKey, HKDF_SALT, info, 32);
+  const derived = (0, import_utils27.hkdfSha256)(masterKey, HKDF_SALT, info, 32);
   cache.set(compositeKey, derived);
   return derived;
 }
 function encryptRecord(key, record) {
   const plaintext = JSON.stringify(record);
-  const iv = (0, import_utils26.randomBytes)(12);
-  const { ciphertext, tag } = (0, import_utils26.encryptAesGcm)(key, new TextEncoder().encode(plaintext), iv);
+  const iv = (0, import_utils27.randomBytes)(12);
+  const { ciphertext, tag } = (0, import_utils27.encryptAesGcm)(key, new TextEncoder().encode(plaintext), iv);
   return JSON.stringify({
     iv: Buffer.from(iv).toString("base64url"),
     tag: Buffer.from(tag).toString("base64url"),
@@ -5330,7 +5370,7 @@ function decryptRecord(key, encrypted) {
   const ivBytes = Buffer.from(iv, "base64url");
   const tagBytes = Buffer.from(tag, "base64url");
   const ciphertextBytes = Buffer.from(data, "base64url");
-  const plaintext = (0, import_utils26.decryptAesGcm)(key, ciphertextBytes, ivBytes, tagBytes);
+  const plaintext = (0, import_utils27.decryptAesGcm)(key, ciphertextBytes, ivBytes, tagBytes);
   return JSON.parse(new TextDecoder().decode(plaintext));
 }
 
@@ -5509,7 +5549,7 @@ var StorageOrchestratedTokenStore = class {
 };
 
 // libs/auth/src/session/federated-auth.session.ts
-var import_utils27 = require("@frontmcp/utils");
+var import_utils28 = require("@frontmcp/utils");
 function toSessionRecord(session) {
   return {
     ...session,
@@ -5584,7 +5624,7 @@ var InMemoryFederatedAuthSessionStore = class {
   createSession(params) {
     const now = Date.now();
     return {
-      id: (0, import_utils27.randomUUID)(),
+      id: (0, import_utils28.randomUUID)(),
       pendingAuthId: params.pendingAuthId,
       clientId: params.clientId,
       redirectUri: params.redirectUri,
@@ -5616,7 +5656,7 @@ var InMemoryFederatedAuthSessionStore = class {
 function createFederatedAuthSession(params, ttlMs = 15 * 60 * 1e3) {
   const now = Date.now();
   return {
-    id: (0, import_utils27.randomUUID)(),
+    id: (0, import_utils28.randomUUID)(),
     pendingAuthId: params.pendingAuthId,
     clientId: params.clientId,
     redirectUri: params.redirectUri,
@@ -5673,7 +5713,7 @@ function startNextProvider(session, pkce, state) {
 }
 
 // libs/auth/src/session/storage-federated-auth.session.ts
-var import_utils28 = require("@frontmcp/utils");
+var import_utils29 = require("@frontmcp/utils");
 var StorageFederatedAuthSessionStore = class {
   storage;
   namespace;
@@ -5682,7 +5722,7 @@ var StorageFederatedAuthSessionStore = class {
     this.namespace = options.namespace ?? "fed";
     this.storageIsNamespaced = this.isNamespacedStorage(storage);
     const namespacedStorage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
-    this.storage = new import_utils28.TypedStorage(namespacedStorage);
+    this.storage = new import_utils29.TypedStorage(namespacedStorage);
   }
   async store(session) {
     await this.put(session);
@@ -5753,7 +5793,7 @@ var InMemoryConsentStore = class {
 };
 
 // libs/auth/src/session/storage-consent.store.ts
-var import_utils29 = require("@frontmcp/utils");
+var import_utils30 = require("@frontmcp/utils");
 var StorageConsentStore = class {
   storage;
   namespace;
@@ -5762,7 +5802,7 @@ var StorageConsentStore = class {
     this.namespace = options.namespace ?? "remembered-consent";
     this.storageIsNamespaced = this.isNamespacedStorage(storage);
     const namespacedStorage = this.storageIsNamespaced ? storage.namespace(this.namespace) : storage;
-    this.storage = new import_utils29.TypedStorage(namespacedStorage);
+    this.storage = new import_utils30.TypedStorage(namespacedStorage);
   }
   async get(userSub, clientId) {
     return this.storage.get(this.key(userSub, clientId));
@@ -5784,7 +5824,7 @@ var StorageConsentStore = class {
 
 // libs/auth/src/session/encrypted-authorization-vault.ts
 var import_lazy_zod5 = require("@frontmcp/lazy-zod");
-var import_utils30 = require("@frontmcp/utils");
+var import_utils31 = require("@frontmcp/utils");
 var redisVaultEntrySchema = import_lazy_zod5.z.object({
   /** Vault ID */
   id: import_lazy_zod5.z.string(),
@@ -5809,7 +5849,7 @@ var redisVaultEntrySchema = import_lazy_zod5.z.object({
   /** Encrypted sensitive data blob */
   encrypted: encryptedDataSchema
 });
-var encryptionContextStorage = new import_utils30.AsyncLocalStorage();
+var encryptionContextStorage = new import_utils31.AsyncLocalStorage();
 var EncryptedRedisVault = class {
   constructor(redis, encryption, namespace = "vault:") {
     this.redis = redis;
@@ -5945,7 +5985,7 @@ var EncryptedRedisVault = class {
   async create(params) {
     const now = Date.now();
     const entry = {
-      id: (0, import_utils30.randomUUID)(),
+      id: (0, import_utils31.randomUUID)(),
       userSub: params.userSub,
       userEmail: params.userEmail,
       userName: params.userName,
@@ -6004,7 +6044,7 @@ var EncryptedRedisVault = class {
     }
     const now = Date.now();
     const pendingAuth = {
-      id: (0, import_utils30.randomUUID)(),
+      id: (0, import_utils31.randomUUID)(),
       appId: params.appId,
       toolId: params.toolId,
       authUrl: params.authUrl,
@@ -6182,7 +6222,7 @@ function createEncryptedVault(redis, config = {}) {
 }
 
 // libs/auth/src/session/token.refresh.ts
-var import_utils31 = require("@frontmcp/utils");
+var import_utils32 = require("@frontmcp/utils");
 function toEpochSeconds(exp) {
   if (exp == null) return void 0;
   if (exp instanceof Date) return Math.floor(exp.getTime() / 1e3);
@@ -6204,7 +6244,7 @@ function tryJwtExp(token) {
   const parts = token.split(".");
   if (parts.length < 2) return void 0;
   try {
-    const json = JSON.parse(new TextDecoder().decode((0, import_utils31.base64urlDecode)(parts[1])));
+    const json = JSON.parse(new TextDecoder().decode((0, import_utils32.base64urlDecode)(parts[1])));
     const e = json?.exp;
     return typeof e === "number" ? toEpochSeconds(e) : void 0;
   } catch {
@@ -6267,7 +6307,7 @@ var progressiveAuthStateSchema = import_lazy_zod6.z.object({
 });
 
 // libs/auth/src/authorization/authorization.class.ts
-var import_utils34 = require("@frontmcp/utils");
+var import_utils35 = require("@frontmcp/utils");
 var AuthorizationBase = class _AuthorizationBase {
   id;
   isAnonymous;
@@ -6315,14 +6355,14 @@ var AuthorizationBase = class _AuthorizationBase {
    * @param fingerprint - Optional client fingerprint for tracking
    */
   createTransportSession(protocol, fingerprint) {
-    const sessionId = (0, import_utils34.randomUUID)();
+    const sessionId = (0, import_utils35.randomUUID)();
     const session = {
       id: sessionId,
       authorizationId: this.id,
       protocol,
       createdAt: Date.now(),
       expiresAt: this.expiresAt,
-      nodeId: (0, import_utils34.getMachineId)(),
+      nodeId: (0, import_utils35.getMachineId)(),
       clientFingerprint: fingerprint
     };
     this.#sessions.set(session.id, session);
@@ -6393,11 +6433,22 @@ var AuthorizationBase = class _AuthorizationBase {
   /**
    * Build URL for progressive/incremental authorization.
    * Used when a tool requires authorization for an app that was skipped during initial auth.
+   *
+   * The URL only SKIPS the login step when it carries a valid incremental
+   * ticket (GHSA-2c4g-9c8x-6m8g) — mint one with
+   * {@link signIncrementalAuthTicket} using the server signing secret and pass
+   * it here. Without a ticket the link still works, but the user completes an
+   * ordinary login; `mode=incremental` alone is no longer an authorization
+   * signal and is not emitted.
+   *
    * @param appId - App ID that requires authorization
    * @param baseUrl - Base URL of the server
+   * @param ticket - Signed incremental-authorization ticket for this subject
    */
-  getProgressiveAuthUrl(appId, baseUrl) {
-    return `${baseUrl}/oauth/authorize?app=${encodeURIComponent(appId)}&mode=incremental`;
+  getProgressiveAuthUrl(appId, baseUrl, ticket) {
+    const params = new URLSearchParams({ app: appId });
+    if (ticket) params.set("ticket", ticket);
+    return `${baseUrl}/oauth/authorize?${params.toString()}`;
   }
   /**
    * Check if the authorization is expired
@@ -6452,7 +6503,7 @@ var AuthorizationBase = class _AuthorizationBase {
    */
   static isJwtHeader(segment) {
     try {
-      const bytes = (0, import_utils34.base64urlDecode)(segment);
+      const bytes = (0, import_utils35.base64urlDecode)(segment);
       const text = new TextDecoder().decode(bytes);
       const parsed = JSON.parse(text);
       return typeof parsed === "object" && parsed !== null && typeof parsed.alg === "string";
@@ -6504,7 +6555,7 @@ var AuthorizationBase = class _AuthorizationBase {
 };
 
 // libs/auth/src/authorization/public.authorization.ts
-var import_utils35 = require("@frontmcp/utils");
+var import_utils36 = require("@frontmcp/utils");
 var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
   mode = "public";
   /**
@@ -6540,7 +6591,7 @@ var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
       allowedTools = "all",
       allowedPrompts = "all"
     } = ctx;
-    const uuid = (0, import_utils35.randomUUID)();
+    const uuid = (0, import_utils36.randomUUID)();
     const sub = `${prefix}:${uuid}`;
     const user = {
       sub,
@@ -6624,7 +6675,7 @@ var PublicAuthorization = class _PublicAuthorization extends AuthorizationBase {
 };
 
 // libs/auth/src/authorization/transparent.authorization.ts
-var import_utils36 = require("@frontmcp/utils");
+var import_utils37 = require("@frontmcp/utils");
 var TransparentAuthorization = class _TransparentAuthorization extends AuthorizationBase {
   mode = "transparent";
   /**
@@ -6724,7 +6775,7 @@ var TransparentAuthorization = class _TransparentAuthorization extends Authoriza
   static generateAuthorizationId(token) {
     const parts = token.split(".");
     const signature = parts[2] || token;
-    return (0, import_utils36.sha256Hex)(signature).substring(0, 16);
+    return (0, import_utils37.sha256Hex)(signature).substring(0, 16);
   }
   /**
    * Get the issuer from the token claims
@@ -6750,11 +6801,11 @@ var TransparentAuthorization = class _TransparentAuthorization extends Authoriza
 };
 
 // libs/auth/src/utils/authorization-id.utils.ts
-var import_utils37 = require("@frontmcp/utils");
+var import_utils38 = require("@frontmcp/utils");
 function deriveAuthorizationId(token) {
   const parts = token.split(".");
   const signature = parts[2] || token;
-  return (0, import_utils37.sha256Hex)(signature).substring(0, 16);
+  return (0, import_utils38.sha256Hex)(signature).substring(0, 16);
 }
 
 // libs/auth/src/authorization/orchestrated.authorization.ts
@@ -7123,7 +7174,7 @@ var OrchestratedAuthAccessorAdapter = class {
 };
 
 // libs/auth/src/authorization/dcr-client.registry.ts
-var import_utils38 = require("@frontmcp/utils");
+var import_utils39 = require("@frontmcp/utils");
 var DEFAULT_MAX_DYNAMIC_CLIENTS = 1e3;
 function globMatch(pattern, input) {
   let p = 0;
@@ -7249,7 +7300,7 @@ var DcrClientRegistry = class {
     if (!isConfidential) return "ok";
     if (!client.client_secret) return "invalid";
     if (!presentedSecret) return "invalid";
-    return (0, import_utils38.timingSafeEqual)((0, import_utils38.sha256)(presentedSecret), (0, import_utils38.sha256)(client.client_secret)) ? "ok" : "invalid";
+    return (0, import_utils39.timingSafeEqual)((0, import_utils39.sha256)(presentedSecret), (0, import_utils39.sha256)(client.client_secret)) ? "ok" : "invalid";
   }
   /** Whether a client id is known to the registry. */
   has(clientId) {
@@ -7337,7 +7388,7 @@ var DcrClientRegistry = class {
     if (typeof presented !== "string" || presented.length === 0) {
       return false;
     }
-    return (0, import_utils38.timingSafeEqual)((0, import_utils38.sha256)(presented), (0, import_utils38.sha256)(expected));
+    return (0, import_utils39.timingSafeEqual)((0, import_utils39.sha256)(presented), (0, import_utils39.sha256)(expected));
   }
 };
 
@@ -9383,7 +9434,7 @@ var CredentialCache = class {
 var AUTH_PROVIDERS_ACCESSOR = /* @__PURE__ */ Symbol.for("frontmcp:AUTH_PROVIDERS_ACCESSOR");
 
 // libs/auth/src/vault/auth-providers.accessor.impl.ts
-var import_utils41 = require("@frontmcp/utils");
+var import_utils42 = require("@frontmcp/utils");
 var AuthProvidersAccessorImpl = class {
   constructor(registry, vault, cache, loader, context, logger) {
     this.registry = registry;
@@ -9598,7 +9649,7 @@ var AuthProvidersAccessorImpl = class {
         return { [credential.headerName]: credential.key };
       case "basic": {
         const value = `${credential.username}:${credential.password}`;
-        const encoded = credential.encodedValue ?? (0, import_utils41.base64Encode)(new TextEncoder().encode(value));
+        const encoded = credential.encodedValue ?? (0, import_utils42.base64Encode)(new TextEncoder().encode(value));
         return { Authorization: `Basic ${encoded}` };
       }
       case "custom":
@@ -11157,6 +11208,7 @@ var FetchCredentialMiddleware = class {
   CredentialProviderAlreadyRegisteredError,
   CredentialStorageError,
   CredentialsAccessorImpl,
+  DEFAULT_INCREMENTAL_TICKET_TTL_MS,
   DEFAULT_RESUME_TTL_MS,
   DEFAULT_THEME,
   DcrClientRegistry,
@@ -11400,6 +11452,7 @@ var FetchCredentialMiddleware = class {
   sessionIdPayloadSchema,
   sessionJwtPayloadSchema,
   signCredentialResumeToken,
+  signIncrementalAuthTicket,
   signSession,
   skippedAppBehaviorSchema,
   sseTransportStateSchema,
@@ -11428,6 +11481,7 @@ var FetchCredentialMiddleware = class {
   vaultConsentRecordSchema,
   vaultFederatedRecordSchema,
   verifyCredentialResumeToken,
+  verifyIncrementalAuthTicket,
   verifyOrParseSession,
   verifyPkce,
   verifySession,