@frontmcp/auth 1.7.2 → 1.8.1

package/esm/index.mjs

@@ -225,10 +225,14 @@ import {
   bytesToHex,
   createKeyPersistence,
   isProduction,
+  isRedirectResponse,
   randomBytes,
   rsaVerify
 } from "@frontmcp/utils";
 
+// libs/auth/src/cimd/cimd.validator.ts
+import { classifyIpAddress } from "@frontmcp/utils";
+
 // libs/auth/src/cimd/cimd.errors.ts
 var CimdError = class extends Error {
   /**
@@ -492,70 +496,38 @@ function isIpAddress(hostname) {
   }
   return false;
 }
+var BLOCKED_RANGE_REASONS = /* @__PURE__ */ new Map([
+  ["0.0.0.0/8", "Current network addresses (0.x.x.x) are not allowed"],
+  ["10.0.0.0/8", "Private IP addresses (10.x.x.x) are not allowed"],
+  ["100.64.0.0/10", "Carrier-grade NAT addresses (100.64-127.x.x) are not allowed"],
+  ["127.0.0.0/8", "Loopback addresses (127.x.x.x) are not allowed"],
+  ["169.254.0.0/16", "Link-local addresses (169.254.x.x) are not allowed"],
+  ["172.16.0.0/12", "Private IP addresses (172.16-31.x.x) are not allowed"],
+  ["192.0.0.0/24", "IETF protocol-assignment addresses (192.0.0.0/24) are not allowed"],
+  ["192.168.0.0/16", "Private IP addresses (192.168.x.x) are not allowed"],
+  ["224.0.0.0/4", "Multicast addresses are not allowed"],
+  ["255.255.255.255/32", "Broadcast address is not allowed"],
+  ["::/128", "IPv6 unspecified address (::) is not allowed"],
+  ["::1/128", "IPv6 loopback address (::1) is not allowed"],
+  ["fc00::/7", "IPv6 unique local addresses (fc00::/7) are not allowed"],
+  ["fe80::/10", "IPv6 link-local addresses (fe80::/10) are not allowed"]
+]);
 function checkIpAddress(ip) {
-  const cleanIp = ip.replace(/^\[|\]$/g, "");
-  if (cleanIp.includes(".") && !cleanIp.includes(":")) {
-    return checkIpv4(cleanIp);
-  }
-  return checkIpv6(cleanIp);
-}
-function checkIpv4(ip) {
-  const parts = ip.split(".").map(Number);
-  if (parts.length !== 4 || parts.some((p) => isNaN(p) || p < 0 || p > 255)) {
-    return { allowed: false, reason: "Invalid IPv4 address" };
-  }
-  const [a, b, c, d] = parts;
-  if (a === 127) {
-    return { allowed: false, reason: "Loopback addresses (127.x.x.x) are not allowed" };
-  }
-  if (a === 10) {
-    return { allowed: false, reason: "Private IP addresses (10.x.x.x) are not allowed" };
-  }
-  if (a === 172 && b >= 16 && b <= 31) {
-    return { allowed: false, reason: "Private IP addresses (172.16-31.x.x) are not allowed" };
-  }
-  if (a === 192 && b === 168) {
-    return { allowed: false, reason: "Private IP addresses (192.168.x.x) are not allowed" };
-  }
-  if (a === 169 && b === 254) {
-    return { allowed: false, reason: "Link-local addresses (169.254.x.x) are not allowed" };
-  }
-  if (a === 100 && b >= 64 && b <= 127) {
-    return { allowed: false, reason: "Carrier-grade NAT addresses (100.64-127.x.x) are not allowed" };
-  }
-  if (a === 192 && b === 0 && c === 0) {
-    return { allowed: false, reason: "IETF protocol-assignment addresses (192.0.0.0/24) are not allowed" };
-  }
-  if (a === 0) {
-    return { allowed: false, reason: "Current network addresses (0.x.x.x) are not allowed" };
-  }
-  if (a === 255 && b === 255 && c === 255 && d === 255) {
-    return { allowed: false, reason: "Broadcast address is not allowed" };
-  }
-  if (a >= 224 && a <= 239) {
-    return { allowed: false, reason: "Multicast addresses are not allowed" };
-  }
-  return { allowed: true, reason: "" };
-}
-function checkIpv6(ip) {
-  const normalizedIp = ip.toLowerCase();
-  if (normalizedIp === "::1") {
-    return { allowed: false, reason: "IPv6 loopback address (::1) is not allowed" };
-  }
-  if (normalizedIp === "::" || normalizedIp === "0:0:0:0:0:0:0:0") {
-    return { allowed: false, reason: "IPv6 unspecified address (::) is not allowed" };
-  }
-  if (normalizedIp.startsWith("fe8") || normalizedIp.startsWith("fe9") || normalizedIp.startsWith("fea") || normalizedIp.startsWith("feb")) {
-    return { allowed: false, reason: "IPv6 link-local addresses (fe80::/10) are not allowed" };
-  }
-  if (normalizedIp.startsWith("fc") || normalizedIp.startsWith("fd")) {
-    return { allowed: false, reason: "IPv6 unique local addresses (fc00::/7) are not allowed" };
+  const classification = classifyIpAddress(ip);
+  if (!classification) {
+    const bareIp = ip.replace(/^\[|\]$/g, "");
+    return {
+      allowed: false,
+      reason: bareIp.includes(":") ? `Malformed IPv6 address: ${bareIp}` : "Invalid IPv4 address"
+    };
   }
-  const ipv4MappedMatch = normalizedIp.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
-  if (ipv4MappedMatch) {
-    return checkIpv4(ipv4MappedMatch[1]);
+  if (classification.range === "public") {
+    return { allowed: true, reason: "" };
   }
-  return { allowed: true, reason: "" };
+  return {
+    allowed: false,
+    reason: BLOCKED_RANGE_REASONS.get(classification.cidr) ?? `Addresses in the ${classification.range} range (${classification.cidr}) are not allowed`
+  };
 }
 function isDomainInList(hostname, domainList) {
   const lowerHostname = hostname.toLowerCase();
@@ -964,11 +936,10 @@ var JwksService = class {
           // Follow redirects manually so each hop is re-validated (scheme + SSRF).
           redirect: "manual"
         });
-        if (res.status >= 300 && res.status < 400) {
+        if (isRedirectResponse(res)) {
           const location = res.headers.get("location");
-          if (!location || hop >= MAX_JWKS_FETCH_HOPS) {
-            throw new Error("too many redirects");
-          }
+          if (!location) throw new Error("redirect without a readable Location header");
+          if (hop >= MAX_JWKS_FETCH_HOPS) throw new Error("too many redirects");
           currentUrl = new URL(location, currentUrl).toString();
           continue;
         }
@@ -3544,6 +3515,22 @@ var SessionSecretRequiredError = class extends AuthInternalError {
     super(`Session secret is required for ${component}`, "SESSION_SECRET_REQUIRED");
   }
 };
+var JwtSecretRequiredError = class extends AuthInternalError {
+  constructor(mode) {
+    super(
+      `JWT_SECRET is required in production for auth.mode "${mode}". Without it the server signs tokens with a random per-process secret, so every restart invalidates outstanding tokens and any second instance or isolate rejects tokens the first one minted.`,
+      "JWT_SECRET_REQUIRED"
+    );
+  }
+};
+var JwtSecretWeakError = class extends AuthInternalError {
+  constructor(byteLength) {
+    super(
+      `JWT_SECRET is ${byteLength} bytes; HS256 requires at least 32 (RFC 7518 \xA73.2). A shorter secret is guessable, and whoever guesses it can forge tokens for this server. Generate one with \`openssl rand -hex 32\`.`,
+      "JWT_SECRET_INVALID"
+    );
+  }
+};
 var CredentialProviderAlreadyRegisteredError = class extends AuthInternalError {
   constructor(name) {
     super(`Credential provider "${name}" is already registered`, "CREDENTIAL_PROVIDER_ALREADY_REGISTERED");
@@ -7420,6 +7407,7 @@ init_cimd_cache();
 
 // libs/auth/src/cimd/cimd.service.ts
 init_cimd_cache();
+import { isRedirectResponse as isRedirectResponse2 } from "@frontmcp/utils";
 var CimdService = class {
   config;
   cacheConfig;
@@ -7593,7 +7581,7 @@ var CimdService = class {
             httpStatus: 304
           });
         }
-        if (response.status >= 300 && response.status < 400) {
+        if (isRedirectResponse2(response)) {
           const location = response.headers.get("location");
           if (!location) {
             throw new CimdFetchError(clientId, "Redirect response missing Location header", {
@@ -8210,10 +8198,48 @@ var publicAuthOptionsSchema = z11.object({
   signKey: jwkSchema.or(z11.instanceof(Uint8Array)).optional()
 });
 
-// libs/auth/src/options/transparent.schema.ts
+// libs/auth/src/options/static.schema.ts
 import { z as z12 } from "@frontmcp/lazy-zod";
-var transparentAuthOptionsSchema = z12.object({
-  mode: z12.literal("transparent"),
+var staticAuthOptionsSchema = z12.object({
+  mode: z12.literal("static"),
+  /**
+   * Accepted credentials. Compared against the presented one in constant time,
+   * over SHA-256 digests so neither the value nor its length leaks by timing.
+   *
+   * Read these from the environment — never commit them.
+   */
+  tokens: z12.array(z12.string().min(1)).min(1),
+  /**
+   * Request header carrying the credential.
+   * @default 'authorization'
+   */
+  header: z12.string().min(1).default("authorization"),
+  /**
+   * Scheme prefix to strip before comparing, matched case-insensitively. Set to
+   * an empty string for headers that carry a bare token (e.g. `x-api-key`).
+   * @default 'Bearer'
+   */
+  scheme: z12.string().default("Bearer"),
+  /**
+   * Scopes granted to a request that presents a valid token.
+   * @default ['static']
+   */
+  scopes: z12.array(z12.string()).default(["static"]),
+  /**
+   * Realm reported in the `WWW-Authenticate` challenge on failure.
+   * @default 'mcp'
+   */
+  realm: z12.string().default("mcp"),
+  /**
+   * Tool/prompt access configuration, same shape the other modes accept.
+   */
+  publicAccess: publicAccessConfigSchema.optional()
+});
+
+// libs/auth/src/options/transparent.schema.ts
+import { z as z13 } from "@frontmcp/lazy-zod";
+var transparentAuthOptionsSchema = z13.object({
+  mode: z13.literal("transparent"),
   /**
    * Flattened remote provider fields (provider, clientId, clientSecret, scopes, providerConfig)
    */
@@ -8222,28 +8248,28 @@ var transparentAuthOptionsSchema = z12.object({
    * Expected token audience
    * If not set, defaults to the resource URL
    */
-  expectedAudience: z12.union([z12.string(), z12.array(z12.string())]).optional(),
+  expectedAudience: z13.union([z13.string(), z13.array(z13.string())]).optional(),
   /**
    * Require an `aud` claim (reject audience-less tokens). Defaults to `false`
    * for IdP compatibility; set `true` to reject tokens with no audience.
    */
-  requireAudience: z12.boolean().optional(),
+  requireAudience: z13.boolean().optional(),
   /**
    * Required scopes for access
    * Empty array means any valid token is accepted
    * @default []
    */
-  requiredScopes: z12.array(z12.string()).default([]),
+  requiredScopes: z13.array(z13.string()).default([]),
   /**
    * Allow anonymous fallback when no token is provided
    * @default false
    */
-  allowAnonymous: z12.boolean().default(false),
+  allowAnonymous: z13.boolean().default(false),
   /**
    * Scopes granted to anonymous sessions (when allowAnonymous=true)
    * @default ['anonymous']
    */
-  anonymousScopes: z12.array(z12.string()).default(["anonymous"]),
+  anonymousScopes: z13.array(z13.string()).default(["anonymous"]),
   /**
    * Public access config for anonymous users (when allowAnonymous=true)
    */
@@ -8251,13 +8277,13 @@ var transparentAuthOptionsSchema = z12.object({
 });
 
 // libs/auth/src/options/orchestrated.schema.ts
-import { z as z13 } from "@frontmcp/lazy-zod";
-var authSlotSchema = z13.enum(["login", "consent", "incremental", "federated", "error"]);
-var authUiMapSchema = z13.partialRecord(authSlotSchema, z13.string().min(1));
-var authExtraHandlerSchema = z13.custom((v) => typeof v === "function", {
+import { z as z14 } from "@frontmcp/lazy-zod";
+var authSlotSchema = z14.enum(["login", "consent", "incremental", "federated", "error"]);
+var authUiMapSchema = z14.partialRecord(authSlotSchema, z14.string().min(1));
+var authExtraHandlerSchema = z14.custom((v) => typeof v === "function", {
   message: "auth.extras entries must be handler functions (input, ctx) => AuthExtraResult."
 });
-var authExtrasMapSchema = z13.record(z13.string().min(1), authExtraHandlerSchema);
+var authExtrasMapSchema = z14.record(z14.string().min(1), authExtraHandlerSchema);
 var sharedAuthFields = {
   local: localSigningConfigSchema.optional(),
   tokenStorage: tokenStorageConfigSchema.default("memory"),
@@ -8265,13 +8291,13 @@ var sharedAuthFields = {
   // Optional (no default) so an unset value resolves to the in-memory encrypted
   // default at runtime; existing configs are unaffected.
   secureStore: secureStoreConfigSchema.optional(),
-  allowDefaultPublic: z13.boolean().default(false),
-  anonymousScopes: z13.array(z13.string()).default(["anonymous"]),
+  allowDefaultPublic: z14.boolean().default(false),
+  anonymousScopes: z14.array(z14.string()).default(["anonymous"]),
   publicAccess: publicAccessConfigSchema.optional(),
   consent: consentConfigSchema.optional(),
   federatedAuth: federatedAuthConfigSchema.optional(),
   refresh: tokenRefreshConfigSchema.optional(),
-  expectedAudience: z13.union([z13.string(), z13.array(z13.string())]).optional(),
+  expectedAudience: z14.union([z14.string(), z14.array(z14.string())]).optional(),
   incrementalAuth: incrementalAuthConfigSchema.optional(),
   /**
    * Require the OAuth client to be KNOWN (registered via DCR / pre-registered,
@@ -8287,46 +8313,46 @@ var sharedAuthFields = {
    * matching for every client. Clients on a configured
    * `dcr.allowedRedirectUris` allowlist still pass.
    */
-  requireRegisteredClients: z13.boolean().default(false),
+  requireRegisteredClients: z14.boolean().default(false),
   cimd: cimdConfigSchema.optional(),
   // #469 — custom auth UI as a slot→file map + extras name→handler map (per-app
   // under splitByApp). Both optional; omitting them serves the built-in pages.
   ui: authUiMapSchema.optional(),
   extras: authExtrasMapSchema.optional()
 };
-var loginFieldSchema = z13.object({
-  type: z13.enum(["text", "password", "email", "select", "hidden"]),
-  label: z13.string().optional(),
-  required: z13.boolean().optional(),
-  placeholder: z13.string().optional(),
-  options: z13.array(z13.object({ value: z13.string(), label: z13.string() })).optional()
+var loginFieldSchema = z14.object({
+  type: z14.enum(["text", "password", "email", "select", "hidden"]),
+  label: z14.string().optional(),
+  required: z14.boolean().optional(),
+  placeholder: z14.string().optional(),
+  options: z14.array(z14.object({ value: z14.string(), label: z14.string() })).optional()
 });
-var loginConfigSchema = z13.object({
-  title: z13.string().optional(),
-  subtitle: z13.string().optional(),
-  logoUri: z13.string().optional(),
-  fields: z13.record(z13.string(), loginFieldSchema).optional(),
+var loginConfigSchema = z14.object({
+  title: z14.string().optional(),
+  subtitle: z14.string().optional(),
+  logoUri: z14.string().optional(),
+  fields: z14.record(z14.string(), loginFieldSchema).optional(),
   // Full HTML override — a function, validated structurally like other callbacks
   // in the codebase (see http/cors handlers using z.custom<…>).
-  render: z13.custom((v) => typeof v === "function", {
+  render: z14.custom((v) => typeof v === "function", {
     message: "login.render must be a function"
   }).optional(),
-  subject: z13.object({
-    fromField: z13.string().optional(),
-    strategy: z13.enum(["per-session", "per-account"]).optional()
+  subject: z14.object({
+    fromField: z14.string().optional(),
+    strategy: z14.enum(["per-session", "per-account"]).optional()
   }).optional()
 });
-var authenticateFnSchema = z13.custom((v) => typeof v === "function", {
+var authenticateFnSchema = z14.custom((v) => typeof v === "function", {
   message: "authenticate must be a function"
 });
-var localAuthSchema = z13.object({
-  mode: z13.literal("local"),
+var localAuthSchema = z14.object({
+  mode: z14.literal("local"),
   ...sharedAuthFields,
   // #468 — opt-out of the email requirement at /oauth/callback for
   // single-operator local setups. Defaults preserve the historical behavior
   // (email required) so existing configs are unaffected.
-  requireEmail: z13.boolean().default(true),
-  anonymousSubject: z13.string().min(1).default("local-operator"),
+  requireEmail: z14.boolean().default(true),
+  anonymousSubject: z14.string().min(1).default("local-operator"),
   // Checkpoint 3a — declarative login customization + custom verification.
   // Both optional; omitting them preserves the default login path exactly.
   login: loginConfigSchema.optional(),
@@ -8334,7 +8360,7 @@ var localAuthSchema = z13.object({
   // Multi-OAuth-provider orchestration — declare upstream providers (GitHub,
   // Slack, Jira, …) to federate at /oauth/authorize. Optional; omitting it
   // preserves the default single-operator local login exactly.
-  providers: z13.array(upstreamProviderSchema).optional(),
+  providers: z14.array(upstreamProviderSchema).optional(),
   // Local-AS Dynamic Client Registration control surface (#462) — gate
   // `POST /oauth/register`, allowlist redirect_uris/client_ids, require an
   // initial access token, and seed pre-registered trusted clients. Optional;
@@ -8342,8 +8368,8 @@ var localAuthSchema = z13.object({
   // no allowlist; no initial access token).
   dcr: localDcrConfigSchema.optional()
 });
-var remoteAuthSchema = z13.object({
-  mode: z13.literal("remote"),
+var remoteAuthSchema = z14.object({
+  mode: z14.literal("remote"),
   ...flatRemoteProviderFields,
   ...sharedAuthFields
 });
@@ -8351,21 +8377,22 @@ var orchestratedLocalSchema = localAuthSchema;
 var orchestratedRemoteSchema = remoteAuthSchema;
 
 // libs/auth/src/options/schema.ts
-import { z as z14 } from "@frontmcp/lazy-zod";
-var authOptionsSchema = z14.union([
+import { z as z15 } from "@frontmcp/lazy-zod";
+var authOptionsSchema = z15.union([
   publicAuthOptionsSchema,
+  staticAuthOptionsSchema,
   transparentAuthOptionsSchema,
   localAuthSchema,
   remoteAuthSchema
 ]);
 
 // libs/auth/src/options/app-auth.schema.ts
-import { z as z15 } from "@frontmcp/lazy-zod";
+import { z as z16 } from "@frontmcp/lazy-zod";
 var standaloneOptionSchema = {
-  standalone: z15.boolean().optional(),
-  excludeFromParent: z15.boolean().optional()
+  standalone: z16.boolean().optional(),
+  excludeFromParent: z16.boolean().optional()
 };
-var appAuthOptionsSchema = z15.union([
+var appAuthOptionsSchema = z16.union([
   publicAuthOptionsSchema.extend(standaloneOptionSchema),
   transparentAuthOptionsSchema.extend(standaloneOptionSchema),
   localAuthSchema.extend(standaloneOptionSchema),
@@ -8379,6 +8406,9 @@ function parseAuthOptions(input) {
 function isPublicMode(options) {
   return options.mode === "public";
 }
+function isStaticMode(options) {
+  return options.mode === "static";
+}
 function isTransparentMode(options) {
   return options.mode === "transparent";
 }
@@ -8405,108 +8435,108 @@ function allowsPublicAccess(options) {
 }
 
 // libs/auth/src/consent/consent.types.ts
-import { z as z16 } from "@frontmcp/lazy-zod";
-var consentToolItemSchema = z16.object({
+import { z as z17 } from "@frontmcp/lazy-zod";
+var consentToolItemSchema = z17.object({
   /** Tool ID (e.g., 'slack:send_message') */
-  id: z16.string().min(1),
+  id: z17.string().min(1),
   /** Tool name for display */
-  name: z16.string().min(1),
+  name: z17.string().min(1),
   /** Tool description */
-  description: z16.string().optional(),
+  description: z17.string().optional(),
   /** App ID this tool belongs to */
-  appId: z16.string().min(1),
+  appId: z17.string().min(1),
   /** App name for display */
-  appName: z16.string().min(1),
+  appName: z17.string().min(1),
   /** Whether the tool is selected by default */
-  defaultSelected: z16.boolean().default(true),
+  defaultSelected: z17.boolean().default(true),
   /** Whether this tool requires specific scopes */
-  requiredScopes: z16.array(z16.string()).optional(),
+  requiredScopes: z17.array(z17.string()).optional(),
   /** Category for grouping (e.g., 'read', 'write', 'admin') */
-  category: z16.string().optional()
+  category: z17.string().optional()
 });
-var consentSelectionSchema = z16.object({
+var consentSelectionSchema = z17.object({
   /** Selected tool IDs */
-  selectedTools: z16.array(z16.string()),
+  selectedTools: z17.array(z17.string()),
   /** Whether all tools were selected */
-  allSelected: z16.boolean(),
+  allSelected: z17.boolean(),
   /** Timestamp when consent was given */
-  consentedAt: z16.string().datetime(),
+  consentedAt: z17.string().datetime(),
   /** Consent version for tracking changes */
-  consentVersion: z16.string().default("1.0")
+  consentVersion: z17.string().default("1.0")
 });
-var consentStateSchema = z16.object({
+var consentStateSchema = z17.object({
   /** Whether consent flow is enabled */
-  enabled: z16.boolean(),
+  enabled: z17.boolean(),
   /** Available tools for consent */
-  availableTools: z16.array(consentToolItemSchema),
+  availableTools: z17.array(consentToolItemSchema),
   /** Pre-selected tools (from previous consent or defaults) */
-  preselectedTools: z16.array(z16.string()).optional(),
+  preselectedTools: z17.array(z17.string()).optional(),
   /** Whether to show all tools or group by app */
-  groupByApp: z16.boolean().default(true),
+  groupByApp: z17.boolean().default(true),
   /** Custom consent message */
-  customMessage: z16.string().optional()
+  customMessage: z17.string().optional()
 });
-var federatedProviderItemSchema = z16.object({
+var federatedProviderItemSchema = z17.object({
   /** Provider ID (derived or explicit) */
-  id: z16.string().min(1),
+  id: z17.string().min(1),
   /** Provider display name */
-  name: z16.string().min(1),
+  name: z17.string().min(1),
   /** Provider description */
-  description: z16.string().optional(),
+  description: z17.string().optional(),
   /** Provider icon URL or emoji */
-  icon: z16.string().optional(),
+  icon: z17.string().optional(),
   /** Provider type */
-  type: z16.enum(["local", "remote", "transparent"]),
+  type: z17.enum(["local", "remote", "transparent"]),
   /** OAuth provider URL (for remote providers) */
-  providerUrl: z16.string().url().optional(),
+  providerUrl: z17.string().url().optional(),
   /** Apps using this provider */
-  appIds: z16.array(z16.string()),
+  appIds: z17.array(z17.string()),
   /** App names using this provider */
-  appNames: z16.array(z16.string()),
+  appNames: z17.array(z17.string()),
   /** Scopes required by this provider */
-  scopes: z16.array(z16.string()),
+  scopes: z17.array(z17.string()),
   /** Whether this is the primary/parent provider */
-  isPrimary: z16.boolean(),
+  isPrimary: z17.boolean(),
   /** Whether this provider is optional (can be skipped) */
-  isOptional: z16.boolean().default(false)
+  isOptional: z17.boolean().default(false)
 });
-var federatedLoginStateSchema = z16.object({
+var federatedLoginStateSchema = z17.object({
   /** All available providers */
-  providers: z16.array(federatedProviderItemSchema),
+  providers: z17.array(federatedProviderItemSchema),
   /** Primary provider ID (if any) */
-  primaryProviderId: z16.string().optional(),
+  primaryProviderId: z17.string().optional(),
   /** Whether user can skip optional providers */
-  allowSkip: z16.boolean().default(true),
+  allowSkip: z17.boolean().default(true),
   /** Pre-selected provider IDs (from previous session) */
-  preselectedProviders: z16.array(z16.string()).optional()
+  preselectedProviders: z17.array(z17.string()).optional()
 });
-var federatedSelectionSchema = z16.object({
+var federatedSelectionSchema = z17.object({
   /** Selected provider IDs */
-  selectedProviders: z16.array(z16.string()),
+  selectedProviders: z17.array(z17.string()),
   /** Skipped provider IDs */
-  skippedProviders: z16.array(z16.string()),
+  skippedProviders: z17.array(z17.string()),
   /** Provider-specific metadata */
-  providerMetadata: z16.record(z16.string(), z16.unknown()).optional()
+  providerMetadata: z17.record(z17.string(), z17.unknown()).optional()
 });
 
 // libs/auth/src/detection/auth-provider-detection.ts
-import { z as z17 } from "@frontmcp/lazy-zod";
-var detectedAuthProviderSchema = z17.object({
-  id: z17.string(),
-  providerUrl: z17.string().optional(),
-  mode: z17.enum(["public", "transparent", "local", "remote"]),
-  appIds: z17.array(z17.string()),
-  scopes: z17.array(z17.string()),
-  isParentProvider: z17.boolean()
+import { z as z18 } from "@frontmcp/lazy-zod";
+var detectedAuthProviderSchema = z18.object({
+  id: z18.string(),
+  providerUrl: z18.string().optional(),
+  mode: z18.enum(["public", "static", "transparent", "local", "remote"]),
+  appIds: z18.array(z18.string()),
+  scopes: z18.array(z18.string()),
+  isParentProvider: z18.boolean()
 });
-var authProviderDetectionResultSchema = z17.object({
-  providers: z17.map(z17.string(), detectedAuthProviderSchema),
-  requiresOrchestration: z17.boolean(),
-  parentProviderId: z17.string().optional(),
-  childProviderIds: z17.array(z17.string()),
-  uniqueProviderCount: z17.number(),
-  validationErrors: z17.array(z17.string()),
-  warnings: z17.array(z17.string())
+var authProviderDetectionResultSchema = z18.object({
+  providers: z18.map(z18.string(), detectedAuthProviderSchema),
+  requiresOrchestration: z18.boolean(),
+  parentProviderId: z18.string().optional(),
+  childProviderIds: z18.array(z18.string()),
+  uniqueProviderCount: z18.number(),
+  validationErrors: z18.array(z18.string()),
+  warnings: z18.array(z18.string())
 });
 function deriveProviderId(options) {
   if (isPublicMode(options)) {
@@ -8895,43 +8925,43 @@ var AudienceValidator = class _AudienceValidator {
 };
 
 // libs/auth/src/vault/auth-providers.types.ts
-import { z as z18 } from "@frontmcp/lazy-zod";
-var credentialScopeSchema = z18.enum(["global", "user", "session"]);
-var loadingStrategySchema = z18.enum(["eager", "lazy"]);
-var getCredentialOptionsSchema = z18.object({
-  forceRefresh: z18.boolean().optional(),
-  scopes: z18.array(z18.string()).optional(),
-  timeout: z18.number().positive().optional()
+import { z as z19 } from "@frontmcp/lazy-zod";
+var credentialScopeSchema = z19.enum(["global", "user", "session"]);
+var loadingStrategySchema = z19.enum(["eager", "lazy"]);
+var getCredentialOptionsSchema = z19.object({
+  forceRefresh: z19.boolean().optional(),
+  scopes: z19.array(z19.string()).optional(),
+  timeout: z19.number().positive().optional()
 }).strict();
-var credentialProviderConfigSchema = z18.object({
-  name: z18.string().min(1),
-  description: z18.string().optional(),
+var credentialProviderConfigSchema = z19.object({
+  name: z19.string().min(1),
+  description: z19.string().optional(),
   scope: credentialScopeSchema,
   loading: loadingStrategySchema,
-  cacheTtl: z18.number().nonnegative().optional(),
+  cacheTtl: z19.number().nonnegative().optional(),
   // Functions validated at runtime, not via Zod (Zod 4 compatibility)
-  factory: z18.any(),
-  refresh: z18.any().optional(),
-  toHeaders: z18.any().optional(),
-  metadata: z18.record(z18.string(), z18.unknown()).optional(),
-  required: z18.boolean().optional()
+  factory: z19.any(),
+  refresh: z19.any().optional(),
+  toHeaders: z19.any().optional(),
+  metadata: z19.record(z19.string(), z19.unknown()).optional(),
+  required: z19.boolean().optional()
 }).strict();
-var authProviderMappingSchema = z18.union([
-  z18.string(),
-  z18.object({
-    name: z18.string().min(1),
-    required: z18.boolean().optional().default(true),
-    scopes: z18.array(z18.string()).optional(),
-    alias: z18.string().optional()
+var authProviderMappingSchema = z19.union([
+  z19.string(),
+  z19.object({
+    name: z19.string().min(1),
+    required: z19.boolean().optional().default(true),
+    scopes: z19.array(z19.string()).optional(),
+    alias: z19.string().optional()
   }).strict()
 ]);
-var authProvidersVaultOptionsSchema = z18.object({
-  enabled: z18.boolean().optional(),
-  useSharedStorage: z18.boolean().optional().default(true),
-  namespace: z18.string().optional().default("authproviders:"),
-  defaultCacheTtl: z18.number().nonnegative().optional().default(36e5),
-  maxCredentialsPerSession: z18.number().positive().optional().default(100),
-  providers: z18.array(credentialProviderConfigSchema).optional()
+var authProvidersVaultOptionsSchema = z19.object({
+  enabled: z19.boolean().optional(),
+  useSharedStorage: z19.boolean().optional().default(true),
+  namespace: z19.string().optional().default("authproviders:"),
+  defaultCacheTtl: z19.number().nonnegative().optional().default(36e5),
+  maxCredentialsPerSession: z19.number().positive().optional().default(100),
+  providers: z19.array(credentialProviderConfigSchema).optional()
 }).strict();
 
 // libs/auth/src/vault/credential-helpers.ts
@@ -9939,6 +9969,18 @@ var noopRelationshipResolver = {
     return false;
   }
 };
+function resolveAuthUser(authInfo) {
+  const extraUser = authInfo?.extra?.["user"];
+  if (authInfo?.user) return authInfo.user;
+  return typeof extraUser === "object" && extraUser !== null ? extraUser : {};
+}
+function isAnonymousSubject(sub) {
+  return typeof sub !== "string" || sub === "" || sub.startsWith("anon:");
+}
+function signedInSubject(rawSub, mappedSub) {
+  if (rawSub !== void 0 && isAnonymousSubject(rawSub)) return void 0;
+  return [mappedSub, rawSub].find((candidate) => !isAnonymousSubject(candidate));
+}
 var AuthoritiesContextBuilder = class {
   claimsMapping;
   claimsResolver;
@@ -9956,7 +9998,7 @@ var AuthoritiesContextBuilder = class {
       const resolved = this.claimsResolver(authInfo);
       return {
         user: {
-          sub: authInfo?.user?.sub ?? "",
+          sub: signedInSubject(resolveAuthUser(authInfo).sub),
           roles: resolved.roles,
           permissions: resolved.permissions,
           claims: resolved.claims
@@ -9966,7 +10008,7 @@ var AuthoritiesContextBuilder = class {
         relationships: this.relationshipResolver
       };
     }
-    const user = authInfo?.user ?? {};
+    const user = resolveAuthUser(authInfo);
     const authorization = authInfo?.extra?.["authorization"];
     const authorizationClaims = authorization?.["claims"] ?? {};
     const rawClaims = {
@@ -9987,10 +10029,10 @@ var AuthoritiesContextBuilder = class {
     } else {
       permissions = toStringArray(user["permissions"] ?? []);
     }
-    const sub = this.claimsMapping?.userId ? String(resolveDotPath(rawClaims, this.claimsMapping.userId) ?? "") : user.sub ?? "";
+    const mappedSub = this.claimsMapping?.userId ? resolveDotPath(rawClaims, this.claimsMapping.userId) : void 0;
     return {
       user: {
-        sub,
+        sub: signedInSubject(user.sub, mappedSub),
         roles,
         permissions,
         claims: rawClaims
@@ -10022,15 +10064,17 @@ var FrontMcpAuthContextImpl = class {
   roles;
   permissions;
   constructor(source, claimsMapping) {
-    const rawUser = source.user ?? {};
-    const sub = claimsMapping?.userId ? String(resolveDotPath(this.buildRawClaims(source), claimsMapping.userId) ?? rawUser.sub ?? "") : String(rawUser.sub ?? "");
+    const rawUser = resolveAuthUser(source);
+    const mappedSub = claimsMapping?.userId ? resolveDotPath(this.buildRawClaims(source), claimsMapping.userId) : void 0;
+    const signedInSub = signedInSubject(rawUser.sub, mappedSub);
+    const sub = signedInSub ?? (typeof rawUser.sub === "string" ? rawUser.sub : "");
     this.user = Object.freeze({
       sub,
       name: rawUser.name,
       email: rawUser.email,
       picture: rawUser.picture
     });
-    this.isAnonymous = sub === "" || sub.startsWith("anon:");
+    this.isAnonymous = signedInSub === void 0;
     const extraAuth = source.extra?.["authorization"];
     this.mode = String(
       source.extra?.["authMode"] ?? extraAuth?.["mode"] ?? (source.extra?.["isPublic"] === true || rawUser["anonymous"] === true ? "public" : "authenticated")
@@ -10088,7 +10132,7 @@ var FrontMcpAuthContextImpl = class {
    * Mirrors the logic in AuthoritiesContextBuilder.build().
    */
   buildRawClaims(source) {
-    const rawUser = source.user ?? {};
+    const rawUser = resolveAuthUser(source);
     const extraAuth = source.extra?.["authorization"];
     const authorizationClaims = extraAuth?.["claims"] ?? {};
     return {
@@ -10153,20 +10197,20 @@ function resolveRequiredScopes(denial, mapping, authorities) {
 }
 
 // libs/auth/src/authorities/authorities.schema.ts
-import { z as z19 } from "@frontmcp/lazy-zod";
-var rbacRolesPolicySchema = z19.object({
-  all: z19.array(z19.string().min(1)).optional(),
-  any: z19.array(z19.string().min(1)).optional()
+import { z as z20 } from "@frontmcp/lazy-zod";
+var rbacRolesPolicySchema = z20.object({
+  all: z20.array(z20.string().min(1)).optional(),
+  any: z20.array(z20.string().min(1)).optional()
 }).refine((data) => data.all !== void 0 || data.any !== void 0, {
   message: 'Roles policy must have at least "all" or "any"'
 });
-var rbacPermissionsPolicySchema = z19.object({
-  all: z19.array(z19.string().min(1)).optional(),
-  any: z19.array(z19.string().min(1)).optional()
+var rbacPermissionsPolicySchema = z20.object({
+  all: z20.array(z20.string().min(1)).optional(),
+  any: z20.array(z20.string().min(1)).optional()
 }).refine((data) => data.all !== void 0 || data.any !== void 0, {
   message: 'Permissions policy must have at least "all" or "any"'
 });
-var abacOperatorSchema = z19.enum([
+var abacOperatorSchema = z20.enum([
   "eq",
   "neq",
   "in",
@@ -10181,55 +10225,55 @@ var abacOperatorSchema = z19.enum([
   "exists",
   "matches"
 ]);
-var abacConditionSchema = z19.object({
-  path: z19.string().min(1),
+var abacConditionSchema = z20.object({
+  path: z20.string().min(1),
   op: abacOperatorSchema,
-  value: z19.unknown()
+  value: z20.unknown()
 });
-var abacPolicySchema = z19.object({
-  match: z19.record(z19.string(), z19.unknown()).optional(),
-  conditions: z19.array(abacConditionSchema).optional()
+var abacPolicySchema = z20.object({
+  match: z20.record(z20.string(), z20.unknown()).optional(),
+  conditions: z20.array(abacConditionSchema).optional()
 }).refine((data) => data.match !== void 0 || data.conditions !== void 0, {
   message: 'Attributes policy must have at least "match" or "conditions"'
 });
-var resourceIdRefSchema = z19.union([
-  z19.string().min(1),
-  z19.object({ fromInput: z19.string().min(1) }).strict(),
-  z19.object({ fromClaims: z19.string().min(1) }).strict()
+var resourceIdRefSchema = z20.union([
+  z20.string().min(1),
+  z20.object({ fromInput: z20.string().min(1) }).strict(),
+  z20.object({ fromClaims: z20.string().min(1) }).strict()
 ]);
-var rebacPolicySchema = z19.object({
-  type: z19.string().min(1),
-  resource: z19.string().min(1),
+var rebacPolicySchema = z20.object({
+  type: z20.string().min(1),
+  resource: z20.string().min(1),
   resourceId: resourceIdRefSchema
 });
 var basePolicyShape = {
   roles: rbacRolesPolicySchema.optional(),
   permissions: rbacPermissionsPolicySchema.optional(),
   attributes: abacPolicySchema.optional(),
-  relationships: z19.union([rebacPolicySchema, z19.array(rebacPolicySchema)]).optional(),
-  custom: z19.record(z19.string(), z19.unknown()).optional(),
-  guards: z19.array(z19.instanceof(Function)).optional(),
-  operator: z19.enum(["AND", "OR"]).optional()
+  relationships: z20.union([rebacPolicySchema, z20.array(rebacPolicySchema)]).optional(),
+  custom: z20.record(z20.string(), z20.unknown()).optional(),
+  guards: z20.array(z20.instanceof(Function)).optional(),
+  operator: z20.enum(["AND", "OR"]).optional()
 };
-var authoritiesPolicySchema = z19.lazy(
-  () => z19.object({
+var authoritiesPolicySchema = z20.lazy(
+  () => z20.object({
     ...basePolicyShape,
     not: authoritiesPolicySchema.optional(),
-    anyOf: z19.array(authoritiesPolicySchema).optional(),
-    allOf: z19.array(authoritiesPolicySchema).optional()
+    anyOf: z20.array(authoritiesPolicySchema).optional(),
+    allOf: z20.array(authoritiesPolicySchema).optional()
   })
 );
-var authoritiesMetadataSchema = z19.union([
-  z19.string().min(1),
-  z19.array(z19.string().min(1)).min(1),
+var authoritiesMetadataSchema = z20.union([
+  z20.string().min(1),
+  z20.array(z20.string().min(1)).min(1),
   authoritiesPolicySchema
 ]);
-var authoritiesClaimsMappingSchema = z19.record(z19.string(), z19.string().optional()).refine((data) => Object.values(data).some((v) => v !== void 0), {
+var authoritiesClaimsMappingSchema = z20.record(z20.string(), z20.string().optional()).refine((data) => Object.values(data).some((v) => v !== void 0), {
   message: "Claims mapping must have at least one mapping"
 });
-var authoritiesConfigSchema = z19.object({
+var authoritiesConfigSchema = z20.object({
   claimsMapping: authoritiesClaimsMappingSchema.optional(),
-  profiles: z19.record(z19.string().min(1), authoritiesPolicySchema).optional()
+  profiles: z20.record(z20.string().min(1), authoritiesPolicySchema).optional()
 });
 
 // libs/auth/src/authorities/authorities.evaluator.ts
@@ -10307,8 +10351,9 @@ function resolveValue(value, ctx) {
 }
 function applyOperator(actual, op, expected) {
   switch (op) {
+    // A missing expected value (e.g. an absent fromInput) never matches, even an absent actual value
     case "eq":
-      return actual === expected;
+      return expected !== void 0 && actual === expected;
     case "neq":
       return actual !== expected;
     case "in":
@@ -10357,7 +10402,7 @@ function evaluateAbac(policy, ctx) {
     for (const [path, expectedRaw] of Object.entries(policy.match)) {
       const actual = resolveDotPath(envelope, path);
       const expected = resolveValue(expectedRaw, ctx);
-      if (actual !== expected) {
+      if (expected === void 0 || actual !== expected) {
         return {
           granted: false,
           deniedBy: `attributes.match: '${path}' expected '${String(expected)}' but got '${String(actual)}'`,
@@ -10397,6 +10442,15 @@ function resolveResourceId(ref, ctx) {
   return void 0;
 }
 async function evaluateSingleRebac(policy, ctx) {
+  const userSub = ctx.user.sub;
+  if (userSub === void 0 || isAnonymousSubject(userSub)) {
+    return {
+      granted: false,
+      deniedBy: `relationships: an anonymous caller cannot be '${policy.type}' of ${policy.resource}`,
+      denial: { kind: "relationships", path: "user.sub", expected: "a signed-in caller", actual: void 0 },
+      evaluatedPolicies: ["relationships"]
+    };
+  }
   const resourceId = resolveResourceId(policy.resourceId, ctx);
   if (resourceId === void 0) {
     return {
@@ -10411,11 +10465,11 @@ async function evaluateSingleRebac(policy, ctx) {
       evaluatedPolicies: ["relationships"]
     };
   }
-  const hasRelationship = await ctx.relationships.check(policy.type, policy.resource, resourceId, ctx.user.sub, ctx);
+  const hasRelationship = await ctx.relationships.check(policy.type, policy.resource, resourceId, userSub, ctx);
   if (!hasRelationship) {
     return {
       granted: false,
-      deniedBy: `relationships: user '${ctx.user.sub}' is not '${policy.type}' of ${policy.resource}:${resourceId}`,
+      deniedBy: `relationships: user '${userSub}' is not '${policy.type}' of ${policy.resource}:${resourceId}`,
       denial: {
         kind: "relationships",
         path: "relationships",
@@ -10932,6 +10986,8 @@ export {
   InMemoryStoreRequiredError,
   InvalidClientIdUrlError,
   JwksService,
+  JwtSecretRequiredError,
+  JwtSecretWeakError,
   LazyCredentialLoader,
   NoProviderIdError,
   NullOrchestratedAuthAccessor,
@@ -11086,6 +11142,7 @@ export {
   headerApplier,
   hkdfSha2564 as hkdfSha256,
   incrementalAuthConfigSchema,
+  isAnonymousSubject,
   isCimdClientId,
   isFrontMcpCredentials,
   isJwt,
@@ -11102,6 +11159,7 @@ export {
   isSoonExpiring,
   isSoonExpiringProvider,
   isSqliteTokenStorage,
+  isStaticMode,
   isTransparentMode,
   jsonWebKeySetSchema,
   jwkParametersSchema,
@@ -11161,6 +11219,7 @@ export {
   startNextProvider,
   statefulHttpTransportStateSchema,
   statelessHttpTransportStateSchema,
+  staticAuthOptionsSchema,
   storedSessionSchema,
   streamableHttpTransportStateSchema,
   toEpochSeconds,